redline | 7eb6bb9d3c6559c75fc2d76023136503f8aa676ed9ba4f01b1472ba403770ea1

Analysis

max time kernel
140s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2023, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b2f05fed4a2e5ba0ed6d5290cc61c328.exe
Size 730KB
Sample230818-vs4xtscc92
SHA256 7eb6bb9d3c6559c75fc2d76023136503f8aa676ed9ba4f01b1472ba403770ea1
MD5 b2f05fed4a2e5ba0ed6d5290cc61c328
SHA1 c129840be6c84fab11c877b84865c3d1ff98c882
SHA512 a6c497d3bd14ba71db713573ed0f94a7c05f59cee7b175f388104ba50d7be97e1f4d27f882c01b43defb0f388c39113a97a53eb581978961d8b305fad339722e
SSDEEP 12288:CMrUy90yKX/RrZ3gVrnVmalCQ68xvliBCkce22pJI1u6PjPAKWSGagX0gSe7rPML:6ybKX/VtCnlUkeLAZPcaglH0XDvNd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline dugin infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

dugin

77.91.124.73:19071

Attributes

auth_value
7c3e46e091100fd26a6076996d374c28

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 5 IoCs

pid	Process
1200	z2891798.exe
3080	z8945215.exe
4280	z4016820.exe
1380	r1911125.exe
4472	s3766382.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z2891798.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z8945215.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z4016820.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b2f05fed4a2e5ba0ed6d5290cc61c328.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 1200	2180	b2f05fed4a2e5ba0ed6d5290cc61c328.exe	82
PID 2180 wrote to memory of 1200	2180	b2f05fed4a2e5ba0ed6d5290cc61c328.exe	82
PID 2180 wrote to memory of 1200	2180	b2f05fed4a2e5ba0ed6d5290cc61c328.exe	82
PID 1200 wrote to memory of 3080	1200	z2891798.exe	83
PID 1200 wrote to memory of 3080	1200	z2891798.exe	83
PID 1200 wrote to memory of 3080	1200	z2891798.exe	83
PID 3080 wrote to memory of 4280	3080	z8945215.exe	84
PID 3080 wrote to memory of 4280	3080	z8945215.exe	84
PID 3080 wrote to memory of 4280	3080	z8945215.exe	84
PID 4280 wrote to memory of 1380	4280	z4016820.exe	85
PID 4280 wrote to memory of 1380	4280	z4016820.exe	85
PID 4280 wrote to memory of 1380	4280	z4016820.exe	85
PID 4280 wrote to memory of 4472	4280	z4016820.exe	86
PID 4280 wrote to memory of 4472	4280	z4016820.exe	86
PID 4280 wrote to memory of 4472	4280	z4016820.exe	86

C:\Users\Admin\AppData\Local\Temp\b2f05fed4a2e5ba0ed6d5290cc61c328.exe
"C:\Users\Admin\AppData\Local\Temp\b2f05fed4a2e5ba0ed6d5290cc61c328.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2891798.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2891798.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1200
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8945215.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8945215.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3080
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4016820.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4016820.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\r1911125.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\r1911125.exe
        5⤵
        Executes dropped EXE
        
        PID:1380
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s3766382.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s3766382.exe
        5⤵
        Executes dropped EXE
        
        PID:4472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

z2891798.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2891798.exe
Size 598KB
SHA256 191c45450f9bd6bc24e07f434566f206caa56e7941e834eaf8b950e71b217b58
MD5 299dd4e1a3046ba6f22731606e6f37a5
SHA1 ee9cb262acb276c456c3db277a9eb1c00f9edb38
SHA512 7ba14fa7e7cb300c2134efff790f2b732dbebe4b8ebbff1ac445b9d6e2e39a92579e9ec6ce2947f4c0a7731bc56a3a8f8a2280a3159aee51a41b1551ed09d88d
SSDEEP 12288:KMrsy90mmaICQ6VxvlkaC0cUh2iJKxuoujEAD2FGagXMgFU7CPMXDvsS:CyD6XUJMru3ag6e0XDvh
MD5 SHA1 SHA512 SSDEEP

Submit Download

z2891798.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2891798.exe
Size 598KB
SHA256 191c45450f9bd6bc24e07f434566f206caa56e7941e834eaf8b950e71b217b58
MD5 299dd4e1a3046ba6f22731606e6f37a5
SHA1 ee9cb262acb276c456c3db277a9eb1c00f9edb38
SHA512 7ba14fa7e7cb300c2134efff790f2b732dbebe4b8ebbff1ac445b9d6e2e39a92579e9ec6ce2947f4c0a7731bc56a3a8f8a2280a3159aee51a41b1551ed09d88d
SSDEEP 12288:KMrsy90mmaICQ6VxvlkaC0cUh2iJKxuoujEAD2FGagXMgFU7CPMXDvsS:CyD6XUJMru3ag6e0XDvh
MD5 SHA1 SHA512 SSDEEP

Submit Download

z8945215.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8945215.exe
Size 372KB
SHA256 731e9457cc1cb1375f1aef8d6b9f2dda3336e73f912c3c13b202d873d7bb1c7b
MD5 b2113964a1bdf3208cd0d7e096fcb492
SHA1 fd33f8c175ad0b53ee382507a552a65445b533be
SHA512 ba417edcef7742a4b54524ca82b64c00b164bae156a8f2f46c0b58954cb3af604d46b70f368368bf5843a4e0eb99eb56b39af2e76d903d5e9c397dc184ae3b0e
SSDEEP 6144:Kty+bnr+Np0yN90QEGwe7vzMrF6GQKc0lshA+psilUZ4T7SNMJFUqEAbQ:zMrBy90I7bMrF6Qchhsi2ZUuEUqEA0
MD5 SHA1 SHA512 SSDEEP

Submit Download

z8945215.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8945215.exe
Size 372KB
SHA256 731e9457cc1cb1375f1aef8d6b9f2dda3336e73f912c3c13b202d873d7bb1c7b
MD5 b2113964a1bdf3208cd0d7e096fcb492
SHA1 fd33f8c175ad0b53ee382507a552a65445b533be
SHA512 ba417edcef7742a4b54524ca82b64c00b164bae156a8f2f46c0b58954cb3af604d46b70f368368bf5843a4e0eb99eb56b39af2e76d903d5e9c397dc184ae3b0e
SSDEEP 6144:Kty+bnr+Np0yN90QEGwe7vzMrF6GQKc0lshA+psilUZ4T7SNMJFUqEAbQ:zMrBy90I7bMrF6Qchhsi2ZUuEUqEA0
MD5 SHA1 SHA512 SSDEEP

Submit Download

z4016820.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4016820.exe
Size 271KB
SHA256 e8d5851511be1614a09c4e0366eab1d40839971685001b7f2dff4a5d1a30673d
MD5 92106aa0a71714d55202917ccc38fc67
SHA1 6e4b366af5b371d739020cd3845e465c3e44ad2d
SHA512 9b67be8739be5c28880734258862a65ca03f73601ac978d02f07ee577ffceb4b121c6a9f79b3fd220d31e256c6796f383ef3a8189bcf6a913090458597a463ee
SSDEEP 6144:Kwy+bnr+bp0yN90QEJpyilaZ/hLt0Y1W8y0C:wMrHy90tyi0Zp6zj
MD5 SHA1 SHA512 SSDEEP

Submit Download

z4016820.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4016820.exe
Size 271KB
SHA256 e8d5851511be1614a09c4e0366eab1d40839971685001b7f2dff4a5d1a30673d
MD5 92106aa0a71714d55202917ccc38fc67
SHA1 6e4b366af5b371d739020cd3845e465c3e44ad2d
SHA512 9b67be8739be5c28880734258862a65ca03f73601ac978d02f07ee577ffceb4b121c6a9f79b3fd220d31e256c6796f383ef3a8189bcf6a913090458597a463ee
SSDEEP 6144:Kwy+bnr+bp0yN90QEJpyilaZ/hLt0Y1W8y0C:wMrHy90tyi0Zp6zj
MD5 SHA1 SHA512 SSDEEP

Submit Download

r1911125.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\r1911125.exe
Size 140KB
SHA256 0fcb9c3965ee7f2c36d232a624e0769542916f207ab4118a1e6d56fabffb3675
MD5 77a93a6afb1d7fa81c674cbecbee8531
SHA1 fbd5275cea45278e48c3306c5e069619cdf038b3
SHA512 dc09b69e4ba62ccbb61310d39d185ad06e3e74759cfeb193a0d626ee36f35f27dd51f22425985884dd88143c5c24cbbb1da74e105c0adcc33a3a53e9b898d40e
SSDEEP 3072:x3A8KZSuCoIO/pLS0CvFOdVBf2FwUZWUE9wpDV+hb5lPmZzP8aKVJ:xkZSiO0pBE+55YKVJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

r1911125.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\r1911125.exe
Size 140KB
SHA256 0fcb9c3965ee7f2c36d232a624e0769542916f207ab4118a1e6d56fabffb3675
MD5 77a93a6afb1d7fa81c674cbecbee8531
SHA1 fbd5275cea45278e48c3306c5e069619cdf038b3
SHA512 dc09b69e4ba62ccbb61310d39d185ad06e3e74759cfeb193a0d626ee36f35f27dd51f22425985884dd88143c5c24cbbb1da74e105c0adcc33a3a53e9b898d40e
SSDEEP 3072:x3A8KZSuCoIO/pLS0CvFOdVBf2FwUZWUE9wpDV+hb5lPmZzP8aKVJ:xkZSiO0pBE+55YKVJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

s3766382.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s3766382.exe
Size 173KB
SHA256 64b6558c24af070e047262ad247dc64b968f8d919a5c9bb2b5c279931ef38db0
MD5 d5f3785f09b0b4ddb516cb1bba85a36d
SHA1 978b0c33233c9ab63a596cbb282473f1e99b07d4
SHA512 40f87989963ef21438f1378eb4b8f4d736bf7de67d2a12670faa6f94ab221dfb475eed8cec99208539e0a06e61ef987f8a7a5cb759442fc79583200b393611fb
SSDEEP 3072:eTS18qdsI0PBESjOvGew8Z88FQE02quBoeaTJ38e8hr:eTSfsI0PBESOZ88FQE0QoeaTR
MD5 SHA1 SHA512 SSDEEP

Submit Download

s3766382.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s3766382.exe
Size 173KB
SHA256 64b6558c24af070e047262ad247dc64b968f8d919a5c9bb2b5c279931ef38db0
MD5 d5f3785f09b0b4ddb516cb1bba85a36d
SHA1 978b0c33233c9ab63a596cbb282473f1e99b07d4
SHA512 40f87989963ef21438f1378eb4b8f4d736bf7de67d2a12670faa6f94ab221dfb475eed8cec99208539e0a06e61ef987f8a7a5cb759442fc79583200b393611fb
SSDEEP 3072:eTS18qdsI0PBESjOvGew8Z88FQE02quBoeaTJ38e8hr:eTSfsI0PBESOZ88FQE0QoeaTR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4472-165-0x0000000074020000-0x00000000747D0000-memory.dmp

Download

memory/4472-164-0x00000000005C0000-0x00000000005F0000-memory.dmp

Download

memory/4472-166-0x00000000056B0000-0x0000000005CC8000-memory.dmp

Download

memory/4472-167-0x00000000051A0000-0x00000000052AA000-memory.dmp

Download

memory/4472-169-0x0000000005090000-0x00000000050A2000-memory.dmp

Download

memory/4472-168-0x0000000005080000-0x0000000005090000-memory.dmp

Download

memory/4472-170-0x00000000050F0000-0x000000000512C000-memory.dmp

Download

memory/4472-171-0x0000000074020000-0x00000000747D0000-memory.dmp

Download

memory/4472-172-0x0000000005080000-0x0000000005090000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads