redline | 3fcc6830fb99b359dce15bf876b4d279d8750c82d643548c29fcfc45184cdc5a

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2023, 00:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
98d935c6f75ba3f5f7c5916c3a64d3b2.exe
Size 838KB
Sample230819-a4msgafd62
SHA256 3fcc6830fb99b359dce15bf876b4d279d8750c82d643548c29fcfc45184cdc5a
MD5 98d935c6f75ba3f5f7c5916c3a64d3b2
SHA1 5ff586567d6627b81cb95c3f20f136826ded8f8e
SHA512 b3def3a07b1517f4ba3b92f0287139b34113d00fca0377e461374932a2750c406a653b3d0467d50dd65f34b58fb5ae1f73082abc9d605d951f93e17df9b437cf
SSDEEP 12288:+Mrzy90RTUNipa0P8q/wzweixJu0CIGq51XhOJMLGtsGASd6zha9:1yITKyLwzweixJujq2CPZha9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline dugin infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

dugin

77.91.124.73:19071

Attributes

auth_value
7c3e46e091100fd26a6076996d374c28

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 6 IoCs

pid	Process
4776	v8885200.exe
4768	v8283322.exe
3424	v9713537.exe
2716	v7757786.exe
3468	a1243200.exe
2408	b0736354.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v9713537.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	v7757786.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	98d935c6f75ba3f5f7c5916c3a64d3b2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v8885200.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v8283322.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3360 wrote to memory of 4776	3360	98d935c6f75ba3f5f7c5916c3a64d3b2.exe	83
PID 3360 wrote to memory of 4776	3360	98d935c6f75ba3f5f7c5916c3a64d3b2.exe	83
PID 3360 wrote to memory of 4776	3360	98d935c6f75ba3f5f7c5916c3a64d3b2.exe	83
PID 4776 wrote to memory of 4768	4776	v8885200.exe	84
PID 4776 wrote to memory of 4768	4776	v8885200.exe	84
PID 4776 wrote to memory of 4768	4776	v8885200.exe	84
PID 4768 wrote to memory of 3424	4768	v8283322.exe	85
PID 4768 wrote to memory of 3424	4768	v8283322.exe	85
PID 4768 wrote to memory of 3424	4768	v8283322.exe	85
PID 3424 wrote to memory of 2716	3424	v9713537.exe	86
PID 3424 wrote to memory of 2716	3424	v9713537.exe	86
PID 3424 wrote to memory of 2716	3424	v9713537.exe	86
PID 2716 wrote to memory of 3468	2716	v7757786.exe	87
PID 2716 wrote to memory of 3468	2716	v7757786.exe	87
PID 2716 wrote to memory of 3468	2716	v7757786.exe	87
PID 2716 wrote to memory of 2408	2716	v7757786.exe	88
PID 2716 wrote to memory of 2408	2716	v7757786.exe	88
PID 2716 wrote to memory of 2408	2716	v7757786.exe	88

C:\Users\Admin\AppData\Local\Temp\98d935c6f75ba3f5f7c5916c3a64d3b2.exe
"C:\Users\Admin\AppData\Local\Temp\98d935c6f75ba3f5f7c5916c3a64d3b2.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8885200.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8885200.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8283322.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8283322.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4768
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9713537.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9713537.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7757786.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7757786.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1243200.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1243200.exe
        6⤵
        Executes dropped EXE
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b0736354.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b0736354.exe
        6⤵
        Executes dropped EXE
        
        PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

v8885200.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8885200.exe
Size 723KB
SHA256 7c547c17126a6209a33d5edc9b602cbbf71e57b90138ab77c56ebc7f32de64c3
MD5 e7acdc634641556be8c14dd13530b925
SHA1 27a55d35b451bb7c6c0dd1b17209f564d33e62d0
SHA512 1aee1a5ab3c45d88a66982c6415748fb4fc6ef7f08dc4e97b09a1509567a673008f949f4bd6eb47885c88171b1086fc2bd05303cf9e0532d6987e60da64799ca
SSDEEP 12288:jMrdy90sPjq/FfVeikJqdCITq51XtOiMq5lfGmSd6/q:iyxiFfVeikJqsLxjtFq
MD5 SHA1 SHA512 SSDEEP

Submit Download

v8885200.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8885200.exe
Size 723KB
SHA256 7c547c17126a6209a33d5edc9b602cbbf71e57b90138ab77c56ebc7f32de64c3
MD5 e7acdc634641556be8c14dd13530b925
SHA1 27a55d35b451bb7c6c0dd1b17209f564d33e62d0
SHA512 1aee1a5ab3c45d88a66982c6415748fb4fc6ef7f08dc4e97b09a1509567a673008f949f4bd6eb47885c88171b1086fc2bd05303cf9e0532d6987e60da64799ca
SSDEEP 12288:jMrdy90sPjq/FfVeikJqdCITq51XtOiMq5lfGmSd6/q:iyxiFfVeikJqsLxjtFq
MD5 SHA1 SHA512 SSDEEP

Submit Download

v8283322.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8283322.exe
Size 598KB
SHA256 40dc8d8f4600b3ed12e8aec6b3a0b696b8314d15db1ab6ed261fee3f404ae3fc
MD5 8986d5a5de708f06f5ddec9e7f8bedd8
SHA1 234af7cb3338fa5a4206e15f3b2d011ad83d8afa
SHA512 ff626d064329fd0738519779e3e2c727485e5bf523b7f10e8cd430ebceb38d56b2da8036709971be78661d2af27acc4ce695cef7291aef22a8936b060e170269
SSDEEP 12288:/MrEy90nA0s6vzcJOvCI9q61itZqxk1UZGZ:ny3dMoJOaZe2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

v8283322.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8283322.exe
Size 598KB
SHA256 40dc8d8f4600b3ed12e8aec6b3a0b696b8314d15db1ab6ed261fee3f404ae3fc
MD5 8986d5a5de708f06f5ddec9e7f8bedd8
SHA1 234af7cb3338fa5a4206e15f3b2d011ad83d8afa
SHA512 ff626d064329fd0738519779e3e2c727485e5bf523b7f10e8cd430ebceb38d56b2da8036709971be78661d2af27acc4ce695cef7291aef22a8936b060e170269
SSDEEP 12288:/MrEy90nA0s6vzcJOvCI9q61itZqxk1UZGZ:ny3dMoJOaZe2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

v9713537.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9713537.exe
Size 372KB
SHA256 6e100c94e14795d26eeae25f52bb6c1caa6a80c00fcf4c2ee771517e08108870
MD5 8f603c88cbd9d6538243027b9fd0e72a
SHA1 beaf6f5a9c445497adf4a2101e6cb840c92f53cf
SHA512 0f65af6486e8acfc432307bfff5b2abc07a6158d0a9450969545e7c68854a65f2a0909fd680f94055a0c2e54048cb9c2e71b396c421c6720bf5dfa710eccc3b3
SSDEEP 6144:Kdy+bnr+zp0yN90QEN7xvZHoEwNBWqOpsilkZ+c7uvS6bTDFp5Lm0N:nMrny90n7tbw7Wq6siGZ+4Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

v9713537.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9713537.exe
Size 372KB
SHA256 6e100c94e14795d26eeae25f52bb6c1caa6a80c00fcf4c2ee771517e08108870
MD5 8f603c88cbd9d6538243027b9fd0e72a
SHA1 beaf6f5a9c445497adf4a2101e6cb840c92f53cf
SHA512 0f65af6486e8acfc432307bfff5b2abc07a6158d0a9450969545e7c68854a65f2a0909fd680f94055a0c2e54048cb9c2e71b396c421c6720bf5dfa710eccc3b3
SSDEEP 6144:Kdy+bnr+zp0yN90QEN7xvZHoEwNBWqOpsilkZ+c7uvS6bTDFp5Lm0N:nMrny90n7tbw7Wq6siGZ+4Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

v7757786.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7757786.exe
Size 271KB
SHA256 ba7b5cc4b30468e24bb5af133dfe983e92a09c7e9868aff1960a823b53aec540
MD5 ce646f2df7ff9a3b94ab5b729656859a
SHA1 d2032435fb50e89439ceaecbfe7865e8d1ce220b
SHA512 9497de2eae81179d7208f5cc1188f1646b9a797646d8e99582b4179da9255dbb1138796c943cf4516ab80730cb1736f385adab656ed09ec7620615bfad651efa
SSDEEP 6144:KKy+bnr+Gp0yN90QEJpyilaZ/hLt0Y1W8y0H:iMrGy90Vyi0Zp6zi
MD5 SHA1 SHA512 SSDEEP

Submit Download

v7757786.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7757786.exe
Size 271KB
SHA256 ba7b5cc4b30468e24bb5af133dfe983e92a09c7e9868aff1960a823b53aec540
MD5 ce646f2df7ff9a3b94ab5b729656859a
SHA1 d2032435fb50e89439ceaecbfe7865e8d1ce220b
SHA512 9497de2eae81179d7208f5cc1188f1646b9a797646d8e99582b4179da9255dbb1138796c943cf4516ab80730cb1736f385adab656ed09ec7620615bfad651efa
SSDEEP 6144:KKy+bnr+Gp0yN90QEJpyilaZ/hLt0Y1W8y0H:iMrGy90Vyi0Zp6zi
MD5 SHA1 SHA512 SSDEEP

Submit Download

a1243200.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1243200.exe
Size 140KB
SHA256 0fcb9c3965ee7f2c36d232a624e0769542916f207ab4118a1e6d56fabffb3675
MD5 77a93a6afb1d7fa81c674cbecbee8531
SHA1 fbd5275cea45278e48c3306c5e069619cdf038b3
SHA512 dc09b69e4ba62ccbb61310d39d185ad06e3e74759cfeb193a0d626ee36f35f27dd51f22425985884dd88143c5c24cbbb1da74e105c0adcc33a3a53e9b898d40e
SSDEEP 3072:x3A8KZSuCoIO/pLS0CvFOdVBf2FwUZWUE9wpDV+hb5lPmZzP8aKVJ:xkZSiO0pBE+55YKVJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

a1243200.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1243200.exe
Size 140KB
SHA256 0fcb9c3965ee7f2c36d232a624e0769542916f207ab4118a1e6d56fabffb3675
MD5 77a93a6afb1d7fa81c674cbecbee8531
SHA1 fbd5275cea45278e48c3306c5e069619cdf038b3
SHA512 dc09b69e4ba62ccbb61310d39d185ad06e3e74759cfeb193a0d626ee36f35f27dd51f22425985884dd88143c5c24cbbb1da74e105c0adcc33a3a53e9b898d40e
SSDEEP 3072:x3A8KZSuCoIO/pLS0CvFOdVBf2FwUZWUE9wpDV+hb5lPmZzP8aKVJ:xkZSiO0pBE+55YKVJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

b0736354.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b0736354.exe
Size 173KB
SHA256 64b6558c24af070e047262ad247dc64b968f8d919a5c9bb2b5c279931ef38db0
MD5 d5f3785f09b0b4ddb516cb1bba85a36d
SHA1 978b0c33233c9ab63a596cbb282473f1e99b07d4
SHA512 40f87989963ef21438f1378eb4b8f4d736bf7de67d2a12670faa6f94ab221dfb475eed8cec99208539e0a06e61ef987f8a7a5cb759442fc79583200b393611fb
SSDEEP 3072:eTS18qdsI0PBESjOvGew8Z88FQE02quBoeaTJ38e8hr:eTSfsI0PBESOZ88FQE0QoeaTR
MD5 SHA1 SHA512 SSDEEP

Submit Download

b0736354.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b0736354.exe
Size 173KB
SHA256 64b6558c24af070e047262ad247dc64b968f8d919a5c9bb2b5c279931ef38db0
MD5 d5f3785f09b0b4ddb516cb1bba85a36d
SHA1 978b0c33233c9ab63a596cbb282473f1e99b07d4
SHA512 40f87989963ef21438f1378eb4b8f4d736bf7de67d2a12670faa6f94ab221dfb475eed8cec99208539e0a06e61ef987f8a7a5cb759442fc79583200b393611fb
SSDEEP 3072:eTS18qdsI0PBESjOvGew8Z88FQE02quBoeaTJ38e8hr:eTSfsI0PBESOZ88FQE0QoeaTR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2408-171-0x0000000000120000-0x0000000000150000-memory.dmp

Download

memory/2408-172-0x00000000740D0000-0x0000000074880000-memory.dmp

Download

memory/2408-173-0x000000000A560000-0x000000000AB78000-memory.dmp

Download

memory/2408-174-0x000000000A0D0000-0x000000000A1DA000-memory.dmp

Download

memory/2408-175-0x0000000004A70000-0x0000000004A80000-memory.dmp

Download

memory/2408-176-0x000000000A010000-0x000000000A022000-memory.dmp

Download

memory/2408-177-0x000000000A070000-0x000000000A0AC000-memory.dmp

Download

memory/2408-178-0x00000000740D0000-0x0000000074880000-memory.dmp

Download

memory/2408-179-0x0000000004A70000-0x0000000004A80000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads