redline | 753d498b51ca76be3218a2ce7fa90488b8e129fe4733db056cd32ae06c539d92

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2023, 09:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f497be70573e3a4cfc122af82edc822d.exe
Size 831KB
Sample230819-lr665agg93
SHA256 753d498b51ca76be3218a2ce7fa90488b8e129fe4733db056cd32ae06c539d92
MD5 f497be70573e3a4cfc122af82edc822d
SHA1 da01174d4b312c855112683f9ce77aa1648e91b8
SHA512 6de050ecd35593d7590408c5dc686601738efcea5944b760f6578e51986ede17ac3f9e84c5a2e0e5ed0ed796a805c92ceeaf3a0a9ac4ed3b596120492e868aa6
SSDEEP 24576:eyh+NGmKOdGnYkYnF2s87aGP8SV0RNpQ:tTOdGnfYnF27R5V0R
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline dugin infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

dugin

77.91.124.73:19071

Attributes

auth_value
7c3e46e091100fd26a6076996d374c28

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 5 IoCs

pid	Process
4372	z6475834.exe
4756	z9075883.exe
2960	z4702271.exe
4508	r5153373.exe
3668	s7932093.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	f497be70573e3a4cfc122af82edc822d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z6475834.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z9075883.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z4702271.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 4372	1448	f497be70573e3a4cfc122af82edc822d.exe	80
PID 1448 wrote to memory of 4372	1448	f497be70573e3a4cfc122af82edc822d.exe	80
PID 1448 wrote to memory of 4372	1448	f497be70573e3a4cfc122af82edc822d.exe	80
PID 4372 wrote to memory of 4756	4372	z6475834.exe	81
PID 4372 wrote to memory of 4756	4372	z6475834.exe	81
PID 4372 wrote to memory of 4756	4372	z6475834.exe	81
PID 4756 wrote to memory of 2960	4756	z9075883.exe	82
PID 4756 wrote to memory of 2960	4756	z9075883.exe	82
PID 4756 wrote to memory of 2960	4756	z9075883.exe	82
PID 2960 wrote to memory of 4508	2960	z4702271.exe	83
PID 2960 wrote to memory of 4508	2960	z4702271.exe	83
PID 2960 wrote to memory of 4508	2960	z4702271.exe	83
PID 2960 wrote to memory of 3668	2960	z4702271.exe	84
PID 2960 wrote to memory of 3668	2960	z4702271.exe	84
PID 2960 wrote to memory of 3668	2960	z4702271.exe	84

C:\Users\Admin\AppData\Local\Temp\f497be70573e3a4cfc122af82edc822d.exe
"C:\Users\Admin\AppData\Local\Temp\f497be70573e3a4cfc122af82edc822d.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6475834.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6475834.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9075883.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9075883.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4756
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4702271.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4702271.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\r5153373.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\r5153373.exe
        5⤵
        Executes dropped EXE
        
        PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7932093.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7932093.exe
        5⤵
        Executes dropped EXE
        
        PID:3668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

z6475834.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6475834.exe
Size 598KB
SHA256 5b8850308939fb97cdcd38e05651b08fa37c02cf4f3dbadf73bb4d7d844209f0
MD5 7d3ca7ca9ded50b668381e522341f6ea
SHA1 3947c9b405bddaa91fc518cab5915ea03c4242c7
SHA512 1dab8ca2d20b602a520337b15e09013af611413031e20b085ad0324f9a43b3e45a9cb0a099df83d3439dacf3f8f956717db22fd95c0cbdcd32e1d6c799f906da
SSDEEP 12288:DMrzy90YICe2VGnYEcO6/Bi3GiIK8bBsJElaDPWgWX:gyRbVGnYSui3usJ+aDPpWX
MD5 SHA1 SHA512 SSDEEP

Submit Download

z6475834.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6475834.exe
Size 598KB
SHA256 5b8850308939fb97cdcd38e05651b08fa37c02cf4f3dbadf73bb4d7d844209f0
MD5 7d3ca7ca9ded50b668381e522341f6ea
SHA1 3947c9b405bddaa91fc518cab5915ea03c4242c7
SHA512 1dab8ca2d20b602a520337b15e09013af611413031e20b085ad0324f9a43b3e45a9cb0a099df83d3439dacf3f8f956717db22fd95c0cbdcd32e1d6c799f906da
SSDEEP 12288:DMrzy90YICe2VGnYEcO6/Bi3GiIK8bBsJElaDPWgWX:gyRbVGnYSui3usJ+aDPpWX
MD5 SHA1 SHA512 SSDEEP

Submit Download

z9075883.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9075883.exe
Size 372KB
SHA256 a18c5f91b75af5ac56c24307db4b2dfd92761061a5ceabcf497768bc10299f58
MD5 75960348a0db7eba5c41238663b19c9b
SHA1 8db0910d2c16266ae0a80a05b238b4231ca6c3d8
SHA512 defd84c17ab93c25e80fdea1286eea676ff7f1142793bfbd8334e5e413b9ebcf2015b6e99ea0b3fcaed835caf1431d0406716fc2a29a27997b9c55b1b5370d0b
SSDEEP 6144:KDy+bnr+tp0yN90QEleLl1IjlJFjC13+203yX5psil/Ze6AgBYOjNso:VMrBy90Sx1IjlJFjiF0i3silZ1bBso
MD5 SHA1 SHA512 SSDEEP

Submit Download

z9075883.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9075883.exe
Size 372KB
SHA256 a18c5f91b75af5ac56c24307db4b2dfd92761061a5ceabcf497768bc10299f58
MD5 75960348a0db7eba5c41238663b19c9b
SHA1 8db0910d2c16266ae0a80a05b238b4231ca6c3d8
SHA512 defd84c17ab93c25e80fdea1286eea676ff7f1142793bfbd8334e5e413b9ebcf2015b6e99ea0b3fcaed835caf1431d0406716fc2a29a27997b9c55b1b5370d0b
SSDEEP 6144:KDy+bnr+tp0yN90QEleLl1IjlJFjC13+203yX5psil/Ze6AgBYOjNso:VMrBy90Sx1IjlJFjiF0i3silZ1bBso
MD5 SHA1 SHA512 SSDEEP

Submit Download

z4702271.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4702271.exe
Size 271KB
SHA256 edd947fc6199a00e2f0d5a2cbe0df6cc005eacef90aa0943bd857c1d4fea3402
MD5 1bfa528869de4d000ff09e8245112bb0
SHA1 3f3f5af2211c2d8a864b16042f799ef0c6ac0622
SHA512 5277221e3c7ae03c731bbf79f24550156604346509884cfbbf34c3a83a951f60fc64aba9bbb5863ce29c023e290eb471b2d4a3b2936d25dabb9730889f713f7b
SSDEEP 6144:K+y+bnr+np0yN90QEdpyilaZ/hLt0Y1W8y0J:mMrDy90lyi0Zp6zo
MD5 SHA1 SHA512 SSDEEP

Submit Download

z4702271.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4702271.exe
Size 271KB
SHA256 edd947fc6199a00e2f0d5a2cbe0df6cc005eacef90aa0943bd857c1d4fea3402
MD5 1bfa528869de4d000ff09e8245112bb0
SHA1 3f3f5af2211c2d8a864b16042f799ef0c6ac0622
SHA512 5277221e3c7ae03c731bbf79f24550156604346509884cfbbf34c3a83a951f60fc64aba9bbb5863ce29c023e290eb471b2d4a3b2936d25dabb9730889f713f7b
SSDEEP 6144:K+y+bnr+np0yN90QEdpyilaZ/hLt0Y1W8y0J:mMrDy90lyi0Zp6zo
MD5 SHA1 SHA512 SSDEEP

Submit Download

r5153373.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\r5153373.exe
Size 140KB
SHA256 0fcb9c3965ee7f2c36d232a624e0769542916f207ab4118a1e6d56fabffb3675
MD5 77a93a6afb1d7fa81c674cbecbee8531
SHA1 fbd5275cea45278e48c3306c5e069619cdf038b3
SHA512 dc09b69e4ba62ccbb61310d39d185ad06e3e74759cfeb193a0d626ee36f35f27dd51f22425985884dd88143c5c24cbbb1da74e105c0adcc33a3a53e9b898d40e
SSDEEP 3072:x3A8KZSuCoIO/pLS0CvFOdVBf2FwUZWUE9wpDV+hb5lPmZzP8aKVJ:xkZSiO0pBE+55YKVJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

r5153373.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\r5153373.exe
Size 140KB
SHA256 0fcb9c3965ee7f2c36d232a624e0769542916f207ab4118a1e6d56fabffb3675
MD5 77a93a6afb1d7fa81c674cbecbee8531
SHA1 fbd5275cea45278e48c3306c5e069619cdf038b3
SHA512 dc09b69e4ba62ccbb61310d39d185ad06e3e74759cfeb193a0d626ee36f35f27dd51f22425985884dd88143c5c24cbbb1da74e105c0adcc33a3a53e9b898d40e
SSDEEP 3072:x3A8KZSuCoIO/pLS0CvFOdVBf2FwUZWUE9wpDV+hb5lPmZzP8aKVJ:xkZSiO0pBE+55YKVJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

s7932093.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7932093.exe
Size 173KB
SHA256 64b6558c24af070e047262ad247dc64b968f8d919a5c9bb2b5c279931ef38db0
MD5 d5f3785f09b0b4ddb516cb1bba85a36d
SHA1 978b0c33233c9ab63a596cbb282473f1e99b07d4
SHA512 40f87989963ef21438f1378eb4b8f4d736bf7de67d2a12670faa6f94ab221dfb475eed8cec99208539e0a06e61ef987f8a7a5cb759442fc79583200b393611fb
SSDEEP 3072:eTS18qdsI0PBESjOvGew8Z88FQE02quBoeaTJ38e8hr:eTSfsI0PBESOZ88FQE0QoeaTR
MD5 SHA1 SHA512 SSDEEP

Submit Download

s7932093.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7932093.exe
Size 173KB
SHA256 64b6558c24af070e047262ad247dc64b968f8d919a5c9bb2b5c279931ef38db0
MD5 d5f3785f09b0b4ddb516cb1bba85a36d
SHA1 978b0c33233c9ab63a596cbb282473f1e99b07d4
SHA512 40f87989963ef21438f1378eb4b8f4d736bf7de67d2a12670faa6f94ab221dfb475eed8cec99208539e0a06e61ef987f8a7a5cb759442fc79583200b393611fb
SSDEEP 3072:eTS18qdsI0PBESjOvGew8Z88FQE02quBoeaTJ38e8hr:eTSfsI0PBESOZ88FQE0QoeaTR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3668-164-0x0000000000A60000-0x0000000000A90000-memory.dmp

Download

memory/3668-165-0x00000000748A0000-0x0000000075050000-memory.dmp

Download

memory/3668-166-0x0000000005C30000-0x0000000006248000-memory.dmp

Download

memory/3668-167-0x0000000005720000-0x000000000582A000-memory.dmp

Download

memory/3668-168-0x0000000005500000-0x0000000005510000-memory.dmp

Download

memory/3668-169-0x0000000002FD0000-0x0000000002FE2000-memory.dmp

Download

memory/3668-170-0x00000000054B0000-0x00000000054EC000-memory.dmp

Download

memory/3668-171-0x00000000748A0000-0x0000000075050000-memory.dmp

Download

memory/3668-172-0x0000000005500000-0x0000000005510000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads