redline | b9cbbed3e5ad1281b2b3bb2c419932676fe8f3029a3ce541b1ea54a07cf5df3e

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2023, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e26214c95391693dbeb195f3505175fd.exe
Size 832KB
Sample230819-pc6tlahf62
SHA256 b9cbbed3e5ad1281b2b3bb2c419932676fe8f3029a3ce541b1ea54a07cf5df3e
MD5 e26214c95391693dbeb195f3505175fd
SHA1 158dea72e582db690adef0f214c8d51ed49b6ce7
SHA512 447ee48dedec5e9048d5e7eaf6c9ef1765b55e0d4e2d93a55c1406b1da7f0757b880b278ea50f091a78c9f804eb7f5ac03b44c1980582034ab196c69e7978cb9
SSDEEP 12288:HMrzy90htJhjrc9sm+9l874/mVspWwsb8TdrhvtQZXZOpHPbY6qay8yz:4yQZrWsPl874ob8BdeZpOpvbY6Fjyz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline jonka infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

jonka

77.91.124.73:19071

Attributes

auth_value
c95bc30cd252fa6dff2a19fd78bfab4e

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 5 IoCs

pid	Process
1116	z7759196.exe
3816	z0976848.exe
3552	z7460848.exe
3624	r9535526.exe
4244	s9066344.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	e26214c95391693dbeb195f3505175fd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z7759196.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z0976848.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z7460848.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3136 wrote to memory of 1116	3136	e26214c95391693dbeb195f3505175fd.exe	83
PID 3136 wrote to memory of 1116	3136	e26214c95391693dbeb195f3505175fd.exe	83
PID 3136 wrote to memory of 1116	3136	e26214c95391693dbeb195f3505175fd.exe	83
PID 1116 wrote to memory of 3816	1116	z7759196.exe	84
PID 1116 wrote to memory of 3816	1116	z7759196.exe	84
PID 1116 wrote to memory of 3816	1116	z7759196.exe	84
PID 3816 wrote to memory of 3552	3816	z0976848.exe	85
PID 3816 wrote to memory of 3552	3816	z0976848.exe	85
PID 3816 wrote to memory of 3552	3816	z0976848.exe	85
PID 3552 wrote to memory of 3624	3552	z7460848.exe	86
PID 3552 wrote to memory of 3624	3552	z7460848.exe	86
PID 3552 wrote to memory of 3624	3552	z7460848.exe	86
PID 3552 wrote to memory of 4244	3552	z7460848.exe	87
PID 3552 wrote to memory of 4244	3552	z7460848.exe	87
PID 3552 wrote to memory of 4244	3552	z7460848.exe	87

C:\Users\Admin\AppData\Local\Temp\e26214c95391693dbeb195f3505175fd.exe
"C:\Users\Admin\AppData\Local\Temp\e26214c95391693dbeb195f3505175fd.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7759196.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7759196.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0976848.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0976848.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3816
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7460848.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7460848.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\r9535526.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\r9535526.exe
        5⤵
        Executes dropped EXE
        
        PID:3624
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9066344.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9066344.exe
        5⤵
        Executes dropped EXE
        
        PID:4244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

z7759196.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7759196.exe
Size 598KB
SHA256 21ab6ecf51cbf8a1c7a3b9e7c5376dcf9c64b75c97acd87443a898a275c5c9f1
MD5 521a633c42d4d45283dce7fbfdb8312f
SHA1 493a7c960420eb931cbcff3c9e202d88d3551f6c
SHA512 8ddf3eeb8adbed122294779fa5745c295b1a1ee3013ce2f9244f82dda72275ef952fa438b2b475af154c7554c439129e6a643aa02394e99c87f5560fb406a97e
SSDEEP 12288:UMryy90fHsZ9lQG4DjTspTwsdsTj7hEtQZPZO+b:WynlQG4SdsXtnZxO+b
MD5 SHA1 SHA512 SSDEEP

Submit Download

z7759196.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7759196.exe
Size 598KB
SHA256 21ab6ecf51cbf8a1c7a3b9e7c5376dcf9c64b75c97acd87443a898a275c5c9f1
MD5 521a633c42d4d45283dce7fbfdb8312f
SHA1 493a7c960420eb931cbcff3c9e202d88d3551f6c
SHA512 8ddf3eeb8adbed122294779fa5745c295b1a1ee3013ce2f9244f82dda72275ef952fa438b2b475af154c7554c439129e6a643aa02394e99c87f5560fb406a97e
SSDEEP 12288:UMryy90fHsZ9lQG4DjTspTwsdsTj7hEtQZPZO+b:WynlQG4SdsXtnZxO+b
MD5 SHA1 SHA512 SSDEEP

Submit Download

z0976848.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0976848.exe
Size 372KB
SHA256 e6c6c895e725c3ec5f8e2335f971e4a8f086ef8f2b4273a5e8c0ea190baae7ee
MD5 de88a9ba074254303a6ab43af7b81727
SHA1 e9e028dc630e64c8c8ec603cc066bcc21c7eaba1
SHA512 752ba28b46b7e581c4465fe52c922e1742addb4e23f0fb9dc0b19bf15ea4de5190a3b5556d9e833c2707ed7375d3dfce74e63a2a6e7ec5e6db4294bc16d73269
SSDEEP 6144:K/y+bnr+8p0yN90QElGOFoFHkA+U/2IB+qhZjnspM3wcdDJAt+lTK2OYwvL:lMr0y90zrHE2/KnspuwsGATTW
MD5 SHA1 SHA512 SSDEEP

Submit Download

z0976848.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0976848.exe
Size 372KB
SHA256 e6c6c895e725c3ec5f8e2335f971e4a8f086ef8f2b4273a5e8c0ea190baae7ee
MD5 de88a9ba074254303a6ab43af7b81727
SHA1 e9e028dc630e64c8c8ec603cc066bcc21c7eaba1
SHA512 752ba28b46b7e581c4465fe52c922e1742addb4e23f0fb9dc0b19bf15ea4de5190a3b5556d9e833c2707ed7375d3dfce74e63a2a6e7ec5e6db4294bc16d73269
SSDEEP 6144:K/y+bnr+8p0yN90QElGOFoFHkA+U/2IB+qhZjnspM3wcdDJAt+lTK2OYwvL:lMr0y90zrHE2/KnspuwsGATTW
MD5 SHA1 SHA512 SSDEEP

Submit Download

z7460848.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7460848.exe
Size 271KB
SHA256 8796069f605c84b385df558740f61c135f613028865b6074626453f474d51863
MD5 5b456b380013f7fad0eb5fd1462ab9dd
SHA1 956f85e98db12ae8448bbf715909fbcce71b947c
SHA512 d66f1300784fcd33e61be180e371da71d5cff530b2e06350e34cd9ccc31ab43435b87697e6594cef7f7e51fc8470f6dee37ac716e3cf4576bf649040f18ed067
SSDEEP 6144:Kjy+bnr+Fp0yN90QEqjgsKM3wcdDJ7wIw6OsPWHRZX:9Mr5y90MgsKuwsk6DPuR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

z7460848.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7460848.exe
Size 271KB
SHA256 8796069f605c84b385df558740f61c135f613028865b6074626453f474d51863
MD5 5b456b380013f7fad0eb5fd1462ab9dd
SHA1 956f85e98db12ae8448bbf715909fbcce71b947c
SHA512 d66f1300784fcd33e61be180e371da71d5cff530b2e06350e34cd9ccc31ab43435b87697e6594cef7f7e51fc8470f6dee37ac716e3cf4576bf649040f18ed067
SSDEEP 6144:Kjy+bnr+Fp0yN90QEqjgsKM3wcdDJ7wIw6OsPWHRZX:9Mr5y90MgsKuwsk6DPuR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

r9535526.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\r9535526.exe
Size 140KB
SHA256 119c842d3037762fc6de08df5927d13b70055dcbaa9b08813b8b699cca05ae4a
MD5 04cba969879eb44387e53ed42f474ffc
SHA1 5232c20370e125f0bb1f5bdd858253f492125483
SHA512 946da0fc06917a482c0fa41af6706dcf1a87ff926c3a765e4bb9bc90479bc682ea16d325cf66877505514b5a5e2f08e700bfa5a050fc986b76e4163370672dc8
SSDEEP 3072:V3A8KoSubILO/pLd0Cp0Olrf22cLail/WDiva+Fr5phmZzPGaAVJ:VkoS2x0aLiZ5MAVJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

r9535526.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\r9535526.exe
Size 140KB
SHA256 119c842d3037762fc6de08df5927d13b70055dcbaa9b08813b8b699cca05ae4a
MD5 04cba969879eb44387e53ed42f474ffc
SHA1 5232c20370e125f0bb1f5bdd858253f492125483
SHA512 946da0fc06917a482c0fa41af6706dcf1a87ff926c3a765e4bb9bc90479bc682ea16d325cf66877505514b5a5e2f08e700bfa5a050fc986b76e4163370672dc8
SSDEEP 3072:V3A8KoSubILO/pLd0Cp0Olrf22cLail/WDiva+Fr5phmZzPGaAVJ:VkoS2x0aLiZ5MAVJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

s9066344.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9066344.exe
Size 174KB
SHA256 d1cad7ca6edfcb9fccce2ef66023d1b652c6adcfc5ec6589034876e9d754d6ff
MD5 2873b8b66a547327aef437fc48099ffd
SHA1 7fb523346dc975c538e5d27b1cd657c39b267d42
SHA512 c73ce31d8b4a7ff4f44f5cef0789afe12a0942cb59e9d6d5fe0797923f27afad59572eadeb6905672a3d7b27fe75316eac5d76714ecc4da74f014c6ec23a80e7
SSDEEP 3072:jzyDoUefdkPI0iGEndlOzQnvqmqtlMyNhE04ys4x7sJo8e8hy:fHUjPI0iGEnd2msDNhE09x7su
MD5 SHA1 SHA512 SSDEEP

Submit Download

s9066344.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9066344.exe
Size 174KB
SHA256 d1cad7ca6edfcb9fccce2ef66023d1b652c6adcfc5ec6589034876e9d754d6ff
MD5 2873b8b66a547327aef437fc48099ffd
SHA1 7fb523346dc975c538e5d27b1cd657c39b267d42
SHA512 c73ce31d8b4a7ff4f44f5cef0789afe12a0942cb59e9d6d5fe0797923f27afad59572eadeb6905672a3d7b27fe75316eac5d76714ecc4da74f014c6ec23a80e7
SSDEEP 3072:jzyDoUefdkPI0iGEndlOzQnvqmqtlMyNhE04ys4x7sJo8e8hy:fHUjPI0iGEnd2msDNhE09x7su
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4244-164-0x0000000000070000-0x00000000000A0000-memory.dmp

Download

memory/4244-165-0x0000000073E50000-0x0000000074600000-memory.dmp

Download

memory/4244-166-0x0000000005170000-0x0000000005788000-memory.dmp

Download

memory/4244-167-0x0000000004C60000-0x0000000004D6A000-memory.dmp

Download

memory/4244-168-0x0000000002400000-0x0000000002410000-memory.dmp

Download

memory/4244-169-0x0000000004B50000-0x0000000004B62000-memory.dmp

Download

memory/4244-170-0x0000000004BB0000-0x0000000004BEC000-memory.dmp

Download

memory/4244-171-0x0000000073E50000-0x0000000074600000-memory.dmp

Download

memory/4244-172-0x0000000002400000-0x0000000002410000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads