redline | 344e886fb7e22bc78b9acadd8a6b62a04df0980e81a9d28421e2cff2478829a3

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2023, 16:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d20a7d4729946f23a0f47ee20b3c6863.exe
Size 373KB
Sample230907-tt757sbf4t
SHA256 344e886fb7e22bc78b9acadd8a6b62a04df0980e81a9d28421e2cff2478829a3
MD5 d20a7d4729946f23a0f47ee20b3c6863
SHA1 ee3555cd7f472981011521088f6fd0862ecae927
SHA512 5089d6d2c33b75dcc6644a5c09062676a840681839952e4b8ff3ded661a057bf55bb138a02d793b0e5bef0f685e3c50b51072d01a75d0cbb68a2d3bfed7fdcf4
SSDEEP 6144:KRy+bnr+np0yN90QEkwHZ4W7F3bv71u5Y5P4CKr5iQBvd1C3bgBd5LF4e:PMrLy90bFrv7MeUXybgj5B
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline mrak infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

mrak

77.91.124.82:19071

Attributes

auth_value
7d9a335ab5dfd42d374867c96fe25302

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
3020	y5113409.exe
2160	m5867982.exe
2492	n4901952.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	d20a7d4729946f23a0f47ee20b3c6863.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y5113409.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 3020	3060	d20a7d4729946f23a0f47ee20b3c6863.exe	85
PID 3060 wrote to memory of 3020	3060	d20a7d4729946f23a0f47ee20b3c6863.exe	85
PID 3060 wrote to memory of 3020	3060	d20a7d4729946f23a0f47ee20b3c6863.exe	85
PID 3020 wrote to memory of 2160	3020	y5113409.exe	86
PID 3020 wrote to memory of 2160	3020	y5113409.exe	86
PID 3020 wrote to memory of 2160	3020	y5113409.exe	86
PID 3020 wrote to memory of 2492	3020	y5113409.exe	89
PID 3020 wrote to memory of 2492	3020	y5113409.exe	89
PID 3020 wrote to memory of 2492	3020	y5113409.exe	89

C:\Users\Admin\AppData\Local\Temp\d20a7d4729946f23a0f47ee20b3c6863.exe
"C:\Users\Admin\AppData\Local\Temp\d20a7d4729946f23a0f47ee20b3c6863.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5113409.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5113409.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m5867982.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m5867982.exe
    3⤵
    - Executes dropped EXE
    PID:2160
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n4901952.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n4901952.exe
    3⤵
    - Executes dropped EXE
    PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

y5113409.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5113409.exe
Size 271KB
SHA256 2f306b0afe88273869d67c0917ae8a268c678b73f06cad1559a56f0eaaae8911
MD5 5a20fcb4711ba21871736493afbd5960
SHA1 5b47d98e2a31def2b54e1ddd4636c582b88e1bbd
SHA512 50592d84b505838c3dd6f2f72db7b75208ec92cf03d18ef6ad98164892c803eff7b1e98779daeee22d79f314ee78cb53af15e9e9c91d27cfd1773ea8f4feaf3b
SSDEEP 6144:KKy+bnr+hp0yN90QEeKeBiQBvd1C3w7AEybmpa:yMrNy90HKyw8V
MD5 SHA1 SHA512 SSDEEP

Submit Download

y5113409.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5113409.exe
Size 271KB
SHA256 2f306b0afe88273869d67c0917ae8a268c678b73f06cad1559a56f0eaaae8911
MD5 5a20fcb4711ba21871736493afbd5960
SHA1 5b47d98e2a31def2b54e1ddd4636c582b88e1bbd
SHA512 50592d84b505838c3dd6f2f72db7b75208ec92cf03d18ef6ad98164892c803eff7b1e98779daeee22d79f314ee78cb53af15e9e9c91d27cfd1773ea8f4feaf3b
SSDEEP 6144:KKy+bnr+hp0yN90QEeKeBiQBvd1C3w7AEybmpa:yMrNy90HKyw8V
MD5 SHA1 SHA512 SSDEEP

Submit Download

m5867982.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m5867982.exe
Size 140KB
SHA256 c95ed5f6345af52574ac77050af24e10db290e42182e1d3249549f7fae83c811
MD5 bf0fbbd363a3cf54d344d3e0f5fe2ac4
SHA1 6e613944d4c9879be8027b5797d09f607794adfb
SHA512 4347fef61e1b9ed240dff1e6e96bc141a572fecbc12b1f1be6fd85d52b765621ebdc625a80e066ee34bf78c0c69f0f4b8868eafa7a7c8efebe06bbfc1106d0ed
SSDEEP 3072:BMrwPG9SiG103j9DR0CvlIM00tob89UoxqhLPNH8Z4PJjfCp:e59SO10kOfJfCp
MD5 SHA1 SHA512 SSDEEP

Submit Download

m5867982.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m5867982.exe
Size 140KB
SHA256 c95ed5f6345af52574ac77050af24e10db290e42182e1d3249549f7fae83c811
MD5 bf0fbbd363a3cf54d344d3e0f5fe2ac4
SHA1 6e613944d4c9879be8027b5797d09f607794adfb
SHA512 4347fef61e1b9ed240dff1e6e96bc141a572fecbc12b1f1be6fd85d52b765621ebdc625a80e066ee34bf78c0c69f0f4b8868eafa7a7c8efebe06bbfc1106d0ed
SSDEEP 3072:BMrwPG9SiG103j9DR0CvlIM00tob89UoxqhLPNH8Z4PJjfCp:e59SO10kOfJfCp
MD5 SHA1 SHA512 SSDEEP

Submit Download

n4901952.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n4901952.exe
Size 176KB
SHA256 fb09f8bb6c30810ced80d3aa052e9f3eecb00ac7ea847f8947f2b6094b6e1949
MD5 ec9321013466e5f617e7748b5d121d7a
SHA1 b1c13a8afb946e470e814bab31ae7e9b463ebff1
SHA512 4194577ba404313d2aeadb22cc90b25697fe5fdb8dbe6a5b02215af08a4d1d91e87af1512ad423c39f05699fe82c5e858c1a5942eeac03aa9762514019faf710
SSDEEP 3072:0P7NPifVI0pMLGKOmT0xLbE2FE0CBFOshR0cJj8e8hv:e7sVI0pMLG/bxFE0GhR0cV
MD5 SHA1 SHA512 SSDEEP

Submit Download

n4901952.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n4901952.exe
Size 176KB
SHA256 fb09f8bb6c30810ced80d3aa052e9f3eecb00ac7ea847f8947f2b6094b6e1949
MD5 ec9321013466e5f617e7748b5d121d7a
SHA1 b1c13a8afb946e470e814bab31ae7e9b463ebff1
SHA512 4194577ba404313d2aeadb22cc90b25697fe5fdb8dbe6a5b02215af08a4d1d91e87af1512ad423c39f05699fe82c5e858c1a5942eeac03aa9762514019faf710
SSDEEP 3072:0P7NPifVI0pMLGKOmT0xLbE2FE0CBFOshR0cJj8e8hv:e7sVI0pMLG/bxFE0GhR0cV
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2492-17-0x00000000744A0000-0x0000000074C50000-memory.dmp

Download

memory/2492-18-0x00000000001B0000-0x00000000001E0000-memory.dmp

Download

memory/2492-19-0x000000000A690000-0x000000000ACA8000-memory.dmp

Download

memory/2492-20-0x000000000A180000-0x000000000A28A000-memory.dmp

Download

memory/2492-21-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

Download

memory/2492-22-0x000000000A090000-0x000000000A0A2000-memory.dmp

Download

memory/2492-23-0x000000000A0F0000-0x000000000A12C000-memory.dmp

Download

memory/2492-24-0x00000000744A0000-0x0000000074C50000-memory.dmp

Download

memory/2492-25-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads