redline | 37dcecb10fe64dfbddbdf1e1f1f54e8b354eab9e1c8aafee8e3ced756e5240d9

Analysis

max time kernel
138s
max time network
150s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
22/09/2023, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 567KB
Sample230922-apf2dabb8z
SHA256 37dcecb10fe64dfbddbdf1e1f1f54e8b354eab9e1c8aafee8e3ced756e5240d9
MD5 9d9cf159793727d6a2fae66f64d0f21c
SHA1 cd449b6d435b92f90db702b70f988459d1aeacde
SHA512 f31db6ec9187b36cebfba1aee567ab12a2331b2fa865ae85ee2baa06ee036e49160e0023da0e1fdaff857920515976a77db1bfd1e704c3327581a41adbd0b2eb
SSDEEP 12288:AMrMy90EoXEdSm/ujU1enkzTPoBb8QHBgMrbyrF9sizL7uEabHl:8y0EdxuIsnkzTPu1h2ndLSEwl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline trush infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

trush

77.91.124.82:19071

Attributes

auth_value
c13814867cde8193679cd0cad2d774be

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 2 IoCs

pid	Process
1708	v8803833.exe
1372	a0895330.exe

Loads dropped DLL 9 IoCs

pid	Process
2016	file.exe
1708	v8803833.exe
1708	v8803833.exe
1708	v8803833.exe
1372	a0895330.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v8803833.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1372 set thread context of 3048	1372	a0895330.exe	31

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2668	1372	WerFault.exe	2

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1708	2016	file.exe	3
PID 2016 wrote to memory of 1708	2016	file.exe	3
PID 2016 wrote to memory of 1708	2016	file.exe	3
PID 2016 wrote to memory of 1708	2016	file.exe	3
PID 2016 wrote to memory of 1708	2016	file.exe	3
PID 2016 wrote to memory of 1708	2016	file.exe	3
PID 2016 wrote to memory of 1708	2016	file.exe	3
PID 1708 wrote to memory of 1372	1708	v8803833.exe	2
PID 1708 wrote to memory of 1372	1708	v8803833.exe	2
PID 1708 wrote to memory of 1372	1708	v8803833.exe	2
PID 1708 wrote to memory of 1372	1708	v8803833.exe	2
PID 1708 wrote to memory of 1372	1708	v8803833.exe	2
PID 1708 wrote to memory of 1372	1708	v8803833.exe	2
PID 1708 wrote to memory of 1372	1708	v8803833.exe	2
PID 1372 wrote to memory of 3048	1372	a0895330.exe	31
PID 1372 wrote to memory of 3048	1372	a0895330.exe	31
PID 1372 wrote to memory of 3048	1372	a0895330.exe	31
PID 1372 wrote to memory of 3048	1372	a0895330.exe	31
PID 1372 wrote to memory of 3048	1372	a0895330.exe	31
PID 1372 wrote to memory of 3048	1372	a0895330.exe	31
PID 1372 wrote to memory of 3048	1372	a0895330.exe	31
PID 1372 wrote to memory of 3048	1372	a0895330.exe	31
PID 1372 wrote to memory of 3048	1372	a0895330.exe	31
PID 1372 wrote to memory of 3048	1372	a0895330.exe	31
PID 1372 wrote to memory of 3048	1372	a0895330.exe	31
PID 1372 wrote to memory of 3048	1372	a0895330.exe	31
PID 1372 wrote to memory of 2668	1372	a0895330.exe	32
PID 1372 wrote to memory of 2668	1372	a0895330.exe	32
PID 1372 wrote to memory of 2668	1372	a0895330.exe	32
PID 1372 wrote to memory of 2668	1372	a0895330.exe	32
PID 1372 wrote to memory of 2668	1372	a0895330.exe	32
PID 1372 wrote to memory of 2668	1372	a0895330.exe	32
PID 1372 wrote to memory of 2668	1372	a0895330.exe	32

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a0895330.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a0895330.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 268
  2⤵
  - Loads dropped DLL
  - Program crash
  PID:2668

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8803833.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8803833.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1708

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

v8803833.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8803833.exe
Size 466KB
SHA256 08c3bcd87ab7db03e8ca27a83973a9b1abcd1ed5ec0fe9db77b2b51965c3c485
MD5 89c3e6ad62299b22390882ce677c2908
SHA1 374046b6ae2d9e2f8a8d4e5e223594925897b0d8
SHA512 3d39f29c3d627d3fe9eb989e89ba4ae360c3eccdc563e4eeeb76ed9f3e0688ae61a52e36648080349d37707742bb59115703d3b0257191d073401c7c3a119014
SSDEEP 12288:JMrMZy9062O2rWBU8QHVKPcTHiHH/pzX7CEafe:pZy4FrUG1KPxHH/pjuE1
MD5 SHA1 SHA512 SSDEEP

Submit Download

v8803833.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8803833.exe
Size 466KB
SHA256 08c3bcd87ab7db03e8ca27a83973a9b1abcd1ed5ec0fe9db77b2b51965c3c485
MD5 89c3e6ad62299b22390882ce677c2908
SHA1 374046b6ae2d9e2f8a8d4e5e223594925897b0d8
SHA512 3d39f29c3d627d3fe9eb989e89ba4ae360c3eccdc563e4eeeb76ed9f3e0688ae61a52e36648080349d37707742bb59115703d3b0257191d073401c7c3a119014
SSDEEP 12288:JMrMZy9062O2rWBU8QHVKPcTHiHH/pzX7CEafe:pZy4FrUG1KPxHH/pjuE1
MD5 SHA1 SHA512 SSDEEP

Submit Download

a0895330.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a0895330.exe
Size 707KB
SHA256 244013880f3744a55891bd71d8f03b80ef19875987ecb3948a6eb9e6b0fea86f
MD5 874dd069e6f022f0bb22c467b73301f4
SHA1 7212a02abc67ebbb33f9a61220e9beaf9def6d25
SHA512 ed88fdaa5823374378b1eb4ed9135853fd5186925395ed8d37bea040566b2ef85236736c215aae26b0bdd6406f2ec5c788fecb0c83ec32690b24a8eb7e346861
SSDEEP 6144:9Q2sZYqlTK4QgB5KQ3Tsqd5tXdXVd4uVQfdQcvmG+MCiCEzlxdeWStl+pNnKPfQ:e2sZYqc4QgqQ3Tr4uVQfOcuRipWQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

a0895330.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a0895330.exe
Size 707KB
SHA256 244013880f3744a55891bd71d8f03b80ef19875987ecb3948a6eb9e6b0fea86f
MD5 874dd069e6f022f0bb22c467b73301f4
SHA1 7212a02abc67ebbb33f9a61220e9beaf9def6d25
SHA512 ed88fdaa5823374378b1eb4ed9135853fd5186925395ed8d37bea040566b2ef85236736c215aae26b0bdd6406f2ec5c788fecb0c83ec32690b24a8eb7e346861
SSDEEP 6144:9Q2sZYqlTK4QgB5KQ3Tsqd5tXdXVd4uVQfdQcvmG+MCiCEzlxdeWStl+pNnKPfQ:e2sZYqc4QgqQ3Tr4uVQfOcuRipWQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

a0895330.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a0895330.exe
Size 707KB
SHA256 244013880f3744a55891bd71d8f03b80ef19875987ecb3948a6eb9e6b0fea86f
MD5 874dd069e6f022f0bb22c467b73301f4
SHA1 7212a02abc67ebbb33f9a61220e9beaf9def6d25
SHA512 ed88fdaa5823374378b1eb4ed9135853fd5186925395ed8d37bea040566b2ef85236736c215aae26b0bdd6406f2ec5c788fecb0c83ec32690b24a8eb7e346861
SSDEEP 6144:9Q2sZYqlTK4QgB5KQ3Tsqd5tXdXVd4uVQfdQcvmG+MCiCEzlxdeWStl+pNnKPfQ:e2sZYqc4QgqQ3Tr4uVQfOcuRipWQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

v8803833.exe

Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\v8803833.exe
Size 466KB
SHA256 08c3bcd87ab7db03e8ca27a83973a9b1abcd1ed5ec0fe9db77b2b51965c3c485
MD5 89c3e6ad62299b22390882ce677c2908
SHA1 374046b6ae2d9e2f8a8d4e5e223594925897b0d8
SHA512 3d39f29c3d627d3fe9eb989e89ba4ae360c3eccdc563e4eeeb76ed9f3e0688ae61a52e36648080349d37707742bb59115703d3b0257191d073401c7c3a119014
SSDEEP 12288:JMrMZy9062O2rWBU8QHVKPcTHiHH/pzX7CEafe:pZy4FrUG1KPxHH/pjuE1
MD5 SHA1 SHA512 SSDEEP

Submit Download

v8803833.exe

Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\v8803833.exe
Size 466KB
SHA256 08c3bcd87ab7db03e8ca27a83973a9b1abcd1ed5ec0fe9db77b2b51965c3c485
MD5 89c3e6ad62299b22390882ce677c2908
SHA1 374046b6ae2d9e2f8a8d4e5e223594925897b0d8
SHA512 3d39f29c3d627d3fe9eb989e89ba4ae360c3eccdc563e4eeeb76ed9f3e0688ae61a52e36648080349d37707742bb59115703d3b0257191d073401c7c3a119014
SSDEEP 12288:JMrMZy9062O2rWBU8QHVKPcTHiHH/pzX7CEafe:pZy4FrUG1KPxHH/pjuE1
MD5 SHA1 SHA512 SSDEEP

Submit Download

a0895330.exe

Path \Users\Admin\AppData\Local\Temp\IXP001.TMP\a0895330.exe
Size 707KB
SHA256 244013880f3744a55891bd71d8f03b80ef19875987ecb3948a6eb9e6b0fea86f
MD5 874dd069e6f022f0bb22c467b73301f4
SHA1 7212a02abc67ebbb33f9a61220e9beaf9def6d25
SHA512 ed88fdaa5823374378b1eb4ed9135853fd5186925395ed8d37bea040566b2ef85236736c215aae26b0bdd6406f2ec5c788fecb0c83ec32690b24a8eb7e346861
SSDEEP 6144:9Q2sZYqlTK4QgB5KQ3Tsqd5tXdXVd4uVQfdQcvmG+MCiCEzlxdeWStl+pNnKPfQ:e2sZYqc4QgqQ3Tr4uVQfOcuRipWQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

a0895330.exe

Path \Users\Admin\AppData\Local\Temp\IXP001.TMP\a0895330.exe
Size 707KB
SHA256 244013880f3744a55891bd71d8f03b80ef19875987ecb3948a6eb9e6b0fea86f
MD5 874dd069e6f022f0bb22c467b73301f4
SHA1 7212a02abc67ebbb33f9a61220e9beaf9def6d25
SHA512 ed88fdaa5823374378b1eb4ed9135853fd5186925395ed8d37bea040566b2ef85236736c215aae26b0bdd6406f2ec5c788fecb0c83ec32690b24a8eb7e346861
SSDEEP 6144:9Q2sZYqlTK4QgB5KQ3Tsqd5tXdXVd4uVQfdQcvmG+MCiCEzlxdeWStl+pNnKPfQ:e2sZYqc4QgqQ3Tr4uVQfOcuRipWQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

a0895330.exe

Path \Users\Admin\AppData\Local\Temp\IXP001.TMP\a0895330.exe
Size 707KB
SHA256 244013880f3744a55891bd71d8f03b80ef19875987ecb3948a6eb9e6b0fea86f
MD5 874dd069e6f022f0bb22c467b73301f4
SHA1 7212a02abc67ebbb33f9a61220e9beaf9def6d25
SHA512 ed88fdaa5823374378b1eb4ed9135853fd5186925395ed8d37bea040566b2ef85236736c215aae26b0bdd6406f2ec5c788fecb0c83ec32690b24a8eb7e346861
SSDEEP 6144:9Q2sZYqlTK4QgB5KQ3Tsqd5tXdXVd4uVQfdQcvmG+MCiCEzlxdeWStl+pNnKPfQ:e2sZYqc4QgqQ3Tr4uVQfOcuRipWQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

a0895330.exe

Path \Users\Admin\AppData\Local\Temp\IXP001.TMP\a0895330.exe
Size 707KB
SHA256 244013880f3744a55891bd71d8f03b80ef19875987ecb3948a6eb9e6b0fea86f
MD5 874dd069e6f022f0bb22c467b73301f4
SHA1 7212a02abc67ebbb33f9a61220e9beaf9def6d25
SHA512 ed88fdaa5823374378b1eb4ed9135853fd5186925395ed8d37bea040566b2ef85236736c215aae26b0bdd6406f2ec5c788fecb0c83ec32690b24a8eb7e346861
SSDEEP 6144:9Q2sZYqlTK4QgB5KQ3Tsqd5tXdXVd4uVQfdQcvmG+MCiCEzlxdeWStl+pNnKPfQ:e2sZYqc4QgqQ3Tr4uVQfOcuRipWQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

a0895330.exe

Path \Users\Admin\AppData\Local\Temp\IXP001.TMP\a0895330.exe
Size 707KB
SHA256 244013880f3744a55891bd71d8f03b80ef19875987ecb3948a6eb9e6b0fea86f
MD5 874dd069e6f022f0bb22c467b73301f4
SHA1 7212a02abc67ebbb33f9a61220e9beaf9def6d25
SHA512 ed88fdaa5823374378b1eb4ed9135853fd5186925395ed8d37bea040566b2ef85236736c215aae26b0bdd6406f2ec5c788fecb0c83ec32690b24a8eb7e346861
SSDEEP 6144:9Q2sZYqlTK4QgB5KQ3Tsqd5tXdXVd4uVQfdQcvmG+MCiCEzlxdeWStl+pNnKPfQ:e2sZYqc4QgqQ3Tr4uVQfOcuRipWQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

a0895330.exe

Path \Users\Admin\AppData\Local\Temp\IXP001.TMP\a0895330.exe
Size 707KB
SHA256 244013880f3744a55891bd71d8f03b80ef19875987ecb3948a6eb9e6b0fea86f
MD5 874dd069e6f022f0bb22c467b73301f4
SHA1 7212a02abc67ebbb33f9a61220e9beaf9def6d25
SHA512 ed88fdaa5823374378b1eb4ed9135853fd5186925395ed8d37bea040566b2ef85236736c215aae26b0bdd6406f2ec5c788fecb0c83ec32690b24a8eb7e346861
SSDEEP 6144:9Q2sZYqlTK4QgB5KQ3Tsqd5tXdXVd4uVQfdQcvmG+MCiCEzlxdeWStl+pNnKPfQ:e2sZYqc4QgqQ3Tr4uVQfOcuRipWQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

a0895330.exe

Path \Users\Admin\AppData\Local\Temp\IXP001.TMP\a0895330.exe
Size 707KB
SHA256 244013880f3744a55891bd71d8f03b80ef19875987ecb3948a6eb9e6b0fea86f
MD5 874dd069e6f022f0bb22c467b73301f4
SHA1 7212a02abc67ebbb33f9a61220e9beaf9def6d25
SHA512 ed88fdaa5823374378b1eb4ed9135853fd5186925395ed8d37bea040566b2ef85236736c215aae26b0bdd6406f2ec5c788fecb0c83ec32690b24a8eb7e346861
SSDEEP 6144:9Q2sZYqlTK4QgB5KQ3Tsqd5tXdXVd4uVQfdQcvmG+MCiCEzlxdeWStl+pNnKPfQ:e2sZYqc4QgqQ3Tr4uVQfOcuRipWQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3048-23-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/3048-24-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/3048-32-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/3048-34-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/3048-27-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/3048-30-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/3048-29-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Download

memory/3048-25-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/3048-39-0x0000000000350000-0x0000000000356000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads