redline | 62bdf7c8bc61b7d1bd73ccc8685e220edf33b9a5ba1ab3c192a61c31da9b1a9f

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 17:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

067e5c3ecff330d7c89e0a5c37fec8e0f642f8b31f9a396325cc5782eaa456b6.exe
Size

556KB
MD5

69014fa7a78edd320abd2fbc65911205
SHA1

6e4eb344b44399213baf461c5bedc2bf49eecfc9
SHA256

067e5c3ecff330d7c89e0a5c37fec8e0f642f8b31f9a396325cc5782eaa456b6
SHA512

6bac499e063dffff0336efecc320653de75320e9d897143c5a2ab349e086c5a6723607748ba4088b40b7eeeb18ea3285e0d8ac47b02242935237e7aea2360a4d
SSDEEP

12288:lMray903CqtYfE5UHygzucgH5mpHoU9mhdKPLW:XyKCpjyAO5/UCdKPy

Score

10^/10

redline darm infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

darm

217.196.96.56:4138

Attributes

auth_value
d88ac8ccc04ab9979b04b46313db1648

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral3/files/0x00080000000233e7-12.dat	family_redline
behavioral3/memory/3500-15-0x0000000000780000-0x00000000007B0000-memory.dmp	family_redline

Executes dropped EXE 2 IoCs

pid	Process
4900	x9733772.exe
3500	g1340199.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	067e5c3ecff330d7c89e0a5c37fec8e0f642f8b31f9a396325cc5782eaa456b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x9733772.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 4900	1276	067e5c3ecff330d7c89e0a5c37fec8e0f642f8b31f9a396325cc5782eaa456b6.exe	80
PID 1276 wrote to memory of 4900	1276	067e5c3ecff330d7c89e0a5c37fec8e0f642f8b31f9a396325cc5782eaa456b6.exe	80
PID 1276 wrote to memory of 4900	1276	067e5c3ecff330d7c89e0a5c37fec8e0f642f8b31f9a396325cc5782eaa456b6.exe	80
PID 4900 wrote to memory of 3500	4900	x9733772.exe	81
PID 4900 wrote to memory of 3500	4900	x9733772.exe	81
PID 4900 wrote to memory of 3500	4900	x9733772.exe	81

C:\Users\Admin\AppData\Local\Temp\067e5c3ecff330d7c89e0a5c37fec8e0f642f8b31f9a396325cc5782eaa456b6.exe
"C:\Users\Admin\AppData\Local\Temp\067e5c3ecff330d7c89e0a5c37fec8e0f642f8b31f9a396325cc5782eaa456b6.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9733772.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9733772.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g1340199.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g1340199.exe
    3⤵
    - Executes dropped EXE
    PID:3500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9733772.exe

Filesize
384KB

MD5
7bc2d05ad6c8a97ba0e72e08fea76c33

SHA1
34ca4cd11a85d4c4e347e0a3e14bbbce06a52b8a

SHA256
d637403a7a8d4f4e55e3bd56e000ee3668faae9137eaa6efbcd8dfdcc4744709

SHA512
d904d036c3348d6171810adc02588990dc349f6cf8a79f95466b1e4d64bc0ca3dad17de0868260bf66db36b2cc5cdf4ba4437a1833671ab7bc2ed7079e55feb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g1340199.exe

Filesize
168KB

MD5
1713407b17523d6fc4e5bb0c8224dc99

SHA1
a7d93f158db51fdae389110c4db7a09ac8e47857

SHA256
f56b8bee3041e40eb529a840f8eee89a536c282e29c5df448d6eee87bc87eda7

SHA512
dbd31ce690b92202ff507140a215abcb0f9f580afd288d2ac684233b67cc4f0d26d150c6e2986ccaba93f858cf62ee7ff455fc464ff5dc93725d7246e8d6c43b

Download Submit
memory/3500-14-0x00000000748CE000-0x00000000748CF000-memory.dmp

Filesize
4KB

Download
memory/3500-15-0x0000000000780000-0x00000000007B0000-memory.dmp

Filesize
192KB

Download
memory/3500-16-0x0000000004FA0000-0x0000000004FA6000-memory.dmp

Filesize
24KB

Download
memory/3500-17-0x000000000AAC0000-0x000000000B0D8000-memory.dmp

Filesize
6.1MB

Download
memory/3500-18-0x000000000A5F0000-0x000000000A6FA000-memory.dmp

Filesize
1.0MB

Download
memory/3500-19-0x000000000A520000-0x000000000A532000-memory.dmp

Filesize
72KB

Download
memory/3500-20-0x000000000A580000-0x000000000A5BC000-memory.dmp

Filesize
240KB

Download
memory/3500-21-0x00000000748C0000-0x0000000075070000-memory.dmp

Filesize
7.7MB

Download
memory/3500-22-0x0000000004A80000-0x0000000004ACC000-memory.dmp

Filesize
304KB

Download
memory/3500-23-0x00000000748CE000-0x00000000748CF000-memory.dmp

Filesize
4KB

Download
memory/3500-24-0x00000000748C0000-0x0000000075070000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads