redline | 205ae779babd66a06edef8f4549388af61dbb854e06c82a7f291317f4dbe780e

Analysis

max time kernel
132s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 13:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce9f75c073171b1315c869b550348e6d8c48a986b262a068b33f0833b7a24716.exe
Size

864KB
MD5

2c52c514ed30a21dbfc181f9a56e756d
SHA1

251cf6719d43e1fd2c52df211e76b8644c3cd2b0
SHA256

ce9f75c073171b1315c869b550348e6d8c48a986b262a068b33f0833b7a24716
SHA512

e59f6f72001fbfb87dfbdf3ac73832f17ba334a5877f395f3c3173d18ba41c3a962714d6f91ce92d484ffe5368bf3ff90b388be4175032dc20a2bee0005c000b
SSDEEP

24576:5yQ6k1XlUuV6gbsDRA/vTXLp3qiwikDLDJtgYBNSu+KpEFMe:sQ6knTs2XTXLpFusYKu+yQ

Score

10^/10

redline kira infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

kira

77.91.68.48:19071

Attributes

auth_value
1677a40fd8997eb89377e1681911e9c6

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral20/memory/3740-18-0x0000000000540000-0x0000000000570000-memory.dmp	family_redline
behavioral20/memory/3740-22-0x0000000000400000-0x000000000043A000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

pid	Process
3080	y6497315.exe
4972	k0077088.exe
3740	l7490768.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ce9f75c073171b1315c869b550348e6d8c48a986b262a068b33f0833b7a24716.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y6497315.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1416	4972	WerFault.exe	93

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 3080	4872	ce9f75c073171b1315c869b550348e6d8c48a986b262a068b33f0833b7a24716.exe	92
PID 4872 wrote to memory of 3080	4872	ce9f75c073171b1315c869b550348e6d8c48a986b262a068b33f0833b7a24716.exe	92
PID 4872 wrote to memory of 3080	4872	ce9f75c073171b1315c869b550348e6d8c48a986b262a068b33f0833b7a24716.exe	92
PID 3080 wrote to memory of 4972	3080	y6497315.exe	93
PID 3080 wrote to memory of 4972	3080	y6497315.exe	93
PID 3080 wrote to memory of 4972	3080	y6497315.exe	93
PID 3080 wrote to memory of 3740	3080	y6497315.exe	100
PID 3080 wrote to memory of 3740	3080	y6497315.exe	100
PID 3080 wrote to memory of 3740	3080	y6497315.exe	100

C:\Users\Admin\AppData\Local\Temp\ce9f75c073171b1315c869b550348e6d8c48a986b262a068b33f0833b7a24716.exe
"C:\Users\Admin\AppData\Local\Temp\ce9f75c073171b1315c869b550348e6d8c48a986b262a068b33f0833b7a24716.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6497315.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6497315.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3080
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0077088.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0077088.exe
    3⤵
    - Executes dropped EXE
    PID:4972
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 572
      4⤵
      Program crash
      PID:1416
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7490768.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7490768.exe
    3⤵
    - Executes dropped EXE
    PID:3740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4972 -ip 4972
1⤵
PID:2084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4040,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:8
1⤵
PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6497315.exe

Filesize
681KB

MD5
347fa3300c887f6ed7b1a13377bb28bd

SHA1
f7290c370763737aa41f0bc92d66b2423647815c

SHA256
8ecc876c0ce1dc9774cb4ee93fbcd638c9182cd5c33e4a7aee74bbc39bd75cc4

SHA512
e17a78db324fd6bd80872c92fd6c03f0308b20c256d9a42cec304f21f13df2f0c6069ba95998d525e39b6e99040d07baaabf60015ab4ff88344e5d222c0cc341

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0077088.exe

Filesize
530KB

MD5
3afbc821636e1e7951821231f0cdc4bc

SHA1
d962f7454a83bdeb81b16476055773c65090c068

SHA256
b05287fda0d66708df3d5a927caeb62a87e8809fb992871a5615a3c62ce1eeff

SHA512
4b74ca6740b4a8cf7d6bf4a54e64cbf564f42443d4b23d824feb661a8945a7a1a08fb6428afb8a8af7646607b5edc1af9d4c7aea8aac341965dbbf220db86eba

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7490768.exe

Filesize
692KB

MD5
ed78531c3da44f95b5e5f7aa280bf586

SHA1
a9e403fcbf3a8020cb51d8f3a406c74775936c2d

SHA256
d996d9ed8e0931fe6f414b91b0d4f52fc6b80a8493829f63fdd44cbf9afea60e

SHA512
7649d4ceb7cf0771ed8905dbff16e74b117b0ced16f94026d457a6534a10f39c91da18bd986fd66ded33d9c2c4ef501e7c895760418b39361089f196bbdb6970

Download Submit
memory/3740-18-0x0000000000540000-0x0000000000570000-memory.dmp

Filesize
192KB

Download
memory/3740-22-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3740-23-0x0000000004A60000-0x0000000004A66000-memory.dmp

Filesize
24KB

Download
memory/3740-24-0x000000000A470000-0x000000000AA88000-memory.dmp

Filesize
6.1MB

Download
memory/3740-25-0x0000000009EE0000-0x0000000009FEA000-memory.dmp

Filesize
1.0MB

Download
memory/3740-26-0x000000000A020000-0x000000000A032000-memory.dmp

Filesize
72KB

Download
memory/3740-27-0x000000000A040000-0x000000000A07C000-memory.dmp

Filesize
240KB

Download
memory/3740-28-0x00000000022E0000-0x000000000232C000-memory.dmp

Filesize
304KB

Download
memory/4972-14-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads