redline | 205ae779babd66a06edef8f4549388af61dbb854e06c82a7f291317f4dbe780e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 13:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ce9f75c073171b1315c869b550348e6d8c48a986b262a068b33f0833b7a24716.exe
Size 864KB
Sample240510-qfa2rsbe83
SHA256 ce9f75c073171b1315c869b550348e6d8c48a986b262a068b33f0833b7a24716
MD5 2c52c514ed30a21dbfc181f9a56e756d
SHA1 251cf6719d43e1fd2c52df211e76b8644c3cd2b0
SHA512 e59f6f72001fbfb87dfbdf3ac73832f17ba334a5877f395f3c3173d18ba41c3a962714d6f91ce92d484ffe5368bf3ff90b388be4175032dc20a2bee0005c000b
SSDEEP 24576:5yQ6k1XlUuV6gbsDRA/vTXLp3qiwikDLDJtgYBNSu+KpEFMe:sQ6knTs2XTXLpFusYKu+yQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline kira infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

kira

77.91.68.48:19071

Attributes

auth_value
1677a40fd8997eb89377e1681911e9c6

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral20/memory/3244-18-0x0000000000400000-0x000000000043A000-memory.dmp	family_redline
behavioral20/memory/3244-19-0x0000000000440000-0x0000000000470000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

pid	Process
2492	y6497315.exe
4648	k0077088.exe
3244	l7490768.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ce9f75c073171b1315c869b550348e6d8c48a986b262a068b33f0833b7a24716.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y6497315.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1792	4648	WerFault.exe	84

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 2492	4832	ce9f75c073171b1315c869b550348e6d8c48a986b262a068b33f0833b7a24716.exe	83
PID 4832 wrote to memory of 2492	4832	ce9f75c073171b1315c869b550348e6d8c48a986b262a068b33f0833b7a24716.exe	83
PID 4832 wrote to memory of 2492	4832	ce9f75c073171b1315c869b550348e6d8c48a986b262a068b33f0833b7a24716.exe	83
PID 2492 wrote to memory of 4648	2492	y6497315.exe	84
PID 2492 wrote to memory of 4648	2492	y6497315.exe	84
PID 2492 wrote to memory of 4648	2492	y6497315.exe	84
PID 2492 wrote to memory of 3244	2492	y6497315.exe	92
PID 2492 wrote to memory of 3244	2492	y6497315.exe	92
PID 2492 wrote to memory of 3244	2492	y6497315.exe	92

C:\Users\Admin\AppData\Local\Temp\ce9f75c073171b1315c869b550348e6d8c48a986b262a068b33f0833b7a24716.exe
"C:\Users\Admin\AppData\Local\Temp\ce9f75c073171b1315c869b550348e6d8c48a986b262a068b33f0833b7a24716.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6497315.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6497315.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0077088.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0077088.exe
    3⤵
    - Executes dropped EXE
    PID:4648
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 136
      4⤵
      Program crash
      PID:1792
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7490768.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7490768.exe
    3⤵
    - Executes dropped EXE
    PID:3244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4648 -ip 4648
1⤵
PID:1836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

y6497315.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6497315.exe
Size 681KB
SHA256 8ecc876c0ce1dc9774cb4ee93fbcd638c9182cd5c33e4a7aee74bbc39bd75cc4
MD5 347fa3300c887f6ed7b1a13377bb28bd
SHA1 f7290c370763737aa41f0bc92d66b2423647815c
SHA512 e17a78db324fd6bd80872c92fd6c03f0308b20c256d9a42cec304f21f13df2f0c6069ba95998d525e39b6e99040d07baaabf60015ab4ff88344e5d222c0cc341
SSDEEP 12288:KMrpy90oI6KbdbFy3yryPZTLrSjHDkPozp3qi/oQkxJ6JhaoeukPyBNOu+3XZ3IJ:Ly46KbdosA/GT4Cp3qi/9kD+hJgPyBNZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

k0077088.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0077088.exe
Size 530KB
SHA256 b05287fda0d66708df3d5a927caeb62a87e8809fb992871a5615a3c62ce1eeff
MD5 3afbc821636e1e7951821231f0cdc4bc
SHA1 d962f7454a83bdeb81b16476055773c65090c068
SHA512 4b74ca6740b4a8cf7d6bf4a54e64cbf564f42443d4b23d824feb661a8945a7a1a08fb6428afb8a8af7646607b5edc1af9d4c7aea8aac341965dbbf220db86eba
SSDEEP 12288:NiICSVtg0wBW3iFt4ONq30/4St2NBd0JoLdaoi9Bbk:NBbVTb34k30/8dRi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

l7490768.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7490768.exe
Size 692KB
SHA256 d996d9ed8e0931fe6f414b91b0d4f52fc6b80a8493829f63fdd44cbf9afea60e
MD5 ed78531c3da44f95b5e5f7aa280bf586
SHA1 a9e403fcbf3a8020cb51d8f3a406c74775936c2d
SHA512 7649d4ceb7cf0771ed8905dbff16e74b117b0ced16f94026d457a6534a10f39c91da18bd986fd66ded33d9c2c4ef501e7c895760418b39361089f196bbdb6970
SSDEEP 12288:pw3zk2EWiICSVtg0wBW3iFt4ONq30/4St2NBd0JoLdaoi9Bbk:pwDkNWBbVTb34k30/8dRi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3244-18-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/3244-19-0x0000000000440000-0x0000000000470000-memory.dmp

Download

memory/3244-23-0x0000000002210000-0x0000000002216000-memory.dmp

Download

memory/3244-24-0x0000000009FB0000-0x000000000A5C8000-memory.dmp

Download

memory/3244-25-0x000000000A640000-0x000000000A74A000-memory.dmp

Download

memory/3244-26-0x000000000A780000-0x000000000A792000-memory.dmp

Download

memory/3244-27-0x000000000A7A0000-0x000000000A7DC000-memory.dmp

Download

memory/3244-28-0x0000000004620000-0x000000000466C000-memory.dmp

Download

memory/4648-14-0x0000000000401000-0x0000000000402000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads