redline | 9bf42d30009d4ddad615b803ba623f0520c82c23439142288ce711002d7b3292

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 14:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b21367ffaa0009b30055944fc1052857ec46336d5bfe2efd3dab109667a56fef.exe
Size

1.0MB
MD5

fcec5bd6e991dabef70f77e08e42bccd
SHA1

3ae3b13a9757d327ed4227102d5b0b54712f19d4
SHA256

b21367ffaa0009b30055944fc1052857ec46336d5bfe2efd3dab109667a56fef
SHA512

59a2d1cc2576e55beff18f52573b6ac7baae8839dbbf536d5126f88d873375ebb9bb287606021e9c3c14533b004bde6bc3e28511fa646ef65cafabe6fdd4573b
SSDEEP

24576:PyvzwYJvJY4834KiT25Y/fUlpyY4yWvHIPnpAOD6FA7dZJ7Rj:arwamDIn2i38WPIpDzR

Score

10^/10

redline diza infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

diza

185.161.248.37:4138

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6752633.exe	family_redline
behavioral20/memory/4624-21-0x0000000000030000-0x000000000005A000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

Processes:

x1101592.exex5310347.exef6752633.exe

pid process

2960 x1101592.exe
1576 x5310347.exe
4624 f6752633.exe

pid	process
2960	x1101592.exe
1576	x5310347.exe
4624	f6752633.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

x1101592.exex5310347.exeb21367ffaa0009b30055944fc1052857ec46336d5bfe2efd3dab109667a56fef.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x1101592.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x5310347.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b21367ffaa0009b30055944fc1052857ec46336d5bfe2efd3dab109667a56fef.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

b21367ffaa0009b30055944fc1052857ec46336d5bfe2efd3dab109667a56fef.exex1101592.exex5310347.exe

description	pid	process	target process
PID 3172 wrote to memory of 2960	3172	b21367ffaa0009b30055944fc1052857ec46336d5bfe2efd3dab109667a56fef.exe	x1101592.exe
PID 3172 wrote to memory of 2960	3172	b21367ffaa0009b30055944fc1052857ec46336d5bfe2efd3dab109667a56fef.exe	x1101592.exe
PID 3172 wrote to memory of 2960	3172	b21367ffaa0009b30055944fc1052857ec46336d5bfe2efd3dab109667a56fef.exe	x1101592.exe
PID 2960 wrote to memory of 1576	2960	x1101592.exe	x5310347.exe
PID 2960 wrote to memory of 1576	2960	x1101592.exe	x5310347.exe
PID 2960 wrote to memory of 1576	2960	x1101592.exe	x5310347.exe
PID 1576 wrote to memory of 4624	1576	x5310347.exe	f6752633.exe
PID 1576 wrote to memory of 4624	1576	x5310347.exe	f6752633.exe
PID 1576 wrote to memory of 4624	1576	x5310347.exe	f6752633.exe

C:\Users\Admin\AppData\Local\Temp\b21367ffaa0009b30055944fc1052857ec46336d5bfe2efd3dab109667a56fef.exe
"C:\Users\Admin\AppData\Local\Temp\b21367ffaa0009b30055944fc1052857ec46336d5bfe2efd3dab109667a56fef.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3172

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1101592.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1101592.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2960

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5310347.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5310347.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1576

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6752633.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6752633.exe
4⤵
- Executes dropped EXE
PID:4624

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1101592.exe
Filesize
750KB

MD5
a71d1485c6def63e3a12a56cef3df216

SHA1
6356ae641fe06783171f255072b3f06c3e53fe5a

SHA256
f71aeabbf5f3f4fa0a150bad2b24cd2db183e723cecd2296815fdc1582b31297

SHA512
b7f7ab9fada5915189862df412f319de2f1958606d40c24bb31060352d07f94c4300c849aa9e61efb3a0e30a458c17afad573a145a326ee56c02c5e19fb19393

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5310347.exe
Filesize
306KB

MD5
59758d08e26d80f2b560b43915a196e7

SHA1
191e46484309a701c87f826cfeca3c5590f41c75

SHA256
2b21dfe635c66e24e5cbba2203c09083e228789c3bed18a1dde42d38b19ee924

SHA512
548c92ed1205a43648fa218af44b77811a149e4c82a48943a164e3464f035b2ef56a89aa1270311a7410aaf8c98e1b7383290a796a53dc3da450edd6f77f618d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6752633.exe
Filesize
145KB

MD5
fc89ffae6d5ecc9374ef6b75d0d09edb

SHA1
8440ad5c070d5bb75d10308525777a70d42d18fc

SHA256
5d2c14e89b6b1b95fead94182a17aebfeaca900df36f4eb7cb87cd52829196da

SHA512
558f2e2b7ed661b8f486c980483d04148f09e1c692469d978e6efc98425f5cd32393351684f90cc3ba6611193a4ac58724e31310f358055e75dca30ced3d8752

Download Submit
memory/4624-21-0x0000000000030000-0x000000000005A000-memory.dmp

Filesize
168KB

Download
memory/4624-22-0x0000000004E90000-0x00000000054A8000-memory.dmp

Filesize
6.1MB

Download
memory/4624-23-0x00000000049C0000-0x0000000004ACA000-memory.dmp

Filesize
1.0MB

Download
memory/4624-24-0x00000000048F0000-0x0000000004902000-memory.dmp

Filesize
72KB

Download
memory/4624-25-0x0000000004950000-0x000000000498C000-memory.dmp

Filesize
240KB

Download
memory/4624-26-0x0000000004AD0000-0x0000000004B1C000-memory.dmp

Filesize
304KB

Download