redline | dd49e60a45e3962b98b32d0ae9a1256ae1e60ba2b696a005fe221e32f96d996b

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 15:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
061669c83be149e85a977dfd41981b6115bf335e8f5bf4a2c696247dbf3999c0.exe
Size 479KB
Sample240510-sl48xafc82
SHA256 061669c83be149e85a977dfd41981b6115bf335e8f5bf4a2c696247dbf3999c0
MD5 da9628d206200541f94439093a97094e
SHA1 c5638efc45b8695458802fd3ad98e55715762ca2
SHA512 65f4e60de936967c989350a7fe4402ef868092013f5af39391cce52c2fae631937b851403c4cf0b087ae7b75109de8bcb454d0f0046a0de3ef1e56537e028c2b
SSDEEP 12288:LMrZy90PoaNuTNVYHTIQNJSngK3ITlWiy8KMn:Oy03NuZCzINYxWiN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline dumud infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

dumud

217.196.96.101:4132

Attributes

auth_value
3e18d4b90418aa3e78d8822e87c62f5c

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000800000002347d-13.dat	family_redline
behavioral2/memory/4048-15-0x00000000000D0000-0x0000000000100000-memory.dmp	family_redline

Executes dropped EXE 2 IoCs

pid	Process
2108	x5371498.exe
4048	g1920462.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	061669c83be149e85a977dfd41981b6115bf335e8f5bf4a2c696247dbf3999c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x5371498.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2108	2900	061669c83be149e85a977dfd41981b6115bf335e8f5bf4a2c696247dbf3999c0.exe	83
PID 2900 wrote to memory of 2108	2900	061669c83be149e85a977dfd41981b6115bf335e8f5bf4a2c696247dbf3999c0.exe	83
PID 2900 wrote to memory of 2108	2900	061669c83be149e85a977dfd41981b6115bf335e8f5bf4a2c696247dbf3999c0.exe	83
PID 2108 wrote to memory of 4048	2108	x5371498.exe	84
PID 2108 wrote to memory of 4048	2108	x5371498.exe	84
PID 2108 wrote to memory of 4048	2108	x5371498.exe	84

C:\Users\Admin\AppData\Local\Temp\061669c83be149e85a977dfd41981b6115bf335e8f5bf4a2c696247dbf3999c0.exe
"C:\Users\Admin\AppData\Local\Temp\061669c83be149e85a977dfd41981b6115bf335e8f5bf4a2c696247dbf3999c0.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5371498.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5371498.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g1920462.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g1920462.exe
    3⤵
    - Executes dropped EXE
    PID:4048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x5371498.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5371498.exe
Size 307KB
SHA256 d1e8dbd66731cd0a95e444d0fda9ebdc32fdc49845c43907cd292619ac4e88dd
MD5 be44ddb40e085d64a8405eb231963d84
SHA1 089450ca5957daa8a8a3a346c6e497000c25e5cc
SHA512 aedd56e83d7927b377ff827536ef601ef40b119ac3eef701b91d02d8ef2f11df222469a08064121118413e161ae5fef8060bc71df7c5675583ac5f8e3bad3c63
SSDEEP 6144:KNy+bnr+op0yN90QEwwSAl5E1S3+/9+S/k0KB5Njk:HMrUy90JrwS2ZKbu
MD5 SHA1 SHA512 SSDEEP

Submit Download

g1920462.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g1920462.exe
Size 168KB
SHA256 c2983fb6cd3f07ea3641e57cf51ef8ecc219415818831b4afd88e7224332578a
MD5 a2c9c17afefa6bf916c24bbd4f495a6f
SHA1 47e6ae11989fc1f04d20984d5e9fb5f3b9a1a6dc
SHA512 1a64cbf7435e78424e68fb832ba36d935ba717af69ccba456d7a829ce3036879acd2b8e3e770235e99ccd333cc4b0336c213cab01751bbe1309d46c7d3ff01f1
SSDEEP 1536:8HHDXepqlVZRGWnKarISqKkH1jgl3mfTGqVibutZFryIaQ383wYkz8e8hg:yOMcSqKEoWyqV2MFeIaQ3t8e8hg
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4048-14-0x00000000744AE000-0x00000000744AF000-memory.dmp

Download

memory/4048-15-0x00000000000D0000-0x0000000000100000-memory.dmp

Download

memory/4048-16-0x0000000002420000-0x0000000002426000-memory.dmp

Download

memory/4048-17-0x000000000A3F0000-0x000000000AA08000-memory.dmp

Download

memory/4048-18-0x0000000009F40000-0x000000000A04A000-memory.dmp

Download

memory/4048-19-0x0000000009E70000-0x0000000009E82000-memory.dmp

Download

memory/4048-20-0x0000000009ED0000-0x0000000009F0C000-memory.dmp

Download

memory/4048-21-0x00000000744A0000-0x0000000074C50000-memory.dmp

Download

memory/4048-22-0x0000000002250000-0x000000000229C000-memory.dmp

Download

memory/4048-23-0x00000000744AE000-0x00000000744AF000-memory.dmp

Download

memory/4048-24-0x00000000744A0000-0x0000000074C50000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads