redline | dd49e60a45e3962b98b32d0ae9a1256ae1e60ba2b696a005fe221e32f96d996b

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 15:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

061669c83be149e85a977dfd41981b6115bf335e8f5bf4a2c696247dbf3999c0.exe
Size

479KB
MD5

da9628d206200541f94439093a97094e
SHA1

c5638efc45b8695458802fd3ad98e55715762ca2
SHA256

061669c83be149e85a977dfd41981b6115bf335e8f5bf4a2c696247dbf3999c0
SHA512

65f4e60de936967c989350a7fe4402ef868092013f5af39391cce52c2fae631937b851403c4cf0b087ae7b75109de8bcb454d0f0046a0de3ef1e56537e028c2b
SSDEEP

12288:LMrZy90PoaNuTNVYHTIQNJSngK3ITlWiy8KMn:Oy03NuZCzINYxWiN

Score

10^/10

redline dumud infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

dumud

217.196.96.101:4132

Attributes

auth_value
3e18d4b90418aa3e78d8822e87c62f5c

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g1920462.exe	family_redline
behavioral2/memory/4048-15-0x00000000000D0000-0x0000000000100000-memory.dmp	family_redline

Executes dropped EXE 2 IoCs

Processes:

x5371498.exeg1920462.exe

pid process

2108 x5371498.exe
4048 g1920462.exe

pid	process
2108	x5371498.exe
4048	g1920462.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

061669c83be149e85a977dfd41981b6115bf335e8f5bf4a2c696247dbf3999c0.exex5371498.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	061669c83be149e85a977dfd41981b6115bf335e8f5bf4a2c696247dbf3999c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x5371498.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

061669c83be149e85a977dfd41981b6115bf335e8f5bf4a2c696247dbf3999c0.exex5371498.exe

description	pid	process	target process
PID 2900 wrote to memory of 2108	2900	061669c83be149e85a977dfd41981b6115bf335e8f5bf4a2c696247dbf3999c0.exe	x5371498.exe
PID 2900 wrote to memory of 2108	2900	061669c83be149e85a977dfd41981b6115bf335e8f5bf4a2c696247dbf3999c0.exe	x5371498.exe
PID 2900 wrote to memory of 2108	2900	061669c83be149e85a977dfd41981b6115bf335e8f5bf4a2c696247dbf3999c0.exe	x5371498.exe
PID 2108 wrote to memory of 4048	2108	x5371498.exe	g1920462.exe
PID 2108 wrote to memory of 4048	2108	x5371498.exe	g1920462.exe
PID 2108 wrote to memory of 4048	2108	x5371498.exe	g1920462.exe

C:\Users\Admin\AppData\Local\Temp\061669c83be149e85a977dfd41981b6115bf335e8f5bf4a2c696247dbf3999c0.exe
"C:\Users\Admin\AppData\Local\Temp\061669c83be149e85a977dfd41981b6115bf335e8f5bf4a2c696247dbf3999c0.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2900

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5371498.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5371498.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2108

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g1920462.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g1920462.exe
3⤵
- Executes dropped EXE
PID:4048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5371498.exe
Filesize
307KB

MD5
be44ddb40e085d64a8405eb231963d84

SHA1
089450ca5957daa8a8a3a346c6e497000c25e5cc

SHA256
d1e8dbd66731cd0a95e444d0fda9ebdc32fdc49845c43907cd292619ac4e88dd

SHA512
aedd56e83d7927b377ff827536ef601ef40b119ac3eef701b91d02d8ef2f11df222469a08064121118413e161ae5fef8060bc71df7c5675583ac5f8e3bad3c63

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g1920462.exe
Filesize
168KB

MD5
a2c9c17afefa6bf916c24bbd4f495a6f

SHA1
47e6ae11989fc1f04d20984d5e9fb5f3b9a1a6dc

SHA256
c2983fb6cd3f07ea3641e57cf51ef8ecc219415818831b4afd88e7224332578a

SHA512
1a64cbf7435e78424e68fb832ba36d935ba717af69ccba456d7a829ce3036879acd2b8e3e770235e99ccd333cc4b0336c213cab01751bbe1309d46c7d3ff01f1

Download Submit
memory/4048-14-0x00000000744AE000-0x00000000744AF000-memory.dmp

Filesize
4KB

Download
memory/4048-15-0x00000000000D0000-0x0000000000100000-memory.dmp

Filesize
192KB

Download
memory/4048-16-0x0000000002420000-0x0000000002426000-memory.dmp

Filesize
24KB

Download
memory/4048-17-0x000000000A3F0000-0x000000000AA08000-memory.dmp

Filesize
6.1MB

Download
memory/4048-18-0x0000000009F40000-0x000000000A04A000-memory.dmp

Filesize
1.0MB

Download
memory/4048-19-0x0000000009E70000-0x0000000009E82000-memory.dmp

Filesize
72KB

Download
memory/4048-20-0x0000000009ED0000-0x0000000009F0C000-memory.dmp

Filesize
240KB

Download
memory/4048-21-0x00000000744A0000-0x0000000074C50000-memory.dmp

Filesize
7.7MB

Download
memory/4048-22-0x0000000002250000-0x000000000229C000-memory.dmp

Filesize
304KB

Download
memory/4048-23-0x00000000744AE000-0x00000000744AF000-memory.dmp

Filesize
4KB

Download
memory/4048-24-0x00000000744A0000-0x0000000074C50000-memory.dmp

Filesize
7.7MB

Download