redline | 2685b451d5bc5d1cd7c159a87efdfacd5a60c314491404e6e60e752ba3db90cf

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 15:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c73d83c0a0062c5cead0597dac9f90beac93ae125536330571cadd52acefe75.exe
Size

480KB
MD5

ebf83062f40b343b023a1b0f6642e146
SHA1

ab96700bba473de2cf6aae2705628430b640a981
SHA256

7c73d83c0a0062c5cead0597dac9f90beac93ae125536330571cadd52acefe75
SHA512

7a60dddafa0f3690af046a64c608b2ca2d36fc6a79d3a381fef13bdb0bb059c92293db70af6a1f6fd4908c92de8ea4dc635eae68c064c49a518c8b1f81ce4549
SSDEEP

12288:0MrAy90IlVP6Jn5Xb8ubn85+G/Ndq4RfED9PgIP42:Uy7lVCTXoubI+G/NdRJ+9IIP42

Score

10^/10

redline dumud infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

dumud

217.196.96.101:4132

Attributes

auth_value
3e18d4b90418aa3e78d8822e87c62f5c

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral16/files/0x0008000000023444-12.dat	family_redline
behavioral16/memory/2176-15-0x0000000000570000-0x00000000005A0000-memory.dmp	family_redline

Executes dropped EXE 2 IoCs

pid	Process
1324	x8259455.exe
2176	g2412948.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7c73d83c0a0062c5cead0597dac9f90beac93ae125536330571cadd52acefe75.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x8259455.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 1324	3036	7c73d83c0a0062c5cead0597dac9f90beac93ae125536330571cadd52acefe75.exe	83
PID 3036 wrote to memory of 1324	3036	7c73d83c0a0062c5cead0597dac9f90beac93ae125536330571cadd52acefe75.exe	83
PID 3036 wrote to memory of 1324	3036	7c73d83c0a0062c5cead0597dac9f90beac93ae125536330571cadd52acefe75.exe	83
PID 1324 wrote to memory of 2176	1324	x8259455.exe	85
PID 1324 wrote to memory of 2176	1324	x8259455.exe	85
PID 1324 wrote to memory of 2176	1324	x8259455.exe	85

C:\Users\Admin\AppData\Local\Temp\7c73d83c0a0062c5cead0597dac9f90beac93ae125536330571cadd52acefe75.exe
"C:\Users\Admin\AppData\Local\Temp\7c73d83c0a0062c5cead0597dac9f90beac93ae125536330571cadd52acefe75.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8259455.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8259455.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1324
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g2412948.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g2412948.exe
    3⤵
    - Executes dropped EXE
    PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8259455.exe

Filesize
307KB

MD5
851a5f99a016bd43c7a70531d0676684

SHA1
d079d1c95a771f7b293d4936e046f144599191f6

SHA256
be5114d10db820426670fbbb41db92b8671a5f55a0b396e2d54b44606067a6f3

SHA512
3205df87162fa5c10064d9361c78e7c07582c7da1d7f327e74d3758f477c585e5899e3b82b2a654307d295490f39e39b4d04fb25c27c1cc27f932380a2f4d361

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g2412948.exe

Filesize
168KB

MD5
7fcf4cd3e71c764f90fd9a4e5ab142c4

SHA1
e723b9230c9af8c1141cbca0f6dd1e34341a6653

SHA256
8c420dc55efa7fe6a808f9acc4d0b9069edd9b038bb71568911694d2083a1d6b

SHA512
b9c6293825caaa2efc67cd6016627bdfd77a251275ce57b6220da0faa0fe1939233756c12a65c17e3960e8e87f13e1187a088bf94453f638d5d40055b90ceee4

Download Submit
memory/2176-14-0x0000000073D6E000-0x0000000073D6F000-memory.dmp

Filesize
4KB

Download
memory/2176-15-0x0000000000570000-0x00000000005A0000-memory.dmp

Filesize
192KB

Download
memory/2176-16-0x0000000004D50000-0x0000000004D56000-memory.dmp

Filesize
24KB

Download
memory/2176-17-0x0000000005660000-0x0000000005C78000-memory.dmp

Filesize
6.1MB

Download
memory/2176-18-0x0000000005150000-0x000000000525A000-memory.dmp

Filesize
1.0MB

Download
memory/2176-19-0x0000000005040000-0x0000000005052000-memory.dmp

Filesize
72KB

Download
memory/2176-20-0x0000000073D60000-0x0000000074510000-memory.dmp

Filesize
7.7MB

Download
memory/2176-21-0x0000000005060000-0x000000000509C000-memory.dmp

Filesize
240KB

Download
memory/2176-22-0x00000000050E0000-0x000000000512C000-memory.dmp

Filesize
304KB

Download
memory/2176-23-0x0000000073D6E000-0x0000000073D6F000-memory.dmp

Filesize
4KB

Download
memory/2176-24-0x0000000073D60000-0x0000000074510000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads