redline | 2685b451d5bc5d1cd7c159a87efdfacd5a60c314491404e6e60e752ba3db90cf

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 15:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d1e8dbd66731cd0a95e444d0fda9ebdc32fdc49845c43907cd292619ac4e88dd.exe
Size

307KB
MD5

be44ddb40e085d64a8405eb231963d84
SHA1

089450ca5957daa8a8a3a346c6e497000c25e5cc
SHA256

d1e8dbd66731cd0a95e444d0fda9ebdc32fdc49845c43907cd292619ac4e88dd
SHA512

aedd56e83d7927b377ff827536ef601ef40b119ac3eef701b91d02d8ef2f11df222469a08064121118413e161ae5fef8060bc71df7c5675583ac5f8e3bad3c63
SSDEEP

6144:KNy+bnr+op0yN90QEwwSAl5E1S3+/9+S/k0KB5Njk:HMrUy90JrwS2ZKbu

Score

10^/10

redline dumud infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

dumud

217.196.96.101:4132

Attributes

auth_value
3e18d4b90418aa3e78d8822e87c62f5c

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral21/files/0x0007000000023430-5.dat	family_redline
behavioral21/memory/2056-8-0x00000000006B0000-0x00000000006E0000-memory.dmp	family_redline

Executes dropped EXE 1 IoCs

pid	Process
2056	g1920462.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	d1e8dbd66731cd0a95e444d0fda9ebdc32fdc49845c43907cd292619ac4e88dd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3272 wrote to memory of 2056	3272	d1e8dbd66731cd0a95e444d0fda9ebdc32fdc49845c43907cd292619ac4e88dd.exe	82
PID 3272 wrote to memory of 2056	3272	d1e8dbd66731cd0a95e444d0fda9ebdc32fdc49845c43907cd292619ac4e88dd.exe	82
PID 3272 wrote to memory of 2056	3272	d1e8dbd66731cd0a95e444d0fda9ebdc32fdc49845c43907cd292619ac4e88dd.exe	82

C:\Users\Admin\AppData\Local\Temp\d1e8dbd66731cd0a95e444d0fda9ebdc32fdc49845c43907cd292619ac4e88dd.exe
"C:\Users\Admin\AppData\Local\Temp\d1e8dbd66731cd0a95e444d0fda9ebdc32fdc49845c43907cd292619ac4e88dd.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g1920462.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g1920462.exe
  2⤵
  - Executes dropped EXE
  PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g1920462.exe

Filesize
168KB

MD5
a2c9c17afefa6bf916c24bbd4f495a6f

SHA1
47e6ae11989fc1f04d20984d5e9fb5f3b9a1a6dc

SHA256
c2983fb6cd3f07ea3641e57cf51ef8ecc219415818831b4afd88e7224332578a

SHA512
1a64cbf7435e78424e68fb832ba36d935ba717af69ccba456d7a829ce3036879acd2b8e3e770235e99ccd333cc4b0336c213cab01751bbe1309d46c7d3ff01f1

Download Submit
memory/2056-7-0x0000000073CBE000-0x0000000073CBF000-memory.dmp

Filesize
4KB

Download
memory/2056-8-0x00000000006B0000-0x00000000006E0000-memory.dmp

Filesize
192KB

Download
memory/2056-9-0x00000000028F0000-0x00000000028F6000-memory.dmp

Filesize
24KB

Download
memory/2056-10-0x000000000A9D0000-0x000000000AFE8000-memory.dmp

Filesize
6.1MB

Download
memory/2056-11-0x000000000A520000-0x000000000A62A000-memory.dmp

Filesize
1.0MB

Download
memory/2056-12-0x000000000A450000-0x000000000A462000-memory.dmp

Filesize
72KB

Download
memory/2056-13-0x000000000A4B0000-0x000000000A4EC000-memory.dmp

Filesize
240KB

Download
memory/2056-14-0x0000000073CB0000-0x0000000074460000-memory.dmp

Filesize
7.7MB

Download
memory/2056-15-0x0000000002870000-0x00000000028BC000-memory.dmp

Filesize
304KB

Download
memory/2056-16-0x0000000073CBE000-0x0000000073CBF000-memory.dmp

Filesize
4KB

Download
memory/2056-17-0x0000000073CB0000-0x0000000074460000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads