redline | ae29634c421e7fae872a93c040b896ad770641124691367109255096c87422ba

Analysis

max time kernel
131s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 08:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bdc8be1708b12d406d76b4c6d9cb66fc47101b1a34bef22f58bdec7f873b12f2.exe
Size

316KB
MD5

6d7aae742f92b9d7649d006bbb032d43
SHA1

ddeff69dfbdf10903d566b3ad0a3d06681a81df7
SHA256

bdc8be1708b12d406d76b4c6d9cb66fc47101b1a34bef22f58bdec7f873b12f2
SHA512

4ab76eec7f2841f516ff6ce930abb2004431c9ee9cb307ec437391c47a0a3843c0fba7b4b4b5163e462fb1f55ed55fd19c14da45df90a90577c93b8a4cadcaf3
SSDEEP

6144:KPy+bnr+4p0yN90QEW96G62nMpfj3uXN9RUMuaozOKV0:VMrwy90ig2Mhj+baR3X0

Score

10^/10

redline debro infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

debro

185.161.248.75:4132

Attributes

auth_value
18c2c191aebfde5d1787ec8d805a01a8

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral24/files/0x00090000000235b2-5.dat	family_redline
behavioral24/memory/3064-8-0x0000000000EC0000-0x0000000000EEE000-memory.dmp	family_redline

Executes dropped EXE 1 IoCs

Processes:

f6565541.exe

pid	Process
3064	f6565541.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

bdc8be1708b12d406d76b4c6d9cb66fc47101b1a34bef22f58bdec7f873b12f2.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	bdc8be1708b12d406d76b4c6d9cb66fc47101b1a34bef22f58bdec7f873b12f2.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

bdc8be1708b12d406d76b4c6d9cb66fc47101b1a34bef22f58bdec7f873b12f2.exe

description	pid	Process	procid_target
PID 4736 wrote to memory of 3064	4736	bdc8be1708b12d406d76b4c6d9cb66fc47101b1a34bef22f58bdec7f873b12f2.exe	90
PID 4736 wrote to memory of 3064	4736	bdc8be1708b12d406d76b4c6d9cb66fc47101b1a34bef22f58bdec7f873b12f2.exe	90
PID 4736 wrote to memory of 3064	4736	bdc8be1708b12d406d76b4c6d9cb66fc47101b1a34bef22f58bdec7f873b12f2.exe	90

C:\Users\Admin\AppData\Local\Temp\bdc8be1708b12d406d76b4c6d9cb66fc47101b1a34bef22f58bdec7f873b12f2.exe
"C:\Users\Admin\AppData\Local\Temp\bdc8be1708b12d406d76b4c6d9cb66fc47101b1a34bef22f58bdec7f873b12f2.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\f6565541.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\f6565541.exe
  2⤵
  - Executes dropped EXE
  PID:3064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4212,i,6593821857742176458,13646536021844995125,262144 --variations-seed-version --mojo-platform-channel-handle=1308 /prefetch:8
1⤵
PID:448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\f6565541.exe

Filesize
168KB

MD5
6f0d9f9c2a21c992e713ed14488ff1b6

SHA1
90c75701b6e5f4ec25130ebd7330572207f7415a

SHA256
f10a9614620b45cf5a58fdbf6c705d7dc5c8ef90172c91cdb3f48c4504803756

SHA512
d05c8ea05382bd21e13a3d34b588baca69076039b06e90cde06cd9837ceebe5437fe9136762b36cc70e003e3d9e620cc3408a1e711b3dd68b8859151ae94ed2c

Download Submit
memory/3064-7-0x0000000073C8E000-0x0000000073C8F000-memory.dmp

Filesize
4KB

Download
memory/3064-8-0x0000000000EC0000-0x0000000000EEE000-memory.dmp

Filesize
184KB

Download
memory/3064-9-0x0000000001700000-0x0000000001706000-memory.dmp

Filesize
24KB

Download
memory/3064-10-0x000000000B210000-0x000000000B828000-memory.dmp

Filesize
6.1MB

Download
memory/3064-11-0x000000000AD40000-0x000000000AE4A000-memory.dmp

Filesize
1.0MB

Download
memory/3064-12-0x000000000AC60000-0x000000000AC72000-memory.dmp

Filesize
72KB

Download
memory/3064-13-0x000000000ACC0000-0x000000000ACFC000-memory.dmp

Filesize
240KB

Download
memory/3064-14-0x0000000073C80000-0x0000000074430000-memory.dmp

Filesize
7.7MB

Download
memory/3064-15-0x0000000001660000-0x00000000016AC000-memory.dmp

Filesize
304KB

Download
memory/3064-16-0x0000000073C8E000-0x0000000073C8F000-memory.dmp

Filesize
4KB

Download
memory/3064-17-0x0000000073C80000-0x0000000074430000-memory.dmp

Filesize
7.7MB

Download