redline | b20d3b5caab986390a57d9b858c330d6fa12fa368809dfc94b90991735dc89d1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 10:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8672d19897720829ca8e3d11e92f295b615d0fb57d0ae1c17f1358f55bcdc74f.exe
Size

762KB
MD5

56b4ec09b7959eab1c27ee19fc26f92e
SHA1

ec6547336820cd65aa0b5122b46dd154f7235c48
SHA256

8672d19897720829ca8e3d11e92f295b615d0fb57d0ae1c17f1358f55bcdc74f
SHA512

c037beb0258697df44828b0902ba5d054160aa8e8a5877c7d151d11614a0bb81af284a223985c367d2978142a80e604efc21bf02730451c5ad36d0f0a4597508
SSDEEP

12288:HMr6y90cYfR5WWXXxFeVB5U5MZOVQTsX1YKFcL9B0Pf/aG9fn0Ev5:JytYffPXr5ATsELb0PT1n0Ev5

Score

10^/10

redline debro infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

debro

185.161.248.75:4132

Attributes

auth_value
18c2c191aebfde5d1787ec8d805a01a8

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral15/files/0x0008000000023431-19.dat	family_redline
behavioral15/memory/1664-21-0x0000000000F70000-0x0000000000F9E000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

pid	Process
4076	x7741946.exe
1188	x7311706.exe
1664	f8054662.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	8672d19897720829ca8e3d11e92f295b615d0fb57d0ae1c17f1358f55bcdc74f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x7741946.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x7311706.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 4076	3108	8672d19897720829ca8e3d11e92f295b615d0fb57d0ae1c17f1358f55bcdc74f.exe	81
PID 3108 wrote to memory of 4076	3108	8672d19897720829ca8e3d11e92f295b615d0fb57d0ae1c17f1358f55bcdc74f.exe	81
PID 3108 wrote to memory of 4076	3108	8672d19897720829ca8e3d11e92f295b615d0fb57d0ae1c17f1358f55bcdc74f.exe	81
PID 4076 wrote to memory of 1188	4076	x7741946.exe	83
PID 4076 wrote to memory of 1188	4076	x7741946.exe	83
PID 4076 wrote to memory of 1188	4076	x7741946.exe	83
PID 1188 wrote to memory of 1664	1188	x7311706.exe	84
PID 1188 wrote to memory of 1664	1188	x7311706.exe	84
PID 1188 wrote to memory of 1664	1188	x7311706.exe	84

C:\Users\Admin\AppData\Local\Temp\8672d19897720829ca8e3d11e92f295b615d0fb57d0ae1c17f1358f55bcdc74f.exe
"C:\Users\Admin\AppData\Local\Temp\8672d19897720829ca8e3d11e92f295b615d0fb57d0ae1c17f1358f55bcdc74f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7741946.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7741946.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4076
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7311706.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7311706.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1188
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f8054662.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f8054662.exe
      4⤵
      Executes dropped EXE
      PID:1664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7741946.exe

Filesize
488KB

MD5
1c6e0906d11b4bc3d241351998ea589b

SHA1
fca1f572444c36bab6ab66ac9128edc0d44674de

SHA256
05820ee56ffff9d4c8fc734d7a0c8aecd0b6727ddc4973a5a7b05723103c9b41

SHA512
820d0a5f56f7d45c50c1ff68e76f571fa605b9dce5f9e20fe6c7eaa345b676acc2d158435920ab6bab9f44e1f9cd3215701819ce85b890a41df7e07986d077e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7311706.exe

Filesize
316KB

MD5
86a80836219856467f3d6c6306a78d01

SHA1
ba5efffffe7a8475e307c94f5e2ad8376fa03fea

SHA256
585b7ec0bc0b3b0cdd09aa45f34f46984cc2526cb60f30f17ae1ee481c5af417

SHA512
98863826016da09cf9057ec859f8ac328183944dd7b84d2c8f7f2b54349af58162db512e68a92cd7eb9aceb9ad374213c477af014d694319ff7eb9e4019670c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f8054662.exe

Filesize
168KB

MD5
e352c91d3659cda91423b8ec73c5108c

SHA1
613cbcc23173c896c0d603d0a8e329dfbb6c2ce4

SHA256
cb45cbea63a6b9f7ef481cd98697c130516838bf6563ad517236f7a640ada6cc

SHA512
7cc86ef3927c852c46006471a157f75a3ace871869269c47bfa0d5be099fbe82fffba0461a803983ed79b822290dc706c77bd2e31164db66bacce02dd14494d0

Download Submit
memory/1664-21-0x0000000000F70000-0x0000000000F9E000-memory.dmp

Filesize
184KB

Download
memory/1664-22-0x0000000001820000-0x0000000001826000-memory.dmp

Filesize
24KB

Download
memory/1664-23-0x0000000005FD0000-0x00000000065E8000-memory.dmp

Filesize
6.1MB

Download
memory/1664-24-0x0000000005AC0000-0x0000000005BCA000-memory.dmp

Filesize
1.0MB

Download
memory/1664-25-0x00000000058E0000-0x00000000058F2000-memory.dmp

Filesize
72KB

Download
memory/1664-26-0x0000000005940000-0x000000000597C000-memory.dmp

Filesize
240KB

Download
memory/1664-27-0x00000000059B0000-0x00000000059FC000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads