redline | b20d3b5caab986390a57d9b858c330d6fa12fa368809dfc94b90991735dc89d1

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 10:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0fbb8ff4cb39375b064e85f8aef7950a25795f035ac41fb2e1af59b5bf042d49.exe
Size

488KB
MD5

f237dee40ba985649f8a1e58c274d61a
SHA1

e5b2c7cb39a46dfa76a753e1bcd4f54a5778f3e9
SHA256

0fbb8ff4cb39375b064e85f8aef7950a25795f035ac41fb2e1af59b5bf042d49
SHA512

3ffdf0bfbcf9b606ad90e8fbb3129eb510cd91bdc54a41e3ea8aa1378a6a0aa033282223aec6924739d9ec1df4396f51e9eb42926ae9829f459f3240038671a1
SSDEEP

6144:KTy+bnr+Sp0yN90QEZnSB+ubeqXjtm1skdmVzgbIuWyYeAqxu2KcJGAW2Mj:lMr+y90zvubeCKIuWyYeL8hc8AW2Mj

Score

10^/10

redline debro infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

debro

185.161.248.75:4132

Attributes

auth_value
18c2c191aebfde5d1787ec8d805a01a8

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral4/files/0x0008000000023437-13.dat	family_redline
behavioral4/memory/3180-15-0x0000000000E20000-0x0000000000E4E000-memory.dmp	family_redline

Executes dropped EXE 2 IoCs

pid	Process
1680	x8248839.exe
3180	f5204965.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	0fbb8ff4cb39375b064e85f8aef7950a25795f035ac41fb2e1af59b5bf042d49.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x8248839.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3244 wrote to memory of 1680	3244	0fbb8ff4cb39375b064e85f8aef7950a25795f035ac41fb2e1af59b5bf042d49.exe	83
PID 3244 wrote to memory of 1680	3244	0fbb8ff4cb39375b064e85f8aef7950a25795f035ac41fb2e1af59b5bf042d49.exe	83
PID 3244 wrote to memory of 1680	3244	0fbb8ff4cb39375b064e85f8aef7950a25795f035ac41fb2e1af59b5bf042d49.exe	83
PID 1680 wrote to memory of 3180	1680	x8248839.exe	84
PID 1680 wrote to memory of 3180	1680	x8248839.exe	84
PID 1680 wrote to memory of 3180	1680	x8248839.exe	84

C:\Users\Admin\AppData\Local\Temp\0fbb8ff4cb39375b064e85f8aef7950a25795f035ac41fb2e1af59b5bf042d49.exe
"C:\Users\Admin\AppData\Local\Temp\0fbb8ff4cb39375b064e85f8aef7950a25795f035ac41fb2e1af59b5bf042d49.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8248839.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8248839.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f5204965.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f5204965.exe
    3⤵
    - Executes dropped EXE
    PID:3180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8248839.exe

Filesize
316KB

MD5
4f8d4db03ff7302c8233cbccf51b9e7a

SHA1
91379a4e8eb9b75379b3c924e1b5b95ed60bf66b

SHA256
1522207077e3aee47dc9624ce4766267091ae87f7e349887943791322b38480f

SHA512
7d60af1999d078ac0060380b570c03e8f7c665b5ef9de52af88d85aabf8d593c608709d696e627e4ef4edc7c53c0ba9d95029d2ddad2f6bfb0cb7c3c15e56d3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f5204965.exe

Filesize
168KB

MD5
60b0797319b5bd9d78fca4e893f72ecd

SHA1
6ea3a5ef662e72b4b3b686cd5bf039965ea9992a

SHA256
62a95742ea221cec99dcc68028658bd0e4f11fbe17a53e204731db7dede2d8e4

SHA512
06e3ee72844baea135e86734b5b62e508a019c0984325f9e89d1f73f7dc202c1775513c666d0cd5008ef075e24318be045d47749f5213cf9b73712a34b0fb398

Download Submit
memory/3180-14-0x0000000073DAE000-0x0000000073DAF000-memory.dmp

Filesize
4KB

Download
memory/3180-15-0x0000000000E20000-0x0000000000E4E000-memory.dmp

Filesize
184KB

Download
memory/3180-16-0x0000000003140000-0x0000000003146000-memory.dmp

Filesize
24KB

Download
memory/3180-17-0x000000000B320000-0x000000000B938000-memory.dmp

Filesize
6.1MB

Download
memory/3180-19-0x000000000AD00000-0x000000000AD12000-memory.dmp

Filesize
72KB

Download
memory/3180-18-0x000000000AE10000-0x000000000AF1A000-memory.dmp

Filesize
1.0MB

Download
memory/3180-20-0x000000000AD60000-0x000000000AD9C000-memory.dmp

Filesize
240KB

Download
memory/3180-21-0x0000000073DA0000-0x0000000074550000-memory.dmp

Filesize
7.7MB

Download
memory/3180-22-0x0000000003290000-0x00000000032DC000-memory.dmp

Filesize
304KB

Download
memory/3180-23-0x0000000073DAE000-0x0000000073DAF000-memory.dmp

Filesize
4KB

Download
memory/3180-24-0x0000000073DA0000-0x0000000074550000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads