redline | b20d3b5caab986390a57d9b858c330d6fa12fa368809dfc94b90991735dc89d1

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 10:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1522207077e3aee47dc9624ce4766267091ae87f7e349887943791322b38480f.exe
Size

316KB
MD5

4f8d4db03ff7302c8233cbccf51b9e7a
SHA1

91379a4e8eb9b75379b3c924e1b5b95ed60bf66b
SHA256

1522207077e3aee47dc9624ce4766267091ae87f7e349887943791322b38480f
SHA512

7d60af1999d078ac0060380b570c03e8f7c665b5ef9de52af88d85aabf8d593c608709d696e627e4ef4edc7c53c0ba9d95029d2ddad2f6bfb0cb7c3c15e56d3f
SSDEEP

6144:KRy+bnr+Vp0yN90QEW96G62nMR71s9dmVzgbITrydeAqe:HMr1y90ug2MRvKITrydeLe

Score

10^/10

redline debro infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

debro

185.161.248.75:4132

Attributes

auth_value
18c2c191aebfde5d1787ec8d805a01a8

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral7/files/0x00090000000233ec-5.dat	family_redline
behavioral7/memory/4616-8-0x0000000000110000-0x000000000013E000-memory.dmp	family_redline

Executes dropped EXE 1 IoCs

pid	Process
4616	f5204965.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	1522207077e3aee47dc9624ce4766267091ae87f7e349887943791322b38480f.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 4616	1540	1522207077e3aee47dc9624ce4766267091ae87f7e349887943791322b38480f.exe	81
PID 1540 wrote to memory of 4616	1540	1522207077e3aee47dc9624ce4766267091ae87f7e349887943791322b38480f.exe	81
PID 1540 wrote to memory of 4616	1540	1522207077e3aee47dc9624ce4766267091ae87f7e349887943791322b38480f.exe	81

C:\Users\Admin\AppData\Local\Temp\1522207077e3aee47dc9624ce4766267091ae87f7e349887943791322b38480f.exe
"C:\Users\Admin\AppData\Local\Temp\1522207077e3aee47dc9624ce4766267091ae87f7e349887943791322b38480f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\f5204965.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\f5204965.exe
  2⤵
  - Executes dropped EXE
  PID:4616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\f5204965.exe

Filesize
168KB

MD5
60b0797319b5bd9d78fca4e893f72ecd

SHA1
6ea3a5ef662e72b4b3b686cd5bf039965ea9992a

SHA256
62a95742ea221cec99dcc68028658bd0e4f11fbe17a53e204731db7dede2d8e4

SHA512
06e3ee72844baea135e86734b5b62e508a019c0984325f9e89d1f73f7dc202c1775513c666d0cd5008ef075e24318be045d47749f5213cf9b73712a34b0fb398

Download Submit
memory/4616-7-0x00000000747AE000-0x00000000747AF000-memory.dmp

Filesize
4KB

Download
memory/4616-8-0x0000000000110000-0x000000000013E000-memory.dmp

Filesize
184KB

Download
memory/4616-9-0x0000000004A30000-0x0000000004A36000-memory.dmp

Filesize
24KB

Download
memory/4616-10-0x000000000A460000-0x000000000AA78000-memory.dmp

Filesize
6.1MB

Download
memory/4616-11-0x0000000009F80000-0x000000000A08A000-memory.dmp

Filesize
1.0MB

Download
memory/4616-12-0x0000000009EB0000-0x0000000009EC2000-memory.dmp

Filesize
72KB

Download
memory/4616-13-0x0000000009F10000-0x0000000009F4C000-memory.dmp

Filesize
240KB

Download
memory/4616-14-0x00000000747A0000-0x0000000074F50000-memory.dmp

Filesize
7.7MB

Download
memory/4616-15-0x0000000004430000-0x000000000447C000-memory.dmp

Filesize
304KB

Download
memory/4616-16-0x00000000747AE000-0x00000000747AF000-memory.dmp

Filesize
4KB

Download
memory/4616-17-0x00000000747A0000-0x0000000074F50000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads