redline | e7f6f5bdc43ac7d3592abd41c145023459c70f3386ead747bf12a8d4eef69995

Analysis

max time kernel
148s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 10:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

149cd41e04afd54119c40358aa55b0d0de72a8c1e612ff1d1d4d79ab20ba8a01.exe
Size

488KB
MD5

d2baad5181035b853d37213e96ab5cb0
SHA1

ea7d2a47054b24b4c3f9569f6440e241448696c2
SHA256

149cd41e04afd54119c40358aa55b0d0de72a8c1e612ff1d1d4d79ab20ba8a01
SHA512

074df38a24e951caa6f69cda76683bcd9058e0ff87406a96f8d18a95998484a55e3401f89c59f28ffe029fcf581f028e40da8cf0d24deef53b1662539df3e291
SSDEEP

12288:CMrOy90tPjCZopOsfm8DfbuusCN3Tv1lpqokW4md:Yy1A+8DdsCR1/FkW4c

Score

10^/10

redline debro infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

debro

185.161.248.75:4132

Attributes

auth_value
18c2c191aebfde5d1787ec8d805a01a8

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023419-13.dat	family_redline
behavioral2/memory/540-15-0x0000000000B90000-0x0000000000BBE000-memory.dmp	family_redline

Executes dropped EXE 2 IoCs

pid	Process
1808	x4127652.exe
540	f5875111.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	149cd41e04afd54119c40358aa55b0d0de72a8c1e612ff1d1d4d79ab20ba8a01.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x4127652.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 1808	2708	149cd41e04afd54119c40358aa55b0d0de72a8c1e612ff1d1d4d79ab20ba8a01.exe	82
PID 2708 wrote to memory of 1808	2708	149cd41e04afd54119c40358aa55b0d0de72a8c1e612ff1d1d4d79ab20ba8a01.exe	82
PID 2708 wrote to memory of 1808	2708	149cd41e04afd54119c40358aa55b0d0de72a8c1e612ff1d1d4d79ab20ba8a01.exe	82
PID 1808 wrote to memory of 540	1808	x4127652.exe	83
PID 1808 wrote to memory of 540	1808	x4127652.exe	83
PID 1808 wrote to memory of 540	1808	x4127652.exe	83

C:\Users\Admin\AppData\Local\Temp\149cd41e04afd54119c40358aa55b0d0de72a8c1e612ff1d1d4d79ab20ba8a01.exe
"C:\Users\Admin\AppData\Local\Temp\149cd41e04afd54119c40358aa55b0d0de72a8c1e612ff1d1d4d79ab20ba8a01.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4127652.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4127652.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f5875111.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f5875111.exe
    3⤵
    - Executes dropped EXE
    PID:540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4127652.exe

Filesize
316KB

MD5
0dfa00ef7dd88c58d78e4340dd5ae2dc

SHA1
3c1612fd08f43f64ca684bd81f1d96fbb6a2e7f6

SHA256
66e75d8b2b30497bc2d658cff1612173503234cdd343219cabe22954ef5ed726

SHA512
65587f99b60a881ab906592dba93e724b5fae1e3269e1792c7878e55fe68fc5eaafc4a3e0c397044cf8f805332e87380b090ee60c67061aebb2178fef9b6509a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f5875111.exe

Filesize
168KB

MD5
e10039f9013490e8cda467f1f754cd85

SHA1
37ed33ecd5455d4bdf2e52a975069717581b3931

SHA256
507f56c424e6e8c6eaab75a80dae68a710d5a54b69cc232abed8ed8023355e7a

SHA512
ff520466d9ee1c6591da19f3f8de6c05a56ece708f2044169a649e5c3f8513d3beb880d58d556979a47d6f5adffc0f20703d4500ab03ef2e7862e6691ed02647

Download Submit
memory/540-14-0x00000000747AE000-0x00000000747AF000-memory.dmp

Filesize
4KB

Download
memory/540-15-0x0000000000B90000-0x0000000000BBE000-memory.dmp

Filesize
184KB

Download
memory/540-16-0x00000000055F0000-0x00000000055F6000-memory.dmp

Filesize
24KB

Download
memory/540-17-0x0000000005C50000-0x0000000006268000-memory.dmp

Filesize
6.1MB

Download
memory/540-18-0x0000000005740000-0x000000000584A000-memory.dmp

Filesize
1.0MB

Download
memory/540-19-0x0000000005650000-0x0000000005662000-memory.dmp

Filesize
72KB

Download
memory/540-21-0x00000000747A0000-0x0000000074F50000-memory.dmp

Filesize
7.7MB

Download
memory/540-20-0x00000000056B0000-0x00000000056EC000-memory.dmp

Filesize
240KB

Download
memory/540-22-0x0000000005850000-0x000000000589C000-memory.dmp

Filesize
304KB

Download
memory/540-23-0x00000000747AE000-0x00000000747AF000-memory.dmp

Filesize
4KB

Download
memory/540-24-0x00000000747A0000-0x0000000074F50000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads