redline | 4de1124a0c0b201907321b44ffbad15b2e2e9ad38b6ae1a833ce56f145c5c177

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 11:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a6784f4b550acc54cc3376066858e706933e32e7c275b9b79acf346dc3cd3da5.exe
Size

488KB
MD5

7a5c3e1e5f4b6babd35faf0480dd409f
SHA1

7870f67f3efce145f0e49b4d85b99bea3a7a6283
SHA256

a6784f4b550acc54cc3376066858e706933e32e7c275b9b79acf346dc3cd3da5
SHA512

b46eb02d9a71a09e28e75f084c2536d8a895d0571097a6477fa8be6a34594a8af12cb2de597dad38a3a5023abbae51226644bbebf541ef0f246079e982421806
SSDEEP

12288:9MrOy90vu/z2ejeR85fhKj5bKRzXN+CZz+xQ7Xjbs:nyvfeSHKN+xd+G+SU

Score

10^/10

redline debro infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

debro

185.161.248.75:4132

Attributes

auth_value
18c2c191aebfde5d1787ec8d805a01a8

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral23/files/0x000800000002345c-12.dat	family_redline
behavioral23/memory/3068-15-0x00000000009A0000-0x00000000009CE000-memory.dmp	family_redline

Executes dropped EXE 2 IoCs

Processes:

x4616159.exef6565541.exe

pid	Process
4656	x4616159.exe
3068	f6565541.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

a6784f4b550acc54cc3376066858e706933e32e7c275b9b79acf346dc3cd3da5.exex4616159.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a6784f4b550acc54cc3376066858e706933e32e7c275b9b79acf346dc3cd3da5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x4616159.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

a6784f4b550acc54cc3376066858e706933e32e7c275b9b79acf346dc3cd3da5.exex4616159.exe

description	pid	Process	procid_target
PID 1524 wrote to memory of 4656	1524	a6784f4b550acc54cc3376066858e706933e32e7c275b9b79acf346dc3cd3da5.exe	84
PID 1524 wrote to memory of 4656	1524	a6784f4b550acc54cc3376066858e706933e32e7c275b9b79acf346dc3cd3da5.exe	84
PID 1524 wrote to memory of 4656	1524	a6784f4b550acc54cc3376066858e706933e32e7c275b9b79acf346dc3cd3da5.exe	84
PID 4656 wrote to memory of 3068	4656	x4616159.exe	85
PID 4656 wrote to memory of 3068	4656	x4616159.exe	85
PID 4656 wrote to memory of 3068	4656	x4616159.exe	85

C:\Users\Admin\AppData\Local\Temp\a6784f4b550acc54cc3376066858e706933e32e7c275b9b79acf346dc3cd3da5.exe
"C:\Users\Admin\AppData\Local\Temp\a6784f4b550acc54cc3376066858e706933e32e7c275b9b79acf346dc3cd3da5.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4616159.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4616159.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f6565541.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f6565541.exe
    3⤵
    - Executes dropped EXE
    PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4616159.exe

Filesize
316KB

MD5
6d7aae742f92b9d7649d006bbb032d43

SHA1
ddeff69dfbdf10903d566b3ad0a3d06681a81df7

SHA256
bdc8be1708b12d406d76b4c6d9cb66fc47101b1a34bef22f58bdec7f873b12f2

SHA512
4ab76eec7f2841f516ff6ce930abb2004431c9ee9cb307ec437391c47a0a3843c0fba7b4b4b5163e462fb1f55ed55fd19c14da45df90a90577c93b8a4cadcaf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f6565541.exe

Filesize
168KB

MD5
6f0d9f9c2a21c992e713ed14488ff1b6

SHA1
90c75701b6e5f4ec25130ebd7330572207f7415a

SHA256
f10a9614620b45cf5a58fdbf6c705d7dc5c8ef90172c91cdb3f48c4504803756

SHA512
d05c8ea05382bd21e13a3d34b588baca69076039b06e90cde06cd9837ceebe5437fe9136762b36cc70e003e3d9e620cc3408a1e711b3dd68b8859151ae94ed2c

Download Submit
memory/3068-14-0x000000007402E000-0x000000007402F000-memory.dmp

Filesize
4KB

Download
memory/3068-15-0x00000000009A0000-0x00000000009CE000-memory.dmp

Filesize
184KB

Download
memory/3068-16-0x0000000005400000-0x0000000005406000-memory.dmp

Filesize
24KB

Download
memory/3068-17-0x0000000005AD0000-0x00000000060E8000-memory.dmp

Filesize
6.1MB

Download
memory/3068-18-0x00000000055C0000-0x00000000056CA000-memory.dmp

Filesize
1.0MB

Download
memory/3068-19-0x0000000005450000-0x0000000005462000-memory.dmp

Filesize
72KB

Download
memory/3068-20-0x00000000054F0000-0x000000000552C000-memory.dmp

Filesize
240KB

Download
memory/3068-21-0x0000000074020000-0x00000000747D0000-memory.dmp

Filesize
7.7MB

Download
memory/3068-22-0x0000000005530000-0x000000000557C000-memory.dmp

Filesize
304KB

Download
memory/3068-23-0x000000007402E000-0x000000007402F000-memory.dmp

Filesize
4KB

Download
memory/3068-24-0x0000000074020000-0x00000000747D0000-memory.dmp

Filesize
7.7MB

Download