redline | 4de1124a0c0b201907321b44ffbad15b2e2e9ad38b6ae1a833ce56f145c5c177

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 11:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b3c25930d8e5239354b72caa7636c9cd244db255f2dbdad867a4095441c91c3.exe
Size

488KB
MD5

7708f942fc03661888b12d848e63be86
SHA1

ce37a96ff8c2a103828b904568a181ffaaf53341
SHA256

3b3c25930d8e5239354b72caa7636c9cd244db255f2dbdad867a4095441c91c3
SHA512

3bd43a4bc4ce233e3c28563c222c3443ecf2d81cd229669addcafaf24d6d5115e73db80f8030169bcbc3980f043030df354adbf43d28532d82bfe187e0df78bf
SSDEEP

12288:VMr8y90FONVwfOLFGj67nSaJejITycHNb85:9y7N2yFTS+t45

Score

10^/10

redline debro infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

debro

185.161.248.75:4132

Attributes

auth_value
18c2c191aebfde5d1787ec8d805a01a8

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral5/files/0x0008000000023401-12.dat	family_redline
behavioral5/memory/3232-15-0x0000000000660000-0x000000000068E000-memory.dmp	family_redline

Executes dropped EXE 2 IoCs

Processes:

x7298016.exef9072388.exe

pid	Process
1932	x7298016.exe
3232	f9072388.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

3b3c25930d8e5239354b72caa7636c9cd244db255f2dbdad867a4095441c91c3.exex7298016.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	3b3c25930d8e5239354b72caa7636c9cd244db255f2dbdad867a4095441c91c3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x7298016.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

3b3c25930d8e5239354b72caa7636c9cd244db255f2dbdad867a4095441c91c3.exex7298016.exe

description	pid	Process	procid_target
PID 840 wrote to memory of 1932	840	3b3c25930d8e5239354b72caa7636c9cd244db255f2dbdad867a4095441c91c3.exe	83
PID 840 wrote to memory of 1932	840	3b3c25930d8e5239354b72caa7636c9cd244db255f2dbdad867a4095441c91c3.exe	83
PID 840 wrote to memory of 1932	840	3b3c25930d8e5239354b72caa7636c9cd244db255f2dbdad867a4095441c91c3.exe	83
PID 1932 wrote to memory of 3232	1932	x7298016.exe	84
PID 1932 wrote to memory of 3232	1932	x7298016.exe	84
PID 1932 wrote to memory of 3232	1932	x7298016.exe	84

C:\Users\Admin\AppData\Local\Temp\3b3c25930d8e5239354b72caa7636c9cd244db255f2dbdad867a4095441c91c3.exe
"C:\Users\Admin\AppData\Local\Temp\3b3c25930d8e5239354b72caa7636c9cd244db255f2dbdad867a4095441c91c3.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:840
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7298016.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7298016.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f9072388.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f9072388.exe
    3⤵
    - Executes dropped EXE
    PID:3232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7298016.exe

Filesize
316KB

MD5
94a02d62c4e080836f944e844ec8b5d4

SHA1
9a8aabb5ed9387cebf5f1ff4216f1c02b28a0603

SHA256
cc7742c8001c4a7afeeb3158d2ab1ec0ba7e424607202fda0368e3c083efc012

SHA512
1abe32d98d730410ae3cec75228d4ee70b7606a44c0cf502df169d82dcc018c891003815a9e4d9ce84067bfc5fcace37565fb08a882da458383d117213a39a50

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f9072388.exe

Filesize
168KB

MD5
eb8b7ed031907feef48b8ca46cf405da

SHA1
9b5d75b4ef1107d40c94b9df351d069768849775

SHA256
6ced36faeef589c276016664daf454735510bd994189307c54188179f845d5db

SHA512
ce7182db29e02d600297e1a279f4990178a8d3f232b13ccb221172b9771b5f9cdc6c6ec082035e6e2102d338de0a7c88e9052e592e26dfb55588f22fceaed394

Download Submit
memory/3232-14-0x00000000746FE000-0x00000000746FF000-memory.dmp

Filesize
4KB

Download
memory/3232-15-0x0000000000660000-0x000000000068E000-memory.dmp

Filesize
184KB

Download
memory/3232-16-0x0000000000D40000-0x0000000000D46000-memory.dmp

Filesize
24KB

Download
memory/3232-17-0x000000000AA50000-0x000000000B068000-memory.dmp

Filesize
6.1MB

Download
memory/3232-18-0x000000000A540000-0x000000000A64A000-memory.dmp

Filesize
1.0MB

Download
memory/3232-19-0x000000000A430000-0x000000000A442000-memory.dmp

Filesize
72KB

Download
memory/3232-20-0x00000000746F0000-0x0000000074EA0000-memory.dmp

Filesize
7.7MB

Download
memory/3232-21-0x000000000A490000-0x000000000A4CC000-memory.dmp

Filesize
240KB

Download
memory/3232-22-0x0000000000E80000-0x0000000000ECC000-memory.dmp

Filesize
304KB

Download
memory/3232-23-0x00000000746FE000-0x00000000746FF000-memory.dmp

Filesize
4KB

Download
memory/3232-24-0x00000000746F0000-0x0000000074EA0000-memory.dmp

Filesize
7.7MB

Download