redline | d66c5907218da0e1082f3a1318226d1c5bab6bd1ebb57b034a817b4c35495ac8

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 09:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0848e1e7e128d7f1f97806b2608b355879b602ba08e121497f133be212790f63.exe
Size

534KB
MD5

3c37c9dee739aadac42bb79609804a88
SHA1

825fc8f20b26c3a6a0b14656ccaac4e616cac2f3
SHA256

0848e1e7e128d7f1f97806b2608b355879b602ba08e121497f133be212790f63
SHA512

c65f00987ef863db518fce5e3c73ec821d2a743b83544b96100d3388e00641d8153bfc96e29839844cd94d48fda513cae2966627c8a6881eb84cb6a8ff0022a2
SSDEEP

12288:/Mrwy90l5dDCl5EZ+oNfInGuks/c6+fB5KsUPK7TiumGBESu:PyfHEMiInGukgIB8sBOwBEL

Score

10^/10

redline luate infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

luate

77.91.124.55:19071

Attributes

auth_value
e45cd419aba6c9d372088ffe5629308b

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x00080000000234a6-12.dat	family_redline
behavioral1/memory/3292-15-0x00000000008A0000-0x00000000008D0000-memory.dmp	family_redline

Executes dropped EXE 2 IoCs

pid	Process
1328	x5353505.exe
3292	h4417973.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	0848e1e7e128d7f1f97806b2608b355879b602ba08e121497f133be212790f63.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x5353505.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 1328	224	0848e1e7e128d7f1f97806b2608b355879b602ba08e121497f133be212790f63.exe	83
PID 224 wrote to memory of 1328	224	0848e1e7e128d7f1f97806b2608b355879b602ba08e121497f133be212790f63.exe	83
PID 224 wrote to memory of 1328	224	0848e1e7e128d7f1f97806b2608b355879b602ba08e121497f133be212790f63.exe	83
PID 1328 wrote to memory of 3292	1328	x5353505.exe	84
PID 1328 wrote to memory of 3292	1328	x5353505.exe	84
PID 1328 wrote to memory of 3292	1328	x5353505.exe	84

C:\Users\Admin\AppData\Local\Temp\0848e1e7e128d7f1f97806b2608b355879b602ba08e121497f133be212790f63.exe
"C:\Users\Admin\AppData\Local\Temp\0848e1e7e128d7f1f97806b2608b355879b602ba08e121497f133be212790f63.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:224
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5353505.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5353505.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1328
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4417973.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4417973.exe
    3⤵
    - Executes dropped EXE
    PID:3292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5353505.exe

Filesize
271KB

MD5
c66d330e39f6f9413c2c81268330fc44

SHA1
e304925141e66a998b6055f850b6a85c489a6008

SHA256
fcfee37db5ae74641e6b43beec2a2f148bf23c29d8a30f9bf772b7069e448cc4

SHA512
8fffbb955f4fcd188a040ef66f3ee05b2405373b79f55990f1342c5225a1155853aa7cf3df25e00dda7f43148e7c1392487df9d637cc318e3e04507efb433fd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4417973.exe

Filesize
174KB

MD5
c48d405a321ee4a9174f2fe5698ac73f

SHA1
8b3fa46f0c04442f7c75ae73656d6f6b7b6eca0c

SHA256
612b20bc3edda08e6aa100c153992c22fc241effcc77797e6c543c08e1b39797

SHA512
edea57d9401164330e9cfc10ce3c33c78c41765255a0a6f45d56facfd8d44e41f923fa34be698d0d600d92bba6a00ccbc0a1b730d5f5522f21242697c64eed49

Download Submit
memory/3292-14-0x0000000073E8E000-0x0000000073E8F000-memory.dmp

Filesize
4KB

Download
memory/3292-15-0x00000000008A0000-0x00000000008D0000-memory.dmp

Filesize
192KB

Download
memory/3292-16-0x0000000002B40000-0x0000000002B46000-memory.dmp

Filesize
24KB

Download
memory/3292-17-0x00000000057F0000-0x0000000005E08000-memory.dmp

Filesize
6.1MB

Download
memory/3292-18-0x00000000052F0000-0x00000000053FA000-memory.dmp

Filesize
1.0MB

Download
memory/3292-19-0x0000000005230000-0x0000000005242000-memory.dmp

Filesize
72KB

Download
memory/3292-20-0x0000000005290000-0x00000000052CC000-memory.dmp

Filesize
240KB

Download
memory/3292-21-0x0000000073E80000-0x0000000074630000-memory.dmp

Filesize
7.7MB

Download
memory/3292-22-0x0000000005400000-0x000000000544C000-memory.dmp

Filesize
304KB

Download
memory/3292-23-0x0000000073E8E000-0x0000000073E8F000-memory.dmp

Filesize
4KB

Download
memory/3292-24-0x0000000073E80000-0x0000000074630000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads