redline | e19e97a334ecb39058fd976080222a46cc2159e34c85df371a9eaf0088ee80eb

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 10:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dfe8591c80d0895e6a0ba6ab5324840b06b4acfdc0570bbc6eea97239314ef49.exe
Size

376KB
MD5

6b31ed5900fe7f56e0ac67e52701b02a
SHA1

2f0f6453921a2e1fcd4201bec3ec8f219dcfd96d
SHA256

dfe8591c80d0895e6a0ba6ab5324840b06b4acfdc0570bbc6eea97239314ef49
SHA512

b6542081374cbf12d82b74898ca8f761a530e0f016c1602607b8d3a15c8582cf56948c05289d29bddd44feabea82d948f977ac9520baac0f4d32cfe987bbe369
SSDEEP

6144:K1y+bnr+Jp0yN90QEgCVzy7tYdT/2MK1peUg2/RRQIt19gkrb9ICPaKE3zkEc:vMrty902oz0tYwfjg2/R6It/fEzkB

Score

10^/10

redline infostealer persistence

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral26/files/0x0008000000023601-12.dat	family_redline
behavioral26/memory/2732-15-0x00000000007A0000-0x00000000007C8000-memory.dmp	family_redline

Executes dropped EXE 2 IoCs

pid	Process
1680	x9571162.exe
2732	g4403280.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x9571162.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	dfe8591c80d0895e6a0ba6ab5324840b06b4acfdc0570bbc6eea97239314ef49.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 1680	3412	dfe8591c80d0895e6a0ba6ab5324840b06b4acfdc0570bbc6eea97239314ef49.exe	90
PID 3412 wrote to memory of 1680	3412	dfe8591c80d0895e6a0ba6ab5324840b06b4acfdc0570bbc6eea97239314ef49.exe	90
PID 3412 wrote to memory of 1680	3412	dfe8591c80d0895e6a0ba6ab5324840b06b4acfdc0570bbc6eea97239314ef49.exe	90
PID 1680 wrote to memory of 2732	1680	x9571162.exe	91
PID 1680 wrote to memory of 2732	1680	x9571162.exe	91
PID 1680 wrote to memory of 2732	1680	x9571162.exe	91

C:\Users\Admin\AppData\Local\Temp\dfe8591c80d0895e6a0ba6ab5324840b06b4acfdc0570bbc6eea97239314ef49.exe
"C:\Users\Admin\AppData\Local\Temp\dfe8591c80d0895e6a0ba6ab5324840b06b4acfdc0570bbc6eea97239314ef49.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9571162.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9571162.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4403280.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4403280.exe
    3⤵
    - Executes dropped EXE
    PID:2732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1324,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
1⤵
PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9571162.exe

Filesize
204KB

MD5
1f9ee2ac394443cd1bc107cd25dc5636

SHA1
32b62d6bd230973b2e2058fe51b2ddfa88390336

SHA256
40941a194a4562c8e0cbf9f2639249277ac1cb6d0a38c13b673d9a170623a8b7

SHA512
2a5f801ed2dd6533cc7b257f8cfb4c4df5aa744eab3a4a7c6d24d396b9d36d481109ab02ed54136e74d1b6dcb181502d18f0c3c8413877447b81e637c92fa0cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4403280.exe

Filesize
136KB

MD5
8f30f7f88229560306c5959c605316de

SHA1
36f26a905a9743f6dd1608e39b37d1116cafcc0a

SHA256
3a616b322cc7ca87e349b8ceabb92062ed0388308d1f9221e9cdb6f65c86b6f7

SHA512
267d0f3954c416dc994e3c3e6790f6997598b71fdb7172e87265b31b7593fb29e9eb4cc295a38b969d1f2aa131b5a67525e0f4bb51a61a3dd82b7c63b867f9a0

Download Submit
memory/2732-14-0x00000000749BE000-0x00000000749BF000-memory.dmp

Filesize
4KB

Download
memory/2732-15-0x00000000007A0000-0x00000000007C8000-memory.dmp

Filesize
160KB

Download
memory/2732-16-0x0000000007BE0000-0x00000000081F8000-memory.dmp

Filesize
6.1MB

Download
memory/2732-17-0x0000000007640000-0x0000000007652000-memory.dmp

Filesize
72KB

Download
memory/2732-18-0x0000000007770000-0x000000000787A000-memory.dmp

Filesize
1.0MB

Download
memory/2732-19-0x00000000076A0000-0x00000000076DC000-memory.dmp

Filesize
240KB

Download
memory/2732-20-0x00000000749B0000-0x0000000075160000-memory.dmp

Filesize
7.7MB

Download
memory/2732-21-0x0000000002B00000-0x0000000002B4C000-memory.dmp

Filesize
304KB

Download
memory/2732-22-0x00000000749BE000-0x00000000749BF000-memory.dmp

Filesize
4KB

Download
memory/2732-23-0x00000000749B0000-0x0000000075160000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads