redline | 5eb722b1af29eaaa64b029ffc54dddae92acbb9c1b778b6bc51551329ed241e8

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 15:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

542eb4afaab2b90e95d070cb150ef76e8faa23f3afdd12ab49978cbb72dd389a.exe
Size

430KB
MD5

73f7d4e8343709104d395f26489cc42b
SHA1

3647210a37ca4eb97210721a09470ae5c2023985
SHA256

542eb4afaab2b90e95d070cb150ef76e8faa23f3afdd12ab49978cbb72dd389a
SHA512

38c32d8eec98525618c1fa38f65e080f065b9dcf64093b88f88d9bc9ddc821c4e3b25a60b7fc8612cffca4446c7c79433be9f17b596de7e9610db8c0ce867cb3
SSDEEP

12288:aMrHy90uY55c5go2JKza1OfB3JlEy3+mzS:tyzAigJqaofnqyul

Score

10^/10

redline taiga infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

taiga

5.42.92.51:19057

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral9/memory/3776-7-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline

Executes dropped EXE 2 IoCs

Processes:

2AY9017.exe3ja09XS.exe

pid process

3228 2AY9017.exe
3288 3ja09XS.exe

pid	process
3228	2AY9017.exe
3288	3ja09XS.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

542eb4afaab2b90e95d070cb150ef76e8faa23f3afdd12ab49978cbb72dd389a.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	542eb4afaab2b90e95d070cb150ef76e8faa23f3afdd12ab49978cbb72dd389a.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

2AY9017.exe

description pid process target process

PID 3228 set thread context of 3776 3228 2AY9017.exe AppLaunch.exe

description	pid	process	target process
PID 3228 set thread context of 3776	3228	2AY9017.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

542eb4afaab2b90e95d070cb150ef76e8faa23f3afdd12ab49978cbb72dd389a.exe2AY9017.exe

description	pid	process	target process
PID 2536 wrote to memory of 3228	2536	542eb4afaab2b90e95d070cb150ef76e8faa23f3afdd12ab49978cbb72dd389a.exe	2AY9017.exe
PID 2536 wrote to memory of 3228	2536	542eb4afaab2b90e95d070cb150ef76e8faa23f3afdd12ab49978cbb72dd389a.exe	2AY9017.exe
PID 2536 wrote to memory of 3228	2536	542eb4afaab2b90e95d070cb150ef76e8faa23f3afdd12ab49978cbb72dd389a.exe	2AY9017.exe
PID 3228 wrote to memory of 3776	3228	2AY9017.exe	AppLaunch.exe
PID 3228 wrote to memory of 3776	3228	2AY9017.exe	AppLaunch.exe
PID 3228 wrote to memory of 3776	3228	2AY9017.exe	AppLaunch.exe
PID 3228 wrote to memory of 3776	3228	2AY9017.exe	AppLaunch.exe
PID 3228 wrote to memory of 3776	3228	2AY9017.exe	AppLaunch.exe
PID 3228 wrote to memory of 3776	3228	2AY9017.exe	AppLaunch.exe
PID 3228 wrote to memory of 3776	3228	2AY9017.exe	AppLaunch.exe
PID 3228 wrote to memory of 3776	3228	2AY9017.exe	AppLaunch.exe
PID 2536 wrote to memory of 3288	2536	542eb4afaab2b90e95d070cb150ef76e8faa23f3afdd12ab49978cbb72dd389a.exe	3ja09XS.exe
PID 2536 wrote to memory of 3288	2536	542eb4afaab2b90e95d070cb150ef76e8faa23f3afdd12ab49978cbb72dd389a.exe	3ja09XS.exe
PID 2536 wrote to memory of 3288	2536	542eb4afaab2b90e95d070cb150ef76e8faa23f3afdd12ab49978cbb72dd389a.exe	3ja09XS.exe

C:\Users\Admin\AppData\Local\Temp\542eb4afaab2b90e95d070cb150ef76e8faa23f3afdd12ab49978cbb72dd389a.exe
"C:\Users\Admin\AppData\Local\Temp\542eb4afaab2b90e95d070cb150ef76e8faa23f3afdd12ab49978cbb72dd389a.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2AY9017.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2AY9017.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3228
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:3776
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3ja09XS.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3ja09XS.exe
  2⤵
  - Executes dropped EXE
  PID:3288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2AY9017.exe

Filesize
415KB

MD5
8eeba881a88e2159594ff357e066faaa

SHA1
2debc094675b204b5b20a3fd45d03030a8f8443c

SHA256
89bdfcc614f2d9f46abf2b3c5762aeebc62caa2692f8d4911f15731ed5420ce6

SHA512
a584446596961d5ba78336570681bfcdd0a72c764fbf0ad2d9e6644a579e9795f826d5f240ba4fd579babd65fb5d1af97b7512c3c90730398bfdd52ec3bb546e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3ja09XS.exe

Filesize
378KB

MD5
d562f8dea437f6c47a70df4a137b3c9a

SHA1
3f36681d23b27d14c6b061ff4add71d4f5bbf0a8

SHA256
02ea7a430cd94053ea4aa2fa2f7ebd873ce1b164cf3bfd152e25c30e31e7cdac

SHA512
a7566cba5e42f03a2037eb3bcd60009cf7cc23827db6b98d9c4e618861cc30a63bc80753d40022c7e4a15daa4e22e69df166ddaad9b6638017df7bdfc1e4cc8c

Download Submit
memory/3776-14-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/3776-11-0x000000007483E000-0x000000007483F000-memory.dmp

Filesize
4KB

Download
memory/3776-12-0x0000000008340000-0x00000000088E4000-memory.dmp

Filesize
5.6MB

Download
memory/3776-13-0x0000000007E30000-0x0000000007EC2000-memory.dmp

Filesize
584KB

Download
memory/3776-7-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3776-15-0x0000000003240000-0x000000000324A000-memory.dmp

Filesize
40KB

Download
memory/3776-16-0x0000000008F10000-0x0000000009528000-memory.dmp

Filesize
6.1MB

Download
memory/3776-17-0x00000000081A0000-0x00000000082AA000-memory.dmp

Filesize
1.0MB

Download
memory/3776-18-0x0000000007FF0000-0x0000000008002000-memory.dmp

Filesize
72KB

Download
memory/3776-19-0x0000000008090000-0x00000000080CC000-memory.dmp

Filesize
240KB

Download
memory/3776-20-0x0000000008030000-0x000000000807C000-memory.dmp

Filesize
304KB

Download