redline | 2dc4a356558b229e53998e6c114b3697aa1cf08f3da6122b2d3c5b01c9790414

General

Target

2dc4a356558b229e53998e6c114b3697aa1cf08f3da6122b2d3c5b01c9790414.exe
Size

479KB
MD5

e821de3920101930f276babb770be5d9
SHA1

946be878107032eea4d9d487e6689bf60b421eba
SHA256

2dc4a356558b229e53998e6c114b3697aa1cf08f3da6122b2d3c5b01c9790414
SHA512

43eee2b89a56e8d1db9d07ca1e73dedd34642273bc6dd528284fe1cde5c98436dd193ac82e5eec210ed203e238a80ce36737496ada192e373c912503882ac82b
SSDEEP

12288:8Mr4y90IFnDSTEnL0kJmCNqN2cFVwcBw8g:EyPFIk7qEcFec7g

Score

10^/10

redline diwer discovery infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

diwer

C2

217.196.96.101:4132

Attributes

auth_value
42abfa9e4f2e290c8bdbc776fd9bb6ad

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g2275454.exe	family_redline
behavioral1/memory/2460-15-0x00000000006B0000-0x00000000006E0000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 2 IoCs

Processes:

x2358444.exeg2275454.exe

pid process

3036 x2358444.exe
2460 g2275454.exe

pid	process
3036	x2358444.exe
2460	g2275454.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2dc4a356558b229e53998e6c114b3697aa1cf08f3da6122b2d3c5b01c9790414.exex2358444.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2dc4a356558b229e53998e6c114b3697aa1cf08f3da6122b2d3c5b01c9790414.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x2358444.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

2dc4a356558b229e53998e6c114b3697aa1cf08f3da6122b2d3c5b01c9790414.exex2358444.exeg2275454.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2dc4a356558b229e53998e6c114b3697aa1cf08f3da6122b2d3c5b01c9790414.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x2358444.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	g2275454.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

2dc4a356558b229e53998e6c114b3697aa1cf08f3da6122b2d3c5b01c9790414.exex2358444.exe

description	pid	process	target process
PID 2176 wrote to memory of 3036	2176	2dc4a356558b229e53998e6c114b3697aa1cf08f3da6122b2d3c5b01c9790414.exe	x2358444.exe
PID 2176 wrote to memory of 3036	2176	2dc4a356558b229e53998e6c114b3697aa1cf08f3da6122b2d3c5b01c9790414.exe	x2358444.exe
PID 2176 wrote to memory of 3036	2176	2dc4a356558b229e53998e6c114b3697aa1cf08f3da6122b2d3c5b01c9790414.exe	x2358444.exe
PID 3036 wrote to memory of 2460	3036	x2358444.exe	g2275454.exe
PID 3036 wrote to memory of 2460	3036	x2358444.exe	g2275454.exe
PID 3036 wrote to memory of 2460	3036	x2358444.exe	g2275454.exe

C:\Users\Admin\AppData\Local\Temp\2dc4a356558b229e53998e6c114b3697aa1cf08f3da6122b2d3c5b01c9790414.exe
"C:\Users\Admin\AppData\Local\Temp\2dc4a356558b229e53998e6c114b3697aa1cf08f3da6122b2d3c5b01c9790414.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2176

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2358444.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2358444.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3036

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g2275454.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g2275454.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2358444.exe

Filesize
307KB

MD5
0840e9dcd75121c32a5d7a4871500152

SHA1
67ce5ce53304bf284ccfba27e6a1cdb8b360c63b

SHA256
bc028e2f41ebb0838fc5eec10ccf90383ca4cc4cbc4d8d19e5d7cb5599b132bc

SHA512
4675cae3742ed62ce3d997f4879db2337e01b68671a08339722e7f134ea742eeffd4b080ceff27c0e6413569e23f78d65961364e426786efe3fe4d3214e5f8ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g2275454.exe

Filesize
168KB

MD5
fec626e1ddc4aac7e6e26cf97d0fd3f0

SHA1
e240626ac0158f3da482f1d078c134e47b46af8c

SHA256
c828367fe1ab48ba851da06cbe9397babb915cf52c4ab135818088c85bff164a

SHA512
caa37fda143f48e644586ed1042583136df32b19129cb59a7e37dbec578c46aa74fa9c2d644119da85f7860c6f9ed03bd967dc8dd16203ed6f9df5cd04e693f4

Download Submit
memory/2460-14-0x0000000073E4E000-0x0000000073E4F000-memory.dmp

Filesize
4KB

Download
memory/2460-15-0x00000000006B0000-0x00000000006E0000-memory.dmp

Filesize
192KB

Download
memory/2460-16-0x0000000002860000-0x0000000002866000-memory.dmp

Filesize
24KB

Download
memory/2460-17-0x00000000055F0000-0x0000000005C08000-memory.dmp

Filesize
6.1MB

Download
memory/2460-18-0x0000000005100000-0x000000000520A000-memory.dmp

Filesize
1.0MB

Download
memory/2460-19-0x0000000005030000-0x0000000005042000-memory.dmp

Filesize
72KB

Download
memory/2460-20-0x0000000005090000-0x00000000050CC000-memory.dmp

Filesize
240KB

Download
memory/2460-21-0x0000000073E40000-0x00000000745F0000-memory.dmp

Filesize
7.7MB

Download
memory/2460-22-0x0000000005210000-0x000000000525C000-memory.dmp

Filesize
304KB

Download
memory/2460-23-0x0000000073E4E000-0x0000000073E4F000-memory.dmp

Filesize
4KB

Download
memory/2460-24-0x0000000073E40000-0x00000000745F0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads