redline | 91ecf7c5b39d759837737717ad1f5dd5ddd01d4c7241bb4c1e6853e6cf74ec38

General

Target

3630b9fd9d3d3f24c1b3116118f7068b48c74201938a8fdfaa4d32116d383abe.exe
Size

580KB
MD5

d8f38558bd9c4a83548ba56ef5e31244
SHA1

b9a5780740c0ce32515eacf5880d8d54c1328b45
SHA256

3630b9fd9d3d3f24c1b3116118f7068b48c74201938a8fdfaa4d32116d383abe
SHA512

407c4ae49e4a2c5a6b10fd92819e04f9a5d96cd8518a3181b9c4cbfeca471214eeb5ad34d0b2863beb1848e39dfbf89f8df1b79b625ee667d206f26af41d1009
SSDEEP

12288:EMrXy90ujBwhs/sT6PrijXwqpdIeOjMq5j2mCgjX4:DyvjWhs/F+jgqpCgyOgj4

Score

10^/10

redline fukia discovery infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes

auth_value
e5783636fbd9e4f0cf9a017bce02e67e

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000c000000023ba4-19.dat	family_redline
behavioral1/memory/1292-21-0x0000000000E30000-0x0000000000E62000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
2052	nHL64nb.exe
3384	nMB44vr.exe
1292	bjR77.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	3630b9fd9d3d3f24c1b3116118f7068b48c74201938a8fdfaa4d32116d383abe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	nHL64nb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	nMB44vr.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nMB44vr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bjR77.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3630b9fd9d3d3f24c1b3116118f7068b48c74201938a8fdfaa4d32116d383abe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nHL64nb.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2052	2316	3630b9fd9d3d3f24c1b3116118f7068b48c74201938a8fdfaa4d32116d383abe.exe	84
PID 2316 wrote to memory of 2052	2316	3630b9fd9d3d3f24c1b3116118f7068b48c74201938a8fdfaa4d32116d383abe.exe	84
PID 2316 wrote to memory of 2052	2316	3630b9fd9d3d3f24c1b3116118f7068b48c74201938a8fdfaa4d32116d383abe.exe	84
PID 2052 wrote to memory of 3384	2052	nHL64nb.exe	86
PID 2052 wrote to memory of 3384	2052	nHL64nb.exe	86
PID 2052 wrote to memory of 3384	2052	nHL64nb.exe	86
PID 3384 wrote to memory of 1292	3384	nMB44vr.exe	87
PID 3384 wrote to memory of 1292	3384	nMB44vr.exe	87
PID 3384 wrote to memory of 1292	3384	nMB44vr.exe	87

C:\Users\Admin\AppData\Local\Temp\3630b9fd9d3d3f24c1b3116118f7068b48c74201938a8fdfaa4d32116d383abe.exe
"C:\Users\Admin\AppData\Local\Temp\3630b9fd9d3d3f24c1b3116118f7068b48c74201938a8fdfaa4d32116d383abe.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nHL64nb.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nHL64nb.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nMB44vr.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nMB44vr.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3384
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bjR77.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bjR77.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nHL64nb.exe

Filesize
476KB

MD5
0d219a012e36a78930d1eb0b6e53e97d

SHA1
7382bc4b5c36c9f568c703df68b6a0f2b3b97a19

SHA256
2cab946252502809283a0dd54fd0a6e3a9b80716748c605a66c9884142ac946f

SHA512
7c6e6ab4414cc6d5735da1f50f6abc80551a2ababa403eefddaac769e2d636e1b8dde82c3a2b6d176f70c0384bf12a134479f33cd25129de396c8ab0aab4a1bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nMB44vr.exe

Filesize
202KB

MD5
9d6f84b2e54dbde2669be6d007d1b1a0

SHA1
6844de60b813fd6bd78697202df2f23f5b3da834

SHA256
523e1201a889a5ed5397801121514cf14753fb0c2a913d428f18fa5b6913ea7d

SHA512
ca8767674095e16db4bd769af8878845568551a856aebec7b8d31cd667db1e0d26adc8bc9dea7c354ac36e23345889a374c66857fe62997767a855cd3acf72f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bjR77.exe

Filesize
175KB

MD5
a5f5c5d6291c7ae9e1d1b7ed1e551490

SHA1
3d06413341893b838549939e15f8f1eec423d71a

SHA256
1a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e

SHA512
d9b3ba67bdd615ee2ce91a29cd9cf6723464be27bf45186fd0e9559ff2b0e7c51b423cfc3e32b5e90955046fb75a34c4a8528df7294b6c831ca254a65d2b8ba2

Download Submit
memory/1292-21-0x0000000000E30000-0x0000000000E62000-memory.dmp

Filesize
200KB

Download
memory/1292-22-0x0000000005DA0000-0x00000000063B8000-memory.dmp

Filesize
6.1MB

Download
memory/1292-23-0x0000000005910000-0x0000000005A1A000-memory.dmp

Filesize
1.0MB

Download
memory/1292-24-0x0000000005840000-0x0000000005852000-memory.dmp

Filesize
72KB

Download
memory/1292-25-0x00000000058A0000-0x00000000058DC000-memory.dmp

Filesize
240KB

Download
memory/1292-26-0x0000000005A20000-0x0000000005A6C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads