redline | 25ca6357645eb71df7da45d2b869370c52a23431f9378e996c4416cec965fcb7

General

Target

25ca6357645eb71df7da45d2b869370c52a23431f9378e996c4416cec965fcb7.exe
Size

1.1MB
MD5

fa1b44ac635ddd4c819ed92d0f52e656
SHA1

0e875cff08cd78fdd80479ae01766e05be5b6d92
SHA256

25ca6357645eb71df7da45d2b869370c52a23431f9378e996c4416cec965fcb7
SHA512

7a71252b059211e1b035eea0134b527a23ffc1acfccebde280553f661481dd3ea8a69e7552c683b1e8b92ad3092d1dea52d7c748086a5bdc2e08ab20be0411a2
SSDEEP

24576:kyqbmfzddd0bWrGe7TVKrXpLsWBJCWtqFm3uGAEAyab80wjH:zVr7d0bWrVHVKrXp5DVt3uG39lj

Score

10^/10

redline doma discovery infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

doma

C2

185.161.248.75:4132

Attributes

auth_value
8be53af7f78567706928d0abef953ef4

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000b000000023b8e-19.dat	family_redline
behavioral1/memory/2032-21-0x0000000000480000-0x00000000004AA000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
3712	x0600893.exe
3788	x3129571.exe
2032	f4374488.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	25ca6357645eb71df7da45d2b869370c52a23431f9378e996c4416cec965fcb7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x0600893.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x3129571.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	25ca6357645eb71df7da45d2b869370c52a23431f9378e996c4416cec965fcb7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x0600893.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x3129571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f4374488.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 3712	2168	25ca6357645eb71df7da45d2b869370c52a23431f9378e996c4416cec965fcb7.exe	83
PID 2168 wrote to memory of 3712	2168	25ca6357645eb71df7da45d2b869370c52a23431f9378e996c4416cec965fcb7.exe	83
PID 2168 wrote to memory of 3712	2168	25ca6357645eb71df7da45d2b869370c52a23431f9378e996c4416cec965fcb7.exe	83
PID 3712 wrote to memory of 3788	3712	x0600893.exe	84
PID 3712 wrote to memory of 3788	3712	x0600893.exe	84
PID 3712 wrote to memory of 3788	3712	x0600893.exe	84
PID 3788 wrote to memory of 2032	3788	x3129571.exe	85
PID 3788 wrote to memory of 2032	3788	x3129571.exe	85
PID 3788 wrote to memory of 2032	3788	x3129571.exe	85

C:\Users\Admin\AppData\Local\Temp\25ca6357645eb71df7da45d2b869370c52a23431f9378e996c4416cec965fcb7.exe
"C:\Users\Admin\AppData\Local\Temp\25ca6357645eb71df7da45d2b869370c52a23431f9378e996c4416cec965fcb7.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0600893.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0600893.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3712
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3129571.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3129571.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3788
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f4374488.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f4374488.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0600893.exe

Filesize
748KB

MD5
639070c3e1da2be26a2b134d83fcb948

SHA1
8d69c1678063804b5f452c617c095e930e8a4c80

SHA256
457d7c0ec95ce1df50c3d02128ac16cfde10ab5ef27d92c0e4cce8d8ba2ed652

SHA512
3af988ea188d0d593aa5bf17318d6cb11bf20a60ac7801a60536bdd7839421d0051862593b7657656c5ee1fd6457b21ca11d7b59bae3bd455908f1e89bef434e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3129571.exe

Filesize
304KB

MD5
23405db80ea7da545282ad9e09c3c802

SHA1
f5b0101f860211fe62695638a46e44a51606fd05

SHA256
949221dd0e03700e5f7d221133140d157797d590d85386dec91320a982661219

SHA512
074f18e2779d03c794c196d18e6e928ed785d4e30de6b36b5e74c74b0ae4ca1b40637305ca5590ac5360e98ca7d246fb00ec910c5f9cf5752c3c9075952b16e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f4374488.exe

Filesize
145KB

MD5
d66332873dd1901cbcae8c3a9c41eb1f

SHA1
f874d161840f42ecc7099aae2dd3425d7ad04cd4

SHA256
3c85d556ec77abe9ef24fb37c69d3f4bec6c282da1fdd9202fb2c940804849aa

SHA512
fbe669423000021d456e374ad153dd7a331fb31cf4ac2b14d69b22532b3b9dde18cf7f0a7649cc3f9b0686c7af0f102e0c7124823211e54df3431180f9bba00a

Download Submit
memory/2032-21-0x0000000000480000-0x00000000004AA000-memory.dmp

Filesize
168KB

Download
memory/2032-22-0x00000000052D0000-0x00000000058E8000-memory.dmp

Filesize
6.1MB

Download
memory/2032-23-0x0000000004E10000-0x0000000004F1A000-memory.dmp

Filesize
1.0MB

Download
memory/2032-24-0x0000000004D60000-0x0000000004D72000-memory.dmp

Filesize
72KB

Download
memory/2032-25-0x0000000004D80000-0x0000000004DBC000-memory.dmp

Filesize
240KB

Download
memory/2032-26-0x0000000004DC0000-0x0000000004E0C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads