redline | f55782ea050b818bb57f945b53d16856a211e564645758753c936c6fe69059de

General

Target

f55782ea050b818bb57f945b53d16856a211e564645758753c936c6fe69059de.exe
Size

566KB
MD5

5b528b7e272930d0d45b1e583c1ca9f4
SHA1

398e3c124372b666b6657ac6a2ad6e196741c161
SHA256

f55782ea050b818bb57f945b53d16856a211e564645758753c936c6fe69059de
SHA512

519f2b53d8af9a73c497c6c10a2205c072139e1d64e9bac8dc718b8b72e079d0d207bd708349dd35085f0cfa76f26c9a314e8c8275873b88c12224e05c083846
SSDEEP

12288:TMrdy907Pc0A9I/TkBmcGwe5BBRJNohAS+pTZJrAOcBEkx92Vt+I6qx:+yQV7k8oeTB2hASsxunD2iI6qx

Score

10^/10

redline darm discovery infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

darm

C2

217.196.96.56:4138

Attributes

auth_value
d88ac8ccc04ab9979b04b46313db1648

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023c90-12.dat	family_redline
behavioral1/memory/3648-15-0x0000000000D20000-0x0000000000D50000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 2 IoCs

pid	Process
4924	y5913568.exe
3648	k7236225.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	f55782ea050b818bb57f945b53d16856a211e564645758753c936c6fe69059de.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y5913568.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y5913568.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k7236225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f55782ea050b818bb57f945b53d16856a211e564645758753c936c6fe69059de.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 4924	1144	f55782ea050b818bb57f945b53d16856a211e564645758753c936c6fe69059de.exe	84
PID 1144 wrote to memory of 4924	1144	f55782ea050b818bb57f945b53d16856a211e564645758753c936c6fe69059de.exe	84
PID 1144 wrote to memory of 4924	1144	f55782ea050b818bb57f945b53d16856a211e564645758753c936c6fe69059de.exe	84
PID 4924 wrote to memory of 3648	4924	y5913568.exe	85
PID 4924 wrote to memory of 3648	4924	y5913568.exe	85
PID 4924 wrote to memory of 3648	4924	y5913568.exe	85

C:\Users\Admin\AppData\Local\Temp\f55782ea050b818bb57f945b53d16856a211e564645758753c936c6fe69059de.exe
"C:\Users\Admin\AppData\Local\Temp\f55782ea050b818bb57f945b53d16856a211e564645758753c936c6fe69059de.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5913568.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5913568.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k7236225.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k7236225.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5913568.exe

Filesize
307KB

MD5
49b984acbeb5486bae5196b0c7b1dca5

SHA1
994571ff3e1da7295b415ac146397aa747d27d4a

SHA256
afd0e41b15989dbae02998acf3adc49d6ef72acbbf3a5c589725c8171f1a7144

SHA512
724309f2db44cfd8d472820fe4abd3d9ec0434c5fe3c0e9d5e28987a797a23c2cfae53454729c7ee265a2bf469c12420817951137897e900e6fe1f363716499c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k7236225.exe

Filesize
169KB

MD5
44a87996fe498078cf18ac4d416c381d

SHA1
8a591867db6c5c89c179a966567cb65b785c04c9

SHA256
2598ce017855dcd0191c241d7dfb6fe131d9c586c08f3333262ba7e9a6ae4c93

SHA512
ec80d3fbb3fa86bdfc8bfc9fcbc85dc9c8152e57f3a584d2e9e2e8418709d4c2e3c19060d10166c9fbe20db1acda2651a6b53550abf271e327bdf3ef97823083

Download Submit
memory/3648-14-0x00000000742FE000-0x00000000742FF000-memory.dmp

Filesize
4KB

Download
memory/3648-15-0x0000000000D20000-0x0000000000D50000-memory.dmp

Filesize
192KB

Download
memory/3648-16-0x00000000055F0000-0x00000000055F6000-memory.dmp

Filesize
24KB

Download
memory/3648-17-0x000000000B180000-0x000000000B798000-memory.dmp

Filesize
6.1MB

Download
memory/3648-18-0x000000000ACC0000-0x000000000ADCA000-memory.dmp

Filesize
1.0MB

Download
memory/3648-19-0x000000000ABF0000-0x000000000AC02000-memory.dmp

Filesize
72KB

Download
memory/3648-20-0x000000000AC50000-0x000000000AC8C000-memory.dmp

Filesize
240KB

Download
memory/3648-21-0x00000000742F0000-0x0000000074AA0000-memory.dmp

Filesize
7.7MB

Download
memory/3648-22-0x0000000002E60000-0x0000000002EAC000-memory.dmp

Filesize
304KB

Download
memory/3648-23-0x00000000742FE000-0x00000000742FF000-memory.dmp

Filesize
4KB

Download
memory/3648-24-0x00000000742F0000-0x0000000074AA0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads