redline | 580af04ba9e12421280fef87334ba3ae9dc3d0e3930b8608e266b43d30e31a67

Analysis

max time kernel
139s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2024, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

580af04ba9e12421280fef87334ba3ae9dc3d0e3930b8608e266b43d30e31a67.exe
Size

895KB
MD5

142ab39c8912c1e9d2ab6b1170a4e44e
SHA1

03863f3ae665b1dcbfe5d46fa6f3f590813afc0e
SHA256

580af04ba9e12421280fef87334ba3ae9dc3d0e3930b8608e266b43d30e31a67
SHA512

566b1b3a5bcc6dc4b00980d9fb8391177df7409ccbf59bc7020a45c12ba53c379620043285c84140b5bbe41b7b14f99ce512fbe9c4f1385f841cce9e628dcef0
SSDEEP

24576:RyhxBN4j0ZynsR0AntIy4e2oeh+j3XJa55Z0nE:ET4j0ZysTarhqXsbZ0

Score

10^/10

redline dante gena discovery infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

gena

185.161.248.73:4164

Attributes

auth_value
d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

dante

185.161.248.73:4164

Attributes

auth_value
f4066af6b8a6f23125c8ee48288a3f90

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/4664-2169-0x00000000059D0000-0x0000000005A02000-memory.dmp	family_redline
behavioral1/files/0x0002000000022ef8-2174.dat	family_redline
behavioral1/memory/2808-2182-0x00000000000A0000-0x00000000000CE000-memory.dmp	family_redline
behavioral1/files/0x0007000000023c89-2194.dat	family_redline
behavioral1/memory/5528-2196-0x0000000000B40000-0x0000000000B70000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	p99195784.exe

Executes dropped EXE 4 IoCs

pid	Process
464	y94426004.exe
4664	p99195784.exe
2808	1.exe
5528	r81968521.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	580af04ba9e12421280fef87334ba3ae9dc3d0e3930b8608e266b43d30e31a67.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y94426004.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2396	4664	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	r81968521.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	580af04ba9e12421280fef87334ba3ae9dc3d0e3930b8608e266b43d30e31a67.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y94426004.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	p99195784.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4664	p99195784.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 464	4556	580af04ba9e12421280fef87334ba3ae9dc3d0e3930b8608e266b43d30e31a67.exe	84
PID 4556 wrote to memory of 464	4556	580af04ba9e12421280fef87334ba3ae9dc3d0e3930b8608e266b43d30e31a67.exe	84
PID 4556 wrote to memory of 464	4556	580af04ba9e12421280fef87334ba3ae9dc3d0e3930b8608e266b43d30e31a67.exe	84
PID 464 wrote to memory of 4664	464	y94426004.exe	85
PID 464 wrote to memory of 4664	464	y94426004.exe	85
PID 464 wrote to memory of 4664	464	y94426004.exe	85
PID 4664 wrote to memory of 2808	4664	p99195784.exe	94
PID 4664 wrote to memory of 2808	4664	p99195784.exe	94
PID 4664 wrote to memory of 2808	4664	p99195784.exe	94
PID 464 wrote to memory of 5528	464	y94426004.exe	98
PID 464 wrote to memory of 5528	464	y94426004.exe	98
PID 464 wrote to memory of 5528	464	y94426004.exe	98

C:\Users\Admin\AppData\Local\Temp\580af04ba9e12421280fef87334ba3ae9dc3d0e3930b8608e266b43d30e31a67.exe
"C:\Users\Admin\AppData\Local\Temp\580af04ba9e12421280fef87334ba3ae9dc3d0e3930b8608e266b43d30e31a67.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y94426004.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y94426004.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p99195784.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p99195784.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4664
  - - C:\Windows\Temp\1.exe
      "C:\Windows\Temp\1.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2808
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 1176
      4⤵
      Program crash
      PID:2396
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r81968521.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r81968521.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4664 -ip 4664
1⤵
PID:5536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y94426004.exe

Filesize
590KB

MD5
f9bced4427c9541e69dceb34ae5555f5

SHA1
3b66ab879cd6b73d464883d8b18f3d79a9809f53

SHA256
e69a024f5994537d025f4a3788fdbe57eab94156f90723b49ae1397d86fe92e5

SHA512
c773f39b1f8f3b58f686a47f437ef3ae7e94528b1310820d0065d13b28d291c9a940dc93e10c6cb17f9bbd848ecf95413e8b2430374c7f2d2a1d7119ae04d378

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p99195784.exe

Filesize
530KB

MD5
947151c0326523575d8fba682eb678a1

SHA1
b90bf64af87b2c886b895bcc2fa69b0c4a796ea2

SHA256
6fd5c7c7004fd34d3fc0f7ba4fdf3a2659d5810c431b320a1a6f2edde6f095b9

SHA512
96219dd3665162ffc04799a508068e6fda28b27d5a8da10a29b0bb39c41893e4201605e530925e089409825d0c92dd5d5f16ced768789d351bf94cd8a5f7140b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r81968521.exe

Filesize
168KB

MD5
c8f9b5387afe4b12da1e67ca93447e1e

SHA1
3e841da5cc9439e20f8f74ea6bfbe3d2bec29c86

SHA256
58e69c5690cd0ba34040643ebbf894b9d1dd7ab4bc69bf105f038f35bf1334bc

SHA512
4e60af72c738abea891c7b1c0fa23d453cbc90f56b89c11a00cd76883f17dca802a464b65dc3ae418be9d3c1aa2a306b173fc0467a2e51683b36d722fc63fb9a

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
memory/2808-2182-0x00000000000A0000-0x00000000000CE000-memory.dmp

Filesize
184KB

Download
memory/2808-2183-0x0000000004980000-0x0000000004986000-memory.dmp

Filesize
24KB

Download
memory/2808-2184-0x000000000A390000-0x000000000A9A8000-memory.dmp

Filesize
6.1MB

Download
memory/2808-2185-0x0000000009F10000-0x000000000A01A000-memory.dmp

Filesize
1.0MB

Download
memory/2808-2188-0x0000000004340000-0x000000000438C000-memory.dmp

Filesize
304KB

Download
memory/2808-2187-0x0000000009EA0000-0x0000000009EDC000-memory.dmp

Filesize
240KB

Download
memory/2808-2186-0x0000000009E40000-0x0000000009E52000-memory.dmp

Filesize
72KB

Download
memory/4664-59-0x00000000057E0000-0x0000000005840000-memory.dmp

Filesize
384KB

Download
memory/4664-45-0x00000000057E0000-0x0000000005840000-memory.dmp

Filesize
384KB

Download
memory/4664-21-0x00000000057E0000-0x0000000005846000-memory.dmp

Filesize
408KB

Download
memory/4664-23-0x00000000057E0000-0x0000000005840000-memory.dmp

Filesize
384KB

Download
memory/4664-29-0x00000000057E0000-0x0000000005840000-memory.dmp

Filesize
384KB

Download
memory/4664-85-0x00000000057E0000-0x0000000005840000-memory.dmp

Filesize
384KB

Download
memory/4664-83-0x00000000057E0000-0x0000000005840000-memory.dmp

Filesize
384KB

Download
memory/4664-81-0x00000000057E0000-0x0000000005840000-memory.dmp

Filesize
384KB

Download
memory/4664-79-0x00000000057E0000-0x0000000005840000-memory.dmp

Filesize
384KB

Download
memory/4664-77-0x00000000057E0000-0x0000000005840000-memory.dmp

Filesize
384KB

Download
memory/4664-75-0x00000000057E0000-0x0000000005840000-memory.dmp

Filesize
384KB

Download
memory/4664-73-0x00000000057E0000-0x0000000005840000-memory.dmp

Filesize
384KB

Download
memory/4664-71-0x00000000057E0000-0x0000000005840000-memory.dmp

Filesize
384KB

Download
memory/4664-69-0x00000000057E0000-0x0000000005840000-memory.dmp

Filesize
384KB

Download
memory/4664-67-0x00000000057E0000-0x0000000005840000-memory.dmp

Filesize
384KB

Download
memory/4664-63-0x00000000057E0000-0x0000000005840000-memory.dmp

Filesize
384KB

Download
memory/4664-61-0x00000000057E0000-0x0000000005840000-memory.dmp

Filesize
384KB

Download
memory/4664-19-0x0000000005140000-0x00000000051A8000-memory.dmp

Filesize
416KB

Download
memory/4664-57-0x00000000057E0000-0x0000000005840000-memory.dmp

Filesize
384KB

Download
memory/4664-55-0x00000000057E0000-0x0000000005840000-memory.dmp

Filesize
384KB

Download
memory/4664-53-0x00000000057E0000-0x0000000005840000-memory.dmp

Filesize
384KB

Download
memory/4664-51-0x00000000057E0000-0x0000000005840000-memory.dmp

Filesize
384KB

Download
memory/4664-47-0x00000000057E0000-0x0000000005840000-memory.dmp

Filesize
384KB

Download
memory/4664-20-0x0000000005230000-0x00000000057D4000-memory.dmp

Filesize
5.6MB

Download
memory/4664-43-0x00000000057E0000-0x0000000005840000-memory.dmp

Filesize
384KB

Download
memory/4664-41-0x00000000057E0000-0x0000000005840000-memory.dmp

Filesize
384KB

Download
memory/4664-39-0x00000000057E0000-0x0000000005840000-memory.dmp

Filesize
384KB

Download
memory/4664-37-0x00000000057E0000-0x0000000005840000-memory.dmp

Filesize
384KB

Download
memory/4664-35-0x00000000057E0000-0x0000000005840000-memory.dmp

Filesize
384KB

Download
memory/4664-33-0x00000000057E0000-0x0000000005840000-memory.dmp

Filesize
384KB

Download
memory/4664-31-0x00000000057E0000-0x0000000005840000-memory.dmp

Filesize
384KB

Download
memory/4664-27-0x00000000057E0000-0x0000000005840000-memory.dmp

Filesize
384KB

Download
memory/4664-25-0x00000000057E0000-0x0000000005840000-memory.dmp

Filesize
384KB

Download
memory/4664-18-0x0000000000400000-0x0000000000A95000-memory.dmp

Filesize
6.6MB

Download
memory/4664-17-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/4664-15-0x0000000000DB0000-0x0000000000EB0000-memory.dmp

Filesize
1024KB

Download
memory/4664-65-0x00000000057E0000-0x0000000005840000-memory.dmp

Filesize
384KB

Download
memory/4664-49-0x00000000057E0000-0x0000000005840000-memory.dmp

Filesize
384KB

Download
memory/4664-22-0x00000000057E0000-0x0000000005840000-memory.dmp

Filesize
384KB

Download
memory/4664-2168-0x0000000000DB0000-0x0000000000EB0000-memory.dmp

Filesize
1024KB

Download
memory/4664-2169-0x00000000059D0000-0x0000000005A02000-memory.dmp

Filesize
200KB

Download
memory/4664-2191-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/4664-2192-0x0000000000400000-0x0000000000A95000-memory.dmp

Filesize
6.6MB

Download
memory/4664-2190-0x0000000000BF0000-0x0000000000C4B000-memory.dmp

Filesize
364KB

Download
memory/4664-16-0x0000000000BF0000-0x0000000000C4B000-memory.dmp

Filesize
364KB

Download
memory/5528-2196-0x0000000000B40000-0x0000000000B70000-memory.dmp

Filesize
192KB

Download
memory/5528-2197-0x0000000002BA0000-0x0000000002BA6000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads