redline | 40960528f00386675ecbef76872da4bc18d084debfc822c96beac39b5326326a

General

Target

40960528f00386675ecbef76872da4bc18d084debfc822c96beac39b5326326a.exe
Size

479KB
MD5

aec6c171c9171b73fa9ffaab9d13283c
SHA1

ee653f0bcc96ddd9879c6cc5e5bf3aea8cc198ee
SHA256

40960528f00386675ecbef76872da4bc18d084debfc822c96beac39b5326326a
SHA512

43701c60a620d49202289cb5ddad95dec3f8aa290d95f172575bc56d357afce4e31703ca5697e309f527d64859feeaf778188267bf3e3f70a88aa80443035c0e
SSDEEP

6144:Kmy+bnr+qp0yN90QEMjlsLFoR1UZXEoZ5WwSaQiiG40Skl38HsJfm1B6qswIt3Y2:yMr6y90P+RClZnsoEskB6qslbLXo0

Score

10^/10

redline dumud discovery infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

dumud

C2

217.196.96.101:4132

Attributes

auth_value
3e18d4b90418aa3e78d8822e87c62f5c

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023c78-12.dat	family_redline
behavioral1/memory/1296-15-0x0000000000A90000-0x0000000000AC0000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 2 IoCs

pid	Process
5116	x9828058.exe
1296	g0504321.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	40960528f00386675ecbef76872da4bc18d084debfc822c96beac39b5326326a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x9828058.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	40960528f00386675ecbef76872da4bc18d084debfc822c96beac39b5326326a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x9828058.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	g0504321.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 5116	2184	40960528f00386675ecbef76872da4bc18d084debfc822c96beac39b5326326a.exe	84
PID 2184 wrote to memory of 5116	2184	40960528f00386675ecbef76872da4bc18d084debfc822c96beac39b5326326a.exe	84
PID 2184 wrote to memory of 5116	2184	40960528f00386675ecbef76872da4bc18d084debfc822c96beac39b5326326a.exe	84
PID 5116 wrote to memory of 1296	5116	x9828058.exe	85
PID 5116 wrote to memory of 1296	5116	x9828058.exe	85
PID 5116 wrote to memory of 1296	5116	x9828058.exe	85

C:\Users\Admin\AppData\Local\Temp\40960528f00386675ecbef76872da4bc18d084debfc822c96beac39b5326326a.exe
"C:\Users\Admin\AppData\Local\Temp\40960528f00386675ecbef76872da4bc18d084debfc822c96beac39b5326326a.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9828058.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9828058.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0504321.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0504321.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9828058.exe

Filesize
308KB

MD5
d52216f91a56278a6969980d3bb39f6c

SHA1
799ff01daf2a8aa9f6cbeb55322d29ff1e489651

SHA256
0a6f75c076559a9425a7fd132113adbad91f5c57bd9380f9a3a152c53122846c

SHA512
6cee90ac944d1b3810d0d4a6a9197687dff26cf7b93b64c14a9fb8b6e54470811799dc56a82973db1ad253d99f015a30cb24f8a06a4e805dbab05077cb42d4e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0504321.exe

Filesize
168KB

MD5
5fd7d6e31ca2e4906dcc9525474273af

SHA1
377703181cb054ba66d85317190bcbb3ee79e29a

SHA256
702997cde95c34c7db7d1c9886720a7d4c43dfc8c732d408983bf31a7a67face

SHA512
40579f152c182565ae9637c363b03a9c9ff5d8b843e215692537bb1f036d3133ee51ca237074a8c6e2710e1f1806390e4945486cd698bca9d762db9c95a745c2

Download Submit
memory/1296-14-0x00000000746CE000-0x00000000746CF000-memory.dmp

Filesize
4KB

Download
memory/1296-15-0x0000000000A90000-0x0000000000AC0000-memory.dmp

Filesize
192KB

Download
memory/1296-16-0x0000000001260000-0x0000000001266000-memory.dmp

Filesize
24KB

Download
memory/1296-17-0x000000000AEC0000-0x000000000B4D8000-memory.dmp

Filesize
6.1MB

Download
memory/1296-18-0x000000000AA40000-0x000000000AB4A000-memory.dmp

Filesize
1.0MB

Download
memory/1296-19-0x000000000A970000-0x000000000A982000-memory.dmp

Filesize
72KB

Download
memory/1296-20-0x000000000A9D0000-0x000000000AA0C000-memory.dmp

Filesize
240KB

Download
memory/1296-21-0x00000000746C0000-0x0000000074E70000-memory.dmp

Filesize
7.7MB

Download
memory/1296-22-0x0000000002C70000-0x0000000002CBC000-memory.dmp

Filesize
304KB

Download
memory/1296-23-0x00000000746CE000-0x00000000746CF000-memory.dmp

Filesize
4KB

Download
memory/1296-24-0x00000000746C0000-0x0000000074E70000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads