redline | f20cf9192dee77d82577216ebe3ecf36bffdccbb84289084c68b244961b6c1f8

General

Target

f20cf9192dee77d82577216ebe3ecf36bffdccbb84289084c68b244961b6c1f8.exe
Size

642KB
MD5

c8d4dc3622df3240e200e550c863d6bd
SHA1

f927979df880ebe8ae5cd2034c8917e3eb6ac1cc
SHA256

f20cf9192dee77d82577216ebe3ecf36bffdccbb84289084c68b244961b6c1f8
SHA512

9fa5c99e549b8e81554ba13401a6304ca939c710d33bee433a119ae764a0bbe362199a3c5ee4e6494081f67be6fc60fe821564c2ca4dffaec39ba096ffbb668e
SSDEEP

12288:fMrRy90ZlpyxuLlHXg4akWDhYrRR8Pq6AlmXG0M54Qzgeq:CysLZXSmn8JvXTM5FO

Score

10^/10

redline darm discovery infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

darm

C2

217.196.96.56:4138

Attributes

auth_value
d88ac8ccc04ab9979b04b46313db1648

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023c66-12.dat	family_redline
behavioral1/memory/2988-15-0x0000000000400000-0x0000000000430000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 2 IoCs

pid	Process
4036	x4434564.exe
2988	g6414717.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	f20cf9192dee77d82577216ebe3ecf36bffdccbb84289084c68b244961b6c1f8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x4434564.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	g6414717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f20cf9192dee77d82577216ebe3ecf36bffdccbb84289084c68b244961b6c1f8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x4434564.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 4036	4976	f20cf9192dee77d82577216ebe3ecf36bffdccbb84289084c68b244961b6c1f8.exe	85
PID 4976 wrote to memory of 4036	4976	f20cf9192dee77d82577216ebe3ecf36bffdccbb84289084c68b244961b6c1f8.exe	85
PID 4976 wrote to memory of 4036	4976	f20cf9192dee77d82577216ebe3ecf36bffdccbb84289084c68b244961b6c1f8.exe	85
PID 4036 wrote to memory of 2988	4036	x4434564.exe	86
PID 4036 wrote to memory of 2988	4036	x4434564.exe	86
PID 4036 wrote to memory of 2988	4036	x4434564.exe	86

C:\Users\Admin\AppData\Local\Temp\f20cf9192dee77d82577216ebe3ecf36bffdccbb84289084c68b244961b6c1f8.exe
"C:\Users\Admin\AppData\Local\Temp\f20cf9192dee77d82577216ebe3ecf36bffdccbb84289084c68b244961b6c1f8.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4434564.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4434564.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6414717.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6414717.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4434564.exe

Filesize
383KB

MD5
e6149e578731129739dd84aefc20c43c

SHA1
8caba7cf289cb29fc9916a34268fec5bb6c0254b

SHA256
c786f458881b404d5c23751aaf01d1d1102974a44f4638d5d3ca2fa466ddc07f

SHA512
543fab33959a6f88257427583e2b565b2ebe1337060ce296d43a06fef371a4a65c5007fa974ba848a2beb317b9102281804330d81c617d42695073b5a400984d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6414717.exe

Filesize
168KB

MD5
580c9d8d9ebe54c85245f99a251248d6

SHA1
1304ee1f098092fbbd4dc4c056d8b04f258f8448

SHA256
2b8e07758b0d046ec83a7f62bb33ff86063f984d80c7ea4e274c5eae62629f57

SHA512
2e637ba269f16ba2b578ccc62d34b38ab78e75d2d777705a24ea47dd9d9e553ef21b74227b5289e651704ed182d4c7defcf7afd700ac2acb07f4ea532a0e4639

Download Submit
memory/2988-14-0x0000000074AFE000-0x0000000074AFF000-memory.dmp

Filesize
4KB

Download
memory/2988-15-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2988-16-0x0000000000AB0000-0x0000000000AB6000-memory.dmp

Filesize
24KB

Download
memory/2988-17-0x0000000005420000-0x0000000005A38000-memory.dmp

Filesize
6.1MB

Download
memory/2988-18-0x0000000004F10000-0x000000000501A000-memory.dmp

Filesize
1.0MB

Download
memory/2988-19-0x0000000004D60000-0x0000000004D72000-memory.dmp

Filesize
72KB

Download
memory/2988-20-0x0000000074AF0000-0x00000000752A0000-memory.dmp

Filesize
7.7MB

Download
memory/2988-21-0x0000000004E00000-0x0000000004E3C000-memory.dmp

Filesize
240KB

Download
memory/2988-22-0x0000000004E40000-0x0000000004E8C000-memory.dmp

Filesize
304KB

Download
memory/2988-23-0x0000000074AFE000-0x0000000074AFF000-memory.dmp

Filesize
4KB

Download
memory/2988-24-0x0000000074AF0000-0x00000000752A0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads