redline | beed3c53da7bb7e64beebecfd59fb8817f238633a13db31f215a49dd0b57e723

General

Target

beed3c53da7bb7e64beebecfd59fb8817f238633a13db31f215a49dd0b57e723.exe
Size

556KB
MD5

87dc51e11f30175c8f145115a9c4c8e2
SHA1

27136c515544038536301b1a0dea4ce0dd91feef
SHA256

beed3c53da7bb7e64beebecfd59fb8817f238633a13db31f215a49dd0b57e723
SHA512

eeab09783461fe566d9bc0f1cad480466d34a9e43b761a7bbdad61825b024c3c61637075ce847d8e7a2dfd1b63057b1f2ceb95ab164476b02ed6a16a1a9b0e64
SSDEEP

12288:7MrNy90aXoh6ngEtw4KlBhC5bOtvEaIqhWeSYvKDKkNOxpXkZgme:eyngggs5KlBs5bOp6qh9y+k87k1e

Score

10^/10

redline darm discovery infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

darm

C2

217.196.96.56:4138

Attributes

auth_value
d88ac8ccc04ab9979b04b46313db1648

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023cb9-12.dat	family_redline
behavioral1/memory/3096-15-0x0000000000F70000-0x0000000000FA0000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 2 IoCs

pid	Process
1128	x9072144.exe
3096	g3399847.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	beed3c53da7bb7e64beebecfd59fb8817f238633a13db31f215a49dd0b57e723.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x9072144.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	beed3c53da7bb7e64beebecfd59fb8817f238633a13db31f215a49dd0b57e723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x9072144.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	g3399847.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 1128	1224	beed3c53da7bb7e64beebecfd59fb8817f238633a13db31f215a49dd0b57e723.exe	83
PID 1224 wrote to memory of 1128	1224	beed3c53da7bb7e64beebecfd59fb8817f238633a13db31f215a49dd0b57e723.exe	83
PID 1224 wrote to memory of 1128	1224	beed3c53da7bb7e64beebecfd59fb8817f238633a13db31f215a49dd0b57e723.exe	83
PID 1128 wrote to memory of 3096	1128	x9072144.exe	84
PID 1128 wrote to memory of 3096	1128	x9072144.exe	84
PID 1128 wrote to memory of 3096	1128	x9072144.exe	84

C:\Users\Admin\AppData\Local\Temp\beed3c53da7bb7e64beebecfd59fb8817f238633a13db31f215a49dd0b57e723.exe
"C:\Users\Admin\AppData\Local\Temp\beed3c53da7bb7e64beebecfd59fb8817f238633a13db31f215a49dd0b57e723.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9072144.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9072144.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3399847.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3399847.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9072144.exe

Filesize
384KB

MD5
06d4ad38c7d7459f36b31a99284755d1

SHA1
e6c56a8f99e7400f3a67758dbd8470167b8160e5

SHA256
e3ad69806629e8dd2b8e3e3b8fe4785b2c311af395accfc55ba9688581627a93

SHA512
c0fecf8e7fdcfc51ba35154d2667c158b9476a768d9046e5273dae0d15b02ab81bf76ffb3cc9742f470ac7e349f4b8be32dd20d485536ab030c44ea60efa9a17

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3399847.exe

Filesize
168KB

MD5
4251fdc2d864cf089c691140550699fe

SHA1
3949dee7f274e32679bf5f1a12a6de0f1106cdba

SHA256
abfcd2c06b2d289fcd1e6110dcfc1c9a1ad3cff9d28550397881fecd4c3bcc75

SHA512
2105395f86974262bf19ab21581840f92a8349dffafb71867392b4e9aaa69a21ecba1d1de39abd0e42a685afeb6a46ac467093143dfab7e4edb28e41db747b8d

Download Submit
memory/3096-14-0x0000000074B2E000-0x0000000074B2F000-memory.dmp

Filesize
4KB

Download
memory/3096-15-0x0000000000F70000-0x0000000000FA0000-memory.dmp

Filesize
192KB

Download
memory/3096-16-0x00000000031C0000-0x00000000031C6000-memory.dmp

Filesize
24KB

Download
memory/3096-17-0x0000000005EC0000-0x00000000064D8000-memory.dmp

Filesize
6.1MB

Download
memory/3096-18-0x00000000059C0000-0x0000000005ACA000-memory.dmp

Filesize
1.0MB

Download
memory/3096-19-0x00000000058F0000-0x0000000005902000-memory.dmp

Filesize
72KB

Download
memory/3096-20-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download
memory/3096-21-0x0000000005950000-0x000000000598C000-memory.dmp

Filesize
240KB

Download
memory/3096-22-0x0000000005AD0000-0x0000000005B1C000-memory.dmp

Filesize
304KB

Download
memory/3096-23-0x0000000074B2E000-0x0000000074B2F000-memory.dmp

Filesize
4KB

Download
memory/3096-24-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads