redline | eb6e484998852eeadcae4d3e4cd13c04bcc2453c8bbe10a381490bcb988e167b

General

Target

eb6e484998852eeadcae4d3e4cd13c04bcc2453c8bbe10a381490bcb988e167b.exe
Size

642KB
MD5

a57fa9655036317278484c572409e94d
SHA1

50627a45add7f4a4af8f3cafcc90b8cdf2802ee0
SHA256

eb6e484998852eeadcae4d3e4cd13c04bcc2453c8bbe10a381490bcb988e167b
SHA512

9c3377f4956b04f57c33a2f14307cc9c9fb6916a43045c05a8c71d776ea4728e8f76c404a366b486b4cf185b93372a9da685487686291203225098b5a182352d
SSDEEP

12288:cMrly90gBpidwCdwWBYuwN9HfJJOfDfDbIodisgIeXkOELju4Sj3:JyrpqwQwWOTn7qb9breXkLje

Score

10^/10

redline darm discovery infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

darm

C2

217.196.96.56:4138

Attributes

auth_value
d88ac8ccc04ab9979b04b46313db1648

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000c000000023bb2-12.dat	family_redline
behavioral1/memory/4192-15-0x00000000009B0000-0x00000000009E0000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 2 IoCs

pid	Process
2564	x1586885.exe
4192	g7287919.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	eb6e484998852eeadcae4d3e4cd13c04bcc2453c8bbe10a381490bcb988e167b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x1586885.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eb6e484998852eeadcae4d3e4cd13c04bcc2453c8bbe10a381490bcb988e167b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x1586885.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	g7287919.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2564	2676	eb6e484998852eeadcae4d3e4cd13c04bcc2453c8bbe10a381490bcb988e167b.exe	84
PID 2676 wrote to memory of 2564	2676	eb6e484998852eeadcae4d3e4cd13c04bcc2453c8bbe10a381490bcb988e167b.exe	84
PID 2676 wrote to memory of 2564	2676	eb6e484998852eeadcae4d3e4cd13c04bcc2453c8bbe10a381490bcb988e167b.exe	84
PID 2564 wrote to memory of 4192	2564	x1586885.exe	85
PID 2564 wrote to memory of 4192	2564	x1586885.exe	85
PID 2564 wrote to memory of 4192	2564	x1586885.exe	85

C:\Users\Admin\AppData\Local\Temp\eb6e484998852eeadcae4d3e4cd13c04bcc2453c8bbe10a381490bcb988e167b.exe
"C:\Users\Admin\AppData\Local\Temp\eb6e484998852eeadcae4d3e4cd13c04bcc2453c8bbe10a381490bcb988e167b.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1586885.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1586885.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7287919.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7287919.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1586885.exe

Filesize
384KB

MD5
fe6d5b1ea63f49632e98785f5f195a03

SHA1
45c5a274f68adb53b23a6a34d4e9dea3883b032c

SHA256
b45df2d5cac0ef81bdea0f9319d1eb1375fb1f71a0f8b7e216b7a8b9f0588fc6

SHA512
5f0a9c0b3803bfc03c993dfaac5220daf78904d76849e1996b397ae0424f9e0517ebe81dbd12a7e1271f6ae83a95b16f51ca583932d0c18aef3aa28329baea59

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7287919.exe

Filesize
168KB

MD5
b2be1e3f2c8caaf0de30d13577614a7c

SHA1
771aa13d2dec710338159440b3a1b69afafe81c6

SHA256
974a72b36e24037042b543abc88dd85f40b8ab4c9a1766793b27c20117d73534

SHA512
cd015840965bfbb8e660751a23155b578d4c13a9c99d4afc6c4594e004e74cdc6ea15478d8262163bf71bcf676c14b996564673e51d4d88a08ca50702a939bfd

Download Submit
memory/4192-14-0x000000007432E000-0x000000007432F000-memory.dmp

Filesize
4KB

Download
memory/4192-15-0x00000000009B0000-0x00000000009E0000-memory.dmp

Filesize
192KB

Download
memory/4192-16-0x0000000005190000-0x0000000005196000-memory.dmp

Filesize
24KB

Download
memory/4192-17-0x000000000AD30000-0x000000000B348000-memory.dmp

Filesize
6.1MB

Download
memory/4192-18-0x000000000A820000-0x000000000A92A000-memory.dmp

Filesize
1.0MB

Download
memory/4192-19-0x000000000A750000-0x000000000A762000-memory.dmp

Filesize
72KB

Download
memory/4192-20-0x000000000A7B0000-0x000000000A7EC000-memory.dmp

Filesize
240KB

Download
memory/4192-21-0x0000000074320000-0x0000000074AD0000-memory.dmp

Filesize
7.7MB

Download
memory/4192-22-0x0000000002B80000-0x0000000002BCC000-memory.dmp

Filesize
304KB

Download
memory/4192-23-0x000000007432E000-0x000000007432F000-memory.dmp

Filesize
4KB

Download
memory/4192-24-0x0000000074320000-0x0000000074AD0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads