redline | f2e71aa6592b015be506f0b168900798b1c1530fb246cbe51f138b7ae3108751

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-11-2024 05:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f2e71aa6592b015be506f0b168900798b1c1530fb246cbe51f138b7ae3108751.exe
Size

759KB
MD5

948ec53b49e9c00c8cd24af5f7b97b3c
SHA1

ee708548a62b3cd3332f107836227e28110038e7
SHA256

f2e71aa6592b015be506f0b168900798b1c1530fb246cbe51f138b7ae3108751
SHA512

fe53c56b581410885821d8527829447bdf0ab4fee7f7eedd20a375a5821840ebe276f7054518331ecf7adf09afdfcdf438c61c875915e5931d081dc134436106
SSDEEP

12288:YMrZy90LRMNJ4b2OjNUZdN8veEFKwinONsEvnom4G6VS0AEoEOyr32+C:ByIMn4r5s6v3I4OuozbSXEDOGA

Score

10^/10

redline romik discovery infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

romik

193.233.20.12:4132

Attributes

auth_value
8fb78d2889ba0ca42678b59b884e88ff

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

resource	yara_rule
behavioral1/memory/3060-22-0x0000000002670000-0x00000000026B6000-memory.dmp	family_redline
behavioral1/memory/3060-24-0x0000000002890000-0x00000000028D4000-memory.dmp	family_redline
behavioral1/memory/3060-30-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/3060-88-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/3060-86-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/3060-84-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/3060-82-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/3060-80-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/3060-78-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/3060-74-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/3060-72-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/3060-70-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/3060-68-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/3060-66-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/3060-64-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/3060-62-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/3060-60-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/3060-56-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/3060-54-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/3060-53-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/3060-48-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/3060-46-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/3060-44-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/3060-42-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/3060-40-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/3060-38-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/3060-36-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/3060-34-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/3060-28-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/3060-26-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/3060-25-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/3060-76-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/3060-58-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/3060-50-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/3060-32-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
2808	vFS13.exe
3208	vLv29.exe
3060	dyV94.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	f2e71aa6592b015be506f0b168900798b1c1530fb246cbe51f138b7ae3108751.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	vFS13.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	vLv29.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyV94.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f2e71aa6592b015be506f0b168900798b1c1530fb246cbe51f138b7ae3108751.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vFS13.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vLv29.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3060	dyV94.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 2808	1632	f2e71aa6592b015be506f0b168900798b1c1530fb246cbe51f138b7ae3108751.exe	83
PID 1632 wrote to memory of 2808	1632	f2e71aa6592b015be506f0b168900798b1c1530fb246cbe51f138b7ae3108751.exe	83
PID 1632 wrote to memory of 2808	1632	f2e71aa6592b015be506f0b168900798b1c1530fb246cbe51f138b7ae3108751.exe	83
PID 2808 wrote to memory of 3208	2808	vFS13.exe	84
PID 2808 wrote to memory of 3208	2808	vFS13.exe	84
PID 2808 wrote to memory of 3208	2808	vFS13.exe	84
PID 3208 wrote to memory of 3060	3208	vLv29.exe	85
PID 3208 wrote to memory of 3060	3208	vLv29.exe	85
PID 3208 wrote to memory of 3060	3208	vLv29.exe	85

C:\Users\Admin\AppData\Local\Temp\f2e71aa6592b015be506f0b168900798b1c1530fb246cbe51f138b7ae3108751.exe
"C:\Users\Admin\AppData\Local\Temp\f2e71aa6592b015be506f0b168900798b1c1530fb246cbe51f138b7ae3108751.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vFS13.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vFS13.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vLv29.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vLv29.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3208
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dyV94.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dyV94.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vFS13.exe

Filesize
655KB

MD5
d89643e31b877a241edc5e35493a966e

SHA1
59e4fd3e6b182d5512f3c5c66c6652362c20c995

SHA256
8974ee4384c7e66d9109c75c7af1870b0c313e18e0645f4fccaf4b401c2b057c

SHA512
bb1af3275543d69094928c0dff8cf30cc3234f35552cf064ab31edf4d36b2f0d758b3b163e58963778e4b070062fd503a1c1ac07b9721182ad0e784a98a88ad2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vLv29.exe

Filesize
509KB

MD5
67a1a7cae6ea3b65bfd86312c65b2c50

SHA1
37e7729ae113353602a9798b3a14c13c6f669178

SHA256
4ecf3f6da745d90f98134512bfb0ab0513086ce2fce33fbce968a80150ea61d3

SHA512
da06322dcd2c7ea86148f731c10aa929b03178e0591e34338f2cca54204fb979d22d3fdd383cd244578b790cfc9ab9e8cad50c948d7c4b391cd94a4163b8677d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dyV94.exe

Filesize
281KB

MD5
1b3f6a341b4fa013cf3f377b3ef4f6f8

SHA1
a6cf129e55830409609df13609f2656774809e20

SHA256
7dab4b2c0841de1211db5d5f75e86c72efdf53fd445d4ccde2dc47f41d1ae65c

SHA512
b0c2b67f97cbdb58964a34de534c1c124e3566b1292c8994d7458bfb9372eeeab88f9537bf668865dcf4fba82d467149e24c830d5d8e7362c5b10ae125387417

Download Submit
memory/3060-22-0x0000000002670000-0x00000000026B6000-memory.dmp

Filesize
280KB

Download
memory/3060-23-0x0000000004F10000-0x00000000054B4000-memory.dmp

Filesize
5.6MB

Download
memory/3060-24-0x0000000002890000-0x00000000028D4000-memory.dmp

Filesize
272KB

Download
memory/3060-30-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/3060-88-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/3060-86-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/3060-84-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/3060-82-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/3060-80-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/3060-78-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/3060-74-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/3060-72-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/3060-70-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/3060-68-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/3060-66-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/3060-64-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/3060-62-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/3060-60-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/3060-56-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/3060-54-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/3060-53-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/3060-48-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/3060-46-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/3060-44-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/3060-42-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/3060-40-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/3060-38-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/3060-36-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/3060-34-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/3060-28-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/3060-26-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/3060-25-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/3060-76-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/3060-58-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/3060-50-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/3060-32-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/3060-931-0x00000000054C0000-0x0000000005AD8000-memory.dmp

Filesize
6.1MB

Download
memory/3060-932-0x0000000005AE0000-0x0000000005BEA000-memory.dmp

Filesize
1.0MB

Download
memory/3060-933-0x0000000002A80000-0x0000000002A92000-memory.dmp

Filesize
72KB

Download
memory/3060-934-0x0000000005BF0000-0x0000000005C2C000-memory.dmp

Filesize
240KB

Download
memory/3060-935-0x0000000005D30000-0x0000000005D7C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads