redline | 7135d1383c6c3b928dffb0f21e1a0a7db275809f3cd64739e724c4b7aac5e90b

General

Target

7135d1383c6c3b928dffb0f21e1a0a7db275809f3cd64739e724c4b7aac5e90b.exe
Size

554KB
MD5

2e0f454388f98cd6ba7a3a3edc9aa8be
SHA1

ca53441e1115b3e83cd7879782852807f761c4f2
SHA256

7135d1383c6c3b928dffb0f21e1a0a7db275809f3cd64739e724c4b7aac5e90b
SHA512

1abc4c8c2aff5117dc69828dd82ef21933dd6b56229862c5bfcd1234b5edd57564b335306099105186082c55e57532a67c9a8775dc3cffba9a98c9b919f021ec
SSDEEP

12288:2Mrky90XfC9c3GHTgjMG5EVxofK3aAwu38K:OyKfCnT4y13ay38K

Score

10^/10

redline darm discovery infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

darm

C2

217.196.96.56:4138

Attributes

auth_value
d88ac8ccc04ab9979b04b46313db1648

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000b000000023b95-12.dat	family_redline
behavioral1/memory/4584-15-0x0000000000C10000-0x0000000000C40000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 2 IoCs

pid	Process
2660	x1035458.exe
4584	g4081829.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7135d1383c6c3b928dffb0f21e1a0a7db275809f3cd64739e724c4b7aac5e90b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x1035458.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7135d1383c6c3b928dffb0f21e1a0a7db275809f3cd64739e724c4b7aac5e90b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x1035458.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	g4081829.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 2660	3316	7135d1383c6c3b928dffb0f21e1a0a7db275809f3cd64739e724c4b7aac5e90b.exe	83
PID 3316 wrote to memory of 2660	3316	7135d1383c6c3b928dffb0f21e1a0a7db275809f3cd64739e724c4b7aac5e90b.exe	83
PID 3316 wrote to memory of 2660	3316	7135d1383c6c3b928dffb0f21e1a0a7db275809f3cd64739e724c4b7aac5e90b.exe	83
PID 2660 wrote to memory of 4584	2660	x1035458.exe	84
PID 2660 wrote to memory of 4584	2660	x1035458.exe	84
PID 2660 wrote to memory of 4584	2660	x1035458.exe	84

C:\Users\Admin\AppData\Local\Temp\7135d1383c6c3b928dffb0f21e1a0a7db275809f3cd64739e724c4b7aac5e90b.exe
"C:\Users\Admin\AppData\Local\Temp\7135d1383c6c3b928dffb0f21e1a0a7db275809f3cd64739e724c4b7aac5e90b.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1035458.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1035458.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4081829.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4081829.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1035458.exe

Filesize
382KB

MD5
85c78faabc91443e45935aec91b8c1d5

SHA1
877d308c822d9d3026b12ec2f2f031e0912269b1

SHA256
cde7ad422d1d41b413a9f63d65a7f824cd0f001bf73dd4a331e04d7cdbd0104c

SHA512
ebebd3b79937dfc1c87afd3d133649fea4833e7ab5b862773eb235d2f555881a729702f0ccc3aa0cc6e2c5fe67c306e8f77ef14a7a109482101f8c12fc79342a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4081829.exe

Filesize
168KB

MD5
75581e3d9de8f11f6c2562ee2d02871e

SHA1
e434850e8db35180240330092440a0cffe9212b6

SHA256
36aa399871a78b23e61aacb06128153d5c0523b8f6b47e38ba76b6378f634a12

SHA512
344ce41de3c1cc47805f7ee75e70b3d255de7ebc365b5121daf06796d7e4d98296148f5cc145f3095285a7225066bbf341ff3e53111e1368c4871652a314f5d7

Download Submit
memory/4584-14-0x00000000741CE000-0x00000000741CF000-memory.dmp

Filesize
4KB

Download
memory/4584-15-0x0000000000C10000-0x0000000000C40000-memory.dmp

Filesize
192KB

Download
memory/4584-16-0x0000000001460000-0x0000000001466000-memory.dmp

Filesize
24KB

Download
memory/4584-17-0x000000000AF80000-0x000000000B598000-memory.dmp

Filesize
6.1MB

Download
memory/4584-18-0x000000000AA80000-0x000000000AB8A000-memory.dmp

Filesize
1.0MB

Download
memory/4584-19-0x000000000A9B0000-0x000000000A9C2000-memory.dmp

Filesize
72KB

Download
memory/4584-20-0x000000000AA10000-0x000000000AA4C000-memory.dmp

Filesize
240KB

Download
memory/4584-21-0x00000000741C0000-0x0000000074970000-memory.dmp

Filesize
7.7MB

Download
memory/4584-22-0x00000000013E0000-0x000000000142C000-memory.dmp

Filesize
304KB

Download
memory/4584-23-0x00000000741CE000-0x00000000741CF000-memory.dmp

Filesize
4KB

Download
memory/4584-24-0x00000000741C0000-0x0000000074970000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads