redline | 918cf290f7dceb2753f76eaea2f2de72d4c3af109028c49f901cef7bd1106d70

Analysis

max time kernel
131s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/11/2024, 09:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
918cf290f7dceb2753f76eaea2f2de72d4c3af109028c49f901cef7bd1106d70.exe
Size 550KB
Sample241110-kyaaaswreq
SHA256 918cf290f7dceb2753f76eaea2f2de72d4c3af109028c49f901cef7bd1106d70
MD5 ba22e5c6ee0d637bacde22ecd438b440
SHA1 6fb51cbf65e53f4d9fc3acd1738d844b677d38f9
SHA512 6059342d227fed6135637e3824b0f4d312b4e767b20369cfc1a009ec038a1236412abd57f4ab3d920749431bf954e3de9b455c23e384a55001e8df23720196e2
SSDEEP 12288:tMrEy90yV4gMtY2CDhoOqdX0GS5WBqrXRVkZ34Nygc7:py7VvMa2CDhoOqdEG2Du
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline fusa discovery infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

fusa

193.233.20.12:4132

Attributes

auth_value
a08b2f01bd2af756e38c5dd60e87e697

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0009000000023c32-12.dat	family_redline
behavioral1/memory/4284-15-0x0000000000470000-0x00000000004A2000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 2 IoCs

pid	Process
1596	njO28.exe
4284	bLF50.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	918cf290f7dceb2753f76eaea2f2de72d4c3af109028c49f901cef7bd1106d70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	njO28.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	918cf290f7dceb2753f76eaea2f2de72d4c3af109028c49f901cef7bd1106d70.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	njO28.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bLF50.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 1596	4116	918cf290f7dceb2753f76eaea2f2de72d4c3af109028c49f901cef7bd1106d70.exe	83
PID 4116 wrote to memory of 1596	4116	918cf290f7dceb2753f76eaea2f2de72d4c3af109028c49f901cef7bd1106d70.exe	83
PID 4116 wrote to memory of 1596	4116	918cf290f7dceb2753f76eaea2f2de72d4c3af109028c49f901cef7bd1106d70.exe	83
PID 1596 wrote to memory of 4284	1596	njO28.exe	84
PID 1596 wrote to memory of 4284	1596	njO28.exe	84
PID 1596 wrote to memory of 4284	1596	njO28.exe	84

C:\Users\Admin\AppData\Local\Temp\918cf290f7dceb2753f76eaea2f2de72d4c3af109028c49f901cef7bd1106d70.exe
"C:\Users\Admin\AppData\Local\Temp\918cf290f7dceb2753f76eaea2f2de72d4c3af109028c49f901cef7bd1106d70.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\njO28.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\njO28.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bLF50.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bLF50.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

njO28.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\njO28.exe
Size 202KB
SHA256 d0423217bae6dff552610d5afe42e125afd5593296b25ffe78d8f35e9ac6f9ec
MD5 29f29c47c6c1d58a2029ecee4e1b194f
SHA1 97e652d0d71214aa44dab61b49d0bd6341795157
SHA512 6a9514a71f877cea3d1a1a141e408a04d5ff0bf0a250dad710c03a7e82a1d20f666693ff2d6464b63d400d57ba0ee4f8758ee4950b4cd45407d2e83e489da320
SSDEEP 3072:Kty+bnr+O1Q5GWp1icKAArDZz4N9GhbkrNEk6azacxnZSxZ5dNlYD:Kty+bnr+vp0yN90QEUzZxnZSxZ3o
MD5 SHA1 SHA512 SSDEEP

Submit Download

bLF50.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bLF50.exe
Size 175KB
SHA256 e6d9ee8ab0ea2ade6e5a9481d8f0f921427ec6919b1b48c6067570fde270736b
MD5 da6f3bef8abc85bd09f50783059964e3
SHA1 a0f25f60ec1896c4c920ea397f40e6ce29724322
SHA512 4d2e1472b114c98c74900b8305aabbc49ba28edffdc2376206cf02e26593df4e444933b3aa19f0c6cd0ae3ac3133d656433574aaf25a57748758e5dd25edfbec
SSDEEP 3072:DxqZWN9abUP0PhSECUce2WF5hsfxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuU:VqZ5hSElb5h
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4284-14-0x00000000747BE000-0x00000000747BF000-memory.dmp

Download

memory/4284-15-0x0000000000470000-0x00000000004A2000-memory.dmp

Download

memory/4284-16-0x0000000005430000-0x0000000005A48000-memory.dmp

Download

memory/4284-17-0x0000000004F50000-0x000000000505A000-memory.dmp

Download

memory/4284-18-0x0000000004E80000-0x0000000004E92000-memory.dmp

Download

memory/4284-19-0x0000000004EE0000-0x0000000004F1C000-memory.dmp

Download

memory/4284-20-0x0000000005060000-0x00000000050AC000-memory.dmp

Download

memory/4284-21-0x00000000747BE000-0x00000000747BF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads