redline | d35c17e781d839b034a6e2bdfe99897aa5896747e5f1d1a2bffda1c37524b4d2

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/11/2024, 17:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d35c17e781d839b034a6e2bdfe99897aa5896747e5f1d1a2bffda1c37524b4d2.exe
Size 477KB
Sample241110-wadtcsvlfq
SHA256 d35c17e781d839b034a6e2bdfe99897aa5896747e5f1d1a2bffda1c37524b4d2
MD5 a9941be7f18e0ef768d334cca8d3ddda
SHA1 bdad872aa95ca4b92d0a3adead1501228d3c4eaf
SHA512 36b8be41b2a6367d90b8ed8e11a2f40537bc4f78ad7edb9f4b07d1d1767cee479544bff7aa3032d07c550adada4f4b5f0c2fabc70d654866eb5479a35b9e69b1
SSDEEP 6144:KUy+bnr+2p0yN90QEz5b5zNLMSUme6YvLLOwLI3YrG5dN7kCUIZNsL8CdT5kxyPy:MMr6y90JrzCN6iOF3YrcdC+sLJ5kfvR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline fusa discovery infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

fusa

193.233.20.12:4132

Attributes

auth_value
a08b2f01bd2af756e38c5dd60e87e697

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000b000000023b81-12.dat	family_redline
behavioral1/memory/5056-15-0x0000000000920000-0x0000000000952000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 2 IoCs

pid	Process
1276	nlo69.exe
5056	bmo85.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	d35c17e781d839b034a6e2bdfe99897aa5896747e5f1d1a2bffda1c37524b4d2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	nlo69.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d35c17e781d839b034a6e2bdfe99897aa5896747e5f1d1a2bffda1c37524b4d2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlo69.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bmo85.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 1276	3892	d35c17e781d839b034a6e2bdfe99897aa5896747e5f1d1a2bffda1c37524b4d2.exe	83
PID 3892 wrote to memory of 1276	3892	d35c17e781d839b034a6e2bdfe99897aa5896747e5f1d1a2bffda1c37524b4d2.exe	83
PID 3892 wrote to memory of 1276	3892	d35c17e781d839b034a6e2bdfe99897aa5896747e5f1d1a2bffda1c37524b4d2.exe	83
PID 1276 wrote to memory of 5056	1276	nlo69.exe	84
PID 1276 wrote to memory of 5056	1276	nlo69.exe	84
PID 1276 wrote to memory of 5056	1276	nlo69.exe	84

C:\Users\Admin\AppData\Local\Temp\d35c17e781d839b034a6e2bdfe99897aa5896747e5f1d1a2bffda1c37524b4d2.exe
"C:\Users\Admin\AppData\Local\Temp\d35c17e781d839b034a6e2bdfe99897aa5896747e5f1d1a2bffda1c37524b4d2.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nlo69.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nlo69.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bmo85.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bmo85.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nlo69.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nlo69.exe
Size 202KB
SHA256 83270824ee75043fb14a0a458167f10b85b53053425f540a008301f156b419ca
MD5 e0e802da7d8cecc5c7cb08b77ec2c425
SHA1 f78e932951b3344e66e84064136e5afe6c4307be
SHA512 88b4b199cda4b823a30bc22f31366c493ea8b6a9b5473d177c0766fe184a4a427a8d6c5b70eb53771a0d7594c256c31a0a5abcfbc1b58c69e10418561279dc51
SSDEEP 3072:KTy+bnr+O1k5GWp1icKAArDZz4N9GhbkrNEk6izacxnZSxZ5djlYD:KTy+bnr+zp0yN90QEQzZxnZSxZ32
MD5 SHA1 SHA512 SSDEEP

Submit Download

bmo85.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bmo85.exe
Size 175KB
SHA256 e6d9ee8ab0ea2ade6e5a9481d8f0f921427ec6919b1b48c6067570fde270736b
MD5 da6f3bef8abc85bd09f50783059964e3
SHA1 a0f25f60ec1896c4c920ea397f40e6ce29724322
SHA512 4d2e1472b114c98c74900b8305aabbc49ba28edffdc2376206cf02e26593df4e444933b3aa19f0c6cd0ae3ac3133d656433574aaf25a57748758e5dd25edfbec
SSDEEP 3072:DxqZWN9abUP0PhSECUce2WF5hsfxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuU:VqZ5hSElb5h
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5056-14-0x000000007409E000-0x000000007409F000-memory.dmp

Download

memory/5056-15-0x0000000000920000-0x0000000000952000-memory.dmp

Download

memory/5056-16-0x00000000057E0000-0x0000000005DF8000-memory.dmp

Download

memory/5056-17-0x00000000052D0000-0x00000000053DA000-memory.dmp

Download

memory/5056-18-0x00000000051E0000-0x00000000051F2000-memory.dmp

Download

memory/5056-19-0x0000000005240000-0x000000000527C000-memory.dmp

Download

memory/5056-20-0x0000000005280000-0x00000000052CC000-memory.dmp

Download

memory/5056-21-0x000000007409E000-0x000000007409F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads