redline | 2a9f83ab2ac91ccc8cd6e1258c45441900b92378d75ce4f017fccb88d374f306

General

Target

2a9f83ab2ac91ccc8cd6e1258c45441900b92378d75ce4f017fccb88d374f306.exe
Size

376KB
MD5

72c510cee77848024c19fea76d7b6b2b
SHA1

872f7c67da238239a0fb728703171885cb88f883
SHA256

2a9f83ab2ac91ccc8cd6e1258c45441900b92378d75ce4f017fccb88d374f306
SHA512

ea8e4d93ea4905606960141579c88eab42b2050c928679b9b14c876a54618a13087289a59252fffa13102fd331cb11ccc528e0e36f3972b88f8fdf36e4a4cc28
SSDEEP

6144:KAy+bnr+tp0yN90QEJa9bsKJO7l5gtARH2QKzrVAqNh9pG52:cMrBy90nWbsK+gtAgQCVPNh9p5

Score

10^/10

redline discovery infostealer persistence

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023cc2-12.dat	family_redline
behavioral1/memory/4592-15-0x0000000000A70000-0x0000000000A98000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 2 IoCs

pid	Process
4900	x0387239.exe
4592	g3582749.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2a9f83ab2ac91ccc8cd6e1258c45441900b92378d75ce4f017fccb88d374f306.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x0387239.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2a9f83ab2ac91ccc8cd6e1258c45441900b92378d75ce4f017fccb88d374f306.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x0387239.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	g3582749.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 976 wrote to memory of 4900	976	2a9f83ab2ac91ccc8cd6e1258c45441900b92378d75ce4f017fccb88d374f306.exe	83
PID 976 wrote to memory of 4900	976	2a9f83ab2ac91ccc8cd6e1258c45441900b92378d75ce4f017fccb88d374f306.exe	83
PID 976 wrote to memory of 4900	976	2a9f83ab2ac91ccc8cd6e1258c45441900b92378d75ce4f017fccb88d374f306.exe	83
PID 4900 wrote to memory of 4592	4900	x0387239.exe	84
PID 4900 wrote to memory of 4592	4900	x0387239.exe	84
PID 4900 wrote to memory of 4592	4900	x0387239.exe	84

C:\Users\Admin\AppData\Local\Temp\2a9f83ab2ac91ccc8cd6e1258c45441900b92378d75ce4f017fccb88d374f306.exe
"C:\Users\Admin\AppData\Local\Temp\2a9f83ab2ac91ccc8cd6e1258c45441900b92378d75ce4f017fccb88d374f306.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:976
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0387239.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0387239.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3582749.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3582749.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0387239.exe

Filesize
204KB

MD5
b284b074658d2223b5cf824b763873a5

SHA1
8017009e37412499c1b31e4f2a7692133ab14026

SHA256
827adba4fa168b9b082dfacd922521db69d51f3a5e8755756940f50fc7de2d6a

SHA512
00011e4945f6bcf20d936c9ac3f02dee5b24485e41fbbb0d9b2ae6ed1bc88f50916bfb34ab496ffd9d19f6308f4a26f44a73b94c994d62b7972548c4b7e500c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3582749.exe

Filesize
136KB

MD5
6e8ef3264d2f20d394d84809a3042b6a

SHA1
b8c91b452db622a589a774ead74cec244d40ac4c

SHA256
8f488264baed9cca064c9ac8bb1566826336333ac5b1f891b45cfe0fb23ad815

SHA512
099d02da0093e8c672d99a1836f108e9e2114505df6104d42ff5156d7a8a3316372eb9be88b16f86ea3c5ebcf5c2102a5fe2da8bc4d2ae625665224f7c863acc

Download Submit
memory/4592-14-0x00000000744BE000-0x00000000744BF000-memory.dmp

Filesize
4KB

Download
memory/4592-15-0x0000000000A70000-0x0000000000A98000-memory.dmp

Filesize
160KB

Download
memory/4592-16-0x0000000007D60000-0x0000000008378000-memory.dmp

Filesize
6.1MB

Download
memory/4592-17-0x00000000077D0000-0x00000000077E2000-memory.dmp

Filesize
72KB

Download
memory/4592-18-0x0000000007900000-0x0000000007A0A000-memory.dmp

Filesize
1.0MB

Download
memory/4592-19-0x0000000007830000-0x000000000786C000-memory.dmp

Filesize
240KB

Download
memory/4592-20-0x00000000744B0000-0x0000000074C60000-memory.dmp

Filesize
7.7MB

Download
memory/4592-21-0x0000000002D70000-0x0000000002DBC000-memory.dmp

Filesize
304KB

Download
memory/4592-22-0x00000000744BE000-0x00000000744BF000-memory.dmp

Filesize
4KB

Download
memory/4592-23-0x00000000744B0000-0x0000000074C60000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads