redline | 6870c12a0dc4c2a7188cdb415025c6bfcdc8fbf683103a6025749c527fa9b192

General

Target

6870c12a0dc4c2a7188cdb415025c6bfcdc8fbf683103a6025749c527fa9b192.exe
Size

1.1MB
MD5

d4ed024c5cc5dd81f1f5ee09c1473195
SHA1

8c7e89d4faaea3f2804e163617a08e068a777069
SHA256

6870c12a0dc4c2a7188cdb415025c6bfcdc8fbf683103a6025749c527fa9b192
SHA512

38ecf4c1abeee48e33becdaf0aa552036a93739deda4066edc231ac3cc7b02c4576eebb1543435f37d9fbeda740c74b9ff83a019fc7eee982466fee09cc97e7b
SSDEEP

24576:Ly9o7E8MJpBT5CmdIOT2NpGBntPOTkW8HTnfT7hOxWe:+9WE8M7jdIOTq+gkW8HTnf

Score

10^/10

redline dedu discovery infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

dedu

C2

185.161.248.75:4132

Attributes

auth_value
43fb2cf55df7896aeff6ce27ec070fea

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023c90-19.dat	family_redline
behavioral1/memory/3992-21-0x0000000000300000-0x000000000032A000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
2656	x2575747.exe
2932	x5300206.exe
3992	f2142890.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x5300206.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6870c12a0dc4c2a7188cdb415025c6bfcdc8fbf683103a6025749c527fa9b192.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x2575747.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6870c12a0dc4c2a7188cdb415025c6bfcdc8fbf683103a6025749c527fa9b192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x2575747.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x5300206.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f2142890.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2656	2648	6870c12a0dc4c2a7188cdb415025c6bfcdc8fbf683103a6025749c527fa9b192.exe	84
PID 2648 wrote to memory of 2656	2648	6870c12a0dc4c2a7188cdb415025c6bfcdc8fbf683103a6025749c527fa9b192.exe	84
PID 2648 wrote to memory of 2656	2648	6870c12a0dc4c2a7188cdb415025c6bfcdc8fbf683103a6025749c527fa9b192.exe	84
PID 2656 wrote to memory of 2932	2656	x2575747.exe	85
PID 2656 wrote to memory of 2932	2656	x2575747.exe	85
PID 2656 wrote to memory of 2932	2656	x2575747.exe	85
PID 2932 wrote to memory of 3992	2932	x5300206.exe	87
PID 2932 wrote to memory of 3992	2932	x5300206.exe	87
PID 2932 wrote to memory of 3992	2932	x5300206.exe	87

C:\Users\Admin\AppData\Local\Temp\6870c12a0dc4c2a7188cdb415025c6bfcdc8fbf683103a6025749c527fa9b192.exe
"C:\Users\Admin\AppData\Local\Temp\6870c12a0dc4c2a7188cdb415025c6bfcdc8fbf683103a6025749c527fa9b192.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2575747.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2575747.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5300206.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5300206.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2932
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f2142890.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f2142890.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2575747.exe

Filesize
750KB

MD5
fb097eb9897a43cdebd3352e915b4903

SHA1
375db14e43b235d8b55707194353ff7362558b99

SHA256
130f625c46a9ab0035a6c8cd040bd47db127e65474331bbfb22056c27326f8de

SHA512
77d5871c33f38348600935e3de4f3b2125a42f64934a96145845095a56f741129a205165814f102023423507c2ca2cc3c6821ccdb7836bee0759853bb60661b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5300206.exe

Filesize
305KB

MD5
cf0ed85ceef5b0418845811318e0fc49

SHA1
b0de1c165ccaa1623a4bb33b18ad4e299a84fc3f

SHA256
0e3aff32a50eacf45670b509e46e02bc9dbed01a65ab719494065752a8c8a47d

SHA512
a03bf67075d35d6f7222b43ed3c7fc8a6af4a75b0cd1b7cb054b8f05228dab60dc14950adc1737d8ff2c2ae5c7d0806155bcca003f8ce3621591af54bba7e448

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f2142890.exe

Filesize
145KB

MD5
ff325a9b53922c19b8d7b06487f19816

SHA1
fcf2d731b8812f18cc8561773033f621b97e471f

SHA256
81ef1f7aec23f4c2bb241b398a2fcf6df85d3cf8c871d9e16f3e5a49212e8a21

SHA512
f96a43ff139181acca5bcc10c6123409288883c084fa82d913921cfbaee4b1fecfcc9e47d337108b799763e8392e339891938b79292104073f09e7335c9c26cb

Download Submit
memory/3992-21-0x0000000000300000-0x000000000032A000-memory.dmp

Filesize
168KB

Download
memory/3992-22-0x0000000005130000-0x0000000005748000-memory.dmp

Filesize
6.1MB

Download
memory/3992-23-0x0000000004C90000-0x0000000004D9A000-memory.dmp

Filesize
1.0MB

Download
memory/3992-24-0x0000000004BD0000-0x0000000004BE2000-memory.dmp

Filesize
72KB

Download
memory/3992-25-0x0000000004C30000-0x0000000004C6C000-memory.dmp

Filesize
240KB

Download
memory/3992-26-0x0000000004DA0000-0x0000000004DEC000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads