redline | 6ce79a5adc7a3134f87261297697557d1f92b5469410dd99e07d5b23fa32252c

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2024, 01:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ce79a5adc7a3134f87261297697557d1f92b5469410dd99e07d5b23fa32252c.exe
Size

564KB
MD5

0a661500c947a45ee021e00b932fb98b
SHA1

a5f35ccc237b0ac34568d0fd409b83abd32e5b2e
SHA256

6ce79a5adc7a3134f87261297697557d1f92b5469410dd99e07d5b23fa32252c
SHA512

ccf07558672ef6a4e572f3e675001dd1ed0e18f3a246fa156788d5312c9fd455eeb633bbee81eadb2e828c094f4e5d0613a8a3bf8d162d11fdbbd6b93a1755bc
SSDEEP

12288:iMr0y90SDqYE/0JXOCoJOa4fEZBLvUDRgy45Z8B7OsSlJNbEM:ayoYQ0JXOCna+WgWO7OsSnNb1

Score

10^/10

redline ronur discovery infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

ronur

193.233.20.20:4134

Attributes

auth_value
f88f86755a528d4b25f6f3628c460965

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

resource	yara_rule
behavioral1/memory/1248-19-0x00000000024C0000-0x0000000002506000-memory.dmp	family_redline
behavioral1/memory/1248-21-0x0000000002850000-0x0000000002894000-memory.dmp	family_redline
behavioral1/memory/1248-33-0x0000000002850000-0x000000000288E000-memory.dmp	family_redline
behavioral1/memory/1248-85-0x0000000002850000-0x000000000288E000-memory.dmp	family_redline
behavioral1/memory/1248-81-0x0000000002850000-0x000000000288E000-memory.dmp	family_redline
behavioral1/memory/1248-79-0x0000000002850000-0x000000000288E000-memory.dmp	family_redline
behavioral1/memory/1248-77-0x0000000002850000-0x000000000288E000-memory.dmp	family_redline
behavioral1/memory/1248-75-0x0000000002850000-0x000000000288E000-memory.dmp	family_redline
behavioral1/memory/1248-73-0x0000000002850000-0x000000000288E000-memory.dmp	family_redline
behavioral1/memory/1248-69-0x0000000002850000-0x000000000288E000-memory.dmp	family_redline
behavioral1/memory/1248-65-0x0000000002850000-0x000000000288E000-memory.dmp	family_redline
behavioral1/memory/1248-63-0x0000000002850000-0x000000000288E000-memory.dmp	family_redline
behavioral1/memory/1248-61-0x0000000002850000-0x000000000288E000-memory.dmp	family_redline
behavioral1/memory/1248-59-0x0000000002850000-0x000000000288E000-memory.dmp	family_redline
behavioral1/memory/1248-57-0x0000000002850000-0x000000000288E000-memory.dmp	family_redline
behavioral1/memory/1248-55-0x0000000002850000-0x000000000288E000-memory.dmp	family_redline
behavioral1/memory/1248-53-0x0000000002850000-0x000000000288E000-memory.dmp	family_redline
behavioral1/memory/1248-51-0x0000000002850000-0x000000000288E000-memory.dmp	family_redline
behavioral1/memory/1248-49-0x0000000002850000-0x000000000288E000-memory.dmp	family_redline
behavioral1/memory/1248-47-0x0000000002850000-0x000000000288E000-memory.dmp	family_redline
behavioral1/memory/1248-45-0x0000000002850000-0x000000000288E000-memory.dmp	family_redline
behavioral1/memory/1248-43-0x0000000002850000-0x000000000288E000-memory.dmp	family_redline
behavioral1/memory/1248-41-0x0000000002850000-0x000000000288E000-memory.dmp	family_redline
behavioral1/memory/1248-39-0x0000000002850000-0x000000000288E000-memory.dmp	family_redline
behavioral1/memory/1248-37-0x0000000002850000-0x000000000288E000-memory.dmp	family_redline
behavioral1/memory/1248-35-0x0000000002850000-0x000000000288E000-memory.dmp	family_redline
behavioral1/memory/1248-31-0x0000000002850000-0x000000000288E000-memory.dmp	family_redline
behavioral1/memory/1248-29-0x0000000002850000-0x000000000288E000-memory.dmp	family_redline
behavioral1/memory/1248-83-0x0000000002850000-0x000000000288E000-memory.dmp	family_redline
behavioral1/memory/1248-27-0x0000000002850000-0x000000000288E000-memory.dmp	family_redline
behavioral1/memory/1248-71-0x0000000002850000-0x000000000288E000-memory.dmp	family_redline
behavioral1/memory/1248-67-0x0000000002850000-0x000000000288E000-memory.dmp	family_redline
behavioral1/memory/1248-25-0x0000000002850000-0x000000000288E000-memory.dmp	family_redline
behavioral1/memory/1248-23-0x0000000002850000-0x000000000288E000-memory.dmp	family_redline
behavioral1/memory/1248-22-0x0000000002850000-0x000000000288E000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 2 IoCs

pid	Process
1192	nnK02yj80.exe
1248	eqs64wC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6ce79a5adc7a3134f87261297697557d1f92b5469410dd99e07d5b23fa32252c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	nnK02yj80.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6ce79a5adc7a3134f87261297697557d1f92b5469410dd99e07d5b23fa32252c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nnK02yj80.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eqs64wC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1248	eqs64wC.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 1192	5100	6ce79a5adc7a3134f87261297697557d1f92b5469410dd99e07d5b23fa32252c.exe	83
PID 5100 wrote to memory of 1192	5100	6ce79a5adc7a3134f87261297697557d1f92b5469410dd99e07d5b23fa32252c.exe	83
PID 5100 wrote to memory of 1192	5100	6ce79a5adc7a3134f87261297697557d1f92b5469410dd99e07d5b23fa32252c.exe	83
PID 1192 wrote to memory of 1248	1192	nnK02yj80.exe	84
PID 1192 wrote to memory of 1248	1192	nnK02yj80.exe	84
PID 1192 wrote to memory of 1248	1192	nnK02yj80.exe	84

C:\Users\Admin\AppData\Local\Temp\6ce79a5adc7a3134f87261297697557d1f92b5469410dd99e07d5b23fa32252c.exe
"C:\Users\Admin\AppData\Local\Temp\6ce79a5adc7a3134f87261297697557d1f92b5469410dd99e07d5b23fa32252c.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nnK02yj80.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nnK02yj80.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1192
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\eqs64wC.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\eqs64wC.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nnK02yj80.exe

Filesize
420KB

MD5
0394f8828b730a875ad9628d3a14a080

SHA1
cff11a1fbeed5e273ef4bdded09080f610cc85f6

SHA256
1ff229375af7c97886d6be688925bdf1ee5363499d33959b17d81194ff2cca29

SHA512
55959be91927c223ef853904ec834f65fc1e67f3635305000444c03576f7c7d6c904e9ced03d02e00454bbc3a994a628c8cdb4f19fa54700ce7aad33231744b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\eqs64wC.exe

Filesize
267KB

MD5
5c95e1356b158b8f7101c1ed0b5ca0c3

SHA1
fa5bd1e797078ef3ad094879657aab80d4d339bc

SHA256
e5642d5842867e0544eb5cf2d31b8970ad464fe431b40b598b69bb5386b19a1f

SHA512
60e90dadd79dc9a8311d4311c39e289bc3a1a6029eeab918d8a0f160672a6343e6bfd95bdcd5747551c7525d1ebbd4b3a39fd8ee8ced6b723c0da28a4488e919

Download Submit
memory/1248-15-0x0000000000920000-0x0000000000A20000-memory.dmp

Filesize
1024KB

Download
memory/1248-16-0x00000000006E0000-0x000000000072B000-memory.dmp

Filesize
300KB

Download
memory/1248-17-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1248-18-0x0000000000400000-0x000000000058A000-memory.dmp

Filesize
1.5MB

Download
memory/1248-19-0x00000000024C0000-0x0000000002506000-memory.dmp

Filesize
280KB

Download
memory/1248-20-0x0000000004D50000-0x00000000052F4000-memory.dmp

Filesize
5.6MB

Download
memory/1248-21-0x0000000002850000-0x0000000002894000-memory.dmp

Filesize
272KB

Download
memory/1248-33-0x0000000002850000-0x000000000288E000-memory.dmp

Filesize
248KB

Download
memory/1248-85-0x0000000002850000-0x000000000288E000-memory.dmp

Filesize
248KB

Download
memory/1248-81-0x0000000002850000-0x000000000288E000-memory.dmp

Filesize
248KB

Download
memory/1248-79-0x0000000002850000-0x000000000288E000-memory.dmp

Filesize
248KB

Download
memory/1248-77-0x0000000002850000-0x000000000288E000-memory.dmp

Filesize
248KB

Download
memory/1248-75-0x0000000002850000-0x000000000288E000-memory.dmp

Filesize
248KB

Download
memory/1248-73-0x0000000002850000-0x000000000288E000-memory.dmp

Filesize
248KB

Download
memory/1248-69-0x0000000002850000-0x000000000288E000-memory.dmp

Filesize
248KB

Download
memory/1248-65-0x0000000002850000-0x000000000288E000-memory.dmp

Filesize
248KB

Download
memory/1248-63-0x0000000002850000-0x000000000288E000-memory.dmp

Filesize
248KB

Download
memory/1248-61-0x0000000002850000-0x000000000288E000-memory.dmp

Filesize
248KB

Download
memory/1248-59-0x0000000002850000-0x000000000288E000-memory.dmp

Filesize
248KB

Download
memory/1248-57-0x0000000002850000-0x000000000288E000-memory.dmp

Filesize
248KB

Download
memory/1248-55-0x0000000002850000-0x000000000288E000-memory.dmp

Filesize
248KB

Download
memory/1248-53-0x0000000002850000-0x000000000288E000-memory.dmp

Filesize
248KB

Download
memory/1248-51-0x0000000002850000-0x000000000288E000-memory.dmp

Filesize
248KB

Download
memory/1248-49-0x0000000002850000-0x000000000288E000-memory.dmp

Filesize
248KB

Download
memory/1248-47-0x0000000002850000-0x000000000288E000-memory.dmp

Filesize
248KB

Download
memory/1248-45-0x0000000002850000-0x000000000288E000-memory.dmp

Filesize
248KB

Download
memory/1248-43-0x0000000002850000-0x000000000288E000-memory.dmp

Filesize
248KB

Download
memory/1248-41-0x0000000002850000-0x000000000288E000-memory.dmp

Filesize
248KB

Download
memory/1248-39-0x0000000002850000-0x000000000288E000-memory.dmp

Filesize
248KB

Download
memory/1248-37-0x0000000002850000-0x000000000288E000-memory.dmp

Filesize
248KB

Download
memory/1248-35-0x0000000002850000-0x000000000288E000-memory.dmp

Filesize
248KB

Download
memory/1248-31-0x0000000002850000-0x000000000288E000-memory.dmp

Filesize
248KB

Download
memory/1248-29-0x0000000002850000-0x000000000288E000-memory.dmp

Filesize
248KB

Download
memory/1248-83-0x0000000002850000-0x000000000288E000-memory.dmp

Filesize
248KB

Download
memory/1248-27-0x0000000002850000-0x000000000288E000-memory.dmp

Filesize
248KB

Download
memory/1248-71-0x0000000002850000-0x000000000288E000-memory.dmp

Filesize
248KB

Download
memory/1248-67-0x0000000002850000-0x000000000288E000-memory.dmp

Filesize
248KB

Download
memory/1248-25-0x0000000002850000-0x000000000288E000-memory.dmp

Filesize
248KB

Download
memory/1248-23-0x0000000002850000-0x000000000288E000-memory.dmp

Filesize
248KB

Download
memory/1248-22-0x0000000002850000-0x000000000288E000-memory.dmp

Filesize
248KB

Download
memory/1248-928-0x0000000005300000-0x0000000005918000-memory.dmp

Filesize
6.1MB

Download
memory/1248-929-0x0000000005920000-0x0000000005A2A000-memory.dmp

Filesize
1.0MB

Download
memory/1248-930-0x0000000004CB0000-0x0000000004CC2000-memory.dmp

Filesize
72KB

Download
memory/1248-931-0x0000000004CD0000-0x0000000004D0C000-memory.dmp

Filesize
240KB

Download
memory/1248-932-0x0000000005B30000-0x0000000005B7C000-memory.dmp

Filesize
304KB

Download
memory/1248-933-0x0000000000920000-0x0000000000A20000-memory.dmp

Filesize
1024KB

Download
memory/1248-934-0x00000000006E0000-0x000000000072B000-memory.dmp

Filesize
300KB

Download
memory/1248-935-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads