redline | d7b38740a2c0a9cb1cf93055042a52b2ec4a89b6882d4b7aabd9582756ae7353

General

Target

d7b38740a2c0a9cb1cf93055042a52b2ec4a89b6882d4b7aabd9582756ae7353.exe
Size

554KB
MD5

87ab9e5e4854f4a879937e5745eebf8c
SHA1

eb2966f5e143a8dbf80d0ffccdfd62f6cb67ca4b
SHA256

d7b38740a2c0a9cb1cf93055042a52b2ec4a89b6882d4b7aabd9582756ae7353
SHA512

16d91e3b18d204c692b47c4e0a251a0772f2debb325ec13ec2a584ca8bc7bfeaa89f1195e796e5acd123742d52bdc99a9ea101efae4ab05116a46d9b17b0ee76
SSDEEP

12288:ZMrzy90RQKInhnMotU40NxdJkGoZnwUa8uYORlWbTrGU:+y0QKyhM410Nxd7oZwUa0OfWb/GU

Score

10^/10

redline darm discovery infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

darm

C2

217.196.96.56:4138

Attributes

auth_value
d88ac8ccc04ab9979b04b46313db1648

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000b000000023b98-12.dat	family_redline
behavioral1/memory/3604-15-0x0000000000200000-0x0000000000230000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 2 IoCs

pid	Process
1692	x0887541.exe
3604	g7719981.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	d7b38740a2c0a9cb1cf93055042a52b2ec4a89b6882d4b7aabd9582756ae7353.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x0887541.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	g7719981.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d7b38740a2c0a9cb1cf93055042a52b2ec4a89b6882d4b7aabd9582756ae7353.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x0887541.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 1692	1168	d7b38740a2c0a9cb1cf93055042a52b2ec4a89b6882d4b7aabd9582756ae7353.exe	83
PID 1168 wrote to memory of 1692	1168	d7b38740a2c0a9cb1cf93055042a52b2ec4a89b6882d4b7aabd9582756ae7353.exe	83
PID 1168 wrote to memory of 1692	1168	d7b38740a2c0a9cb1cf93055042a52b2ec4a89b6882d4b7aabd9582756ae7353.exe	83
PID 1692 wrote to memory of 3604	1692	x0887541.exe	84
PID 1692 wrote to memory of 3604	1692	x0887541.exe	84
PID 1692 wrote to memory of 3604	1692	x0887541.exe	84

C:\Users\Admin\AppData\Local\Temp\d7b38740a2c0a9cb1cf93055042a52b2ec4a89b6882d4b7aabd9582756ae7353.exe
"C:\Users\Admin\AppData\Local\Temp\d7b38740a2c0a9cb1cf93055042a52b2ec4a89b6882d4b7aabd9582756ae7353.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0887541.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0887541.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7719981.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7719981.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0887541.exe

Filesize
382KB

MD5
3a99516df2e1b0c62b678e7463be8d8f

SHA1
53f01b664e0853ec06b668520ad4b3c7d9edda8d

SHA256
9800599917ca9d73e9dbb9aab546953e04b049c5c07170206a2c8c498d3cf832

SHA512
383e8c9e29a53970b6adf6477bc122f144e1a2bf3a1672eaf61fed0f0ed4a448e5ca7db88b61755968a039a9a52c6d0f7741811939157956bb7bd69aab2391c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7719981.exe

Filesize
168KB

MD5
20d1502b4b1c853156f4fd5d25734d53

SHA1
580962e3f515a527c050ac1061d7c1214ac7d83a

SHA256
dbe2b629d7ecd4d080ba36a1ffa797078bb6a67fa278040e964493ec8752c818

SHA512
706f34ed4496a4616e0b4b8754f82a51e91efed4d745b050b3ec8c25036176c307e74e49af53c62a148b6c92eebe5ec77a4afe4439fe9e55a2dbfcb28ea6b48b

Download Submit
memory/3604-14-0x000000007451E000-0x000000007451F000-memory.dmp

Filesize
4KB

Download
memory/3604-15-0x0000000000200000-0x0000000000230000-memory.dmp

Filesize
192KB

Download
memory/3604-16-0x0000000006EB0000-0x0000000006EB6000-memory.dmp

Filesize
24KB

Download
memory/3604-17-0x000000000A4F0000-0x000000000AB08000-memory.dmp

Filesize
6.1MB

Download
memory/3604-18-0x000000000A070000-0x000000000A17A000-memory.dmp

Filesize
1.0MB

Download
memory/3604-19-0x0000000009FA0000-0x0000000009FB2000-memory.dmp

Filesize
72KB

Download
memory/3604-20-0x000000000A000000-0x000000000A03C000-memory.dmp

Filesize
240KB

Download
memory/3604-21-0x0000000074510000-0x0000000074CC0000-memory.dmp

Filesize
7.7MB

Download
memory/3604-22-0x00000000044D0000-0x000000000451C000-memory.dmp

Filesize
304KB

Download
memory/3604-23-0x000000007451E000-0x000000007451F000-memory.dmp

Filesize
4KB

Download
memory/3604-24-0x0000000074510000-0x0000000074CC0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads