redline | 4db8316519d7b38dede20965b80a302b9e87ab39fa77bde38f98ca6d9973a82a

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 10:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4db8316519d7b38dede20965b80a302b9e87ab39fa77bde38f98ca6d9973a82a.exe
Size

761KB
MD5

ccb66f8c4ea3eb03fc022ed6ad2384b7
SHA1

ebdb6d33e624c05f5552361217bae7c65ca44d4e
SHA256

4db8316519d7b38dede20965b80a302b9e87ab39fa77bde38f98ca6d9973a82a
SHA512

d01bcbeddf80dfa6137a72cdad0d645dbaf1571a9ae31e9aaa3f7c46dd7813db711d80c464da8c45de0f13c5ad8f1c09e35b28848de75a3112e638476afdd8dd
SSDEEP

12288:LMr6y90YBVVt/TPilYTYRSsUEs+MPkMGes63khgl1l8NFRxGITvBICoHPZIJd5+:ty5V//j2JRJsxkMGN5ylTUxGI9ICqIF+

Score

10^/10

redline romik discovery infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

romik

193.233.20.12:4132

Attributes

auth_value
8fb78d2889ba0ca42678b59b884e88ff

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

resource	yara_rule
behavioral1/memory/2992-22-0x00000000028D0000-0x0000000002916000-memory.dmp	family_redline
behavioral1/memory/2992-24-0x0000000002A80000-0x0000000002AC4000-memory.dmp	family_redline
behavioral1/memory/2992-28-0x0000000002A80000-0x0000000002ABE000-memory.dmp	family_redline
behavioral1/memory/2992-38-0x0000000002A80000-0x0000000002ABE000-memory.dmp	family_redline
behavioral1/memory/2992-88-0x0000000002A80000-0x0000000002ABE000-memory.dmp	family_redline
behavioral1/memory/2992-86-0x0000000002A80000-0x0000000002ABE000-memory.dmp	family_redline
behavioral1/memory/2992-84-0x0000000002A80000-0x0000000002ABE000-memory.dmp	family_redline
behavioral1/memory/2992-82-0x0000000002A80000-0x0000000002ABE000-memory.dmp	family_redline
behavioral1/memory/2992-80-0x0000000002A80000-0x0000000002ABE000-memory.dmp	family_redline
behavioral1/memory/2992-78-0x0000000002A80000-0x0000000002ABE000-memory.dmp	family_redline
behavioral1/memory/2992-74-0x0000000002A80000-0x0000000002ABE000-memory.dmp	family_redline
behavioral1/memory/2992-72-0x0000000002A80000-0x0000000002ABE000-memory.dmp	family_redline
behavioral1/memory/2992-70-0x0000000002A80000-0x0000000002ABE000-memory.dmp	family_redline
behavioral1/memory/2992-68-0x0000000002A80000-0x0000000002ABE000-memory.dmp	family_redline
behavioral1/memory/2992-66-0x0000000002A80000-0x0000000002ABE000-memory.dmp	family_redline
behavioral1/memory/2992-64-0x0000000002A80000-0x0000000002ABE000-memory.dmp	family_redline
behavioral1/memory/2992-62-0x0000000002A80000-0x0000000002ABE000-memory.dmp	family_redline
behavioral1/memory/2992-58-0x0000000002A80000-0x0000000002ABE000-memory.dmp	family_redline
behavioral1/memory/2992-56-0x0000000002A80000-0x0000000002ABE000-memory.dmp	family_redline
behavioral1/memory/2992-54-0x0000000002A80000-0x0000000002ABE000-memory.dmp	family_redline
behavioral1/memory/2992-52-0x0000000002A80000-0x0000000002ABE000-memory.dmp	family_redline
behavioral1/memory/2992-50-0x0000000002A80000-0x0000000002ABE000-memory.dmp	family_redline
behavioral1/memory/2992-48-0x0000000002A80000-0x0000000002ABE000-memory.dmp	family_redline
behavioral1/memory/2992-46-0x0000000002A80000-0x0000000002ABE000-memory.dmp	family_redline
behavioral1/memory/2992-44-0x0000000002A80000-0x0000000002ABE000-memory.dmp	family_redline
behavioral1/memory/2992-42-0x0000000002A80000-0x0000000002ABE000-memory.dmp	family_redline
behavioral1/memory/2992-40-0x0000000002A80000-0x0000000002ABE000-memory.dmp	family_redline
behavioral1/memory/2992-36-0x0000000002A80000-0x0000000002ABE000-memory.dmp	family_redline
behavioral1/memory/2992-34-0x0000000002A80000-0x0000000002ABE000-memory.dmp	family_redline
behavioral1/memory/2992-32-0x0000000002A80000-0x0000000002ABE000-memory.dmp	family_redline
behavioral1/memory/2992-30-0x0000000002A80000-0x0000000002ABE000-memory.dmp	family_redline
behavioral1/memory/2992-76-0x0000000002A80000-0x0000000002ABE000-memory.dmp	family_redline
behavioral1/memory/2992-60-0x0000000002A80000-0x0000000002ABE000-memory.dmp	family_redline
behavioral1/memory/2992-26-0x0000000002A80000-0x0000000002ABE000-memory.dmp	family_redline
behavioral1/memory/2992-25-0x0000000002A80000-0x0000000002ABE000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
3716	vAF01.exe
4880	vTC30.exe
2992	daQ53.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	4db8316519d7b38dede20965b80a302b9e87ab39fa77bde38f98ca6d9973a82a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	vAF01.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	vTC30.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4db8316519d7b38dede20965b80a302b9e87ab39fa77bde38f98ca6d9973a82a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vAF01.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vTC30.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daQ53.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2992	daQ53.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 3716	2168	4db8316519d7b38dede20965b80a302b9e87ab39fa77bde38f98ca6d9973a82a.exe	83
PID 2168 wrote to memory of 3716	2168	4db8316519d7b38dede20965b80a302b9e87ab39fa77bde38f98ca6d9973a82a.exe	83
PID 2168 wrote to memory of 3716	2168	4db8316519d7b38dede20965b80a302b9e87ab39fa77bde38f98ca6d9973a82a.exe	83
PID 3716 wrote to memory of 4880	3716	vAF01.exe	84
PID 3716 wrote to memory of 4880	3716	vAF01.exe	84
PID 3716 wrote to memory of 4880	3716	vAF01.exe	84
PID 4880 wrote to memory of 2992	4880	vTC30.exe	85
PID 4880 wrote to memory of 2992	4880	vTC30.exe	85
PID 4880 wrote to memory of 2992	4880	vTC30.exe	85

C:\Users\Admin\AppData\Local\Temp\4db8316519d7b38dede20965b80a302b9e87ab39fa77bde38f98ca6d9973a82a.exe
"C:\Users\Admin\AppData\Local\Temp\4db8316519d7b38dede20965b80a302b9e87ab39fa77bde38f98ca6d9973a82a.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vAF01.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vAF01.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3716
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vTC30.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vTC30.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4880
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\daQ53.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\daQ53.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vAF01.exe

Filesize
657KB

MD5
edda5d04a21397c3922365d3bacf7dd2

SHA1
c970ff4acddaf769c7610e5b95e1a13d482eb24b

SHA256
7d6582a914a25b7dee86f508fae2de5a321db6d265dd18f99ae324966c5c92e0

SHA512
8da2303b53088dd6294446a5a9d236a74fda0bb2d10dc9184c3640824001d47c919177888bceb61014748ad6a1613b5b9dd759bec7ca243cc40184ed09164f90

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vTC30.exe

Filesize
512KB

MD5
cf9ac8c288116e56f91e1179bc5780b8

SHA1
c02fae21067e69610bb0ee881f550d2dae9db147

SHA256
f8a06cd0c515518dfe07c6d45731f84b522b055b495eb302a0dcea522392d2c0

SHA512
cde2dfec6c0197bc1da29e6d4838648afcea811d733eb666144d2cb70db9287f7c2a30d6806f7d08ad6ade5b4d2d243dcd58853514f283404751c3c83e6a161a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\daQ53.exe

Filesize
289KB

MD5
f342f2a8fe360afdc2dc03c5d8ccc0c7

SHA1
b574324d34bac92df9b656b64b25e59ac3e2e111

SHA256
f10ded8a5ec704dd5bc919c2e992aa30c246b30d3e6109ab83fe7d801248f1ef

SHA512
444ecb4f34553747e3581285cccb354f996e96cbb1dfc16534ad801e23ab9fba22bec06fab00cd4e96586899a93968405e4db9f064f3d9cff6d9b4ea6516479a

Download Submit
memory/2992-22-0x00000000028D0000-0x0000000002916000-memory.dmp

Filesize
280KB

Download
memory/2992-23-0x0000000004E20000-0x00000000053C4000-memory.dmp

Filesize
5.6MB

Download
memory/2992-24-0x0000000002A80000-0x0000000002AC4000-memory.dmp

Filesize
272KB

Download
memory/2992-28-0x0000000002A80000-0x0000000002ABE000-memory.dmp

Filesize
248KB

Download
memory/2992-38-0x0000000002A80000-0x0000000002ABE000-memory.dmp

Filesize
248KB

Download
memory/2992-88-0x0000000002A80000-0x0000000002ABE000-memory.dmp

Filesize
248KB

Download
memory/2992-86-0x0000000002A80000-0x0000000002ABE000-memory.dmp

Filesize
248KB

Download
memory/2992-84-0x0000000002A80000-0x0000000002ABE000-memory.dmp

Filesize
248KB

Download
memory/2992-82-0x0000000002A80000-0x0000000002ABE000-memory.dmp

Filesize
248KB

Download
memory/2992-80-0x0000000002A80000-0x0000000002ABE000-memory.dmp

Filesize
248KB

Download
memory/2992-78-0x0000000002A80000-0x0000000002ABE000-memory.dmp

Filesize
248KB

Download
memory/2992-74-0x0000000002A80000-0x0000000002ABE000-memory.dmp

Filesize
248KB

Download
memory/2992-72-0x0000000002A80000-0x0000000002ABE000-memory.dmp

Filesize
248KB

Download
memory/2992-70-0x0000000002A80000-0x0000000002ABE000-memory.dmp

Filesize
248KB

Download
memory/2992-68-0x0000000002A80000-0x0000000002ABE000-memory.dmp

Filesize
248KB

Download
memory/2992-66-0x0000000002A80000-0x0000000002ABE000-memory.dmp

Filesize
248KB

Download
memory/2992-64-0x0000000002A80000-0x0000000002ABE000-memory.dmp

Filesize
248KB

Download
memory/2992-62-0x0000000002A80000-0x0000000002ABE000-memory.dmp

Filesize
248KB

Download
memory/2992-58-0x0000000002A80000-0x0000000002ABE000-memory.dmp

Filesize
248KB

Download
memory/2992-56-0x0000000002A80000-0x0000000002ABE000-memory.dmp

Filesize
248KB

Download
memory/2992-54-0x0000000002A80000-0x0000000002ABE000-memory.dmp

Filesize
248KB

Download
memory/2992-52-0x0000000002A80000-0x0000000002ABE000-memory.dmp

Filesize
248KB

Download
memory/2992-50-0x0000000002A80000-0x0000000002ABE000-memory.dmp

Filesize
248KB

Download
memory/2992-48-0x0000000002A80000-0x0000000002ABE000-memory.dmp

Filesize
248KB

Download
memory/2992-46-0x0000000002A80000-0x0000000002ABE000-memory.dmp

Filesize
248KB

Download
memory/2992-44-0x0000000002A80000-0x0000000002ABE000-memory.dmp

Filesize
248KB

Download
memory/2992-42-0x0000000002A80000-0x0000000002ABE000-memory.dmp

Filesize
248KB

Download
memory/2992-40-0x0000000002A80000-0x0000000002ABE000-memory.dmp

Filesize
248KB

Download
memory/2992-36-0x0000000002A80000-0x0000000002ABE000-memory.dmp

Filesize
248KB

Download
memory/2992-34-0x0000000002A80000-0x0000000002ABE000-memory.dmp

Filesize
248KB

Download
memory/2992-32-0x0000000002A80000-0x0000000002ABE000-memory.dmp

Filesize
248KB

Download
memory/2992-30-0x0000000002A80000-0x0000000002ABE000-memory.dmp

Filesize
248KB

Download
memory/2992-76-0x0000000002A80000-0x0000000002ABE000-memory.dmp

Filesize
248KB

Download
memory/2992-60-0x0000000002A80000-0x0000000002ABE000-memory.dmp

Filesize
248KB

Download
memory/2992-26-0x0000000002A80000-0x0000000002ABE000-memory.dmp

Filesize
248KB

Download
memory/2992-25-0x0000000002A80000-0x0000000002ABE000-memory.dmp

Filesize
248KB

Download
memory/2992-931-0x00000000053E0000-0x00000000059F8000-memory.dmp

Filesize
6.1MB

Download
memory/2992-932-0x0000000005A80000-0x0000000005B8A000-memory.dmp

Filesize
1.0MB

Download
memory/2992-933-0x0000000005BC0000-0x0000000005BD2000-memory.dmp

Filesize
72KB

Download
memory/2992-934-0x0000000005BE0000-0x0000000005C1C000-memory.dmp

Filesize
240KB

Download
memory/2992-935-0x0000000005D70000-0x0000000005DBC000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads