Analysis
-
max time kernel
133s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05-05-2023 19:20
Static task
static1
Behavioral task
behavioral1
Sample
bf20e07f595a43f0819e69362d26a48d1a102e4683ac09a1c4a628bf85a14520.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
bf20e07f595a43f0819e69362d26a48d1a102e4683ac09a1c4a628bf85a14520.exe
Resource
win10v2004-20230220-en
General
-
Target
bf20e07f595a43f0819e69362d26a48d1a102e4683ac09a1c4a628bf85a14520.exe
-
Size
1.2MB
-
MD5
9403b8c9ffbc4c4401a8f657e9786208
-
SHA1
090cdbc5ed84a6091fc6fb5950794a384f308842
-
SHA256
bf20e07f595a43f0819e69362d26a48d1a102e4683ac09a1c4a628bf85a14520
-
SHA512
6a5d7b58ffad0cccbda0d7c059b230f588d4a720836a4c9c5addcee2dea51d7cd2f61a101e1df85f5750acc3b8282a3c8df7fcc12337e4be57e89b0481691529
-
SSDEEP
24576:lyp/1UeB6/yQ8RTKxp0Z1YsFcY6XiC/WakW9qd0JMAFymoqfZSGb:ATN6/8VMWBWZSCOak8qdSJ1Z
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
life
185.161.248.73:4164
-
auth_value
8685d11953530b68ad5ec703809d9f91
Signatures
-
Detects Redline Stealer samples 1 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
Processes:
resource yara_rule behavioral2/memory/4936-2333-0x00000000053C0000-0x00000000059D8000-memory.dmp redline_stealer -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
s42467653.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation s42467653.exe -
Executes dropped EXE 6 IoCs
Processes:
z90004687.exez74187737.exez49216465.exes42467653.exe1.exet09126077.exepid process 2564 z90004687.exe 960 z74187737.exe 1260 z49216465.exe 3140 s42467653.exe 4936 1.exe 4644 t09126077.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
z49216465.exebf20e07f595a43f0819e69362d26a48d1a102e4683ac09a1c4a628bf85a14520.exez90004687.exez74187737.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z49216465.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z49216465.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce bf20e07f595a43f0819e69362d26a48d1a102e4683ac09a1c4a628bf85a14520.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" bf20e07f595a43f0819e69362d26a48d1a102e4683ac09a1c4a628bf85a14520.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z90004687.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z90004687.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z74187737.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z74187737.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4364 3140 WerFault.exe s42467653.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
s42467653.exedescription pid process Token: SeDebugPrivilege 3140 s42467653.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
bf20e07f595a43f0819e69362d26a48d1a102e4683ac09a1c4a628bf85a14520.exez90004687.exez74187737.exez49216465.exes42467653.exedescription pid process target process PID 4608 wrote to memory of 2564 4608 bf20e07f595a43f0819e69362d26a48d1a102e4683ac09a1c4a628bf85a14520.exe z90004687.exe PID 4608 wrote to memory of 2564 4608 bf20e07f595a43f0819e69362d26a48d1a102e4683ac09a1c4a628bf85a14520.exe z90004687.exe PID 4608 wrote to memory of 2564 4608 bf20e07f595a43f0819e69362d26a48d1a102e4683ac09a1c4a628bf85a14520.exe z90004687.exe PID 2564 wrote to memory of 960 2564 z90004687.exe z74187737.exe PID 2564 wrote to memory of 960 2564 z90004687.exe z74187737.exe PID 2564 wrote to memory of 960 2564 z90004687.exe z74187737.exe PID 960 wrote to memory of 1260 960 z74187737.exe z49216465.exe PID 960 wrote to memory of 1260 960 z74187737.exe z49216465.exe PID 960 wrote to memory of 1260 960 z74187737.exe z49216465.exe PID 1260 wrote to memory of 3140 1260 z49216465.exe s42467653.exe PID 1260 wrote to memory of 3140 1260 z49216465.exe s42467653.exe PID 1260 wrote to memory of 3140 1260 z49216465.exe s42467653.exe PID 3140 wrote to memory of 4936 3140 s42467653.exe 1.exe PID 3140 wrote to memory of 4936 3140 s42467653.exe 1.exe PID 3140 wrote to memory of 4936 3140 s42467653.exe 1.exe PID 1260 wrote to memory of 4644 1260 z49216465.exe t09126077.exe PID 1260 wrote to memory of 4644 1260 z49216465.exe t09126077.exe PID 1260 wrote to memory of 4644 1260 z49216465.exe t09126077.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf20e07f595a43f0819e69362d26a48d1a102e4683ac09a1c4a628bf85a14520.exe"C:\Users\Admin\AppData\Local\Temp\bf20e07f595a43f0819e69362d26a48d1a102e4683ac09a1c4a628bf85a14520.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z90004687.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z90004687.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z74187737.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z74187737.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z49216465.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z49216465.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s42467653.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s42467653.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 13686⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t09126077.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t09126077.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3140 -ip 31401⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z90004687.exeFilesize
1.0MB
MD52f49bd27cd6ae2eadfe7ee925a0d450f
SHA153751f340e04e52bfc8beef9f2872b703483c3e7
SHA256948a537a769374fa5607fd6a5011ae01b89aeb99ad5b00de87e59e6d4cb3b5ad
SHA5128d8875284689679f94588d57f274f23d8717efcc06e47b5b91523fa071183f80380c287105c4e110520bf1a8a791ffaa56648d4438bdd38dbc4ee560bb77b821
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z90004687.exeFilesize
1.0MB
MD52f49bd27cd6ae2eadfe7ee925a0d450f
SHA153751f340e04e52bfc8beef9f2872b703483c3e7
SHA256948a537a769374fa5607fd6a5011ae01b89aeb99ad5b00de87e59e6d4cb3b5ad
SHA5128d8875284689679f94588d57f274f23d8717efcc06e47b5b91523fa071183f80380c287105c4e110520bf1a8a791ffaa56648d4438bdd38dbc4ee560bb77b821
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z74187737.exeFilesize
759KB
MD57605a51817f62aa4991a33dddf883af9
SHA14a322e64faa8be372117ba8689568960c1697c10
SHA256a8afe9f173ef66f8a7e0517cfe9ff7c5a57e3b07206aae735ce9abd33c9c93e9
SHA5122ca9447e6809c99578c2648624a6415116094ab679d22e7285e2410f75966faef750e66fde1a3b7d8a6e00fc2a6fa7824094fba92bba8684a111c3efcd738f77
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z74187737.exeFilesize
759KB
MD57605a51817f62aa4991a33dddf883af9
SHA14a322e64faa8be372117ba8689568960c1697c10
SHA256a8afe9f173ef66f8a7e0517cfe9ff7c5a57e3b07206aae735ce9abd33c9c93e9
SHA5122ca9447e6809c99578c2648624a6415116094ab679d22e7285e2410f75966faef750e66fde1a3b7d8a6e00fc2a6fa7824094fba92bba8684a111c3efcd738f77
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z49216465.exeFilesize
577KB
MD59e20d76fedea6974aea0d99c72fdc616
SHA1ec6526446f451a8afd81873c200dedb3cf5b63b4
SHA256fc0dca8712bafa39068c7d3681f7de412af464b41c2cb5283c4dddc268a18ff0
SHA512e8e3b492e109c697d9e6660e69cc7ec46957d7d41e0553454ca3e7d45b1a33d3e51648ded2e953180d1b07e9f7b73b5c56d4b852febdd90214e29ce907d1233a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z49216465.exeFilesize
577KB
MD59e20d76fedea6974aea0d99c72fdc616
SHA1ec6526446f451a8afd81873c200dedb3cf5b63b4
SHA256fc0dca8712bafa39068c7d3681f7de412af464b41c2cb5283c4dddc268a18ff0
SHA512e8e3b492e109c697d9e6660e69cc7ec46957d7d41e0553454ca3e7d45b1a33d3e51648ded2e953180d1b07e9f7b73b5c56d4b852febdd90214e29ce907d1233a
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s42467653.exeFilesize
574KB
MD592c804ce687531c96b12771ac00eb457
SHA1dcc29d70009af00e1e6dea18a1ae6cd4dd4d258e
SHA25619b232bcbc29d810d32794f547f1ec8cdb95505c6f75908101bed4d8a58867bd
SHA5120a83fea404f2fda911aa91b92a1e9f0f42cc9ac225dc3f16ac02bf35d3ce050389f257f8aff6f1ef8bd96894e583fdecb7e53ba5e394dc77cf68594cdc12bb88
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s42467653.exeFilesize
574KB
MD592c804ce687531c96b12771ac00eb457
SHA1dcc29d70009af00e1e6dea18a1ae6cd4dd4d258e
SHA25619b232bcbc29d810d32794f547f1ec8cdb95505c6f75908101bed4d8a58867bd
SHA5120a83fea404f2fda911aa91b92a1e9f0f42cc9ac225dc3f16ac02bf35d3ce050389f257f8aff6f1ef8bd96894e583fdecb7e53ba5e394dc77cf68594cdc12bb88
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t09126077.exeFilesize
169KB
MD5c23eb03a6e09b2b41d9b41e5dc3ce050
SHA17f642ff9a93c1785189e6e8590ac328a3601c886
SHA256d04482c8299a40b62bbf782fbdc655f8ced2ba3edf7d8118bd4d49d04f0c8fc3
SHA512800cdaafd514087d39d6089d4b491fba8147871d11ba81c95c0f46ab45bef35f0ef8685b08c48225c173008726d9a0585c39a7d5dc9979add33a56ce8d17cf3f
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t09126077.exeFilesize
169KB
MD5c23eb03a6e09b2b41d9b41e5dc3ce050
SHA17f642ff9a93c1785189e6e8590ac328a3601c886
SHA256d04482c8299a40b62bbf782fbdc655f8ced2ba3edf7d8118bd4d49d04f0c8fc3
SHA512800cdaafd514087d39d6089d4b491fba8147871d11ba81c95c0f46ab45bef35f0ef8685b08c48225c173008726d9a0585c39a7d5dc9979add33a56ce8d17cf3f
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
memory/3140-175-0x0000000005070000-0x00000000050D0000-memory.dmpFilesize
384KB
-
memory/3140-217-0x0000000005070000-0x00000000050D0000-memory.dmpFilesize
384KB
-
memory/3140-173-0x0000000005070000-0x00000000050D0000-memory.dmpFilesize
384KB
-
memory/3140-169-0x0000000005070000-0x00000000050D0000-memory.dmpFilesize
384KB
-
memory/3140-177-0x0000000005070000-0x00000000050D0000-memory.dmpFilesize
384KB
-
memory/3140-179-0x0000000005070000-0x00000000050D0000-memory.dmpFilesize
384KB
-
memory/3140-181-0x0000000005070000-0x00000000050D0000-memory.dmpFilesize
384KB
-
memory/3140-183-0x0000000005070000-0x00000000050D0000-memory.dmpFilesize
384KB
-
memory/3140-186-0x00000000050E0000-0x00000000050F0000-memory.dmpFilesize
64KB
-
memory/3140-185-0x0000000005070000-0x00000000050D0000-memory.dmpFilesize
384KB
-
memory/3140-188-0x00000000050E0000-0x00000000050F0000-memory.dmpFilesize
64KB
-
memory/3140-189-0x0000000005070000-0x00000000050D0000-memory.dmpFilesize
384KB
-
memory/3140-191-0x0000000005070000-0x00000000050D0000-memory.dmpFilesize
384KB
-
memory/3140-193-0x0000000005070000-0x00000000050D0000-memory.dmpFilesize
384KB
-
memory/3140-195-0x0000000005070000-0x00000000050D0000-memory.dmpFilesize
384KB
-
memory/3140-197-0x0000000005070000-0x00000000050D0000-memory.dmpFilesize
384KB
-
memory/3140-199-0x0000000005070000-0x00000000050D0000-memory.dmpFilesize
384KB
-
memory/3140-201-0x0000000005070000-0x00000000050D0000-memory.dmpFilesize
384KB
-
memory/3140-203-0x0000000005070000-0x00000000050D0000-memory.dmpFilesize
384KB
-
memory/3140-205-0x0000000005070000-0x00000000050D0000-memory.dmpFilesize
384KB
-
memory/3140-207-0x0000000005070000-0x00000000050D0000-memory.dmpFilesize
384KB
-
memory/3140-209-0x0000000005070000-0x00000000050D0000-memory.dmpFilesize
384KB
-
memory/3140-211-0x0000000005070000-0x00000000050D0000-memory.dmpFilesize
384KB
-
memory/3140-213-0x0000000005070000-0x00000000050D0000-memory.dmpFilesize
384KB
-
memory/3140-215-0x0000000005070000-0x00000000050D0000-memory.dmpFilesize
384KB
-
memory/3140-171-0x0000000005070000-0x00000000050D0000-memory.dmpFilesize
384KB
-
memory/3140-219-0x0000000005070000-0x00000000050D0000-memory.dmpFilesize
384KB
-
memory/3140-221-0x0000000005070000-0x00000000050D0000-memory.dmpFilesize
384KB
-
memory/3140-223-0x0000000005070000-0x00000000050D0000-memory.dmpFilesize
384KB
-
memory/3140-225-0x0000000005070000-0x00000000050D0000-memory.dmpFilesize
384KB
-
memory/3140-227-0x0000000005070000-0x00000000050D0000-memory.dmpFilesize
384KB
-
memory/3140-229-0x0000000005070000-0x00000000050D0000-memory.dmpFilesize
384KB
-
memory/3140-2313-0x00000000050E0000-0x00000000050F0000-memory.dmpFilesize
64KB
-
memory/3140-2314-0x00000000050E0000-0x00000000050F0000-memory.dmpFilesize
64KB
-
memory/3140-2316-0x00000000050E0000-0x00000000050F0000-memory.dmpFilesize
64KB
-
memory/3140-167-0x0000000005070000-0x00000000050D0000-memory.dmpFilesize
384KB
-
memory/3140-165-0x0000000005070000-0x00000000050D0000-memory.dmpFilesize
384KB
-
memory/3140-164-0x0000000005070000-0x00000000050D0000-memory.dmpFilesize
384KB
-
memory/3140-2328-0x00000000050E0000-0x00000000050F0000-memory.dmpFilesize
64KB
-
memory/3140-162-0x0000000000840000-0x000000000089B000-memory.dmpFilesize
364KB
-
memory/3140-163-0x00000000050F0000-0x0000000005694000-memory.dmpFilesize
5.6MB
-
memory/4644-2342-0x00000000005D0000-0x00000000005FE000-memory.dmpFilesize
184KB
-
memory/4644-2343-0x0000000004E70000-0x0000000004E80000-memory.dmpFilesize
64KB
-
memory/4644-2345-0x0000000004E70000-0x0000000004E80000-memory.dmpFilesize
64KB
-
memory/4936-2334-0x0000000004EB0000-0x0000000004FBA000-memory.dmpFilesize
1.0MB
-
memory/4936-2335-0x0000000004DE0000-0x0000000004DF2000-memory.dmpFilesize
72KB
-
memory/4936-2337-0x0000000002640000-0x0000000002650000-memory.dmpFilesize
64KB
-
memory/4936-2336-0x0000000004E40000-0x0000000004E7C000-memory.dmpFilesize
240KB
-
memory/4936-2333-0x00000000053C0000-0x00000000059D8000-memory.dmpFilesize
6.1MB
-
memory/4936-2331-0x0000000000350000-0x000000000037E000-memory.dmpFilesize
184KB
-
memory/4936-2344-0x0000000002640000-0x0000000002650000-memory.dmpFilesize
64KB