Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05-05-2023 19:25
Static task
static1
Behavioral task
behavioral1
Sample
c1edd92185823f230abd788e527444b9b020c237ec67111414cb701c2286b810.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
c1edd92185823f230abd788e527444b9b020c237ec67111414cb701c2286b810.exe
Resource
win10v2004-20230220-en
General
-
Target
c1edd92185823f230abd788e527444b9b020c237ec67111414cb701c2286b810.exe
-
Size
1.2MB
-
MD5
9eed03da7f480fda399317e7d9447d19
-
SHA1
ef5654b3c4be991e54e4f2e68015f689a004efd2
-
SHA256
c1edd92185823f230abd788e527444b9b020c237ec67111414cb701c2286b810
-
SHA512
de3c478c50933f0884d9d6f7254a12c77e46fb18a5f656e7c904020405b890839a145d9ad034379bce6b87fe2017f2bbc2fec3562577d696623fcda6fd8b367a
-
SSDEEP
24576:hyA7MFbm1VAgQEpct/ui1NFGLHbCwRQ1qHidwosGozC:UA7MFbmbAgVUGM+q1qtt
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
life
185.161.248.73:4164
-
auth_value
8685d11953530b68ad5ec703809d9f91
Signatures
-
Detects Redline Stealer samples 1 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
Processes:
resource yara_rule behavioral2/memory/3264-2333-0x0000000005CB0000-0x00000000062C8000-memory.dmp redline_stealer -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
s03032488.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation s03032488.exe -
Executes dropped EXE 6 IoCs
Processes:
z78105582.exez79597627.exez52773970.exes03032488.exe1.exet47955642.exepid process 2052 z78105582.exe 2848 z79597627.exe 1524 z52773970.exe 3404 s03032488.exe 3264 1.exe 528 t47955642.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
z78105582.exez79597627.exez52773970.exec1edd92185823f230abd788e527444b9b020c237ec67111414cb701c2286b810.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z78105582.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z78105582.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z79597627.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z79597627.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z52773970.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z52773970.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce c1edd92185823f230abd788e527444b9b020c237ec67111414cb701c2286b810.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c1edd92185823f230abd788e527444b9b020c237ec67111414cb701c2286b810.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1512 3404 WerFault.exe s03032488.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
s03032488.exedescription pid process Token: SeDebugPrivilege 3404 s03032488.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
c1edd92185823f230abd788e527444b9b020c237ec67111414cb701c2286b810.exez78105582.exez79597627.exez52773970.exes03032488.exedescription pid process target process PID 4416 wrote to memory of 2052 4416 c1edd92185823f230abd788e527444b9b020c237ec67111414cb701c2286b810.exe z78105582.exe PID 4416 wrote to memory of 2052 4416 c1edd92185823f230abd788e527444b9b020c237ec67111414cb701c2286b810.exe z78105582.exe PID 4416 wrote to memory of 2052 4416 c1edd92185823f230abd788e527444b9b020c237ec67111414cb701c2286b810.exe z78105582.exe PID 2052 wrote to memory of 2848 2052 z78105582.exe z79597627.exe PID 2052 wrote to memory of 2848 2052 z78105582.exe z79597627.exe PID 2052 wrote to memory of 2848 2052 z78105582.exe z79597627.exe PID 2848 wrote to memory of 1524 2848 z79597627.exe z52773970.exe PID 2848 wrote to memory of 1524 2848 z79597627.exe z52773970.exe PID 2848 wrote to memory of 1524 2848 z79597627.exe z52773970.exe PID 1524 wrote to memory of 3404 1524 z52773970.exe s03032488.exe PID 1524 wrote to memory of 3404 1524 z52773970.exe s03032488.exe PID 1524 wrote to memory of 3404 1524 z52773970.exe s03032488.exe PID 3404 wrote to memory of 3264 3404 s03032488.exe 1.exe PID 3404 wrote to memory of 3264 3404 s03032488.exe 1.exe PID 3404 wrote to memory of 3264 3404 s03032488.exe 1.exe PID 1524 wrote to memory of 528 1524 z52773970.exe t47955642.exe PID 1524 wrote to memory of 528 1524 z52773970.exe t47955642.exe PID 1524 wrote to memory of 528 1524 z52773970.exe t47955642.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1edd92185823f230abd788e527444b9b020c237ec67111414cb701c2286b810.exe"C:\Users\Admin\AppData\Local\Temp\c1edd92185823f230abd788e527444b9b020c237ec67111414cb701c2286b810.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z78105582.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z78105582.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z79597627.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z79597627.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z52773970.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z52773970.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s03032488.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s03032488.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 13766⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t47955642.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t47955642.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3404 -ip 34041⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z78105582.exeFilesize
1.0MB
MD5858722523f34647a803c9aa8fdf82b1c
SHA139e8da952bc2281eb3b8105d3fd63dbff9021556
SHA256c116c47ea8cd5fdbdf15f0fce7e5765d4465bcbbe5453484d104bdb0cf62d29e
SHA512d6fae92852de11d89c650ef8d390960fe53e5910f1fdc3f003fc739804e7b802d819f0c83e7a5b808b662acf0b31307a15632ac2b43f0e4f1b2cc49b06644cb4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z78105582.exeFilesize
1.0MB
MD5858722523f34647a803c9aa8fdf82b1c
SHA139e8da952bc2281eb3b8105d3fd63dbff9021556
SHA256c116c47ea8cd5fdbdf15f0fce7e5765d4465bcbbe5453484d104bdb0cf62d29e
SHA512d6fae92852de11d89c650ef8d390960fe53e5910f1fdc3f003fc739804e7b802d819f0c83e7a5b808b662acf0b31307a15632ac2b43f0e4f1b2cc49b06644cb4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z79597627.exeFilesize
759KB
MD56605d08d269ece8aca4d12c1e5c0c77b
SHA17495421eb1035b07c6f815ff1bdcfb2f1082992e
SHA2566e71914cf8e5d53cec684e831d4f00088fe529b2b950a371a3e5b0da7e3d250d
SHA5120f70b7a1e1c89d1a92e94a578589fe3428a5e453936dca91bd8fe42ced05e9a162c5a1a6c9b0f54e2fe9e6f8150066ba7221561139788347e3fca2408a6ce9ba
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z79597627.exeFilesize
759KB
MD56605d08d269ece8aca4d12c1e5c0c77b
SHA17495421eb1035b07c6f815ff1bdcfb2f1082992e
SHA2566e71914cf8e5d53cec684e831d4f00088fe529b2b950a371a3e5b0da7e3d250d
SHA5120f70b7a1e1c89d1a92e94a578589fe3428a5e453936dca91bd8fe42ced05e9a162c5a1a6c9b0f54e2fe9e6f8150066ba7221561139788347e3fca2408a6ce9ba
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z52773970.exeFilesize
577KB
MD5d17cdfa0637659cc344176cf5cef8932
SHA1ffa5f7fb57bc77e80a8956c1b204583bc7e7a520
SHA256b794059a03722136548b7e3d4a33bbf45aad554f0ccea986f9046ec93f569682
SHA5128cad640383c32dc1913ca8bfc47eabc83660548b6e2be28a9fa1386e0a4462d07b416da5426f881621f145fbec04935bbd0fbb6560ec00cb5577c4603934c974
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z52773970.exeFilesize
577KB
MD5d17cdfa0637659cc344176cf5cef8932
SHA1ffa5f7fb57bc77e80a8956c1b204583bc7e7a520
SHA256b794059a03722136548b7e3d4a33bbf45aad554f0ccea986f9046ec93f569682
SHA5128cad640383c32dc1913ca8bfc47eabc83660548b6e2be28a9fa1386e0a4462d07b416da5426f881621f145fbec04935bbd0fbb6560ec00cb5577c4603934c974
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s03032488.exeFilesize
574KB
MD53ded9d552bed22dfc1e71b23385d81ee
SHA10425e7ed683f6c373fd57d1a052136396d6c1475
SHA256b94c2ec4297e737faa9559451773dacdc47137078ca10985c045bd242f8ac80d
SHA512930e910947674191aada2e6e90e019869fa9191e20ee568a2a486f8a1e54db76a1bda55f7ec2b0ce1ddb2c2ed57e513c38a28b42dcd1bedb5bf74329af87d106
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s03032488.exeFilesize
574KB
MD53ded9d552bed22dfc1e71b23385d81ee
SHA10425e7ed683f6c373fd57d1a052136396d6c1475
SHA256b94c2ec4297e737faa9559451773dacdc47137078ca10985c045bd242f8ac80d
SHA512930e910947674191aada2e6e90e019869fa9191e20ee568a2a486f8a1e54db76a1bda55f7ec2b0ce1ddb2c2ed57e513c38a28b42dcd1bedb5bf74329af87d106
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t47955642.exeFilesize
169KB
MD59fa1da7b78f9400d73751f9d31321e41
SHA1cc2bf45507ba8a6e0f2bbcc2d643555619a2fc88
SHA256b93a5a5ad65f4d7bb31a48c796a5c19a847a21816d36e0b14b02ebf115db723e
SHA512dea4d7bd6e41d8d62e9c22404d3d483a06ab194fbf4e2623d21462196ce4930147d580b6599efa04b32f532cd14cde1304bdce8995c49055280e4b70e68a22a4
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t47955642.exeFilesize
169KB
MD59fa1da7b78f9400d73751f9d31321e41
SHA1cc2bf45507ba8a6e0f2bbcc2d643555619a2fc88
SHA256b93a5a5ad65f4d7bb31a48c796a5c19a847a21816d36e0b14b02ebf115db723e
SHA512dea4d7bd6e41d8d62e9c22404d3d483a06ab194fbf4e2623d21462196ce4930147d580b6599efa04b32f532cd14cde1304bdce8995c49055280e4b70e68a22a4
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
memory/528-2343-0x0000000005450000-0x0000000005460000-memory.dmpFilesize
64KB
-
memory/528-2342-0x0000000000AD0000-0x0000000000AFE000-memory.dmpFilesize
184KB
-
memory/528-2345-0x0000000005450000-0x0000000005460000-memory.dmpFilesize
64KB
-
memory/3264-2337-0x0000000005680000-0x0000000005690000-memory.dmpFilesize
64KB
-
memory/3264-2336-0x0000000005690000-0x00000000056CC000-memory.dmpFilesize
240KB
-
memory/3264-2335-0x0000000005600000-0x0000000005612000-memory.dmpFilesize
72KB
-
memory/3264-2334-0x00000000057A0000-0x00000000058AA000-memory.dmpFilesize
1.0MB
-
memory/3264-2333-0x0000000005CB0000-0x00000000062C8000-memory.dmpFilesize
6.1MB
-
memory/3264-2332-0x0000000000CC0000-0x0000000000CEE000-memory.dmpFilesize
184KB
-
memory/3264-2344-0x0000000005680000-0x0000000005690000-memory.dmpFilesize
64KB
-
memory/3404-207-0x0000000004E60000-0x0000000004EC0000-memory.dmpFilesize
384KB
-
memory/3404-231-0x0000000004E60000-0x0000000004EC0000-memory.dmpFilesize
384KB
-
memory/3404-193-0x0000000004E60000-0x0000000004EC0000-memory.dmpFilesize
384KB
-
memory/3404-195-0x0000000004E60000-0x0000000004EC0000-memory.dmpFilesize
384KB
-
memory/3404-197-0x0000000004E60000-0x0000000004EC0000-memory.dmpFilesize
384KB
-
memory/3404-199-0x0000000004E60000-0x0000000004EC0000-memory.dmpFilesize
384KB
-
memory/3404-201-0x0000000004E60000-0x0000000004EC0000-memory.dmpFilesize
384KB
-
memory/3404-203-0x0000000004E60000-0x0000000004EC0000-memory.dmpFilesize
384KB
-
memory/3404-205-0x0000000004E60000-0x0000000004EC0000-memory.dmpFilesize
384KB
-
memory/3404-189-0x0000000004E60000-0x0000000004EC0000-memory.dmpFilesize
384KB
-
memory/3404-209-0x0000000004E60000-0x0000000004EC0000-memory.dmpFilesize
384KB
-
memory/3404-211-0x0000000004E60000-0x0000000004EC0000-memory.dmpFilesize
384KB
-
memory/3404-213-0x0000000004E60000-0x0000000004EC0000-memory.dmpFilesize
384KB
-
memory/3404-215-0x0000000004E60000-0x0000000004EC0000-memory.dmpFilesize
384KB
-
memory/3404-217-0x0000000004E60000-0x0000000004EC0000-memory.dmpFilesize
384KB
-
memory/3404-219-0x0000000004E60000-0x0000000004EC0000-memory.dmpFilesize
384KB
-
memory/3404-221-0x0000000004E60000-0x0000000004EC0000-memory.dmpFilesize
384KB
-
memory/3404-223-0x0000000004E60000-0x0000000004EC0000-memory.dmpFilesize
384KB
-
memory/3404-225-0x0000000004E60000-0x0000000004EC0000-memory.dmpFilesize
384KB
-
memory/3404-227-0x0000000004E60000-0x0000000004EC0000-memory.dmpFilesize
384KB
-
memory/3404-229-0x0000000004E60000-0x0000000004EC0000-memory.dmpFilesize
384KB
-
memory/3404-191-0x0000000004E60000-0x0000000004EC0000-memory.dmpFilesize
384KB
-
memory/3404-233-0x0000000004E60000-0x0000000004EC0000-memory.dmpFilesize
384KB
-
memory/3404-2319-0x0000000004F20000-0x0000000004F30000-memory.dmpFilesize
64KB
-
memory/3404-2318-0x0000000004F20000-0x0000000004F30000-memory.dmpFilesize
64KB
-
memory/3404-2320-0x0000000004F20000-0x0000000004F30000-memory.dmpFilesize
64KB
-
memory/3404-187-0x0000000004E60000-0x0000000004EC0000-memory.dmpFilesize
384KB
-
memory/3404-185-0x0000000004E60000-0x0000000004EC0000-memory.dmpFilesize
384KB
-
memory/3404-183-0x0000000004E60000-0x0000000004EC0000-memory.dmpFilesize
384KB
-
memory/3404-181-0x0000000004E60000-0x0000000004EC0000-memory.dmpFilesize
384KB
-
memory/3404-179-0x0000000004E60000-0x0000000004EC0000-memory.dmpFilesize
384KB
-
memory/3404-177-0x0000000004E60000-0x0000000004EC0000-memory.dmpFilesize
384KB
-
memory/3404-175-0x0000000004E60000-0x0000000004EC0000-memory.dmpFilesize
384KB
-
memory/3404-171-0x0000000004E60000-0x0000000004EC0000-memory.dmpFilesize
384KB
-
memory/3404-173-0x0000000004E60000-0x0000000004EC0000-memory.dmpFilesize
384KB
-
memory/3404-170-0x0000000004E60000-0x0000000004EC0000-memory.dmpFilesize
384KB
-
memory/3404-169-0x0000000004F20000-0x0000000004F30000-memory.dmpFilesize
64KB
-
memory/3404-168-0x0000000004F20000-0x0000000004F30000-memory.dmpFilesize
64KB
-
memory/3404-166-0x0000000004F20000-0x0000000004F30000-memory.dmpFilesize
64KB
-
memory/3404-167-0x0000000005030000-0x00000000055D4000-memory.dmpFilesize
5.6MB
-
memory/3404-165-0x0000000000840000-0x000000000089B000-memory.dmpFilesize
364KB