Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05-05-2023 18:52
Static task
static1
Behavioral task
behavioral1
Sample
a871b0346c7dd19861a2ea7ee0ce6b7f757d6b895c7c7b8e3eecfd2e15b02d4b.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
a871b0346c7dd19861a2ea7ee0ce6b7f757d6b895c7c7b8e3eecfd2e15b02d4b.exe
Resource
win10v2004-20230220-en
General
-
Target
a871b0346c7dd19861a2ea7ee0ce6b7f757d6b895c7c7b8e3eecfd2e15b02d4b.exe
-
Size
1.2MB
-
MD5
06fd164ff0f3790b57cbacea36e20bed
-
SHA1
9625778238581459b00b977fc305a1bd120351cd
-
SHA256
a871b0346c7dd19861a2ea7ee0ce6b7f757d6b895c7c7b8e3eecfd2e15b02d4b
-
SHA512
83c009f42e926193397d4db6772618be2e782e3f4332920bff8efb82ab19caaf12334460960e4d7631054b513b1b8ae5db71d99fc491b12430ac8d78b0004bd9
-
SSDEEP
24576:jyY+37JTO8mpS3MeABZ3MIJmy49idjikksLVvB6p5+rZAByLT0lf:2Y+LJTg4MekzB1UsLVv0D+rZrLT0l
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
life
185.161.248.73:4164
-
auth_value
8685d11953530b68ad5ec703809d9f91
Signatures
-
Detects Redline Stealer samples 1 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
Processes:
resource yara_rule behavioral2/memory/1304-2332-0x00000000059F0000-0x0000000006008000-memory.dmp redline_stealer -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
s49799954.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation s49799954.exe -
Executes dropped EXE 6 IoCs
Processes:
z42202217.exez99259305.exez26361690.exes49799954.exe1.exet95043863.exepid process 4012 z42202217.exe 1052 z99259305.exe 3416 z26361690.exe 224 s49799954.exe 1304 1.exe 3908 t95043863.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
a871b0346c7dd19861a2ea7ee0ce6b7f757d6b895c7c7b8e3eecfd2e15b02d4b.exez42202217.exez99259305.exez26361690.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a871b0346c7dd19861a2ea7ee0ce6b7f757d6b895c7c7b8e3eecfd2e15b02d4b.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z42202217.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z42202217.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z99259305.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z99259305.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z26361690.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z26361690.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce a871b0346c7dd19861a2ea7ee0ce6b7f757d6b895c7c7b8e3eecfd2e15b02d4b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3844 224 WerFault.exe s49799954.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
s49799954.exedescription pid process Token: SeDebugPrivilege 224 s49799954.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
a871b0346c7dd19861a2ea7ee0ce6b7f757d6b895c7c7b8e3eecfd2e15b02d4b.exez42202217.exez99259305.exez26361690.exes49799954.exedescription pid process target process PID 4948 wrote to memory of 4012 4948 a871b0346c7dd19861a2ea7ee0ce6b7f757d6b895c7c7b8e3eecfd2e15b02d4b.exe z42202217.exe PID 4948 wrote to memory of 4012 4948 a871b0346c7dd19861a2ea7ee0ce6b7f757d6b895c7c7b8e3eecfd2e15b02d4b.exe z42202217.exe PID 4948 wrote to memory of 4012 4948 a871b0346c7dd19861a2ea7ee0ce6b7f757d6b895c7c7b8e3eecfd2e15b02d4b.exe z42202217.exe PID 4012 wrote to memory of 1052 4012 z42202217.exe z99259305.exe PID 4012 wrote to memory of 1052 4012 z42202217.exe z99259305.exe PID 4012 wrote to memory of 1052 4012 z42202217.exe z99259305.exe PID 1052 wrote to memory of 3416 1052 z99259305.exe z26361690.exe PID 1052 wrote to memory of 3416 1052 z99259305.exe z26361690.exe PID 1052 wrote to memory of 3416 1052 z99259305.exe z26361690.exe PID 3416 wrote to memory of 224 3416 z26361690.exe s49799954.exe PID 3416 wrote to memory of 224 3416 z26361690.exe s49799954.exe PID 3416 wrote to memory of 224 3416 z26361690.exe s49799954.exe PID 224 wrote to memory of 1304 224 s49799954.exe 1.exe PID 224 wrote to memory of 1304 224 s49799954.exe 1.exe PID 224 wrote to memory of 1304 224 s49799954.exe 1.exe PID 3416 wrote to memory of 3908 3416 z26361690.exe t95043863.exe PID 3416 wrote to memory of 3908 3416 z26361690.exe t95043863.exe PID 3416 wrote to memory of 3908 3416 z26361690.exe t95043863.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a871b0346c7dd19861a2ea7ee0ce6b7f757d6b895c7c7b8e3eecfd2e15b02d4b.exe"C:\Users\Admin\AppData\Local\Temp\a871b0346c7dd19861a2ea7ee0ce6b7f757d6b895c7c7b8e3eecfd2e15b02d4b.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z42202217.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z42202217.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z99259305.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z99259305.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z26361690.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z26361690.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s49799954.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s49799954.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 13726⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t95043863.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t95043863.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 224 -ip 2241⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z42202217.exeFilesize
1.0MB
MD58ec9b4dce5d7719848e5fa4da3ec08f4
SHA16e52062e6a8af9844cf6ba1266c78c3d9dab90ba
SHA25677148f2bb9a04c304bf8df9529cd4e0085e0dba261b4c721df77897aa1bc6cb6
SHA512e9e418e4ae962ce6b020c1dadd250b023ffdb322d1aa39f8e76934e9a0af5d22ba9255c2ad092a4b3bd6ee8fc1d4686e419ab7dfbc1e10e1269de4eea611e4ac
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z42202217.exeFilesize
1.0MB
MD58ec9b4dce5d7719848e5fa4da3ec08f4
SHA16e52062e6a8af9844cf6ba1266c78c3d9dab90ba
SHA25677148f2bb9a04c304bf8df9529cd4e0085e0dba261b4c721df77897aa1bc6cb6
SHA512e9e418e4ae962ce6b020c1dadd250b023ffdb322d1aa39f8e76934e9a0af5d22ba9255c2ad092a4b3bd6ee8fc1d4686e419ab7dfbc1e10e1269de4eea611e4ac
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z99259305.exeFilesize
764KB
MD5e2462f40c0554caad6e7eb79c76dd486
SHA13cd8723c30ed54c54088f087889f7a9108ebaa5b
SHA2564676f0d6d1d336891914005551ff27845b9c0efa75910a0e45a57c11910e839c
SHA5126c84246af18e1616b972eceef724c4ee934b58807a25fc681bac2737e5c0df71db040c2f5bf1064a3e769a516d0bee26dc95a03aed543dc84bfc1353152830fb
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z99259305.exeFilesize
764KB
MD5e2462f40c0554caad6e7eb79c76dd486
SHA13cd8723c30ed54c54088f087889f7a9108ebaa5b
SHA2564676f0d6d1d336891914005551ff27845b9c0efa75910a0e45a57c11910e839c
SHA5126c84246af18e1616b972eceef724c4ee934b58807a25fc681bac2737e5c0df71db040c2f5bf1064a3e769a516d0bee26dc95a03aed543dc84bfc1353152830fb
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z26361690.exeFilesize
581KB
MD578b11752ffe4ed0beeec2bb7e7a9c673
SHA1c8eb50261f1d12cc64d8ec8c2fd4f0df3780576c
SHA256246cd2ce4b03e802611b82e71f3c5bf943da75a28eaea5f9212164e565b7f021
SHA5125e7f685cf53fea12a7904c1129f416f781612f81b8878b0ba62df7e67f2a6b8c175e5eca3945dac355611babd1bb669b4372c98a5e285cd5d8f0a851773b8083
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z26361690.exeFilesize
581KB
MD578b11752ffe4ed0beeec2bb7e7a9c673
SHA1c8eb50261f1d12cc64d8ec8c2fd4f0df3780576c
SHA256246cd2ce4b03e802611b82e71f3c5bf943da75a28eaea5f9212164e565b7f021
SHA5125e7f685cf53fea12a7904c1129f416f781612f81b8878b0ba62df7e67f2a6b8c175e5eca3945dac355611babd1bb669b4372c98a5e285cd5d8f0a851773b8083
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s49799954.exeFilesize
580KB
MD588cc7502c3149f5541e942d13172e2cb
SHA187bcb17f7dbb857abd1eb68bc1f5ab7c70b536ce
SHA2563c2b2ca17881b969ec552387442afb47d01139bb8ced968011e9ba097b2dce7d
SHA5122883e50471ae24bd292980a8e5284c871c1b4cf2880fd03707c37364947a211400307029b1e9b0a7ef7ac899edbc7f2b3fd01b4de2ba8a9cc5f8e71c244114c9
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s49799954.exeFilesize
580KB
MD588cc7502c3149f5541e942d13172e2cb
SHA187bcb17f7dbb857abd1eb68bc1f5ab7c70b536ce
SHA2563c2b2ca17881b969ec552387442afb47d01139bb8ced968011e9ba097b2dce7d
SHA5122883e50471ae24bd292980a8e5284c871c1b4cf2880fd03707c37364947a211400307029b1e9b0a7ef7ac899edbc7f2b3fd01b4de2ba8a9cc5f8e71c244114c9
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t95043863.exeFilesize
169KB
MD5841d16cc27463dcd88b7334617b54e3b
SHA1e5fa1a080d1935827e54841239234f70d2b9533f
SHA2569bc1753f71f72a1e3b504e4963b02a311dd74404453166d36d25454117b066a9
SHA512e8c17fe403a996befa5df2db3fffa58ca87d57591554b8e637b6f7194f8a3361c80f3cc4cbfe6513e1fadc963c2df458731f0021f416420a4a99587f77d45133
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t95043863.exeFilesize
169KB
MD5841d16cc27463dcd88b7334617b54e3b
SHA1e5fa1a080d1935827e54841239234f70d2b9533f
SHA2569bc1753f71f72a1e3b504e4963b02a311dd74404453166d36d25454117b066a9
SHA512e8c17fe403a996befa5df2db3fffa58ca87d57591554b8e637b6f7194f8a3361c80f3cc4cbfe6513e1fadc963c2df458731f0021f416420a4a99587f77d45133
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
memory/224-196-0x00000000054E0000-0x0000000005540000-memory.dmpFilesize
384KB
-
memory/224-212-0x00000000054E0000-0x0000000005540000-memory.dmpFilesize
384KB
-
memory/224-165-0x00000000054E0000-0x0000000005540000-memory.dmpFilesize
384KB
-
memory/224-167-0x00000000054E0000-0x0000000005540000-memory.dmpFilesize
384KB
-
memory/224-168-0x0000000004E70000-0x0000000004E80000-memory.dmpFilesize
64KB
-
memory/224-166-0x0000000004E70000-0x0000000004E80000-memory.dmpFilesize
64KB
-
memory/224-170-0x00000000054E0000-0x0000000005540000-memory.dmpFilesize
384KB
-
memory/224-172-0x00000000054E0000-0x0000000005540000-memory.dmpFilesize
384KB
-
memory/224-174-0x00000000054E0000-0x0000000005540000-memory.dmpFilesize
384KB
-
memory/224-176-0x00000000054E0000-0x0000000005540000-memory.dmpFilesize
384KB
-
memory/224-180-0x00000000054E0000-0x0000000005540000-memory.dmpFilesize
384KB
-
memory/224-178-0x00000000054E0000-0x0000000005540000-memory.dmpFilesize
384KB
-
memory/224-182-0x00000000054E0000-0x0000000005540000-memory.dmpFilesize
384KB
-
memory/224-184-0x00000000054E0000-0x0000000005540000-memory.dmpFilesize
384KB
-
memory/224-186-0x00000000054E0000-0x0000000005540000-memory.dmpFilesize
384KB
-
memory/224-188-0x00000000054E0000-0x0000000005540000-memory.dmpFilesize
384KB
-
memory/224-190-0x00000000054E0000-0x0000000005540000-memory.dmpFilesize
384KB
-
memory/224-192-0x00000000054E0000-0x0000000005540000-memory.dmpFilesize
384KB
-
memory/224-194-0x00000000054E0000-0x0000000005540000-memory.dmpFilesize
384KB
-
memory/224-163-0x0000000004EF0000-0x0000000005494000-memory.dmpFilesize
5.6MB
-
memory/224-198-0x00000000054E0000-0x0000000005540000-memory.dmpFilesize
384KB
-
memory/224-200-0x00000000054E0000-0x0000000005540000-memory.dmpFilesize
384KB
-
memory/224-202-0x00000000054E0000-0x0000000005540000-memory.dmpFilesize
384KB
-
memory/224-204-0x00000000054E0000-0x0000000005540000-memory.dmpFilesize
384KB
-
memory/224-206-0x00000000054E0000-0x0000000005540000-memory.dmpFilesize
384KB
-
memory/224-208-0x00000000054E0000-0x0000000005540000-memory.dmpFilesize
384KB
-
memory/224-210-0x00000000054E0000-0x0000000005540000-memory.dmpFilesize
384KB
-
memory/224-164-0x0000000004E70000-0x0000000004E80000-memory.dmpFilesize
64KB
-
memory/224-214-0x00000000054E0000-0x0000000005540000-memory.dmpFilesize
384KB
-
memory/224-216-0x00000000054E0000-0x0000000005540000-memory.dmpFilesize
384KB
-
memory/224-218-0x00000000054E0000-0x0000000005540000-memory.dmpFilesize
384KB
-
memory/224-220-0x00000000054E0000-0x0000000005540000-memory.dmpFilesize
384KB
-
memory/224-222-0x00000000054E0000-0x0000000005540000-memory.dmpFilesize
384KB
-
memory/224-224-0x00000000054E0000-0x0000000005540000-memory.dmpFilesize
384KB
-
memory/224-226-0x00000000054E0000-0x0000000005540000-memory.dmpFilesize
384KB
-
memory/224-228-0x00000000054E0000-0x0000000005540000-memory.dmpFilesize
384KB
-
memory/224-230-0x00000000054E0000-0x0000000005540000-memory.dmpFilesize
384KB
-
memory/224-2047-0x0000000000910000-0x000000000096B000-memory.dmpFilesize
364KB
-
memory/224-2317-0x0000000004E70000-0x0000000004E80000-memory.dmpFilesize
64KB
-
memory/224-2318-0x0000000004E70000-0x0000000004E80000-memory.dmpFilesize
64KB
-
memory/224-2319-0x0000000004E70000-0x0000000004E80000-memory.dmpFilesize
64KB
-
memory/224-2321-0x0000000004E70000-0x0000000004E80000-memory.dmpFilesize
64KB
-
memory/224-162-0x0000000000910000-0x000000000096B000-memory.dmpFilesize
364KB
-
memory/1304-2332-0x00000000059F0000-0x0000000006008000-memory.dmpFilesize
6.1MB
-
memory/1304-2333-0x00000000054E0000-0x00000000055EA000-memory.dmpFilesize
1.0MB
-
memory/1304-2334-0x0000000005210000-0x0000000005222000-memory.dmpFilesize
72KB
-
memory/1304-2335-0x0000000005270000-0x00000000052AC000-memory.dmpFilesize
240KB
-
memory/1304-2336-0x00000000052C0000-0x00000000052D0000-memory.dmpFilesize
64KB
-
memory/1304-2331-0x00000000009D0000-0x00000000009FE000-memory.dmpFilesize
184KB
-
memory/1304-2343-0x00000000052C0000-0x00000000052D0000-memory.dmpFilesize
64KB
-
memory/3908-2341-0x0000000000E50000-0x0000000000E7E000-memory.dmpFilesize
184KB
-
memory/3908-2342-0x0000000005850000-0x0000000005860000-memory.dmpFilesize
64KB
-
memory/3908-2344-0x0000000005850000-0x0000000005860000-memory.dmpFilesize
64KB