Analysis
-
max time kernel
173s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05-05-2023 18:56
Static task
static1
Behavioral task
behavioral1
Sample
ac2f3b0694ba4a0e839068e4cbb91409c10cbca009fbc69ce690a29f29f49d19.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
ac2f3b0694ba4a0e839068e4cbb91409c10cbca009fbc69ce690a29f29f49d19.exe
Resource
win10v2004-20230220-en
General
-
Target
ac2f3b0694ba4a0e839068e4cbb91409c10cbca009fbc69ce690a29f29f49d19.exe
-
Size
1.2MB
-
MD5
1b5433e3ac1b7eda4d43fb930c03408c
-
SHA1
0edce7e117cc60a55dbb2077626609498b087880
-
SHA256
ac2f3b0694ba4a0e839068e4cbb91409c10cbca009fbc69ce690a29f29f49d19
-
SHA512
3ece2042108fd3c214f5bc6a96df2592f5e473e98628bebb878676fac1f63026d6f336a9baaa254537c9ab6f5e2c10bae31e37f3f8a79a7de470de74dbd2faa8
-
SSDEEP
24576:yy6YXjI3YL6TqIgXt9CtqAqUXzDOPSK3BwcZ+9nrshec:Z5zI3s62RXyAAq+qqQOcY9nGe
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
life
185.161.248.73:4164
-
auth_value
8685d11953530b68ad5ec703809d9f91
Signatures
-
Detects Redline Stealer samples 1 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
Processes:
resource yara_rule behavioral2/memory/2140-2330-0x000000000A530000-0x000000000AB48000-memory.dmp redline_stealer -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
s04560622.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation s04560622.exe -
Executes dropped EXE 6 IoCs
Processes:
z29185994.exez17095493.exez47799259.exes04560622.exe1.exet55708477.exepid process 3888 z29185994.exe 1856 z17095493.exe 1808 z47799259.exe 2576 s04560622.exe 3364 1.exe 2140 t55708477.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
z47799259.exeac2f3b0694ba4a0e839068e4cbb91409c10cbca009fbc69ce690a29f29f49d19.exez29185994.exez17095493.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z47799259.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ac2f3b0694ba4a0e839068e4cbb91409c10cbca009fbc69ce690a29f29f49d19.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" ac2f3b0694ba4a0e839068e4cbb91409c10cbca009fbc69ce690a29f29f49d19.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z29185994.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z29185994.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z17095493.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z17095493.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z47799259.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
s04560622.exedescription pid process Token: SeDebugPrivilege 2576 s04560622.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
ac2f3b0694ba4a0e839068e4cbb91409c10cbca009fbc69ce690a29f29f49d19.exez29185994.exez17095493.exez47799259.exes04560622.exedescription pid process target process PID 1472 wrote to memory of 3888 1472 ac2f3b0694ba4a0e839068e4cbb91409c10cbca009fbc69ce690a29f29f49d19.exe z29185994.exe PID 1472 wrote to memory of 3888 1472 ac2f3b0694ba4a0e839068e4cbb91409c10cbca009fbc69ce690a29f29f49d19.exe z29185994.exe PID 1472 wrote to memory of 3888 1472 ac2f3b0694ba4a0e839068e4cbb91409c10cbca009fbc69ce690a29f29f49d19.exe z29185994.exe PID 3888 wrote to memory of 1856 3888 z29185994.exe z17095493.exe PID 3888 wrote to memory of 1856 3888 z29185994.exe z17095493.exe PID 3888 wrote to memory of 1856 3888 z29185994.exe z17095493.exe PID 1856 wrote to memory of 1808 1856 z17095493.exe z47799259.exe PID 1856 wrote to memory of 1808 1856 z17095493.exe z47799259.exe PID 1856 wrote to memory of 1808 1856 z17095493.exe z47799259.exe PID 1808 wrote to memory of 2576 1808 z47799259.exe s04560622.exe PID 1808 wrote to memory of 2576 1808 z47799259.exe s04560622.exe PID 1808 wrote to memory of 2576 1808 z47799259.exe s04560622.exe PID 2576 wrote to memory of 3364 2576 s04560622.exe 1.exe PID 2576 wrote to memory of 3364 2576 s04560622.exe 1.exe PID 2576 wrote to memory of 3364 2576 s04560622.exe 1.exe PID 1808 wrote to memory of 2140 1808 z47799259.exe t55708477.exe PID 1808 wrote to memory of 2140 1808 z47799259.exe t55708477.exe PID 1808 wrote to memory of 2140 1808 z47799259.exe t55708477.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac2f3b0694ba4a0e839068e4cbb91409c10cbca009fbc69ce690a29f29f49d19.exe"C:\Users\Admin\AppData\Local\Temp\ac2f3b0694ba4a0e839068e4cbb91409c10cbca009fbc69ce690a29f29f49d19.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z29185994.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z29185994.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z17095493.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z17095493.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z47799259.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z47799259.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s04560622.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s04560622.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t55708477.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t55708477.exe5⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z29185994.exeFilesize
1.0MB
MD56045421e7125357243857de9f056a6ac
SHA1e3463b3391dd89d98e579e8f1a4cfcee1cefd6f6
SHA2566a6cca740eeb8e5f568f93fd611eb70b2edc0f460710fa55f69c110bd98bfff2
SHA5123267801066ef1832d10087d1db348a0364e4cc9401d82abd62424a0b8570151ea8d8aa54bccfa4d7f1971581378a499e5a52b05b523c252a3a1165e6c36c514a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z29185994.exeFilesize
1.0MB
MD56045421e7125357243857de9f056a6ac
SHA1e3463b3391dd89d98e579e8f1a4cfcee1cefd6f6
SHA2566a6cca740eeb8e5f568f93fd611eb70b2edc0f460710fa55f69c110bd98bfff2
SHA5123267801066ef1832d10087d1db348a0364e4cc9401d82abd62424a0b8570151ea8d8aa54bccfa4d7f1971581378a499e5a52b05b523c252a3a1165e6c36c514a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z17095493.exeFilesize
765KB
MD5022192ff28bc8ee3476051e54cb0139a
SHA180bcaf14e193fdabf8d79e3aa53510633eb01d7c
SHA2566d0d47f5f9d5b021d74f84c174d5bcded975296657029a99c0fe33b02e91ada7
SHA512a890acb8c2c26bd8ff44e7df0337a0d31115b4b448b03d1891335021f1f05218a56b8785aa0756bc46c8e37bc03daba11a2f365adc068c61ed2ad2b483b9f3c2
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z17095493.exeFilesize
765KB
MD5022192ff28bc8ee3476051e54cb0139a
SHA180bcaf14e193fdabf8d79e3aa53510633eb01d7c
SHA2566d0d47f5f9d5b021d74f84c174d5bcded975296657029a99c0fe33b02e91ada7
SHA512a890acb8c2c26bd8ff44e7df0337a0d31115b4b448b03d1891335021f1f05218a56b8785aa0756bc46c8e37bc03daba11a2f365adc068c61ed2ad2b483b9f3c2
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z47799259.exeFilesize
582KB
MD539eae789d8dede1297c7768c363d2f70
SHA192cf9b7066042c15afdc9b73705ad73c49bcaedd
SHA2568027b2d7566cd8b3301e9334fc2e19744a85728b30dcbadf367bcd70c029ddfe
SHA5127208c174e9257ec22fd55e3b5ff965248f432d015bb91a362dfa8dd7f4224c5da935c4e5c8905f053143caa3814807763f1ac67ff8cbaff50df932e130a4391f
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z47799259.exeFilesize
582KB
MD539eae789d8dede1297c7768c363d2f70
SHA192cf9b7066042c15afdc9b73705ad73c49bcaedd
SHA2568027b2d7566cd8b3301e9334fc2e19744a85728b30dcbadf367bcd70c029ddfe
SHA5127208c174e9257ec22fd55e3b5ff965248f432d015bb91a362dfa8dd7f4224c5da935c4e5c8905f053143caa3814807763f1ac67ff8cbaff50df932e130a4391f
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s04560622.exeFilesize
582KB
MD540451aaabfb1a36bc547c2ac84c7655c
SHA1a998027e1871dd23c32d8788bc0c9d3d1e776da4
SHA2567c61e4d963dcd787b7f38b9ea922954e083614d9126505f5b41ebf189cacc467
SHA5125efb5ba3a05014296798ac7935130e007c8a3878dc7d289c9597189742367fec18a4fb7b3d0493ec8f8daa45ad97ab4f12306a1d016e2ae1f138122d1c08d4e1
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s04560622.exeFilesize
582KB
MD540451aaabfb1a36bc547c2ac84c7655c
SHA1a998027e1871dd23c32d8788bc0c9d3d1e776da4
SHA2567c61e4d963dcd787b7f38b9ea922954e083614d9126505f5b41ebf189cacc467
SHA5125efb5ba3a05014296798ac7935130e007c8a3878dc7d289c9597189742367fec18a4fb7b3d0493ec8f8daa45ad97ab4f12306a1d016e2ae1f138122d1c08d4e1
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t55708477.exeFilesize
169KB
MD5565f360382b18e6aaf5d00e619253896
SHA16b5de99ea070dd5b361539a3e6ee98ce22b54ce2
SHA2564191e7f6b806afa40bc853d67a06d84585e72483546ae39a0e5cd4552e80c560
SHA512d0374a80aa0406fa6b16fca35688b6bf06dfb5302767dfa44812fe8d69700419b7ec6704c08fadc339ed2b6150ed391ae11335a2d762d4cb0370a69e11799b17
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t55708477.exeFilesize
169KB
MD5565f360382b18e6aaf5d00e619253896
SHA16b5de99ea070dd5b361539a3e6ee98ce22b54ce2
SHA2564191e7f6b806afa40bc853d67a06d84585e72483546ae39a0e5cd4552e80c560
SHA512d0374a80aa0406fa6b16fca35688b6bf06dfb5302767dfa44812fe8d69700419b7ec6704c08fadc339ed2b6150ed391ae11335a2d762d4cb0370a69e11799b17
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
memory/2140-2337-0x0000000004B60000-0x0000000004B70000-memory.dmpFilesize
64KB
-
memory/2140-2329-0x0000000000270000-0x000000000029E000-memory.dmpFilesize
184KB
-
memory/2140-2330-0x000000000A530000-0x000000000AB48000-memory.dmpFilesize
6.1MB
-
memory/2140-2331-0x000000000A0B0000-0x000000000A1BA000-memory.dmpFilesize
1.0MB
-
memory/2140-2333-0x000000000A040000-0x000000000A07C000-memory.dmpFilesize
240KB
-
memory/2140-2335-0x0000000004B60000-0x0000000004B70000-memory.dmpFilesize
64KB
-
memory/2576-171-0x0000000005060000-0x00000000050C0000-memory.dmpFilesize
384KB
-
memory/2576-221-0x0000000005060000-0x00000000050C0000-memory.dmpFilesize
384KB
-
memory/2576-183-0x0000000005060000-0x00000000050C0000-memory.dmpFilesize
384KB
-
memory/2576-185-0x0000000005060000-0x00000000050C0000-memory.dmpFilesize
384KB
-
memory/2576-187-0x0000000005060000-0x00000000050C0000-memory.dmpFilesize
384KB
-
memory/2576-189-0x0000000005060000-0x00000000050C0000-memory.dmpFilesize
384KB
-
memory/2576-191-0x0000000005060000-0x00000000050C0000-memory.dmpFilesize
384KB
-
memory/2576-193-0x0000000005060000-0x00000000050C0000-memory.dmpFilesize
384KB
-
memory/2576-195-0x0000000005060000-0x00000000050C0000-memory.dmpFilesize
384KB
-
memory/2576-197-0x0000000005060000-0x00000000050C0000-memory.dmpFilesize
384KB
-
memory/2576-199-0x0000000005060000-0x00000000050C0000-memory.dmpFilesize
384KB
-
memory/2576-201-0x0000000005060000-0x00000000050C0000-memory.dmpFilesize
384KB
-
memory/2576-203-0x0000000005060000-0x00000000050C0000-memory.dmpFilesize
384KB
-
memory/2576-205-0x0000000005060000-0x00000000050C0000-memory.dmpFilesize
384KB
-
memory/2576-207-0x0000000005060000-0x00000000050C0000-memory.dmpFilesize
384KB
-
memory/2576-209-0x0000000005060000-0x00000000050C0000-memory.dmpFilesize
384KB
-
memory/2576-211-0x0000000005060000-0x00000000050C0000-memory.dmpFilesize
384KB
-
memory/2576-213-0x0000000005060000-0x00000000050C0000-memory.dmpFilesize
384KB
-
memory/2576-215-0x0000000005060000-0x00000000050C0000-memory.dmpFilesize
384KB
-
memory/2576-217-0x0000000005060000-0x00000000050C0000-memory.dmpFilesize
384KB
-
memory/2576-219-0x0000000005060000-0x00000000050C0000-memory.dmpFilesize
384KB
-
memory/2576-181-0x0000000005060000-0x00000000050C0000-memory.dmpFilesize
384KB
-
memory/2576-223-0x0000000005060000-0x00000000050C0000-memory.dmpFilesize
384KB
-
memory/2576-225-0x0000000005060000-0x00000000050C0000-memory.dmpFilesize
384KB
-
memory/2576-227-0x0000000005060000-0x00000000050C0000-memory.dmpFilesize
384KB
-
memory/2576-229-0x0000000005060000-0x00000000050C0000-memory.dmpFilesize
384KB
-
memory/2576-179-0x0000000005060000-0x00000000050C0000-memory.dmpFilesize
384KB
-
memory/2576-177-0x0000000005060000-0x00000000050C0000-memory.dmpFilesize
384KB
-
memory/2576-175-0x0000000005060000-0x00000000050C0000-memory.dmpFilesize
384KB
-
memory/2576-162-0x0000000000930000-0x000000000098B000-memory.dmpFilesize
364KB
-
memory/2576-173-0x0000000005060000-0x00000000050C0000-memory.dmpFilesize
384KB
-
memory/2576-169-0x0000000005060000-0x00000000050C0000-memory.dmpFilesize
384KB
-
memory/2576-167-0x0000000005060000-0x00000000050C0000-memory.dmpFilesize
384KB
-
memory/2576-166-0x0000000005060000-0x00000000050C0000-memory.dmpFilesize
384KB
-
memory/2576-163-0x00000000050D0000-0x00000000050E0000-memory.dmpFilesize
64KB
-
memory/2576-164-0x00000000050E0000-0x0000000005684000-memory.dmpFilesize
5.6MB
-
memory/2576-165-0x00000000050D0000-0x00000000050E0000-memory.dmpFilesize
64KB
-
memory/3364-2334-0x00000000058A0000-0x00000000058B0000-memory.dmpFilesize
64KB
-
memory/3364-2332-0x00000000058D0000-0x00000000058E2000-memory.dmpFilesize
72KB
-
memory/3364-2336-0x00000000058A0000-0x00000000058B0000-memory.dmpFilesize
64KB
-
memory/3364-2325-0x0000000000F60000-0x0000000000F8E000-memory.dmpFilesize
184KB