Analysis
-
max time kernel
156s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05-05-2023 19:04
Static task
static1
Behavioral task
behavioral1
Sample
b241f4449ef2ad8d497483109226d28a1326deed430d969c9e849b6531a234ff.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
b241f4449ef2ad8d497483109226d28a1326deed430d969c9e849b6531a234ff.exe
Resource
win10v2004-20230220-en
General
-
Target
b241f4449ef2ad8d497483109226d28a1326deed430d969c9e849b6531a234ff.exe
-
Size
1.2MB
-
MD5
cf0feb49271482b3ef3e23f7db928bee
-
SHA1
011bb778bfc4c2ad2db325830b5d021e36c4b4e5
-
SHA256
b241f4449ef2ad8d497483109226d28a1326deed430d969c9e849b6531a234ff
-
SHA512
1eb7e92003196cb231c1ee866fccf346fbb579cbd4626b8d8d83a8232ed1e851b0256eb923c53b21bc0e9d9293cef41857f23a61a0dc70853502702fdb28033e
-
SSDEEP
24576:iyX6VCuDozpbnAVEjRUMiAiDupr0CfTHoOa5UGZucGTu4ACvLRO39a0KX:JqVv+pbnrUMiAYEr0CDgT4cHCvLRO38p
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
life
185.161.248.73:4164
-
auth_value
8685d11953530b68ad5ec703809d9f91
Signatures
-
Detects Redline Stealer samples 1 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
Processes:
resource yara_rule behavioral2/memory/3772-2332-0x0000000005D10000-0x0000000006328000-memory.dmp redline_stealer -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
s92124979.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation s92124979.exe -
Executes dropped EXE 6 IoCs
Processes:
z23655541.exez14776584.exez86466749.exes92124979.exe1.exet67504870.exepid process 3948 z23655541.exe 4556 z14776584.exe 212 z86466749.exe 2260 s92124979.exe 3772 1.exe 4640 t67504870.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
z23655541.exez14776584.exez86466749.exeb241f4449ef2ad8d497483109226d28a1326deed430d969c9e849b6531a234ff.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z23655541.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z23655541.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z14776584.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z14776584.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z86466749.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z86466749.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce b241f4449ef2ad8d497483109226d28a1326deed430d969c9e849b6531a234ff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" b241f4449ef2ad8d497483109226d28a1326deed430d969c9e849b6531a234ff.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1824 2260 WerFault.exe s92124979.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
s92124979.exedescription pid process Token: SeDebugPrivilege 2260 s92124979.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
b241f4449ef2ad8d497483109226d28a1326deed430d969c9e849b6531a234ff.exez23655541.exez14776584.exez86466749.exes92124979.exedescription pid process target process PID 3092 wrote to memory of 3948 3092 b241f4449ef2ad8d497483109226d28a1326deed430d969c9e849b6531a234ff.exe z23655541.exe PID 3092 wrote to memory of 3948 3092 b241f4449ef2ad8d497483109226d28a1326deed430d969c9e849b6531a234ff.exe z23655541.exe PID 3092 wrote to memory of 3948 3092 b241f4449ef2ad8d497483109226d28a1326deed430d969c9e849b6531a234ff.exe z23655541.exe PID 3948 wrote to memory of 4556 3948 z23655541.exe z14776584.exe PID 3948 wrote to memory of 4556 3948 z23655541.exe z14776584.exe PID 3948 wrote to memory of 4556 3948 z23655541.exe z14776584.exe PID 4556 wrote to memory of 212 4556 z14776584.exe z86466749.exe PID 4556 wrote to memory of 212 4556 z14776584.exe z86466749.exe PID 4556 wrote to memory of 212 4556 z14776584.exe z86466749.exe PID 212 wrote to memory of 2260 212 z86466749.exe s92124979.exe PID 212 wrote to memory of 2260 212 z86466749.exe s92124979.exe PID 212 wrote to memory of 2260 212 z86466749.exe s92124979.exe PID 2260 wrote to memory of 3772 2260 s92124979.exe 1.exe PID 2260 wrote to memory of 3772 2260 s92124979.exe 1.exe PID 2260 wrote to memory of 3772 2260 s92124979.exe 1.exe PID 212 wrote to memory of 4640 212 z86466749.exe t67504870.exe PID 212 wrote to memory of 4640 212 z86466749.exe t67504870.exe PID 212 wrote to memory of 4640 212 z86466749.exe t67504870.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b241f4449ef2ad8d497483109226d28a1326deed430d969c9e849b6531a234ff.exe"C:\Users\Admin\AppData\Local\Temp\b241f4449ef2ad8d497483109226d28a1326deed430d969c9e849b6531a234ff.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z23655541.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z23655541.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z14776584.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z14776584.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z86466749.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z86466749.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s92124979.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s92124979.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 13846⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t67504870.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t67504870.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2260 -ip 22601⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z23655541.exeFilesize
1.0MB
MD594c1f1f586c7c1a32ad345132d9069d4
SHA15a2485e77aab2662fb8b0e34f5ee9f381843fedd
SHA25674b3a10f47f69d295e4ab14206854153a26236284a7b458445ad1b98d70fd48e
SHA5123744fe5caa9f24c28a54df7160bbf15d5fdf1fc8e1f82da36ff41e57210d2dce8352731add10e223a90ec42b63f27992c9b318d9430afcd5df2591ccd21603ac
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z23655541.exeFilesize
1.0MB
MD594c1f1f586c7c1a32ad345132d9069d4
SHA15a2485e77aab2662fb8b0e34f5ee9f381843fedd
SHA25674b3a10f47f69d295e4ab14206854153a26236284a7b458445ad1b98d70fd48e
SHA5123744fe5caa9f24c28a54df7160bbf15d5fdf1fc8e1f82da36ff41e57210d2dce8352731add10e223a90ec42b63f27992c9b318d9430afcd5df2591ccd21603ac
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z14776584.exeFilesize
764KB
MD5c45be99431b539be357bced8c80aa3b5
SHA179b7ea1090786c39cea94f319fc4039be554cfce
SHA256cd442faeb67f091caef2b129bf8e61e5780105e70e4c4a8b8844410d99f221b7
SHA512b4c6ef3f8d05a93ff9295cbc81d7ae029de5b17b818164c54ccfc523eb9f5941d574f6a5f34966283d6dccbbeaed131890c91c9ca9878c8209de11f8b6b36d84
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z14776584.exeFilesize
764KB
MD5c45be99431b539be357bced8c80aa3b5
SHA179b7ea1090786c39cea94f319fc4039be554cfce
SHA256cd442faeb67f091caef2b129bf8e61e5780105e70e4c4a8b8844410d99f221b7
SHA512b4c6ef3f8d05a93ff9295cbc81d7ae029de5b17b818164c54ccfc523eb9f5941d574f6a5f34966283d6dccbbeaed131890c91c9ca9878c8209de11f8b6b36d84
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z86466749.exeFilesize
581KB
MD5550ee7c915a07b5835ac2cc17a08d164
SHA1faa3c9d7291b8f7c1d4e01ac4fd657bd811fd0b3
SHA2566e9efaf6589bde361f37bef3119bfc83d16b2e98174ad2632afe105689d694d7
SHA512b1dd23c38495856f7dec4e1afb5b0f03222901727fd8e545a4e50cfbf3d62a7f76fbc1532b0a68f81c854ae2ada214b422529cfec074083becc482f95cbd4426
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z86466749.exeFilesize
581KB
MD5550ee7c915a07b5835ac2cc17a08d164
SHA1faa3c9d7291b8f7c1d4e01ac4fd657bd811fd0b3
SHA2566e9efaf6589bde361f37bef3119bfc83d16b2e98174ad2632afe105689d694d7
SHA512b1dd23c38495856f7dec4e1afb5b0f03222901727fd8e545a4e50cfbf3d62a7f76fbc1532b0a68f81c854ae2ada214b422529cfec074083becc482f95cbd4426
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s92124979.exeFilesize
580KB
MD51ed679fe00085ee88e48c275adc24878
SHA1c56f15781d5d3f37d6e672568e54e92611ae56d9
SHA2567c543efb8f2c19c62faa9a1975d4b5323703c7279fac221056073a639ac3d7c4
SHA51254e3342e6145bf14b30a4eea9cd3e0c5b5cb7db3bc51eb32bdfe6fe57b0034b62dfb6b6c1d396e7fa9c12dea7ab36c244e0b6abd933ca015b867468f0f76160b
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s92124979.exeFilesize
580KB
MD51ed679fe00085ee88e48c275adc24878
SHA1c56f15781d5d3f37d6e672568e54e92611ae56d9
SHA2567c543efb8f2c19c62faa9a1975d4b5323703c7279fac221056073a639ac3d7c4
SHA51254e3342e6145bf14b30a4eea9cd3e0c5b5cb7db3bc51eb32bdfe6fe57b0034b62dfb6b6c1d396e7fa9c12dea7ab36c244e0b6abd933ca015b867468f0f76160b
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t67504870.exeFilesize
169KB
MD5a82962678b9e8562c5c32691ce12b4d9
SHA19d785d4397c95ce083be3f897efe4610bba9f7d8
SHA256059f56e068882756faf462bb1d4f9372f3b427b190341ad5f7ec9a11bfc34d2c
SHA512f15c0688c94e991083987cea5ae014869f6e8b858d4dca54d5f3628653d2edcfc829c2e9b0e35778f9a065a3026a2044f01b07e071f437a9dbda5fd774e4f532
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t67504870.exeFilesize
169KB
MD5a82962678b9e8562c5c32691ce12b4d9
SHA19d785d4397c95ce083be3f897efe4610bba9f7d8
SHA256059f56e068882756faf462bb1d4f9372f3b427b190341ad5f7ec9a11bfc34d2c
SHA512f15c0688c94e991083987cea5ae014869f6e8b858d4dca54d5f3628653d2edcfc829c2e9b0e35778f9a065a3026a2044f01b07e071f437a9dbda5fd774e4f532
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
memory/2260-193-0x0000000005510000-0x0000000005570000-memory.dmpFilesize
384KB
-
memory/2260-205-0x0000000005510000-0x0000000005570000-memory.dmpFilesize
384KB
-
memory/2260-164-0x0000000002990000-0x00000000029A0000-memory.dmpFilesize
64KB
-
memory/2260-165-0x0000000002990000-0x00000000029A0000-memory.dmpFilesize
64KB
-
memory/2260-166-0x0000000002990000-0x00000000029A0000-memory.dmpFilesize
64KB
-
memory/2260-167-0x0000000000400000-0x0000000000837000-memory.dmpFilesize
4.2MB
-
memory/2260-168-0x0000000005510000-0x0000000005570000-memory.dmpFilesize
384KB
-
memory/2260-169-0x0000000005510000-0x0000000005570000-memory.dmpFilesize
384KB
-
memory/2260-171-0x0000000005510000-0x0000000005570000-memory.dmpFilesize
384KB
-
memory/2260-173-0x0000000005510000-0x0000000005570000-memory.dmpFilesize
384KB
-
memory/2260-175-0x0000000005510000-0x0000000005570000-memory.dmpFilesize
384KB
-
memory/2260-177-0x0000000005510000-0x0000000005570000-memory.dmpFilesize
384KB
-
memory/2260-179-0x0000000005510000-0x0000000005570000-memory.dmpFilesize
384KB
-
memory/2260-181-0x0000000005510000-0x0000000005570000-memory.dmpFilesize
384KB
-
memory/2260-183-0x0000000005510000-0x0000000005570000-memory.dmpFilesize
384KB
-
memory/2260-185-0x0000000005510000-0x0000000005570000-memory.dmpFilesize
384KB
-
memory/2260-187-0x0000000005510000-0x0000000005570000-memory.dmpFilesize
384KB
-
memory/2260-189-0x0000000005510000-0x0000000005570000-memory.dmpFilesize
384KB
-
memory/2260-191-0x0000000005510000-0x0000000005570000-memory.dmpFilesize
384KB
-
memory/2260-162-0x0000000002240000-0x000000000229B000-memory.dmpFilesize
364KB
-
memory/2260-195-0x0000000005510000-0x0000000005570000-memory.dmpFilesize
384KB
-
memory/2260-197-0x0000000005510000-0x0000000005570000-memory.dmpFilesize
384KB
-
memory/2260-199-0x0000000005510000-0x0000000005570000-memory.dmpFilesize
384KB
-
memory/2260-201-0x0000000005510000-0x0000000005570000-memory.dmpFilesize
384KB
-
memory/2260-203-0x0000000005510000-0x0000000005570000-memory.dmpFilesize
384KB
-
memory/2260-163-0x0000000004F60000-0x0000000005504000-memory.dmpFilesize
5.6MB
-
memory/2260-207-0x0000000005510000-0x0000000005570000-memory.dmpFilesize
384KB
-
memory/2260-209-0x0000000005510000-0x0000000005570000-memory.dmpFilesize
384KB
-
memory/2260-211-0x0000000005510000-0x0000000005570000-memory.dmpFilesize
384KB
-
memory/2260-213-0x0000000005510000-0x0000000005570000-memory.dmpFilesize
384KB
-
memory/2260-215-0x0000000005510000-0x0000000005570000-memory.dmpFilesize
384KB
-
memory/2260-217-0x0000000005510000-0x0000000005570000-memory.dmpFilesize
384KB
-
memory/2260-219-0x0000000005510000-0x0000000005570000-memory.dmpFilesize
384KB
-
memory/2260-221-0x0000000005510000-0x0000000005570000-memory.dmpFilesize
384KB
-
memory/2260-223-0x0000000005510000-0x0000000005570000-memory.dmpFilesize
384KB
-
memory/2260-225-0x0000000005510000-0x0000000005570000-memory.dmpFilesize
384KB
-
memory/2260-227-0x0000000005510000-0x0000000005570000-memory.dmpFilesize
384KB
-
memory/2260-229-0x0000000005510000-0x0000000005570000-memory.dmpFilesize
384KB
-
memory/2260-2229-0x0000000002990000-0x00000000029A0000-memory.dmpFilesize
64KB
-
memory/2260-2230-0x0000000002990000-0x00000000029A0000-memory.dmpFilesize
64KB
-
memory/2260-2232-0x0000000002990000-0x00000000029A0000-memory.dmpFilesize
64KB
-
memory/2260-2319-0x0000000002990000-0x00000000029A0000-memory.dmpFilesize
64KB
-
memory/3772-2331-0x0000000000DA0000-0x0000000000DCE000-memory.dmpFilesize
184KB
-
memory/3772-2332-0x0000000005D10000-0x0000000006328000-memory.dmpFilesize
6.1MB
-
memory/3772-2333-0x0000000005800000-0x000000000590A000-memory.dmpFilesize
1.0MB
-
memory/3772-2334-0x00000000056F0000-0x0000000005702000-memory.dmpFilesize
72KB
-
memory/3772-2335-0x0000000005750000-0x000000000578C000-memory.dmpFilesize
240KB
-
memory/3772-2337-0x0000000002F70000-0x0000000002F80000-memory.dmpFilesize
64KB
-
memory/3772-2344-0x0000000002F70000-0x0000000002F80000-memory.dmpFilesize
64KB
-
memory/4640-2342-0x0000000000C90000-0x0000000000CBE000-memory.dmpFilesize
184KB
-
memory/4640-2343-0x0000000005570000-0x0000000005580000-memory.dmpFilesize
64KB
-
memory/4640-2345-0x0000000005570000-0x0000000005580000-memory.dmpFilesize
64KB