redline | b43f098b71f1a2eb5aad77a7eba70f59889287a362ec9f53b90e972223ce6f5a

Analysis

max time kernel
156s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05-05-2023 19:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b43f098b71f1a2eb5aad77a7eba70f59889287a362ec9f53b90e972223ce6f5a.exe
Size

1.2MB
MD5

8e71a6703cff6b71d3e9c648c1a84c35
SHA1

9be7208c7d2c6ca37d9f20e8e42cdbb8664f71d5
SHA256

b43f098b71f1a2eb5aad77a7eba70f59889287a362ec9f53b90e972223ce6f5a
SHA512

980ee0e44faa445e8fdb3bb2f3d5a796517cb96817f9f1285cd03504adf4fb16de2015e030bf89fe3a9944f9e848817ec189c37780f2cef73d1f1d2a5bc3f54c
SSDEEP

24576:UyZ60psaekGKsPR/pgfVij3ioS74QkFPXH2yh:jA5a5Yhqg1S74PxX2y

Score

10^/10

redline gena life infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

gena

185.161.248.73:4164

Attributes

auth_value
d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

life

185.161.248.73:4164

Attributes

auth_value
8685d11953530b68ad5ec703809d9f91

Signatures

Detects Redline Stealer samples 1 IoCs

This rule detects the presence of Redline Stealer samples based on their unique strings.

stealer

Processes:

resource	yara_rule
behavioral2/memory/2728-2328-0x0000000005640000-0x0000000005C58000-memory.dmp	redline_stealer

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

s90381082.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	s90381082.exe

Executes dropped EXE 6 IoCs

Processes:

z44471322.exez95942758.exez79362962.exes90381082.exe1.exet39212979.exe

pid process

3304 z44471322.exe
4568 z95942758.exe
1268 z79362962.exe
1588 s90381082.exe
2728 1.exe
4480 t39212979.exe

pid	process
3304	z44471322.exe
4568	z95942758.exe
1268	z79362962.exe
1588	s90381082.exe
2728	1.exe
4480	t39212979.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

z95942758.exez79362962.exeb43f098b71f1a2eb5aad77a7eba70f59889287a362ec9f53b90e972223ce6f5a.exez44471322.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z95942758.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z79362962.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z79362962.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	b43f098b71f1a2eb5aad77a7eba70f59889287a362ec9f53b90e972223ce6f5a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b43f098b71f1a2eb5aad77a7eba70f59889287a362ec9f53b90e972223ce6f5a.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z44471322.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z44471322.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z95942758.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4344 1588 WerFault.exe s90381082.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

s90381082.exe

description pid process

Token: SeDebugPrivilege 1588 s90381082.exe

pid	pid_target	process	target process
4344	1588	WerFault.exe	s90381082.exe

description	pid	process
Token: SeDebugPrivilege	1588	s90381082.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

b43f098b71f1a2eb5aad77a7eba70f59889287a362ec9f53b90e972223ce6f5a.exez44471322.exez95942758.exez79362962.exes90381082.exe

description	pid	process	target process
PID 840 wrote to memory of 3304	840	b43f098b71f1a2eb5aad77a7eba70f59889287a362ec9f53b90e972223ce6f5a.exe	z44471322.exe
PID 840 wrote to memory of 3304	840	b43f098b71f1a2eb5aad77a7eba70f59889287a362ec9f53b90e972223ce6f5a.exe	z44471322.exe
PID 840 wrote to memory of 3304	840	b43f098b71f1a2eb5aad77a7eba70f59889287a362ec9f53b90e972223ce6f5a.exe	z44471322.exe
PID 3304 wrote to memory of 4568	3304	z44471322.exe	z95942758.exe
PID 3304 wrote to memory of 4568	3304	z44471322.exe	z95942758.exe
PID 3304 wrote to memory of 4568	3304	z44471322.exe	z95942758.exe
PID 4568 wrote to memory of 1268	4568	z95942758.exe	z79362962.exe
PID 4568 wrote to memory of 1268	4568	z95942758.exe	z79362962.exe
PID 4568 wrote to memory of 1268	4568	z95942758.exe	z79362962.exe
PID 1268 wrote to memory of 1588	1268	z79362962.exe	s90381082.exe
PID 1268 wrote to memory of 1588	1268	z79362962.exe	s90381082.exe
PID 1268 wrote to memory of 1588	1268	z79362962.exe	s90381082.exe
PID 1588 wrote to memory of 2728	1588	s90381082.exe	1.exe
PID 1588 wrote to memory of 2728	1588	s90381082.exe	1.exe
PID 1588 wrote to memory of 2728	1588	s90381082.exe	1.exe
PID 1268 wrote to memory of 4480	1268	z79362962.exe	t39212979.exe
PID 1268 wrote to memory of 4480	1268	z79362962.exe	t39212979.exe
PID 1268 wrote to memory of 4480	1268	z79362962.exe	t39212979.exe

C:\Users\Admin\AppData\Local\Temp\b43f098b71f1a2eb5aad77a7eba70f59889287a362ec9f53b90e972223ce6f5a.exe
"C:\Users\Admin\AppData\Local\Temp\b43f098b71f1a2eb5aad77a7eba70f59889287a362ec9f53b90e972223ce6f5a.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:840

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z44471322.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z44471322.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3304

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z95942758.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z95942758.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4568

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z79362962.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z79362962.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1268

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s90381082.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s90381082.exe
5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1588

C:\Windows\Temp\1.exe
"C:\Windows\Temp\1.exe"
6⤵
- Executes dropped EXE
PID:2728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 1376
6⤵
- Program crash
PID:4344

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t39212979.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t39212979.exe
5⤵
- Executes dropped EXE
PID:4480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1588 -ip 1588
1⤵
PID:3664

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z44471322.exe
Filesize
1.0MB

MD5
214e66e4612bdf60b3b1d3ba5eddebf8

SHA1
1b25d229361a946254e0ecf8550b4c2b644b07ae

SHA256
b21897d20527b5c025c7a7396abf2387c994b6bbfc5d43fb9f04569d22b2f51e

SHA512
c7b4ddacb43a311b52852748d8e2aedb7b01c65bfb228cac12faa2395c52f704aa4099e0239b55678b220126df7a327902900d0861d1a57dc74f6a592b79de6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z44471322.exe
Filesize
1.0MB

MD5
214e66e4612bdf60b3b1d3ba5eddebf8

SHA1
1b25d229361a946254e0ecf8550b4c2b644b07ae

SHA256
b21897d20527b5c025c7a7396abf2387c994b6bbfc5d43fb9f04569d22b2f51e

SHA512
c7b4ddacb43a311b52852748d8e2aedb7b01c65bfb228cac12faa2395c52f704aa4099e0239b55678b220126df7a327902900d0861d1a57dc74f6a592b79de6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z95942758.exe
Filesize
759KB

MD5
0e74da15cc7495c3e1ddb1ee1a7a9161

SHA1
2399febd05a048323ecbf18dad7716b9723eadd5

SHA256
224763e4da772ed609ef5bf5f99900515f342f23bd17b487a1cbacf8a7f815fa

SHA512
62a088b2a5758ecce6ae625f378ff6d599b621757fdc69ffb6a66d0354ac24c1f980f62270c2bd44df59ea70c760db48d346407d57304bc4e5b65ec02a5ae07b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z95942758.exe
Filesize
759KB

MD5
0e74da15cc7495c3e1ddb1ee1a7a9161

SHA1
2399febd05a048323ecbf18dad7716b9723eadd5

SHA256
224763e4da772ed609ef5bf5f99900515f342f23bd17b487a1cbacf8a7f815fa

SHA512
62a088b2a5758ecce6ae625f378ff6d599b621757fdc69ffb6a66d0354ac24c1f980f62270c2bd44df59ea70c760db48d346407d57304bc4e5b65ec02a5ae07b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z79362962.exe
Filesize
577KB

MD5
f9f682454475ea4dd874578fe9e33735

SHA1
1dcf959021b9e7a61d47e7bae46f3e370470bcb7

SHA256
7bdd1428f9ceb932f0d73be6e8dfa9d9bdb4ba0acb8d1c00b745c914328ca52f

SHA512
40f316d5547e8e64c7816e2eee73f55d579580597d7aa57ab9daa07bb8babac924c0424770db5f92b4a9f90689a04e35648cacbbe36dc5442b7e2166e2c0c0f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z79362962.exe
Filesize
577KB

MD5
f9f682454475ea4dd874578fe9e33735

SHA1
1dcf959021b9e7a61d47e7bae46f3e370470bcb7

SHA256
7bdd1428f9ceb932f0d73be6e8dfa9d9bdb4ba0acb8d1c00b745c914328ca52f

SHA512
40f316d5547e8e64c7816e2eee73f55d579580597d7aa57ab9daa07bb8babac924c0424770db5f92b4a9f90689a04e35648cacbbe36dc5442b7e2166e2c0c0f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s90381082.exe
Filesize
574KB

MD5
65b6ce9b6a91553947af3eced556c747

SHA1
cb7f8d35a3efa701204880a13bfd567c06947377

SHA256
db9717fd7f031ea62fb3a50bc72915d20cd08b662655988bdc785571228479ea

SHA512
6881cb8d04804b2cfc6dd1ff70eee23b78c1c697a4fdb262f344b08c83165c1648ecaebcacdbf98d1a576c429902203df0a82305787ea9affaa467f0503a1cd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s90381082.exe
Filesize
574KB

MD5
65b6ce9b6a91553947af3eced556c747

SHA1
cb7f8d35a3efa701204880a13bfd567c06947377

SHA256
db9717fd7f031ea62fb3a50bc72915d20cd08b662655988bdc785571228479ea

SHA512
6881cb8d04804b2cfc6dd1ff70eee23b78c1c697a4fdb262f344b08c83165c1648ecaebcacdbf98d1a576c429902203df0a82305787ea9affaa467f0503a1cd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t39212979.exe
Filesize
169KB

MD5
c077bf431098773d7c8b71987f2e90b4

SHA1
d106f7f559dafd297412abc01bf97cd58e930d03

SHA256
41cc3ea743e0efd0a2985a0ed778294770ae3c1f034b8886b681203bdecae97e

SHA512
d0da47d70fdb975612e5b99d0b0d7ec026e38da06eefdd7b5eb9f3a3ea37d99abc528458d1a553b5d16ad8774da26a08c5694ee09fa648160ff3cbfadcf72784

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t39212979.exe
Filesize
169KB

MD5
c077bf431098773d7c8b71987f2e90b4

SHA1
d106f7f559dafd297412abc01bf97cd58e930d03

SHA256
41cc3ea743e0efd0a2985a0ed778294770ae3c1f034b8886b681203bdecae97e

SHA512
d0da47d70fdb975612e5b99d0b0d7ec026e38da06eefdd7b5eb9f3a3ea37d99abc528458d1a553b5d16ad8774da26a08c5694ee09fa648160ff3cbfadcf72784

Download Submit
C:\Windows\Temp\1.exe
Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
C:\Windows\Temp\1.exe
Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
C:\Windows\Temp\1.exe
Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
memory/1588-172-0x00000000054E0000-0x0000000005540000-memory.dmp

Filesize
384KB

Download
memory/1588-216-0x00000000054E0000-0x0000000005540000-memory.dmp

Filesize
384KB

Download
memory/1588-170-0x00000000054E0000-0x0000000005540000-memory.dmp

Filesize
384KB

Download
memory/1588-167-0x00000000054E0000-0x0000000005540000-memory.dmp

Filesize
384KB

Download
memory/1588-174-0x00000000054E0000-0x0000000005540000-memory.dmp

Filesize
384KB

Download
memory/1588-178-0x00000000054E0000-0x0000000005540000-memory.dmp

Filesize
384KB

Download
memory/1588-176-0x00000000054E0000-0x0000000005540000-memory.dmp

Filesize
384KB

Download
memory/1588-180-0x00000000054E0000-0x0000000005540000-memory.dmp

Filesize
384KB

Download
memory/1588-184-0x00000000054E0000-0x0000000005540000-memory.dmp

Filesize
384KB

Download
memory/1588-186-0x00000000054E0000-0x0000000005540000-memory.dmp

Filesize
384KB

Download
memory/1588-182-0x00000000054E0000-0x0000000005540000-memory.dmp

Filesize
384KB

Download
memory/1588-188-0x00000000054E0000-0x0000000005540000-memory.dmp

Filesize
384KB

Download
memory/1588-192-0x00000000054E0000-0x0000000005540000-memory.dmp

Filesize
384KB

Download
memory/1588-194-0x00000000054E0000-0x0000000005540000-memory.dmp

Filesize
384KB

Download
memory/1588-190-0x00000000054E0000-0x0000000005540000-memory.dmp

Filesize
384KB

Download
memory/1588-196-0x00000000054E0000-0x0000000005540000-memory.dmp

Filesize
384KB

Download
memory/1588-200-0x00000000054E0000-0x0000000005540000-memory.dmp

Filesize
384KB

Download
memory/1588-198-0x00000000054E0000-0x0000000005540000-memory.dmp

Filesize
384KB

Download
memory/1588-202-0x00000000054E0000-0x0000000005540000-memory.dmp

Filesize
384KB

Download
memory/1588-204-0x00000000054E0000-0x0000000005540000-memory.dmp

Filesize
384KB

Download
memory/1588-206-0x00000000054E0000-0x0000000005540000-memory.dmp

Filesize
384KB

Download
memory/1588-208-0x00000000054E0000-0x0000000005540000-memory.dmp

Filesize
384KB

Download
memory/1588-210-0x00000000054E0000-0x0000000005540000-memory.dmp

Filesize
384KB

Download
memory/1588-212-0x00000000054E0000-0x0000000005540000-memory.dmp

Filesize
384KB

Download
memory/1588-214-0x00000000054E0000-0x0000000005540000-memory.dmp

Filesize
384KB

Download
memory/1588-168-0x00000000054E0000-0x0000000005540000-memory.dmp

Filesize
384KB

Download
memory/1588-218-0x00000000054E0000-0x0000000005540000-memory.dmp

Filesize
384KB

Download
memory/1588-220-0x00000000054E0000-0x0000000005540000-memory.dmp

Filesize
384KB

Download
memory/1588-222-0x00000000054E0000-0x0000000005540000-memory.dmp

Filesize
384KB

Download
memory/1588-224-0x00000000054E0000-0x0000000005540000-memory.dmp

Filesize
384KB

Download
memory/1588-226-0x00000000054E0000-0x0000000005540000-memory.dmp

Filesize
384KB

Download
memory/1588-228-0x00000000054E0000-0x0000000005540000-memory.dmp

Filesize
384KB

Download
memory/1588-230-0x00000000054E0000-0x0000000005540000-memory.dmp

Filesize
384KB

Download
memory/1588-2315-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

Filesize
64KB

Download
memory/1588-166-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

Filesize
64KB

Download
memory/1588-164-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

Filesize
64KB

Download
memory/1588-165-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

Filesize
64KB

Download
memory/1588-162-0x0000000004EE0000-0x0000000005484000-memory.dmp

Filesize
5.6MB

Download
memory/1588-163-0x0000000000960000-0x00000000009BB000-memory.dmp

Filesize
364KB

Download
memory/1588-2332-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

Filesize
64KB

Download
memory/1588-2330-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

Filesize
64KB

Download
memory/1588-2331-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

Filesize
64KB

Download
memory/2728-2329-0x0000000005130000-0x000000000523A000-memory.dmp

Filesize
1.0MB

Download
memory/2728-2333-0x0000000005040000-0x0000000005052000-memory.dmp

Filesize
72KB

Download
memory/2728-2334-0x00000000050A0000-0x00000000050DC000-memory.dmp

Filesize
240KB

Download
memory/2728-2335-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/2728-2328-0x0000000005640000-0x0000000005C58000-memory.dmp

Filesize
6.1MB

Download
memory/2728-2326-0x00000000005B0000-0x00000000005DE000-memory.dmp

Filesize
184KB

Download
memory/2728-2342-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/4480-2340-0x00000000006E0000-0x000000000070E000-memory.dmp

Filesize
184KB

Download
memory/4480-2341-0x0000000005060000-0x0000000005070000-memory.dmp

Filesize
64KB

Download
memory/4480-2343-0x0000000005060000-0x0000000005070000-memory.dmp

Filesize
64KB

Download