Analysis

  • max time kernel
    135s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/05/2023, 19:09

General

  • Target

    b6983b275bbcfc343b7d7cca8d102f2b940165cedf1301c727165953d2b34ff7.exe

  • Size

    1.2MB

  • MD5

    ab67c1651f4c05d94d91162d3e3e6b2f

  • SHA1

    eed26c7077d8d2401ffc67924a87ee45e1480852

  • SHA256

    b6983b275bbcfc343b7d7cca8d102f2b940165cedf1301c727165953d2b34ff7

  • SHA512

    4b1566f87896c3cb445bfdfd029812cdea5ef8b03f2fe68847cca2b887524d64da1b2d39a3804421af0a1d64f40acb2116df010f8b9000b854e46f9bdc3fb82d

  • SSDEEP

    24576:zyaBBra9rUv8jHFZIaXKmiKPumFOq2FcJi3wnfXV9dCTw:GaBBrSrUEzvfXojdN2JPfXbdCT

Malware Config

Extracted

Family

redline

Botnet

gena

C2

185.161.248.73:4164

Attributes
  • auth_value

    d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

life

C2

185.161.248.73:4164

Attributes
  • auth_value

    8685d11953530b68ad5ec703809d9f91

Signatures

  • Detects Redline Stealer samples 1 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b6983b275bbcfc343b7d7cca8d102f2b940165cedf1301c727165953d2b34ff7.exe
    "C:\Users\Admin\AppData\Local\Temp\b6983b275bbcfc343b7d7cca8d102f2b940165cedf1301c727165953d2b34ff7.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:376
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z59412567.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z59412567.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:804
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z69272784.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z69272784.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1704
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z49654519.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z49654519.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:3968
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s95028090.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s95028090.exe
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2704
            • C:\Windows\Temp\1.exe
              "C:\Windows\Temp\1.exe"
              6⤵
              • Executes dropped EXE
              PID:3524
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t19280905.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t19280905.exe
            5⤵
            • Executes dropped EXE
            PID:3848

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z59412567.exe

    Filesize

    1.0MB

    MD5

    8e5d294501aba2bb44f69b3a25ef14ae

    SHA1

    4aad0b3c84299346f348c053ada168c6f6d86e66

    SHA256

    76858caa9bde961c9c100b5603096730c03b4b3848199afe17bd38ccec1e7220

    SHA512

    73b62df70cfb770b454a12b4015aab6fa21aab8e8102aaa50a53c040832d5dcfd89589d43cc3aad91a37925aee9c7344a8830c85ce459ba3ea792b01e0a6e01b

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z59412567.exe

    Filesize

    1.0MB

    MD5

    8e5d294501aba2bb44f69b3a25ef14ae

    SHA1

    4aad0b3c84299346f348c053ada168c6f6d86e66

    SHA256

    76858caa9bde961c9c100b5603096730c03b4b3848199afe17bd38ccec1e7220

    SHA512

    73b62df70cfb770b454a12b4015aab6fa21aab8e8102aaa50a53c040832d5dcfd89589d43cc3aad91a37925aee9c7344a8830c85ce459ba3ea792b01e0a6e01b

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z69272784.exe

    Filesize

    764KB

    MD5

    8d84805181f94fc17c6966fc2669bf19

    SHA1

    08335302d537b610cfdaae3441d09b0afec946ec

    SHA256

    8f51bdb793054460eb03ae4a7abc306774cf34a073a9e478ede769b96a8d47bb

    SHA512

    d3d9c2b0231b19ce6c6c3958d421a6cc3a3be52143e6c9af9dc861d75f7ee38d80c757f764151c8524f7a6ce8bd6a7b284db9845f0c2c6edc02b533d6bcbfa2a

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z69272784.exe

    Filesize

    764KB

    MD5

    8d84805181f94fc17c6966fc2669bf19

    SHA1

    08335302d537b610cfdaae3441d09b0afec946ec

    SHA256

    8f51bdb793054460eb03ae4a7abc306774cf34a073a9e478ede769b96a8d47bb

    SHA512

    d3d9c2b0231b19ce6c6c3958d421a6cc3a3be52143e6c9af9dc861d75f7ee38d80c757f764151c8524f7a6ce8bd6a7b284db9845f0c2c6edc02b533d6bcbfa2a

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z49654519.exe

    Filesize

    582KB

    MD5

    2b788e55abc9ae9e1972a0f797f64f7b

    SHA1

    e8c0a20aa5698e892ddd766e054e1637818aa0e8

    SHA256

    8ffa021f6dddbc97dab175ec87fea33e7c733d3fe92ee9f273b28f5e882cadf8

    SHA512

    f02e81fbc0da42c58cba25561c4cbe7c7935892f6fa90684118708b54fe4a5e4c2b411984adbcb30e0e47238363f0acb74c5447d11d38f7e12c40eba055f2bb0

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z49654519.exe

    Filesize

    582KB

    MD5

    2b788e55abc9ae9e1972a0f797f64f7b

    SHA1

    e8c0a20aa5698e892ddd766e054e1637818aa0e8

    SHA256

    8ffa021f6dddbc97dab175ec87fea33e7c733d3fe92ee9f273b28f5e882cadf8

    SHA512

    f02e81fbc0da42c58cba25561c4cbe7c7935892f6fa90684118708b54fe4a5e4c2b411984adbcb30e0e47238363f0acb74c5447d11d38f7e12c40eba055f2bb0

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s95028090.exe

    Filesize

    582KB

    MD5

    d71b4e3ce87a69c089b26241de9b266f

    SHA1

    ce8fd7b2be7f7595f54686339408e4e1ee6c1fb2

    SHA256

    3c899aaaa29ca527e37b2728b1fe4a203438b4d676d78d08b930d80014e19c86

    SHA512

    3c91153b8d7d43d199b484b34c79a37155d55895de7f61faa4b13350d88cd54dffd2bf8cc9825e276e3372fce76aa9e503e29c3806ae380ba93aa7c46c80fffa

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s95028090.exe

    Filesize

    582KB

    MD5

    d71b4e3ce87a69c089b26241de9b266f

    SHA1

    ce8fd7b2be7f7595f54686339408e4e1ee6c1fb2

    SHA256

    3c899aaaa29ca527e37b2728b1fe4a203438b4d676d78d08b930d80014e19c86

    SHA512

    3c91153b8d7d43d199b484b34c79a37155d55895de7f61faa4b13350d88cd54dffd2bf8cc9825e276e3372fce76aa9e503e29c3806ae380ba93aa7c46c80fffa

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t19280905.exe

    Filesize

    169KB

    MD5

    794f259b300ed3bb56d8560893548773

    SHA1

    848d56403cf25643bcc20af0f500fd803cc6d664

    SHA256

    85ebf9809cd97164c26d612870f3add40ace7c1a77efdb2e86dd43906c1989b4

    SHA512

    025794063a45eafb18118d6875a446ad44a0d323e6c8b92dcd88f4d6ce341b1c674b0172b79cd99e1997443289ab40550d17dd52fac8e10fc962a4f02bc47bca

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t19280905.exe

    Filesize

    169KB

    MD5

    794f259b300ed3bb56d8560893548773

    SHA1

    848d56403cf25643bcc20af0f500fd803cc6d664

    SHA256

    85ebf9809cd97164c26d612870f3add40ace7c1a77efdb2e86dd43906c1989b4

    SHA512

    025794063a45eafb18118d6875a446ad44a0d323e6c8b92dcd88f4d6ce341b1c674b0172b79cd99e1997443289ab40550d17dd52fac8e10fc962a4f02bc47bca

  • C:\Windows\Temp\1.exe

    Filesize

    168KB

    MD5

    f16fb63d4e551d3808e8f01f2671b57e

    SHA1

    781153ad6235a1152da112de1fb39a6f2d063575

    SHA256

    8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

    SHA512

    fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

  • C:\Windows\Temp\1.exe

    Filesize

    168KB

    MD5

    f16fb63d4e551d3808e8f01f2671b57e

    SHA1

    781153ad6235a1152da112de1fb39a6f2d063575

    SHA256

    8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

    SHA512

    fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

  • C:\Windows\Temp\1.exe

    Filesize

    168KB

    MD5

    f16fb63d4e551d3808e8f01f2671b57e

    SHA1

    781153ad6235a1152da112de1fb39a6f2d063575

    SHA256

    8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

    SHA512

    fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

  • memory/2704-196-0x0000000005530000-0x0000000005590000-memory.dmp

    Filesize

    384KB

  • memory/2704-212-0x0000000005530000-0x0000000005590000-memory.dmp

    Filesize

    384KB

  • memory/2704-167-0x0000000005530000-0x0000000005590000-memory.dmp

    Filesize

    384KB

  • memory/2704-168-0x0000000005530000-0x0000000005590000-memory.dmp

    Filesize

    384KB

  • memory/2704-170-0x0000000005530000-0x0000000005590000-memory.dmp

    Filesize

    384KB

  • memory/2704-172-0x0000000005530000-0x0000000005590000-memory.dmp

    Filesize

    384KB

  • memory/2704-174-0x0000000005530000-0x0000000005590000-memory.dmp

    Filesize

    384KB

  • memory/2704-176-0x0000000005530000-0x0000000005590000-memory.dmp

    Filesize

    384KB

  • memory/2704-178-0x0000000005530000-0x0000000005590000-memory.dmp

    Filesize

    384KB

  • memory/2704-180-0x0000000005530000-0x0000000005590000-memory.dmp

    Filesize

    384KB

  • memory/2704-182-0x0000000005530000-0x0000000005590000-memory.dmp

    Filesize

    384KB

  • memory/2704-184-0x0000000005530000-0x0000000005590000-memory.dmp

    Filesize

    384KB

  • memory/2704-186-0x0000000005530000-0x0000000005590000-memory.dmp

    Filesize

    384KB

  • memory/2704-188-0x0000000005530000-0x0000000005590000-memory.dmp

    Filesize

    384KB

  • memory/2704-190-0x0000000005530000-0x0000000005590000-memory.dmp

    Filesize

    384KB

  • memory/2704-192-0x0000000005530000-0x0000000005590000-memory.dmp

    Filesize

    384KB

  • memory/2704-194-0x0000000005530000-0x0000000005590000-memory.dmp

    Filesize

    384KB

  • memory/2704-165-0x0000000004F00000-0x0000000004F10000-memory.dmp

    Filesize

    64KB

  • memory/2704-198-0x0000000005530000-0x0000000005590000-memory.dmp

    Filesize

    384KB

  • memory/2704-200-0x0000000005530000-0x0000000005590000-memory.dmp

    Filesize

    384KB

  • memory/2704-202-0x0000000005530000-0x0000000005590000-memory.dmp

    Filesize

    384KB

  • memory/2704-204-0x0000000005530000-0x0000000005590000-memory.dmp

    Filesize

    384KB

  • memory/2704-206-0x0000000005530000-0x0000000005590000-memory.dmp

    Filesize

    384KB

  • memory/2704-208-0x0000000005530000-0x0000000005590000-memory.dmp

    Filesize

    384KB

  • memory/2704-210-0x0000000005530000-0x0000000005590000-memory.dmp

    Filesize

    384KB

  • memory/2704-166-0x0000000004F00000-0x0000000004F10000-memory.dmp

    Filesize

    64KB

  • memory/2704-214-0x0000000005530000-0x0000000005590000-memory.dmp

    Filesize

    384KB

  • memory/2704-216-0x0000000005530000-0x0000000005590000-memory.dmp

    Filesize

    384KB

  • memory/2704-218-0x0000000005530000-0x0000000005590000-memory.dmp

    Filesize

    384KB

  • memory/2704-220-0x0000000005530000-0x0000000005590000-memory.dmp

    Filesize

    384KB

  • memory/2704-222-0x0000000005530000-0x0000000005590000-memory.dmp

    Filesize

    384KB

  • memory/2704-224-0x0000000005530000-0x0000000005590000-memory.dmp

    Filesize

    384KB

  • memory/2704-226-0x0000000005530000-0x0000000005590000-memory.dmp

    Filesize

    384KB

  • memory/2704-228-0x0000000005530000-0x0000000005590000-memory.dmp

    Filesize

    384KB

  • memory/2704-163-0x0000000000910000-0x000000000096B000-memory.dmp

    Filesize

    364KB

  • memory/2704-230-0x0000000005530000-0x0000000005590000-memory.dmp

    Filesize

    384KB

  • memory/2704-2315-0x0000000004F00000-0x0000000004F10000-memory.dmp

    Filesize

    64KB

  • memory/2704-162-0x0000000004F80000-0x0000000005524000-memory.dmp

    Filesize

    5.6MB

  • memory/2704-164-0x0000000004F00000-0x0000000004F10000-memory.dmp

    Filesize

    64KB

  • memory/3524-2328-0x0000000000190000-0x00000000001BE000-memory.dmp

    Filesize

    184KB

  • memory/3524-2336-0x0000000009F60000-0x0000000009F9C000-memory.dmp

    Filesize

    240KB

  • memory/3524-2338-0x00000000049C0000-0x00000000049D0000-memory.dmp

    Filesize

    64KB

  • memory/3524-2340-0x00000000049C0000-0x00000000049D0000-memory.dmp

    Filesize

    64KB

  • memory/3848-2332-0x00000000006B0000-0x00000000006DE000-memory.dmp

    Filesize

    184KB

  • memory/3848-2333-0x00000000055D0000-0x0000000005BE8000-memory.dmp

    Filesize

    6.1MB

  • memory/3848-2334-0x00000000050D0000-0x00000000051DA000-memory.dmp

    Filesize

    1.0MB

  • memory/3848-2335-0x0000000005000000-0x0000000005012000-memory.dmp

    Filesize

    72KB

  • memory/3848-2337-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

    Filesize

    64KB

  • memory/3848-2339-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

    Filesize

    64KB