redline | b6983b275bbcfc343b7d7cca8d102f2b940165cedf1301c727165953d2b34ff7

Analysis

max time kernel
135s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2023, 19:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6983b275bbcfc343b7d7cca8d102f2b940165cedf1301c727165953d2b34ff7.exe
Size

1.2MB
MD5

ab67c1651f4c05d94d91162d3e3e6b2f
SHA1

eed26c7077d8d2401ffc67924a87ee45e1480852
SHA256

b6983b275bbcfc343b7d7cca8d102f2b940165cedf1301c727165953d2b34ff7
SHA512

4b1566f87896c3cb445bfdfd029812cdea5ef8b03f2fe68847cca2b887524d64da1b2d39a3804421af0a1d64f40acb2116df010f8b9000b854e46f9bdc3fb82d
SSDEEP

24576:zyaBBra9rUv8jHFZIaXKmiKPumFOq2FcJi3wnfXV9dCTw:GaBBrSrUEzvfXojdN2JPfXbdCT

Score

10^/10

redline gena life infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

gena

185.161.248.73:4164

Attributes

auth_value
d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

life

185.161.248.73:4164

Attributes

auth_value
8685d11953530b68ad5ec703809d9f91

Signatures

Detects Redline Stealer samples 1 IoCs

This rule detects the presence of Redline Stealer samples based on their unique strings.

stealer

resource	yara_rule
behavioral2/memory/3848-2333-0x00000000055D0000-0x0000000005BE8000-memory.dmp	redline_stealer

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	s95028090.exe

Executes dropped EXE 6 IoCs

pid	Process
804	z59412567.exe
1704	z69272784.exe
3968	z49654519.exe
2704	s95028090.exe
3524	1.exe
3848	t19280905.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z59412567.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z59412567.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z69272784.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z69272784.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z49654519.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z49654519.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	b6983b275bbcfc343b7d7cca8d102f2b940165cedf1301c727165953d2b34ff7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b6983b275bbcfc343b7d7cca8d102f2b940165cedf1301c727165953d2b34ff7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2704	s95028090.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 376 wrote to memory of 804	376	b6983b275bbcfc343b7d7cca8d102f2b940165cedf1301c727165953d2b34ff7.exe	83
PID 376 wrote to memory of 804	376	b6983b275bbcfc343b7d7cca8d102f2b940165cedf1301c727165953d2b34ff7.exe	83
PID 376 wrote to memory of 804	376	b6983b275bbcfc343b7d7cca8d102f2b940165cedf1301c727165953d2b34ff7.exe	83
PID 804 wrote to memory of 1704	804	z59412567.exe	84
PID 804 wrote to memory of 1704	804	z59412567.exe	84
PID 804 wrote to memory of 1704	804	z59412567.exe	84
PID 1704 wrote to memory of 3968	1704	z69272784.exe	85
PID 1704 wrote to memory of 3968	1704	z69272784.exe	85
PID 1704 wrote to memory of 3968	1704	z69272784.exe	85
PID 3968 wrote to memory of 2704	3968	z49654519.exe	86
PID 3968 wrote to memory of 2704	3968	z49654519.exe	86
PID 3968 wrote to memory of 2704	3968	z49654519.exe	86
PID 2704 wrote to memory of 3524	2704	s95028090.exe	89
PID 2704 wrote to memory of 3524	2704	s95028090.exe	89
PID 2704 wrote to memory of 3524	2704	s95028090.exe	89
PID 3968 wrote to memory of 3848	3968	z49654519.exe	90
PID 3968 wrote to memory of 3848	3968	z49654519.exe	90
PID 3968 wrote to memory of 3848	3968	z49654519.exe	90

C:\Users\Admin\AppData\Local\Temp\b6983b275bbcfc343b7d7cca8d102f2b940165cedf1301c727165953d2b34ff7.exe
"C:\Users\Admin\AppData\Local\Temp\b6983b275bbcfc343b7d7cca8d102f2b940165cedf1301c727165953d2b34ff7.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:376
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z59412567.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z59412567.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:804
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z69272784.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z69272784.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1704
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z49654519.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z49654519.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s95028090.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s95028090.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2704
      - C:\Windows\Temp\1.exe
        
        "C:\Windows\Temp\1.exe"
        6⤵
        Executes dropped EXE
        
        PID:3524
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t19280905.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t19280905.exe
        5⤵
        Executes dropped EXE
        
        PID:3848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z59412567.exe

Filesize
1.0MB

MD5
8e5d294501aba2bb44f69b3a25ef14ae

SHA1
4aad0b3c84299346f348c053ada168c6f6d86e66

SHA256
76858caa9bde961c9c100b5603096730c03b4b3848199afe17bd38ccec1e7220

SHA512
73b62df70cfb770b454a12b4015aab6fa21aab8e8102aaa50a53c040832d5dcfd89589d43cc3aad91a37925aee9c7344a8830c85ce459ba3ea792b01e0a6e01b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z59412567.exe

Filesize
1.0MB

MD5
8e5d294501aba2bb44f69b3a25ef14ae

SHA1
4aad0b3c84299346f348c053ada168c6f6d86e66

SHA256
76858caa9bde961c9c100b5603096730c03b4b3848199afe17bd38ccec1e7220

SHA512
73b62df70cfb770b454a12b4015aab6fa21aab8e8102aaa50a53c040832d5dcfd89589d43cc3aad91a37925aee9c7344a8830c85ce459ba3ea792b01e0a6e01b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z69272784.exe

Filesize
764KB

MD5
8d84805181f94fc17c6966fc2669bf19

SHA1
08335302d537b610cfdaae3441d09b0afec946ec

SHA256
8f51bdb793054460eb03ae4a7abc306774cf34a073a9e478ede769b96a8d47bb

SHA512
d3d9c2b0231b19ce6c6c3958d421a6cc3a3be52143e6c9af9dc861d75f7ee38d80c757f764151c8524f7a6ce8bd6a7b284db9845f0c2c6edc02b533d6bcbfa2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z69272784.exe

Filesize
764KB

MD5
8d84805181f94fc17c6966fc2669bf19

SHA1
08335302d537b610cfdaae3441d09b0afec946ec

SHA256
8f51bdb793054460eb03ae4a7abc306774cf34a073a9e478ede769b96a8d47bb

SHA512
d3d9c2b0231b19ce6c6c3958d421a6cc3a3be52143e6c9af9dc861d75f7ee38d80c757f764151c8524f7a6ce8bd6a7b284db9845f0c2c6edc02b533d6bcbfa2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z49654519.exe

Filesize
582KB

MD5
2b788e55abc9ae9e1972a0f797f64f7b

SHA1
e8c0a20aa5698e892ddd766e054e1637818aa0e8

SHA256
8ffa021f6dddbc97dab175ec87fea33e7c733d3fe92ee9f273b28f5e882cadf8

SHA512
f02e81fbc0da42c58cba25561c4cbe7c7935892f6fa90684118708b54fe4a5e4c2b411984adbcb30e0e47238363f0acb74c5447d11d38f7e12c40eba055f2bb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z49654519.exe

Filesize
582KB

MD5
2b788e55abc9ae9e1972a0f797f64f7b

SHA1
e8c0a20aa5698e892ddd766e054e1637818aa0e8

SHA256
8ffa021f6dddbc97dab175ec87fea33e7c733d3fe92ee9f273b28f5e882cadf8

SHA512
f02e81fbc0da42c58cba25561c4cbe7c7935892f6fa90684118708b54fe4a5e4c2b411984adbcb30e0e47238363f0acb74c5447d11d38f7e12c40eba055f2bb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s95028090.exe

Filesize
582KB

MD5
d71b4e3ce87a69c089b26241de9b266f

SHA1
ce8fd7b2be7f7595f54686339408e4e1ee6c1fb2

SHA256
3c899aaaa29ca527e37b2728b1fe4a203438b4d676d78d08b930d80014e19c86

SHA512
3c91153b8d7d43d199b484b34c79a37155d55895de7f61faa4b13350d88cd54dffd2bf8cc9825e276e3372fce76aa9e503e29c3806ae380ba93aa7c46c80fffa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s95028090.exe

Filesize
582KB

MD5
d71b4e3ce87a69c089b26241de9b266f

SHA1
ce8fd7b2be7f7595f54686339408e4e1ee6c1fb2

SHA256
3c899aaaa29ca527e37b2728b1fe4a203438b4d676d78d08b930d80014e19c86

SHA512
3c91153b8d7d43d199b484b34c79a37155d55895de7f61faa4b13350d88cd54dffd2bf8cc9825e276e3372fce76aa9e503e29c3806ae380ba93aa7c46c80fffa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t19280905.exe

Filesize
169KB

MD5
794f259b300ed3bb56d8560893548773

SHA1
848d56403cf25643bcc20af0f500fd803cc6d664

SHA256
85ebf9809cd97164c26d612870f3add40ace7c1a77efdb2e86dd43906c1989b4

SHA512
025794063a45eafb18118d6875a446ad44a0d323e6c8b92dcd88f4d6ce341b1c674b0172b79cd99e1997443289ab40550d17dd52fac8e10fc962a4f02bc47bca

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t19280905.exe

Filesize
169KB

MD5
794f259b300ed3bb56d8560893548773

SHA1
848d56403cf25643bcc20af0f500fd803cc6d664

SHA256
85ebf9809cd97164c26d612870f3add40ace7c1a77efdb2e86dd43906c1989b4

SHA512
025794063a45eafb18118d6875a446ad44a0d323e6c8b92dcd88f4d6ce341b1c674b0172b79cd99e1997443289ab40550d17dd52fac8e10fc962a4f02bc47bca

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
memory/2704-196-0x0000000005530000-0x0000000005590000-memory.dmp

Filesize
384KB

Download
memory/2704-212-0x0000000005530000-0x0000000005590000-memory.dmp

Filesize
384KB

Download
memory/2704-167-0x0000000005530000-0x0000000005590000-memory.dmp

Filesize
384KB

Download
memory/2704-168-0x0000000005530000-0x0000000005590000-memory.dmp

Filesize
384KB

Download
memory/2704-170-0x0000000005530000-0x0000000005590000-memory.dmp

Filesize
384KB

Download
memory/2704-172-0x0000000005530000-0x0000000005590000-memory.dmp

Filesize
384KB

Download
memory/2704-174-0x0000000005530000-0x0000000005590000-memory.dmp

Filesize
384KB

Download
memory/2704-176-0x0000000005530000-0x0000000005590000-memory.dmp

Filesize
384KB

Download
memory/2704-178-0x0000000005530000-0x0000000005590000-memory.dmp

Filesize
384KB

Download
memory/2704-180-0x0000000005530000-0x0000000005590000-memory.dmp

Filesize
384KB

Download
memory/2704-182-0x0000000005530000-0x0000000005590000-memory.dmp

Filesize
384KB

Download
memory/2704-184-0x0000000005530000-0x0000000005590000-memory.dmp

Filesize
384KB

Download
memory/2704-186-0x0000000005530000-0x0000000005590000-memory.dmp

Filesize
384KB

Download
memory/2704-188-0x0000000005530000-0x0000000005590000-memory.dmp

Filesize
384KB

Download
memory/2704-190-0x0000000005530000-0x0000000005590000-memory.dmp

Filesize
384KB

Download
memory/2704-192-0x0000000005530000-0x0000000005590000-memory.dmp

Filesize
384KB

Download
memory/2704-194-0x0000000005530000-0x0000000005590000-memory.dmp

Filesize
384KB

Download
memory/2704-165-0x0000000004F00000-0x0000000004F10000-memory.dmp

Filesize
64KB

Download
memory/2704-198-0x0000000005530000-0x0000000005590000-memory.dmp

Filesize
384KB

Download
memory/2704-200-0x0000000005530000-0x0000000005590000-memory.dmp

Filesize
384KB

Download
memory/2704-202-0x0000000005530000-0x0000000005590000-memory.dmp

Filesize
384KB

Download
memory/2704-204-0x0000000005530000-0x0000000005590000-memory.dmp

Filesize
384KB

Download
memory/2704-206-0x0000000005530000-0x0000000005590000-memory.dmp

Filesize
384KB

Download
memory/2704-208-0x0000000005530000-0x0000000005590000-memory.dmp

Filesize
384KB

Download
memory/2704-210-0x0000000005530000-0x0000000005590000-memory.dmp

Filesize
384KB

Download
memory/2704-166-0x0000000004F00000-0x0000000004F10000-memory.dmp

Filesize
64KB

Download
memory/2704-214-0x0000000005530000-0x0000000005590000-memory.dmp

Filesize
384KB

Download
memory/2704-216-0x0000000005530000-0x0000000005590000-memory.dmp

Filesize
384KB

Download
memory/2704-218-0x0000000005530000-0x0000000005590000-memory.dmp

Filesize
384KB

Download
memory/2704-220-0x0000000005530000-0x0000000005590000-memory.dmp

Filesize
384KB

Download
memory/2704-222-0x0000000005530000-0x0000000005590000-memory.dmp

Filesize
384KB

Download
memory/2704-224-0x0000000005530000-0x0000000005590000-memory.dmp

Filesize
384KB

Download
memory/2704-226-0x0000000005530000-0x0000000005590000-memory.dmp

Filesize
384KB

Download
memory/2704-228-0x0000000005530000-0x0000000005590000-memory.dmp

Filesize
384KB

Download
memory/2704-163-0x0000000000910000-0x000000000096B000-memory.dmp

Filesize
364KB

Download
memory/2704-230-0x0000000005530000-0x0000000005590000-memory.dmp

Filesize
384KB

Download
memory/2704-2315-0x0000000004F00000-0x0000000004F10000-memory.dmp

Filesize
64KB

Download
memory/2704-162-0x0000000004F80000-0x0000000005524000-memory.dmp

Filesize
5.6MB

Download
memory/2704-164-0x0000000004F00000-0x0000000004F10000-memory.dmp

Filesize
64KB

Download
memory/3524-2328-0x0000000000190000-0x00000000001BE000-memory.dmp

Filesize
184KB

Download
memory/3524-2336-0x0000000009F60000-0x0000000009F9C000-memory.dmp

Filesize
240KB

Download
memory/3524-2338-0x00000000049C0000-0x00000000049D0000-memory.dmp

Filesize
64KB

Download
memory/3524-2340-0x00000000049C0000-0x00000000049D0000-memory.dmp

Filesize
64KB

Download
memory/3848-2332-0x00000000006B0000-0x00000000006DE000-memory.dmp

Filesize
184KB

Download
memory/3848-2333-0x00000000055D0000-0x0000000005BE8000-memory.dmp

Filesize
6.1MB

Download
memory/3848-2334-0x00000000050D0000-0x00000000051DA000-memory.dmp

Filesize
1.0MB

Download
memory/3848-2335-0x0000000005000000-0x0000000005012000-memory.dmp

Filesize
72KB

Download
memory/3848-2337-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

Filesize
64KB

Download
memory/3848-2339-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads