Analysis
-
max time kernel
141s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05-05-2023 19:08
Static task
static1
Behavioral task
behavioral1
Sample
b552bffd7a4ff70b616496fe7cd46f5f6980e09d306ef2f69836128bedd75725.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
b552bffd7a4ff70b616496fe7cd46f5f6980e09d306ef2f69836128bedd75725.exe
Resource
win10v2004-20230220-en
General
-
Target
b552bffd7a4ff70b616496fe7cd46f5f6980e09d306ef2f69836128bedd75725.exe
-
Size
1.2MB
-
MD5
c8a42d204799ed3e1d2350025c068707
-
SHA1
6e15d876c10897c560a7accfe9e72de0578c38ef
-
SHA256
b552bffd7a4ff70b616496fe7cd46f5f6980e09d306ef2f69836128bedd75725
-
SHA512
707c871b4fa3ccef0c06e49a0ff32d23eac4a924d240686b4017f7641913dda618935c91e32723d87d3ce6b0b91a94c34664035603f94d74f8055d89dec88972
-
SSDEEP
24576:qyYz8T2V7lLbYVZN8z4/hNE0S6iIuX5JuJvlCdS2i2BqxdPxTnCDH+0HAw:xYi2V7Bs9/hHSL7X+vCdGxx9m+0H
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
life
185.161.248.73:4164
-
auth_value
8685d11953530b68ad5ec703809d9f91
Signatures
-
Detects Redline Stealer samples 1 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
Processes:
resource yara_rule behavioral2/memory/5108-2337-0x0000000005800000-0x0000000005E18000-memory.dmp redline_stealer -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
s22282801.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation s22282801.exe -
Executes dropped EXE 6 IoCs
Processes:
z41633467.exez44972985.exez19478743.exes22282801.exe1.exet76720619.exepid process 4240 z41633467.exe 1512 z44972985.exe 1852 z19478743.exe 1680 s22282801.exe 4976 1.exe 5108 t76720619.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
z19478743.exeb552bffd7a4ff70b616496fe7cd46f5f6980e09d306ef2f69836128bedd75725.exez41633467.exez44972985.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z19478743.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z19478743.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce b552bffd7a4ff70b616496fe7cd46f5f6980e09d306ef2f69836128bedd75725.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" b552bffd7a4ff70b616496fe7cd46f5f6980e09d306ef2f69836128bedd75725.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z41633467.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z41633467.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z44972985.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z44972985.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
s22282801.exedescription pid process Token: SeDebugPrivilege 1680 s22282801.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
b552bffd7a4ff70b616496fe7cd46f5f6980e09d306ef2f69836128bedd75725.exez41633467.exez44972985.exez19478743.exes22282801.exedescription pid process target process PID 1592 wrote to memory of 4240 1592 b552bffd7a4ff70b616496fe7cd46f5f6980e09d306ef2f69836128bedd75725.exe z41633467.exe PID 1592 wrote to memory of 4240 1592 b552bffd7a4ff70b616496fe7cd46f5f6980e09d306ef2f69836128bedd75725.exe z41633467.exe PID 1592 wrote to memory of 4240 1592 b552bffd7a4ff70b616496fe7cd46f5f6980e09d306ef2f69836128bedd75725.exe z41633467.exe PID 4240 wrote to memory of 1512 4240 z41633467.exe z44972985.exe PID 4240 wrote to memory of 1512 4240 z41633467.exe z44972985.exe PID 4240 wrote to memory of 1512 4240 z41633467.exe z44972985.exe PID 1512 wrote to memory of 1852 1512 z44972985.exe z19478743.exe PID 1512 wrote to memory of 1852 1512 z44972985.exe z19478743.exe PID 1512 wrote to memory of 1852 1512 z44972985.exe z19478743.exe PID 1852 wrote to memory of 1680 1852 z19478743.exe s22282801.exe PID 1852 wrote to memory of 1680 1852 z19478743.exe s22282801.exe PID 1852 wrote to memory of 1680 1852 z19478743.exe s22282801.exe PID 1680 wrote to memory of 4976 1680 s22282801.exe 1.exe PID 1680 wrote to memory of 4976 1680 s22282801.exe 1.exe PID 1680 wrote to memory of 4976 1680 s22282801.exe 1.exe PID 1852 wrote to memory of 5108 1852 z19478743.exe t76720619.exe PID 1852 wrote to memory of 5108 1852 z19478743.exe t76720619.exe PID 1852 wrote to memory of 5108 1852 z19478743.exe t76720619.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b552bffd7a4ff70b616496fe7cd46f5f6980e09d306ef2f69836128bedd75725.exe"C:\Users\Admin\AppData\Local\Temp\b552bffd7a4ff70b616496fe7cd46f5f6980e09d306ef2f69836128bedd75725.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z41633467.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z41633467.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z44972985.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z44972985.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z19478743.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z19478743.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s22282801.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s22282801.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t76720619.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t76720619.exe5⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z41633467.exeFilesize
1.0MB
MD59c25dbf85c0965d1a49db0914516e353
SHA1eb97d82e48e7eb3c0c261ff555fe86e8340b2f50
SHA2561df33a17a240e97913a7536c545f5c0ebc3c45a8a1467517a90a4b8487a31b0d
SHA51255bacb5b965a4364f4352ee387ab1974b75fa4b415a4d2432edc9689c8ccd0f8021b01f15b635b88b812598e02ef56cbab3bf2d86121455d159f4d86c469f9e1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z41633467.exeFilesize
1.0MB
MD59c25dbf85c0965d1a49db0914516e353
SHA1eb97d82e48e7eb3c0c261ff555fe86e8340b2f50
SHA2561df33a17a240e97913a7536c545f5c0ebc3c45a8a1467517a90a4b8487a31b0d
SHA51255bacb5b965a4364f4352ee387ab1974b75fa4b415a4d2432edc9689c8ccd0f8021b01f15b635b88b812598e02ef56cbab3bf2d86121455d159f4d86c469f9e1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z44972985.exeFilesize
764KB
MD5d44112a7e1c5767372d14e4312909332
SHA15150c5274e1cd2d06d8d02fbdbacf914d332f87c
SHA2560a2c6e24de13f7823ee0e9ef5c8c695e42b0107a62cbc7b7ffbfdee24eeec824
SHA512d6695512f45dc765806b5df5baadd3069378ce6e74377de2ae070b0e85e215990c931981590536370144c8699f9215aebb64f435d2ae4105bcea5c3d09b4bd09
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z44972985.exeFilesize
764KB
MD5d44112a7e1c5767372d14e4312909332
SHA15150c5274e1cd2d06d8d02fbdbacf914d332f87c
SHA2560a2c6e24de13f7823ee0e9ef5c8c695e42b0107a62cbc7b7ffbfdee24eeec824
SHA512d6695512f45dc765806b5df5baadd3069378ce6e74377de2ae070b0e85e215990c931981590536370144c8699f9215aebb64f435d2ae4105bcea5c3d09b4bd09
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z19478743.exeFilesize
581KB
MD56dab672dff5b0927037b4f6985f263bc
SHA11b333c4dcad4eeb74501e24d363cca1c4ca43ac5
SHA25641b30b618526f85a26c747cc307de7ab5a87d7f881905a3e82ba1a7c492762f3
SHA51228782690928ad620d870f68dc48e7e67cf165c17e4932447f7f8c8d1134f9238282b4689713179f2ffdb4739ef509060a96359967216c8318b46e461ee625520
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z19478743.exeFilesize
581KB
MD56dab672dff5b0927037b4f6985f263bc
SHA11b333c4dcad4eeb74501e24d363cca1c4ca43ac5
SHA25641b30b618526f85a26c747cc307de7ab5a87d7f881905a3e82ba1a7c492762f3
SHA51228782690928ad620d870f68dc48e7e67cf165c17e4932447f7f8c8d1134f9238282b4689713179f2ffdb4739ef509060a96359967216c8318b46e461ee625520
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s22282801.exeFilesize
582KB
MD57f642c5c2d6f9bdcf9d91c17f7bf975e
SHA133bc8a7312cc481e884c9e88e5f5b29b4384c1e3
SHA2568406d4ab66db039673e882df9d125021e11cb69936f3d7bb11da7c105e5474ad
SHA512ec28604b423ceb04cde1fe230179ab3941b9f9e285f39949972dcfec624e26d2fd9d4af8bb95be54e6ee2244a7cc9f6792a306ea7778cca63fbb4fbd485526af
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s22282801.exeFilesize
582KB
MD57f642c5c2d6f9bdcf9d91c17f7bf975e
SHA133bc8a7312cc481e884c9e88e5f5b29b4384c1e3
SHA2568406d4ab66db039673e882df9d125021e11cb69936f3d7bb11da7c105e5474ad
SHA512ec28604b423ceb04cde1fe230179ab3941b9f9e285f39949972dcfec624e26d2fd9d4af8bb95be54e6ee2244a7cc9f6792a306ea7778cca63fbb4fbd485526af
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t76720619.exeFilesize
169KB
MD54e83e40cfb9211a775e68db9c8269de1
SHA1e3811ee7806c1db4821160ec59dba566acb530c6
SHA2560a3f789bc67f72995d4900b150d4e5c686462747e5ae213e470300be869d0a43
SHA512e573d32f2c81d26fc744f2a1dd2edc224c35bc7e3bcbe3ae9710f66729cf5f0d42d597f294fdf9695b48c4a46ef2366a95a232fc7bb7978f915751b867e344f5
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t76720619.exeFilesize
169KB
MD54e83e40cfb9211a775e68db9c8269de1
SHA1e3811ee7806c1db4821160ec59dba566acb530c6
SHA2560a3f789bc67f72995d4900b150d4e5c686462747e5ae213e470300be869d0a43
SHA512e573d32f2c81d26fc744f2a1dd2edc224c35bc7e3bcbe3ae9710f66729cf5f0d42d597f294fdf9695b48c4a46ef2366a95a232fc7bb7978f915751b867e344f5
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
memory/1680-193-0x0000000004FA0000-0x0000000004FB0000-memory.dmpFilesize
64KB
-
memory/1680-210-0x0000000004F40000-0x0000000004FA0000-memory.dmpFilesize
384KB
-
memory/1680-164-0x0000000004F40000-0x0000000004FA0000-memory.dmpFilesize
384KB
-
memory/1680-165-0x0000000004F40000-0x0000000004FA0000-memory.dmpFilesize
384KB
-
memory/1680-167-0x0000000004F40000-0x0000000004FA0000-memory.dmpFilesize
384KB
-
memory/1680-169-0x0000000004F40000-0x0000000004FA0000-memory.dmpFilesize
384KB
-
memory/1680-171-0x0000000004F40000-0x0000000004FA0000-memory.dmpFilesize
384KB
-
memory/1680-173-0x0000000004F40000-0x0000000004FA0000-memory.dmpFilesize
384KB
-
memory/1680-175-0x0000000004F40000-0x0000000004FA0000-memory.dmpFilesize
384KB
-
memory/1680-177-0x0000000004F40000-0x0000000004FA0000-memory.dmpFilesize
384KB
-
memory/1680-181-0x0000000004F40000-0x0000000004FA0000-memory.dmpFilesize
384KB
-
memory/1680-179-0x0000000004F40000-0x0000000004FA0000-memory.dmpFilesize
384KB
-
memory/1680-183-0x0000000004F40000-0x0000000004FA0000-memory.dmpFilesize
384KB
-
memory/1680-185-0x0000000004F40000-0x0000000004FA0000-memory.dmpFilesize
384KB
-
memory/1680-187-0x0000000004F40000-0x0000000004FA0000-memory.dmpFilesize
384KB
-
memory/1680-190-0x0000000004F40000-0x0000000004FA0000-memory.dmpFilesize
384KB
-
memory/1680-189-0x0000000004FA0000-0x0000000004FB0000-memory.dmpFilesize
64KB
-
memory/1680-191-0x0000000004FA0000-0x0000000004FB0000-memory.dmpFilesize
64KB
-
memory/1680-194-0x0000000004F40000-0x0000000004FA0000-memory.dmpFilesize
384KB
-
memory/1680-162-0x0000000000840000-0x000000000089B000-memory.dmpFilesize
364KB
-
memory/1680-196-0x0000000004F40000-0x0000000004FA0000-memory.dmpFilesize
384KB
-
memory/1680-198-0x0000000004F40000-0x0000000004FA0000-memory.dmpFilesize
384KB
-
memory/1680-200-0x0000000004F40000-0x0000000004FA0000-memory.dmpFilesize
384KB
-
memory/1680-202-0x0000000004F40000-0x0000000004FA0000-memory.dmpFilesize
384KB
-
memory/1680-204-0x0000000004F40000-0x0000000004FA0000-memory.dmpFilesize
384KB
-
memory/1680-206-0x0000000004F40000-0x0000000004FA0000-memory.dmpFilesize
384KB
-
memory/1680-208-0x0000000004F40000-0x0000000004FA0000-memory.dmpFilesize
384KB
-
memory/1680-163-0x0000000004FB0000-0x0000000005554000-memory.dmpFilesize
5.6MB
-
memory/1680-212-0x0000000004F40000-0x0000000004FA0000-memory.dmpFilesize
384KB
-
memory/1680-214-0x0000000004F40000-0x0000000004FA0000-memory.dmpFilesize
384KB
-
memory/1680-216-0x0000000004F40000-0x0000000004FA0000-memory.dmpFilesize
384KB
-
memory/1680-218-0x0000000004F40000-0x0000000004FA0000-memory.dmpFilesize
384KB
-
memory/1680-220-0x0000000004F40000-0x0000000004FA0000-memory.dmpFilesize
384KB
-
memory/1680-222-0x0000000004F40000-0x0000000004FA0000-memory.dmpFilesize
384KB
-
memory/1680-224-0x0000000004F40000-0x0000000004FA0000-memory.dmpFilesize
384KB
-
memory/1680-226-0x0000000004F40000-0x0000000004FA0000-memory.dmpFilesize
384KB
-
memory/1680-228-0x0000000004F40000-0x0000000004FA0000-memory.dmpFilesize
384KB
-
memory/1680-230-0x0000000004F40000-0x0000000004FA0000-memory.dmpFilesize
384KB
-
memory/1680-2315-0x0000000004FA0000-0x0000000004FB0000-memory.dmpFilesize
64KB
-
memory/1680-2317-0x0000000000840000-0x000000000089B000-memory.dmpFilesize
364KB
-
memory/1680-2318-0x0000000004FA0000-0x0000000004FB0000-memory.dmpFilesize
64KB
-
memory/1680-2319-0x0000000004FA0000-0x0000000004FB0000-memory.dmpFilesize
64KB
-
memory/1680-2320-0x0000000004FA0000-0x0000000004FB0000-memory.dmpFilesize
64KB
-
memory/4976-2332-0x0000000000EE0000-0x0000000000F0E000-memory.dmpFilesize
184KB
-
memory/4976-2338-0x0000000005960000-0x0000000005A6A000-memory.dmpFilesize
1.0MB
-
memory/4976-2339-0x0000000005820000-0x0000000005832000-memory.dmpFilesize
72KB
-
memory/4976-2342-0x0000000005840000-0x0000000005850000-memory.dmpFilesize
64KB
-
memory/4976-2344-0x0000000005840000-0x0000000005850000-memory.dmpFilesize
64KB
-
memory/5108-2336-0x0000000000840000-0x000000000086E000-memory.dmpFilesize
184KB
-
memory/5108-2337-0x0000000005800000-0x0000000005E18000-memory.dmpFilesize
6.1MB
-
memory/5108-2341-0x00000000051D0000-0x00000000051E0000-memory.dmpFilesize
64KB
-
memory/5108-2340-0x0000000005220000-0x000000000525C000-memory.dmpFilesize
240KB
-
memory/5108-2343-0x00000000051D0000-0x00000000051E0000-memory.dmpFilesize
64KB