Analysis

  • max time kernel
    190s
  • max time network
    195s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-05-2023 20:22

General

  • Target

    edd159a6ffc12eb2d1373c7f9be371c42b4b3157462fb0211d6d0d7cc2aaf86c.exe

  • Size

    1.2MB

  • MD5

    4920b94ea7d0c18b5cc3a2915bb1cfba

  • SHA1

    3e9b7ddd899110e5876e0b9461c1914251ed8a38

  • SHA256

    edd159a6ffc12eb2d1373c7f9be371c42b4b3157462fb0211d6d0d7cc2aaf86c

  • SHA512

    b0c62a842870dffc9d681164a8827a16becf882b0a1a615f28c60564e960a0d75c467037bcd719e2b1df2401eb04632f796bcf63b24fec0784153f790ea5ce90

  • SSDEEP

    24576:DyB+6wPK4fCkSB2Dz1rEyoN/rZ6WZ0e2GVRWBLkYZT/ioOiMyvF1WTjUd:WBNwPJfU414yoNdz5OJ/iby9oTjU

Malware Config

Extracted

Family

redline

Botnet

gena

C2

185.161.248.73:4164

Attributes
  • auth_value

    d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

life

C2

185.161.248.73:4164

Attributes
  • auth_value

    8685d11953530b68ad5ec703809d9f91

Signatures

  • Detects Redline Stealer samples 1 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\edd159a6ffc12eb2d1373c7f9be371c42b4b3157462fb0211d6d0d7cc2aaf86c.exe
    "C:\Users\Admin\AppData\Local\Temp\edd159a6ffc12eb2d1373c7f9be371c42b4b3157462fb0211d6d0d7cc2aaf86c.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2264
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z78750995.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z78750995.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3024
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z19803407.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z19803407.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1328
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z29944310.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z29944310.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:220
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s16166419.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s16166419.exe
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3312
            • C:\Windows\Temp\1.exe
              "C:\Windows\Temp\1.exe"
              6⤵
              • Executes dropped EXE
              PID:2784
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 1384
              6⤵
              • Program crash
              PID:776
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t94216193.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t94216193.exe
            5⤵
            • Executes dropped EXE
            PID:4908
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3312 -ip 3312
    1⤵
      PID:1696

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z78750995.exe

      Filesize

      1.0MB

      MD5

      b3fa776e9cccdfa79364675cbeb632b4

      SHA1

      dafffbc79bd87e3d5235d42fd06d70bfa9231fdb

      SHA256

      d392169f49c954d14be07c553b7992b02bdbc717cff9641cc7b217c514bcdeda

      SHA512

      f24ae65c85b142c46db93cc3fbe164dc33e2852973cf58717b695d9e53753c778d760435484a7f9c02546a06127945d6ac31afbd39f941cae1d73cf49b14c0be

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z78750995.exe

      Filesize

      1.0MB

      MD5

      b3fa776e9cccdfa79364675cbeb632b4

      SHA1

      dafffbc79bd87e3d5235d42fd06d70bfa9231fdb

      SHA256

      d392169f49c954d14be07c553b7992b02bdbc717cff9641cc7b217c514bcdeda

      SHA512

      f24ae65c85b142c46db93cc3fbe164dc33e2852973cf58717b695d9e53753c778d760435484a7f9c02546a06127945d6ac31afbd39f941cae1d73cf49b14c0be

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z19803407.exe

      Filesize

      764KB

      MD5

      aeb899bf39b4de18da0bb5db378c8a2d

      SHA1

      3a437d23bb1ce28c4b54e0efa5a1aa7e607e5503

      SHA256

      456a71ea9ba6ec6e9cd20d29548e13d2047a5697af6d6f5e04474dfeae16994b

      SHA512

      646c2d82aa94f2c31d460df847d53692038fad26637e6d06442d43997c926e7a4d555bddcfb71275d66662099ff25b9b1ef1b909043f3a89eb4e983e41664251

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z19803407.exe

      Filesize

      764KB

      MD5

      aeb899bf39b4de18da0bb5db378c8a2d

      SHA1

      3a437d23bb1ce28c4b54e0efa5a1aa7e607e5503

      SHA256

      456a71ea9ba6ec6e9cd20d29548e13d2047a5697af6d6f5e04474dfeae16994b

      SHA512

      646c2d82aa94f2c31d460df847d53692038fad26637e6d06442d43997c926e7a4d555bddcfb71275d66662099ff25b9b1ef1b909043f3a89eb4e983e41664251

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z29944310.exe

      Filesize

      581KB

      MD5

      35698cff3e94c33d3610b5626e368a44

      SHA1

      4b31580dc67373cfe6bad2e20f003a8cb33d7562

      SHA256

      37cfad99c413661b015d1c6875b19a35faf4c6bbb1488b2b5d25ab85a289e246

      SHA512

      e7cb913bf4b9ebe06d0c9afeed1a7928671132079f13c30f72c4a4e5c1e8b14ab6032e31897484387afb3da7668ea0020034570c3f153ca8d2ff2f51161c3e29

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z29944310.exe

      Filesize

      581KB

      MD5

      35698cff3e94c33d3610b5626e368a44

      SHA1

      4b31580dc67373cfe6bad2e20f003a8cb33d7562

      SHA256

      37cfad99c413661b015d1c6875b19a35faf4c6bbb1488b2b5d25ab85a289e246

      SHA512

      e7cb913bf4b9ebe06d0c9afeed1a7928671132079f13c30f72c4a4e5c1e8b14ab6032e31897484387afb3da7668ea0020034570c3f153ca8d2ff2f51161c3e29

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s16166419.exe

      Filesize

      580KB

      MD5

      2b7a09408462f72d37d0ad514f9c0458

      SHA1

      230db1374aa153f3d3edf275569043a59815dce7

      SHA256

      0b2f000d423cae62513a64ef15f4e8ccec1784be55a175f3fc43cafd024b2691

      SHA512

      15077015ddc9c7b67d1d828ce201ef1f904f7924a8f923e26d9d161a6453b8e9e02851e3430302dc3815f619c6656efbc69d7021b6f16756e6b25a3b4fc7ff5b

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s16166419.exe

      Filesize

      580KB

      MD5

      2b7a09408462f72d37d0ad514f9c0458

      SHA1

      230db1374aa153f3d3edf275569043a59815dce7

      SHA256

      0b2f000d423cae62513a64ef15f4e8ccec1784be55a175f3fc43cafd024b2691

      SHA512

      15077015ddc9c7b67d1d828ce201ef1f904f7924a8f923e26d9d161a6453b8e9e02851e3430302dc3815f619c6656efbc69d7021b6f16756e6b25a3b4fc7ff5b

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t94216193.exe

      Filesize

      169KB

      MD5

      97f5242a2c93f68b3b7978cef16b84bd

      SHA1

      8997ba1cce5c36d23a69aaaa8be71c92fff47461

      SHA256

      72455f337b2d7da9702594004b19e8e3b266dbfd5c6cffc1a455cbaea0a212a7

      SHA512

      10f11a0d9cc9725bbc85c7e87f7e9c7d37cbf2e3c166ac7e683cd9f976accebbc877edccf38fadd4d4e0a452239769a9403083456ece677839fbab20c1967a55

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t94216193.exe

      Filesize

      169KB

      MD5

      97f5242a2c93f68b3b7978cef16b84bd

      SHA1

      8997ba1cce5c36d23a69aaaa8be71c92fff47461

      SHA256

      72455f337b2d7da9702594004b19e8e3b266dbfd5c6cffc1a455cbaea0a212a7

      SHA512

      10f11a0d9cc9725bbc85c7e87f7e9c7d37cbf2e3c166ac7e683cd9f976accebbc877edccf38fadd4d4e0a452239769a9403083456ece677839fbab20c1967a55

    • C:\Windows\Temp\1.exe

      Filesize

      168KB

      MD5

      f16fb63d4e551d3808e8f01f2671b57e

      SHA1

      781153ad6235a1152da112de1fb39a6f2d063575

      SHA256

      8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

      SHA512

      fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

    • C:\Windows\Temp\1.exe

      Filesize

      168KB

      MD5

      f16fb63d4e551d3808e8f01f2671b57e

      SHA1

      781153ad6235a1152da112de1fb39a6f2d063575

      SHA256

      8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

      SHA512

      fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

    • C:\Windows\Temp\1.exe

      Filesize

      168KB

      MD5

      f16fb63d4e551d3808e8f01f2671b57e

      SHA1

      781153ad6235a1152da112de1fb39a6f2d063575

      SHA256

      8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

      SHA512

      fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

    • memory/2784-2346-0x0000000005260000-0x0000000005270000-memory.dmp

      Filesize

      64KB

    • memory/2784-2339-0x000000000A620000-0x000000000A65C000-memory.dmp

      Filesize

      240KB

    • memory/2784-2338-0x0000000005260000-0x0000000005270000-memory.dmp

      Filesize

      64KB

    • memory/2784-2337-0x00000000051E0000-0x00000000051F2000-memory.dmp

      Filesize

      72KB

    • memory/2784-2336-0x000000000A730000-0x000000000A83A000-memory.dmp

      Filesize

      1.0MB

    • memory/2784-2335-0x000000000AC40000-0x000000000B258000-memory.dmp

      Filesize

      6.1MB

    • memory/2784-2330-0x0000000000980000-0x00000000009AE000-memory.dmp

      Filesize

      184KB

    • memory/3312-204-0x00000000054E0000-0x0000000005540000-memory.dmp

      Filesize

      384KB

    • memory/3312-226-0x00000000054E0000-0x0000000005540000-memory.dmp

      Filesize

      384KB

    • memory/3312-184-0x00000000054E0000-0x0000000005540000-memory.dmp

      Filesize

      384KB

    • memory/3312-186-0x00000000054E0000-0x0000000005540000-memory.dmp

      Filesize

      384KB

    • memory/3312-188-0x00000000054E0000-0x0000000005540000-memory.dmp

      Filesize

      384KB

    • memory/3312-190-0x00000000054E0000-0x0000000005540000-memory.dmp

      Filesize

      384KB

    • memory/3312-192-0x00000000054E0000-0x0000000005540000-memory.dmp

      Filesize

      384KB

    • memory/3312-194-0x00000000054E0000-0x0000000005540000-memory.dmp

      Filesize

      384KB

    • memory/3312-196-0x00000000054E0000-0x0000000005540000-memory.dmp

      Filesize

      384KB

    • memory/3312-198-0x00000000054E0000-0x0000000005540000-memory.dmp

      Filesize

      384KB

    • memory/3312-200-0x00000000054E0000-0x0000000005540000-memory.dmp

      Filesize

      384KB

    • memory/3312-202-0x00000000054E0000-0x0000000005540000-memory.dmp

      Filesize

      384KB

    • memory/3312-180-0x00000000054E0000-0x0000000005540000-memory.dmp

      Filesize

      384KB

    • memory/3312-206-0x00000000054E0000-0x0000000005540000-memory.dmp

      Filesize

      384KB

    • memory/3312-208-0x00000000054E0000-0x0000000005540000-memory.dmp

      Filesize

      384KB

    • memory/3312-210-0x00000000054E0000-0x0000000005540000-memory.dmp

      Filesize

      384KB

    • memory/3312-212-0x00000000054E0000-0x0000000005540000-memory.dmp

      Filesize

      384KB

    • memory/3312-214-0x00000000054E0000-0x0000000005540000-memory.dmp

      Filesize

      384KB

    • memory/3312-216-0x00000000054E0000-0x0000000005540000-memory.dmp

      Filesize

      384KB

    • memory/3312-218-0x00000000054E0000-0x0000000005540000-memory.dmp

      Filesize

      384KB

    • memory/3312-220-0x00000000054E0000-0x0000000005540000-memory.dmp

      Filesize

      384KB

    • memory/3312-222-0x00000000054E0000-0x0000000005540000-memory.dmp

      Filesize

      384KB

    • memory/3312-224-0x00000000054E0000-0x0000000005540000-memory.dmp

      Filesize

      384KB

    • memory/3312-182-0x00000000054E0000-0x0000000005540000-memory.dmp

      Filesize

      384KB

    • memory/3312-228-0x00000000054E0000-0x0000000005540000-memory.dmp

      Filesize

      384KB

    • memory/3312-230-0x00000000054E0000-0x0000000005540000-memory.dmp

      Filesize

      384KB

    • memory/3312-2314-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

      Filesize

      64KB

    • memory/3312-2315-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

      Filesize

      64KB

    • memory/3312-2316-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

      Filesize

      64KB

    • memory/3312-178-0x00000000054E0000-0x0000000005540000-memory.dmp

      Filesize

      384KB

    • memory/3312-2325-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

      Filesize

      64KB

    • memory/3312-176-0x00000000054E0000-0x0000000005540000-memory.dmp

      Filesize

      384KB

    • memory/3312-172-0x00000000054E0000-0x0000000005540000-memory.dmp

      Filesize

      384KB

    • memory/3312-174-0x00000000054E0000-0x0000000005540000-memory.dmp

      Filesize

      384KB

    • memory/3312-2332-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

      Filesize

      64KB

    • memory/3312-170-0x00000000054E0000-0x0000000005540000-memory.dmp

      Filesize

      384KB

    • memory/3312-168-0x00000000054E0000-0x0000000005540000-memory.dmp

      Filesize

      384KB

    • memory/3312-167-0x00000000054E0000-0x0000000005540000-memory.dmp

      Filesize

      384KB

    • memory/3312-166-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

      Filesize

      64KB

    • memory/3312-164-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

      Filesize

      64KB

    • memory/3312-165-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

      Filesize

      64KB

    • memory/3312-163-0x0000000000970000-0x00000000009CB000-memory.dmp

      Filesize

      364KB

    • memory/3312-162-0x0000000004EF0000-0x0000000005494000-memory.dmp

      Filesize

      5.6MB

    • memory/4908-2345-0x0000000002410000-0x0000000002420000-memory.dmp

      Filesize

      64KB

    • memory/4908-2344-0x0000000000270000-0x000000000029E000-memory.dmp

      Filesize

      184KB

    • memory/4908-2347-0x0000000002410000-0x0000000002420000-memory.dmp

      Filesize

      64KB