Analysis
-
max time kernel
143s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
05/05/2023, 19:59 UTC
General
-
Target
dbd9066bc8a1c5a15986e9eea7cb2a866a5eab54078247ec0d6eb28e440e1643.exe
-
Size
690KB
-
MD5
00cfa935e1f3d8f6908394aa7e4f0d1b
-
SHA1
9923a91b0f7e63a49919004f4ad41ec53b194898
-
SHA256
dbd9066bc8a1c5a15986e9eea7cb2a866a5eab54078247ec0d6eb28e440e1643
-
SHA512
cb4a9c0cc480d08277147f23190919d83b5ff46365fc6274903292bbb26fd9eba822929b9564c5a4320a509c84e7b6b011c667d703490699e70d3c3a9aaef65a
-
SSDEEP
12288:7y90kyLaEtZ98UMF4TjkfRkiuB84bGgniN1mgXE6yNdBLf:7y3U98HFgGRWB84aN7+Lf
Malware Config
Signatures
-
Detects Redline Stealer samples 1 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbd9066bc8a1c5a15986e9eea7cb2a866a5eab54078247ec0d6eb28e440e1643.exe"C:\Users\Admin\AppData\Local\Temp\dbd9066bc8a1c5a15986e9eea7cb2a866a5eab54078247ec0d6eb28e440e1643.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un387279.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un387279.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\48225604.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\48225604.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk462972.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk462972.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
Network
-
DNS26.165.165.52.in-addr.arpaRemote address:8.8.8.8:53Request26.165.165.52.in-addr.arpaIN PTRResponse -
DNS8.3.197.209.in-addr.arpaRemote address:8.8.8.8:53Request8.3.197.209.in-addr.arpaIN PTRResponse8.3.197.209.in-addr.arpaIN PTRvip0x008map2sslhwcdnnet
-
DNS18.31.95.13.in-addr.arpaRemote address:8.8.8.8:53Request18.31.95.13.in-addr.arpaIN PTRResponse
-
DNS1.77.109.52.in-addr.arpaRemote address:8.8.8.8:53Request1.77.109.52.in-addr.arpaIN PTRResponse
-
20.189.173.7:443
-
185.161.248.143:38452 -
185.161.248.143:38452
-
173.223.113.164:443 -
173.223.113.131:80
-
131.253.33.203:80
-
185.161.248.143:38452
-
185.161.248.143:38452
-
185.161.248.143:38452
-
8.8.8.8:5326.165.165.52.in-addr.arpadns
DNS Request
26.165.165.52.in-addr.arpa
-
8.8.8.8:538.3.197.209.in-addr.arpadns
DNS Request
8.3.197.209.in-addr.arpa
-
8.8.8.8:5318.31.95.13.in-addr.arpadns
DNS Request
18.31.95.13.in-addr.arpa
-
8.8.8.8:531.77.109.52.in-addr.arpadns
DNS Request
1.77.109.52.in-addr.arpa
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
536KB
MD5ea2eedcb44a2458016f322aea377d348
SHA1c832581e0a3467813ce85cf2d9dfb985351368d0
SHA256768115576168dec02ae6c7565384b82161b4908130d7463e2047eb561f0bd78c
SHA512168850465ba0efcb547afd2759dcf755f60a8d0d36d72680e9b69517677ad1bfe88e0c96fa5f3d9406719b87eda9e9a569afb31b43e2de4153ac5c4ec0e19baa
-
Filesize
536KB
MD5ea2eedcb44a2458016f322aea377d348
SHA1c832581e0a3467813ce85cf2d9dfb985351368d0
SHA256768115576168dec02ae6c7565384b82161b4908130d7463e2047eb561f0bd78c
SHA512168850465ba0efcb547afd2759dcf755f60a8d0d36d72680e9b69517677ad1bfe88e0c96fa5f3d9406719b87eda9e9a569afb31b43e2de4153ac5c4ec0e19baa
-
Filesize
258KB
MD5c98580790ed4b813cef3355fc63b57ba
SHA18bfeea54109d30d5171abec7c1604f5fa36a958b
SHA2569b222804e2d805b64db13d9cf8baaa658a44fe830336fae5fd0ce455c9e57fd0
SHA512962946757db26857e2e8c70a1c822c1dcda5a6f4953176d32561ad27cfef699346c92826a692b203f4ae67dcad5f43f64e575d7437b257560612a7dec069490c
-
Filesize
258KB
MD5c98580790ed4b813cef3355fc63b57ba
SHA18bfeea54109d30d5171abec7c1604f5fa36a958b
SHA2569b222804e2d805b64db13d9cf8baaa658a44fe830336fae5fd0ce455c9e57fd0
SHA512962946757db26857e2e8c70a1c822c1dcda5a6f4953176d32561ad27cfef699346c92826a692b203f4ae67dcad5f43f64e575d7437b257560612a7dec069490c
-
Filesize
341KB
MD5c89e5faadd68d16103ef7decffd06e07
SHA192ea11a3380a0b955d8cb798aeaabaf7e44c6bcf
SHA256bfabf63cdcd7f88f339721af88cbd2c426fa15940a016d3a0b252862867214d9
SHA512cfe6b76cec8339d0d5fb4d7177e503bcfd51e7cd3bc6e469af81ad5f1685561745a5213f0d94bb190fe0a6ffa3dce37b06552ec94a66261100aab074b60fd97b
-
Filesize
341KB
MD5c89e5faadd68d16103ef7decffd06e07
SHA192ea11a3380a0b955d8cb798aeaabaf7e44c6bcf
SHA256bfabf63cdcd7f88f339721af88cbd2c426fa15940a016d3a0b252862867214d9
SHA512cfe6b76cec8339d0d5fb4d7177e503bcfd51e7cd3bc6e469af81ad5f1685561745a5213f0d94bb190fe0a6ffa3dce37b06552ec94a66261100aab074b60fd97b
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
240KB
-
Filesize
1.0MB
-
Filesize
212KB
-
Filesize
6.1MB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
64KB
-
Filesize
212KB
-
Filesize
280KB
-
Filesize
72KB
-
Filesize
212KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
64KB
-
Filesize
340KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
180KB
-
Filesize
64KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
340KB
-
Filesize
5.6MB