redline | f8f3639b70343ec746e90c05081f2f3be560905473964488dae725d01db19d4d

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05-05-2023 20:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f8f3639b70343ec746e90c05081f2f3be560905473964488dae725d01db19d4d.exe
Size

1.2MB
MD5

06838e0b33a419314b406e8967acadd3
SHA1

6a9e5f5331fb94404a91b5770cf38437fca1a690
SHA256

f8f3639b70343ec746e90c05081f2f3be560905473964488dae725d01db19d4d
SHA512

a13a114e463ca4fa20fc2fa1a3926ad3caf4627d08be9ad5a004b19d2855f9b1e8792111c72c5bf9e2c29cb266d24f643bfb06d2f96ad0857b0b53b15d22b11d
SSDEEP

24576:/yA0lLvIXkRWeyJYbo89IvXuKTiTmSsclPn3RFMi5P0dT0nkgGh5:KN20RtuhWiXlvo3IG3nM

Score

10^/10

redline gena life infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

gena

185.161.248.73:4164

Attributes

auth_value
d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

life

185.161.248.73:4164

Attributes

auth_value
8685d11953530b68ad5ec703809d9f91

Signatures

Detects Redline Stealer samples 1 IoCs

This rule detects the presence of Redline Stealer samples based on their unique strings.

stealer

Processes:

resource	yara_rule
behavioral2/memory/2992-2335-0x0000000005D20000-0x0000000006338000-memory.dmp	redline_stealer

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

s13301969.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	s13301969.exe

Executes dropped EXE 6 IoCs

Processes:

z03536485.exez59265053.exez77361637.exes13301969.exe1.exet97213294.exe

pid process

2516 z03536485.exe
1240 z59265053.exe
3940 z77361637.exe
3888 s13301969.exe
2992 1.exe
4576 t97213294.exe

pid	process
2516	z03536485.exe
1240	z59265053.exe
3940	z77361637.exe
3888	s13301969.exe
2992	1.exe
4576	t97213294.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

z03536485.exez59265053.exez77361637.exef8f3639b70343ec746e90c05081f2f3be560905473964488dae725d01db19d4d.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z03536485.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z59265053.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z59265053.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z77361637.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z77361637.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	f8f3639b70343ec746e90c05081f2f3be560905473964488dae725d01db19d4d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	f8f3639b70343ec746e90c05081f2f3be560905473964488dae725d01db19d4d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z03536485.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

s13301969.exe

description pid process

Token: SeDebugPrivilege 3888 s13301969.exe

description	pid	process
Token: SeDebugPrivilege	3888	s13301969.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

f8f3639b70343ec746e90c05081f2f3be560905473964488dae725d01db19d4d.exez03536485.exez59265053.exez77361637.exes13301969.exe

description	pid	process	target process
PID 356 wrote to memory of 2516	356	f8f3639b70343ec746e90c05081f2f3be560905473964488dae725d01db19d4d.exe	z03536485.exe
PID 356 wrote to memory of 2516	356	f8f3639b70343ec746e90c05081f2f3be560905473964488dae725d01db19d4d.exe	z03536485.exe
PID 356 wrote to memory of 2516	356	f8f3639b70343ec746e90c05081f2f3be560905473964488dae725d01db19d4d.exe	z03536485.exe
PID 2516 wrote to memory of 1240	2516	z03536485.exe	z59265053.exe
PID 2516 wrote to memory of 1240	2516	z03536485.exe	z59265053.exe
PID 2516 wrote to memory of 1240	2516	z03536485.exe	z59265053.exe
PID 1240 wrote to memory of 3940	1240	z59265053.exe	z77361637.exe
PID 1240 wrote to memory of 3940	1240	z59265053.exe	z77361637.exe
PID 1240 wrote to memory of 3940	1240	z59265053.exe	z77361637.exe
PID 3940 wrote to memory of 3888	3940	z77361637.exe	s13301969.exe
PID 3940 wrote to memory of 3888	3940	z77361637.exe	s13301969.exe
PID 3940 wrote to memory of 3888	3940	z77361637.exe	s13301969.exe
PID 3888 wrote to memory of 2992	3888	s13301969.exe	1.exe
PID 3888 wrote to memory of 2992	3888	s13301969.exe	1.exe
PID 3888 wrote to memory of 2992	3888	s13301969.exe	1.exe
PID 3940 wrote to memory of 4576	3940	z77361637.exe	t97213294.exe
PID 3940 wrote to memory of 4576	3940	z77361637.exe	t97213294.exe
PID 3940 wrote to memory of 4576	3940	z77361637.exe	t97213294.exe

C:\Users\Admin\AppData\Local\Temp\f8f3639b70343ec746e90c05081f2f3be560905473964488dae725d01db19d4d.exe
"C:\Users\Admin\AppData\Local\Temp\f8f3639b70343ec746e90c05081f2f3be560905473964488dae725d01db19d4d.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:356
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z03536485.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z03536485.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z59265053.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z59265053.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1240
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z77361637.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z77361637.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3940
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s13301969.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s13301969.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3888
      - C:\Windows\Temp\1.exe
        
        "C:\Windows\Temp\1.exe"
        6⤵
        Executes dropped EXE
        
        PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t97213294.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t97213294.exe
        5⤵
        Executes dropped EXE
        
        PID:4576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z03536485.exe

Filesize
1.0MB

MD5
1fe12a91a01a6d4ce55265c3fd8e5287

SHA1
29293e6cb7bb2da4d4be8f413e10220bc1462699

SHA256
c1557aa2bdad99d91f520edd899e3a251f31f2be00e60b0e54002c7a64bd22de

SHA512
f81d7a8583d6304a1463711cfd7090d87249e63203eafb6bbdde864b75d018bfed8be579563ab93757c421d105b5d0e8af624030eb62fcce8c2970c55cc8838d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z03536485.exe

Filesize
1.0MB

MD5
1fe12a91a01a6d4ce55265c3fd8e5287

SHA1
29293e6cb7bb2da4d4be8f413e10220bc1462699

SHA256
c1557aa2bdad99d91f520edd899e3a251f31f2be00e60b0e54002c7a64bd22de

SHA512
f81d7a8583d6304a1463711cfd7090d87249e63203eafb6bbdde864b75d018bfed8be579563ab93757c421d105b5d0e8af624030eb62fcce8c2970c55cc8838d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z59265053.exe

Filesize
764KB

MD5
172d68d3f78c35aab97ee2c1b983c5fd

SHA1
6c50268be53a5b139c2faabf5321fc065e873c06

SHA256
019fa2ab42d218e1cd74181a2518c6d4f7d95558d12f1e717bd934e55ac8e185

SHA512
4fbacd57ce0c2037c3fe812adcf000653641ee1f45fa4b94781cde69dce813b2d53cfa432c44aa0b6a28f25b24aedf5e6df797b73f0e8542927b5cc397e94503

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z59265053.exe

Filesize
764KB

MD5
172d68d3f78c35aab97ee2c1b983c5fd

SHA1
6c50268be53a5b139c2faabf5321fc065e873c06

SHA256
019fa2ab42d218e1cd74181a2518c6d4f7d95558d12f1e717bd934e55ac8e185

SHA512
4fbacd57ce0c2037c3fe812adcf000653641ee1f45fa4b94781cde69dce813b2d53cfa432c44aa0b6a28f25b24aedf5e6df797b73f0e8542927b5cc397e94503

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z77361637.exe

Filesize
582KB

MD5
c90f4f42b79fe938e8bd29f60995125c

SHA1
a2408200f5bf32ef76c9be28d220c4b5eebf9e26

SHA256
2892808297ad96444592f512045d335f255da8ec75fb18e8833f28bd415c5677

SHA512
eeb1ce6bd3670ab1a16a8cef2793ec400d7f8d5f0dc967261d05b72d14d8a4cd19aaab848ebb019c4153ba9221e841218836e293e0d5cb6a17694cd114899ef2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z77361637.exe

Filesize
582KB

MD5
c90f4f42b79fe938e8bd29f60995125c

SHA1
a2408200f5bf32ef76c9be28d220c4b5eebf9e26

SHA256
2892808297ad96444592f512045d335f255da8ec75fb18e8833f28bd415c5677

SHA512
eeb1ce6bd3670ab1a16a8cef2793ec400d7f8d5f0dc967261d05b72d14d8a4cd19aaab848ebb019c4153ba9221e841218836e293e0d5cb6a17694cd114899ef2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s13301969.exe

Filesize
582KB

MD5
0c3e3bde19c634efdd0b1413854f59e0

SHA1
2b3b3bde01c46e95fa2262ecdbff01446f5094a4

SHA256
940411bb7d7c2748cbac6ae46b7cf1bc8d8a8e3c43f81a8dac940af8343c6038

SHA512
2c8fcd7590595c89544f95d662bec3b6eac2e00b4e666a74e2344233867471a2576bd23a89b60bdb2db3ff3a7785a19977636ee8561b152ec760d32bb8b36846

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s13301969.exe

Filesize
582KB

MD5
0c3e3bde19c634efdd0b1413854f59e0

SHA1
2b3b3bde01c46e95fa2262ecdbff01446f5094a4

SHA256
940411bb7d7c2748cbac6ae46b7cf1bc8d8a8e3c43f81a8dac940af8343c6038

SHA512
2c8fcd7590595c89544f95d662bec3b6eac2e00b4e666a74e2344233867471a2576bd23a89b60bdb2db3ff3a7785a19977636ee8561b152ec760d32bb8b36846

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t97213294.exe

Filesize
169KB

MD5
85ca107259e15ffcade5360e321a6dbc

SHA1
f05b4365945860e1c809299bc4c5e25945ac7216

SHA256
6ae48c21ff1cc7109880191d6dbe9014ca0a7d838cbf2bcd7884f1a09fd6b418

SHA512
ea2ca0393a5259921b457735cd94ff9c0c33b30a9e0e56f820c8286f875fb1f27d2ab6828cb616c166068d5727af60137aaf234596658c39a3bd01198115c268

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t97213294.exe

Filesize
169KB

MD5
85ca107259e15ffcade5360e321a6dbc

SHA1
f05b4365945860e1c809299bc4c5e25945ac7216

SHA256
6ae48c21ff1cc7109880191d6dbe9014ca0a7d838cbf2bcd7884f1a09fd6b418

SHA512
ea2ca0393a5259921b457735cd94ff9c0c33b30a9e0e56f820c8286f875fb1f27d2ab6828cb616c166068d5727af60137aaf234596658c39a3bd01198115c268

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
memory/2992-2337-0x00000000054B0000-0x00000000054C2000-memory.dmp

Filesize
72KB

Download
memory/2992-2335-0x0000000005D20000-0x0000000006338000-memory.dmp

Filesize
6.1MB

Download
memory/2992-2339-0x00000000054F0000-0x0000000005500000-memory.dmp

Filesize
64KB

Download
memory/2992-2341-0x00000000054F0000-0x0000000005500000-memory.dmp

Filesize
64KB

Download
memory/2992-2330-0x0000000000C30000-0x0000000000C5E000-memory.dmp

Filesize
184KB

Download
memory/3888-204-0x00000000028E0000-0x0000000002940000-memory.dmp

Filesize
384KB

Download
memory/3888-222-0x00000000028E0000-0x0000000002940000-memory.dmp

Filesize
384KB

Download
memory/3888-180-0x00000000028E0000-0x0000000002940000-memory.dmp

Filesize
384KB

Download
memory/3888-182-0x00000000028E0000-0x0000000002940000-memory.dmp

Filesize
384KB

Download
memory/3888-184-0x00000000028E0000-0x0000000002940000-memory.dmp

Filesize
384KB

Download
memory/3888-186-0x00000000028E0000-0x0000000002940000-memory.dmp

Filesize
384KB

Download
memory/3888-188-0x00000000028E0000-0x0000000002940000-memory.dmp

Filesize
384KB

Download
memory/3888-190-0x00000000028E0000-0x0000000002940000-memory.dmp

Filesize
384KB

Download
memory/3888-192-0x00000000028E0000-0x0000000002940000-memory.dmp

Filesize
384KB

Download
memory/3888-194-0x00000000028E0000-0x0000000002940000-memory.dmp

Filesize
384KB

Download
memory/3888-200-0x00000000028E0000-0x0000000002940000-memory.dmp

Filesize
384KB

Download
memory/3888-198-0x00000000028E0000-0x0000000002940000-memory.dmp

Filesize
384KB

Download
memory/3888-196-0x00000000028E0000-0x0000000002940000-memory.dmp

Filesize
384KB

Download
memory/3888-202-0x00000000028E0000-0x0000000002940000-memory.dmp

Filesize
384KB

Download
memory/3888-176-0x00000000028E0000-0x0000000002940000-memory.dmp

Filesize
384KB

Download
memory/3888-206-0x00000000028E0000-0x0000000002940000-memory.dmp

Filesize
384KB

Download
memory/3888-208-0x00000000028E0000-0x0000000002940000-memory.dmp

Filesize
384KB

Download
memory/3888-210-0x00000000028E0000-0x0000000002940000-memory.dmp

Filesize
384KB

Download
memory/3888-212-0x00000000028E0000-0x0000000002940000-memory.dmp

Filesize
384KB

Download
memory/3888-214-0x00000000028E0000-0x0000000002940000-memory.dmp

Filesize
384KB

Download
memory/3888-216-0x00000000028E0000-0x0000000002940000-memory.dmp

Filesize
384KB

Download
memory/3888-218-0x00000000028E0000-0x0000000002940000-memory.dmp

Filesize
384KB

Download
memory/3888-220-0x00000000028E0000-0x0000000002940000-memory.dmp

Filesize
384KB

Download
memory/3888-178-0x00000000028E0000-0x0000000002940000-memory.dmp

Filesize
384KB

Download
memory/3888-224-0x00000000028E0000-0x0000000002940000-memory.dmp

Filesize
384KB

Download
memory/3888-226-0x00000000028E0000-0x0000000002940000-memory.dmp

Filesize
384KB

Download
memory/3888-228-0x00000000028E0000-0x0000000002940000-memory.dmp

Filesize
384KB

Download
memory/3888-230-0x00000000028E0000-0x0000000002940000-memory.dmp

Filesize
384KB

Download
memory/3888-2315-0x00000000050E0000-0x00000000050F0000-memory.dmp

Filesize
64KB

Download
memory/3888-2316-0x00000000050E0000-0x00000000050F0000-memory.dmp

Filesize
64KB

Download
memory/3888-2317-0x00000000050E0000-0x00000000050F0000-memory.dmp

Filesize
64KB

Download
memory/3888-174-0x00000000028E0000-0x0000000002940000-memory.dmp

Filesize
384KB

Download
memory/3888-172-0x00000000028E0000-0x0000000002940000-memory.dmp

Filesize
384KB

Download
memory/3888-170-0x00000000028E0000-0x0000000002940000-memory.dmp

Filesize
384KB

Download
memory/3888-168-0x00000000028E0000-0x0000000002940000-memory.dmp

Filesize
384KB

Download
memory/3888-167-0x00000000028E0000-0x0000000002940000-memory.dmp

Filesize
384KB

Download
memory/3888-166-0x00000000050E0000-0x00000000050F0000-memory.dmp

Filesize
64KB

Download
memory/3888-162-0x0000000000A40000-0x0000000000A9B000-memory.dmp

Filesize
364KB

Download
memory/3888-165-0x00000000050E0000-0x00000000050F0000-memory.dmp

Filesize
64KB

Download
memory/3888-163-0x00000000050F0000-0x0000000005694000-memory.dmp

Filesize
5.6MB

Download
memory/3888-164-0x00000000050E0000-0x00000000050F0000-memory.dmp

Filesize
64KB

Download
memory/4576-2338-0x0000000005790000-0x00000000057CC000-memory.dmp

Filesize
240KB

Download
memory/4576-2336-0x0000000005820000-0x000000000592A000-memory.dmp

Filesize
1.0MB

Download
memory/4576-2340-0x0000000005700000-0x0000000005710000-memory.dmp

Filesize
64KB

Download
memory/4576-2342-0x0000000005700000-0x0000000005710000-memory.dmp

Filesize
64KB

Download
memory/4576-2334-0x0000000000DE0000-0x0000000000E0E000-memory.dmp

Filesize
184KB

Download