Analysis
-
max time kernel
150s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
06-05-2023 22:10
Static task
static1
Behavioral task
behavioral1
Sample
602146da46afad36acd9f5d7ff071282009bc87c13b710e36308ae910777769a.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
602146da46afad36acd9f5d7ff071282009bc87c13b710e36308ae910777769a.exe
Resource
win10v2004-20230220-en
General
-
Target
602146da46afad36acd9f5d7ff071282009bc87c13b710e36308ae910777769a.exe
-
Size
1.2MB
-
MD5
99c88e4ed8b1df13a7ad50a0db8e7169
-
SHA1
98325c9698978df1c8cbf9e787d373ad25550c6e
-
SHA256
602146da46afad36acd9f5d7ff071282009bc87c13b710e36308ae910777769a
-
SHA512
9c512d95256128595beaf30f383f7b7caf05d6dfbcaabfcfb69c13165db2c077d8a193767e739d4e507eb940bfbc13187afa5e59fd2becc2c0c1cda12b9e9cfd
-
SSDEEP
24576:xy97vBcO04E3JDInMYKGPA//xvsQYn7DJM0LYv6EB7di0KMF4tm72dpm7:k99n0n3JDInMHZnJsT/8v6k00KpY2d
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
life
185.161.248.73:4164
-
auth_value
8685d11953530b68ad5ec703809d9f91
Signatures
-
Detects Redline Stealer samples 1 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
Processes:
resource yara_rule behavioral2/memory/3908-2333-0x000000000B200000-0x000000000B818000-memory.dmp redline_stealer -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
s56665980.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation s56665980.exe -
Executes dropped EXE 6 IoCs
Processes:
z38986627.exez07831119.exez07473793.exes56665980.exe1.exet96620854.exepid process 4484 z38986627.exe 2296 z07831119.exe 1504 z07473793.exe 2904 s56665980.exe 3908 1.exe 3148 t96620854.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
z38986627.exez07831119.exez07473793.exe602146da46afad36acd9f5d7ff071282009bc87c13b710e36308ae910777769a.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z38986627.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z38986627.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z07831119.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z07831119.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z07473793.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z07473793.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 602146da46afad36acd9f5d7ff071282009bc87c13b710e36308ae910777769a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 602146da46afad36acd9f5d7ff071282009bc87c13b710e36308ae910777769a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3880 2904 WerFault.exe s56665980.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
s56665980.exedescription pid process Token: SeDebugPrivilege 2904 s56665980.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
602146da46afad36acd9f5d7ff071282009bc87c13b710e36308ae910777769a.exez38986627.exez07831119.exez07473793.exes56665980.exedescription pid process target process PID 2724 wrote to memory of 4484 2724 602146da46afad36acd9f5d7ff071282009bc87c13b710e36308ae910777769a.exe z38986627.exe PID 2724 wrote to memory of 4484 2724 602146da46afad36acd9f5d7ff071282009bc87c13b710e36308ae910777769a.exe z38986627.exe PID 2724 wrote to memory of 4484 2724 602146da46afad36acd9f5d7ff071282009bc87c13b710e36308ae910777769a.exe z38986627.exe PID 4484 wrote to memory of 2296 4484 z38986627.exe z07831119.exe PID 4484 wrote to memory of 2296 4484 z38986627.exe z07831119.exe PID 4484 wrote to memory of 2296 4484 z38986627.exe z07831119.exe PID 2296 wrote to memory of 1504 2296 z07831119.exe z07473793.exe PID 2296 wrote to memory of 1504 2296 z07831119.exe z07473793.exe PID 2296 wrote to memory of 1504 2296 z07831119.exe z07473793.exe PID 1504 wrote to memory of 2904 1504 z07473793.exe s56665980.exe PID 1504 wrote to memory of 2904 1504 z07473793.exe s56665980.exe PID 1504 wrote to memory of 2904 1504 z07473793.exe s56665980.exe PID 2904 wrote to memory of 3908 2904 s56665980.exe 1.exe PID 2904 wrote to memory of 3908 2904 s56665980.exe 1.exe PID 2904 wrote to memory of 3908 2904 s56665980.exe 1.exe PID 1504 wrote to memory of 3148 1504 z07473793.exe t96620854.exe PID 1504 wrote to memory of 3148 1504 z07473793.exe t96620854.exe PID 1504 wrote to memory of 3148 1504 z07473793.exe t96620854.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\602146da46afad36acd9f5d7ff071282009bc87c13b710e36308ae910777769a.exe"C:\Users\Admin\AppData\Local\Temp\602146da46afad36acd9f5d7ff071282009bc87c13b710e36308ae910777769a.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z38986627.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z38986627.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z07831119.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z07831119.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z07473793.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z07473793.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s56665980.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s56665980.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 13806⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t96620854.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t96620854.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2904 -ip 29041⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z38986627.exeFilesize
1.0MB
MD54a7fda9f82580da3aff9e3b5af8426b2
SHA19ac65838bfd29108989c973dff1cbde82b2a4c75
SHA256bd08a4daa487f47d7e4bcff2c72e3961e48a8e68ef18fa0fca86409825a928b1
SHA512eae4da450b23fadeaa28344f4a78fca37d69c7bf7c93d0b39fd63e6733d9a33ed74d04a3410a7684dd3c909a999a5c8aee0e02f70619a159174d470501f1af69
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z38986627.exeFilesize
1.0MB
MD54a7fda9f82580da3aff9e3b5af8426b2
SHA19ac65838bfd29108989c973dff1cbde82b2a4c75
SHA256bd08a4daa487f47d7e4bcff2c72e3961e48a8e68ef18fa0fca86409825a928b1
SHA512eae4da450b23fadeaa28344f4a78fca37d69c7bf7c93d0b39fd63e6733d9a33ed74d04a3410a7684dd3c909a999a5c8aee0e02f70619a159174d470501f1af69
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z07831119.exeFilesize
759KB
MD53d728c324a7d1eaf8fea21b99dcb60bf
SHA1a4498292f657075a81a13e02e34849fa02d1bf73
SHA256296249c84cad9df5cae9c864f055b65b6ad30e24220ba27d361b1b80c2d9924f
SHA512e2c674192fcfc8ae92c7c2cb7894fc11d3eca70c76b39be70be3e9d19b1256c5746e0e583d58f99f70b73010a399b1b6f5f99d9eb19c0a73a48d1fbe661ca21d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z07831119.exeFilesize
759KB
MD53d728c324a7d1eaf8fea21b99dcb60bf
SHA1a4498292f657075a81a13e02e34849fa02d1bf73
SHA256296249c84cad9df5cae9c864f055b65b6ad30e24220ba27d361b1b80c2d9924f
SHA512e2c674192fcfc8ae92c7c2cb7894fc11d3eca70c76b39be70be3e9d19b1256c5746e0e583d58f99f70b73010a399b1b6f5f99d9eb19c0a73a48d1fbe661ca21d
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z07473793.exeFilesize
577KB
MD5bf8fc2f3043441caff36c89a7a327f47
SHA1ba66a9453409263d8c41a948b742f7be89916c88
SHA2567543680ec6cfe349b00679846c64590598cf5933baea8d50a69c15aa252be8dc
SHA512ebb4d29417e80d305416ddaba0791e21854b83f003a68fe664eb2b906b804ab3e4b1ff94133cc58b749bedd73da15eb116312369400b0cb9e7a01823509bb5fb
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z07473793.exeFilesize
577KB
MD5bf8fc2f3043441caff36c89a7a327f47
SHA1ba66a9453409263d8c41a948b742f7be89916c88
SHA2567543680ec6cfe349b00679846c64590598cf5933baea8d50a69c15aa252be8dc
SHA512ebb4d29417e80d305416ddaba0791e21854b83f003a68fe664eb2b906b804ab3e4b1ff94133cc58b749bedd73da15eb116312369400b0cb9e7a01823509bb5fb
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s56665980.exeFilesize
574KB
MD524000f5e4687d7e5db9cd73b70807930
SHA132ef526807bbd6488fb8bb358001b6ee23c89779
SHA256591aff00e997ee3895768a4698c8555105239814c995152fd7b9ab475ac485e4
SHA5126dee95fe477f345a0824eb3eb8a5f5fa1f5d4b19f8c6177bb5f2d192ec54bade00e267213c980f45e173235978627e47ffda9d763afc8b9aeffce830861ca6c8
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s56665980.exeFilesize
574KB
MD524000f5e4687d7e5db9cd73b70807930
SHA132ef526807bbd6488fb8bb358001b6ee23c89779
SHA256591aff00e997ee3895768a4698c8555105239814c995152fd7b9ab475ac485e4
SHA5126dee95fe477f345a0824eb3eb8a5f5fa1f5d4b19f8c6177bb5f2d192ec54bade00e267213c980f45e173235978627e47ffda9d763afc8b9aeffce830861ca6c8
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t96620854.exeFilesize
169KB
MD549318186f563dbbb9a55a9465da71c95
SHA1fd7281867003ec9b6f8c967e26ae7c06794c5df9
SHA2567048f120d63f33670bab9bc9c5c82d5c8b0b7638d5d20fb2c945cbea29f2883e
SHA512533db66e18f33553f6f9d99ebda817758b598c40fe9ca213ce2601a9ce0e9165f57642b2af4ec68fc6efda5c6019c5f917d10dcdd167992eb6aff522097b4537
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t96620854.exeFilesize
169KB
MD549318186f563dbbb9a55a9465da71c95
SHA1fd7281867003ec9b6f8c967e26ae7c06794c5df9
SHA2567048f120d63f33670bab9bc9c5c82d5c8b0b7638d5d20fb2c945cbea29f2883e
SHA512533db66e18f33553f6f9d99ebda817758b598c40fe9ca213ce2601a9ce0e9165f57642b2af4ec68fc6efda5c6019c5f917d10dcdd167992eb6aff522097b4537
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
memory/2904-194-0x0000000004F20000-0x0000000004F80000-memory.dmpFilesize
384KB
-
memory/2904-206-0x0000000004F20000-0x0000000004F80000-memory.dmpFilesize
384KB
-
memory/2904-165-0x0000000004F80000-0x0000000004F90000-memory.dmpFilesize
64KB
-
memory/2904-164-0x0000000004F80000-0x0000000004F90000-memory.dmpFilesize
64KB
-
memory/2904-166-0x0000000004F80000-0x0000000004F90000-memory.dmpFilesize
64KB
-
memory/2904-167-0x0000000004F20000-0x0000000004F80000-memory.dmpFilesize
384KB
-
memory/2904-168-0x0000000004F20000-0x0000000004F80000-memory.dmpFilesize
384KB
-
memory/2904-170-0x0000000004F20000-0x0000000004F80000-memory.dmpFilesize
384KB
-
memory/2904-172-0x0000000004F20000-0x0000000004F80000-memory.dmpFilesize
384KB
-
memory/2904-174-0x0000000004F20000-0x0000000004F80000-memory.dmpFilesize
384KB
-
memory/2904-176-0x0000000004F20000-0x0000000004F80000-memory.dmpFilesize
384KB
-
memory/2904-178-0x0000000004F20000-0x0000000004F80000-memory.dmpFilesize
384KB
-
memory/2904-180-0x0000000004F20000-0x0000000004F80000-memory.dmpFilesize
384KB
-
memory/2904-182-0x0000000004F20000-0x0000000004F80000-memory.dmpFilesize
384KB
-
memory/2904-184-0x0000000004F20000-0x0000000004F80000-memory.dmpFilesize
384KB
-
memory/2904-186-0x0000000004F20000-0x0000000004F80000-memory.dmpFilesize
384KB
-
memory/2904-188-0x0000000004F20000-0x0000000004F80000-memory.dmpFilesize
384KB
-
memory/2904-190-0x0000000004F20000-0x0000000004F80000-memory.dmpFilesize
384KB
-
memory/2904-192-0x0000000004F20000-0x0000000004F80000-memory.dmpFilesize
384KB
-
memory/2904-162-0x0000000004F90000-0x0000000005534000-memory.dmpFilesize
5.6MB
-
memory/2904-196-0x0000000004F20000-0x0000000004F80000-memory.dmpFilesize
384KB
-
memory/2904-198-0x0000000004F20000-0x0000000004F80000-memory.dmpFilesize
384KB
-
memory/2904-200-0x0000000004F20000-0x0000000004F80000-memory.dmpFilesize
384KB
-
memory/2904-202-0x0000000004F20000-0x0000000004F80000-memory.dmpFilesize
384KB
-
memory/2904-204-0x0000000004F20000-0x0000000004F80000-memory.dmpFilesize
384KB
-
memory/2904-163-0x0000000000910000-0x000000000096B000-memory.dmpFilesize
364KB
-
memory/2904-208-0x0000000004F20000-0x0000000004F80000-memory.dmpFilesize
384KB
-
memory/2904-210-0x0000000004F20000-0x0000000004F80000-memory.dmpFilesize
384KB
-
memory/2904-212-0x0000000004F20000-0x0000000004F80000-memory.dmpFilesize
384KB
-
memory/2904-214-0x0000000004F20000-0x0000000004F80000-memory.dmpFilesize
384KB
-
memory/2904-216-0x0000000004F20000-0x0000000004F80000-memory.dmpFilesize
384KB
-
memory/2904-218-0x0000000004F20000-0x0000000004F80000-memory.dmpFilesize
384KB
-
memory/2904-220-0x0000000004F20000-0x0000000004F80000-memory.dmpFilesize
384KB
-
memory/2904-222-0x0000000004F20000-0x0000000004F80000-memory.dmpFilesize
384KB
-
memory/2904-224-0x0000000004F20000-0x0000000004F80000-memory.dmpFilesize
384KB
-
memory/2904-226-0x0000000004F20000-0x0000000004F80000-memory.dmpFilesize
384KB
-
memory/2904-228-0x0000000004F20000-0x0000000004F80000-memory.dmpFilesize
384KB
-
memory/2904-230-0x0000000004F20000-0x0000000004F80000-memory.dmpFilesize
384KB
-
memory/2904-2316-0x0000000004F80000-0x0000000004F90000-memory.dmpFilesize
64KB
-
memory/2904-2317-0x0000000004F80000-0x0000000004F90000-memory.dmpFilesize
64KB
-
memory/2904-2318-0x0000000004F80000-0x0000000004F90000-memory.dmpFilesize
64KB
-
memory/2904-2320-0x0000000004F80000-0x0000000004F90000-memory.dmpFilesize
64KB
-
memory/3148-2343-0x0000000000C00000-0x0000000000C2E000-memory.dmpFilesize
184KB
-
memory/3148-2344-0x00000000055C0000-0x00000000055D0000-memory.dmpFilesize
64KB
-
memory/3148-2346-0x00000000055C0000-0x00000000055D0000-memory.dmpFilesize
64KB
-
memory/3908-2332-0x0000000000E80000-0x0000000000EAE000-memory.dmpFilesize
184KB
-
memory/3908-2333-0x000000000B200000-0x000000000B818000-memory.dmpFilesize
6.1MB
-
memory/3908-2334-0x000000000ACF0000-0x000000000ADFA000-memory.dmpFilesize
1.0MB
-
memory/3908-2335-0x000000000AC00000-0x000000000AC12000-memory.dmpFilesize
72KB
-
memory/3908-2336-0x000000000AC60000-0x000000000AC9C000-memory.dmpFilesize
240KB
-
memory/3908-2337-0x0000000005750000-0x0000000005760000-memory.dmpFilesize
64KB
-
memory/3908-2345-0x0000000005750000-0x0000000005760000-memory.dmpFilesize
64KB