redline | 3bb184eafaf18df62f5a3c5248ff17debba1d21703e45ca68441746b302aeca6

Analysis

max time kernel
136s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06-05-2023 21:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3bb184eafaf18df62f5a3c5248ff17debba1d21703e45ca68441746b302aeca6.exe
Size

1.2MB
MD5

f88e03d7f439ee7cf4e3bad75d66ac03
SHA1

fc6363dcee15a103c451af247691e4318eb34843
SHA256

3bb184eafaf18df62f5a3c5248ff17debba1d21703e45ca68441746b302aeca6
SHA512

1463a93c9b522f8a0bdc69a45564618bd405b83cc90cce545d8fb3bfc7800acfd2df56e31a535af206a4e2fcc3fe8fbb0e59648ba05a3ebf80ef59cc67caf1a5
SSDEEP

24576:ByignTXyHHXmzoc/S42KImH/CEfDnRJ+9siJwzjKdITb3yq:0igoAH/S4dNKQjv1iJUKd2bi

Score

10^/10

redline gena life infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

gena

185.161.248.73:4164

Attributes

auth_value
d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

life

185.161.248.73:4164

Attributes

auth_value
8685d11953530b68ad5ec703809d9f91

Signatures

Detects Redline Stealer samples 1 IoCs

This rule detects the presence of Redline Stealer samples based on their unique strings.

stealer

Processes:

resource	yara_rule
behavioral2/memory/2696-2334-0x00000000058B0000-0x0000000005EC8000-memory.dmp	redline_stealer

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

s64102883.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	s64102883.exe

Executes dropped EXE 6 IoCs

Processes:

z33372511.exez60849953.exez89754360.exes64102883.exe1.exet33133724.exe

pid process

4228 z33372511.exe
4396 z60849953.exe
4904 z89754360.exe
3088 s64102883.exe
2696 1.exe
1324 t33133724.exe

pid	process
4228	z33372511.exe
4396	z60849953.exe
4904	z89754360.exe
3088	s64102883.exe
2696	1.exe
1324	t33133724.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

z89754360.exe3bb184eafaf18df62f5a3c5248ff17debba1d21703e45ca68441746b302aeca6.exez33372511.exez60849953.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z89754360.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z89754360.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	3bb184eafaf18df62f5a3c5248ff17debba1d21703e45ca68441746b302aeca6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	3bb184eafaf18df62f5a3c5248ff17debba1d21703e45ca68441746b302aeca6.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z33372511.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z33372511.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z60849953.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z60849953.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1124 3088 WerFault.exe s64102883.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

s64102883.exe

description pid process

Token: SeDebugPrivilege 3088 s64102883.exe

pid	pid_target	process	target process
1124	3088	WerFault.exe	s64102883.exe

description	pid	process
Token: SeDebugPrivilege	3088	s64102883.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

3bb184eafaf18df62f5a3c5248ff17debba1d21703e45ca68441746b302aeca6.exez33372511.exez60849953.exez89754360.exes64102883.exe

description	pid	process	target process
PID 3740 wrote to memory of 4228	3740	3bb184eafaf18df62f5a3c5248ff17debba1d21703e45ca68441746b302aeca6.exe	z33372511.exe
PID 3740 wrote to memory of 4228	3740	3bb184eafaf18df62f5a3c5248ff17debba1d21703e45ca68441746b302aeca6.exe	z33372511.exe
PID 3740 wrote to memory of 4228	3740	3bb184eafaf18df62f5a3c5248ff17debba1d21703e45ca68441746b302aeca6.exe	z33372511.exe
PID 4228 wrote to memory of 4396	4228	z33372511.exe	z60849953.exe
PID 4228 wrote to memory of 4396	4228	z33372511.exe	z60849953.exe
PID 4228 wrote to memory of 4396	4228	z33372511.exe	z60849953.exe
PID 4396 wrote to memory of 4904	4396	z60849953.exe	z89754360.exe
PID 4396 wrote to memory of 4904	4396	z60849953.exe	z89754360.exe
PID 4396 wrote to memory of 4904	4396	z60849953.exe	z89754360.exe
PID 4904 wrote to memory of 3088	4904	z89754360.exe	s64102883.exe
PID 4904 wrote to memory of 3088	4904	z89754360.exe	s64102883.exe
PID 4904 wrote to memory of 3088	4904	z89754360.exe	s64102883.exe
PID 3088 wrote to memory of 2696	3088	s64102883.exe	1.exe
PID 3088 wrote to memory of 2696	3088	s64102883.exe	1.exe
PID 3088 wrote to memory of 2696	3088	s64102883.exe	1.exe
PID 4904 wrote to memory of 1324	4904	z89754360.exe	t33133724.exe
PID 4904 wrote to memory of 1324	4904	z89754360.exe	t33133724.exe
PID 4904 wrote to memory of 1324	4904	z89754360.exe	t33133724.exe

C:\Users\Admin\AppData\Local\Temp\3bb184eafaf18df62f5a3c5248ff17debba1d21703e45ca68441746b302aeca6.exe
"C:\Users\Admin\AppData\Local\Temp\3bb184eafaf18df62f5a3c5248ff17debba1d21703e45ca68441746b302aeca6.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z33372511.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z33372511.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4228
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z60849953.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z60849953.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z89754360.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z89754360.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4904
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s64102883.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s64102883.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3088
      - C:\Windows\Temp\1.exe
        
        "C:\Windows\Temp\1.exe"
        6⤵
        Executes dropped EXE
        
        PID:2696
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 1388
        6⤵
        Program crash
        
        PID:1124
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t33133724.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t33133724.exe
        5⤵
        Executes dropped EXE
        
        PID:1324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3088 -ip 3088
1⤵
PID:1492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z33372511.exe

Filesize
1.0MB

MD5
7895df1d991d14ee4023533a2cc0dfaa

SHA1
4364523c29e8d219e0446e4ae90e83da9a6e13d1

SHA256
7dbc3c54f4291eaecd2076855b2c11cf656c07012056953b614bd2d88067079b

SHA512
4eb530a4f04565e8eb312c3fd496e637f85a752b6c8de9f5aaa8bef3eeb44bde075aaf637c2a83daced71fc3ddcbe8f70459d666dd30a79c0d9d3454c0e53c03

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z33372511.exe

Filesize
1.0MB

MD5
7895df1d991d14ee4023533a2cc0dfaa

SHA1
4364523c29e8d219e0446e4ae90e83da9a6e13d1

SHA256
7dbc3c54f4291eaecd2076855b2c11cf656c07012056953b614bd2d88067079b

SHA512
4eb530a4f04565e8eb312c3fd496e637f85a752b6c8de9f5aaa8bef3eeb44bde075aaf637c2a83daced71fc3ddcbe8f70459d666dd30a79c0d9d3454c0e53c03

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z60849953.exe

Filesize
760KB

MD5
95fe7e298713afdb3aa9ecf21a9ebe7a

SHA1
aaa8a725321ce113fc963abd4aea89c826a7129f

SHA256
0ed06895e72ae5c05756e93293290f1575c6a68d2fe7852d210bbcc1c04644e2

SHA512
f97e649efbfbd4af8ba06ba7d0c6096fccea9ffcec6cea911abc765233d2598d44367e21eff6c4e1aed836eb40acdd72327cc5160ed12b82017f24c3447fce72

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z60849953.exe

Filesize
760KB

MD5
95fe7e298713afdb3aa9ecf21a9ebe7a

SHA1
aaa8a725321ce113fc963abd4aea89c826a7129f

SHA256
0ed06895e72ae5c05756e93293290f1575c6a68d2fe7852d210bbcc1c04644e2

SHA512
f97e649efbfbd4af8ba06ba7d0c6096fccea9ffcec6cea911abc765233d2598d44367e21eff6c4e1aed836eb40acdd72327cc5160ed12b82017f24c3447fce72

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z89754360.exe

Filesize
577KB

MD5
2dbe2f256f435beb799061f5e5ee72c3

SHA1
53e66bf4d979d9669588d4e14116e5004644454d

SHA256
0546767f535588fd601d0d1a989b2d71c609a833ddebfbce3cb2ed9254dd6dff

SHA512
56f9c069839ded6d5d2afdc8c4bc459f0d33c09ff56bad8300c02338ecc251151bd99a38336f461d5375972d6b485e281d8f15f5f5dafd7aff1ca232d644756a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z89754360.exe

Filesize
577KB

MD5
2dbe2f256f435beb799061f5e5ee72c3

SHA1
53e66bf4d979d9669588d4e14116e5004644454d

SHA256
0546767f535588fd601d0d1a989b2d71c609a833ddebfbce3cb2ed9254dd6dff

SHA512
56f9c069839ded6d5d2afdc8c4bc459f0d33c09ff56bad8300c02338ecc251151bd99a38336f461d5375972d6b485e281d8f15f5f5dafd7aff1ca232d644756a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s64102883.exe

Filesize
574KB

MD5
3d66870e8c7b63d94eb46f1849bcb3c2

SHA1
4042698ad3111e394489bb16cf2abf218fb954ba

SHA256
eddbade494a696953f4e3b818915719e417d777e386a8d63b61ae05bba81d2d8

SHA512
3297b29f25b1fd57391befc6f3505521bf6493f4a07fdda10ff85a02a58c22bfe05b813170df9aab0582fd6391b7cf1703bb22ca56a4239a73934e38c06ce5dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s64102883.exe

Filesize
574KB

MD5
3d66870e8c7b63d94eb46f1849bcb3c2

SHA1
4042698ad3111e394489bb16cf2abf218fb954ba

SHA256
eddbade494a696953f4e3b818915719e417d777e386a8d63b61ae05bba81d2d8

SHA512
3297b29f25b1fd57391befc6f3505521bf6493f4a07fdda10ff85a02a58c22bfe05b813170df9aab0582fd6391b7cf1703bb22ca56a4239a73934e38c06ce5dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t33133724.exe

Filesize
169KB

MD5
00c15f652158fe2f52151aaa36a66f1d

SHA1
6bc83659c162d28402d666d51a7f46a279e08161

SHA256
07a425dafb0ba17a9ec6e5a2893503b24d06e907e0fdd851a9924dedc8f792b2

SHA512
f1948c07276740f667ed146b9a4a8ad1913c4ef334fe2120fca860b08c25ff82a72412e67cf402fc73144587dd599446a00e6acec4374f56551a29c0239b94d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t33133724.exe

Filesize
169KB

MD5
00c15f652158fe2f52151aaa36a66f1d

SHA1
6bc83659c162d28402d666d51a7f46a279e08161

SHA256
07a425dafb0ba17a9ec6e5a2893503b24d06e907e0fdd851a9924dedc8f792b2

SHA512
f1948c07276740f667ed146b9a4a8ad1913c4ef334fe2120fca860b08c25ff82a72412e67cf402fc73144587dd599446a00e6acec4374f56551a29c0239b94d9

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
memory/1324-2344-0x00000000052F0000-0x0000000005300000-memory.dmp

Filesize
64KB

Download
memory/1324-2343-0x0000000000A30000-0x0000000000A5E000-memory.dmp

Filesize
184KB

Download
memory/1324-2346-0x00000000052F0000-0x0000000005300000-memory.dmp

Filesize
64KB

Download
memory/2696-2338-0x0000000005280000-0x0000000005290000-memory.dmp

Filesize
64KB

Download
memory/2696-2337-0x00000000052D0000-0x000000000530C000-memory.dmp

Filesize
240KB

Download
memory/2696-2336-0x0000000005240000-0x0000000005252000-memory.dmp

Filesize
72KB

Download
memory/2696-2335-0x00000000053A0000-0x00000000054AA000-memory.dmp

Filesize
1.0MB

Download
memory/2696-2334-0x00000000058B0000-0x0000000005EC8000-memory.dmp

Filesize
6.1MB

Download
memory/2696-2332-0x0000000000900000-0x000000000092E000-memory.dmp

Filesize
184KB

Download
memory/2696-2345-0x0000000005280000-0x0000000005290000-memory.dmp

Filesize
64KB

Download
memory/3088-172-0x0000000005650000-0x00000000056B0000-memory.dmp

Filesize
384KB

Download
memory/3088-230-0x0000000005650000-0x00000000056B0000-memory.dmp

Filesize
384KB

Download
memory/3088-192-0x0000000005650000-0x00000000056B0000-memory.dmp

Filesize
384KB

Download
memory/3088-190-0x0000000005650000-0x00000000056B0000-memory.dmp

Filesize
384KB

Download
memory/3088-194-0x0000000005650000-0x00000000056B0000-memory.dmp

Filesize
384KB

Download
memory/3088-196-0x0000000005650000-0x00000000056B0000-memory.dmp

Filesize
384KB

Download
memory/3088-198-0x0000000005650000-0x00000000056B0000-memory.dmp

Filesize
384KB

Download
memory/3088-200-0x0000000005650000-0x00000000056B0000-memory.dmp

Filesize
384KB

Download
memory/3088-202-0x0000000005650000-0x00000000056B0000-memory.dmp

Filesize
384KB

Download
memory/3088-204-0x0000000005650000-0x00000000056B0000-memory.dmp

Filesize
384KB

Download
memory/3088-206-0x0000000005650000-0x00000000056B0000-memory.dmp

Filesize
384KB

Download
memory/3088-208-0x0000000005650000-0x00000000056B0000-memory.dmp

Filesize
384KB

Download
memory/3088-210-0x0000000005650000-0x00000000056B0000-memory.dmp

Filesize
384KB

Download
memory/3088-212-0x0000000005650000-0x00000000056B0000-memory.dmp

Filesize
384KB

Download
memory/3088-214-0x0000000005650000-0x00000000056B0000-memory.dmp

Filesize
384KB

Download
memory/3088-216-0x0000000005650000-0x00000000056B0000-memory.dmp

Filesize
384KB

Download
memory/3088-218-0x0000000005650000-0x00000000056B0000-memory.dmp

Filesize
384KB

Download
memory/3088-220-0x0000000005650000-0x00000000056B0000-memory.dmp

Filesize
384KB

Download
memory/3088-222-0x0000000005650000-0x00000000056B0000-memory.dmp

Filesize
384KB

Download
memory/3088-224-0x0000000005650000-0x00000000056B0000-memory.dmp

Filesize
384KB

Download
memory/3088-226-0x0000000005650000-0x00000000056B0000-memory.dmp

Filesize
384KB

Download
memory/3088-188-0x0000000005650000-0x00000000056B0000-memory.dmp

Filesize
384KB

Download
memory/3088-228-0x0000000005650000-0x00000000056B0000-memory.dmp

Filesize
384KB

Download
memory/3088-448-0x00000000025B0000-0x00000000025C0000-memory.dmp

Filesize
64KB

Download
memory/3088-449-0x00000000025B0000-0x00000000025C0000-memory.dmp

Filesize
64KB

Download
memory/3088-186-0x0000000005650000-0x00000000056B0000-memory.dmp

Filesize
384KB

Download
memory/3088-184-0x0000000005650000-0x00000000056B0000-memory.dmp

Filesize
384KB

Download
memory/3088-182-0x0000000005650000-0x00000000056B0000-memory.dmp

Filesize
384KB

Download
memory/3088-2333-0x00000000025B0000-0x00000000025C0000-memory.dmp

Filesize
64KB

Download
memory/3088-180-0x0000000005650000-0x00000000056B0000-memory.dmp

Filesize
384KB

Download
memory/3088-178-0x0000000005650000-0x00000000056B0000-memory.dmp

Filesize
384KB

Download
memory/3088-176-0x0000000005650000-0x00000000056B0000-memory.dmp

Filesize
384KB

Download
memory/3088-174-0x0000000005650000-0x00000000056B0000-memory.dmp

Filesize
384KB

Download
memory/3088-171-0x0000000005650000-0x00000000056B0000-memory.dmp

Filesize
384KB

Download
memory/3088-169-0x00000000025B0000-0x00000000025C0000-memory.dmp

Filesize
64KB

Download
memory/3088-168-0x0000000005060000-0x0000000005604000-memory.dmp

Filesize
5.6MB

Download
memory/3088-167-0x00000000025B0000-0x00000000025C0000-memory.dmp

Filesize
64KB

Download
memory/3088-166-0x00000000025B0000-0x00000000025C0000-memory.dmp

Filesize
64KB

Download
memory/3088-164-0x0000000000400000-0x0000000000835000-memory.dmp

Filesize
4.2MB

Download
memory/3088-163-0x00000000025B0000-0x00000000025C0000-memory.dmp

Filesize
64KB

Download
memory/3088-162-0x0000000000910000-0x000000000096B000-memory.dmp

Filesize
364KB

Download