Analysis
-
max time kernel
151s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
06-05-2023 21:40
Static task
static1
Behavioral task
behavioral1
Sample
470d3845dbc02ca9d2c7a0494fa96c4f87c752eeeadd27ff670da6a8b3d07467.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
470d3845dbc02ca9d2c7a0494fa96c4f87c752eeeadd27ff670da6a8b3d07467.exe
Resource
win10v2004-20230220-en
General
-
Target
470d3845dbc02ca9d2c7a0494fa96c4f87c752eeeadd27ff670da6a8b3d07467.exe
-
Size
1.2MB
-
MD5
f8383977e884bcdcb523a00de557c42c
-
SHA1
97bc42296a91971a8459b6a189fa9698e46a8b70
-
SHA256
470d3845dbc02ca9d2c7a0494fa96c4f87c752eeeadd27ff670da6a8b3d07467
-
SHA512
ba75aa4d68e2b9bb51bd25e941fc4aecfed56cdd6b194fd1744e912daddaf2332297a47f3b83f5a45c48445749dde7bc17fe112eaca57c971ef8cefdbf08b597
-
SSDEEP
24576:8yOnDHcCk46CtoX9xoXKHpO/hic/7/Sxs5Yp6ijchACJ:rODH9XtazoaUZlD/SeWY+uA
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
life
185.161.248.73:4164
-
auth_value
8685d11953530b68ad5ec703809d9f91
Signatures
-
Detects Redline Stealer samples 1 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
Processes:
resource yara_rule behavioral2/memory/1008-2328-0x0000000005220000-0x0000000005838000-memory.dmp redline_stealer -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
s71446923.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation s71446923.exe -
Executes dropped EXE 6 IoCs
Processes:
z83137217.exez37439471.exez15620384.exes71446923.exe1.exet85411896.exepid process 1756 z83137217.exe 4132 z37439471.exe 4876 z15620384.exe 512 s71446923.exe 1008 1.exe 4488 t85411896.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
z83137217.exez37439471.exez15620384.exe470d3845dbc02ca9d2c7a0494fa96c4f87c752eeeadd27ff670da6a8b3d07467.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z83137217.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z37439471.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z37439471.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z15620384.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z15620384.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 470d3845dbc02ca9d2c7a0494fa96c4f87c752eeeadd27ff670da6a8b3d07467.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 470d3845dbc02ca9d2c7a0494fa96c4f87c752eeeadd27ff670da6a8b3d07467.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z83137217.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1544 512 WerFault.exe s71446923.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
s71446923.exedescription pid process Token: SeDebugPrivilege 512 s71446923.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
470d3845dbc02ca9d2c7a0494fa96c4f87c752eeeadd27ff670da6a8b3d07467.exez83137217.exez37439471.exez15620384.exes71446923.exedescription pid process target process PID 1036 wrote to memory of 1756 1036 470d3845dbc02ca9d2c7a0494fa96c4f87c752eeeadd27ff670da6a8b3d07467.exe z83137217.exe PID 1036 wrote to memory of 1756 1036 470d3845dbc02ca9d2c7a0494fa96c4f87c752eeeadd27ff670da6a8b3d07467.exe z83137217.exe PID 1036 wrote to memory of 1756 1036 470d3845dbc02ca9d2c7a0494fa96c4f87c752eeeadd27ff670da6a8b3d07467.exe z83137217.exe PID 1756 wrote to memory of 4132 1756 z83137217.exe z37439471.exe PID 1756 wrote to memory of 4132 1756 z83137217.exe z37439471.exe PID 1756 wrote to memory of 4132 1756 z83137217.exe z37439471.exe PID 4132 wrote to memory of 4876 4132 z37439471.exe z15620384.exe PID 4132 wrote to memory of 4876 4132 z37439471.exe z15620384.exe PID 4132 wrote to memory of 4876 4132 z37439471.exe z15620384.exe PID 4876 wrote to memory of 512 4876 z15620384.exe s71446923.exe PID 4876 wrote to memory of 512 4876 z15620384.exe s71446923.exe PID 4876 wrote to memory of 512 4876 z15620384.exe s71446923.exe PID 512 wrote to memory of 1008 512 s71446923.exe 1.exe PID 512 wrote to memory of 1008 512 s71446923.exe 1.exe PID 512 wrote to memory of 1008 512 s71446923.exe 1.exe PID 4876 wrote to memory of 4488 4876 z15620384.exe t85411896.exe PID 4876 wrote to memory of 4488 4876 z15620384.exe t85411896.exe PID 4876 wrote to memory of 4488 4876 z15620384.exe t85411896.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\470d3845dbc02ca9d2c7a0494fa96c4f87c752eeeadd27ff670da6a8b3d07467.exe"C:\Users\Admin\AppData\Local\Temp\470d3845dbc02ca9d2c7a0494fa96c4f87c752eeeadd27ff670da6a8b3d07467.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z83137217.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z83137217.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z37439471.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z37439471.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z15620384.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z15620384.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s71446923.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s71446923.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 512 -s 13846⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t85411896.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t85411896.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 512 -ip 5121⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z83137217.exeFilesize
1.0MB
MD5d85db5df8fe0bb13b9b648282c990e2d
SHA1fa070f8a323626a4e99189516f3d09a95313154c
SHA256191fbcf6a65d8670bf662197c52430e7c8d426d3f3d6d5e16be4f0f1ecd46b2e
SHA512c6162d2068a5761afe2fa163ef6aa736418b2f5d3eea9c44d1b2ad0670b5b4069f2fa7cecc3c7d42a8f3bb8388e9f203343086fd6518bb63e547e09d05c68134
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z83137217.exeFilesize
1.0MB
MD5d85db5df8fe0bb13b9b648282c990e2d
SHA1fa070f8a323626a4e99189516f3d09a95313154c
SHA256191fbcf6a65d8670bf662197c52430e7c8d426d3f3d6d5e16be4f0f1ecd46b2e
SHA512c6162d2068a5761afe2fa163ef6aa736418b2f5d3eea9c44d1b2ad0670b5b4069f2fa7cecc3c7d42a8f3bb8388e9f203343086fd6518bb63e547e09d05c68134
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z37439471.exeFilesize
759KB
MD54051d3a2bb5fcf14526b995fb9dbbc53
SHA180379662bf0350659da926f6aedc1abd7f8666ec
SHA25682abec9d514803fd9ce2c7743546628d990a799b8d7d30ae1d873c2694f65424
SHA512390767ce12823c3b25f6893565797ca836da6851a8f8b9b008757a5dac44adafa04e75220d06b0ffc8f7a21610471e472099a00a0ee76b257bb13d54bad9dd48
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z37439471.exeFilesize
759KB
MD54051d3a2bb5fcf14526b995fb9dbbc53
SHA180379662bf0350659da926f6aedc1abd7f8666ec
SHA25682abec9d514803fd9ce2c7743546628d990a799b8d7d30ae1d873c2694f65424
SHA512390767ce12823c3b25f6893565797ca836da6851a8f8b9b008757a5dac44adafa04e75220d06b0ffc8f7a21610471e472099a00a0ee76b257bb13d54bad9dd48
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z15620384.exeFilesize
577KB
MD5d17a9ada9eeafdc502da8ca035534387
SHA1aa7040590d32e13591d18698b8e9d9bd690a0c63
SHA256ac9f426538a40c5518905b5861b5a80e3793ee9fc6447ff215058a05dff58df1
SHA512e1aa94c436b7e069242e9c0474dfbb936d355073eb87dd44775659aa7a6ad0d99d943fcfee762ea075fbe36906625bf5c3cd1f83ef91993138aaaf2d8499ba15
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z15620384.exeFilesize
577KB
MD5d17a9ada9eeafdc502da8ca035534387
SHA1aa7040590d32e13591d18698b8e9d9bd690a0c63
SHA256ac9f426538a40c5518905b5861b5a80e3793ee9fc6447ff215058a05dff58df1
SHA512e1aa94c436b7e069242e9c0474dfbb936d355073eb87dd44775659aa7a6ad0d99d943fcfee762ea075fbe36906625bf5c3cd1f83ef91993138aaaf2d8499ba15
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s71446923.exeFilesize
574KB
MD52271bfb4855d9e4335aadf3453fe9a28
SHA16c76168d951d4050235bfc8ab9bcc2c6c715bd70
SHA2563d011073029d2ce94ef2ac713dcf694ebcd30725fa6de3ae2b1f84f955e85492
SHA5122d9cfccb6c96cd0594bd8bfabd239b6d9f65724cabd56b1543d04cfcacfab266f5e1290737d0445a007bd841bf940744da0a7655389184e92c35fecfd6ec18c0
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s71446923.exeFilesize
574KB
MD52271bfb4855d9e4335aadf3453fe9a28
SHA16c76168d951d4050235bfc8ab9bcc2c6c715bd70
SHA2563d011073029d2ce94ef2ac713dcf694ebcd30725fa6de3ae2b1f84f955e85492
SHA5122d9cfccb6c96cd0594bd8bfabd239b6d9f65724cabd56b1543d04cfcacfab266f5e1290737d0445a007bd841bf940744da0a7655389184e92c35fecfd6ec18c0
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t85411896.exeFilesize
169KB
MD5e3c7834c24170ffe6f83519fd0203757
SHA15bf56accaffc7bdc33d08f76f1249015ae8f2eac
SHA2562aa4e6854a088952773142022d67251f688fe6c35c060c5ef2e6f96f4260df10
SHA512b90553fc203c2d7610558eb7499b393391f60643376be91f61ac78297fef99ef14ee29df12593409d2c36553048ca899ce6f49525825a53e50fed29138eac672
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t85411896.exeFilesize
169KB
MD5e3c7834c24170ffe6f83519fd0203757
SHA15bf56accaffc7bdc33d08f76f1249015ae8f2eac
SHA2562aa4e6854a088952773142022d67251f688fe6c35c060c5ef2e6f96f4260df10
SHA512b90553fc203c2d7610558eb7499b393391f60643376be91f61ac78297fef99ef14ee29df12593409d2c36553048ca899ce6f49525825a53e50fed29138eac672
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
memory/512-175-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/512-216-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/512-173-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/512-169-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/512-177-0x0000000005000000-0x0000000005010000-memory.dmpFilesize
64KB
-
memory/512-178-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/512-180-0x0000000005000000-0x0000000005010000-memory.dmpFilesize
64KB
-
memory/512-182-0x0000000005000000-0x0000000005010000-memory.dmpFilesize
64KB
-
memory/512-184-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/512-181-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/512-186-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/512-188-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/512-190-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/512-192-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/512-194-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/512-196-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/512-198-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/512-200-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/512-202-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/512-204-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/512-206-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/512-208-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/512-210-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/512-212-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/512-214-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/512-171-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/512-218-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/512-220-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/512-222-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/512-224-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/512-226-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/512-228-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/512-230-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/512-2313-0x0000000005000000-0x0000000005010000-memory.dmpFilesize
64KB
-
memory/512-167-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/512-165-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/512-164-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/512-162-0x0000000000840000-0x000000000089B000-memory.dmpFilesize
364KB
-
memory/512-163-0x0000000005010000-0x00000000055B4000-memory.dmpFilesize
5.6MB
-
memory/512-2334-0x0000000005000000-0x0000000005010000-memory.dmpFilesize
64KB
-
memory/512-2333-0x0000000005000000-0x0000000005010000-memory.dmpFilesize
64KB
-
memory/512-2332-0x0000000005000000-0x0000000005010000-memory.dmpFilesize
64KB
-
memory/1008-2331-0x0000000004CA0000-0x0000000004CDC000-memory.dmpFilesize
240KB
-
memory/1008-2330-0x0000000004C40000-0x0000000004C52000-memory.dmpFilesize
72KB
-
memory/1008-2329-0x0000000004D10000-0x0000000004E1A000-memory.dmpFilesize
1.0MB
-
memory/1008-2328-0x0000000005220000-0x0000000005838000-memory.dmpFilesize
6.1MB
-
memory/1008-2326-0x0000000000300000-0x000000000032E000-memory.dmpFilesize
184KB
-
memory/1008-2341-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/4488-2339-0x0000000000690000-0x00000000006BE000-memory.dmpFilesize
184KB
-
memory/4488-2340-0x0000000004F00000-0x0000000004F10000-memory.dmpFilesize
64KB
-
memory/4488-2342-0x0000000004F00000-0x0000000004F10000-memory.dmpFilesize
64KB