redline | 4fbf6459ee877ab1676f05932edb3ada0e119c63628e48f3c04550d5543e3395

Analysis

max time kernel
202s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06-05-2023 21:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4fbf6459ee877ab1676f05932edb3ada0e119c63628e48f3c04550d5543e3395.exe
Size

1.2MB
MD5

22c79790d74b3191b3186e677df681df
SHA1

398ca5a3a5225d4fc86c2f901e51f1cadc1ba385
SHA256

4fbf6459ee877ab1676f05932edb3ada0e119c63628e48f3c04550d5543e3395
SHA512

002e571f8852e0f234385326ef5cd09a9b4a9d224d49981751faaba1c8b3fa966d96ddfc5cc41666ebf67ce3640c7a1f0444235a46dcfca4d1647d0e65c60d42
SSDEEP

24576:5yRrEdtpjzvOPiBqObuImNNJpK0oe/NBPAo+OCc0p2lMbDlHZaPsjn:sRrMvnvOqGe41FAoeSmbDlHZaPI

Score

10^/10

redline gena life infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

gena

185.161.248.73:4164

Attributes

auth_value
d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

life

185.161.248.73:4164

Attributes

auth_value
8685d11953530b68ad5ec703809d9f91

Signatures

Detects Redline Stealer samples 1 IoCs

This rule detects the presence of Redline Stealer samples based on their unique strings.

stealer

Processes:

resource	yara_rule
behavioral2/memory/5028-2334-0x00000000052C0000-0x00000000058D8000-memory.dmp	redline_stealer

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

s36320737.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	s36320737.exe

Executes dropped EXE 6 IoCs

Processes:

z35789116.exez29407356.exez55426459.exes36320737.exe1.exet02353897.exe

pid process

4220 z35789116.exe
4356 z29407356.exe
4728 z55426459.exe
796 s36320737.exe
5028 1.exe
2232 t02353897.exe

pid	process
4220	z35789116.exe
4356	z29407356.exe
4728	z55426459.exe
796	s36320737.exe
5028	1.exe
2232	t02353897.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

z29407356.exez55426459.exe4fbf6459ee877ab1676f05932edb3ada0e119c63628e48f3c04550d5543e3395.exez35789116.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z29407356.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z29407356.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z55426459.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z55426459.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	4fbf6459ee877ab1676f05932edb3ada0e119c63628e48f3c04550d5543e3395.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	4fbf6459ee877ab1676f05932edb3ada0e119c63628e48f3c04550d5543e3395.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z35789116.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z35789116.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4400 796 WerFault.exe s36320737.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

s36320737.exe

description pid process

Token: SeDebugPrivilege 796 s36320737.exe

pid	pid_target	process	target process
4400	796	WerFault.exe	s36320737.exe

description	pid	process
Token: SeDebugPrivilege	796	s36320737.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

4fbf6459ee877ab1676f05932edb3ada0e119c63628e48f3c04550d5543e3395.exez35789116.exez29407356.exez55426459.exes36320737.exe

description	pid	process	target process
PID 3628 wrote to memory of 4220	3628	4fbf6459ee877ab1676f05932edb3ada0e119c63628e48f3c04550d5543e3395.exe	z35789116.exe
PID 3628 wrote to memory of 4220	3628	4fbf6459ee877ab1676f05932edb3ada0e119c63628e48f3c04550d5543e3395.exe	z35789116.exe
PID 3628 wrote to memory of 4220	3628	4fbf6459ee877ab1676f05932edb3ada0e119c63628e48f3c04550d5543e3395.exe	z35789116.exe
PID 4220 wrote to memory of 4356	4220	z35789116.exe	z29407356.exe
PID 4220 wrote to memory of 4356	4220	z35789116.exe	z29407356.exe
PID 4220 wrote to memory of 4356	4220	z35789116.exe	z29407356.exe
PID 4356 wrote to memory of 4728	4356	z29407356.exe	z55426459.exe
PID 4356 wrote to memory of 4728	4356	z29407356.exe	z55426459.exe
PID 4356 wrote to memory of 4728	4356	z29407356.exe	z55426459.exe
PID 4728 wrote to memory of 796	4728	z55426459.exe	s36320737.exe
PID 4728 wrote to memory of 796	4728	z55426459.exe	s36320737.exe
PID 4728 wrote to memory of 796	4728	z55426459.exe	s36320737.exe
PID 796 wrote to memory of 5028	796	s36320737.exe	1.exe
PID 796 wrote to memory of 5028	796	s36320737.exe	1.exe
PID 796 wrote to memory of 5028	796	s36320737.exe	1.exe
PID 4728 wrote to memory of 2232	4728	z55426459.exe	t02353897.exe
PID 4728 wrote to memory of 2232	4728	z55426459.exe	t02353897.exe
PID 4728 wrote to memory of 2232	4728	z55426459.exe	t02353897.exe

C:\Users\Admin\AppData\Local\Temp\4fbf6459ee877ab1676f05932edb3ada0e119c63628e48f3c04550d5543e3395.exe
"C:\Users\Admin\AppData\Local\Temp\4fbf6459ee877ab1676f05932edb3ada0e119c63628e48f3c04550d5543e3395.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3628

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z35789116.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z35789116.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4220

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z29407356.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z29407356.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4356

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z55426459.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z55426459.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4728

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s36320737.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s36320737.exe
5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:796

C:\Windows\Temp\1.exe
"C:\Windows\Temp\1.exe"
6⤵
- Executes dropped EXE
PID:5028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 1368
6⤵
- Program crash
PID:4400

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t02353897.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t02353897.exe
5⤵
- Executes dropped EXE
PID:2232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 796 -ip 796
1⤵
PID:3896

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z35789116.exe
Filesize
1.0MB

MD5
b5c75da83711f4c60e61a52d06e92c1d

SHA1
a6ae619941c6ce6acd32b42f8a6f815d3accd4d6

SHA256
f1530347c1af9c236fb7549a7d50875d0dc3fe6dfca2e755c7e7ddea9ff12573

SHA512
1fd37b04dd1c3f8f8396123dc1632f4bbcc2cfe5ed4d01565d14c35a4ed484880471d7a4406f5139dd9f778563b2e9aa824058974cbbe4f81b51c5a7615384f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z35789116.exe
Filesize
1.0MB

MD5
b5c75da83711f4c60e61a52d06e92c1d

SHA1
a6ae619941c6ce6acd32b42f8a6f815d3accd4d6

SHA256
f1530347c1af9c236fb7549a7d50875d0dc3fe6dfca2e755c7e7ddea9ff12573

SHA512
1fd37b04dd1c3f8f8396123dc1632f4bbcc2cfe5ed4d01565d14c35a4ed484880471d7a4406f5139dd9f778563b2e9aa824058974cbbe4f81b51c5a7615384f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z29407356.exe
Filesize
759KB

MD5
fe8fb400212f0f5de71995c932dea1cb

SHA1
b03640e4e3207fa2203337562c10d428614e69ec

SHA256
f067f785ae854a041aca2134f310ffe01be0f91f511ffb71fdd33e8d5ef1ce1d

SHA512
586da4037f077578cf5c765c3ca26c00507cb365f688540ac2a01e8f4ae4cb34bfd71b9a0a276a510f5d9f276a07ed5405bda1ffdd9de25ef42e955cadd67520

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z29407356.exe
Filesize
759KB

MD5
fe8fb400212f0f5de71995c932dea1cb

SHA1
b03640e4e3207fa2203337562c10d428614e69ec

SHA256
f067f785ae854a041aca2134f310ffe01be0f91f511ffb71fdd33e8d5ef1ce1d

SHA512
586da4037f077578cf5c765c3ca26c00507cb365f688540ac2a01e8f4ae4cb34bfd71b9a0a276a510f5d9f276a07ed5405bda1ffdd9de25ef42e955cadd67520

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z55426459.exe
Filesize
577KB

MD5
450bb1a96f70c25a7e17ecbf902eceee

SHA1
3a33ec34ab3ec26bb138fe02d25c394b2d531806

SHA256
eeadbf038169b30acd241fd4b8c3bb99a9afa4eb53ad2303327a9b0f5acb6956

SHA512
29cf8a41cf55c3ef22176102b0ec7ade7d1f7d96bbe262abd5be30977209160f41cb4fbefcf9a33b5f6a7ae3ce2d383f2000323fd2e6a7a2a4638a4ee3a1514f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z55426459.exe
Filesize
577KB

MD5
450bb1a96f70c25a7e17ecbf902eceee

SHA1
3a33ec34ab3ec26bb138fe02d25c394b2d531806

SHA256
eeadbf038169b30acd241fd4b8c3bb99a9afa4eb53ad2303327a9b0f5acb6956

SHA512
29cf8a41cf55c3ef22176102b0ec7ade7d1f7d96bbe262abd5be30977209160f41cb4fbefcf9a33b5f6a7ae3ce2d383f2000323fd2e6a7a2a4638a4ee3a1514f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s36320737.exe
Filesize
574KB

MD5
2db86111b240a6b284f2e26d1a77b703

SHA1
6b65d2db9d61e72ea41e396612ed07b8c5049587

SHA256
b191e1cc5f4df0ef037a074d07b28df0e0c43f028e3a8e42716baeb33f55d4fc

SHA512
4b936d94c6f39987c97152e2a675d564a6349b3460f724a579024c66b49d3af90dffd7da87ff75e09734598fcd7b2245e7e6bd857be0d1e995d0d9665a075950

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s36320737.exe
Filesize
574KB

MD5
2db86111b240a6b284f2e26d1a77b703

SHA1
6b65d2db9d61e72ea41e396612ed07b8c5049587

SHA256
b191e1cc5f4df0ef037a074d07b28df0e0c43f028e3a8e42716baeb33f55d4fc

SHA512
4b936d94c6f39987c97152e2a675d564a6349b3460f724a579024c66b49d3af90dffd7da87ff75e09734598fcd7b2245e7e6bd857be0d1e995d0d9665a075950

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t02353897.exe
Filesize
169KB

MD5
ef7ffd65add8193bd947603c158b3557

SHA1
4495d80353845ed7382f95f7e1c38b0f9330f306

SHA256
13e1c8769de06e3b0185738e55dfcb5ec74e83b750b7d77a3786b1cc01c34b67

SHA512
df6ef806042a06348b6d318b62e85b77481300d0c83d660596e5c721c2c63c416a004ec6c6880c120f9b56415fda110e53a73be73a9f55e11f7bd7f2e6628a46

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t02353897.exe
Filesize
169KB

MD5
ef7ffd65add8193bd947603c158b3557

SHA1
4495d80353845ed7382f95f7e1c38b0f9330f306

SHA256
13e1c8769de06e3b0185738e55dfcb5ec74e83b750b7d77a3786b1cc01c34b67

SHA512
df6ef806042a06348b6d318b62e85b77481300d0c83d660596e5c721c2c63c416a004ec6c6880c120f9b56415fda110e53a73be73a9f55e11f7bd7f2e6628a46

Download Submit
C:\Windows\Temp\1.exe
Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
C:\Windows\Temp\1.exe
Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
C:\Windows\Temp\1.exe
Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
memory/796-174-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/796-220-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/796-172-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/796-168-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/796-176-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/796-178-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/796-180-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/796-182-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/796-184-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/796-186-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/796-188-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/796-190-0x0000000002790000-0x00000000027A0000-memory.dmp

Filesize
64KB

Download
memory/796-192-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/796-191-0x0000000002790000-0x00000000027A0000-memory.dmp

Filesize
64KB

Download
memory/796-194-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/796-196-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/796-198-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/796-200-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/796-202-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/796-204-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/796-206-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/796-208-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/796-210-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/796-212-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/796-214-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/796-216-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/796-218-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/796-170-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/796-222-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/796-224-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/796-228-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/796-226-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/796-2315-0x0000000002270000-0x00000000022CB000-memory.dmp

Filesize
364KB

Download
memory/796-2316-0x0000000002790000-0x00000000027A0000-memory.dmp

Filesize
64KB

Download
memory/796-166-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/796-165-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/796-164-0x0000000004F50000-0x00000000054F4000-memory.dmp

Filesize
5.6MB

Download
memory/796-162-0x0000000000400000-0x0000000000835000-memory.dmp

Filesize
4.2MB

Download
memory/796-2329-0x0000000002790000-0x00000000027A0000-memory.dmp

Filesize
64KB

Download
memory/796-2330-0x0000000002790000-0x00000000027A0000-memory.dmp

Filesize
64KB

Download
memory/796-2331-0x0000000002790000-0x00000000027A0000-memory.dmp

Filesize
64KB

Download
memory/796-2333-0x0000000002790000-0x00000000027A0000-memory.dmp

Filesize
64KB

Download
memory/796-163-0x0000000002270000-0x00000000022CB000-memory.dmp

Filesize
364KB

Download
memory/2232-2344-0x0000000000310000-0x000000000033E000-memory.dmp

Filesize
184KB

Download
memory/2232-2345-0x0000000004C30000-0x0000000004C40000-memory.dmp

Filesize
64KB

Download
memory/2232-2347-0x0000000004C30000-0x0000000004C40000-memory.dmp

Filesize
64KB

Download
memory/5028-2335-0x0000000004DB0000-0x0000000004EBA000-memory.dmp

Filesize
1.0MB

Download
memory/5028-2336-0x0000000004B90000-0x0000000004BA0000-memory.dmp

Filesize
64KB

Download
memory/5028-2337-0x0000000004CC0000-0x0000000004CD2000-memory.dmp

Filesize
72KB

Download
memory/5028-2338-0x0000000004D20000-0x0000000004D5C000-memory.dmp

Filesize
240KB

Download
memory/5028-2334-0x00000000052C0000-0x00000000058D8000-memory.dmp

Filesize
6.1MB

Download
memory/5028-2328-0x0000000000230000-0x000000000025E000-memory.dmp

Filesize
184KB

Download
memory/5028-2346-0x0000000004B90000-0x0000000004BA0000-memory.dmp

Filesize
64KB

Download