Analysis
-
max time kernel
140s -
max time network
178s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
06-05-2023 21:56
Static task
static1
Behavioral task
behavioral1
Sample
53373ec859d3cc02addb86345400dd637dfba36704ba9f04b04942a72490af55.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
53373ec859d3cc02addb86345400dd637dfba36704ba9f04b04942a72490af55.exe
Resource
win10v2004-20230220-en
General
-
Target
53373ec859d3cc02addb86345400dd637dfba36704ba9f04b04942a72490af55.exe
-
Size
1.2MB
-
MD5
da5ee2ff584ed5f7131125c717662ab5
-
SHA1
dc5496dc0fdb8de0791a623f350dc23721ed1066
-
SHA256
53373ec859d3cc02addb86345400dd637dfba36704ba9f04b04942a72490af55
-
SHA512
fd6555389d9b134845bfd47f1fb18cd7c83f1098af743ddbb68ee733edf2d8f9746d77dedec7a29163561d8f4f9201573b16eba767b4f044f5eb03968c4949dc
-
SSDEEP
24576:LyeRQyaPZS/bmwTVsAx5bvc21VANMFLxkdvzYrK3tqzvi4:+elanwTZbk21Vi6L6dvzYrK9qW
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
life
185.161.248.73:4164
-
auth_value
8685d11953530b68ad5ec703809d9f91
Signatures
-
Detects Redline Stealer samples 1 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
Processes:
resource yara_rule behavioral2/memory/948-2334-0x0000000005000000-0x0000000005618000-memory.dmp redline_stealer -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
s12134036.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation s12134036.exe -
Executes dropped EXE 6 IoCs
Processes:
z71398744.exez17844164.exez37189512.exes12134036.exe1.exet96789474.exepid process 4720 z71398744.exe 452 z17844164.exe 5064 z37189512.exe 836 s12134036.exe 948 1.exe 3800 t96789474.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
53373ec859d3cc02addb86345400dd637dfba36704ba9f04b04942a72490af55.exez71398744.exez17844164.exez37189512.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 53373ec859d3cc02addb86345400dd637dfba36704ba9f04b04942a72490af55.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z71398744.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z71398744.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z17844164.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z17844164.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z37189512.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z37189512.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 53373ec859d3cc02addb86345400dd637dfba36704ba9f04b04942a72490af55.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4556 836 WerFault.exe s12134036.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
s12134036.exedescription pid process Token: SeDebugPrivilege 836 s12134036.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
53373ec859d3cc02addb86345400dd637dfba36704ba9f04b04942a72490af55.exez71398744.exez17844164.exez37189512.exes12134036.exedescription pid process target process PID 4732 wrote to memory of 4720 4732 53373ec859d3cc02addb86345400dd637dfba36704ba9f04b04942a72490af55.exe z71398744.exe PID 4732 wrote to memory of 4720 4732 53373ec859d3cc02addb86345400dd637dfba36704ba9f04b04942a72490af55.exe z71398744.exe PID 4732 wrote to memory of 4720 4732 53373ec859d3cc02addb86345400dd637dfba36704ba9f04b04942a72490af55.exe z71398744.exe PID 4720 wrote to memory of 452 4720 z71398744.exe z17844164.exe PID 4720 wrote to memory of 452 4720 z71398744.exe z17844164.exe PID 4720 wrote to memory of 452 4720 z71398744.exe z17844164.exe PID 452 wrote to memory of 5064 452 z17844164.exe z37189512.exe PID 452 wrote to memory of 5064 452 z17844164.exe z37189512.exe PID 452 wrote to memory of 5064 452 z17844164.exe z37189512.exe PID 5064 wrote to memory of 836 5064 z37189512.exe s12134036.exe PID 5064 wrote to memory of 836 5064 z37189512.exe s12134036.exe PID 5064 wrote to memory of 836 5064 z37189512.exe s12134036.exe PID 836 wrote to memory of 948 836 s12134036.exe 1.exe PID 836 wrote to memory of 948 836 s12134036.exe 1.exe PID 836 wrote to memory of 948 836 s12134036.exe 1.exe PID 5064 wrote to memory of 3800 5064 z37189512.exe t96789474.exe PID 5064 wrote to memory of 3800 5064 z37189512.exe t96789474.exe PID 5064 wrote to memory of 3800 5064 z37189512.exe t96789474.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\53373ec859d3cc02addb86345400dd637dfba36704ba9f04b04942a72490af55.exe"C:\Users\Admin\AppData\Local\Temp\53373ec859d3cc02addb86345400dd637dfba36704ba9f04b04942a72490af55.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z71398744.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z71398744.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z17844164.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z17844164.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z37189512.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z37189512.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s12134036.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s12134036.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 15086⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t96789474.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t96789474.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 836 -ip 8361⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z71398744.exeFilesize
1.0MB
MD519172fbceb583e38a567bf0625aede64
SHA17db06bb1d4cd386bad4454e0ade6e37d6ed2e5f4
SHA2567e321e786a77eb7afb114050fefac5b82954cfcc9408cea8b6205e7bd060dfb7
SHA51202bb86e12e7b1ec21ac446021478dacd5a023a55c214f790a3e3c96260cba39a2d8e05a43dd96673ae9a9c7b5cb459be8e875271c7651a523e9ffb9c6cc03ab5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z71398744.exeFilesize
1.0MB
MD519172fbceb583e38a567bf0625aede64
SHA17db06bb1d4cd386bad4454e0ade6e37d6ed2e5f4
SHA2567e321e786a77eb7afb114050fefac5b82954cfcc9408cea8b6205e7bd060dfb7
SHA51202bb86e12e7b1ec21ac446021478dacd5a023a55c214f790a3e3c96260cba39a2d8e05a43dd96673ae9a9c7b5cb459be8e875271c7651a523e9ffb9c6cc03ab5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z17844164.exeFilesize
752KB
MD5d87741ed907ef6a3f105e1899dd22753
SHA12064a27054867ddd269bdfb99e8cc68432b3119d
SHA256b80c22c08a98c414b152be81d093face0ef3c57081a179dde67fae85741ec802
SHA512350d96eb1fb8328b729ad5167ceaf76572fa73f67f1815e5cc33616184ae0c67ba2c21012db753f83726d70b22d9f0796329d06ca5303ff4f3c511ec0a79e945
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z17844164.exeFilesize
752KB
MD5d87741ed907ef6a3f105e1899dd22753
SHA12064a27054867ddd269bdfb99e8cc68432b3119d
SHA256b80c22c08a98c414b152be81d093face0ef3c57081a179dde67fae85741ec802
SHA512350d96eb1fb8328b729ad5167ceaf76572fa73f67f1815e5cc33616184ae0c67ba2c21012db753f83726d70b22d9f0796329d06ca5303ff4f3c511ec0a79e945
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z37189512.exeFilesize
570KB
MD570f2bd74310608fa8b88f8dd6492087b
SHA1db70ccb598210efee775dd5d15cb9a8a991616f0
SHA256dd3ca04b002edec8338d87562a3ee057013b1ef0b0d598c3397d364291e44e5b
SHA512da066b568a8c9a888a76af098ea843ab491ac6c3e5442bb328978db33c4d992a71c7a59f6b05555477d64ce2de766110c0ece59ec931df32f95e2048a1573dab
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z37189512.exeFilesize
570KB
MD570f2bd74310608fa8b88f8dd6492087b
SHA1db70ccb598210efee775dd5d15cb9a8a991616f0
SHA256dd3ca04b002edec8338d87562a3ee057013b1ef0b0d598c3397d364291e44e5b
SHA512da066b568a8c9a888a76af098ea843ab491ac6c3e5442bb328978db33c4d992a71c7a59f6b05555477d64ce2de766110c0ece59ec931df32f95e2048a1573dab
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s12134036.exeFilesize
488KB
MD5f03f358e2f3062af1beb841ce5f502b2
SHA1a21edddf24ba567c295214fd8d8c0de72683af85
SHA256a3fa3f6e43393632325799af195b5a1ba3eb0bccf2d3f003227925d8171235dd
SHA512b055667ccbcb3bf53ddc8c2b304d8644c1c6edfc7d34e9be4d5f779c26f57f8a65615f510fefcc46ff3d2438c71224c04ffe6d936eb30de58294cf6c2d664a1c
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s12134036.exeFilesize
488KB
MD5f03f358e2f3062af1beb841ce5f502b2
SHA1a21edddf24ba567c295214fd8d8c0de72683af85
SHA256a3fa3f6e43393632325799af195b5a1ba3eb0bccf2d3f003227925d8171235dd
SHA512b055667ccbcb3bf53ddc8c2b304d8644c1c6edfc7d34e9be4d5f779c26f57f8a65615f510fefcc46ff3d2438c71224c04ffe6d936eb30de58294cf6c2d664a1c
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t96789474.exeFilesize
169KB
MD58a87fef5b9b7c1beb2a7d4b5435f617f
SHA122606686d19560854b312bc3a7ba10a62c68529e
SHA256f805bd37b5ca44166c08e8c53048017e33d891176dc7ecc0492c77a6d2c005d5
SHA51226e0833e5cbfa7be35b4223fee8b627173492b4a1f0701f506f1d42390050abc3a71501eab3a83577a7cb31eff70c7977fab76109a4576a47e92305192027bff
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t96789474.exeFilesize
169KB
MD58a87fef5b9b7c1beb2a7d4b5435f617f
SHA122606686d19560854b312bc3a7ba10a62c68529e
SHA256f805bd37b5ca44166c08e8c53048017e33d891176dc7ecc0492c77a6d2c005d5
SHA51226e0833e5cbfa7be35b4223fee8b627173492b4a1f0701f506f1d42390050abc3a71501eab3a83577a7cb31eff70c7977fab76109a4576a47e92305192027bff
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
memory/836-172-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/836-220-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/836-170-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/836-167-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/836-174-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/836-176-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/836-178-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/836-180-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/836-182-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/836-184-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/836-186-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/836-188-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/836-190-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/836-192-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/836-194-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/836-196-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/836-198-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/836-200-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/836-202-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/836-204-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/836-206-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/836-208-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/836-210-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/836-212-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/836-214-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/836-216-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/836-218-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/836-168-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/836-222-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/836-224-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/836-226-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/836-228-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/836-230-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/836-2315-0x0000000002390000-0x00000000023A0000-memory.dmpFilesize
64KB
-
memory/836-166-0x0000000002390000-0x00000000023A0000-memory.dmpFilesize
64KB
-
memory/836-165-0x0000000002390000-0x00000000023A0000-memory.dmpFilesize
64KB
-
memory/836-164-0x0000000002390000-0x00000000023A0000-memory.dmpFilesize
64KB
-
memory/836-162-0x0000000004F10000-0x00000000054B4000-memory.dmpFilesize
5.6MB
-
memory/836-2328-0x0000000002390000-0x00000000023A0000-memory.dmpFilesize
64KB
-
memory/836-2329-0x0000000002390000-0x00000000023A0000-memory.dmpFilesize
64KB
-
memory/836-2330-0x0000000002390000-0x00000000023A0000-memory.dmpFilesize
64KB
-
memory/836-2332-0x0000000002390000-0x00000000023A0000-memory.dmpFilesize
64KB
-
memory/836-163-0x0000000000A00000-0x0000000000A5B000-memory.dmpFilesize
364KB
-
memory/948-2335-0x0000000004AF0000-0x0000000004BFA000-memory.dmpFilesize
1.0MB
-
memory/948-2336-0x0000000004900000-0x0000000004912000-memory.dmpFilesize
72KB
-
memory/948-2337-0x0000000004960000-0x000000000499C000-memory.dmpFilesize
240KB
-
memory/948-2338-0x00000000049D0000-0x00000000049E0000-memory.dmpFilesize
64KB
-
memory/948-2334-0x0000000005000000-0x0000000005618000-memory.dmpFilesize
6.1MB
-
memory/948-2327-0x00000000000F0000-0x000000000011E000-memory.dmpFilesize
184KB
-
memory/948-2346-0x00000000049D0000-0x00000000049E0000-memory.dmpFilesize
64KB
-
memory/3800-2344-0x0000000000CB0000-0x0000000000CDE000-memory.dmpFilesize
184KB
-
memory/3800-2345-0x00000000055D0000-0x00000000055E0000-memory.dmpFilesize
64KB
-
memory/3800-2347-0x00000000055D0000-0x00000000055E0000-memory.dmpFilesize
64KB