Analysis
-
max time kernel
144s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
06-05-2023 22:00
Static task
static1
Behavioral task
behavioral1
Sample
5659e568a3380029a3859aaea2584b78e4e1b111dbbb82637d05345cc10e42d6.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
5659e568a3380029a3859aaea2584b78e4e1b111dbbb82637d05345cc10e42d6.exe
Resource
win10v2004-20230220-en
General
-
Target
5659e568a3380029a3859aaea2584b78e4e1b111dbbb82637d05345cc10e42d6.exe
-
Size
1.2MB
-
MD5
234d5aeb1a41e52cc5066c52c4c6a7da
-
SHA1
b5bbc5ce13ee8717e771d3aa6f2ea3fd812e93b1
-
SHA256
5659e568a3380029a3859aaea2584b78e4e1b111dbbb82637d05345cc10e42d6
-
SHA512
964d9bbb2a0536333f2cfa7a16962655041fdb96d7eca08cbbfc304f07543cd62b28489252d4c83ea855c05def6ef963e0d1f9b6915dd99de76b44590849d4fa
-
SSDEEP
24576:yypxZV7fgqoC75znlp+kJutJCErxT6Se0DOvhscLfVAhzy8FYe:ZpzV7fgFE5znlp+kJyFrxTjVOpsuAhF
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
life
185.161.248.73:4164
-
auth_value
8685d11953530b68ad5ec703809d9f91
Signatures
-
Detects Redline Stealer samples 1 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
Processes:
resource yara_rule behavioral2/memory/1172-2328-0x000000000B170000-0x000000000B788000-memory.dmp redline_stealer -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
s12411598.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation s12411598.exe -
Executes dropped EXE 6 IoCs
Processes:
z75753864.exez27335901.exez08842161.exes12411598.exe1.exet82897344.exepid process 1356 z75753864.exe 4628 z27335901.exe 4160 z08842161.exe 4020 s12411598.exe 1172 1.exe 2104 t82897344.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
5659e568a3380029a3859aaea2584b78e4e1b111dbbb82637d05345cc10e42d6.exez75753864.exez27335901.exez08842161.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 5659e568a3380029a3859aaea2584b78e4e1b111dbbb82637d05345cc10e42d6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5659e568a3380029a3859aaea2584b78e4e1b111dbbb82637d05345cc10e42d6.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z75753864.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z75753864.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z27335901.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z27335901.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z08842161.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z08842161.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3308 4020 WerFault.exe s12411598.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
s12411598.exedescription pid process Token: SeDebugPrivilege 4020 s12411598.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
5659e568a3380029a3859aaea2584b78e4e1b111dbbb82637d05345cc10e42d6.exez75753864.exez27335901.exez08842161.exes12411598.exedescription pid process target process PID 1912 wrote to memory of 1356 1912 5659e568a3380029a3859aaea2584b78e4e1b111dbbb82637d05345cc10e42d6.exe z75753864.exe PID 1912 wrote to memory of 1356 1912 5659e568a3380029a3859aaea2584b78e4e1b111dbbb82637d05345cc10e42d6.exe z75753864.exe PID 1912 wrote to memory of 1356 1912 5659e568a3380029a3859aaea2584b78e4e1b111dbbb82637d05345cc10e42d6.exe z75753864.exe PID 1356 wrote to memory of 4628 1356 z75753864.exe z27335901.exe PID 1356 wrote to memory of 4628 1356 z75753864.exe z27335901.exe PID 1356 wrote to memory of 4628 1356 z75753864.exe z27335901.exe PID 4628 wrote to memory of 4160 4628 z27335901.exe z08842161.exe PID 4628 wrote to memory of 4160 4628 z27335901.exe z08842161.exe PID 4628 wrote to memory of 4160 4628 z27335901.exe z08842161.exe PID 4160 wrote to memory of 4020 4160 z08842161.exe s12411598.exe PID 4160 wrote to memory of 4020 4160 z08842161.exe s12411598.exe PID 4160 wrote to memory of 4020 4160 z08842161.exe s12411598.exe PID 4020 wrote to memory of 1172 4020 s12411598.exe 1.exe PID 4020 wrote to memory of 1172 4020 s12411598.exe 1.exe PID 4020 wrote to memory of 1172 4020 s12411598.exe 1.exe PID 4160 wrote to memory of 2104 4160 z08842161.exe t82897344.exe PID 4160 wrote to memory of 2104 4160 z08842161.exe t82897344.exe PID 4160 wrote to memory of 2104 4160 z08842161.exe t82897344.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5659e568a3380029a3859aaea2584b78e4e1b111dbbb82637d05345cc10e42d6.exe"C:\Users\Admin\AppData\Local\Temp\5659e568a3380029a3859aaea2584b78e4e1b111dbbb82637d05345cc10e42d6.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z75753864.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z75753864.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z27335901.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z27335901.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z08842161.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z08842161.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s12411598.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s12411598.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 13766⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t82897344.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t82897344.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4020 -ip 40201⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z75753864.exeFilesize
1.0MB
MD59b540a21d0e140ce9efeefcdd3b13ebd
SHA1eb9bf11b91e15b1ea91a8ae1cded7e8b81099acf
SHA2560f844cd0ceb8e2a273383921011f1596873115df464a531ebcb8c2760127ab6d
SHA51225631d3f1e1bc9ac01fed77a4ac7b778db4e42a0c0561654492f5beb1c955872e6ce765405de25587b17aff5b4126d654b6abfd6011a9ab8374a736e22450ff8
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z75753864.exeFilesize
1.0MB
MD59b540a21d0e140ce9efeefcdd3b13ebd
SHA1eb9bf11b91e15b1ea91a8ae1cded7e8b81099acf
SHA2560f844cd0ceb8e2a273383921011f1596873115df464a531ebcb8c2760127ab6d
SHA51225631d3f1e1bc9ac01fed77a4ac7b778db4e42a0c0561654492f5beb1c955872e6ce765405de25587b17aff5b4126d654b6abfd6011a9ab8374a736e22450ff8
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z27335901.exeFilesize
762KB
MD52df7c6b3aa82ad86060f6a7c825997d8
SHA1313039cfa2675cc56d4464f50e36543098c04d8b
SHA256e475bbbf42daeda4b92c78d6befe49a4d1f28049f81edea71e1be102030a214b
SHA512e2e8fd76a7059c4e6bf06aa68ea1d4a19d1eb7b6dfdfac29681eeaecf0caedd97e060bfa4c37be4388572bf9b00791f5f87a39cf8f0f06605534d40d81eaaf3e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z27335901.exeFilesize
762KB
MD52df7c6b3aa82ad86060f6a7c825997d8
SHA1313039cfa2675cc56d4464f50e36543098c04d8b
SHA256e475bbbf42daeda4b92c78d6befe49a4d1f28049f81edea71e1be102030a214b
SHA512e2e8fd76a7059c4e6bf06aa68ea1d4a19d1eb7b6dfdfac29681eeaecf0caedd97e060bfa4c37be4388572bf9b00791f5f87a39cf8f0f06605534d40d81eaaf3e
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z08842161.exeFilesize
578KB
MD5886cfb926920bad9ea4503536d1b2044
SHA1a6ce76e0f66f7f29b50c79d245e30164e2271cac
SHA256ebcd46844df950250238956870c816587b525d5b399e0cc10a291cf2a397d0c7
SHA512fc0ea4c23fef9b4ed42cc0e9f5dad773bd256e774319d23563c601b5098d9f9488c272627277080c95c4743099c0095af6401423a7b2ff1fd2a79400c6980246
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z08842161.exeFilesize
578KB
MD5886cfb926920bad9ea4503536d1b2044
SHA1a6ce76e0f66f7f29b50c79d245e30164e2271cac
SHA256ebcd46844df950250238956870c816587b525d5b399e0cc10a291cf2a397d0c7
SHA512fc0ea4c23fef9b4ed42cc0e9f5dad773bd256e774319d23563c601b5098d9f9488c272627277080c95c4743099c0095af6401423a7b2ff1fd2a79400c6980246
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s12411598.exeFilesize
580KB
MD5b15e8f7f3c4ec7cb8bd154b1ba8b76c2
SHA112179f8b947d183c2b470c5aca5bcb43579a2493
SHA25632ac9df0bfa9ef97ab7f170aab1af61702bfc06e9d0c2b9d98ab7b8c908900d6
SHA51222aea38419d461ce1a4c51fe9c407143c0ff5b3db77750b9a3251f3058a6ea8480ab5e953f7047691a6322a9fe48e4cc096854509e682ee50a11b60933c5a016
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s12411598.exeFilesize
580KB
MD5b15e8f7f3c4ec7cb8bd154b1ba8b76c2
SHA112179f8b947d183c2b470c5aca5bcb43579a2493
SHA25632ac9df0bfa9ef97ab7f170aab1af61702bfc06e9d0c2b9d98ab7b8c908900d6
SHA51222aea38419d461ce1a4c51fe9c407143c0ff5b3db77750b9a3251f3058a6ea8480ab5e953f7047691a6322a9fe48e4cc096854509e682ee50a11b60933c5a016
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t82897344.exeFilesize
169KB
MD524d18ae3463156a59ba1f726d50bc431
SHA17ccb5822097ae819b17c43c351f1e01538e65f90
SHA256e8dbd56a5f3f6c8dd95eec65079426ec8bfceb4743718383b78923476aa5e799
SHA51235dd5bab489483315bc85940daea713f5cd86961b06a229b75e7e95265423dfa66085b5e1ba3a77383dde306d1068bdec17b85d96e0fd3036e1147feb6e95d26
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t82897344.exeFilesize
169KB
MD524d18ae3463156a59ba1f726d50bc431
SHA17ccb5822097ae819b17c43c351f1e01538e65f90
SHA256e8dbd56a5f3f6c8dd95eec65079426ec8bfceb4743718383b78923476aa5e799
SHA51235dd5bab489483315bc85940daea713f5cd86961b06a229b75e7e95265423dfa66085b5e1ba3a77383dde306d1068bdec17b85d96e0fd3036e1147feb6e95d26
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
memory/1172-2334-0x00000000056C0000-0x00000000056D0000-memory.dmpFilesize
64KB
-
memory/1172-2335-0x000000000AB90000-0x000000000ABCC000-memory.dmpFilesize
240KB
-
memory/1172-2333-0x0000000005680000-0x0000000005692000-memory.dmpFilesize
72KB
-
memory/1172-2332-0x000000000AC60000-0x000000000AD6A000-memory.dmpFilesize
1.0MB
-
memory/1172-2328-0x000000000B170000-0x000000000B788000-memory.dmpFilesize
6.1MB
-
memory/1172-2327-0x0000000000DA0000-0x0000000000DCE000-memory.dmpFilesize
184KB
-
memory/1172-2344-0x00000000056C0000-0x00000000056D0000-memory.dmpFilesize
64KB
-
memory/2104-2342-0x0000000000A80000-0x0000000000AAE000-memory.dmpFilesize
184KB
-
memory/2104-2343-0x0000000005280000-0x0000000005290000-memory.dmpFilesize
64KB
-
memory/2104-2345-0x0000000005280000-0x0000000005290000-memory.dmpFilesize
64KB
-
memory/4020-174-0x0000000004E50000-0x0000000004EB0000-memory.dmpFilesize
384KB
-
memory/4020-228-0x0000000004E50000-0x0000000004EB0000-memory.dmpFilesize
384KB
-
memory/4020-190-0x0000000004E50000-0x0000000004EB0000-memory.dmpFilesize
384KB
-
memory/4020-192-0x0000000004E50000-0x0000000004EB0000-memory.dmpFilesize
384KB
-
memory/4020-194-0x0000000004E50000-0x0000000004EB0000-memory.dmpFilesize
384KB
-
memory/4020-196-0x0000000004E50000-0x0000000004EB0000-memory.dmpFilesize
384KB
-
memory/4020-198-0x0000000004E50000-0x0000000004EB0000-memory.dmpFilesize
384KB
-
memory/4020-200-0x0000000004E50000-0x0000000004EB0000-memory.dmpFilesize
384KB
-
memory/4020-202-0x0000000004E50000-0x0000000004EB0000-memory.dmpFilesize
384KB
-
memory/4020-204-0x0000000004E50000-0x0000000004EB0000-memory.dmpFilesize
384KB
-
memory/4020-206-0x0000000004E50000-0x0000000004EB0000-memory.dmpFilesize
384KB
-
memory/4020-208-0x0000000004E50000-0x0000000004EB0000-memory.dmpFilesize
384KB
-
memory/4020-210-0x0000000004E50000-0x0000000004EB0000-memory.dmpFilesize
384KB
-
memory/4020-212-0x0000000004E50000-0x0000000004EB0000-memory.dmpFilesize
384KB
-
memory/4020-214-0x0000000004E50000-0x0000000004EB0000-memory.dmpFilesize
384KB
-
memory/4020-216-0x0000000004E50000-0x0000000004EB0000-memory.dmpFilesize
384KB
-
memory/4020-218-0x0000000004E50000-0x0000000004EB0000-memory.dmpFilesize
384KB
-
memory/4020-220-0x0000000004E50000-0x0000000004EB0000-memory.dmpFilesize
384KB
-
memory/4020-222-0x0000000004E50000-0x0000000004EB0000-memory.dmpFilesize
384KB
-
memory/4020-224-0x0000000004E50000-0x0000000004EB0000-memory.dmpFilesize
384KB
-
memory/4020-226-0x0000000004E50000-0x0000000004EB0000-memory.dmpFilesize
384KB
-
memory/4020-188-0x0000000004E50000-0x0000000004EB0000-memory.dmpFilesize
384KB
-
memory/4020-230-0x0000000004E50000-0x0000000004EB0000-memory.dmpFilesize
384KB
-
memory/4020-186-0x0000000004E50000-0x0000000004EB0000-memory.dmpFilesize
384KB
-
memory/4020-2322-0x0000000004EC0000-0x0000000004ED0000-memory.dmpFilesize
64KB
-
memory/4020-184-0x0000000004E50000-0x0000000004EB0000-memory.dmpFilesize
384KB
-
memory/4020-182-0x0000000004E50000-0x0000000004EB0000-memory.dmpFilesize
384KB
-
memory/4020-180-0x0000000004E50000-0x0000000004EB0000-memory.dmpFilesize
384KB
-
memory/4020-178-0x0000000004E50000-0x0000000004EB0000-memory.dmpFilesize
384KB
-
memory/4020-2329-0x0000000004EC0000-0x0000000004ED0000-memory.dmpFilesize
64KB
-
memory/4020-2330-0x0000000004EC0000-0x0000000004ED0000-memory.dmpFilesize
64KB
-
memory/4020-2331-0x0000000004EC0000-0x0000000004ED0000-memory.dmpFilesize
64KB
-
memory/4020-176-0x0000000004E50000-0x0000000004EB0000-memory.dmpFilesize
384KB
-
memory/4020-168-0x0000000004E50000-0x0000000004EB0000-memory.dmpFilesize
384KB
-
memory/4020-172-0x0000000004E50000-0x0000000004EB0000-memory.dmpFilesize
384KB
-
memory/4020-171-0x0000000004EC0000-0x0000000004ED0000-memory.dmpFilesize
64KB
-
memory/4020-2337-0x0000000004EC0000-0x0000000004ED0000-memory.dmpFilesize
64KB
-
memory/4020-169-0x0000000004EC0000-0x0000000004ED0000-memory.dmpFilesize
64KB
-
memory/4020-167-0x0000000004EC0000-0x0000000004ED0000-memory.dmpFilesize
64KB
-
memory/4020-165-0x0000000004E50000-0x0000000004EB0000-memory.dmpFilesize
384KB
-
memory/4020-164-0x0000000004E50000-0x0000000004EB0000-memory.dmpFilesize
384KB
-
memory/4020-163-0x0000000004FD0000-0x0000000005574000-memory.dmpFilesize
5.6MB
-
memory/4020-162-0x00000000009A0000-0x00000000009FB000-memory.dmpFilesize
364KB