redline | 0a798259526762d68920a658209b0e6416f495a2127e182c135bff029f5ba8eb

Analysis

max time kernel
205s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06-05-2023 22:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a798259526762d68920a658209b0e6416f495a2127e182c135bff029f5ba8eb.exe
Size

1.2MB
MD5

fc81f8ae4764baf58422360378dcc1d1
SHA1

6fce0e598acc363480c335c832abe90c13d2424a
SHA256

0a798259526762d68920a658209b0e6416f495a2127e182c135bff029f5ba8eb
SHA512

46dc9a8c3d74031b0a8b9672959479204482da291d4e187b45a77714514ce15ee27da3c0e47552157ecf2fa204706c8c9eb38826a5906e49d658b9355a2649e3
SSDEEP

24576:dyzLpnrPguE1MyaCLUA1FsyfNh/JS+38nvdSwsDKTM53:4v5KaCgA1FsYNtKvDsDKT

Score

10^/10

redline gena life infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

gena

185.161.248.73:4164

Attributes

auth_value
d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

life

185.161.248.73:4164

Attributes

auth_value
8685d11953530b68ad5ec703809d9f91

Signatures

Detects Redline Stealer samples 1 IoCs

This rule detects the presence of Redline Stealer samples based on their unique strings.

stealer

Processes:

resource	yara_rule
behavioral2/memory/2728-2334-0x0000000005DD0000-0x00000000063E8000-memory.dmp	redline_stealer

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

s89183155.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	s89183155.exe

Executes dropped EXE 6 IoCs

Processes:

z25338459.exez81714914.exez88885603.exes89183155.exe1.exet54576409.exe

pid process

1468 z25338459.exe
4392 z81714914.exe
3396 z88885603.exe
648 s89183155.exe
2728 1.exe
4076 t54576409.exe

pid	process
1468	z25338459.exe
4392	z81714914.exe
3396	z88885603.exe
648	s89183155.exe
2728	1.exe
4076	t54576409.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

z25338459.exez81714914.exez88885603.exe0a798259526762d68920a658209b0e6416f495a2127e182c135bff029f5ba8eb.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z25338459.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z25338459.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z81714914.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z81714914.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z88885603.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z88885603.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	0a798259526762d68920a658209b0e6416f495a2127e182c135bff029f5ba8eb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	0a798259526762d68920a658209b0e6416f495a2127e182c135bff029f5ba8eb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4804 648 WerFault.exe s89183155.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

s89183155.exe

description pid process

Token: SeDebugPrivilege 648 s89183155.exe

pid	pid_target	process	target process
4804	648	WerFault.exe	s89183155.exe

description	pid	process
Token: SeDebugPrivilege	648	s89183155.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

0a798259526762d68920a658209b0e6416f495a2127e182c135bff029f5ba8eb.exez25338459.exez81714914.exez88885603.exes89183155.exe

description	pid	process	target process
PID 916 wrote to memory of 1468	916	0a798259526762d68920a658209b0e6416f495a2127e182c135bff029f5ba8eb.exe	z25338459.exe
PID 916 wrote to memory of 1468	916	0a798259526762d68920a658209b0e6416f495a2127e182c135bff029f5ba8eb.exe	z25338459.exe
PID 916 wrote to memory of 1468	916	0a798259526762d68920a658209b0e6416f495a2127e182c135bff029f5ba8eb.exe	z25338459.exe
PID 1468 wrote to memory of 4392	1468	z25338459.exe	z81714914.exe
PID 1468 wrote to memory of 4392	1468	z25338459.exe	z81714914.exe
PID 1468 wrote to memory of 4392	1468	z25338459.exe	z81714914.exe
PID 4392 wrote to memory of 3396	4392	z81714914.exe	z88885603.exe
PID 4392 wrote to memory of 3396	4392	z81714914.exe	z88885603.exe
PID 4392 wrote to memory of 3396	4392	z81714914.exe	z88885603.exe
PID 3396 wrote to memory of 648	3396	z88885603.exe	s89183155.exe
PID 3396 wrote to memory of 648	3396	z88885603.exe	s89183155.exe
PID 3396 wrote to memory of 648	3396	z88885603.exe	s89183155.exe
PID 648 wrote to memory of 2728	648	s89183155.exe	1.exe
PID 648 wrote to memory of 2728	648	s89183155.exe	1.exe
PID 648 wrote to memory of 2728	648	s89183155.exe	1.exe
PID 3396 wrote to memory of 4076	3396	z88885603.exe	t54576409.exe
PID 3396 wrote to memory of 4076	3396	z88885603.exe	t54576409.exe
PID 3396 wrote to memory of 4076	3396	z88885603.exe	t54576409.exe

C:\Users\Admin\AppData\Local\Temp\0a798259526762d68920a658209b0e6416f495a2127e182c135bff029f5ba8eb.exe
"C:\Users\Admin\AppData\Local\Temp\0a798259526762d68920a658209b0e6416f495a2127e182c135bff029f5ba8eb.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:916
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z25338459.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z25338459.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z81714914.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z81714914.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4392
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z88885603.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z88885603.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3396
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s89183155.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s89183155.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:648
      - C:\Windows\Temp\1.exe
        
        "C:\Windows\Temp\1.exe"
        6⤵
        Executes dropped EXE
        
        PID:2728
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 1388
        6⤵
        Program crash
        
        PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t54576409.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t54576409.exe
        5⤵
        Executes dropped EXE
        
        PID:4076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 648 -ip 648
1⤵
PID:4708

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z25338459.exe

Filesize
1.0MB

MD5
60a2f52ff9556f92032a812b24dfc4ee

SHA1
5216048132b4f507839bb686037b39e3aedf2d6d

SHA256
ef3153474ede9f02e0a737948666db35d05e082fff6cf518f01524a023f3bf51

SHA512
c849c016b17a6171013f4020486f1287ef18ecb9e865cc0ca74af739256ec4a38ea4339147d27940d6df5f6657efe308e9be62172f0a90c5d9f52020d6c59859

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z25338459.exe

Filesize
1.0MB

MD5
60a2f52ff9556f92032a812b24dfc4ee

SHA1
5216048132b4f507839bb686037b39e3aedf2d6d

SHA256
ef3153474ede9f02e0a737948666db35d05e082fff6cf518f01524a023f3bf51

SHA512
c849c016b17a6171013f4020486f1287ef18ecb9e865cc0ca74af739256ec4a38ea4339147d27940d6df5f6657efe308e9be62172f0a90c5d9f52020d6c59859

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z81714914.exe

Filesize
753KB

MD5
2594aebeef67a9d17be886f881b40755

SHA1
fe5dda6aad2552759f98fb21d743d63064ddd32e

SHA256
0b183a8b9e9b84e8809e3e7d1695b6f27ef23fa09b10ec89c5c44f2a78e71393

SHA512
3780fbfea71e5fb2dce163110e2acf1e50498c38f1ec44791be2622b733439d146a8dadfa29be5975840cdf3bebbe26e592e6530c4ecbb46c0541ae06fa7d61a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z81714914.exe

Filesize
753KB

MD5
2594aebeef67a9d17be886f881b40755

SHA1
fe5dda6aad2552759f98fb21d743d63064ddd32e

SHA256
0b183a8b9e9b84e8809e3e7d1695b6f27ef23fa09b10ec89c5c44f2a78e71393

SHA512
3780fbfea71e5fb2dce163110e2acf1e50498c38f1ec44791be2622b733439d146a8dadfa29be5975840cdf3bebbe26e592e6530c4ecbb46c0541ae06fa7d61a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z88885603.exe

Filesize
570KB

MD5
9eb4fe183529c655eba749f8fb47b335

SHA1
b79bfc5796063019d7307ada17bc84084c7e9990

SHA256
62de75667849eaf159b01a0996e20e28c57fb7fa47f2e2f035f0a6e79f86e065

SHA512
2748e9b16f6ffd9ed23823031a66d96ece21b8b5d1534e7dd5a6419a94390d469c785619b803c1394ad853ba168aa1677a661158d4093da66011498d5345481b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z88885603.exe

Filesize
570KB

MD5
9eb4fe183529c655eba749f8fb47b335

SHA1
b79bfc5796063019d7307ada17bc84084c7e9990

SHA256
62de75667849eaf159b01a0996e20e28c57fb7fa47f2e2f035f0a6e79f86e065

SHA512
2748e9b16f6ffd9ed23823031a66d96ece21b8b5d1534e7dd5a6419a94390d469c785619b803c1394ad853ba168aa1677a661158d4093da66011498d5345481b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s89183155.exe

Filesize
488KB

MD5
dee6e031a2d429af3c97b6e62572c162

SHA1
f4ffd3e2ee77c33795583b0cae9da9c18ba20752

SHA256
bc77263513e15e1c3644acdf2c78108adb6673e8bd8e28ac37d16d7642de8721

SHA512
20787cafb60e8f59ef27bd66295e6e707de1f5178dea9a4e2dd486ceac353c4c6c942e8e8de0965b5089629195223a359cdc994c5734c4d3c2567f2366def700

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s89183155.exe

Filesize
488KB

MD5
dee6e031a2d429af3c97b6e62572c162

SHA1
f4ffd3e2ee77c33795583b0cae9da9c18ba20752

SHA256
bc77263513e15e1c3644acdf2c78108adb6673e8bd8e28ac37d16d7642de8721

SHA512
20787cafb60e8f59ef27bd66295e6e707de1f5178dea9a4e2dd486ceac353c4c6c942e8e8de0965b5089629195223a359cdc994c5734c4d3c2567f2366def700

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t54576409.exe

Filesize
170KB

MD5
851d1031f7fc8a25bcd44733cd9ca354

SHA1
f3110f08bff21ab0a53ab796232145238f47f581

SHA256
d2659a2672012556a0504b1bd11f63a29c2b84bc8b6f2a4782412d9c99a68965

SHA512
bc4d39eadbec54eb13515e0c07f756e250dc0e0707a241fcf826a0e5443560351f923e9232a84e98674bfe6e68baada7ca370e2fdfb3e11cb5ec884fd52a3750

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t54576409.exe

Filesize
170KB

MD5
851d1031f7fc8a25bcd44733cd9ca354

SHA1
f3110f08bff21ab0a53ab796232145238f47f581

SHA256
d2659a2672012556a0504b1bd11f63a29c2b84bc8b6f2a4782412d9c99a68965

SHA512
bc4d39eadbec54eb13515e0c07f756e250dc0e0707a241fcf826a0e5443560351f923e9232a84e98674bfe6e68baada7ca370e2fdfb3e11cb5ec884fd52a3750

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
memory/648-196-0x0000000004E00000-0x0000000004E60000-memory.dmp

Filesize
384KB

Download
memory/648-212-0x0000000004E00000-0x0000000004E60000-memory.dmp

Filesize
384KB

Download
memory/648-165-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

Filesize
64KB

Download
memory/648-166-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

Filesize
64KB

Download
memory/648-167-0x0000000004E00000-0x0000000004E60000-memory.dmp

Filesize
384KB

Download
memory/648-168-0x0000000004E00000-0x0000000004E60000-memory.dmp

Filesize
384KB

Download
memory/648-170-0x0000000004E00000-0x0000000004E60000-memory.dmp

Filesize
384KB

Download
memory/648-172-0x0000000004E00000-0x0000000004E60000-memory.dmp

Filesize
384KB

Download
memory/648-174-0x0000000004E00000-0x0000000004E60000-memory.dmp

Filesize
384KB

Download
memory/648-176-0x0000000004E00000-0x0000000004E60000-memory.dmp

Filesize
384KB

Download
memory/648-180-0x0000000004E00000-0x0000000004E60000-memory.dmp

Filesize
384KB

Download
memory/648-178-0x0000000004E00000-0x0000000004E60000-memory.dmp

Filesize
384KB

Download
memory/648-182-0x0000000004E00000-0x0000000004E60000-memory.dmp

Filesize
384KB

Download
memory/648-184-0x0000000004E00000-0x0000000004E60000-memory.dmp

Filesize
384KB

Download
memory/648-186-0x0000000004E00000-0x0000000004E60000-memory.dmp

Filesize
384KB

Download
memory/648-188-0x0000000004E00000-0x0000000004E60000-memory.dmp

Filesize
384KB

Download
memory/648-190-0x0000000004E00000-0x0000000004E60000-memory.dmp

Filesize
384KB

Download
memory/648-194-0x0000000004E00000-0x0000000004E60000-memory.dmp

Filesize
384KB

Download
memory/648-192-0x0000000004E00000-0x0000000004E60000-memory.dmp

Filesize
384KB

Download
memory/648-163-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

Filesize
64KB

Download
memory/648-198-0x0000000004E00000-0x0000000004E60000-memory.dmp

Filesize
384KB

Download
memory/648-200-0x0000000004E00000-0x0000000004E60000-memory.dmp

Filesize
384KB

Download
memory/648-202-0x0000000004E00000-0x0000000004E60000-memory.dmp

Filesize
384KB

Download
memory/648-204-0x0000000004E00000-0x0000000004E60000-memory.dmp

Filesize
384KB

Download
memory/648-206-0x0000000004E00000-0x0000000004E60000-memory.dmp

Filesize
384KB

Download
memory/648-208-0x0000000004E00000-0x0000000004E60000-memory.dmp

Filesize
384KB

Download
memory/648-210-0x0000000004E00000-0x0000000004E60000-memory.dmp

Filesize
384KB

Download
memory/648-164-0x0000000004FE0000-0x0000000005584000-memory.dmp

Filesize
5.6MB

Download
memory/648-214-0x0000000004E00000-0x0000000004E60000-memory.dmp

Filesize
384KB

Download
memory/648-216-0x0000000004E00000-0x0000000004E60000-memory.dmp

Filesize
384KB

Download
memory/648-218-0x0000000004E00000-0x0000000004E60000-memory.dmp

Filesize
384KB

Download
memory/648-220-0x0000000004E00000-0x0000000004E60000-memory.dmp

Filesize
384KB

Download
memory/648-222-0x0000000004E00000-0x0000000004E60000-memory.dmp

Filesize
384KB

Download
memory/648-224-0x0000000004E00000-0x0000000004E60000-memory.dmp

Filesize
384KB

Download
memory/648-226-0x0000000004E00000-0x0000000004E60000-memory.dmp

Filesize
384KB

Download
memory/648-228-0x0000000004E00000-0x0000000004E60000-memory.dmp

Filesize
384KB

Download
memory/648-230-0x0000000004E00000-0x0000000004E60000-memory.dmp

Filesize
384KB

Download
memory/648-2315-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

Filesize
64KB

Download
memory/648-2316-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

Filesize
64KB

Download
memory/648-2317-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

Filesize
64KB

Download
memory/648-2320-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

Filesize
64KB

Download
memory/648-2339-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

Filesize
64KB

Download
memory/648-162-0x0000000002200000-0x000000000225B000-memory.dmp

Filesize
364KB

Download
memory/2728-2334-0x0000000005DD0000-0x00000000063E8000-memory.dmp

Filesize
6.1MB

Download
memory/2728-2335-0x00000000058C0000-0x00000000059CA000-memory.dmp

Filesize
1.0MB

Download
memory/2728-2336-0x0000000005760000-0x0000000005772000-memory.dmp

Filesize
72KB

Download
memory/2728-2337-0x00000000057F0000-0x000000000582C000-memory.dmp

Filesize
240KB

Download
memory/2728-2338-0x00000000057A0000-0x00000000057B0000-memory.dmp

Filesize
64KB

Download
memory/2728-2331-0x0000000000E20000-0x0000000000E4E000-memory.dmp

Filesize
184KB

Download
memory/2728-2341-0x00000000057A0000-0x00000000057B0000-memory.dmp

Filesize
64KB

Download
memory/4076-2346-0x0000000000B30000-0x0000000000B5E000-memory.dmp

Filesize
184KB

Download
memory/4076-2347-0x0000000002CB0000-0x0000000002CC0000-memory.dmp

Filesize
64KB

Download
memory/4076-2348-0x0000000002CB0000-0x0000000002CC0000-memory.dmp

Filesize
64KB

Download