redline | 0a798259526762d68920a658209b0e6416f495a2127e182c135bff029f5ba8eb

Analysis

max time kernel
152s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06-05-2023 22:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a798259526762d68920a658209b0e6416f495a2127e182c135bff029f5ba8eb.exe
Size

1.2MB
MD5

fc81f8ae4764baf58422360378dcc1d1
SHA1

6fce0e598acc363480c335c832abe90c13d2424a
SHA256

0a798259526762d68920a658209b0e6416f495a2127e182c135bff029f5ba8eb
SHA512

46dc9a8c3d74031b0a8b9672959479204482da291d4e187b45a77714514ce15ee27da3c0e47552157ecf2fa204706c8c9eb38826a5906e49d658b9355a2649e3
SSDEEP

24576:dyzLpnrPguE1MyaCLUA1FsyfNh/JS+38nvdSwsDKTM53:4v5KaCgA1FsYNtKvDsDKT

Score

10^/10

redline gena life infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

gena

185.161.248.73:4164

Attributes

auth_value
d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

life

185.161.248.73:4164

Attributes

auth_value
8685d11953530b68ad5ec703809d9f91

Signatures

Detects Redline Stealer samples 1 IoCs

This rule detects the presence of Redline Stealer samples based on their unique strings.

stealer

Processes:

resource	yara_rule
behavioral2/memory/768-2334-0x000000000A960000-0x000000000AF78000-memory.dmp	redline_stealer

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

s89183155.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	s89183155.exe

Executes dropped EXE 6 IoCs

Processes:

z25338459.exez81714914.exez88885603.exes89183155.exe1.exet54576409.exe

pid process

4880 z25338459.exe
1920 z81714914.exe
1708 z88885603.exe
2408 s89183155.exe
768 1.exe
2320 t54576409.exe

pid	process
4880	z25338459.exe
1920	z81714914.exe
1708	z88885603.exe
2408	s89183155.exe
768	1.exe
2320	t54576409.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0a798259526762d68920a658209b0e6416f495a2127e182c135bff029f5ba8eb.exez25338459.exez81714914.exez88885603.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	0a798259526762d68920a658209b0e6416f495a2127e182c135bff029f5ba8eb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	0a798259526762d68920a658209b0e6416f495a2127e182c135bff029f5ba8eb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z25338459.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z25338459.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z81714914.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z81714914.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z88885603.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z88885603.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1924 2408 WerFault.exe s89183155.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

s89183155.exe

description pid process

Token: SeDebugPrivilege 2408 s89183155.exe

pid	pid_target	process	target process
1924	2408	WerFault.exe	s89183155.exe

description	pid	process
Token: SeDebugPrivilege	2408	s89183155.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

0a798259526762d68920a658209b0e6416f495a2127e182c135bff029f5ba8eb.exez25338459.exez81714914.exez88885603.exes89183155.exe

description	pid	process	target process
PID 1324 wrote to memory of 4880	1324	0a798259526762d68920a658209b0e6416f495a2127e182c135bff029f5ba8eb.exe	z25338459.exe
PID 1324 wrote to memory of 4880	1324	0a798259526762d68920a658209b0e6416f495a2127e182c135bff029f5ba8eb.exe	z25338459.exe
PID 1324 wrote to memory of 4880	1324	0a798259526762d68920a658209b0e6416f495a2127e182c135bff029f5ba8eb.exe	z25338459.exe
PID 4880 wrote to memory of 1920	4880	z25338459.exe	z81714914.exe
PID 4880 wrote to memory of 1920	4880	z25338459.exe	z81714914.exe
PID 4880 wrote to memory of 1920	4880	z25338459.exe	z81714914.exe
PID 1920 wrote to memory of 1708	1920	z81714914.exe	z88885603.exe
PID 1920 wrote to memory of 1708	1920	z81714914.exe	z88885603.exe
PID 1920 wrote to memory of 1708	1920	z81714914.exe	z88885603.exe
PID 1708 wrote to memory of 2408	1708	z88885603.exe	s89183155.exe
PID 1708 wrote to memory of 2408	1708	z88885603.exe	s89183155.exe
PID 1708 wrote to memory of 2408	1708	z88885603.exe	s89183155.exe
PID 2408 wrote to memory of 768	2408	s89183155.exe	1.exe
PID 2408 wrote to memory of 768	2408	s89183155.exe	1.exe
PID 2408 wrote to memory of 768	2408	s89183155.exe	1.exe
PID 1708 wrote to memory of 2320	1708	z88885603.exe	t54576409.exe
PID 1708 wrote to memory of 2320	1708	z88885603.exe	t54576409.exe
PID 1708 wrote to memory of 2320	1708	z88885603.exe	t54576409.exe

C:\Users\Admin\AppData\Local\Temp\0a798259526762d68920a658209b0e6416f495a2127e182c135bff029f5ba8eb.exe
"C:\Users\Admin\AppData\Local\Temp\0a798259526762d68920a658209b0e6416f495a2127e182c135bff029f5ba8eb.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1324

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z25338459.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z25338459.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4880

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z81714914.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z81714914.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1920

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z88885603.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z88885603.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1708

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s89183155.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s89183155.exe
5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2408

C:\Windows\Temp\1.exe
"C:\Windows\Temp\1.exe"
6⤵
- Executes dropped EXE
PID:768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 1384
6⤵
- Program crash
PID:1924

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t54576409.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t54576409.exe
5⤵
- Executes dropped EXE
PID:2320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2408 -ip 2408
1⤵
PID:1828

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z25338459.exe
Filesize
1.0MB

MD5
60a2f52ff9556f92032a812b24dfc4ee

SHA1
5216048132b4f507839bb686037b39e3aedf2d6d

SHA256
ef3153474ede9f02e0a737948666db35d05e082fff6cf518f01524a023f3bf51

SHA512
c849c016b17a6171013f4020486f1287ef18ecb9e865cc0ca74af739256ec4a38ea4339147d27940d6df5f6657efe308e9be62172f0a90c5d9f52020d6c59859

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z25338459.exe
Filesize
1.0MB

MD5
60a2f52ff9556f92032a812b24dfc4ee

SHA1
5216048132b4f507839bb686037b39e3aedf2d6d

SHA256
ef3153474ede9f02e0a737948666db35d05e082fff6cf518f01524a023f3bf51

SHA512
c849c016b17a6171013f4020486f1287ef18ecb9e865cc0ca74af739256ec4a38ea4339147d27940d6df5f6657efe308e9be62172f0a90c5d9f52020d6c59859

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z81714914.exe
Filesize
753KB

MD5
2594aebeef67a9d17be886f881b40755

SHA1
fe5dda6aad2552759f98fb21d743d63064ddd32e

SHA256
0b183a8b9e9b84e8809e3e7d1695b6f27ef23fa09b10ec89c5c44f2a78e71393

SHA512
3780fbfea71e5fb2dce163110e2acf1e50498c38f1ec44791be2622b733439d146a8dadfa29be5975840cdf3bebbe26e592e6530c4ecbb46c0541ae06fa7d61a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z81714914.exe
Filesize
753KB

MD5
2594aebeef67a9d17be886f881b40755

SHA1
fe5dda6aad2552759f98fb21d743d63064ddd32e

SHA256
0b183a8b9e9b84e8809e3e7d1695b6f27ef23fa09b10ec89c5c44f2a78e71393

SHA512
3780fbfea71e5fb2dce163110e2acf1e50498c38f1ec44791be2622b733439d146a8dadfa29be5975840cdf3bebbe26e592e6530c4ecbb46c0541ae06fa7d61a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z88885603.exe
Filesize
570KB

MD5
9eb4fe183529c655eba749f8fb47b335

SHA1
b79bfc5796063019d7307ada17bc84084c7e9990

SHA256
62de75667849eaf159b01a0996e20e28c57fb7fa47f2e2f035f0a6e79f86e065

SHA512
2748e9b16f6ffd9ed23823031a66d96ece21b8b5d1534e7dd5a6419a94390d469c785619b803c1394ad853ba168aa1677a661158d4093da66011498d5345481b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z88885603.exe
Filesize
570KB

MD5
9eb4fe183529c655eba749f8fb47b335

SHA1
b79bfc5796063019d7307ada17bc84084c7e9990

SHA256
62de75667849eaf159b01a0996e20e28c57fb7fa47f2e2f035f0a6e79f86e065

SHA512
2748e9b16f6ffd9ed23823031a66d96ece21b8b5d1534e7dd5a6419a94390d469c785619b803c1394ad853ba168aa1677a661158d4093da66011498d5345481b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s89183155.exe
Filesize
488KB

MD5
dee6e031a2d429af3c97b6e62572c162

SHA1
f4ffd3e2ee77c33795583b0cae9da9c18ba20752

SHA256
bc77263513e15e1c3644acdf2c78108adb6673e8bd8e28ac37d16d7642de8721

SHA512
20787cafb60e8f59ef27bd66295e6e707de1f5178dea9a4e2dd486ceac353c4c6c942e8e8de0965b5089629195223a359cdc994c5734c4d3c2567f2366def700

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s89183155.exe
Filesize
488KB

MD5
dee6e031a2d429af3c97b6e62572c162

SHA1
f4ffd3e2ee77c33795583b0cae9da9c18ba20752

SHA256
bc77263513e15e1c3644acdf2c78108adb6673e8bd8e28ac37d16d7642de8721

SHA512
20787cafb60e8f59ef27bd66295e6e707de1f5178dea9a4e2dd486ceac353c4c6c942e8e8de0965b5089629195223a359cdc994c5734c4d3c2567f2366def700

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t54576409.exe
Filesize
170KB

MD5
851d1031f7fc8a25bcd44733cd9ca354

SHA1
f3110f08bff21ab0a53ab796232145238f47f581

SHA256
d2659a2672012556a0504b1bd11f63a29c2b84bc8b6f2a4782412d9c99a68965

SHA512
bc4d39eadbec54eb13515e0c07f756e250dc0e0707a241fcf826a0e5443560351f923e9232a84e98674bfe6e68baada7ca370e2fdfb3e11cb5ec884fd52a3750

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t54576409.exe
Filesize
170KB

MD5
851d1031f7fc8a25bcd44733cd9ca354

SHA1
f3110f08bff21ab0a53ab796232145238f47f581

SHA256
d2659a2672012556a0504b1bd11f63a29c2b84bc8b6f2a4782412d9c99a68965

SHA512
bc4d39eadbec54eb13515e0c07f756e250dc0e0707a241fcf826a0e5443560351f923e9232a84e98674bfe6e68baada7ca370e2fdfb3e11cb5ec884fd52a3750

Download Submit
C:\Windows\Temp\1.exe
Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
C:\Windows\Temp\1.exe
Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
C:\Windows\Temp\1.exe
Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
memory/768-2346-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

Filesize
64KB

Download
memory/768-2334-0x000000000A960000-0x000000000AF78000-memory.dmp

Filesize
6.1MB

Download
memory/768-2332-0x00000000005D0000-0x00000000005FE000-memory.dmp

Filesize
184KB

Download
memory/768-2338-0x000000000A3A0000-0x000000000A3DC000-memory.dmp

Filesize
240KB

Download
memory/768-2337-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

Filesize
64KB

Download
memory/768-2336-0x000000000A340000-0x000000000A352000-memory.dmp

Filesize
72KB

Download
memory/768-2335-0x000000000A450000-0x000000000A55A000-memory.dmp

Filesize
1.0MB

Download
memory/2320-2347-0x0000000004990000-0x00000000049A0000-memory.dmp

Filesize
64KB

Download
memory/2320-2345-0x0000000004990000-0x00000000049A0000-memory.dmp

Filesize
64KB

Download
memory/2320-2344-0x0000000000140000-0x000000000016E000-memory.dmp

Filesize
184KB

Download
memory/2408-194-0x00000000028D0000-0x0000000002930000-memory.dmp

Filesize
384KB

Download
memory/2408-218-0x00000000028D0000-0x0000000002930000-memory.dmp

Filesize
384KB

Download
memory/2408-180-0x00000000028D0000-0x0000000002930000-memory.dmp

Filesize
384KB

Download
memory/2408-182-0x00000000028D0000-0x0000000002930000-memory.dmp

Filesize
384KB

Download
memory/2408-184-0x00000000028D0000-0x0000000002930000-memory.dmp

Filesize
384KB

Download
memory/2408-188-0x00000000028D0000-0x0000000002930000-memory.dmp

Filesize
384KB

Download
memory/2408-190-0x00000000028D0000-0x0000000002930000-memory.dmp

Filesize
384KB

Download
memory/2408-186-0x00000000028D0000-0x0000000002930000-memory.dmp

Filesize
384KB

Download
memory/2408-192-0x00000000028D0000-0x0000000002930000-memory.dmp

Filesize
384KB

Download
memory/2408-176-0x00000000028D0000-0x0000000002930000-memory.dmp

Filesize
384KB

Download
memory/2408-196-0x00000000028D0000-0x0000000002930000-memory.dmp

Filesize
384KB

Download
memory/2408-198-0x00000000028D0000-0x0000000002930000-memory.dmp

Filesize
384KB

Download
memory/2408-200-0x00000000028D0000-0x0000000002930000-memory.dmp

Filesize
384KB

Download
memory/2408-202-0x00000000028D0000-0x0000000002930000-memory.dmp

Filesize
384KB

Download
memory/2408-204-0x00000000028D0000-0x0000000002930000-memory.dmp

Filesize
384KB

Download
memory/2408-206-0x00000000028D0000-0x0000000002930000-memory.dmp

Filesize
384KB

Download
memory/2408-208-0x00000000028D0000-0x0000000002930000-memory.dmp

Filesize
384KB

Download
memory/2408-210-0x00000000028D0000-0x0000000002930000-memory.dmp

Filesize
384KB

Download
memory/2408-212-0x00000000028D0000-0x0000000002930000-memory.dmp

Filesize
384KB

Download
memory/2408-214-0x00000000028D0000-0x0000000002930000-memory.dmp

Filesize
384KB

Download
memory/2408-216-0x00000000028D0000-0x0000000002930000-memory.dmp

Filesize
384KB

Download
memory/2408-178-0x00000000028D0000-0x0000000002930000-memory.dmp

Filesize
384KB

Download
memory/2408-220-0x00000000028D0000-0x0000000002930000-memory.dmp

Filesize
384KB

Download
memory/2408-222-0x00000000028D0000-0x0000000002930000-memory.dmp

Filesize
384KB

Download
memory/2408-224-0x00000000028D0000-0x0000000002930000-memory.dmp

Filesize
384KB

Download
memory/2408-226-0x00000000028D0000-0x0000000002930000-memory.dmp

Filesize
384KB

Download
memory/2408-228-0x00000000028D0000-0x0000000002930000-memory.dmp

Filesize
384KB

Download
memory/2408-230-0x00000000028D0000-0x0000000002930000-memory.dmp

Filesize
384KB

Download
memory/2408-2314-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

Filesize
64KB

Download
memory/2408-174-0x00000000028D0000-0x0000000002930000-memory.dmp

Filesize
384KB

Download
memory/2408-172-0x00000000028D0000-0x0000000002930000-memory.dmp

Filesize
384KB

Download
memory/2408-170-0x00000000028D0000-0x0000000002930000-memory.dmp

Filesize
384KB

Download
memory/2408-168-0x00000000028D0000-0x0000000002930000-memory.dmp

Filesize
384KB

Download
memory/2408-167-0x00000000028D0000-0x0000000002930000-memory.dmp

Filesize
384KB

Download
memory/2408-166-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

Filesize
64KB

Download
memory/2408-165-0x0000000004FF0000-0x0000000005594000-memory.dmp

Filesize
5.6MB

Download
memory/2408-164-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

Filesize
64KB

Download
memory/2408-163-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

Filesize
64KB

Download
memory/2408-162-0x00000000008F0000-0x000000000094B000-memory.dmp

Filesize
364KB

Download
memory/2408-2315-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

Filesize
64KB

Download
memory/2408-2316-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

Filesize
64KB

Download
memory/2408-2317-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

Filesize
64KB

Download
memory/2408-2327-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

Filesize
64KB

Download