Analysis
-
max time kernel
143s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
06-05-2023 23:29
Static task
static1
Behavioral task
behavioral1
Sample
16ff68bb78bfb6c9baa5b277880648d5c12e3d5f7574ab873e418a8aa2a55d54.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
16ff68bb78bfb6c9baa5b277880648d5c12e3d5f7574ab873e418a8aa2a55d54.exe
Resource
win10v2004-20230220-en
General
-
Target
16ff68bb78bfb6c9baa5b277880648d5c12e3d5f7574ab873e418a8aa2a55d54.exe
-
Size
1.2MB
-
MD5
5433cca7ba9fe515b731674dcf814dc8
-
SHA1
c56dd6b65a933e9be1977d0c06fb6777c712e188
-
SHA256
16ff68bb78bfb6c9baa5b277880648d5c12e3d5f7574ab873e418a8aa2a55d54
-
SHA512
436189acd7f396ccf6d1c0afb9648fb0813f4e8d8c1a8ab0af2ab85c7da1d0ec22f7a5027e434d060b7c67398645556f668c2c0b71c6a6fc15b87eb01fa3ae86
-
SSDEEP
24576:oy4REIZvY0myaP1HB6Ld2keaWGX1i79+q/aShme4zC:v4REI1lmyChoOaXX1ip+OaScz
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
life
185.161.248.73:4164
-
auth_value
8685d11953530b68ad5ec703809d9f91
Signatures
-
Detects Redline Stealer samples 1 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
Processes:
resource yara_rule behavioral2/memory/1728-2331-0x00000000054D0000-0x0000000005AE8000-memory.dmp redline_stealer -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
s89721865.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation s89721865.exe -
Executes dropped EXE 6 IoCs
Processes:
z33270660.exez38581761.exez11418588.exes89721865.exe1.exet51547459.exepid process 3652 z33270660.exe 3144 z38581761.exe 1724 z11418588.exe 5028 s89721865.exe 1728 1.exe 3904 t51547459.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
16ff68bb78bfb6c9baa5b277880648d5c12e3d5f7574ab873e418a8aa2a55d54.exez33270660.exez38581761.exez11418588.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 16ff68bb78bfb6c9baa5b277880648d5c12e3d5f7574ab873e418a8aa2a55d54.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 16ff68bb78bfb6c9baa5b277880648d5c12e3d5f7574ab873e418a8aa2a55d54.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z33270660.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z33270660.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z38581761.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z38581761.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z11418588.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z11418588.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 640 5028 WerFault.exe s89721865.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
s89721865.exedescription pid process Token: SeDebugPrivilege 5028 s89721865.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
16ff68bb78bfb6c9baa5b277880648d5c12e3d5f7574ab873e418a8aa2a55d54.exez33270660.exez38581761.exez11418588.exes89721865.exedescription pid process target process PID 3720 wrote to memory of 3652 3720 16ff68bb78bfb6c9baa5b277880648d5c12e3d5f7574ab873e418a8aa2a55d54.exe z33270660.exe PID 3720 wrote to memory of 3652 3720 16ff68bb78bfb6c9baa5b277880648d5c12e3d5f7574ab873e418a8aa2a55d54.exe z33270660.exe PID 3720 wrote to memory of 3652 3720 16ff68bb78bfb6c9baa5b277880648d5c12e3d5f7574ab873e418a8aa2a55d54.exe z33270660.exe PID 3652 wrote to memory of 3144 3652 z33270660.exe z38581761.exe PID 3652 wrote to memory of 3144 3652 z33270660.exe z38581761.exe PID 3652 wrote to memory of 3144 3652 z33270660.exe z38581761.exe PID 3144 wrote to memory of 1724 3144 z38581761.exe z11418588.exe PID 3144 wrote to memory of 1724 3144 z38581761.exe z11418588.exe PID 3144 wrote to memory of 1724 3144 z38581761.exe z11418588.exe PID 1724 wrote to memory of 5028 1724 z11418588.exe s89721865.exe PID 1724 wrote to memory of 5028 1724 z11418588.exe s89721865.exe PID 1724 wrote to memory of 5028 1724 z11418588.exe s89721865.exe PID 5028 wrote to memory of 1728 5028 s89721865.exe 1.exe PID 5028 wrote to memory of 1728 5028 s89721865.exe 1.exe PID 5028 wrote to memory of 1728 5028 s89721865.exe 1.exe PID 1724 wrote to memory of 3904 1724 z11418588.exe t51547459.exe PID 1724 wrote to memory of 3904 1724 z11418588.exe t51547459.exe PID 1724 wrote to memory of 3904 1724 z11418588.exe t51547459.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\16ff68bb78bfb6c9baa5b277880648d5c12e3d5f7574ab873e418a8aa2a55d54.exe"C:\Users\Admin\AppData\Local\Temp\16ff68bb78bfb6c9baa5b277880648d5c12e3d5f7574ab873e418a8aa2a55d54.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z33270660.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z33270660.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z38581761.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z38581761.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z11418588.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z11418588.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s89721865.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s89721865.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 13766⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t51547459.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t51547459.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 5028 -ip 50281⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z33270660.exeFilesize
1.0MB
MD547c7b4a6f6cd6c030c5ee35e09b843cf
SHA1a433e39d8a55a4812e1da69d58ae9ac905b98ba6
SHA256ed0ef773800ede4129ba0e0196c7af410fcb11634a686df3424c0351160dac41
SHA5120562fe290625d58a884ac7e1e248f12e5a4b259bcb45ccbc44e1f2f37d141ea4946f6e1efca2a7ad4f3115b671934106be084c3f597c87635eeb33cd8e4b2062
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z33270660.exeFilesize
1.0MB
MD547c7b4a6f6cd6c030c5ee35e09b843cf
SHA1a433e39d8a55a4812e1da69d58ae9ac905b98ba6
SHA256ed0ef773800ede4129ba0e0196c7af410fcb11634a686df3424c0351160dac41
SHA5120562fe290625d58a884ac7e1e248f12e5a4b259bcb45ccbc44e1f2f37d141ea4946f6e1efca2a7ad4f3115b671934106be084c3f597c87635eeb33cd8e4b2062
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z38581761.exeFilesize
752KB
MD566d29ae6e3ee44a1094e867abfcd8a2a
SHA1f336573fec8f58d465733ebfa0619a6a86cfa8ee
SHA256829f0ab240d140ae0d4dfb32cf295e2f3ded4d47bdf8117afa43741ad56d27f5
SHA512abb0e09d9a2c5b025c54241be3162bddfaeaab5f3871ccc0f10c493ad5f862b7d05df297a88a448a3d8c103388d501fee018544e912775a4bb63e5a0635c441d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z38581761.exeFilesize
752KB
MD566d29ae6e3ee44a1094e867abfcd8a2a
SHA1f336573fec8f58d465733ebfa0619a6a86cfa8ee
SHA256829f0ab240d140ae0d4dfb32cf295e2f3ded4d47bdf8117afa43741ad56d27f5
SHA512abb0e09d9a2c5b025c54241be3162bddfaeaab5f3871ccc0f10c493ad5f862b7d05df297a88a448a3d8c103388d501fee018544e912775a4bb63e5a0635c441d
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z11418588.exeFilesize
569KB
MD55759b68ae429abd57465a21627eedb1c
SHA1b9f553626517fe5ebb1e3c9bfb936504bc8ae3b6
SHA2562b72bd6cfd4059da3eb711d6929ca5c4d74c8347d891948175f357eb995bb26c
SHA5127dceac730ae6307bafe0ac6bd198521cd743a0d354e551622139b28a382737ff06cac2d2bfd1b29820cf027fa96078a7fce6cb20910a5cb5c130842f6f6d5ef7
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z11418588.exeFilesize
569KB
MD55759b68ae429abd57465a21627eedb1c
SHA1b9f553626517fe5ebb1e3c9bfb936504bc8ae3b6
SHA2562b72bd6cfd4059da3eb711d6929ca5c4d74c8347d891948175f357eb995bb26c
SHA5127dceac730ae6307bafe0ac6bd198521cd743a0d354e551622139b28a382737ff06cac2d2bfd1b29820cf027fa96078a7fce6cb20910a5cb5c130842f6f6d5ef7
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s89721865.exeFilesize
488KB
MD500892fa343a0d16e841b6a0b2e9b325b
SHA11ad113a302dd1cf3c5565d50300cfdc40b01e8b7
SHA256cc5913520cde774c0a10283b8166614923c17ed4475c686e5ba0e4bdd2ade28f
SHA512e282e5c24847fa50c80a69f2a2f652802585e8d49212f6accf54c36714604e32c45068b6ce2b0fe8589cee6e2c26324efad097b3e1781008a176b31232867cec
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s89721865.exeFilesize
488KB
MD500892fa343a0d16e841b6a0b2e9b325b
SHA11ad113a302dd1cf3c5565d50300cfdc40b01e8b7
SHA256cc5913520cde774c0a10283b8166614923c17ed4475c686e5ba0e4bdd2ade28f
SHA512e282e5c24847fa50c80a69f2a2f652802585e8d49212f6accf54c36714604e32c45068b6ce2b0fe8589cee6e2c26324efad097b3e1781008a176b31232867cec
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t51547459.exeFilesize
169KB
MD53502840e9f62ce8bebc683d54434082d
SHA11ac5f5636166bb5cb850bc79a93c474727e48d81
SHA2568dc3d9f1ddcab5366fa69d1f9c2a995060fe8df319dffdbfa9ac67afa4713bfe
SHA51209fc4208cd2598c093dd932e9a6aff7df3f4875fe30e645cb47565f37a134a1a58a8160d401331eb42de9e137ccc93335774025d9fd009010cb4256c2bf70a7a
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t51547459.exeFilesize
169KB
MD53502840e9f62ce8bebc683d54434082d
SHA11ac5f5636166bb5cb850bc79a93c474727e48d81
SHA2568dc3d9f1ddcab5366fa69d1f9c2a995060fe8df319dffdbfa9ac67afa4713bfe
SHA51209fc4208cd2598c093dd932e9a6aff7df3f4875fe30e645cb47565f37a134a1a58a8160d401331eb42de9e137ccc93335774025d9fd009010cb4256c2bf70a7a
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
memory/1728-2334-0x0000000004EA0000-0x0000000004EB0000-memory.dmpFilesize
64KB
-
memory/1728-2335-0x0000000004F30000-0x0000000004F6C000-memory.dmpFilesize
240KB
-
memory/1728-2333-0x0000000004ED0000-0x0000000004EE2000-memory.dmpFilesize
72KB
-
memory/1728-2332-0x0000000004FC0000-0x00000000050CA000-memory.dmpFilesize
1.0MB
-
memory/1728-2331-0x00000000054D0000-0x0000000005AE8000-memory.dmpFilesize
6.1MB
-
memory/1728-2327-0x0000000000580000-0x00000000005AE000-memory.dmpFilesize
184KB
-
memory/1728-2344-0x0000000004EA0000-0x0000000004EB0000-memory.dmpFilesize
64KB
-
memory/3904-2342-0x0000000000F50000-0x0000000000F7E000-memory.dmpFilesize
184KB
-
memory/3904-2343-0x00000000031C0000-0x00000000031D0000-memory.dmpFilesize
64KB
-
memory/3904-2345-0x00000000031C0000-0x00000000031D0000-memory.dmpFilesize
64KB
-
memory/5028-173-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/5028-228-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/5028-190-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/5028-192-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/5028-194-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/5028-196-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/5028-198-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/5028-200-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/5028-204-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/5028-206-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/5028-202-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/5028-208-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/5028-210-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/5028-212-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/5028-214-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/5028-216-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/5028-218-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/5028-220-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/5028-222-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/5028-224-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/5028-226-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/5028-188-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/5028-230-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/5028-2315-0x0000000004EA0000-0x0000000004EB0000-memory.dmpFilesize
64KB
-
memory/5028-186-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/5028-184-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/5028-182-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/5028-180-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/5028-2328-0x0000000004EA0000-0x0000000004EB0000-memory.dmpFilesize
64KB
-
memory/5028-2329-0x0000000004EA0000-0x0000000004EB0000-memory.dmpFilesize
64KB
-
memory/5028-2330-0x0000000004EA0000-0x0000000004EB0000-memory.dmpFilesize
64KB
-
memory/5028-178-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/5028-176-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/5028-174-0x0000000004EA0000-0x0000000004EB0000-memory.dmpFilesize
64KB
-
memory/5028-171-0x0000000004EA0000-0x0000000004EB0000-memory.dmpFilesize
64KB
-
memory/5028-170-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/5028-2337-0x0000000004EA0000-0x0000000004EB0000-memory.dmpFilesize
64KB
-
memory/5028-167-0x0000000000910000-0x000000000096B000-memory.dmpFilesize
364KB
-
memory/5028-169-0x0000000004EA0000-0x0000000004EB0000-memory.dmpFilesize
64KB
-
memory/5028-166-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/5028-164-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/5028-163-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/5028-162-0x0000000004EB0000-0x0000000005454000-memory.dmpFilesize
5.6MB