redline | 05c6d58e57ca0c03f52bc53a24359a6ed653be12e1477d083c842bb60fd7dcd8

Analysis

max time kernel
144s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06-05-2023 20:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05c6d58e57ca0c03f52bc53a24359a6ed653be12e1477d083c842bb60fd7dcd8.bin.exe
Size

1.2MB
MD5

f1ce68048ca3eb6db7c572e1cff99deb
SHA1

b834f00374a965c18b32562bd1a48abc097ca606
SHA256

05c6d58e57ca0c03f52bc53a24359a6ed653be12e1477d083c842bb60fd7dcd8
SHA512

51202095441630c6c8ee6119804e14951ee87a233bd006b2480dd80f7d96293e4b3e2e91ba080d7294646ee5b83e65860e1942623e6a5bf75b7ac075145386c5
SSDEEP

24576:NyQAMgxtsHeAOXGIsXqrOs3HQJzKaAWUGRRyRgV5JDGIANc:oQ/ot2XO2TXX8QJzqWUil5JDGI

Score

10^/10

redline gena life infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

gena

185.161.248.73:4164

Attributes

auth_value
d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

life

185.161.248.73:4164

Attributes

auth_value
8685d11953530b68ad5ec703809d9f91

Signatures

Detects Redline Stealer samples 1 IoCs

This rule detects the presence of Redline Stealer samples based on their unique strings.

stealer

Processes:

resource	yara_rule
behavioral2/memory/540-2337-0x000000000B170000-0x000000000B788000-memory.dmp	redline_stealer

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

s14342626.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	s14342626.exe

Executes dropped EXE 6 IoCs

Processes:

z68398999.exez05062584.exez51704119.exes14342626.exe1.exet09613204.exe

pid process

632 z68398999.exe
3384 z05062584.exe
3672 z51704119.exe
1796 s14342626.exe
4860 1.exe
540 t09613204.exe

pid	process
632	z68398999.exe
3384	z05062584.exe
3672	z51704119.exe
1796	s14342626.exe
4860	1.exe
540	t09613204.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

z51704119.exe05c6d58e57ca0c03f52bc53a24359a6ed653be12e1477d083c842bb60fd7dcd8.bin.exez68398999.exez05062584.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z51704119.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z51704119.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	05c6d58e57ca0c03f52bc53a24359a6ed653be12e1477d083c842bb60fd7dcd8.bin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	05c6d58e57ca0c03f52bc53a24359a6ed653be12e1477d083c842bb60fd7dcd8.bin.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z68398999.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z68398999.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z05062584.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z05062584.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

s14342626.exe

description pid process

Token: SeDebugPrivilege 1796 s14342626.exe

description	pid	process
Token: SeDebugPrivilege	1796	s14342626.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

05c6d58e57ca0c03f52bc53a24359a6ed653be12e1477d083c842bb60fd7dcd8.bin.exez68398999.exez05062584.exez51704119.exes14342626.exe

description	pid	process	target process
PID 2916 wrote to memory of 632	2916	05c6d58e57ca0c03f52bc53a24359a6ed653be12e1477d083c842bb60fd7dcd8.bin.exe	z68398999.exe
PID 2916 wrote to memory of 632	2916	05c6d58e57ca0c03f52bc53a24359a6ed653be12e1477d083c842bb60fd7dcd8.bin.exe	z68398999.exe
PID 2916 wrote to memory of 632	2916	05c6d58e57ca0c03f52bc53a24359a6ed653be12e1477d083c842bb60fd7dcd8.bin.exe	z68398999.exe
PID 632 wrote to memory of 3384	632	z68398999.exe	z05062584.exe
PID 632 wrote to memory of 3384	632	z68398999.exe	z05062584.exe
PID 632 wrote to memory of 3384	632	z68398999.exe	z05062584.exe
PID 3384 wrote to memory of 3672	3384	z05062584.exe	z51704119.exe
PID 3384 wrote to memory of 3672	3384	z05062584.exe	z51704119.exe
PID 3384 wrote to memory of 3672	3384	z05062584.exe	z51704119.exe
PID 3672 wrote to memory of 1796	3672	z51704119.exe	s14342626.exe
PID 3672 wrote to memory of 1796	3672	z51704119.exe	s14342626.exe
PID 3672 wrote to memory of 1796	3672	z51704119.exe	s14342626.exe
PID 1796 wrote to memory of 4860	1796	s14342626.exe	1.exe
PID 1796 wrote to memory of 4860	1796	s14342626.exe	1.exe
PID 1796 wrote to memory of 4860	1796	s14342626.exe	1.exe
PID 3672 wrote to memory of 540	3672	z51704119.exe	t09613204.exe
PID 3672 wrote to memory of 540	3672	z51704119.exe	t09613204.exe
PID 3672 wrote to memory of 540	3672	z51704119.exe	t09613204.exe

C:\Users\Admin\AppData\Local\Temp\05c6d58e57ca0c03f52bc53a24359a6ed653be12e1477d083c842bb60fd7dcd8.bin.exe
"C:\Users\Admin\AppData\Local\Temp\05c6d58e57ca0c03f52bc53a24359a6ed653be12e1477d083c842bb60fd7dcd8.bin.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2916

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z68398999.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z68398999.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:632

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z05062584.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z05062584.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3384

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z51704119.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z51704119.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3672

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s14342626.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s14342626.exe
5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1796

C:\Windows\Temp\1.exe
"C:\Windows\Temp\1.exe"
6⤵
- Executes dropped EXE
PID:4860

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t09613204.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t09613204.exe
5⤵
- Executes dropped EXE
PID:540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z68398999.exe
Filesize
1.0MB

MD5
82cf535953d37308b564fac38989748d

SHA1
6ee8d4fbe68c7e1bd3d3c4279933e4da09e5b806

SHA256
76c6ade0c5b7e74cf50a8997d253ae0e4e913543b103cd9c94b4d84d328c15df

SHA512
ec0a71bcb79c885a56e293a391d127ef10506e09e04416879cb127301bfb0ef06204abd613c603cf84540e93d2a8420761240892bbc0acea96f547679fd93132

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z68398999.exe
Filesize
1.0MB

MD5
82cf535953d37308b564fac38989748d

SHA1
6ee8d4fbe68c7e1bd3d3c4279933e4da09e5b806

SHA256
76c6ade0c5b7e74cf50a8997d253ae0e4e913543b103cd9c94b4d84d328c15df

SHA512
ec0a71bcb79c885a56e293a391d127ef10506e09e04416879cb127301bfb0ef06204abd613c603cf84540e93d2a8420761240892bbc0acea96f547679fd93132

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z05062584.exe
Filesize
764KB

MD5
80cb17aee4360ab91b51bdc670810e2e

SHA1
80695f176819f129e9298d350b8df2bc3ffa5659

SHA256
2aba067152837731e48bce809015962774ed129c84a87cf4b01b1807d0798890

SHA512
5511dc0bbd2eb260c3edeef4b3f1c0f56c542274ccdac4882382b10daf2be0032f099bfda51938670a0bb78d73bd0a534126361f3c321768f824fffff175a59a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z05062584.exe
Filesize
764KB

MD5
80cb17aee4360ab91b51bdc670810e2e

SHA1
80695f176819f129e9298d350b8df2bc3ffa5659

SHA256
2aba067152837731e48bce809015962774ed129c84a87cf4b01b1807d0798890

SHA512
5511dc0bbd2eb260c3edeef4b3f1c0f56c542274ccdac4882382b10daf2be0032f099bfda51938670a0bb78d73bd0a534126361f3c321768f824fffff175a59a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z51704119.exe
Filesize
582KB

MD5
d7158851b9e1900fec2af64a98e087b8

SHA1
80425c700ed3a5268ae5e334d955a74cbd5f41cf

SHA256
9ea4e14db96d63b426f6fbd99f6dc66e67df761a616507e935930d0b14032a6e

SHA512
6ab3bf4bca05bed75ece5a7864aafcfc67cff25295eac328a080e67bebb8bfa2358a1f96b4ed20a3ecdbdf6c7b57b3f6110489d1ce7f39dd1d7aee3b79e1200f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z51704119.exe
Filesize
582KB

MD5
d7158851b9e1900fec2af64a98e087b8

SHA1
80425c700ed3a5268ae5e334d955a74cbd5f41cf

SHA256
9ea4e14db96d63b426f6fbd99f6dc66e67df761a616507e935930d0b14032a6e

SHA512
6ab3bf4bca05bed75ece5a7864aafcfc67cff25295eac328a080e67bebb8bfa2358a1f96b4ed20a3ecdbdf6c7b57b3f6110489d1ce7f39dd1d7aee3b79e1200f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s14342626.exe
Filesize
582KB

MD5
d60649ee0d6de2bbafe4a69110225aa3

SHA1
45f5b83081621b4fa1140070b8d06fbea38ec1d2

SHA256
be6eebf3c44a077b4c6114009e41e4094bdc6e8c512984833e6476c7ebdcfc81

SHA512
78413881e48f7fb17b6df9f4c339a1fe92a8c9cb0bcd5df38a60780d5cbd0f7d6af37daa23dc359f1d7027f8faccd0fa31e962fec22bcb250c1efba82672e7a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s14342626.exe
Filesize
582KB

MD5
d60649ee0d6de2bbafe4a69110225aa3

SHA1
45f5b83081621b4fa1140070b8d06fbea38ec1d2

SHA256
be6eebf3c44a077b4c6114009e41e4094bdc6e8c512984833e6476c7ebdcfc81

SHA512
78413881e48f7fb17b6df9f4c339a1fe92a8c9cb0bcd5df38a60780d5cbd0f7d6af37daa23dc359f1d7027f8faccd0fa31e962fec22bcb250c1efba82672e7a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t09613204.exe
Filesize
169KB

MD5
e13ebd7cd905fb692310eebe2edd2404

SHA1
5a066658781ab8584ae805ccea27646afc91aa48

SHA256
47d04c1a981fc6a9799811b4eba93ecab4df931ac6d674e7749970d231704653

SHA512
b394da4721ce82267ee45e3aaf37abdc09fe19b3fb184705f283229ac035faa77da64ae1214354d4042ef117c646243a693ba0c801241102c65e4fc2f9b1bd7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t09613204.exe
Filesize
169KB

MD5
e13ebd7cd905fb692310eebe2edd2404

SHA1
5a066658781ab8584ae805ccea27646afc91aa48

SHA256
47d04c1a981fc6a9799811b4eba93ecab4df931ac6d674e7749970d231704653

SHA512
b394da4721ce82267ee45e3aaf37abdc09fe19b3fb184705f283229ac035faa77da64ae1214354d4042ef117c646243a693ba0c801241102c65e4fc2f9b1bd7f

Download Submit
C:\Windows\Temp\1.exe
Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
C:\Windows\Temp\1.exe
Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
C:\Windows\Temp\1.exe
Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
memory/540-2343-0x00000000057C0000-0x00000000057D0000-memory.dmp

Filesize
64KB

Download
memory/540-2336-0x0000000000E90000-0x0000000000EBE000-memory.dmp

Filesize
184KB

Download
memory/540-2337-0x000000000B170000-0x000000000B788000-memory.dmp

Filesize
6.1MB

Download
memory/540-2340-0x00000000057C0000-0x00000000057D0000-memory.dmp

Filesize
64KB

Download
memory/540-2342-0x000000000AC60000-0x000000000AC9C000-memory.dmp

Filesize
240KB

Download
memory/1796-207-0x0000000005540000-0x00000000055A0000-memory.dmp

Filesize
384KB

Download
memory/1796-222-0x0000000005540000-0x00000000055A0000-memory.dmp

Filesize
384KB

Download
memory/1796-183-0x0000000005540000-0x00000000055A0000-memory.dmp

Filesize
384KB

Download
memory/1796-185-0x0000000005540000-0x00000000055A0000-memory.dmp

Filesize
384KB

Download
memory/1796-187-0x0000000005540000-0x00000000055A0000-memory.dmp

Filesize
384KB

Download
memory/1796-189-0x0000000005540000-0x00000000055A0000-memory.dmp

Filesize
384KB

Download
memory/1796-191-0x0000000005540000-0x00000000055A0000-memory.dmp

Filesize
384KB

Download
memory/1796-197-0x0000000005540000-0x00000000055A0000-memory.dmp

Filesize
384KB

Download
memory/1796-199-0x0000000005540000-0x00000000055A0000-memory.dmp

Filesize
384KB

Download
memory/1796-201-0x0000000005540000-0x00000000055A0000-memory.dmp

Filesize
384KB

Download
memory/1796-203-0x0000000005540000-0x00000000055A0000-memory.dmp

Filesize
384KB

Download
memory/1796-195-0x0000000005540000-0x00000000055A0000-memory.dmp

Filesize
384KB

Download
memory/1796-205-0x0000000005540000-0x00000000055A0000-memory.dmp

Filesize
384KB

Download
memory/1796-193-0x0000000005540000-0x00000000055A0000-memory.dmp

Filesize
384KB

Download
memory/1796-179-0x0000000005540000-0x00000000055A0000-memory.dmp

Filesize
384KB

Download
memory/1796-209-0x0000000005540000-0x00000000055A0000-memory.dmp

Filesize
384KB

Download
memory/1796-211-0x0000000005540000-0x00000000055A0000-memory.dmp

Filesize
384KB

Download
memory/1796-214-0x0000000005540000-0x00000000055A0000-memory.dmp

Filesize
384KB

Download
memory/1796-213-0x0000000004E10000-0x0000000004E20000-memory.dmp

Filesize
64KB

Download
memory/1796-216-0x0000000004E10000-0x0000000004E20000-memory.dmp

Filesize
64KB

Download
memory/1796-218-0x0000000004E10000-0x0000000004E20000-memory.dmp

Filesize
64KB

Download
memory/1796-217-0x0000000005540000-0x00000000055A0000-memory.dmp

Filesize
384KB

Download
memory/1796-220-0x0000000005540000-0x00000000055A0000-memory.dmp

Filesize
384KB

Download
memory/1796-181-0x0000000005540000-0x00000000055A0000-memory.dmp

Filesize
384KB

Download
memory/1796-224-0x0000000005540000-0x00000000055A0000-memory.dmp

Filesize
384KB

Download
memory/1796-226-0x0000000005540000-0x00000000055A0000-memory.dmp

Filesize
384KB

Download
memory/1796-228-0x0000000005540000-0x00000000055A0000-memory.dmp

Filesize
384KB

Download
memory/1796-230-0x0000000005540000-0x00000000055A0000-memory.dmp

Filesize
384KB

Download
memory/1796-2315-0x0000000004E10000-0x0000000004E20000-memory.dmp

Filesize
64KB

Download
memory/1796-2316-0x0000000004E10000-0x0000000004E20000-memory.dmp

Filesize
64KB

Download
memory/1796-2317-0x0000000004E10000-0x0000000004E20000-memory.dmp

Filesize
64KB

Download
memory/1796-177-0x0000000005540000-0x00000000055A0000-memory.dmp

Filesize
384KB

Download
memory/1796-175-0x0000000005540000-0x00000000055A0000-memory.dmp

Filesize
384KB

Download
memory/1796-173-0x0000000005540000-0x00000000055A0000-memory.dmp

Filesize
384KB

Download
memory/1796-2330-0x0000000004E10000-0x0000000004E20000-memory.dmp

Filesize
64KB

Download
memory/1796-162-0x0000000000970000-0x00000000009CB000-memory.dmp

Filesize
364KB

Download
memory/1796-171-0x0000000005540000-0x00000000055A0000-memory.dmp

Filesize
384KB

Download
memory/1796-169-0x0000000005540000-0x00000000055A0000-memory.dmp

Filesize
384KB

Download
memory/1796-167-0x0000000005540000-0x00000000055A0000-memory.dmp

Filesize
384KB

Download
memory/1796-165-0x0000000005540000-0x00000000055A0000-memory.dmp

Filesize
384KB

Download
memory/1796-163-0x0000000004F90000-0x0000000005534000-memory.dmp

Filesize
5.6MB

Download
memory/1796-164-0x0000000005540000-0x00000000055A0000-memory.dmp

Filesize
384KB

Download
memory/4860-2339-0x00000000049C0000-0x00000000049D2000-memory.dmp

Filesize
72KB

Download
memory/4860-2341-0x00000000049F0000-0x0000000004A00000-memory.dmp

Filesize
64KB

Download
memory/4860-2338-0x0000000004C10000-0x0000000004D1A000-memory.dmp

Filesize
1.0MB

Download
memory/4860-2332-0x0000000000180000-0x00000000001AE000-memory.dmp

Filesize
184KB

Download
memory/4860-2344-0x00000000049F0000-0x0000000004A00000-memory.dmp

Filesize
64KB

Download