Analysis
-
max time kernel
147s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
06-05-2023 20:48
Static task
static1
Behavioral task
behavioral1
Sample
1d3fcfd7dce4fc0203457fa49fa2e22e761c191b247433f4e3aaa905844dc9c7.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1d3fcfd7dce4fc0203457fa49fa2e22e761c191b247433f4e3aaa905844dc9c7.exe
Resource
win10v2004-20230220-en
General
-
Target
1d3fcfd7dce4fc0203457fa49fa2e22e761c191b247433f4e3aaa905844dc9c7.exe
-
Size
1.2MB
-
MD5
1f08f91fa072288cd746c062ae7a8e72
-
SHA1
565a0eafe526ca7a3eac8412730e720e6d717b7a
-
SHA256
1d3fcfd7dce4fc0203457fa49fa2e22e761c191b247433f4e3aaa905844dc9c7
-
SHA512
1704ae8252802a350c0981e08e2a1ceac86916400bf1350e971856c476501aafb0f5502a32164dd90ba1bb3ae4c59e189386636fec926ffb86d961757a72cff7
-
SSDEEP
24576:myfB6udmwapxH98K2Ua/F3owxl8aLDFwqCaqM5X97nGnVNt1:1fw4m/pxdD094aNCqJqM5Vnkt
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
life
185.161.248.73:4164
-
auth_value
8685d11953530b68ad5ec703809d9f91
Signatures
-
Detects Redline Stealer samples 1 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
Processes:
resource yara_rule behavioral2/memory/2016-2332-0x0000000005210000-0x0000000005828000-memory.dmp redline_stealer -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
s35650423.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation s35650423.exe -
Executes dropped EXE 6 IoCs
Processes:
z06472477.exez82599861.exez11067762.exes35650423.exe1.exet46634292.exepid process 4824 z06472477.exe 4232 z82599861.exe 4204 z11067762.exe 1812 s35650423.exe 2016 1.exe 3640 t46634292.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
z82599861.exez11067762.exe1d3fcfd7dce4fc0203457fa49fa2e22e761c191b247433f4e3aaa905844dc9c7.exez06472477.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z82599861.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z11067762.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z11067762.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 1d3fcfd7dce4fc0203457fa49fa2e22e761c191b247433f4e3aaa905844dc9c7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1d3fcfd7dce4fc0203457fa49fa2e22e761c191b247433f4e3aaa905844dc9c7.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z06472477.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z06472477.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z82599861.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2032 1812 WerFault.exe s35650423.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
s35650423.exedescription pid process Token: SeDebugPrivilege 1812 s35650423.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
1d3fcfd7dce4fc0203457fa49fa2e22e761c191b247433f4e3aaa905844dc9c7.exez06472477.exez82599861.exez11067762.exes35650423.exedescription pid process target process PID 2356 wrote to memory of 4824 2356 1d3fcfd7dce4fc0203457fa49fa2e22e761c191b247433f4e3aaa905844dc9c7.exe z06472477.exe PID 2356 wrote to memory of 4824 2356 1d3fcfd7dce4fc0203457fa49fa2e22e761c191b247433f4e3aaa905844dc9c7.exe z06472477.exe PID 2356 wrote to memory of 4824 2356 1d3fcfd7dce4fc0203457fa49fa2e22e761c191b247433f4e3aaa905844dc9c7.exe z06472477.exe PID 4824 wrote to memory of 4232 4824 z06472477.exe z82599861.exe PID 4824 wrote to memory of 4232 4824 z06472477.exe z82599861.exe PID 4824 wrote to memory of 4232 4824 z06472477.exe z82599861.exe PID 4232 wrote to memory of 4204 4232 z82599861.exe z11067762.exe PID 4232 wrote to memory of 4204 4232 z82599861.exe z11067762.exe PID 4232 wrote to memory of 4204 4232 z82599861.exe z11067762.exe PID 4204 wrote to memory of 1812 4204 z11067762.exe s35650423.exe PID 4204 wrote to memory of 1812 4204 z11067762.exe s35650423.exe PID 4204 wrote to memory of 1812 4204 z11067762.exe s35650423.exe PID 1812 wrote to memory of 2016 1812 s35650423.exe 1.exe PID 1812 wrote to memory of 2016 1812 s35650423.exe 1.exe PID 1812 wrote to memory of 2016 1812 s35650423.exe 1.exe PID 4204 wrote to memory of 3640 4204 z11067762.exe t46634292.exe PID 4204 wrote to memory of 3640 4204 z11067762.exe t46634292.exe PID 4204 wrote to memory of 3640 4204 z11067762.exe t46634292.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d3fcfd7dce4fc0203457fa49fa2e22e761c191b247433f4e3aaa905844dc9c7.exe"C:\Users\Admin\AppData\Local\Temp\1d3fcfd7dce4fc0203457fa49fa2e22e761c191b247433f4e3aaa905844dc9c7.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z06472477.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z06472477.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z82599861.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z82599861.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z11067762.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z11067762.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s35650423.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s35650423.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 13726⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t46634292.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t46634292.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1812 -ip 18121⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z06472477.exeFilesize
1.0MB
MD50256e0a22051fdafdf589628ac56df8b
SHA1fcc622ada568faef4240b52c16ae62ebebdeb94b
SHA25607f7802352549913627f4b717a2dd963a2ac2b8a25f8d93275da661984ef7826
SHA512d454a00e08dcaeb55d48a9ae8cc72bd50f3dd4407bbfb2237281a33aa2dc3758271308e00cf7a0a6470c6487c7267a52bc803243aaea615581232fcd445675e0
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z06472477.exeFilesize
1.0MB
MD50256e0a22051fdafdf589628ac56df8b
SHA1fcc622ada568faef4240b52c16ae62ebebdeb94b
SHA25607f7802352549913627f4b717a2dd963a2ac2b8a25f8d93275da661984ef7826
SHA512d454a00e08dcaeb55d48a9ae8cc72bd50f3dd4407bbfb2237281a33aa2dc3758271308e00cf7a0a6470c6487c7267a52bc803243aaea615581232fcd445675e0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z82599861.exeFilesize
760KB
MD550f9e91a00d2e782b1cdb3bf8ca12a5f
SHA1a03b93c49b3b0d8b8bb59b2e6017c33a767df2dd
SHA256ee9aa7c24a42af99ad6e1a56b8133813fb620806cef27607f4c2480eb0d0069a
SHA5128eea6454eb245cd99579173baa47d91f2bab44b6b659b06369a386465db317b7ded321b6b954ebdcd481a2cf73a8a12e9a89334b74b5bcf50070d92fbb6accfa
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z82599861.exeFilesize
760KB
MD550f9e91a00d2e782b1cdb3bf8ca12a5f
SHA1a03b93c49b3b0d8b8bb59b2e6017c33a767df2dd
SHA256ee9aa7c24a42af99ad6e1a56b8133813fb620806cef27607f4c2480eb0d0069a
SHA5128eea6454eb245cd99579173baa47d91f2bab44b6b659b06369a386465db317b7ded321b6b954ebdcd481a2cf73a8a12e9a89334b74b5bcf50070d92fbb6accfa
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z11067762.exeFilesize
577KB
MD53ebf0419ae158386ee0e8cbd86880c62
SHA1152c254ed6e15ac6fe6f2ecd0ffd17a21eaf1a78
SHA2565c5ee9fc03dfd1dac1d5c9960d413f27832ffbd7d1861f4c626bd79b1647f28f
SHA512d2b7500a6959bbf104e85c86b1b16c4d3150de22c7c8abd47086d45a299b1d9adcc1bbf95bc9a32836d33e91dd194623e7e9d01da9a79a2596c0c270eb2e6479
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z11067762.exeFilesize
577KB
MD53ebf0419ae158386ee0e8cbd86880c62
SHA1152c254ed6e15ac6fe6f2ecd0ffd17a21eaf1a78
SHA2565c5ee9fc03dfd1dac1d5c9960d413f27832ffbd7d1861f4c626bd79b1647f28f
SHA512d2b7500a6959bbf104e85c86b1b16c4d3150de22c7c8abd47086d45a299b1d9adcc1bbf95bc9a32836d33e91dd194623e7e9d01da9a79a2596c0c270eb2e6479
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s35650423.exeFilesize
574KB
MD5266660909b1c5aebffbcae2e6e4b3385
SHA18d20ad339f8c8517751f35a7c2b31fe1a2d32e74
SHA256b99bc7ed118f2de10d3d9d815fcf5531f645a91de1901edf5df2f9672010514a
SHA512a62c149382e33e4542e4eec59354036cf25bd931edb85e794fa45bc7044143bdcfb8f96457c3a18a33e456090f334b31e83f74ffd9fbb2fdc704b6d549beb64e
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s35650423.exeFilesize
574KB
MD5266660909b1c5aebffbcae2e6e4b3385
SHA18d20ad339f8c8517751f35a7c2b31fe1a2d32e74
SHA256b99bc7ed118f2de10d3d9d815fcf5531f645a91de1901edf5df2f9672010514a
SHA512a62c149382e33e4542e4eec59354036cf25bd931edb85e794fa45bc7044143bdcfb8f96457c3a18a33e456090f334b31e83f74ffd9fbb2fdc704b6d549beb64e
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t46634292.exeFilesize
169KB
MD5418764f6ad1a49bf37b457b8f750515b
SHA107f2024c736ce3d4f269941e91c261a14914bfcc
SHA25689d68bde01435db8fe2b1a391b164d0eee7227a9f2245d9a85d20886ecaecef8
SHA512ff8bf99eb707a7f11db1485c3898fc6fe8533bef3457c2265cd98e850790bc2329a5698dd57011a21418443857b69d73aa5c3db9c33acd7531bbfb77df9be421
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t46634292.exeFilesize
169KB
MD5418764f6ad1a49bf37b457b8f750515b
SHA107f2024c736ce3d4f269941e91c261a14914bfcc
SHA25689d68bde01435db8fe2b1a391b164d0eee7227a9f2245d9a85d20886ecaecef8
SHA512ff8bf99eb707a7f11db1485c3898fc6fe8533bef3457c2265cd98e850790bc2329a5698dd57011a21418443857b69d73aa5c3db9c33acd7531bbfb77df9be421
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
memory/1812-204-0x0000000002A00000-0x0000000002A60000-memory.dmpFilesize
384KB
-
memory/1812-220-0x0000000002A00000-0x0000000002A60000-memory.dmpFilesize
384KB
-
memory/1812-173-0x0000000002A00000-0x0000000002A60000-memory.dmpFilesize
384KB
-
memory/1812-175-0x0000000002A00000-0x0000000002A60000-memory.dmpFilesize
384KB
-
memory/1812-177-0x0000000002A00000-0x0000000002A60000-memory.dmpFilesize
384KB
-
memory/1812-179-0x0000000002A00000-0x0000000002A60000-memory.dmpFilesize
384KB
-
memory/1812-181-0x0000000002A00000-0x0000000002A60000-memory.dmpFilesize
384KB
-
memory/1812-183-0x0000000002A00000-0x0000000002A60000-memory.dmpFilesize
384KB
-
memory/1812-185-0x0000000002A00000-0x0000000002A60000-memory.dmpFilesize
384KB
-
memory/1812-186-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/1812-188-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/1812-190-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/1812-192-0x0000000002A00000-0x0000000002A60000-memory.dmpFilesize
384KB
-
memory/1812-194-0x0000000002A00000-0x0000000002A60000-memory.dmpFilesize
384KB
-
memory/1812-189-0x0000000002A00000-0x0000000002A60000-memory.dmpFilesize
384KB
-
memory/1812-196-0x0000000002A00000-0x0000000002A60000-memory.dmpFilesize
384KB
-
memory/1812-198-0x0000000002A00000-0x0000000002A60000-memory.dmpFilesize
384KB
-
memory/1812-200-0x0000000002A00000-0x0000000002A60000-memory.dmpFilesize
384KB
-
memory/1812-202-0x0000000002A00000-0x0000000002A60000-memory.dmpFilesize
384KB
-
memory/1812-169-0x0000000002A00000-0x0000000002A60000-memory.dmpFilesize
384KB
-
memory/1812-206-0x0000000002A00000-0x0000000002A60000-memory.dmpFilesize
384KB
-
memory/1812-208-0x0000000002A00000-0x0000000002A60000-memory.dmpFilesize
384KB
-
memory/1812-210-0x0000000002A00000-0x0000000002A60000-memory.dmpFilesize
384KB
-
memory/1812-212-0x0000000002A00000-0x0000000002A60000-memory.dmpFilesize
384KB
-
memory/1812-214-0x0000000002A00000-0x0000000002A60000-memory.dmpFilesize
384KB
-
memory/1812-216-0x0000000002A00000-0x0000000002A60000-memory.dmpFilesize
384KB
-
memory/1812-218-0x0000000002A00000-0x0000000002A60000-memory.dmpFilesize
384KB
-
memory/1812-171-0x0000000002A00000-0x0000000002A60000-memory.dmpFilesize
384KB
-
memory/1812-222-0x0000000002A00000-0x0000000002A60000-memory.dmpFilesize
384KB
-
memory/1812-224-0x0000000002A00000-0x0000000002A60000-memory.dmpFilesize
384KB
-
memory/1812-228-0x0000000002A00000-0x0000000002A60000-memory.dmpFilesize
384KB
-
memory/1812-226-0x0000000002A00000-0x0000000002A60000-memory.dmpFilesize
384KB
-
memory/1812-230-0x0000000002A00000-0x0000000002A60000-memory.dmpFilesize
384KB
-
memory/1812-2314-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/1812-2315-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/1812-2316-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/1812-167-0x0000000002A00000-0x0000000002A60000-memory.dmpFilesize
384KB
-
memory/1812-2326-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/1812-165-0x0000000002A00000-0x0000000002A60000-memory.dmpFilesize
384KB
-
memory/1812-162-0x0000000000840000-0x000000000089B000-memory.dmpFilesize
364KB
-
memory/1812-164-0x0000000002A00000-0x0000000002A60000-memory.dmpFilesize
384KB
-
memory/1812-163-0x0000000004FF0000-0x0000000005594000-memory.dmpFilesize
5.6MB
-
memory/1812-2338-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/2016-2334-0x0000000004BF0000-0x0000000004C02000-memory.dmpFilesize
72KB
-
memory/2016-2335-0x0000000004C10000-0x0000000004C4C000-memory.dmpFilesize
240KB
-
memory/2016-2337-0x00000000049E0000-0x00000000049F0000-memory.dmpFilesize
64KB
-
memory/2016-2333-0x0000000004D00000-0x0000000004E0A000-memory.dmpFilesize
1.0MB
-
memory/2016-2332-0x0000000005210000-0x0000000005828000-memory.dmpFilesize
6.1MB
-
memory/2016-2331-0x0000000000150000-0x000000000017E000-memory.dmpFilesize
184KB
-
memory/2016-2345-0x00000000049E0000-0x00000000049F0000-memory.dmpFilesize
64KB
-
memory/3640-2343-0x00000000001C0000-0x00000000001EE000-memory.dmpFilesize
184KB
-
memory/3640-2344-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/3640-2346-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB