Analysis

  • max time kernel
    144s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-05-2023 20:52

General

  • Target

    1f76c49b8f6cb9fc7625659012061fe90b46c242936adf39fae3e77ec0f39265.exe

  • Size

    1.2MB

  • MD5

    15502e935321906eb2a416943cbad8d7

  • SHA1

    5162480c8d16d1b270ac94b9e50cb18a80932ef0

  • SHA256

    1f76c49b8f6cb9fc7625659012061fe90b46c242936adf39fae3e77ec0f39265

  • SHA512

    c908bcb22d2646f30d6db2a82d13b6a39ccc1feae29945401db3e898060d4ad3386167ca4bcbbf04390bf94e90c349dc986acec486d20f5f31544b020abd3fdb

  • SSDEEP

    24576:XypxXSAF4UOhYYHKT/8/gmtW3oHn550eke9y7dOmdbQvLoxoJTd3ii:iDSMihYcKT/84mtgoH5tkSy0md5+JTdy

Malware Config

Extracted

Family

redline

Botnet

gena

C2

185.161.248.73:4164

Attributes
  • auth_value

    d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

life

C2

185.161.248.73:4164

Attributes
  • auth_value

    8685d11953530b68ad5ec703809d9f91

Signatures

  • Detects Redline Stealer samples 1 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1f76c49b8f6cb9fc7625659012061fe90b46c242936adf39fae3e77ec0f39265.exe
    "C:\Users\Admin\AppData\Local\Temp\1f76c49b8f6cb9fc7625659012061fe90b46c242936adf39fae3e77ec0f39265.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1948
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z64971320.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z64971320.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1912
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z46301186.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z46301186.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3264
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z01083958.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z01083958.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:676
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s03226909.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s03226909.exe
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:112
            • C:\Windows\Temp\1.exe
              "C:\Windows\Temp\1.exe"
              6⤵
              • Executes dropped EXE
              PID:3440
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 112 -s 1372
              6⤵
              • Program crash
              PID:4696
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t15900642.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t15900642.exe
            5⤵
            • Executes dropped EXE
            PID:4244
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 112 -ip 112
    1⤵
      PID:3448

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    1
    T1112

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z64971320.exe
      Filesize

      1.0MB

      MD5

      9a5644fa5cbaf4e1d48419ebcb90f683

      SHA1

      dd7dcf691fcc3139f5fc4fb97a70532a0185afb2

      SHA256

      122990f27d8798c366efc86642ad32321ca2409be3ce8f463e5b2f8c635a5c5a

      SHA512

      950092bc995bc8adc3e8899b2cb4a40f851e7643e5a0771581d229fd811f9d191c6de4a2b3ac0a32db8dc9abd657c6f51bdd84ebce2b14873a45899d54a3a39f

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z64971320.exe
      Filesize

      1.0MB

      MD5

      9a5644fa5cbaf4e1d48419ebcb90f683

      SHA1

      dd7dcf691fcc3139f5fc4fb97a70532a0185afb2

      SHA256

      122990f27d8798c366efc86642ad32321ca2409be3ce8f463e5b2f8c635a5c5a

      SHA512

      950092bc995bc8adc3e8899b2cb4a40f851e7643e5a0771581d229fd811f9d191c6de4a2b3ac0a32db8dc9abd657c6f51bdd84ebce2b14873a45899d54a3a39f

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z46301186.exe
      Filesize

      760KB

      MD5

      526936faea0aa672386e6b8d69cab40b

      SHA1

      c3e269403b2dbddac106004b3be26091f898ba43

      SHA256

      4db5552c2205439d4796b90ca48d2d0b00334a6af5f4f00068615dd1c7d4b9a1

      SHA512

      3ab26799983fa5487adcb25771364172126e2126a19e18b68e1ae9256919b8ca5e49ef9f2746da6da488600ddcf766f7c4244fe9ba20619cb71ab40597563e3c

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z46301186.exe
      Filesize

      760KB

      MD5

      526936faea0aa672386e6b8d69cab40b

      SHA1

      c3e269403b2dbddac106004b3be26091f898ba43

      SHA256

      4db5552c2205439d4796b90ca48d2d0b00334a6af5f4f00068615dd1c7d4b9a1

      SHA512

      3ab26799983fa5487adcb25771364172126e2126a19e18b68e1ae9256919b8ca5e49ef9f2746da6da488600ddcf766f7c4244fe9ba20619cb71ab40597563e3c

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z01083958.exe
      Filesize

      578KB

      MD5

      b9645d853b17bbdedab3b84d23de13e5

      SHA1

      4ade005fe766f7671c0948a93cda1a55e196c6cd

      SHA256

      b92364cf3c97b2f5507d2819057b0f709995097c467c40db1a374d6d1dcdb6f2

      SHA512

      49a330fe28d3c49c6f7f2723c8a2aba900439ae0759bdfd2ad21d0d8ce9d4df9709aeb2a7be53561e7152a433da746c1b184d013e191a02d1e02cf0cb0d9e7b4

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z01083958.exe
      Filesize

      578KB

      MD5

      b9645d853b17bbdedab3b84d23de13e5

      SHA1

      4ade005fe766f7671c0948a93cda1a55e196c6cd

      SHA256

      b92364cf3c97b2f5507d2819057b0f709995097c467c40db1a374d6d1dcdb6f2

      SHA512

      49a330fe28d3c49c6f7f2723c8a2aba900439ae0759bdfd2ad21d0d8ce9d4df9709aeb2a7be53561e7152a433da746c1b184d013e191a02d1e02cf0cb0d9e7b4

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s03226909.exe
      Filesize

      575KB

      MD5

      00e276368abe8ab10878271467b91af3

      SHA1

      7390f16aa575b4da773e33bec1d7652dec36474f

      SHA256

      df5a2a15c9de7f9500e0873a9b3511c88707656efb67a29165b14e91b534b1fd

      SHA512

      c6fdef66cb9502e5cffd9a67128c4eef142b56caae2f7217a4c088bc6d100bc45aef9d8d30093ba314285283280ccd0dea4cb2eeceb8cda9d9332d5b83a881e3

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s03226909.exe
      Filesize

      575KB

      MD5

      00e276368abe8ab10878271467b91af3

      SHA1

      7390f16aa575b4da773e33bec1d7652dec36474f

      SHA256

      df5a2a15c9de7f9500e0873a9b3511c88707656efb67a29165b14e91b534b1fd

      SHA512

      c6fdef66cb9502e5cffd9a67128c4eef142b56caae2f7217a4c088bc6d100bc45aef9d8d30093ba314285283280ccd0dea4cb2eeceb8cda9d9332d5b83a881e3

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t15900642.exe
      Filesize

      169KB

      MD5

      d0b9aea8971b2ded818e2be2f859f733

      SHA1

      16588b076d916545c4e0c6bd7d08242b2cd6155f

      SHA256

      42faa2f42851505068159ec08f185dbf40914fc30eb49562d0e764d386234ac3

      SHA512

      e41c8bf4a85b24ded97416ccbc6c14542ed8263fe3cffbe0b48e04c7444c447e24063f14c047cdc8d9a1eb1108301b8e83d06916418dab1bf7b291e753cd7508

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t15900642.exe
      Filesize

      169KB

      MD5

      d0b9aea8971b2ded818e2be2f859f733

      SHA1

      16588b076d916545c4e0c6bd7d08242b2cd6155f

      SHA256

      42faa2f42851505068159ec08f185dbf40914fc30eb49562d0e764d386234ac3

      SHA512

      e41c8bf4a85b24ded97416ccbc6c14542ed8263fe3cffbe0b48e04c7444c447e24063f14c047cdc8d9a1eb1108301b8e83d06916418dab1bf7b291e753cd7508

    • C:\Windows\Temp\1.exe
      Filesize

      168KB

      MD5

      f16fb63d4e551d3808e8f01f2671b57e

      SHA1

      781153ad6235a1152da112de1fb39a6f2d063575

      SHA256

      8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

      SHA512

      fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

    • C:\Windows\Temp\1.exe
      Filesize

      168KB

      MD5

      f16fb63d4e551d3808e8f01f2671b57e

      SHA1

      781153ad6235a1152da112de1fb39a6f2d063575

      SHA256

      8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

      SHA512

      fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

    • C:\Windows\Temp\1.exe
      Filesize

      168KB

      MD5

      f16fb63d4e551d3808e8f01f2671b57e

      SHA1

      781153ad6235a1152da112de1fb39a6f2d063575

      SHA256

      8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

      SHA512

      fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

    • memory/112-172-0x0000000005510000-0x0000000005570000-memory.dmp
      Filesize

      384KB

    • memory/112-214-0x0000000005510000-0x0000000005570000-memory.dmp
      Filesize

      384KB

    • memory/112-168-0x0000000005510000-0x0000000005570000-memory.dmp
      Filesize

      384KB

    • memory/112-174-0x0000000005510000-0x0000000005570000-memory.dmp
      Filesize

      384KB

    • memory/112-176-0x0000000005510000-0x0000000005570000-memory.dmp
      Filesize

      384KB

    • memory/112-178-0x0000000005510000-0x0000000005570000-memory.dmp
      Filesize

      384KB

    • memory/112-180-0x0000000005510000-0x0000000005570000-memory.dmp
      Filesize

      384KB

    • memory/112-182-0x0000000005510000-0x0000000005570000-memory.dmp
      Filesize

      384KB

    • memory/112-184-0x0000000005510000-0x0000000005570000-memory.dmp
      Filesize

      384KB

    • memory/112-186-0x0000000005510000-0x0000000005570000-memory.dmp
      Filesize

      384KB

    • memory/112-188-0x0000000005510000-0x0000000005570000-memory.dmp
      Filesize

      384KB

    • memory/112-190-0x0000000005510000-0x0000000005570000-memory.dmp
      Filesize

      384KB

    • memory/112-192-0x0000000005510000-0x0000000005570000-memory.dmp
      Filesize

      384KB

    • memory/112-194-0x0000000005510000-0x0000000005570000-memory.dmp
      Filesize

      384KB

    • memory/112-196-0x0000000005510000-0x0000000005570000-memory.dmp
      Filesize

      384KB

    • memory/112-198-0x0000000005510000-0x0000000005570000-memory.dmp
      Filesize

      384KB

    • memory/112-200-0x0000000005510000-0x0000000005570000-memory.dmp
      Filesize

      384KB

    • memory/112-202-0x0000000005510000-0x0000000005570000-memory.dmp
      Filesize

      384KB

    • memory/112-204-0x0000000005510000-0x0000000005570000-memory.dmp
      Filesize

      384KB

    • memory/112-206-0x0000000005510000-0x0000000005570000-memory.dmp
      Filesize

      384KB

    • memory/112-208-0x0000000005510000-0x0000000005570000-memory.dmp
      Filesize

      384KB

    • memory/112-210-0x0000000005510000-0x0000000005570000-memory.dmp
      Filesize

      384KB

    • memory/112-212-0x0000000005510000-0x0000000005570000-memory.dmp
      Filesize

      384KB

    • memory/112-170-0x0000000005510000-0x0000000005570000-memory.dmp
      Filesize

      384KB

    • memory/112-216-0x0000000005510000-0x0000000005570000-memory.dmp
      Filesize

      384KB

    • memory/112-218-0x0000000005510000-0x0000000005570000-memory.dmp
      Filesize

      384KB

    • memory/112-220-0x0000000005510000-0x0000000005570000-memory.dmp
      Filesize

      384KB

    • memory/112-222-0x0000000005510000-0x0000000005570000-memory.dmp
      Filesize

      384KB

    • memory/112-224-0x0000000005510000-0x0000000005570000-memory.dmp
      Filesize

      384KB

    • memory/112-226-0x0000000005510000-0x0000000005570000-memory.dmp
      Filesize

      384KB

    • memory/112-228-0x0000000005510000-0x0000000005570000-memory.dmp
      Filesize

      384KB

    • memory/112-166-0x0000000005510000-0x0000000005570000-memory.dmp
      Filesize

      384KB

    • memory/112-2314-0x0000000004E50000-0x0000000004E60000-memory.dmp
      Filesize

      64KB

    • memory/112-165-0x0000000005510000-0x0000000005570000-memory.dmp
      Filesize

      384KB

    • memory/112-164-0x0000000004F60000-0x0000000005504000-memory.dmp
      Filesize

      5.6MB

    • memory/112-162-0x0000000000840000-0x000000000089B000-memory.dmp
      Filesize

      364KB

    • memory/112-163-0x0000000004E50000-0x0000000004E60000-memory.dmp
      Filesize

      64KB

    • memory/3440-2327-0x0000000004B80000-0x0000000004C8A000-memory.dmp
      Filesize

      1.0MB

    • memory/3440-2328-0x0000000004A90000-0x0000000004AA2000-memory.dmp
      Filesize

      72KB

    • memory/3440-2329-0x0000000004AF0000-0x0000000004B2C000-memory.dmp
      Filesize

      240KB

    • memory/3440-2330-0x0000000004A60000-0x0000000004A70000-memory.dmp
      Filesize

      64KB

    • memory/3440-2326-0x0000000005090000-0x00000000056A8000-memory.dmp
      Filesize

      6.1MB

    • memory/3440-2325-0x0000000000140000-0x000000000016E000-memory.dmp
      Filesize

      184KB

    • memory/3440-2337-0x0000000004A60000-0x0000000004A70000-memory.dmp
      Filesize

      64KB

    • memory/4244-2335-0x00000000005F0000-0x000000000061E000-memory.dmp
      Filesize

      184KB

    • memory/4244-2336-0x0000000004FD0000-0x0000000004FE0000-memory.dmp
      Filesize

      64KB

    • memory/4244-2338-0x0000000004FD0000-0x0000000004FE0000-memory.dmp
      Filesize

      64KB