redline | 295910d2ccdf3cd05350c9cc21f76aa77cdcfdd5ea2d0a15f835d47164adbf94

Analysis

max time kernel
156s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2023 00:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

295910d2ccdf3cd05350c9cc21f76aa77cdcfdd5ea2d0a15f835d47164adbf94.exe
Size

1.2MB
MD5

12ab1d7773f3f985d9b1ca44fa1f28c9
SHA1

77886891e176fbf171a6d8ffedf17139187a3a98
SHA256

295910d2ccdf3cd05350c9cc21f76aa77cdcfdd5ea2d0a15f835d47164adbf94
SHA512

08b6d6296132c05f75c890b6685a749ff72a2938331185823fe8b372031ecf4a2dc8d8a1990b8707746603c117ac45f4c6fdc8efece219472cced523b8760e3d
SSDEEP

24576:PyWSb2SNg6nDF4uuiI3XuPBCNKaA/yALAyVcmfGONl6gp9gtJUlzAC:aBu6D5f+XSSDA/yxyVVfGOHf9gtC

Score

10^/10

redline gena life infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

gena

185.161.248.73:4164

Attributes

auth_value
d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

life

185.161.248.73:4164

Attributes

auth_value
8685d11953530b68ad5ec703809d9f91

Signatures

Detects Redline Stealer samples 1 IoCs

This rule detects the presence of Redline Stealer samples based on their unique strings.

stealer

Processes:

resource	yara_rule
behavioral2/memory/4960-2333-0x0000000005CF0000-0x0000000006308000-memory.dmp	redline_stealer

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

s96811071.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	s96811071.exe

Executes dropped EXE 6 IoCs

Processes:

z76188084.exez02625146.exez23129318.exes96811071.exe1.exet56046219.exe

pid process

740 z76188084.exe
2900 z02625146.exe
4136 z23129318.exe
2040 s96811071.exe
4960 1.exe
4144 t56046219.exe

pid	process
740	z76188084.exe
2900	z02625146.exe
4136	z23129318.exe
2040	s96811071.exe
4960	1.exe
4144	t56046219.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

z02625146.exez23129318.exe295910d2ccdf3cd05350c9cc21f76aa77cdcfdd5ea2d0a15f835d47164adbf94.exez76188084.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z02625146.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z23129318.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z23129318.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	295910d2ccdf3cd05350c9cc21f76aa77cdcfdd5ea2d0a15f835d47164adbf94.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	295910d2ccdf3cd05350c9cc21f76aa77cdcfdd5ea2d0a15f835d47164adbf94.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z76188084.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z76188084.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z02625146.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

s96811071.exe

description pid process

Token: SeDebugPrivilege 2040 s96811071.exe

description	pid	process
Token: SeDebugPrivilege	2040	s96811071.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

295910d2ccdf3cd05350c9cc21f76aa77cdcfdd5ea2d0a15f835d47164adbf94.exez76188084.exez02625146.exez23129318.exes96811071.exe

description	pid	process	target process
PID 1036 wrote to memory of 740	1036	295910d2ccdf3cd05350c9cc21f76aa77cdcfdd5ea2d0a15f835d47164adbf94.exe	z76188084.exe
PID 1036 wrote to memory of 740	1036	295910d2ccdf3cd05350c9cc21f76aa77cdcfdd5ea2d0a15f835d47164adbf94.exe	z76188084.exe
PID 1036 wrote to memory of 740	1036	295910d2ccdf3cd05350c9cc21f76aa77cdcfdd5ea2d0a15f835d47164adbf94.exe	z76188084.exe
PID 740 wrote to memory of 2900	740	z76188084.exe	z02625146.exe
PID 740 wrote to memory of 2900	740	z76188084.exe	z02625146.exe
PID 740 wrote to memory of 2900	740	z76188084.exe	z02625146.exe
PID 2900 wrote to memory of 4136	2900	z02625146.exe	z23129318.exe
PID 2900 wrote to memory of 4136	2900	z02625146.exe	z23129318.exe
PID 2900 wrote to memory of 4136	2900	z02625146.exe	z23129318.exe
PID 4136 wrote to memory of 2040	4136	z23129318.exe	s96811071.exe
PID 4136 wrote to memory of 2040	4136	z23129318.exe	s96811071.exe
PID 4136 wrote to memory of 2040	4136	z23129318.exe	s96811071.exe
PID 2040 wrote to memory of 4960	2040	s96811071.exe	1.exe
PID 2040 wrote to memory of 4960	2040	s96811071.exe	1.exe
PID 2040 wrote to memory of 4960	2040	s96811071.exe	1.exe
PID 4136 wrote to memory of 4144	4136	z23129318.exe	t56046219.exe
PID 4136 wrote to memory of 4144	4136	z23129318.exe	t56046219.exe
PID 4136 wrote to memory of 4144	4136	z23129318.exe	t56046219.exe

C:\Users\Admin\AppData\Local\Temp\295910d2ccdf3cd05350c9cc21f76aa77cdcfdd5ea2d0a15f835d47164adbf94.exe
"C:\Users\Admin\AppData\Local\Temp\295910d2ccdf3cd05350c9cc21f76aa77cdcfdd5ea2d0a15f835d47164adbf94.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1036

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z76188084.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z76188084.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:740

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z02625146.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z02625146.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2900

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z23129318.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z23129318.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4136

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s96811071.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s96811071.exe
5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\Temp\1.exe
"C:\Windows\Temp\1.exe"
6⤵
- Executes dropped EXE
PID:4960

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t56046219.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t56046219.exe
5⤵
- Executes dropped EXE
PID:4144

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z76188084.exe
Filesize
1.0MB

MD5
26df2362259152fa46d04a6c5bba1461

SHA1
6fd0eb30e0aec8a0220606cfd2dcc5ddddfa0c99

SHA256
e01d4f0d96bd682a1955597375b198f37a6a1d5b5ecb3cfdddd6fe671e9ff255

SHA512
9fb47d6abbd9df1c39a40e016aaa68895ad4d92ab1da9a56bc4e440a3cb5ab9ffdb4db604f811a83d03e1cdaca1bf6ab53f6c228d34c07f71ce5e5f912e77afa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z76188084.exe
Filesize
1.0MB

MD5
26df2362259152fa46d04a6c5bba1461

SHA1
6fd0eb30e0aec8a0220606cfd2dcc5ddddfa0c99

SHA256
e01d4f0d96bd682a1955597375b198f37a6a1d5b5ecb3cfdddd6fe671e9ff255

SHA512
9fb47d6abbd9df1c39a40e016aaa68895ad4d92ab1da9a56bc4e440a3cb5ab9ffdb4db604f811a83d03e1cdaca1bf6ab53f6c228d34c07f71ce5e5f912e77afa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z02625146.exe
Filesize
764KB

MD5
ed3c14a30af55b0b11229b6f59beb0f9

SHA1
bfc8e09c5db7a6741d8086630b0b5c79619652a4

SHA256
d4caf1f3d094eed087091fca467a4e9d15c0f5092deb0bcd9303749562f7bee3

SHA512
061bf46b3125763db843f77a010767fd32480241b347376c6047b297fe3f0a4f2a8eb8e872235880c24664e243c192d2d5ed2d46690d4f1f7852c4ab619a9204

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z02625146.exe
Filesize
764KB

MD5
ed3c14a30af55b0b11229b6f59beb0f9

SHA1
bfc8e09c5db7a6741d8086630b0b5c79619652a4

SHA256
d4caf1f3d094eed087091fca467a4e9d15c0f5092deb0bcd9303749562f7bee3

SHA512
061bf46b3125763db843f77a010767fd32480241b347376c6047b297fe3f0a4f2a8eb8e872235880c24664e243c192d2d5ed2d46690d4f1f7852c4ab619a9204

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z23129318.exe
Filesize
582KB

MD5
d6f2356cbf6131b585bb7aaf02afbe07

SHA1
db7e406bcb98c022608a10104c6b2d6ab8b410e6

SHA256
6d4a8298bc3cea3ef5164b80cc7b78b35c8344da0785578aaf30ded229555784

SHA512
a05b16aabaa4f74dd49bc610d74e1a11349068d0c31ec318aface56810175a2b25b33ea87296530e5317fae0f88f49412f179bd8ec9f9f8305ac85662e9eb8f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z23129318.exe
Filesize
582KB

MD5
d6f2356cbf6131b585bb7aaf02afbe07

SHA1
db7e406bcb98c022608a10104c6b2d6ab8b410e6

SHA256
6d4a8298bc3cea3ef5164b80cc7b78b35c8344da0785578aaf30ded229555784

SHA512
a05b16aabaa4f74dd49bc610d74e1a11349068d0c31ec318aface56810175a2b25b33ea87296530e5317fae0f88f49412f179bd8ec9f9f8305ac85662e9eb8f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s96811071.exe
Filesize
582KB

MD5
a1e99829509d3cc04439f140bbfe8dbc

SHA1
52e179cb6c0f460d8ffdfc60ee7b5143b6230386

SHA256
cbdb8604bc456d03cb8ba0b101a968536537ddd5094ea3a7b5ba9e6571474a18

SHA512
90f78a977627318bc3d4ee9c9b92b62f507e3b126ec8635a09ff22f38f0dc5f0a65d549a4da3963a937b29f465c9820d79c2d40be77897d97f9ca833cb6ced4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s96811071.exe
Filesize
582KB

MD5
a1e99829509d3cc04439f140bbfe8dbc

SHA1
52e179cb6c0f460d8ffdfc60ee7b5143b6230386

SHA256
cbdb8604bc456d03cb8ba0b101a968536537ddd5094ea3a7b5ba9e6571474a18

SHA512
90f78a977627318bc3d4ee9c9b92b62f507e3b126ec8635a09ff22f38f0dc5f0a65d549a4da3963a937b29f465c9820d79c2d40be77897d97f9ca833cb6ced4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t56046219.exe
Filesize
169KB

MD5
c46760b6b8be89367a35e49a215c7853

SHA1
e95a11c463b34dfb539ff7d2685537374f725fa4

SHA256
89df3c721d59a24d6bc1dbffe96a079f9d4685c63e6bf8fcc33ec59cdc06c87b

SHA512
1131e35107960cd484aa08fd64cd1fa767e0c32d9c77fc7083badc906f15a80f5381b9ccea9854aa801137aafc2dcc6d8886efde30eb47d0ae21cc957dd387c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t56046219.exe
Filesize
169KB

MD5
c46760b6b8be89367a35e49a215c7853

SHA1
e95a11c463b34dfb539ff7d2685537374f725fa4

SHA256
89df3c721d59a24d6bc1dbffe96a079f9d4685c63e6bf8fcc33ec59cdc06c87b

SHA512
1131e35107960cd484aa08fd64cd1fa767e0c32d9c77fc7083badc906f15a80f5381b9ccea9854aa801137aafc2dcc6d8886efde30eb47d0ae21cc957dd387c6

Download Submit
C:\Windows\Temp\1.exe
Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
C:\Windows\Temp\1.exe
Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
C:\Windows\Temp\1.exe
Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
memory/2040-200-0x0000000004F70000-0x0000000004FD0000-memory.dmp

Filesize
384KB

Download
memory/2040-212-0x0000000004F70000-0x0000000004FD0000-memory.dmp

Filesize
384KB

Download
memory/2040-174-0x0000000004F70000-0x0000000004FD0000-memory.dmp

Filesize
384KB

Download
memory/2040-176-0x0000000004F70000-0x0000000004FD0000-memory.dmp

Filesize
384KB

Download
memory/2040-172-0x0000000004F70000-0x0000000004FD0000-memory.dmp

Filesize
384KB

Download
memory/2040-170-0x0000000004F70000-0x0000000004FD0000-memory.dmp

Filesize
384KB

Download
memory/2040-178-0x0000000004F70000-0x0000000004FD0000-memory.dmp

Filesize
384KB

Download
memory/2040-180-0x0000000004F70000-0x0000000004FD0000-memory.dmp

Filesize
384KB

Download
memory/2040-182-0x0000000004F70000-0x0000000004FD0000-memory.dmp

Filesize
384KB

Download
memory/2040-184-0x0000000004F70000-0x0000000004FD0000-memory.dmp

Filesize
384KB

Download
memory/2040-186-0x0000000004F70000-0x0000000004FD0000-memory.dmp

Filesize
384KB

Download
memory/2040-188-0x0000000004F70000-0x0000000004FD0000-memory.dmp

Filesize
384KB

Download
memory/2040-190-0x0000000004F70000-0x0000000004FD0000-memory.dmp

Filesize
384KB

Download
memory/2040-192-0x0000000004F70000-0x0000000004FD0000-memory.dmp

Filesize
384KB

Download
memory/2040-194-0x0000000004F70000-0x0000000004FD0000-memory.dmp

Filesize
384KB

Download
memory/2040-196-0x0000000004F70000-0x0000000004FD0000-memory.dmp

Filesize
384KB

Download
memory/2040-198-0x0000000004F70000-0x0000000004FD0000-memory.dmp

Filesize
384KB

Download
memory/2040-167-0x0000000004F70000-0x0000000004FD0000-memory.dmp

Filesize
384KB

Download
memory/2040-202-0x0000000004F70000-0x0000000004FD0000-memory.dmp

Filesize
384KB

Download
memory/2040-204-0x0000000004F70000-0x0000000004FD0000-memory.dmp

Filesize
384KB

Download
memory/2040-206-0x0000000004F70000-0x0000000004FD0000-memory.dmp

Filesize
384KB

Download
memory/2040-208-0x0000000004F70000-0x0000000004FD0000-memory.dmp

Filesize
384KB

Download
memory/2040-210-0x0000000004F70000-0x0000000004FD0000-memory.dmp

Filesize
384KB

Download
memory/2040-168-0x0000000004F70000-0x0000000004FD0000-memory.dmp

Filesize
384KB

Download
memory/2040-214-0x0000000004F70000-0x0000000004FD0000-memory.dmp

Filesize
384KB

Download
memory/2040-216-0x0000000004F70000-0x0000000004FD0000-memory.dmp

Filesize
384KB

Download
memory/2040-218-0x0000000004F70000-0x0000000004FD0000-memory.dmp

Filesize
384KB

Download
memory/2040-220-0x0000000004F70000-0x0000000004FD0000-memory.dmp

Filesize
384KB

Download
memory/2040-222-0x0000000004F70000-0x0000000004FD0000-memory.dmp

Filesize
384KB

Download
memory/2040-224-0x0000000004F70000-0x0000000004FD0000-memory.dmp

Filesize
384KB

Download
memory/2040-226-0x0000000004F70000-0x0000000004FD0000-memory.dmp

Filesize
384KB

Download
memory/2040-228-0x0000000004F70000-0x0000000004FD0000-memory.dmp

Filesize
384KB

Download
memory/2040-2315-0x0000000005050000-0x0000000005060000-memory.dmp

Filesize
64KB

Download
memory/2040-166-0x0000000005060000-0x0000000005604000-memory.dmp

Filesize
5.6MB

Download
memory/2040-165-0x0000000000400000-0x0000000000837000-memory.dmp

Filesize
4.2MB

Download
memory/2040-164-0x0000000005050000-0x0000000005060000-memory.dmp

Filesize
64KB

Download
memory/2040-162-0x0000000002200000-0x000000000225B000-memory.dmp

Filesize
364KB

Download
memory/2040-163-0x0000000005050000-0x0000000005060000-memory.dmp

Filesize
64KB

Download
memory/4144-2332-0x0000000000E40000-0x0000000000E6E000-memory.dmp

Filesize
184KB

Download
memory/4144-2335-0x0000000005790000-0x00000000057A2000-memory.dmp

Filesize
72KB

Download
memory/4144-2337-0x0000000005780000-0x0000000005790000-memory.dmp

Filesize
64KB

Download
memory/4144-2339-0x0000000005780000-0x0000000005790000-memory.dmp

Filesize
64KB

Download
memory/4960-2328-0x0000000000D30000-0x0000000000D5E000-memory.dmp

Filesize
184KB

Download
memory/4960-2333-0x0000000005CF0000-0x0000000006308000-memory.dmp

Filesize
6.1MB

Download
memory/4960-2334-0x00000000057E0000-0x00000000058EA000-memory.dmp

Filesize
1.0MB

Download
memory/4960-2336-0x0000000005710000-0x000000000574C000-memory.dmp

Filesize
240KB

Download
memory/4960-2338-0x00000000056C0000-0x00000000056D0000-memory.dmp

Filesize
64KB

Download
memory/4960-2340-0x00000000056C0000-0x00000000056D0000-memory.dmp

Filesize
64KB

Download