redline | 35f2a91490a3e69881adc3817b30ec0058bb5ee66cc37451628a05d5169cdf91

Analysis

max time kernel
144s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2023 01:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35f2a91490a3e69881adc3817b30ec0058bb5ee66cc37451628a05d5169cdf91.exe
Size

1.2MB
MD5

c3991ae252ccccd395df7aaa3a828f68
SHA1

2fd77033b2343854de76d68914f4863d72da84df
SHA256

35f2a91490a3e69881adc3817b30ec0058bb5ee66cc37451628a05d5169cdf91
SHA512

4b4e770d4011cc981fc7e8665f727e48168b5abceba28bab7969cba33d576865b91deb5a9a035da8007caf9a1071bdbcefc8b74862cb795f6e80f98be060122a
SSDEEP

24576:DymrUXL2hkC1LFyBTQeaVpgChcwGoNaSUHhf35H/pwgfALnx:Wm82hN1LYBTQ1biRogSULhwNL

Score

10^/10

redline gena life infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

gena

185.161.248.73:4164

Attributes

auth_value
d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

life

185.161.248.73:4164

Attributes

auth_value
8685d11953530b68ad5ec703809d9f91

Signatures

Detects Redline Stealer samples 2 IoCs

This rule detects the presence of Redline Stealer samples based on their unique strings.

stealer

Processes:

resource	yara_rule
behavioral2/memory/4564-2330-0x00000000058C0000-0x0000000005ED8000-memory.dmp	redline_stealer
behavioral2/memory/1096-2340-0x0000000005770000-0x0000000005780000-memory.dmp	redline_stealer

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

s40728379.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	s40728379.exe

Executes dropped EXE 6 IoCs

Processes:

z33597068.exez27334138.exez37619894.exes40728379.exe1.exet77026415.exe

pid process

3228 z33597068.exe
1952 z27334138.exe
3500 z37619894.exe
1420 s40728379.exe
4564 1.exe
1096 t77026415.exe

pid	process
3228	z33597068.exe
1952	z27334138.exe
3500	z37619894.exe
1420	s40728379.exe
4564	1.exe
1096	t77026415.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

z37619894.exe35f2a91490a3e69881adc3817b30ec0058bb5ee66cc37451628a05d5169cdf91.exez33597068.exez27334138.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z37619894.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	35f2a91490a3e69881adc3817b30ec0058bb5ee66cc37451628a05d5169cdf91.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	35f2a91490a3e69881adc3817b30ec0058bb5ee66cc37451628a05d5169cdf91.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z33597068.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z33597068.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z27334138.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z27334138.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z37619894.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2108 1420 WerFault.exe s40728379.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

s40728379.exe

description pid process

Token: SeDebugPrivilege 1420 s40728379.exe

pid	pid_target	process	target process
2108	1420	WerFault.exe	s40728379.exe

description	pid	process
Token: SeDebugPrivilege	1420	s40728379.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

35f2a91490a3e69881adc3817b30ec0058bb5ee66cc37451628a05d5169cdf91.exez33597068.exez27334138.exez37619894.exes40728379.exe

description	pid	process	target process
PID 536 wrote to memory of 3228	536	35f2a91490a3e69881adc3817b30ec0058bb5ee66cc37451628a05d5169cdf91.exe	z33597068.exe
PID 536 wrote to memory of 3228	536	35f2a91490a3e69881adc3817b30ec0058bb5ee66cc37451628a05d5169cdf91.exe	z33597068.exe
PID 536 wrote to memory of 3228	536	35f2a91490a3e69881adc3817b30ec0058bb5ee66cc37451628a05d5169cdf91.exe	z33597068.exe
PID 3228 wrote to memory of 1952	3228	z33597068.exe	z27334138.exe
PID 3228 wrote to memory of 1952	3228	z33597068.exe	z27334138.exe
PID 3228 wrote to memory of 1952	3228	z33597068.exe	z27334138.exe
PID 1952 wrote to memory of 3500	1952	z27334138.exe	z37619894.exe
PID 1952 wrote to memory of 3500	1952	z27334138.exe	z37619894.exe
PID 1952 wrote to memory of 3500	1952	z27334138.exe	z37619894.exe
PID 3500 wrote to memory of 1420	3500	z37619894.exe	s40728379.exe
PID 3500 wrote to memory of 1420	3500	z37619894.exe	s40728379.exe
PID 3500 wrote to memory of 1420	3500	z37619894.exe	s40728379.exe
PID 1420 wrote to memory of 4564	1420	s40728379.exe	1.exe
PID 1420 wrote to memory of 4564	1420	s40728379.exe	1.exe
PID 1420 wrote to memory of 4564	1420	s40728379.exe	1.exe
PID 3500 wrote to memory of 1096	3500	z37619894.exe	t77026415.exe
PID 3500 wrote to memory of 1096	3500	z37619894.exe	t77026415.exe
PID 3500 wrote to memory of 1096	3500	z37619894.exe	t77026415.exe

C:\Users\Admin\AppData\Local\Temp\35f2a91490a3e69881adc3817b30ec0058bb5ee66cc37451628a05d5169cdf91.exe
"C:\Users\Admin\AppData\Local\Temp\35f2a91490a3e69881adc3817b30ec0058bb5ee66cc37451628a05d5169cdf91.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:536

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z33597068.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z33597068.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3228

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z27334138.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z27334138.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1952

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z37619894.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z37619894.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3500

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s40728379.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s40728379.exe
5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1420

C:\Windows\Temp\1.exe
"C:\Windows\Temp\1.exe"
6⤵
- Executes dropped EXE
PID:4564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 1384
6⤵
- Program crash
PID:2108

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t77026415.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t77026415.exe
5⤵
- Executes dropped EXE
PID:1096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1420 -ip 1420
1⤵
PID:1796

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z33597068.exe
Filesize
1.0MB

MD5
0fcee36c7eb310c57ef289b95b87092d

SHA1
10b220fe1b1703388a6255ffa141c16b7ab01894

SHA256
f50fa5dbddfdbbcef210376cd6bdd1549b2b5a93ce1bc3d6ea9adb71fd6672cf

SHA512
c7521067b49a423ff079f543069feb5d2eced54767529096a8b05c40a9a399fb1f5078bb8feeaef1913fca233702913d1637386e1a8a38db57b3825561272301

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z33597068.exe
Filesize
1.0MB

MD5
0fcee36c7eb310c57ef289b95b87092d

SHA1
10b220fe1b1703388a6255ffa141c16b7ab01894

SHA256
f50fa5dbddfdbbcef210376cd6bdd1549b2b5a93ce1bc3d6ea9adb71fd6672cf

SHA512
c7521067b49a423ff079f543069feb5d2eced54767529096a8b05c40a9a399fb1f5078bb8feeaef1913fca233702913d1637386e1a8a38db57b3825561272301

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z27334138.exe
Filesize
764KB

MD5
2698cbb5a9377365325e0da36773d5cd

SHA1
658854ceb78f914c212324780b2bc8d72a74ce26

SHA256
6bb8b0cff9d946cf545d1737f553944d69c7993b0ee33e5a961eb52e2a957669

SHA512
b08883c851248c58d77560284cbf1d72406bd299b83742d3dc1d7188294e7e195dd8a7de09267dcca4fe1b16560dcfb430fa254bd93874920ec6f949b33d2c91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z27334138.exe
Filesize
764KB

MD5
2698cbb5a9377365325e0da36773d5cd

SHA1
658854ceb78f914c212324780b2bc8d72a74ce26

SHA256
6bb8b0cff9d946cf545d1737f553944d69c7993b0ee33e5a961eb52e2a957669

SHA512
b08883c851248c58d77560284cbf1d72406bd299b83742d3dc1d7188294e7e195dd8a7de09267dcca4fe1b16560dcfb430fa254bd93874920ec6f949b33d2c91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z37619894.exe
Filesize
581KB

MD5
d7b44cc3b16bb4edee0080a6d4f3a403

SHA1
4251997c832df4de33679a415937f89ba9737c8e

SHA256
74d1f7e3ccf61e5d4e873f97b2039b1533427fd07dcc3d0a0d811d2d86b455ce

SHA512
d60c908fa29af8304c790e75851f149742502ad391d46742b7b04d7bef646e9c6573031d0ba3b0c90bd7cc49a3f99973dc514c4f9e2ad996387c60c165d15c29

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z37619894.exe
Filesize
581KB

MD5
d7b44cc3b16bb4edee0080a6d4f3a403

SHA1
4251997c832df4de33679a415937f89ba9737c8e

SHA256
74d1f7e3ccf61e5d4e873f97b2039b1533427fd07dcc3d0a0d811d2d86b455ce

SHA512
d60c908fa29af8304c790e75851f149742502ad391d46742b7b04d7bef646e9c6573031d0ba3b0c90bd7cc49a3f99973dc514c4f9e2ad996387c60c165d15c29

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s40728379.exe
Filesize
580KB

MD5
eb8206a551c079289729f5dabe3f126a

SHA1
4c449077ddf42f1fec1aeab1462fe59771f70c39

SHA256
c043d39bdcd1706aaab300f60171d0e3c9d5ffb1fd453e2563b1d44eb68a86ed

SHA512
cbbddea5eaba44bcfaefdbacde795d4d34d9a8229f35a10fb34856ec7623f4074dedd248c3dcaa2f603e31fc09da7a11d1257744d342554aa448932a21876953

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s40728379.exe
Filesize
580KB

MD5
eb8206a551c079289729f5dabe3f126a

SHA1
4c449077ddf42f1fec1aeab1462fe59771f70c39

SHA256
c043d39bdcd1706aaab300f60171d0e3c9d5ffb1fd453e2563b1d44eb68a86ed

SHA512
cbbddea5eaba44bcfaefdbacde795d4d34d9a8229f35a10fb34856ec7623f4074dedd248c3dcaa2f603e31fc09da7a11d1257744d342554aa448932a21876953

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t77026415.exe
Filesize
169KB

MD5
5e91816d6975c3dff0cf0a1c59fab727

SHA1
ece39f872bbbfe4f33726b89be38a0ba080d9993

SHA256
2518afe57786dfd43038d9bec2b5907e7e51f9270bd8341ad0d95f8828807275

SHA512
cce0d69b559bcebcb5150cf182643028c657f8ffb977d4a42db11cd796c7db2b7eb24f4ab6a7868c7861c27604e6f89f8393d13b7fb7c7bcbf15b5b4260d90cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t77026415.exe
Filesize
169KB

MD5
5e91816d6975c3dff0cf0a1c59fab727

SHA1
ece39f872bbbfe4f33726b89be38a0ba080d9993

SHA256
2518afe57786dfd43038d9bec2b5907e7e51f9270bd8341ad0d95f8828807275

SHA512
cce0d69b559bcebcb5150cf182643028c657f8ffb977d4a42db11cd796c7db2b7eb24f4ab6a7868c7861c27604e6f89f8393d13b7fb7c7bcbf15b5b4260d90cb

Download Submit
C:\Windows\Temp\1.exe
Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
C:\Windows\Temp\1.exe
Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
C:\Windows\Temp\1.exe
Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
memory/1096-2340-0x0000000005770000-0x0000000005780000-memory.dmp

Filesize
64KB

Download
memory/1096-2339-0x0000000000ED0000-0x0000000000EFE000-memory.dmp

Filesize
184KB

Download
memory/1096-2342-0x0000000005770000-0x0000000005780000-memory.dmp

Filesize
64KB

Download
memory/1420-190-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/1420-218-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/1420-176-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/1420-178-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/1420-180-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/1420-182-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/1420-184-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/1420-186-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/1420-188-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/1420-196-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/1420-198-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/1420-200-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/1420-194-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/1420-202-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/1420-192-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/1420-204-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/1420-172-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/1420-206-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/1420-208-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/1420-210-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/1420-212-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/1420-216-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/1420-214-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/1420-174-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/1420-220-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/1420-224-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/1420-222-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/1420-226-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/1420-228-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/1420-230-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/1420-2315-0x0000000004F40000-0x0000000004F50000-memory.dmp

Filesize
64KB

Download
memory/1420-2316-0x0000000004F40000-0x0000000004F50000-memory.dmp

Filesize
64KB

Download
memory/1420-2318-0x0000000004F40000-0x0000000004F50000-memory.dmp

Filesize
64KB

Download
memory/1420-170-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/1420-168-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/1420-167-0x0000000005500000-0x0000000005560000-memory.dmp

Filesize
384KB

Download
memory/1420-162-0x0000000000960000-0x00000000009BB000-memory.dmp

Filesize
364KB

Download
memory/1420-164-0x0000000004F40000-0x0000000004F50000-memory.dmp

Filesize
64KB

Download
memory/1420-163-0x0000000004F50000-0x00000000054F4000-memory.dmp

Filesize
5.6MB

Download
memory/1420-165-0x0000000004F40000-0x0000000004F50000-memory.dmp

Filesize
64KB

Download
memory/1420-166-0x0000000004F40000-0x0000000004F50000-memory.dmp

Filesize
64KB

Download
memory/4564-2334-0x0000000005290000-0x00000000052A0000-memory.dmp

Filesize
64KB

Download
memory/4564-2333-0x00000000052E0000-0x000000000531C000-memory.dmp

Filesize
240KB

Download
memory/4564-2332-0x0000000002CE0000-0x0000000002CF2000-memory.dmp

Filesize
72KB

Download
memory/4564-2331-0x00000000053B0000-0x00000000054BA000-memory.dmp

Filesize
1.0MB

Download
memory/4564-2330-0x00000000058C0000-0x0000000005ED8000-memory.dmp

Filesize
6.1MB

Download
memory/4564-2341-0x0000000005290000-0x00000000052A0000-memory.dmp

Filesize
64KB

Download
memory/4564-2329-0x00000000008F0000-0x000000000091E000-memory.dmp

Filesize
184KB

Download