Analysis

  • max time kernel
    142s
  • max time network
    158s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    07-05-2023 02:47

General

  • Target

    63bc1e42b0c6ba1b625957a662d71489a72399c251351ef042c1ae2d6680d3f1.exe

  • Size

    794KB

  • MD5

    967a6b4f821c37a43e32473bf7babdff

  • SHA1

    b76824489fbfc57031fa3964f0337203820b2591

  • SHA256

    63bc1e42b0c6ba1b625957a662d71489a72399c251351ef042c1ae2d6680d3f1

  • SHA512

    85f6340fd3e7b804e562227d72495764be27844ba701f2a973e85d9094146b65005344b7391d3fec4636cecd1093e0c0bc78128a048b741d89235cb4990d3287

  • SSDEEP

    24576:JyBZV6vhxlCtnSRIpxpseMg8zCgGIdMc:8LsZxlQS6Ubre

Malware Config

Extracted

Family

redline

Botnet

gena

C2

185.161.248.73:4164

Attributes
  • auth_value

    d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

dante

C2

185.161.248.73:4164

Attributes
  • auth_value

    f4066af6b8a6f23125c8ee48288a3f90

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 9 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\63bc1e42b0c6ba1b625957a662d71489a72399c251351ef042c1ae2d6680d3f1.exe
    "C:\Users\Admin\AppData\Local\Temp\63bc1e42b0c6ba1b625957a662d71489a72399c251351ef042c1ae2d6680d3f1.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1704
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x98163747.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x98163747.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1356
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m78480480.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m78480480.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1312
        • C:\Windows\Temp\1.exe
          "C:\Windows\Temp\1.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1132
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n21897179.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n21897179.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:544

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x98163747.exe
    Filesize

    590KB

    MD5

    0fe3243c964674a61b4aa1ffe97541b0

    SHA1

    62ad0eced3f82c30cbb42c9f9aa31e85999d6086

    SHA256

    65319b375b475da7012a2f470c56f034c7404eb41be019bf111b82e5b5ebc8ac

    SHA512

    d7a0019451e4aebe6105a2c800ae6634ff4d910e631f1a3f2350ba1e54d5f3d99f0408bde17ec287109d746c696fdec911a11d23f3d05fe2c66879f0695ff1df

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x98163747.exe
    Filesize

    590KB

    MD5

    0fe3243c964674a61b4aa1ffe97541b0

    SHA1

    62ad0eced3f82c30cbb42c9f9aa31e85999d6086

    SHA256

    65319b375b475da7012a2f470c56f034c7404eb41be019bf111b82e5b5ebc8ac

    SHA512

    d7a0019451e4aebe6105a2c800ae6634ff4d910e631f1a3f2350ba1e54d5f3d99f0408bde17ec287109d746c696fdec911a11d23f3d05fe2c66879f0695ff1df

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m78480480.exe
    Filesize

    530KB

    MD5

    22113260ce3afde8584fc4941f505825

    SHA1

    03a241b99c72cd28bdeda8956c61641c4552f17c

    SHA256

    5cf45ae0913f830ab9a8733d331a9096d99a82c46479353a81b6d74df64b801d

    SHA512

    d6b975794e6aeacf9fc1f018beb8c7bc51114ebde80ec7d894671d22d3d667db0dbe13607dfbd56a97545f3c2800728428bb63031683ed6cb84154662518f46d

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m78480480.exe
    Filesize

    530KB

    MD5

    22113260ce3afde8584fc4941f505825

    SHA1

    03a241b99c72cd28bdeda8956c61641c4552f17c

    SHA256

    5cf45ae0913f830ab9a8733d331a9096d99a82c46479353a81b6d74df64b801d

    SHA512

    d6b975794e6aeacf9fc1f018beb8c7bc51114ebde80ec7d894671d22d3d667db0dbe13607dfbd56a97545f3c2800728428bb63031683ed6cb84154662518f46d

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m78480480.exe
    Filesize

    530KB

    MD5

    22113260ce3afde8584fc4941f505825

    SHA1

    03a241b99c72cd28bdeda8956c61641c4552f17c

    SHA256

    5cf45ae0913f830ab9a8733d331a9096d99a82c46479353a81b6d74df64b801d

    SHA512

    d6b975794e6aeacf9fc1f018beb8c7bc51114ebde80ec7d894671d22d3d667db0dbe13607dfbd56a97545f3c2800728428bb63031683ed6cb84154662518f46d

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n21897179.exe
    Filesize

    168KB

    MD5

    a32d631323edad140b440220052329e0

    SHA1

    3474bded1dac39a5566aa6bed516886ce4882b8d

    SHA256

    e034faab9b98fac0fff0b1a2825aff58837094307893169374970a814bcfda42

    SHA512

    6bfcdfb3237f82dbbabff58b61db758fd2964a725ab8985963394d91f4e5876ce4b163347ac7deb12f9f64e63f66e35eec514c58c78442563a6b760fa48f90b6

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n21897179.exe
    Filesize

    168KB

    MD5

    a32d631323edad140b440220052329e0

    SHA1

    3474bded1dac39a5566aa6bed516886ce4882b8d

    SHA256

    e034faab9b98fac0fff0b1a2825aff58837094307893169374970a814bcfda42

    SHA512

    6bfcdfb3237f82dbbabff58b61db758fd2964a725ab8985963394d91f4e5876ce4b163347ac7deb12f9f64e63f66e35eec514c58c78442563a6b760fa48f90b6

  • C:\Windows\Temp\1.exe
    Filesize

    168KB

    MD5

    f16fb63d4e551d3808e8f01f2671b57e

    SHA1

    781153ad6235a1152da112de1fb39a6f2d063575

    SHA256

    8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

    SHA512

    fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

  • C:\Windows\Temp\1.exe
    Filesize

    168KB

    MD5

    f16fb63d4e551d3808e8f01f2671b57e

    SHA1

    781153ad6235a1152da112de1fb39a6f2d063575

    SHA256

    8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

    SHA512

    fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\x98163747.exe
    Filesize

    590KB

    MD5

    0fe3243c964674a61b4aa1ffe97541b0

    SHA1

    62ad0eced3f82c30cbb42c9f9aa31e85999d6086

    SHA256

    65319b375b475da7012a2f470c56f034c7404eb41be019bf111b82e5b5ebc8ac

    SHA512

    d7a0019451e4aebe6105a2c800ae6634ff4d910e631f1a3f2350ba1e54d5f3d99f0408bde17ec287109d746c696fdec911a11d23f3d05fe2c66879f0695ff1df

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\x98163747.exe
    Filesize

    590KB

    MD5

    0fe3243c964674a61b4aa1ffe97541b0

    SHA1

    62ad0eced3f82c30cbb42c9f9aa31e85999d6086

    SHA256

    65319b375b475da7012a2f470c56f034c7404eb41be019bf111b82e5b5ebc8ac

    SHA512

    d7a0019451e4aebe6105a2c800ae6634ff4d910e631f1a3f2350ba1e54d5f3d99f0408bde17ec287109d746c696fdec911a11d23f3d05fe2c66879f0695ff1df

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\m78480480.exe
    Filesize

    530KB

    MD5

    22113260ce3afde8584fc4941f505825

    SHA1

    03a241b99c72cd28bdeda8956c61641c4552f17c

    SHA256

    5cf45ae0913f830ab9a8733d331a9096d99a82c46479353a81b6d74df64b801d

    SHA512

    d6b975794e6aeacf9fc1f018beb8c7bc51114ebde80ec7d894671d22d3d667db0dbe13607dfbd56a97545f3c2800728428bb63031683ed6cb84154662518f46d

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\m78480480.exe
    Filesize

    530KB

    MD5

    22113260ce3afde8584fc4941f505825

    SHA1

    03a241b99c72cd28bdeda8956c61641c4552f17c

    SHA256

    5cf45ae0913f830ab9a8733d331a9096d99a82c46479353a81b6d74df64b801d

    SHA512

    d6b975794e6aeacf9fc1f018beb8c7bc51114ebde80ec7d894671d22d3d667db0dbe13607dfbd56a97545f3c2800728428bb63031683ed6cb84154662518f46d

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\m78480480.exe
    Filesize

    530KB

    MD5

    22113260ce3afde8584fc4941f505825

    SHA1

    03a241b99c72cd28bdeda8956c61641c4552f17c

    SHA256

    5cf45ae0913f830ab9a8733d331a9096d99a82c46479353a81b6d74df64b801d

    SHA512

    d6b975794e6aeacf9fc1f018beb8c7bc51114ebde80ec7d894671d22d3d667db0dbe13607dfbd56a97545f3c2800728428bb63031683ed6cb84154662518f46d

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\n21897179.exe
    Filesize

    168KB

    MD5

    a32d631323edad140b440220052329e0

    SHA1

    3474bded1dac39a5566aa6bed516886ce4882b8d

    SHA256

    e034faab9b98fac0fff0b1a2825aff58837094307893169374970a814bcfda42

    SHA512

    6bfcdfb3237f82dbbabff58b61db758fd2964a725ab8985963394d91f4e5876ce4b163347ac7deb12f9f64e63f66e35eec514c58c78442563a6b760fa48f90b6

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\n21897179.exe
    Filesize

    168KB

    MD5

    a32d631323edad140b440220052329e0

    SHA1

    3474bded1dac39a5566aa6bed516886ce4882b8d

    SHA256

    e034faab9b98fac0fff0b1a2825aff58837094307893169374970a814bcfda42

    SHA512

    6bfcdfb3237f82dbbabff58b61db758fd2964a725ab8985963394d91f4e5876ce4b163347ac7deb12f9f64e63f66e35eec514c58c78442563a6b760fa48f90b6

  • \Windows\Temp\1.exe
    Filesize

    168KB

    MD5

    f16fb63d4e551d3808e8f01f2671b57e

    SHA1

    781153ad6235a1152da112de1fb39a6f2d063575

    SHA256

    8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

    SHA512

    fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

  • \Windows\Temp\1.exe
    Filesize

    168KB

    MD5

    f16fb63d4e551d3808e8f01f2671b57e

    SHA1

    781153ad6235a1152da112de1fb39a6f2d063575

    SHA256

    8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

    SHA512

    fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

  • memory/544-2250-0x0000000000E70000-0x0000000000EA0000-memory.dmp
    Filesize

    192KB

  • memory/544-2251-0x00000000004D0000-0x00000000004D6000-memory.dmp
    Filesize

    24KB

  • memory/544-2253-0x0000000004BB0000-0x0000000004BF0000-memory.dmp
    Filesize

    256KB

  • memory/544-2255-0x0000000004BB0000-0x0000000004BF0000-memory.dmp
    Filesize

    256KB

  • memory/1132-2249-0x00000000003F0000-0x00000000003F6000-memory.dmp
    Filesize

    24KB

  • memory/1132-2252-0x0000000004BF0000-0x0000000004C30000-memory.dmp
    Filesize

    256KB

  • memory/1132-2242-0x0000000000E70000-0x0000000000E9E000-memory.dmp
    Filesize

    184KB

  • memory/1132-2254-0x0000000004BF0000-0x0000000004C30000-memory.dmp
    Filesize

    256KB

  • memory/1312-115-0x0000000002930000-0x0000000002990000-memory.dmp
    Filesize

    384KB

  • memory/1312-147-0x0000000002930000-0x0000000002990000-memory.dmp
    Filesize

    384KB

  • memory/1312-107-0x0000000002930000-0x0000000002990000-memory.dmp
    Filesize

    384KB

  • memory/1312-113-0x0000000002930000-0x0000000002990000-memory.dmp
    Filesize

    384KB

  • memory/1312-111-0x0000000002930000-0x0000000002990000-memory.dmp
    Filesize

    384KB

  • memory/1312-109-0x0000000002930000-0x0000000002990000-memory.dmp
    Filesize

    384KB

  • memory/1312-103-0x0000000002930000-0x0000000002990000-memory.dmp
    Filesize

    384KB

  • memory/1312-117-0x0000000002930000-0x0000000002990000-memory.dmp
    Filesize

    384KB

  • memory/1312-119-0x0000000002930000-0x0000000002990000-memory.dmp
    Filesize

    384KB

  • memory/1312-121-0x0000000002930000-0x0000000002990000-memory.dmp
    Filesize

    384KB

  • memory/1312-125-0x0000000002930000-0x0000000002990000-memory.dmp
    Filesize

    384KB

  • memory/1312-123-0x0000000002930000-0x0000000002990000-memory.dmp
    Filesize

    384KB

  • memory/1312-127-0x0000000002930000-0x0000000002990000-memory.dmp
    Filesize

    384KB

  • memory/1312-129-0x0000000002930000-0x0000000002990000-memory.dmp
    Filesize

    384KB

  • memory/1312-131-0x0000000002930000-0x0000000002990000-memory.dmp
    Filesize

    384KB

  • memory/1312-133-0x0000000002930000-0x0000000002990000-memory.dmp
    Filesize

    384KB

  • memory/1312-135-0x0000000002930000-0x0000000002990000-memory.dmp
    Filesize

    384KB

  • memory/1312-137-0x0000000002930000-0x0000000002990000-memory.dmp
    Filesize

    384KB

  • memory/1312-139-0x0000000002930000-0x0000000002990000-memory.dmp
    Filesize

    384KB

  • memory/1312-141-0x0000000002930000-0x0000000002990000-memory.dmp
    Filesize

    384KB

  • memory/1312-143-0x0000000002930000-0x0000000002990000-memory.dmp
    Filesize

    384KB

  • memory/1312-105-0x0000000002930000-0x0000000002990000-memory.dmp
    Filesize

    384KB

  • memory/1312-145-0x0000000002930000-0x0000000002990000-memory.dmp
    Filesize

    384KB

  • memory/1312-2230-0x00000000027F0000-0x0000000002822000-memory.dmp
    Filesize

    200KB

  • memory/1312-2233-0x0000000005280000-0x00000000052C0000-memory.dmp
    Filesize

    256KB

  • memory/1312-97-0x0000000002930000-0x0000000002990000-memory.dmp
    Filesize

    384KB

  • memory/1312-99-0x0000000002930000-0x0000000002990000-memory.dmp
    Filesize

    384KB

  • memory/1312-101-0x0000000002930000-0x0000000002990000-memory.dmp
    Filesize

    384KB

  • memory/1312-93-0x0000000002930000-0x0000000002990000-memory.dmp
    Filesize

    384KB

  • memory/1312-95-0x0000000002930000-0x0000000002990000-memory.dmp
    Filesize

    384KB

  • memory/1312-88-0x0000000002930000-0x0000000002990000-memory.dmp
    Filesize

    384KB

  • memory/1312-91-0x0000000002930000-0x0000000002990000-memory.dmp
    Filesize

    384KB

  • memory/1312-89-0x0000000005280000-0x00000000052C0000-memory.dmp
    Filesize

    256KB

  • memory/1312-87-0x0000000005280000-0x00000000052C0000-memory.dmp
    Filesize

    256KB

  • memory/1312-84-0x0000000002930000-0x0000000002990000-memory.dmp
    Filesize

    384KB

  • memory/1312-85-0x0000000005280000-0x00000000052C0000-memory.dmp
    Filesize

    256KB

  • memory/1312-83-0x0000000000300000-0x000000000035B000-memory.dmp
    Filesize

    364KB

  • memory/1312-81-0x0000000002930000-0x0000000002990000-memory.dmp
    Filesize

    384KB

  • memory/1312-80-0x0000000002930000-0x0000000002990000-memory.dmp
    Filesize

    384KB

  • memory/1312-79-0x0000000002930000-0x0000000002996000-memory.dmp
    Filesize

    408KB

  • memory/1312-78-0x0000000001170000-0x00000000011D8000-memory.dmp
    Filesize

    416KB