Analysis

  • max time kernel
    183s
  • max time network
    205s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-05-2023 02:47

General

  • Target

    63bc1e42b0c6ba1b625957a662d71489a72399c251351ef042c1ae2d6680d3f1.exe

  • Size

    794KB

  • MD5

    967a6b4f821c37a43e32473bf7babdff

  • SHA1

    b76824489fbfc57031fa3964f0337203820b2591

  • SHA256

    63bc1e42b0c6ba1b625957a662d71489a72399c251351ef042c1ae2d6680d3f1

  • SHA512

    85f6340fd3e7b804e562227d72495764be27844ba701f2a973e85d9094146b65005344b7391d3fec4636cecd1093e0c0bc78128a048b741d89235cb4990d3287

  • SSDEEP

    24576:JyBZV6vhxlCtnSRIpxpseMg8zCgGIdMc:8LsZxlQS6Ubre

Malware Config

Extracted

Family

redline

Botnet

gena

C2

185.161.248.73:4164

Attributes
  • auth_value

    d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

dante

C2

185.161.248.73:4164

Attributes
  • auth_value

    f4066af6b8a6f23125c8ee48288a3f90

Signatures

  • Detects Redline Stealer samples 1 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\63bc1e42b0c6ba1b625957a662d71489a72399c251351ef042c1ae2d6680d3f1.exe
    "C:\Users\Admin\AppData\Local\Temp\63bc1e42b0c6ba1b625957a662d71489a72399c251351ef042c1ae2d6680d3f1.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2680
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x98163747.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x98163747.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3884
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m78480480.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m78480480.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1420
        • C:\Windows\Temp\1.exe
          "C:\Windows\Temp\1.exe"
          4⤵
          • Executes dropped EXE
          PID:4436
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 1380
          4⤵
          • Program crash
          PID:4596
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n21897179.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n21897179.exe
        3⤵
        • Executes dropped EXE
        PID:1904
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1420 -ip 1420
    1⤵
      PID:1656

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    1
    T1112

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x98163747.exe
      Filesize

      590KB

      MD5

      0fe3243c964674a61b4aa1ffe97541b0

      SHA1

      62ad0eced3f82c30cbb42c9f9aa31e85999d6086

      SHA256

      65319b375b475da7012a2f470c56f034c7404eb41be019bf111b82e5b5ebc8ac

      SHA512

      d7a0019451e4aebe6105a2c800ae6634ff4d910e631f1a3f2350ba1e54d5f3d99f0408bde17ec287109d746c696fdec911a11d23f3d05fe2c66879f0695ff1df

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x98163747.exe
      Filesize

      590KB

      MD5

      0fe3243c964674a61b4aa1ffe97541b0

      SHA1

      62ad0eced3f82c30cbb42c9f9aa31e85999d6086

      SHA256

      65319b375b475da7012a2f470c56f034c7404eb41be019bf111b82e5b5ebc8ac

      SHA512

      d7a0019451e4aebe6105a2c800ae6634ff4d910e631f1a3f2350ba1e54d5f3d99f0408bde17ec287109d746c696fdec911a11d23f3d05fe2c66879f0695ff1df

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m78480480.exe
      Filesize

      530KB

      MD5

      22113260ce3afde8584fc4941f505825

      SHA1

      03a241b99c72cd28bdeda8956c61641c4552f17c

      SHA256

      5cf45ae0913f830ab9a8733d331a9096d99a82c46479353a81b6d74df64b801d

      SHA512

      d6b975794e6aeacf9fc1f018beb8c7bc51114ebde80ec7d894671d22d3d667db0dbe13607dfbd56a97545f3c2800728428bb63031683ed6cb84154662518f46d

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m78480480.exe
      Filesize

      530KB

      MD5

      22113260ce3afde8584fc4941f505825

      SHA1

      03a241b99c72cd28bdeda8956c61641c4552f17c

      SHA256

      5cf45ae0913f830ab9a8733d331a9096d99a82c46479353a81b6d74df64b801d

      SHA512

      d6b975794e6aeacf9fc1f018beb8c7bc51114ebde80ec7d894671d22d3d667db0dbe13607dfbd56a97545f3c2800728428bb63031683ed6cb84154662518f46d

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n21897179.exe
      Filesize

      168KB

      MD5

      a32d631323edad140b440220052329e0

      SHA1

      3474bded1dac39a5566aa6bed516886ce4882b8d

      SHA256

      e034faab9b98fac0fff0b1a2825aff58837094307893169374970a814bcfda42

      SHA512

      6bfcdfb3237f82dbbabff58b61db758fd2964a725ab8985963394d91f4e5876ce4b163347ac7deb12f9f64e63f66e35eec514c58c78442563a6b760fa48f90b6

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n21897179.exe
      Filesize

      168KB

      MD5

      a32d631323edad140b440220052329e0

      SHA1

      3474bded1dac39a5566aa6bed516886ce4882b8d

      SHA256

      e034faab9b98fac0fff0b1a2825aff58837094307893169374970a814bcfda42

      SHA512

      6bfcdfb3237f82dbbabff58b61db758fd2964a725ab8985963394d91f4e5876ce4b163347ac7deb12f9f64e63f66e35eec514c58c78442563a6b760fa48f90b6

    • C:\Windows\Temp\1.exe
      Filesize

      168KB

      MD5

      f16fb63d4e551d3808e8f01f2671b57e

      SHA1

      781153ad6235a1152da112de1fb39a6f2d063575

      SHA256

      8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

      SHA512

      fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

    • C:\Windows\Temp\1.exe
      Filesize

      168KB

      MD5

      f16fb63d4e551d3808e8f01f2671b57e

      SHA1

      781153ad6235a1152da112de1fb39a6f2d063575

      SHA256

      8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

      SHA512

      fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

    • C:\Windows\Temp\1.exe
      Filesize

      168KB

      MD5

      f16fb63d4e551d3808e8f01f2671b57e

      SHA1

      781153ad6235a1152da112de1fb39a6f2d063575

      SHA256

      8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

      SHA512

      fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

    • memory/1420-192-0x00000000058E0000-0x0000000005940000-memory.dmp
      Filesize

      384KB

    • memory/1420-200-0x00000000058E0000-0x0000000005940000-memory.dmp
      Filesize

      384KB

    • memory/1420-155-0x0000000005320000-0x0000000005330000-memory.dmp
      Filesize

      64KB

    • memory/1420-156-0x0000000005320000-0x0000000005330000-memory.dmp
      Filesize

      64KB

    • memory/1420-159-0x00000000058E0000-0x0000000005940000-memory.dmp
      Filesize

      384KB

    • memory/1420-160-0x00000000058E0000-0x0000000005940000-memory.dmp
      Filesize

      384KB

    • memory/1420-162-0x00000000058E0000-0x0000000005940000-memory.dmp
      Filesize

      384KB

    • memory/1420-164-0x00000000058E0000-0x0000000005940000-memory.dmp
      Filesize

      384KB

    • memory/1420-166-0x00000000058E0000-0x0000000005940000-memory.dmp
      Filesize

      384KB

    • memory/1420-168-0x00000000058E0000-0x0000000005940000-memory.dmp
      Filesize

      384KB

    • memory/1420-170-0x00000000058E0000-0x0000000005940000-memory.dmp
      Filesize

      384KB

    • memory/1420-172-0x00000000058E0000-0x0000000005940000-memory.dmp
      Filesize

      384KB

    • memory/1420-174-0x00000000058E0000-0x0000000005940000-memory.dmp
      Filesize

      384KB

    • memory/1420-176-0x00000000058E0000-0x0000000005940000-memory.dmp
      Filesize

      384KB

    • memory/1420-178-0x00000000058E0000-0x0000000005940000-memory.dmp
      Filesize

      384KB

    • memory/1420-180-0x00000000058E0000-0x0000000005940000-memory.dmp
      Filesize

      384KB

    • memory/1420-182-0x00000000058E0000-0x0000000005940000-memory.dmp
      Filesize

      384KB

    • memory/1420-184-0x00000000058E0000-0x0000000005940000-memory.dmp
      Filesize

      384KB

    • memory/1420-186-0x00000000058E0000-0x0000000005940000-memory.dmp
      Filesize

      384KB

    • memory/1420-188-0x00000000058E0000-0x0000000005940000-memory.dmp
      Filesize

      384KB

    • memory/1420-190-0x00000000058E0000-0x0000000005940000-memory.dmp
      Filesize

      384KB

    • memory/1420-153-0x0000000000400000-0x0000000000A95000-memory.dmp
      Filesize

      6.6MB

    • memory/1420-194-0x00000000058E0000-0x0000000005940000-memory.dmp
      Filesize

      384KB

    • memory/1420-196-0x00000000058E0000-0x0000000005940000-memory.dmp
      Filesize

      384KB

    • memory/1420-198-0x00000000058E0000-0x0000000005940000-memory.dmp
      Filesize

      384KB

    • memory/1420-154-0x0000000005320000-0x0000000005330000-memory.dmp
      Filesize

      64KB

    • memory/1420-202-0x00000000058E0000-0x0000000005940000-memory.dmp
      Filesize

      384KB

    • memory/1420-204-0x00000000058E0000-0x0000000005940000-memory.dmp
      Filesize

      384KB

    • memory/1420-206-0x00000000058E0000-0x0000000005940000-memory.dmp
      Filesize

      384KB

    • memory/1420-208-0x00000000058E0000-0x0000000005940000-memory.dmp
      Filesize

      384KB

    • memory/1420-210-0x00000000058E0000-0x0000000005940000-memory.dmp
      Filesize

      384KB

    • memory/1420-212-0x00000000058E0000-0x0000000005940000-memory.dmp
      Filesize

      384KB

    • memory/1420-214-0x00000000058E0000-0x0000000005940000-memory.dmp
      Filesize

      384KB

    • memory/1420-216-0x00000000058E0000-0x0000000005940000-memory.dmp
      Filesize

      384KB

    • memory/1420-218-0x00000000058E0000-0x0000000005940000-memory.dmp
      Filesize

      384KB

    • memory/1420-2306-0x0000000005320000-0x0000000005330000-memory.dmp
      Filesize

      64KB

    • memory/1420-2309-0x0000000005320000-0x0000000005330000-memory.dmp
      Filesize

      64KB

    • memory/1420-152-0x0000000005320000-0x0000000005330000-memory.dmp
      Filesize

      64KB

    • memory/1420-151-0x0000000005320000-0x0000000005330000-memory.dmp
      Filesize

      64KB

    • memory/1420-150-0x0000000005330000-0x00000000058D4000-memory.dmp
      Filesize

      5.6MB

    • memory/1420-148-0x0000000000FB0000-0x000000000100B000-memory.dmp
      Filesize

      364KB

    • memory/1420-149-0x0000000005320000-0x0000000005330000-memory.dmp
      Filesize

      64KB

    • memory/1904-2332-0x0000000000FC0000-0x0000000000FF0000-memory.dmp
      Filesize

      192KB

    • memory/1904-2333-0x0000000005930000-0x0000000005940000-memory.dmp
      Filesize

      64KB

    • memory/1904-2335-0x0000000005930000-0x0000000005940000-memory.dmp
      Filesize

      64KB

    • memory/4436-2324-0x0000000004C90000-0x0000000004D9A000-memory.dmp
      Filesize

      1.0MB

    • memory/4436-2325-0x0000000004B40000-0x0000000004B52000-memory.dmp
      Filesize

      72KB

    • memory/4436-2326-0x0000000004B70000-0x0000000004B80000-memory.dmp
      Filesize

      64KB

    • memory/4436-2327-0x0000000004BC0000-0x0000000004BFC000-memory.dmp
      Filesize

      240KB

    • memory/4436-2323-0x00000000051A0000-0x00000000057B8000-memory.dmp
      Filesize

      6.1MB

    • memory/4436-2321-0x0000000000200000-0x000000000022E000-memory.dmp
      Filesize

      184KB

    • memory/4436-2334-0x0000000004B70000-0x0000000004B80000-memory.dmp
      Filesize

      64KB