Analysis
-
max time kernel
183s -
max time network
205s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2023 02:47
Static task
static1
Behavioral task
behavioral1
Sample
63bc1e42b0c6ba1b625957a662d71489a72399c251351ef042c1ae2d6680d3f1.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
63bc1e42b0c6ba1b625957a662d71489a72399c251351ef042c1ae2d6680d3f1.exe
Resource
win10v2004-20230220-en
General
-
Target
63bc1e42b0c6ba1b625957a662d71489a72399c251351ef042c1ae2d6680d3f1.exe
-
Size
794KB
-
MD5
967a6b4f821c37a43e32473bf7babdff
-
SHA1
b76824489fbfc57031fa3964f0337203820b2591
-
SHA256
63bc1e42b0c6ba1b625957a662d71489a72399c251351ef042c1ae2d6680d3f1
-
SHA512
85f6340fd3e7b804e562227d72495764be27844ba701f2a973e85d9094146b65005344b7391d3fec4636cecd1093e0c0bc78128a048b741d89235cb4990d3287
-
SSDEEP
24576:JyBZV6vhxlCtnSRIpxpseMg8zCgGIdMc:8LsZxlQS6Ubre
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
dante
185.161.248.73:4164
-
auth_value
f4066af6b8a6f23125c8ee48288a3f90
Signatures
-
Detects Redline Stealer samples 1 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
Processes:
resource yara_rule behavioral2/memory/4436-2323-0x00000000051A0000-0x00000000057B8000-memory.dmp redline_stealer -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
m78480480.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation m78480480.exe -
Executes dropped EXE 4 IoCs
Processes:
x98163747.exem78480480.exe1.exen21897179.exepid process 3884 x98163747.exe 1420 m78480480.exe 4436 1.exe 1904 n21897179.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
63bc1e42b0c6ba1b625957a662d71489a72399c251351ef042c1ae2d6680d3f1.exex98163747.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 63bc1e42b0c6ba1b625957a662d71489a72399c251351ef042c1ae2d6680d3f1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 63bc1e42b0c6ba1b625957a662d71489a72399c251351ef042c1ae2d6680d3f1.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce x98163747.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x98163747.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4596 1420 WerFault.exe m78480480.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
m78480480.exedescription pid process Token: SeDebugPrivilege 1420 m78480480.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
63bc1e42b0c6ba1b625957a662d71489a72399c251351ef042c1ae2d6680d3f1.exex98163747.exem78480480.exedescription pid process target process PID 2680 wrote to memory of 3884 2680 63bc1e42b0c6ba1b625957a662d71489a72399c251351ef042c1ae2d6680d3f1.exe x98163747.exe PID 2680 wrote to memory of 3884 2680 63bc1e42b0c6ba1b625957a662d71489a72399c251351ef042c1ae2d6680d3f1.exe x98163747.exe PID 2680 wrote to memory of 3884 2680 63bc1e42b0c6ba1b625957a662d71489a72399c251351ef042c1ae2d6680d3f1.exe x98163747.exe PID 3884 wrote to memory of 1420 3884 x98163747.exe m78480480.exe PID 3884 wrote to memory of 1420 3884 x98163747.exe m78480480.exe PID 3884 wrote to memory of 1420 3884 x98163747.exe m78480480.exe PID 1420 wrote to memory of 4436 1420 m78480480.exe 1.exe PID 1420 wrote to memory of 4436 1420 m78480480.exe 1.exe PID 1420 wrote to memory of 4436 1420 m78480480.exe 1.exe PID 3884 wrote to memory of 1904 3884 x98163747.exe n21897179.exe PID 3884 wrote to memory of 1904 3884 x98163747.exe n21897179.exe PID 3884 wrote to memory of 1904 3884 x98163747.exe n21897179.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\63bc1e42b0c6ba1b625957a662d71489a72399c251351ef042c1ae2d6680d3f1.exe"C:\Users\Admin\AppData\Local\Temp\63bc1e42b0c6ba1b625957a662d71489a72399c251351ef042c1ae2d6680d3f1.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x98163747.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x98163747.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m78480480.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m78480480.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 13804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n21897179.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n21897179.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1420 -ip 14201⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x98163747.exeFilesize
590KB
MD50fe3243c964674a61b4aa1ffe97541b0
SHA162ad0eced3f82c30cbb42c9f9aa31e85999d6086
SHA25665319b375b475da7012a2f470c56f034c7404eb41be019bf111b82e5b5ebc8ac
SHA512d7a0019451e4aebe6105a2c800ae6634ff4d910e631f1a3f2350ba1e54d5f3d99f0408bde17ec287109d746c696fdec911a11d23f3d05fe2c66879f0695ff1df
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x98163747.exeFilesize
590KB
MD50fe3243c964674a61b4aa1ffe97541b0
SHA162ad0eced3f82c30cbb42c9f9aa31e85999d6086
SHA25665319b375b475da7012a2f470c56f034c7404eb41be019bf111b82e5b5ebc8ac
SHA512d7a0019451e4aebe6105a2c800ae6634ff4d910e631f1a3f2350ba1e54d5f3d99f0408bde17ec287109d746c696fdec911a11d23f3d05fe2c66879f0695ff1df
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m78480480.exeFilesize
530KB
MD522113260ce3afde8584fc4941f505825
SHA103a241b99c72cd28bdeda8956c61641c4552f17c
SHA2565cf45ae0913f830ab9a8733d331a9096d99a82c46479353a81b6d74df64b801d
SHA512d6b975794e6aeacf9fc1f018beb8c7bc51114ebde80ec7d894671d22d3d667db0dbe13607dfbd56a97545f3c2800728428bb63031683ed6cb84154662518f46d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m78480480.exeFilesize
530KB
MD522113260ce3afde8584fc4941f505825
SHA103a241b99c72cd28bdeda8956c61641c4552f17c
SHA2565cf45ae0913f830ab9a8733d331a9096d99a82c46479353a81b6d74df64b801d
SHA512d6b975794e6aeacf9fc1f018beb8c7bc51114ebde80ec7d894671d22d3d667db0dbe13607dfbd56a97545f3c2800728428bb63031683ed6cb84154662518f46d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n21897179.exeFilesize
168KB
MD5a32d631323edad140b440220052329e0
SHA13474bded1dac39a5566aa6bed516886ce4882b8d
SHA256e034faab9b98fac0fff0b1a2825aff58837094307893169374970a814bcfda42
SHA5126bfcdfb3237f82dbbabff58b61db758fd2964a725ab8985963394d91f4e5876ce4b163347ac7deb12f9f64e63f66e35eec514c58c78442563a6b760fa48f90b6
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n21897179.exeFilesize
168KB
MD5a32d631323edad140b440220052329e0
SHA13474bded1dac39a5566aa6bed516886ce4882b8d
SHA256e034faab9b98fac0fff0b1a2825aff58837094307893169374970a814bcfda42
SHA5126bfcdfb3237f82dbbabff58b61db758fd2964a725ab8985963394d91f4e5876ce4b163347ac7deb12f9f64e63f66e35eec514c58c78442563a6b760fa48f90b6
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
memory/1420-192-0x00000000058E0000-0x0000000005940000-memory.dmpFilesize
384KB
-
memory/1420-200-0x00000000058E0000-0x0000000005940000-memory.dmpFilesize
384KB
-
memory/1420-155-0x0000000005320000-0x0000000005330000-memory.dmpFilesize
64KB
-
memory/1420-156-0x0000000005320000-0x0000000005330000-memory.dmpFilesize
64KB
-
memory/1420-159-0x00000000058E0000-0x0000000005940000-memory.dmpFilesize
384KB
-
memory/1420-160-0x00000000058E0000-0x0000000005940000-memory.dmpFilesize
384KB
-
memory/1420-162-0x00000000058E0000-0x0000000005940000-memory.dmpFilesize
384KB
-
memory/1420-164-0x00000000058E0000-0x0000000005940000-memory.dmpFilesize
384KB
-
memory/1420-166-0x00000000058E0000-0x0000000005940000-memory.dmpFilesize
384KB
-
memory/1420-168-0x00000000058E0000-0x0000000005940000-memory.dmpFilesize
384KB
-
memory/1420-170-0x00000000058E0000-0x0000000005940000-memory.dmpFilesize
384KB
-
memory/1420-172-0x00000000058E0000-0x0000000005940000-memory.dmpFilesize
384KB
-
memory/1420-174-0x00000000058E0000-0x0000000005940000-memory.dmpFilesize
384KB
-
memory/1420-176-0x00000000058E0000-0x0000000005940000-memory.dmpFilesize
384KB
-
memory/1420-178-0x00000000058E0000-0x0000000005940000-memory.dmpFilesize
384KB
-
memory/1420-180-0x00000000058E0000-0x0000000005940000-memory.dmpFilesize
384KB
-
memory/1420-182-0x00000000058E0000-0x0000000005940000-memory.dmpFilesize
384KB
-
memory/1420-184-0x00000000058E0000-0x0000000005940000-memory.dmpFilesize
384KB
-
memory/1420-186-0x00000000058E0000-0x0000000005940000-memory.dmpFilesize
384KB
-
memory/1420-188-0x00000000058E0000-0x0000000005940000-memory.dmpFilesize
384KB
-
memory/1420-190-0x00000000058E0000-0x0000000005940000-memory.dmpFilesize
384KB
-
memory/1420-153-0x0000000000400000-0x0000000000A95000-memory.dmpFilesize
6.6MB
-
memory/1420-194-0x00000000058E0000-0x0000000005940000-memory.dmpFilesize
384KB
-
memory/1420-196-0x00000000058E0000-0x0000000005940000-memory.dmpFilesize
384KB
-
memory/1420-198-0x00000000058E0000-0x0000000005940000-memory.dmpFilesize
384KB
-
memory/1420-154-0x0000000005320000-0x0000000005330000-memory.dmpFilesize
64KB
-
memory/1420-202-0x00000000058E0000-0x0000000005940000-memory.dmpFilesize
384KB
-
memory/1420-204-0x00000000058E0000-0x0000000005940000-memory.dmpFilesize
384KB
-
memory/1420-206-0x00000000058E0000-0x0000000005940000-memory.dmpFilesize
384KB
-
memory/1420-208-0x00000000058E0000-0x0000000005940000-memory.dmpFilesize
384KB
-
memory/1420-210-0x00000000058E0000-0x0000000005940000-memory.dmpFilesize
384KB
-
memory/1420-212-0x00000000058E0000-0x0000000005940000-memory.dmpFilesize
384KB
-
memory/1420-214-0x00000000058E0000-0x0000000005940000-memory.dmpFilesize
384KB
-
memory/1420-216-0x00000000058E0000-0x0000000005940000-memory.dmpFilesize
384KB
-
memory/1420-218-0x00000000058E0000-0x0000000005940000-memory.dmpFilesize
384KB
-
memory/1420-2306-0x0000000005320000-0x0000000005330000-memory.dmpFilesize
64KB
-
memory/1420-2309-0x0000000005320000-0x0000000005330000-memory.dmpFilesize
64KB
-
memory/1420-152-0x0000000005320000-0x0000000005330000-memory.dmpFilesize
64KB
-
memory/1420-151-0x0000000005320000-0x0000000005330000-memory.dmpFilesize
64KB
-
memory/1420-150-0x0000000005330000-0x00000000058D4000-memory.dmpFilesize
5.6MB
-
memory/1420-148-0x0000000000FB0000-0x000000000100B000-memory.dmpFilesize
364KB
-
memory/1420-149-0x0000000005320000-0x0000000005330000-memory.dmpFilesize
64KB
-
memory/1904-2332-0x0000000000FC0000-0x0000000000FF0000-memory.dmpFilesize
192KB
-
memory/1904-2333-0x0000000005930000-0x0000000005940000-memory.dmpFilesize
64KB
-
memory/1904-2335-0x0000000005930000-0x0000000005940000-memory.dmpFilesize
64KB
-
memory/4436-2324-0x0000000004C90000-0x0000000004D9A000-memory.dmpFilesize
1.0MB
-
memory/4436-2325-0x0000000004B40000-0x0000000004B52000-memory.dmpFilesize
72KB
-
memory/4436-2326-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/4436-2327-0x0000000004BC0000-0x0000000004BFC000-memory.dmpFilesize
240KB
-
memory/4436-2323-0x00000000051A0000-0x00000000057B8000-memory.dmpFilesize
6.1MB
-
memory/4436-2321-0x0000000000200000-0x000000000022E000-memory.dmpFilesize
184KB
-
memory/4436-2334-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB