Analysis
-
max time kernel
128s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
07-05-2023 02:30
Static task
static1
Behavioral task
behavioral1
Sample
5dadecd50eab433ff99c5c3d2c36230372db9ecc36ff124500d521ef35276041.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
5dadecd50eab433ff99c5c3d2c36230372db9ecc36ff124500d521ef35276041.exe
Resource
win10v2004-20230220-en
General
-
Target
5dadecd50eab433ff99c5c3d2c36230372db9ecc36ff124500d521ef35276041.exe
-
Size
866KB
-
MD5
823a48680abf9aa0d167f20adc2336cf
-
SHA1
e1105883802ad5cb7488159b8c9508237bece7f9
-
SHA256
5dadecd50eab433ff99c5c3d2c36230372db9ecc36ff124500d521ef35276041
-
SHA512
1a06fc4bab98c1f47ec5a6a2c03f2051ac118fb7f4ca26aeedf5cb8a4edbb7466ce2019dc8e0203b6a6e53cd98ad7d328e4bf84a20223855d1d88c7b376228d6
-
SSDEEP
12288:Cy90GFCGEeMpH+g4ixhiDuY8/3m/lIMQ51VSM0Y9RqynxXy:CytFCGEeMZ+O4KR/2/uMQf8MIoxXy
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
dark
185.161.248.73:4164
-
auth_value
ae85b01f66afe8770afeed560513fc2d
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
Processes:
y49498026.exep61223194.exe1.exer74363598.exepid process 1708 y49498026.exe 1496 p61223194.exe 1208 1.exe 584 r74363598.exe -
Loads dropped DLL 9 IoCs
Processes:
5dadecd50eab433ff99c5c3d2c36230372db9ecc36ff124500d521ef35276041.exey49498026.exep61223194.exe1.exer74363598.exepid process 840 5dadecd50eab433ff99c5c3d2c36230372db9ecc36ff124500d521ef35276041.exe 1708 y49498026.exe 1708 y49498026.exe 1708 y49498026.exe 1496 p61223194.exe 1496 p61223194.exe 1208 1.exe 1708 y49498026.exe 584 r74363598.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
5dadecd50eab433ff99c5c3d2c36230372db9ecc36ff124500d521ef35276041.exey49498026.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce 5dadecd50eab433ff99c5c3d2c36230372db9ecc36ff124500d521ef35276041.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5dadecd50eab433ff99c5c3d2c36230372db9ecc36ff124500d521ef35276041.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce y49498026.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y49498026.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
p61223194.exedescription pid process Token: SeDebugPrivilege 1496 p61223194.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
5dadecd50eab433ff99c5c3d2c36230372db9ecc36ff124500d521ef35276041.exey49498026.exep61223194.exedescription pid process target process PID 840 wrote to memory of 1708 840 5dadecd50eab433ff99c5c3d2c36230372db9ecc36ff124500d521ef35276041.exe y49498026.exe PID 840 wrote to memory of 1708 840 5dadecd50eab433ff99c5c3d2c36230372db9ecc36ff124500d521ef35276041.exe y49498026.exe PID 840 wrote to memory of 1708 840 5dadecd50eab433ff99c5c3d2c36230372db9ecc36ff124500d521ef35276041.exe y49498026.exe PID 840 wrote to memory of 1708 840 5dadecd50eab433ff99c5c3d2c36230372db9ecc36ff124500d521ef35276041.exe y49498026.exe PID 840 wrote to memory of 1708 840 5dadecd50eab433ff99c5c3d2c36230372db9ecc36ff124500d521ef35276041.exe y49498026.exe PID 840 wrote to memory of 1708 840 5dadecd50eab433ff99c5c3d2c36230372db9ecc36ff124500d521ef35276041.exe y49498026.exe PID 840 wrote to memory of 1708 840 5dadecd50eab433ff99c5c3d2c36230372db9ecc36ff124500d521ef35276041.exe y49498026.exe PID 1708 wrote to memory of 1496 1708 y49498026.exe p61223194.exe PID 1708 wrote to memory of 1496 1708 y49498026.exe p61223194.exe PID 1708 wrote to memory of 1496 1708 y49498026.exe p61223194.exe PID 1708 wrote to memory of 1496 1708 y49498026.exe p61223194.exe PID 1708 wrote to memory of 1496 1708 y49498026.exe p61223194.exe PID 1708 wrote to memory of 1496 1708 y49498026.exe p61223194.exe PID 1708 wrote to memory of 1496 1708 y49498026.exe p61223194.exe PID 1496 wrote to memory of 1208 1496 p61223194.exe 1.exe PID 1496 wrote to memory of 1208 1496 p61223194.exe 1.exe PID 1496 wrote to memory of 1208 1496 p61223194.exe 1.exe PID 1496 wrote to memory of 1208 1496 p61223194.exe 1.exe PID 1496 wrote to memory of 1208 1496 p61223194.exe 1.exe PID 1496 wrote to memory of 1208 1496 p61223194.exe 1.exe PID 1496 wrote to memory of 1208 1496 p61223194.exe 1.exe PID 1708 wrote to memory of 584 1708 y49498026.exe r74363598.exe PID 1708 wrote to memory of 584 1708 y49498026.exe r74363598.exe PID 1708 wrote to memory of 584 1708 y49498026.exe r74363598.exe PID 1708 wrote to memory of 584 1708 y49498026.exe r74363598.exe PID 1708 wrote to memory of 584 1708 y49498026.exe r74363598.exe PID 1708 wrote to memory of 584 1708 y49498026.exe r74363598.exe PID 1708 wrote to memory of 584 1708 y49498026.exe r74363598.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5dadecd50eab433ff99c5c3d2c36230372db9ecc36ff124500d521ef35276041.exe"C:\Users\Admin\AppData\Local\Temp\5dadecd50eab433ff99c5c3d2c36230372db9ecc36ff124500d521ef35276041.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y49498026.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y49498026.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p61223194.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p61223194.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r74363598.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r74363598.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y49498026.exeFilesize
576KB
MD588c40e4b8764b054775d1902ab6bd5bb
SHA1f8a3a7bb8f809f652604923935f88eceae93174d
SHA256de4736c2e123c4baf86811f937a2c8f601e408910ba5752e5d86f869a684599d
SHA5127cfcad72627a1629c6dd7f511033fbba79f877a3a18c8f1a3f8d92d7458584a73df8ebd392cff92fd7730f90a47776184f258e9ee7869a4f8057ca4fc32224df
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y49498026.exeFilesize
576KB
MD588c40e4b8764b054775d1902ab6bd5bb
SHA1f8a3a7bb8f809f652604923935f88eceae93174d
SHA256de4736c2e123c4baf86811f937a2c8f601e408910ba5752e5d86f869a684599d
SHA5127cfcad72627a1629c6dd7f511033fbba79f877a3a18c8f1a3f8d92d7458584a73df8ebd392cff92fd7730f90a47776184f258e9ee7869a4f8057ca4fc32224df
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p61223194.exeFilesize
574KB
MD57d007c80e8b2e9f6828067516b44b3eb
SHA1b064592ba34ff6968348f707fac2a79e9f885bbf
SHA25635516e2177ee06f8ab73620af8bb0cb399b158f3be20d8301f5c5bbf07ed153f
SHA51238517084cd34cbaf6cb5bb357fc3df75341eda90916cf5391a17b4387df060fc5165ed4b67f2f180d2cd82b8c06a86dabc64a89c9571a4dda1496320006081b9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p61223194.exeFilesize
574KB
MD57d007c80e8b2e9f6828067516b44b3eb
SHA1b064592ba34ff6968348f707fac2a79e9f885bbf
SHA25635516e2177ee06f8ab73620af8bb0cb399b158f3be20d8301f5c5bbf07ed153f
SHA51238517084cd34cbaf6cb5bb357fc3df75341eda90916cf5391a17b4387df060fc5165ed4b67f2f180d2cd82b8c06a86dabc64a89c9571a4dda1496320006081b9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p61223194.exeFilesize
574KB
MD57d007c80e8b2e9f6828067516b44b3eb
SHA1b064592ba34ff6968348f707fac2a79e9f885bbf
SHA25635516e2177ee06f8ab73620af8bb0cb399b158f3be20d8301f5c5bbf07ed153f
SHA51238517084cd34cbaf6cb5bb357fc3df75341eda90916cf5391a17b4387df060fc5165ed4b67f2f180d2cd82b8c06a86dabc64a89c9571a4dda1496320006081b9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r74363598.exeFilesize
171KB
MD5b3f393f73630c5c26c9ffe532b9ddbf9
SHA1db4368442a12436658bd09cdfba314e00b64cf18
SHA25608fb4411690eff0261545ee641266d36bf9c268b99bf03fe69bc3819d4c65b46
SHA512f50853b37681f202fcc9869a40f5c74b608bc3527a6380f8ff192d26293cf7ca7c915589363209a65104bfd91d928913baeb5533faea89b3cf5fdad77aec437f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r74363598.exeFilesize
171KB
MD5b3f393f73630c5c26c9ffe532b9ddbf9
SHA1db4368442a12436658bd09cdfba314e00b64cf18
SHA25608fb4411690eff0261545ee641266d36bf9c268b99bf03fe69bc3819d4c65b46
SHA512f50853b37681f202fcc9869a40f5c74b608bc3527a6380f8ff192d26293cf7ca7c915589363209a65104bfd91d928913baeb5533faea89b3cf5fdad77aec437f
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\y49498026.exeFilesize
576KB
MD588c40e4b8764b054775d1902ab6bd5bb
SHA1f8a3a7bb8f809f652604923935f88eceae93174d
SHA256de4736c2e123c4baf86811f937a2c8f601e408910ba5752e5d86f869a684599d
SHA5127cfcad72627a1629c6dd7f511033fbba79f877a3a18c8f1a3f8d92d7458584a73df8ebd392cff92fd7730f90a47776184f258e9ee7869a4f8057ca4fc32224df
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\y49498026.exeFilesize
576KB
MD588c40e4b8764b054775d1902ab6bd5bb
SHA1f8a3a7bb8f809f652604923935f88eceae93174d
SHA256de4736c2e123c4baf86811f937a2c8f601e408910ba5752e5d86f869a684599d
SHA5127cfcad72627a1629c6dd7f511033fbba79f877a3a18c8f1a3f8d92d7458584a73df8ebd392cff92fd7730f90a47776184f258e9ee7869a4f8057ca4fc32224df
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\p61223194.exeFilesize
574KB
MD57d007c80e8b2e9f6828067516b44b3eb
SHA1b064592ba34ff6968348f707fac2a79e9f885bbf
SHA25635516e2177ee06f8ab73620af8bb0cb399b158f3be20d8301f5c5bbf07ed153f
SHA51238517084cd34cbaf6cb5bb357fc3df75341eda90916cf5391a17b4387df060fc5165ed4b67f2f180d2cd82b8c06a86dabc64a89c9571a4dda1496320006081b9
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\p61223194.exeFilesize
574KB
MD57d007c80e8b2e9f6828067516b44b3eb
SHA1b064592ba34ff6968348f707fac2a79e9f885bbf
SHA25635516e2177ee06f8ab73620af8bb0cb399b158f3be20d8301f5c5bbf07ed153f
SHA51238517084cd34cbaf6cb5bb357fc3df75341eda90916cf5391a17b4387df060fc5165ed4b67f2f180d2cd82b8c06a86dabc64a89c9571a4dda1496320006081b9
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\p61223194.exeFilesize
574KB
MD57d007c80e8b2e9f6828067516b44b3eb
SHA1b064592ba34ff6968348f707fac2a79e9f885bbf
SHA25635516e2177ee06f8ab73620af8bb0cb399b158f3be20d8301f5c5bbf07ed153f
SHA51238517084cd34cbaf6cb5bb357fc3df75341eda90916cf5391a17b4387df060fc5165ed4b67f2f180d2cd82b8c06a86dabc64a89c9571a4dda1496320006081b9
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\r74363598.exeFilesize
171KB
MD5b3f393f73630c5c26c9ffe532b9ddbf9
SHA1db4368442a12436658bd09cdfba314e00b64cf18
SHA25608fb4411690eff0261545ee641266d36bf9c268b99bf03fe69bc3819d4c65b46
SHA512f50853b37681f202fcc9869a40f5c74b608bc3527a6380f8ff192d26293cf7ca7c915589363209a65104bfd91d928913baeb5533faea89b3cf5fdad77aec437f
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\r74363598.exeFilesize
171KB
MD5b3f393f73630c5c26c9ffe532b9ddbf9
SHA1db4368442a12436658bd09cdfba314e00b64cf18
SHA25608fb4411690eff0261545ee641266d36bf9c268b99bf03fe69bc3819d4c65b46
SHA512f50853b37681f202fcc9869a40f5c74b608bc3527a6380f8ff192d26293cf7ca7c915589363209a65104bfd91d928913baeb5533faea89b3cf5fdad77aec437f
-
\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
memory/584-2250-0x0000000000020000-0x0000000000026000-memory.dmpFilesize
24KB
-
memory/584-2249-0x0000000001240000-0x0000000001270000-memory.dmpFilesize
192KB
-
memory/584-2253-0x0000000000DF0000-0x0000000000E30000-memory.dmpFilesize
256KB
-
memory/584-2251-0x0000000000DF0000-0x0000000000E30000-memory.dmpFilesize
256KB
-
memory/1208-2254-0x00000000024C0000-0x0000000002500000-memory.dmpFilesize
256KB
-
memory/1208-2248-0x0000000000420000-0x0000000000426000-memory.dmpFilesize
24KB
-
memory/1208-2241-0x0000000000BF0000-0x0000000000C1E000-memory.dmpFilesize
184KB
-
memory/1208-2252-0x00000000024C0000-0x0000000002500000-memory.dmpFilesize
256KB
-
memory/1496-118-0x0000000004E80000-0x0000000004EE0000-memory.dmpFilesize
384KB
-
memory/1496-141-0x0000000004E80000-0x0000000004EE0000-memory.dmpFilesize
384KB
-
memory/1496-112-0x0000000004E80000-0x0000000004EE0000-memory.dmpFilesize
384KB
-
memory/1496-110-0x0000000004E80000-0x0000000004EE0000-memory.dmpFilesize
384KB
-
memory/1496-114-0x0000000004E80000-0x0000000004EE0000-memory.dmpFilesize
384KB
-
memory/1496-116-0x0000000004E80000-0x0000000004EE0000-memory.dmpFilesize
384KB
-
memory/1496-106-0x0000000004E80000-0x0000000004EE0000-memory.dmpFilesize
384KB
-
memory/1496-120-0x0000000004E80000-0x0000000004EE0000-memory.dmpFilesize
384KB
-
memory/1496-123-0x0000000004F00000-0x0000000004F40000-memory.dmpFilesize
256KB
-
memory/1496-122-0x0000000004E80000-0x0000000004EE0000-memory.dmpFilesize
384KB
-
memory/1496-126-0x0000000004F00000-0x0000000004F40000-memory.dmpFilesize
256KB
-
memory/1496-127-0x0000000004E80000-0x0000000004EE0000-memory.dmpFilesize
384KB
-
memory/1496-124-0x0000000004F00000-0x0000000004F40000-memory.dmpFilesize
256KB
-
memory/1496-129-0x0000000004E80000-0x0000000004EE0000-memory.dmpFilesize
384KB
-
memory/1496-131-0x0000000004E80000-0x0000000004EE0000-memory.dmpFilesize
384KB
-
memory/1496-135-0x0000000004E80000-0x0000000004EE0000-memory.dmpFilesize
384KB
-
memory/1496-133-0x0000000004E80000-0x0000000004EE0000-memory.dmpFilesize
384KB
-
memory/1496-139-0x0000000004E80000-0x0000000004EE0000-memory.dmpFilesize
384KB
-
memory/1496-137-0x0000000004E80000-0x0000000004EE0000-memory.dmpFilesize
384KB
-
memory/1496-104-0x0000000004E80000-0x0000000004EE0000-memory.dmpFilesize
384KB
-
memory/1496-143-0x0000000004E80000-0x0000000004EE0000-memory.dmpFilesize
384KB
-
memory/1496-147-0x0000000004E80000-0x0000000004EE0000-memory.dmpFilesize
384KB
-
memory/1496-145-0x0000000004E80000-0x0000000004EE0000-memory.dmpFilesize
384KB
-
memory/1496-2231-0x0000000002510000-0x0000000002542000-memory.dmpFilesize
200KB
-
memory/1496-108-0x0000000004E80000-0x0000000004EE0000-memory.dmpFilesize
384KB
-
memory/1496-100-0x0000000004E80000-0x0000000004EE0000-memory.dmpFilesize
384KB
-
memory/1496-102-0x0000000004E80000-0x0000000004EE0000-memory.dmpFilesize
384KB
-
memory/1496-96-0x0000000004E80000-0x0000000004EE0000-memory.dmpFilesize
384KB
-
memory/1496-98-0x0000000004E80000-0x0000000004EE0000-memory.dmpFilesize
384KB
-
memory/1496-94-0x0000000004E80000-0x0000000004EE0000-memory.dmpFilesize
384KB
-
memory/1496-92-0x0000000004E80000-0x0000000004EE0000-memory.dmpFilesize
384KB
-
memory/1496-90-0x0000000004E80000-0x0000000004EE0000-memory.dmpFilesize
384KB
-
memory/1496-88-0x0000000004E80000-0x0000000004EE0000-memory.dmpFilesize
384KB
-
memory/1496-86-0x0000000004E80000-0x0000000004EE0000-memory.dmpFilesize
384KB
-
memory/1496-84-0x0000000004E80000-0x0000000004EE0000-memory.dmpFilesize
384KB
-
memory/1496-82-0x0000000004E80000-0x0000000004EE0000-memory.dmpFilesize
384KB
-
memory/1496-81-0x0000000004E80000-0x0000000004EE0000-memory.dmpFilesize
384KB
-
memory/1496-80-0x0000000004E80000-0x0000000004EE6000-memory.dmpFilesize
408KB
-
memory/1496-79-0x0000000004E10000-0x0000000004E78000-memory.dmpFilesize
416KB
-
memory/1496-78-0x0000000000390000-0x00000000003EB000-memory.dmpFilesize
364KB