Analysis
-
max time kernel
127s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
07-05-2023 02:31
Static task
static1
Behavioral task
behavioral1
Sample
5dcf5054f9c3e51d091b520503404f6d4bd4533e1bb970e1d7785d4e49802fad.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
5dcf5054f9c3e51d091b520503404f6d4bd4533e1bb970e1d7785d4e49802fad.exe
Resource
win10v2004-20230220-en
General
-
Target
5dcf5054f9c3e51d091b520503404f6d4bd4533e1bb970e1d7785d4e49802fad.exe
-
Size
890KB
-
MD5
ced4c8f38d08d14d5dec8ce4f935e960
-
SHA1
aad109cc8de3b9d37a83366c721340e600847063
-
SHA256
5dcf5054f9c3e51d091b520503404f6d4bd4533e1bb970e1d7785d4e49802fad
-
SHA512
996c3c2bce491c1c9fefe7223872db72a3c87ce1d577a97c064f58e8024b1d3d1df00ededb9e5389825812b2b5b7facf835b7671eab57f40d3656dac0428dede
-
SSDEEP
12288:3y90iPMhESzIJzpnna2YzR5OwNaPbLxne5gAi2NS7D79+ZMCc/n/5bs7w+TWkG+:3yzPzSynmRNNaTLw5FyCMCknBbuw+T/
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
dante
185.161.248.73:4164
-
auth_value
f4066af6b8a6f23125c8ee48288a3f90
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
Processes:
y48740625.exep35765463.exe1.exer65089823.exepid process 1100 y48740625.exe 2028 p35765463.exe 436 1.exe 1964 r65089823.exe -
Loads dropped DLL 9 IoCs
Processes:
5dcf5054f9c3e51d091b520503404f6d4bd4533e1bb970e1d7785d4e49802fad.exey48740625.exep35765463.exe1.exer65089823.exepid process 1168 5dcf5054f9c3e51d091b520503404f6d4bd4533e1bb970e1d7785d4e49802fad.exe 1100 y48740625.exe 1100 y48740625.exe 1100 y48740625.exe 2028 p35765463.exe 2028 p35765463.exe 436 1.exe 1100 y48740625.exe 1964 r65089823.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
y48740625.exe5dcf5054f9c3e51d091b520503404f6d4bd4533e1bb970e1d7785d4e49802fad.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y48740625.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce 5dcf5054f9c3e51d091b520503404f6d4bd4533e1bb970e1d7785d4e49802fad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5dcf5054f9c3e51d091b520503404f6d4bd4533e1bb970e1d7785d4e49802fad.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce y48740625.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
p35765463.exedescription pid process Token: SeDebugPrivilege 2028 p35765463.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
5dcf5054f9c3e51d091b520503404f6d4bd4533e1bb970e1d7785d4e49802fad.exey48740625.exep35765463.exedescription pid process target process PID 1168 wrote to memory of 1100 1168 5dcf5054f9c3e51d091b520503404f6d4bd4533e1bb970e1d7785d4e49802fad.exe y48740625.exe PID 1168 wrote to memory of 1100 1168 5dcf5054f9c3e51d091b520503404f6d4bd4533e1bb970e1d7785d4e49802fad.exe y48740625.exe PID 1168 wrote to memory of 1100 1168 5dcf5054f9c3e51d091b520503404f6d4bd4533e1bb970e1d7785d4e49802fad.exe y48740625.exe PID 1168 wrote to memory of 1100 1168 5dcf5054f9c3e51d091b520503404f6d4bd4533e1bb970e1d7785d4e49802fad.exe y48740625.exe PID 1168 wrote to memory of 1100 1168 5dcf5054f9c3e51d091b520503404f6d4bd4533e1bb970e1d7785d4e49802fad.exe y48740625.exe PID 1168 wrote to memory of 1100 1168 5dcf5054f9c3e51d091b520503404f6d4bd4533e1bb970e1d7785d4e49802fad.exe y48740625.exe PID 1168 wrote to memory of 1100 1168 5dcf5054f9c3e51d091b520503404f6d4bd4533e1bb970e1d7785d4e49802fad.exe y48740625.exe PID 1100 wrote to memory of 2028 1100 y48740625.exe p35765463.exe PID 1100 wrote to memory of 2028 1100 y48740625.exe p35765463.exe PID 1100 wrote to memory of 2028 1100 y48740625.exe p35765463.exe PID 1100 wrote to memory of 2028 1100 y48740625.exe p35765463.exe PID 1100 wrote to memory of 2028 1100 y48740625.exe p35765463.exe PID 1100 wrote to memory of 2028 1100 y48740625.exe p35765463.exe PID 1100 wrote to memory of 2028 1100 y48740625.exe p35765463.exe PID 2028 wrote to memory of 436 2028 p35765463.exe 1.exe PID 2028 wrote to memory of 436 2028 p35765463.exe 1.exe PID 2028 wrote to memory of 436 2028 p35765463.exe 1.exe PID 2028 wrote to memory of 436 2028 p35765463.exe 1.exe PID 2028 wrote to memory of 436 2028 p35765463.exe 1.exe PID 2028 wrote to memory of 436 2028 p35765463.exe 1.exe PID 2028 wrote to memory of 436 2028 p35765463.exe 1.exe PID 1100 wrote to memory of 1964 1100 y48740625.exe r65089823.exe PID 1100 wrote to memory of 1964 1100 y48740625.exe r65089823.exe PID 1100 wrote to memory of 1964 1100 y48740625.exe r65089823.exe PID 1100 wrote to memory of 1964 1100 y48740625.exe r65089823.exe PID 1100 wrote to memory of 1964 1100 y48740625.exe r65089823.exe PID 1100 wrote to memory of 1964 1100 y48740625.exe r65089823.exe PID 1100 wrote to memory of 1964 1100 y48740625.exe r65089823.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5dcf5054f9c3e51d091b520503404f6d4bd4533e1bb970e1d7785d4e49802fad.exe"C:\Users\Admin\AppData\Local\Temp\5dcf5054f9c3e51d091b520503404f6d4bd4533e1bb970e1d7785d4e49802fad.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y48740625.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y48740625.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p35765463.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p35765463.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r65089823.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r65089823.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y48740625.exeFilesize
590KB
MD5b3d41431e266fa308546300043693959
SHA11be6421e1924592f6eb90f115c15107ed3671453
SHA256f1d791c645fd0957e6cb51d60c6ca78625630eaf62adea3a805e4b92daa582d8
SHA512f3e73efdf9c7e2cce909cd5bd0336cf355b35d8172bb1889ca2261cadde8a4d093c5f55623d681f4fe37f71f582cfaae8b6476bffc7176138cb7e3ffd1a545d8
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y48740625.exeFilesize
590KB
MD5b3d41431e266fa308546300043693959
SHA11be6421e1924592f6eb90f115c15107ed3671453
SHA256f1d791c645fd0957e6cb51d60c6ca78625630eaf62adea3a805e4b92daa582d8
SHA512f3e73efdf9c7e2cce909cd5bd0336cf355b35d8172bb1889ca2261cadde8a4d093c5f55623d681f4fe37f71f582cfaae8b6476bffc7176138cb7e3ffd1a545d8
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p35765463.exeFilesize
530KB
MD5e1113979a91aad7dffa3cdac5dda93d5
SHA1c16f83a9dcef70c57d4089943b9db4c087288be5
SHA256a3f21f7a1491e2602466d01f9ca000b51976f58d77ad912d86903fc55143db07
SHA512a78204920bb0db4755e8d4971b5c7bae56de1d9c52907a062559178a16450ed8bd49f75786b637fe437db7e87b5ab52c09cbbaad3f451c3f799fd1bc733f127d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p35765463.exeFilesize
530KB
MD5e1113979a91aad7dffa3cdac5dda93d5
SHA1c16f83a9dcef70c57d4089943b9db4c087288be5
SHA256a3f21f7a1491e2602466d01f9ca000b51976f58d77ad912d86903fc55143db07
SHA512a78204920bb0db4755e8d4971b5c7bae56de1d9c52907a062559178a16450ed8bd49f75786b637fe437db7e87b5ab52c09cbbaad3f451c3f799fd1bc733f127d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p35765463.exeFilesize
530KB
MD5e1113979a91aad7dffa3cdac5dda93d5
SHA1c16f83a9dcef70c57d4089943b9db4c087288be5
SHA256a3f21f7a1491e2602466d01f9ca000b51976f58d77ad912d86903fc55143db07
SHA512a78204920bb0db4755e8d4971b5c7bae56de1d9c52907a062559178a16450ed8bd49f75786b637fe437db7e87b5ab52c09cbbaad3f451c3f799fd1bc733f127d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r65089823.exeFilesize
168KB
MD5bab307ea21be78afa18e9f6401877fce
SHA1be62b5b46e9c7159b9b6d564fa2a30655983b390
SHA256a2aa50fc925825dae4df4e9438ec524a85c59cb2129dd4db74045b763bba4d70
SHA512fef488a08dd6976e4b4f069db73b8b36cf98ead273b79573249271c7b9a59748ee6e85fe543b404a7e503b45ec7f27603025bca8c312ae78059416f7eec8aacb
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r65089823.exeFilesize
168KB
MD5bab307ea21be78afa18e9f6401877fce
SHA1be62b5b46e9c7159b9b6d564fa2a30655983b390
SHA256a2aa50fc925825dae4df4e9438ec524a85c59cb2129dd4db74045b763bba4d70
SHA512fef488a08dd6976e4b4f069db73b8b36cf98ead273b79573249271c7b9a59748ee6e85fe543b404a7e503b45ec7f27603025bca8c312ae78059416f7eec8aacb
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\y48740625.exeFilesize
590KB
MD5b3d41431e266fa308546300043693959
SHA11be6421e1924592f6eb90f115c15107ed3671453
SHA256f1d791c645fd0957e6cb51d60c6ca78625630eaf62adea3a805e4b92daa582d8
SHA512f3e73efdf9c7e2cce909cd5bd0336cf355b35d8172bb1889ca2261cadde8a4d093c5f55623d681f4fe37f71f582cfaae8b6476bffc7176138cb7e3ffd1a545d8
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\y48740625.exeFilesize
590KB
MD5b3d41431e266fa308546300043693959
SHA11be6421e1924592f6eb90f115c15107ed3671453
SHA256f1d791c645fd0957e6cb51d60c6ca78625630eaf62adea3a805e4b92daa582d8
SHA512f3e73efdf9c7e2cce909cd5bd0336cf355b35d8172bb1889ca2261cadde8a4d093c5f55623d681f4fe37f71f582cfaae8b6476bffc7176138cb7e3ffd1a545d8
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\p35765463.exeFilesize
530KB
MD5e1113979a91aad7dffa3cdac5dda93d5
SHA1c16f83a9dcef70c57d4089943b9db4c087288be5
SHA256a3f21f7a1491e2602466d01f9ca000b51976f58d77ad912d86903fc55143db07
SHA512a78204920bb0db4755e8d4971b5c7bae56de1d9c52907a062559178a16450ed8bd49f75786b637fe437db7e87b5ab52c09cbbaad3f451c3f799fd1bc733f127d
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\p35765463.exeFilesize
530KB
MD5e1113979a91aad7dffa3cdac5dda93d5
SHA1c16f83a9dcef70c57d4089943b9db4c087288be5
SHA256a3f21f7a1491e2602466d01f9ca000b51976f58d77ad912d86903fc55143db07
SHA512a78204920bb0db4755e8d4971b5c7bae56de1d9c52907a062559178a16450ed8bd49f75786b637fe437db7e87b5ab52c09cbbaad3f451c3f799fd1bc733f127d
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\p35765463.exeFilesize
530KB
MD5e1113979a91aad7dffa3cdac5dda93d5
SHA1c16f83a9dcef70c57d4089943b9db4c087288be5
SHA256a3f21f7a1491e2602466d01f9ca000b51976f58d77ad912d86903fc55143db07
SHA512a78204920bb0db4755e8d4971b5c7bae56de1d9c52907a062559178a16450ed8bd49f75786b637fe437db7e87b5ab52c09cbbaad3f451c3f799fd1bc733f127d
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\r65089823.exeFilesize
168KB
MD5bab307ea21be78afa18e9f6401877fce
SHA1be62b5b46e9c7159b9b6d564fa2a30655983b390
SHA256a2aa50fc925825dae4df4e9438ec524a85c59cb2129dd4db74045b763bba4d70
SHA512fef488a08dd6976e4b4f069db73b8b36cf98ead273b79573249271c7b9a59748ee6e85fe543b404a7e503b45ec7f27603025bca8c312ae78059416f7eec8aacb
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\r65089823.exeFilesize
168KB
MD5bab307ea21be78afa18e9f6401877fce
SHA1be62b5b46e9c7159b9b6d564fa2a30655983b390
SHA256a2aa50fc925825dae4df4e9438ec524a85c59cb2129dd4db74045b763bba4d70
SHA512fef488a08dd6976e4b4f069db73b8b36cf98ead273b79573249271c7b9a59748ee6e85fe543b404a7e503b45ec7f27603025bca8c312ae78059416f7eec8aacb
-
\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
memory/436-2250-0x0000000001280000-0x00000000012C0000-memory.dmpFilesize
256KB
-
memory/436-2241-0x0000000000230000-0x0000000000236000-memory.dmpFilesize
24KB
-
memory/436-2239-0x0000000001310000-0x000000000133E000-memory.dmpFilesize
184KB
-
memory/436-2252-0x0000000001280000-0x00000000012C0000-memory.dmpFilesize
256KB
-
memory/1964-2248-0x00000000010F0000-0x0000000001120000-memory.dmpFilesize
192KB
-
memory/1964-2249-0x00000000003C0000-0x00000000003C6000-memory.dmpFilesize
24KB
-
memory/1964-2251-0x00000000008A0000-0x00000000008E0000-memory.dmpFilesize
256KB
-
memory/1964-2253-0x00000000008A0000-0x00000000008E0000-memory.dmpFilesize
256KB
-
memory/2028-119-0x0000000005110000-0x0000000005170000-memory.dmpFilesize
384KB
-
memory/2028-129-0x0000000004FD0000-0x0000000005010000-memory.dmpFilesize
256KB
-
memory/2028-109-0x0000000005110000-0x0000000005170000-memory.dmpFilesize
384KB
-
memory/2028-107-0x0000000005110000-0x0000000005170000-memory.dmpFilesize
384KB
-
memory/2028-115-0x0000000005110000-0x0000000005170000-memory.dmpFilesize
384KB
-
memory/2028-117-0x0000000005110000-0x0000000005170000-memory.dmpFilesize
384KB
-
memory/2028-111-0x0000000005110000-0x0000000005170000-memory.dmpFilesize
384KB
-
memory/2028-121-0x0000000005110000-0x0000000005170000-memory.dmpFilesize
384KB
-
memory/2028-123-0x0000000005110000-0x0000000005170000-memory.dmpFilesize
384KB
-
memory/2028-127-0x0000000004FD0000-0x0000000005010000-memory.dmpFilesize
256KB
-
memory/2028-130-0x0000000005110000-0x0000000005170000-memory.dmpFilesize
384KB
-
memory/2028-132-0x0000000005110000-0x0000000005170000-memory.dmpFilesize
384KB
-
memory/2028-134-0x0000000005110000-0x0000000005170000-memory.dmpFilesize
384KB
-
memory/2028-136-0x0000000005110000-0x0000000005170000-memory.dmpFilesize
384KB
-
memory/2028-140-0x0000000005110000-0x0000000005170000-memory.dmpFilesize
384KB
-
memory/2028-138-0x0000000005110000-0x0000000005170000-memory.dmpFilesize
384KB
-
memory/2028-142-0x0000000005110000-0x0000000005170000-memory.dmpFilesize
384KB
-
memory/2028-144-0x0000000005110000-0x0000000005170000-memory.dmpFilesize
384KB
-
memory/2028-146-0x0000000005110000-0x0000000005170000-memory.dmpFilesize
384KB
-
memory/2028-113-0x0000000005110000-0x0000000005170000-memory.dmpFilesize
384KB
-
memory/2028-126-0x00000000002B0000-0x000000000030B000-memory.dmpFilesize
364KB
-
memory/2028-125-0x0000000005110000-0x0000000005170000-memory.dmpFilesize
384KB
-
memory/2028-2230-0x0000000004F80000-0x0000000004FB2000-memory.dmpFilesize
200KB
-
memory/2028-105-0x0000000005110000-0x0000000005170000-memory.dmpFilesize
384KB
-
memory/2028-103-0x0000000005110000-0x0000000005170000-memory.dmpFilesize
384KB
-
memory/2028-101-0x0000000005110000-0x0000000005170000-memory.dmpFilesize
384KB
-
memory/2028-99-0x0000000005110000-0x0000000005170000-memory.dmpFilesize
384KB
-
memory/2028-97-0x0000000005110000-0x0000000005170000-memory.dmpFilesize
384KB
-
memory/2028-95-0x0000000005110000-0x0000000005170000-memory.dmpFilesize
384KB
-
memory/2028-93-0x0000000005110000-0x0000000005170000-memory.dmpFilesize
384KB
-
memory/2028-91-0x0000000005110000-0x0000000005170000-memory.dmpFilesize
384KB
-
memory/2028-89-0x0000000005110000-0x0000000005170000-memory.dmpFilesize
384KB
-
memory/2028-87-0x0000000005110000-0x0000000005170000-memory.dmpFilesize
384KB
-
memory/2028-85-0x0000000005110000-0x0000000005170000-memory.dmpFilesize
384KB
-
memory/2028-83-0x0000000005110000-0x0000000005170000-memory.dmpFilesize
384KB
-
memory/2028-81-0x0000000005110000-0x0000000005170000-memory.dmpFilesize
384KB
-
memory/2028-80-0x0000000005110000-0x0000000005170000-memory.dmpFilesize
384KB
-
memory/2028-79-0x0000000005110000-0x0000000005176000-memory.dmpFilesize
408KB
-
memory/2028-78-0x0000000004F10000-0x0000000004F78000-memory.dmpFilesize
416KB