Analysis
-
max time kernel
136s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2023 02:31
Static task
static1
Behavioral task
behavioral1
Sample
5de89bdddc5e5fac49ef7283597dac0b859da321e1bb8e336a38a6c5059d2c1d.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
5de89bdddc5e5fac49ef7283597dac0b859da321e1bb8e336a38a6c5059d2c1d.exe
Resource
win10v2004-20230220-en
General
-
Target
5de89bdddc5e5fac49ef7283597dac0b859da321e1bb8e336a38a6c5059d2c1d.exe
-
Size
875KB
-
MD5
6800e35c49fa5f33e267812331ec7f57
-
SHA1
8b8077406490c713730c9e3083c134891f7e93a8
-
SHA256
5de89bdddc5e5fac49ef7283597dac0b859da321e1bb8e336a38a6c5059d2c1d
-
SHA512
a05ed5310546d6935a0bf5c6a0caaad9f48fa021efcd1a4cebce1eb15199ab8b4e9e313fedc50ce9a505852fcc158df88f6deb0a6e3beb3e06785b3aa9b3ef35
-
SSDEEP
24576:ayuzcwgx6rufI6AIHXDq7xC0BMiyQIcATgrLG:huHg2fxmXIE0BMiZIcB3
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
dark
185.161.248.73:4164
-
auth_value
ae85b01f66afe8770afeed560513fc2d
Signatures
-
Detects Redline Stealer samples 1 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
Processes:
resource yara_rule behavioral2/memory/4100-2319-0x000000000ABD0000-0x000000000B1E8000-memory.dmp redline_stealer -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
p05747326.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation p05747326.exe -
Executes dropped EXE 4 IoCs
Processes:
y68333721.exep05747326.exe1.exer15290186.exepid process 1520 y68333721.exe 2936 p05747326.exe 4100 1.exe 3992 r15290186.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
5de89bdddc5e5fac49ef7283597dac0b859da321e1bb8e336a38a6c5059d2c1d.exey68333721.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 5de89bdddc5e5fac49ef7283597dac0b859da321e1bb8e336a38a6c5059d2c1d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5de89bdddc5e5fac49ef7283597dac0b859da321e1bb8e336a38a6c5059d2c1d.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce y68333721.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y68333721.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
p05747326.exedescription pid process Token: SeDebugPrivilege 2936 p05747326.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
5de89bdddc5e5fac49ef7283597dac0b859da321e1bb8e336a38a6c5059d2c1d.exey68333721.exep05747326.exedescription pid process target process PID 4104 wrote to memory of 1520 4104 5de89bdddc5e5fac49ef7283597dac0b859da321e1bb8e336a38a6c5059d2c1d.exe y68333721.exe PID 4104 wrote to memory of 1520 4104 5de89bdddc5e5fac49ef7283597dac0b859da321e1bb8e336a38a6c5059d2c1d.exe y68333721.exe PID 4104 wrote to memory of 1520 4104 5de89bdddc5e5fac49ef7283597dac0b859da321e1bb8e336a38a6c5059d2c1d.exe y68333721.exe PID 1520 wrote to memory of 2936 1520 y68333721.exe p05747326.exe PID 1520 wrote to memory of 2936 1520 y68333721.exe p05747326.exe PID 1520 wrote to memory of 2936 1520 y68333721.exe p05747326.exe PID 2936 wrote to memory of 4100 2936 p05747326.exe 1.exe PID 2936 wrote to memory of 4100 2936 p05747326.exe 1.exe PID 2936 wrote to memory of 4100 2936 p05747326.exe 1.exe PID 1520 wrote to memory of 3992 1520 y68333721.exe r15290186.exe PID 1520 wrote to memory of 3992 1520 y68333721.exe r15290186.exe PID 1520 wrote to memory of 3992 1520 y68333721.exe r15290186.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5de89bdddc5e5fac49ef7283597dac0b859da321e1bb8e336a38a6c5059d2c1d.exe"C:\Users\Admin\AppData\Local\Temp\5de89bdddc5e5fac49ef7283597dac0b859da321e1bb8e336a38a6c5059d2c1d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y68333721.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y68333721.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p05747326.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p05747326.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r15290186.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r15290186.exe3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y68333721.exeFilesize
581KB
MD57ea60bd97681f1c6f9a2c80e7d7f3b4f
SHA192ec11e8efbe82e7adb75084d0e2daa926f084d0
SHA2565324e20a4c06704974d1cb090e25c43494988a0f5c5153de46c4a91193d73969
SHA512955e10bb62a1a84604ec62273324015e56ecc8bf7a33101294b691ec1a4601505ee805a5588cb86a5b42b7197700789a47a686f407649986ede422ca8ad2c589
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y68333721.exeFilesize
581KB
MD57ea60bd97681f1c6f9a2c80e7d7f3b4f
SHA192ec11e8efbe82e7adb75084d0e2daa926f084d0
SHA2565324e20a4c06704974d1cb090e25c43494988a0f5c5153de46c4a91193d73969
SHA512955e10bb62a1a84604ec62273324015e56ecc8bf7a33101294b691ec1a4601505ee805a5588cb86a5b42b7197700789a47a686f407649986ede422ca8ad2c589
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p05747326.exeFilesize
582KB
MD562b10aad95ae5504b55a68b799df137b
SHA1464bb8e0649dc147af8a7496365e346fa7ab0a7b
SHA25695534ef010c61baa388bb151810aa9194fe5e3bd9465bf7ba8b274cf524f3ec3
SHA5129977e5c4c940ea59e2a2376c7db11e2282d7f6af8a934e3c2f4d20f6441a87ccb3615190a655409df551243585c9e08dc229b123b83c2fc5688a9c99e7037cae
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p05747326.exeFilesize
582KB
MD562b10aad95ae5504b55a68b799df137b
SHA1464bb8e0649dc147af8a7496365e346fa7ab0a7b
SHA25695534ef010c61baa388bb151810aa9194fe5e3bd9465bf7ba8b274cf524f3ec3
SHA5129977e5c4c940ea59e2a2376c7db11e2282d7f6af8a934e3c2f4d20f6441a87ccb3615190a655409df551243585c9e08dc229b123b83c2fc5688a9c99e7037cae
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r15290186.exeFilesize
171KB
MD567e24e97b8220f6dcfbb295f1ffb8ebb
SHA1e35e2ac5cf3dd333176b74ee2826f60a8e8c2ec0
SHA25669168c6efc00c88e60d86e85984748a4802501858169e8f0b965cd9b613030e0
SHA51280ae1a07f76d1d0cfbae4f600aeb30a7eb68d4daff671ce9a3e6334a5d6a22f1e4dca4df466cde73eb48fe9c1b946cb62da438e02a63002addf34e34cb39262b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r15290186.exeFilesize
171KB
MD567e24e97b8220f6dcfbb295f1ffb8ebb
SHA1e35e2ac5cf3dd333176b74ee2826f60a8e8c2ec0
SHA25669168c6efc00c88e60d86e85984748a4802501858169e8f0b965cd9b613030e0
SHA51280ae1a07f76d1d0cfbae4f600aeb30a7eb68d4daff671ce9a3e6334a5d6a22f1e4dca4df466cde73eb48fe9c1b946cb62da438e02a63002addf34e34cb39262b
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
memory/2936-190-0x0000000002AA0000-0x0000000002B00000-memory.dmpFilesize
384KB
-
memory/2936-202-0x0000000002AA0000-0x0000000002B00000-memory.dmpFilesize
384KB
-
memory/2936-156-0x0000000002AA0000-0x0000000002B00000-memory.dmpFilesize
384KB
-
memory/2936-158-0x0000000002AA0000-0x0000000002B00000-memory.dmpFilesize
384KB
-
memory/2936-160-0x0000000002AA0000-0x0000000002B00000-memory.dmpFilesize
384KB
-
memory/2936-162-0x0000000002AA0000-0x0000000002B00000-memory.dmpFilesize
384KB
-
memory/2936-164-0x0000000002AA0000-0x0000000002B00000-memory.dmpFilesize
384KB
-
memory/2936-166-0x0000000002AA0000-0x0000000002B00000-memory.dmpFilesize
384KB
-
memory/2936-168-0x0000000002AA0000-0x0000000002B00000-memory.dmpFilesize
384KB
-
memory/2936-170-0x0000000002AA0000-0x0000000002B00000-memory.dmpFilesize
384KB
-
memory/2936-172-0x0000000002AA0000-0x0000000002B00000-memory.dmpFilesize
384KB
-
memory/2936-174-0x0000000002AA0000-0x0000000002B00000-memory.dmpFilesize
384KB
-
memory/2936-176-0x0000000002AA0000-0x0000000002B00000-memory.dmpFilesize
384KB
-
memory/2936-178-0x0000000002AA0000-0x0000000002B00000-memory.dmpFilesize
384KB
-
memory/2936-180-0x0000000002AA0000-0x0000000002B00000-memory.dmpFilesize
384KB
-
memory/2936-182-0x0000000002AA0000-0x0000000002B00000-memory.dmpFilesize
384KB
-
memory/2936-184-0x0000000002AA0000-0x0000000002B00000-memory.dmpFilesize
384KB
-
memory/2936-186-0x0000000002AA0000-0x0000000002B00000-memory.dmpFilesize
384KB
-
memory/2936-188-0x0000000002AA0000-0x0000000002B00000-memory.dmpFilesize
384KB
-
memory/2936-153-0x0000000002AA0000-0x0000000002B00000-memory.dmpFilesize
384KB
-
memory/2936-192-0x0000000002AA0000-0x0000000002B00000-memory.dmpFilesize
384KB
-
memory/2936-194-0x0000000002AA0000-0x0000000002B00000-memory.dmpFilesize
384KB
-
memory/2936-196-0x0000000002AA0000-0x0000000002B00000-memory.dmpFilesize
384KB
-
memory/2936-198-0x0000000002AA0000-0x0000000002B00000-memory.dmpFilesize
384KB
-
memory/2936-200-0x0000000002AA0000-0x0000000002B00000-memory.dmpFilesize
384KB
-
memory/2936-154-0x0000000002AA0000-0x0000000002B00000-memory.dmpFilesize
384KB
-
memory/2936-204-0x0000000002AA0000-0x0000000002B00000-memory.dmpFilesize
384KB
-
memory/2936-206-0x0000000002AA0000-0x0000000002B00000-memory.dmpFilesize
384KB
-
memory/2936-208-0x0000000002AA0000-0x0000000002B00000-memory.dmpFilesize
384KB
-
memory/2936-210-0x0000000002AA0000-0x0000000002B00000-memory.dmpFilesize
384KB
-
memory/2936-212-0x0000000002AA0000-0x0000000002B00000-memory.dmpFilesize
384KB
-
memory/2936-214-0x0000000002AA0000-0x0000000002B00000-memory.dmpFilesize
384KB
-
memory/2936-216-0x0000000002AA0000-0x0000000002B00000-memory.dmpFilesize
384KB
-
memory/2936-2301-0x0000000005230000-0x0000000005240000-memory.dmpFilesize
64KB
-
memory/2936-152-0x0000000005230000-0x0000000005240000-memory.dmpFilesize
64KB
-
memory/2936-151-0x0000000005230000-0x0000000005240000-memory.dmpFilesize
64KB
-
memory/2936-150-0x0000000005230000-0x0000000005240000-memory.dmpFilesize
64KB
-
memory/2936-148-0x0000000000910000-0x000000000096B000-memory.dmpFilesize
364KB
-
memory/2936-149-0x0000000005240000-0x00000000057E4000-memory.dmpFilesize
5.6MB
-
memory/3992-2318-0x0000000000E30000-0x0000000000E60000-memory.dmpFilesize
192KB
-
memory/3992-2320-0x000000000AC80000-0x000000000AD8A000-memory.dmpFilesize
1.0MB
-
memory/3992-2322-0x000000000AC00000-0x000000000AC3C000-memory.dmpFilesize
240KB
-
memory/3992-2324-0x00000000056E0000-0x00000000056F0000-memory.dmpFilesize
64KB
-
memory/3992-2326-0x00000000056E0000-0x00000000056F0000-memory.dmpFilesize
64KB
-
memory/4100-2314-0x0000000000880000-0x00000000008AE000-memory.dmpFilesize
184KB
-
memory/4100-2319-0x000000000ABD0000-0x000000000B1E8000-memory.dmpFilesize
6.1MB
-
memory/4100-2321-0x000000000A5F0000-0x000000000A602000-memory.dmpFilesize
72KB
-
memory/4100-2323-0x0000000005220000-0x0000000005230000-memory.dmpFilesize
64KB
-
memory/4100-2325-0x0000000005220000-0x0000000005230000-memory.dmpFilesize
64KB