Analysis
-
max time kernel
184s -
max time network
192s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2023 02:57
Static task
static1
Behavioral task
behavioral1
Sample
67be978a3318ac18b192ebe5a03739d40df6e80fb8a53ddd18fb595d59817fff.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
67be978a3318ac18b192ebe5a03739d40df6e80fb8a53ddd18fb595d59817fff.exe
Resource
win10v2004-20230220-en
General
-
Target
67be978a3318ac18b192ebe5a03739d40df6e80fb8a53ddd18fb595d59817fff.exe
-
Size
1.2MB
-
MD5
d2cf768c2aef9df50031b6a63530f700
-
SHA1
3654827e43a5f3a95a887c2dfc678fe6bfa5fefc
-
SHA256
67be978a3318ac18b192ebe5a03739d40df6e80fb8a53ddd18fb595d59817fff
-
SHA512
07503c824658f15e48c2388d95088872daef98409247b6f784e388ea6a623bffda20f0e51dcfb90f6a16d2344bbd7083bb0761e486de4aa062847106c6791da0
-
SSDEEP
24576:+yo/SWRHS6P+H/n3840bgLRLG6o9kL7LVGQt0X5L9:No/7+H/s+o6o9Q4
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
life
185.161.248.73:4164
-
auth_value
8685d11953530b68ad5ec703809d9f91
Signatures
-
Detects Redline Stealer samples 1 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
Processes:
resource yara_rule behavioral2/memory/2660-2331-0x000000000ABC0000-0x000000000B1D8000-memory.dmp redline_stealer -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
s76426949.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation s76426949.exe -
Executes dropped EXE 6 IoCs
Processes:
z98644738.exez66946438.exez07828587.exes76426949.exe1.exet24400488.exepid process 5068 z98644738.exe 1920 z66946438.exe 3056 z07828587.exe 2868 s76426949.exe 2660 1.exe 4116 t24400488.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
z07828587.exe67be978a3318ac18b192ebe5a03739d40df6e80fb8a53ddd18fb595d59817fff.exez98644738.exez66946438.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z07828587.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 67be978a3318ac18b192ebe5a03739d40df6e80fb8a53ddd18fb595d59817fff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 67be978a3318ac18b192ebe5a03739d40df6e80fb8a53ddd18fb595d59817fff.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z98644738.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z98644738.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z66946438.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z66946438.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z07828587.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3328 2868 WerFault.exe s76426949.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
s76426949.exedescription pid process Token: SeDebugPrivilege 2868 s76426949.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
67be978a3318ac18b192ebe5a03739d40df6e80fb8a53ddd18fb595d59817fff.exez98644738.exez66946438.exez07828587.exes76426949.exedescription pid process target process PID 1356 wrote to memory of 5068 1356 67be978a3318ac18b192ebe5a03739d40df6e80fb8a53ddd18fb595d59817fff.exe z98644738.exe PID 1356 wrote to memory of 5068 1356 67be978a3318ac18b192ebe5a03739d40df6e80fb8a53ddd18fb595d59817fff.exe z98644738.exe PID 1356 wrote to memory of 5068 1356 67be978a3318ac18b192ebe5a03739d40df6e80fb8a53ddd18fb595d59817fff.exe z98644738.exe PID 5068 wrote to memory of 1920 5068 z98644738.exe z66946438.exe PID 5068 wrote to memory of 1920 5068 z98644738.exe z66946438.exe PID 5068 wrote to memory of 1920 5068 z98644738.exe z66946438.exe PID 1920 wrote to memory of 3056 1920 z66946438.exe z07828587.exe PID 1920 wrote to memory of 3056 1920 z66946438.exe z07828587.exe PID 1920 wrote to memory of 3056 1920 z66946438.exe z07828587.exe PID 3056 wrote to memory of 2868 3056 z07828587.exe s76426949.exe PID 3056 wrote to memory of 2868 3056 z07828587.exe s76426949.exe PID 3056 wrote to memory of 2868 3056 z07828587.exe s76426949.exe PID 2868 wrote to memory of 2660 2868 s76426949.exe 1.exe PID 2868 wrote to memory of 2660 2868 s76426949.exe 1.exe PID 2868 wrote to memory of 2660 2868 s76426949.exe 1.exe PID 3056 wrote to memory of 4116 3056 z07828587.exe t24400488.exe PID 3056 wrote to memory of 4116 3056 z07828587.exe t24400488.exe PID 3056 wrote to memory of 4116 3056 z07828587.exe t24400488.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\67be978a3318ac18b192ebe5a03739d40df6e80fb8a53ddd18fb595d59817fff.exe"C:\Users\Admin\AppData\Local\Temp\67be978a3318ac18b192ebe5a03739d40df6e80fb8a53ddd18fb595d59817fff.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z98644738.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z98644738.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z66946438.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z66946438.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z07828587.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z07828587.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s76426949.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s76426949.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 12126⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t24400488.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t24400488.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2868 -ip 28681⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z98644738.exeFilesize
1.0MB
MD53de750b8ab1b21ad700cc72d9e3c8b8d
SHA110871f34da764db8cf747f4328e4c804b5b525a6
SHA256a9cfbe51ce240ed2fcacaf1ffe135a9144673fa23c2401257b1ecf5fa23b7f86
SHA512791cc9644c882cfebec989454701736e8038a5c25325b157997e8fed792c690622dbfab79309dcade8b521cdde0f9f78cce100a03c1fa529b3f8f2b5cb2dbe77
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z98644738.exeFilesize
1.0MB
MD53de750b8ab1b21ad700cc72d9e3c8b8d
SHA110871f34da764db8cf747f4328e4c804b5b525a6
SHA256a9cfbe51ce240ed2fcacaf1ffe135a9144673fa23c2401257b1ecf5fa23b7f86
SHA512791cc9644c882cfebec989454701736e8038a5c25325b157997e8fed792c690622dbfab79309dcade8b521cdde0f9f78cce100a03c1fa529b3f8f2b5cb2dbe77
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z66946438.exeFilesize
761KB
MD5128513a4859760d4b9c428d5fd1018b5
SHA109e0f12ff47a1cf1818e53f1c52b7a4a12f6a731
SHA256748b5f344ef4d417af8024509edebf909c402bd97f5d6ba19b42903352d8f3a6
SHA51228acb05cae6f976b69fe3b3853aace63ab06a125ff46cb7efa047f458c2b59fb11e6ed0d571ca6b1eb7b90bb5dd9bdc10b4dd1ff4c3cb0dba23227f64b1ac5e0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z66946438.exeFilesize
761KB
MD5128513a4859760d4b9c428d5fd1018b5
SHA109e0f12ff47a1cf1818e53f1c52b7a4a12f6a731
SHA256748b5f344ef4d417af8024509edebf909c402bd97f5d6ba19b42903352d8f3a6
SHA51228acb05cae6f976b69fe3b3853aace63ab06a125ff46cb7efa047f458c2b59fb11e6ed0d571ca6b1eb7b90bb5dd9bdc10b4dd1ff4c3cb0dba23227f64b1ac5e0
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z07828587.exeFilesize
578KB
MD5550b62352e7a45d2f6aaba6867a8f8e2
SHA1b591a777fdd8cf04c2e8eea861d593141ac84c29
SHA256fc0485a462e5f716dcfb665aecc4d7899e226f71a41281195b224148a3d914b5
SHA512b5ab0aa1a712aa5a7d2ff0733f7ad324be7efadb8f386fa13cf41dede53d867deb0647754745a39271ae4b39467e3e97c7c1a6eb3ec5faaaa7089bce7ab6d1ec
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z07828587.exeFilesize
578KB
MD5550b62352e7a45d2f6aaba6867a8f8e2
SHA1b591a777fdd8cf04c2e8eea861d593141ac84c29
SHA256fc0485a462e5f716dcfb665aecc4d7899e226f71a41281195b224148a3d914b5
SHA512b5ab0aa1a712aa5a7d2ff0733f7ad324be7efadb8f386fa13cf41dede53d867deb0647754745a39271ae4b39467e3e97c7c1a6eb3ec5faaaa7089bce7ab6d1ec
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s76426949.exeFilesize
502KB
MD54674311d9e9d41e83ad3f4e9c407ed5b
SHA1e355ffc3c51fc104cabb700580acd57849083616
SHA25654f7c020dabda63b15b15ba580f0c4fd6888ecc785904f4335effc56326d5270
SHA5128ef7ebbd1d970e0889ab096ab7bd51c946e8134f5e52facd636eae33828e632f12930c6a7e3778c2ddc30500dea9615ffc7585240de2c0018f30dd512582ef86
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s76426949.exeFilesize
502KB
MD54674311d9e9d41e83ad3f4e9c407ed5b
SHA1e355ffc3c51fc104cabb700580acd57849083616
SHA25654f7c020dabda63b15b15ba580f0c4fd6888ecc785904f4335effc56326d5270
SHA5128ef7ebbd1d970e0889ab096ab7bd51c946e8134f5e52facd636eae33828e632f12930c6a7e3778c2ddc30500dea9615ffc7585240de2c0018f30dd512582ef86
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t24400488.exeFilesize
169KB
MD5a7957d9a0ed75d0372adea14b402cb21
SHA1bd0ad0cf7a4ed5a47ec8214a019068c63c29c8ed
SHA2568768c6e602f63ac7fee1bff51153d905c2d9471681f10c58d74f99ae78281114
SHA51266a4e3a5e1f8049c4ea10be427236db57c50d76304928f87b3d71fafc9eb3f58a146cabf83e9c2befafbbf7cd70d6c7fecef3941ab16c2d4c216f2235ae1577e
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t24400488.exeFilesize
169KB
MD5a7957d9a0ed75d0372adea14b402cb21
SHA1bd0ad0cf7a4ed5a47ec8214a019068c63c29c8ed
SHA2568768c6e602f63ac7fee1bff51153d905c2d9471681f10c58d74f99ae78281114
SHA51266a4e3a5e1f8049c4ea10be427236db57c50d76304928f87b3d71fafc9eb3f58a146cabf83e9c2befafbbf7cd70d6c7fecef3941ab16c2d4c216f2235ae1577e
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
memory/2660-2330-0x0000000000830000-0x000000000085E000-memory.dmpFilesize
184KB
-
memory/2660-2331-0x000000000ABC0000-0x000000000B1D8000-memory.dmpFilesize
6.1MB
-
memory/2660-2345-0x0000000005110000-0x0000000005120000-memory.dmpFilesize
64KB
-
memory/2660-2338-0x0000000005110000-0x0000000005120000-memory.dmpFilesize
64KB
-
memory/2660-2337-0x000000000A760000-0x000000000A79C000-memory.dmpFilesize
240KB
-
memory/2660-2336-0x000000000A700000-0x000000000A712000-memory.dmpFilesize
72KB
-
memory/2660-2335-0x000000000A7F0000-0x000000000A8FA000-memory.dmpFilesize
1.0MB
-
memory/2868-195-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/2868-213-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/2868-175-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/2868-177-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/2868-179-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/2868-181-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/2868-183-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/2868-185-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/2868-187-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/2868-189-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/2868-191-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/2868-193-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/2868-171-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/2868-199-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/2868-197-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/2868-201-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/2868-203-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/2868-205-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/2868-207-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/2868-209-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/2868-211-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/2868-173-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/2868-215-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/2868-217-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/2868-219-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/2868-221-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/2868-223-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/2868-225-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/2868-227-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/2868-229-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/2868-169-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/2868-167-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/2868-166-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/2868-165-0x0000000005170000-0x0000000005714000-memory.dmpFilesize
5.6MB
-
memory/2868-164-0x0000000005160000-0x0000000005170000-memory.dmpFilesize
64KB
-
memory/2868-163-0x0000000005160000-0x0000000005170000-memory.dmpFilesize
64KB
-
memory/2868-2316-0x0000000005160000-0x0000000005170000-memory.dmpFilesize
64KB
-
memory/2868-2322-0x0000000005160000-0x0000000005170000-memory.dmpFilesize
64KB
-
memory/2868-2323-0x0000000005160000-0x0000000005170000-memory.dmpFilesize
64KB
-
memory/2868-2325-0x0000000005160000-0x0000000005170000-memory.dmpFilesize
64KB
-
memory/2868-162-0x0000000000950000-0x00000000009AB000-memory.dmpFilesize
364KB
-
memory/4116-2344-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/4116-2343-0x0000000000350000-0x000000000037E000-memory.dmpFilesize
184KB
-
memory/4116-2346-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB