Analysis

  • max time kernel
    184s
  • max time network
    192s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-05-2023 02:57

General

  • Target

    67be978a3318ac18b192ebe5a03739d40df6e80fb8a53ddd18fb595d59817fff.exe

  • Size

    1.2MB

  • MD5

    d2cf768c2aef9df50031b6a63530f700

  • SHA1

    3654827e43a5f3a95a887c2dfc678fe6bfa5fefc

  • SHA256

    67be978a3318ac18b192ebe5a03739d40df6e80fb8a53ddd18fb595d59817fff

  • SHA512

    07503c824658f15e48c2388d95088872daef98409247b6f784e388ea6a623bffda20f0e51dcfb90f6a16d2344bbd7083bb0761e486de4aa062847106c6791da0

  • SSDEEP

    24576:+yo/SWRHS6P+H/n3840bgLRLG6o9kL7LVGQt0X5L9:No/7+H/s+o6o9Q4

Malware Config

Extracted

Family

redline

Botnet

gena

C2

185.161.248.73:4164

Attributes
  • auth_value

    d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

life

C2

185.161.248.73:4164

Attributes
  • auth_value

    8685d11953530b68ad5ec703809d9f91

Signatures

  • Detects Redline Stealer samples 1 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\67be978a3318ac18b192ebe5a03739d40df6e80fb8a53ddd18fb595d59817fff.exe
    "C:\Users\Admin\AppData\Local\Temp\67be978a3318ac18b192ebe5a03739d40df6e80fb8a53ddd18fb595d59817fff.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1356
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z98644738.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z98644738.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:5068
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z66946438.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z66946438.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1920
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z07828587.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z07828587.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:3056
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s76426949.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s76426949.exe
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2868
            • C:\Windows\Temp\1.exe
              "C:\Windows\Temp\1.exe"
              6⤵
              • Executes dropped EXE
              PID:2660
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 1212
              6⤵
              • Program crash
              PID:3328
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t24400488.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t24400488.exe
            5⤵
            • Executes dropped EXE
            PID:4116
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2868 -ip 2868
    1⤵
      PID:3836

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    1
    T1112

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z98644738.exe
      Filesize

      1.0MB

      MD5

      3de750b8ab1b21ad700cc72d9e3c8b8d

      SHA1

      10871f34da764db8cf747f4328e4c804b5b525a6

      SHA256

      a9cfbe51ce240ed2fcacaf1ffe135a9144673fa23c2401257b1ecf5fa23b7f86

      SHA512

      791cc9644c882cfebec989454701736e8038a5c25325b157997e8fed792c690622dbfab79309dcade8b521cdde0f9f78cce100a03c1fa529b3f8f2b5cb2dbe77

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z98644738.exe
      Filesize

      1.0MB

      MD5

      3de750b8ab1b21ad700cc72d9e3c8b8d

      SHA1

      10871f34da764db8cf747f4328e4c804b5b525a6

      SHA256

      a9cfbe51ce240ed2fcacaf1ffe135a9144673fa23c2401257b1ecf5fa23b7f86

      SHA512

      791cc9644c882cfebec989454701736e8038a5c25325b157997e8fed792c690622dbfab79309dcade8b521cdde0f9f78cce100a03c1fa529b3f8f2b5cb2dbe77

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z66946438.exe
      Filesize

      761KB

      MD5

      128513a4859760d4b9c428d5fd1018b5

      SHA1

      09e0f12ff47a1cf1818e53f1c52b7a4a12f6a731

      SHA256

      748b5f344ef4d417af8024509edebf909c402bd97f5d6ba19b42903352d8f3a6

      SHA512

      28acb05cae6f976b69fe3b3853aace63ab06a125ff46cb7efa047f458c2b59fb11e6ed0d571ca6b1eb7b90bb5dd9bdc10b4dd1ff4c3cb0dba23227f64b1ac5e0

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z66946438.exe
      Filesize

      761KB

      MD5

      128513a4859760d4b9c428d5fd1018b5

      SHA1

      09e0f12ff47a1cf1818e53f1c52b7a4a12f6a731

      SHA256

      748b5f344ef4d417af8024509edebf909c402bd97f5d6ba19b42903352d8f3a6

      SHA512

      28acb05cae6f976b69fe3b3853aace63ab06a125ff46cb7efa047f458c2b59fb11e6ed0d571ca6b1eb7b90bb5dd9bdc10b4dd1ff4c3cb0dba23227f64b1ac5e0

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z07828587.exe
      Filesize

      578KB

      MD5

      550b62352e7a45d2f6aaba6867a8f8e2

      SHA1

      b591a777fdd8cf04c2e8eea861d593141ac84c29

      SHA256

      fc0485a462e5f716dcfb665aecc4d7899e226f71a41281195b224148a3d914b5

      SHA512

      b5ab0aa1a712aa5a7d2ff0733f7ad324be7efadb8f386fa13cf41dede53d867deb0647754745a39271ae4b39467e3e97c7c1a6eb3ec5faaaa7089bce7ab6d1ec

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z07828587.exe
      Filesize

      578KB

      MD5

      550b62352e7a45d2f6aaba6867a8f8e2

      SHA1

      b591a777fdd8cf04c2e8eea861d593141ac84c29

      SHA256

      fc0485a462e5f716dcfb665aecc4d7899e226f71a41281195b224148a3d914b5

      SHA512

      b5ab0aa1a712aa5a7d2ff0733f7ad324be7efadb8f386fa13cf41dede53d867deb0647754745a39271ae4b39467e3e97c7c1a6eb3ec5faaaa7089bce7ab6d1ec

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s76426949.exe
      Filesize

      502KB

      MD5

      4674311d9e9d41e83ad3f4e9c407ed5b

      SHA1

      e355ffc3c51fc104cabb700580acd57849083616

      SHA256

      54f7c020dabda63b15b15ba580f0c4fd6888ecc785904f4335effc56326d5270

      SHA512

      8ef7ebbd1d970e0889ab096ab7bd51c946e8134f5e52facd636eae33828e632f12930c6a7e3778c2ddc30500dea9615ffc7585240de2c0018f30dd512582ef86

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s76426949.exe
      Filesize

      502KB

      MD5

      4674311d9e9d41e83ad3f4e9c407ed5b

      SHA1

      e355ffc3c51fc104cabb700580acd57849083616

      SHA256

      54f7c020dabda63b15b15ba580f0c4fd6888ecc785904f4335effc56326d5270

      SHA512

      8ef7ebbd1d970e0889ab096ab7bd51c946e8134f5e52facd636eae33828e632f12930c6a7e3778c2ddc30500dea9615ffc7585240de2c0018f30dd512582ef86

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t24400488.exe
      Filesize

      169KB

      MD5

      a7957d9a0ed75d0372adea14b402cb21

      SHA1

      bd0ad0cf7a4ed5a47ec8214a019068c63c29c8ed

      SHA256

      8768c6e602f63ac7fee1bff51153d905c2d9471681f10c58d74f99ae78281114

      SHA512

      66a4e3a5e1f8049c4ea10be427236db57c50d76304928f87b3d71fafc9eb3f58a146cabf83e9c2befafbbf7cd70d6c7fecef3941ab16c2d4c216f2235ae1577e

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t24400488.exe
      Filesize

      169KB

      MD5

      a7957d9a0ed75d0372adea14b402cb21

      SHA1

      bd0ad0cf7a4ed5a47ec8214a019068c63c29c8ed

      SHA256

      8768c6e602f63ac7fee1bff51153d905c2d9471681f10c58d74f99ae78281114

      SHA512

      66a4e3a5e1f8049c4ea10be427236db57c50d76304928f87b3d71fafc9eb3f58a146cabf83e9c2befafbbf7cd70d6c7fecef3941ab16c2d4c216f2235ae1577e

    • C:\Windows\Temp\1.exe
      Filesize

      168KB

      MD5

      f16fb63d4e551d3808e8f01f2671b57e

      SHA1

      781153ad6235a1152da112de1fb39a6f2d063575

      SHA256

      8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

      SHA512

      fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

    • C:\Windows\Temp\1.exe
      Filesize

      168KB

      MD5

      f16fb63d4e551d3808e8f01f2671b57e

      SHA1

      781153ad6235a1152da112de1fb39a6f2d063575

      SHA256

      8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

      SHA512

      fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

    • C:\Windows\Temp\1.exe
      Filesize

      168KB

      MD5

      f16fb63d4e551d3808e8f01f2671b57e

      SHA1

      781153ad6235a1152da112de1fb39a6f2d063575

      SHA256

      8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

      SHA512

      fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

    • memory/2660-2330-0x0000000000830000-0x000000000085E000-memory.dmp
      Filesize

      184KB

    • memory/2660-2331-0x000000000ABC0000-0x000000000B1D8000-memory.dmp
      Filesize

      6.1MB

    • memory/2660-2345-0x0000000005110000-0x0000000005120000-memory.dmp
      Filesize

      64KB

    • memory/2660-2338-0x0000000005110000-0x0000000005120000-memory.dmp
      Filesize

      64KB

    • memory/2660-2337-0x000000000A760000-0x000000000A79C000-memory.dmp
      Filesize

      240KB

    • memory/2660-2336-0x000000000A700000-0x000000000A712000-memory.dmp
      Filesize

      72KB

    • memory/2660-2335-0x000000000A7F0000-0x000000000A8FA000-memory.dmp
      Filesize

      1.0MB

    • memory/2868-195-0x00000000028F0000-0x0000000002950000-memory.dmp
      Filesize

      384KB

    • memory/2868-213-0x00000000028F0000-0x0000000002950000-memory.dmp
      Filesize

      384KB

    • memory/2868-175-0x00000000028F0000-0x0000000002950000-memory.dmp
      Filesize

      384KB

    • memory/2868-177-0x00000000028F0000-0x0000000002950000-memory.dmp
      Filesize

      384KB

    • memory/2868-179-0x00000000028F0000-0x0000000002950000-memory.dmp
      Filesize

      384KB

    • memory/2868-181-0x00000000028F0000-0x0000000002950000-memory.dmp
      Filesize

      384KB

    • memory/2868-183-0x00000000028F0000-0x0000000002950000-memory.dmp
      Filesize

      384KB

    • memory/2868-185-0x00000000028F0000-0x0000000002950000-memory.dmp
      Filesize

      384KB

    • memory/2868-187-0x00000000028F0000-0x0000000002950000-memory.dmp
      Filesize

      384KB

    • memory/2868-189-0x00000000028F0000-0x0000000002950000-memory.dmp
      Filesize

      384KB

    • memory/2868-191-0x00000000028F0000-0x0000000002950000-memory.dmp
      Filesize

      384KB

    • memory/2868-193-0x00000000028F0000-0x0000000002950000-memory.dmp
      Filesize

      384KB

    • memory/2868-171-0x00000000028F0000-0x0000000002950000-memory.dmp
      Filesize

      384KB

    • memory/2868-199-0x00000000028F0000-0x0000000002950000-memory.dmp
      Filesize

      384KB

    • memory/2868-197-0x00000000028F0000-0x0000000002950000-memory.dmp
      Filesize

      384KB

    • memory/2868-201-0x00000000028F0000-0x0000000002950000-memory.dmp
      Filesize

      384KB

    • memory/2868-203-0x00000000028F0000-0x0000000002950000-memory.dmp
      Filesize

      384KB

    • memory/2868-205-0x00000000028F0000-0x0000000002950000-memory.dmp
      Filesize

      384KB

    • memory/2868-207-0x00000000028F0000-0x0000000002950000-memory.dmp
      Filesize

      384KB

    • memory/2868-209-0x00000000028F0000-0x0000000002950000-memory.dmp
      Filesize

      384KB

    • memory/2868-211-0x00000000028F0000-0x0000000002950000-memory.dmp
      Filesize

      384KB

    • memory/2868-173-0x00000000028F0000-0x0000000002950000-memory.dmp
      Filesize

      384KB

    • memory/2868-215-0x00000000028F0000-0x0000000002950000-memory.dmp
      Filesize

      384KB

    • memory/2868-217-0x00000000028F0000-0x0000000002950000-memory.dmp
      Filesize

      384KB

    • memory/2868-219-0x00000000028F0000-0x0000000002950000-memory.dmp
      Filesize

      384KB

    • memory/2868-221-0x00000000028F0000-0x0000000002950000-memory.dmp
      Filesize

      384KB

    • memory/2868-223-0x00000000028F0000-0x0000000002950000-memory.dmp
      Filesize

      384KB

    • memory/2868-225-0x00000000028F0000-0x0000000002950000-memory.dmp
      Filesize

      384KB

    • memory/2868-227-0x00000000028F0000-0x0000000002950000-memory.dmp
      Filesize

      384KB

    • memory/2868-229-0x00000000028F0000-0x0000000002950000-memory.dmp
      Filesize

      384KB

    • memory/2868-169-0x00000000028F0000-0x0000000002950000-memory.dmp
      Filesize

      384KB

    • memory/2868-167-0x00000000028F0000-0x0000000002950000-memory.dmp
      Filesize

      384KB

    • memory/2868-166-0x00000000028F0000-0x0000000002950000-memory.dmp
      Filesize

      384KB

    • memory/2868-165-0x0000000005170000-0x0000000005714000-memory.dmp
      Filesize

      5.6MB

    • memory/2868-164-0x0000000005160000-0x0000000005170000-memory.dmp
      Filesize

      64KB

    • memory/2868-163-0x0000000005160000-0x0000000005170000-memory.dmp
      Filesize

      64KB

    • memory/2868-2316-0x0000000005160000-0x0000000005170000-memory.dmp
      Filesize

      64KB

    • memory/2868-2322-0x0000000005160000-0x0000000005170000-memory.dmp
      Filesize

      64KB

    • memory/2868-2323-0x0000000005160000-0x0000000005170000-memory.dmp
      Filesize

      64KB

    • memory/2868-2325-0x0000000005160000-0x0000000005170000-memory.dmp
      Filesize

      64KB

    • memory/2868-162-0x0000000000950000-0x00000000009AB000-memory.dmp
      Filesize

      364KB

    • memory/4116-2344-0x0000000004BD0000-0x0000000004BE0000-memory.dmp
      Filesize

      64KB

    • memory/4116-2343-0x0000000000350000-0x000000000037E000-memory.dmp
      Filesize

      184KB

    • memory/4116-2346-0x0000000004BD0000-0x0000000004BE0000-memory.dmp
      Filesize

      64KB