Analysis

  • max time kernel
    135s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-05-2023 03:00

General

  • Target

    68f4fffa0655da67fe4314d3a0108fe1.exe

  • Size

    1.2MB

  • MD5

    68f4fffa0655da67fe4314d3a0108fe1

  • SHA1

    0be190df38f794040fad8a79af7990c8fd15789c

  • SHA256

    440ca6ae933fb42123ed2368c8d725c51752a31210492a1c731bebc5e1b9a900

  • SHA512

    ee1ef526b07db4b92d0d08f245cb1e1f0be4ae8fc840d0354e7aa5d6c377759671bb95ac86f74d7585c09b09339a6048d75c8b6bdf4fa34f15570ef25f00b3dc

  • SSDEEP

    24576:sykFF3Y25qn+8drBh3UAQf/AQGHhRAZc8sS+1anUJTZ4:b4oWq+Oh9miKVianUJTZ

Malware Config

Extracted

Family

redline

Botnet

gena

C2

185.161.248.73:4164

Attributes
  • auth_value

    d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

life

C2

185.161.248.73:4164

Attributes
  • auth_value

    8685d11953530b68ad5ec703809d9f91

Signatures

  • Detects Redline Stealer samples 1 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\68f4fffa0655da67fe4314d3a0108fe1.exe
    "C:\Users\Admin\AppData\Local\Temp\68f4fffa0655da67fe4314d3a0108fe1.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3772
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z80011273.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z80011273.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1544
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z61069418.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z61069418.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2012
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z48147855.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z48147855.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2108
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s59462131.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s59462131.exe
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2428
            • C:\Windows\Temp\1.exe
              "C:\Windows\Temp\1.exe"
              6⤵
              • Executes dropped EXE
              PID:4884
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 1492
              6⤵
              • Program crash
              PID:3844
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t70754994.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t70754994.exe
            5⤵
            • Executes dropped EXE
            PID:3580
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2428 -ip 2428
    1⤵
      PID:1076

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    1
    T1112

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z80011273.exe
      Filesize

      1.0MB

      MD5

      d99251e01afe6daf83b8a9a9316a6a8a

      SHA1

      c860385c7962f316352910334cc18e55e21238dc

      SHA256

      d6bc3cc08b70180d9b66b1538d291916067a855588cb1d6f83217eb5a6ef3728

      SHA512

      ac4183c7a361e2b3c0282c143bc96aceeb1614ca8d1371ed853405ea7484a0a430ed2a6bc5681ebdec7f514e8c174e8e54776c97ff1f397d6d7f2d089afac9f0

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z80011273.exe
      Filesize

      1.0MB

      MD5

      d99251e01afe6daf83b8a9a9316a6a8a

      SHA1

      c860385c7962f316352910334cc18e55e21238dc

      SHA256

      d6bc3cc08b70180d9b66b1538d291916067a855588cb1d6f83217eb5a6ef3728

      SHA512

      ac4183c7a361e2b3c0282c143bc96aceeb1614ca8d1371ed853405ea7484a0a430ed2a6bc5681ebdec7f514e8c174e8e54776c97ff1f397d6d7f2d089afac9f0

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z61069418.exe
      Filesize

      760KB

      MD5

      ef9b1e7809ed16caef4d3b11d1bee774

      SHA1

      f5a53b34dd49a9ea730dcaa52029a610721d4004

      SHA256

      3a9458503d177bafa5cee36f31191bf9ed138809246e1096ea17b31f61598eda

      SHA512

      85f84b5bed80cc90027e966780cec1ba566034434ac9912a30f09047fec79c2392545eb4fb48cb9041ca526b18fe2ccb7022061f4b6bed4b854b10b1a364aee0

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z61069418.exe
      Filesize

      760KB

      MD5

      ef9b1e7809ed16caef4d3b11d1bee774

      SHA1

      f5a53b34dd49a9ea730dcaa52029a610721d4004

      SHA256

      3a9458503d177bafa5cee36f31191bf9ed138809246e1096ea17b31f61598eda

      SHA512

      85f84b5bed80cc90027e966780cec1ba566034434ac9912a30f09047fec79c2392545eb4fb48cb9041ca526b18fe2ccb7022061f4b6bed4b854b10b1a364aee0

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z48147855.exe
      Filesize

      577KB

      MD5

      8eca8b3ffb8426093aee257a81729e6a

      SHA1

      92521d8adc62aac41b557fa6a4168c3592fbaeca

      SHA256

      a2ace6f6854689fca52ec2202a93f038642f47c3bb43cc28017e6a9280fac7c8

      SHA512

      2ca06ec2e8d0c3127f586acd93850c33364626d414d4084986352e8f7b2192f2f339c0434615f33b9dd46744ec6d77a1ebaafe2088ef9257a5c8a204eaa516e5

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z48147855.exe
      Filesize

      577KB

      MD5

      8eca8b3ffb8426093aee257a81729e6a

      SHA1

      92521d8adc62aac41b557fa6a4168c3592fbaeca

      SHA256

      a2ace6f6854689fca52ec2202a93f038642f47c3bb43cc28017e6a9280fac7c8

      SHA512

      2ca06ec2e8d0c3127f586acd93850c33364626d414d4084986352e8f7b2192f2f339c0434615f33b9dd46744ec6d77a1ebaafe2088ef9257a5c8a204eaa516e5

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s59462131.exe
      Filesize

      502KB

      MD5

      252ee4563e108902c62896949372a514

      SHA1

      287c9b75c3923a2331978790c84f611a7ff2ecc7

      SHA256

      d7d046d453d7e12f1d020c8b878c4814f2c5516a96ffccb190ac860b3047a4c2

      SHA512

      35027034a204ccb233c81f1ca5ec8d5839a191f585966183a112631757254c800ad580542cd8e6d99588249c5bcff84fe29ba8d348b3ffaa01e1ae9db0b6d55c

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s59462131.exe
      Filesize

      502KB

      MD5

      252ee4563e108902c62896949372a514

      SHA1

      287c9b75c3923a2331978790c84f611a7ff2ecc7

      SHA256

      d7d046d453d7e12f1d020c8b878c4814f2c5516a96ffccb190ac860b3047a4c2

      SHA512

      35027034a204ccb233c81f1ca5ec8d5839a191f585966183a112631757254c800ad580542cd8e6d99588249c5bcff84fe29ba8d348b3ffaa01e1ae9db0b6d55c

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t70754994.exe
      Filesize

      169KB

      MD5

      0c46aaea6889ec92cc45661135ec1271

      SHA1

      a54e12a4d1caa4a30ec6b19f8297265918dd6c99

      SHA256

      5fab84a7349e87932787ec60fa772d39c2019e1a161ce2ee423462716875c6a8

      SHA512

      5a0c0fb65fb3fe3ed2a0c0b791fed544932f865bab34a4c5a8c8b0e594b4296cf4c6127c3ed26757dad8c412ff6ccae9c938a2a0a9fab105586efbf5a381cc78

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t70754994.exe
      Filesize

      169KB

      MD5

      0c46aaea6889ec92cc45661135ec1271

      SHA1

      a54e12a4d1caa4a30ec6b19f8297265918dd6c99

      SHA256

      5fab84a7349e87932787ec60fa772d39c2019e1a161ce2ee423462716875c6a8

      SHA512

      5a0c0fb65fb3fe3ed2a0c0b791fed544932f865bab34a4c5a8c8b0e594b4296cf4c6127c3ed26757dad8c412ff6ccae9c938a2a0a9fab105586efbf5a381cc78

    • C:\Windows\Temp\1.exe
      Filesize

      168KB

      MD5

      f16fb63d4e551d3808e8f01f2671b57e

      SHA1

      781153ad6235a1152da112de1fb39a6f2d063575

      SHA256

      8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

      SHA512

      fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

    • C:\Windows\Temp\1.exe
      Filesize

      168KB

      MD5

      f16fb63d4e551d3808e8f01f2671b57e

      SHA1

      781153ad6235a1152da112de1fb39a6f2d063575

      SHA256

      8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

      SHA512

      fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

    • C:\Windows\Temp\1.exe
      Filesize

      168KB

      MD5

      f16fb63d4e551d3808e8f01f2671b57e

      SHA1

      781153ad6235a1152da112de1fb39a6f2d063575

      SHA256

      8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

      SHA512

      fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

    • memory/2428-204-0x0000000004FA0000-0x0000000005000000-memory.dmp
      Filesize

      384KB

    • memory/2428-216-0x0000000004FA0000-0x0000000005000000-memory.dmp
      Filesize

      384KB

    • memory/2428-170-0x0000000004FA0000-0x0000000005000000-memory.dmp
      Filesize

      384KB

    • memory/2428-172-0x0000000004FA0000-0x0000000005000000-memory.dmp
      Filesize

      384KB

    • memory/2428-174-0x0000000004FA0000-0x0000000005000000-memory.dmp
      Filesize

      384KB

    • memory/2428-176-0x0000000004FA0000-0x0000000005000000-memory.dmp
      Filesize

      384KB

    • memory/2428-178-0x0000000004FA0000-0x0000000005000000-memory.dmp
      Filesize

      384KB

    • memory/2428-182-0x0000000004FA0000-0x0000000005000000-memory.dmp
      Filesize

      384KB

    • memory/2428-180-0x0000000004FA0000-0x0000000005000000-memory.dmp
      Filesize

      384KB

    • memory/2428-184-0x0000000004FA0000-0x0000000005000000-memory.dmp
      Filesize

      384KB

    • memory/2428-188-0x0000000004FA0000-0x0000000005000000-memory.dmp
      Filesize

      384KB

    • memory/2428-186-0x0000000004FA0000-0x0000000005000000-memory.dmp
      Filesize

      384KB

    • memory/2428-190-0x0000000004FA0000-0x0000000005000000-memory.dmp
      Filesize

      384KB

    • memory/2428-192-0x0000000004FA0000-0x0000000005000000-memory.dmp
      Filesize

      384KB

    • memory/2428-194-0x0000000004FA0000-0x0000000005000000-memory.dmp
      Filesize

      384KB

    • memory/2428-196-0x0000000004FA0000-0x0000000005000000-memory.dmp
      Filesize

      384KB

    • memory/2428-198-0x0000000004FA0000-0x0000000005000000-memory.dmp
      Filesize

      384KB

    • memory/2428-200-0x0000000004FA0000-0x0000000005000000-memory.dmp
      Filesize

      384KB

    • memory/2428-202-0x0000000004FA0000-0x0000000005000000-memory.dmp
      Filesize

      384KB

    • memory/2428-167-0x0000000004FA0000-0x0000000005000000-memory.dmp
      Filesize

      384KB

    • memory/2428-206-0x0000000004FA0000-0x0000000005000000-memory.dmp
      Filesize

      384KB

    • memory/2428-208-0x0000000004FA0000-0x0000000005000000-memory.dmp
      Filesize

      384KB

    • memory/2428-210-0x0000000004FA0000-0x0000000005000000-memory.dmp
      Filesize

      384KB

    • memory/2428-212-0x0000000004FA0000-0x0000000005000000-memory.dmp
      Filesize

      384KB

    • memory/2428-214-0x0000000004FA0000-0x0000000005000000-memory.dmp
      Filesize

      384KB

    • memory/2428-168-0x0000000004FA0000-0x0000000005000000-memory.dmp
      Filesize

      384KB

    • memory/2428-218-0x0000000004FA0000-0x0000000005000000-memory.dmp
      Filesize

      384KB

    • memory/2428-220-0x0000000004FA0000-0x0000000005000000-memory.dmp
      Filesize

      384KB

    • memory/2428-222-0x0000000004FA0000-0x0000000005000000-memory.dmp
      Filesize

      384KB

    • memory/2428-224-0x0000000004FA0000-0x0000000005000000-memory.dmp
      Filesize

      384KB

    • memory/2428-226-0x0000000004FA0000-0x0000000005000000-memory.dmp
      Filesize

      384KB

    • memory/2428-228-0x0000000004FA0000-0x0000000005000000-memory.dmp
      Filesize

      384KB

    • memory/2428-230-0x0000000004FA0000-0x0000000005000000-memory.dmp
      Filesize

      384KB

    • memory/2428-2316-0x0000000005010000-0x0000000005020000-memory.dmp
      Filesize

      64KB

    • memory/2428-2315-0x0000000005010000-0x0000000005020000-memory.dmp
      Filesize

      64KB

    • memory/2428-2314-0x0000000005010000-0x0000000005020000-memory.dmp
      Filesize

      64KB

    • memory/2428-166-0x0000000005010000-0x0000000005020000-memory.dmp
      Filesize

      64KB

    • memory/2428-165-0x0000000005010000-0x0000000005020000-memory.dmp
      Filesize

      64KB

    • memory/2428-163-0x0000000005120000-0x00000000056C4000-memory.dmp
      Filesize

      5.6MB

    • memory/2428-2328-0x0000000005010000-0x0000000005020000-memory.dmp
      Filesize

      64KB

    • memory/2428-162-0x0000000000880000-0x00000000008DB000-memory.dmp
      Filesize

      364KB

    • memory/2428-164-0x0000000005010000-0x0000000005020000-memory.dmp
      Filesize

      64KB

    • memory/3580-2340-0x00000000009C0000-0x00000000009EE000-memory.dmp
      Filesize

      184KB

    • memory/3580-2341-0x0000000005300000-0x0000000005310000-memory.dmp
      Filesize

      64KB

    • memory/3580-2343-0x0000000005300000-0x0000000005310000-memory.dmp
      Filesize

      64KB

    • memory/4884-2332-0x0000000009EB0000-0x0000000009FBA000-memory.dmp
      Filesize

      1.0MB

    • memory/4884-2333-0x0000000009DE0000-0x0000000009DF2000-memory.dmp
      Filesize

      72KB

    • memory/4884-2334-0x0000000004870000-0x0000000004880000-memory.dmp
      Filesize

      64KB

    • memory/4884-2335-0x0000000009E40000-0x0000000009E7C000-memory.dmp
      Filesize

      240KB

    • memory/4884-2331-0x000000000A330000-0x000000000A948000-memory.dmp
      Filesize

      6.1MB

    • memory/4884-2330-0x0000000000070000-0x000000000009E000-memory.dmp
      Filesize

      184KB

    • memory/4884-2342-0x0000000004870000-0x0000000004880000-memory.dmp
      Filesize

      64KB