Analysis

  • max time kernel
    138s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-05-2023 03:10

General

  • Target

    6d7ea4c30059878e650cf86cb44fb644dc1e46329f1f4031f50cd6b05346f3d6.exe

  • Size

    1.2MB

  • MD5

    49ba4cc09a0108c676fcc820acfa14c0

  • SHA1

    0a5e94b39b05eea0f6f4ea0c0cd8fa1ec9d301f9

  • SHA256

    6d7ea4c30059878e650cf86cb44fb644dc1e46329f1f4031f50cd6b05346f3d6

  • SHA512

    c2f64796a1c774e1f10ab4bc3f6a39440c528e990a57a33a7e81f3a7083a269de5d9078242537616e898c5720d4a720f22ea79716958de395adaf0ac9b63158e

  • SSDEEP

    24576:wybech4av27p2dmqjm9WvTdbrivKxWE/l5zEryBMdfk/Og2ciITTIIePVizY6b:31qav27UdlbeyfN5MeMs2UTBePa

Malware Config

Extracted

Family

redline

Botnet

gena

C2

185.161.248.73:4164

Attributes
  • auth_value

    d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

life

C2

185.161.248.73:4164

Attributes
  • auth_value

    8685d11953530b68ad5ec703809d9f91

Signatures

  • Detects Redline Stealer samples 1 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6d7ea4c30059878e650cf86cb44fb644dc1e46329f1f4031f50cd6b05346f3d6.exe
    "C:\Users\Admin\AppData\Local\Temp\6d7ea4c30059878e650cf86cb44fb644dc1e46329f1f4031f50cd6b05346f3d6.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1484
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z57148698.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z57148698.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2204
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z75347702.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z75347702.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4200
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z14952233.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z14952233.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:1648
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s98188178.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s98188178.exe
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2404
            • C:\Windows\Temp\1.exe
              "C:\Windows\Temp\1.exe"
              6⤵
              • Executes dropped EXE
              PID:1200
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 1388
              6⤵
              • Program crash
              PID:3124
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t10525958.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t10525958.exe
            5⤵
            • Executes dropped EXE
            PID:3984
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2404 -ip 2404
    1⤵
      PID:4040

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    1
    T1112

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z57148698.exe
      Filesize

      1.0MB

      MD5

      2b4f192120eb64e6e432dc6bd7d4df8c

      SHA1

      82c0391fed909e48b97ae84346da703637fd4b68

      SHA256

      596a88559797a066c609c543e869520ba6befe61627af549cd0919dd81237a81

      SHA512

      58867ccb113fa506b25ecb6f1e5cba1009dde0233bb4a85d17c98e549d3598f3ae74723cdd4ad98d70ad30923b6b0e191b89955a2f17bca10b770274d8f19814

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z57148698.exe
      Filesize

      1.0MB

      MD5

      2b4f192120eb64e6e432dc6bd7d4df8c

      SHA1

      82c0391fed909e48b97ae84346da703637fd4b68

      SHA256

      596a88559797a066c609c543e869520ba6befe61627af549cd0919dd81237a81

      SHA512

      58867ccb113fa506b25ecb6f1e5cba1009dde0233bb4a85d17c98e549d3598f3ae74723cdd4ad98d70ad30923b6b0e191b89955a2f17bca10b770274d8f19814

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z75347702.exe
      Filesize

      759KB

      MD5

      dce43b1c987c5eceff362c72510bc121

      SHA1

      1b53fde4d5aaf8d55c8fbb678eb8eca5d196c4eb

      SHA256

      e86012a9b9218e113df1714d3702d85c6d662bbbf1f1cecbde6d84a7c490a95d

      SHA512

      57742e4d271e03f175411d65ee2e8f367ed2045baa7821d1dc73c6695ca49a1e64f3fab458aff444956e04ef5f653a4cbcf18682bc05fd339e193b99d3b61ae8

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z75347702.exe
      Filesize

      759KB

      MD5

      dce43b1c987c5eceff362c72510bc121

      SHA1

      1b53fde4d5aaf8d55c8fbb678eb8eca5d196c4eb

      SHA256

      e86012a9b9218e113df1714d3702d85c6d662bbbf1f1cecbde6d84a7c490a95d

      SHA512

      57742e4d271e03f175411d65ee2e8f367ed2045baa7821d1dc73c6695ca49a1e64f3fab458aff444956e04ef5f653a4cbcf18682bc05fd339e193b99d3b61ae8

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z14952233.exe
      Filesize

      577KB

      MD5

      f56ca1db680affbe440c2cfafc6d9fb6

      SHA1

      848bab92e40217842303fc4e2f1ab4b3a45ebfd9

      SHA256

      e51ac05e666e115a4448d6b0078de709efb37b8cd184a232c8d60bfc24e27a06

      SHA512

      4510f24d23cd226818b72f7ec1e2b266f9ba560ee5b7ff03d23e2b74cf47d99ffa741560519e9cda73eee55438605cfea957daa21894404843b033c9b7278b67

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z14952233.exe
      Filesize

      577KB

      MD5

      f56ca1db680affbe440c2cfafc6d9fb6

      SHA1

      848bab92e40217842303fc4e2f1ab4b3a45ebfd9

      SHA256

      e51ac05e666e115a4448d6b0078de709efb37b8cd184a232c8d60bfc24e27a06

      SHA512

      4510f24d23cd226818b72f7ec1e2b266f9ba560ee5b7ff03d23e2b74cf47d99ffa741560519e9cda73eee55438605cfea957daa21894404843b033c9b7278b67

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s98188178.exe
      Filesize

      574KB

      MD5

      15bc8a934c930d67b3d915977ad6519f

      SHA1

      2afaaf463b9669c02330f4d3feeed66a7cc17bc0

      SHA256

      bdbd5aaf1beecca7f763af312f3fff9fa47501e29c3110ade02cbbffc4300252

      SHA512

      ec7d2ec4cc78ce1189fcf4c53561395d8f6baf5a3dc53af27b58e8ea1a548ff5e3584ecb645b5c595cf175f56d754ada0593acb8db1003bc776098449863a1a9

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s98188178.exe
      Filesize

      574KB

      MD5

      15bc8a934c930d67b3d915977ad6519f

      SHA1

      2afaaf463b9669c02330f4d3feeed66a7cc17bc0

      SHA256

      bdbd5aaf1beecca7f763af312f3fff9fa47501e29c3110ade02cbbffc4300252

      SHA512

      ec7d2ec4cc78ce1189fcf4c53561395d8f6baf5a3dc53af27b58e8ea1a548ff5e3584ecb645b5c595cf175f56d754ada0593acb8db1003bc776098449863a1a9

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t10525958.exe
      Filesize

      169KB

      MD5

      9c3d371b2f24d7470f6546cf93ed86bf

      SHA1

      d948829ad83aff9f326a264a3a71bf0ecb1ad75c

      SHA256

      b352b8a2f3fc65cf4f3d8678ad941f4e21c207ba50771aa54c43af20edd50f23

      SHA512

      e38fbdc40ea72557e6292a895b4331436e8d5ddd74684e6415c598994c03c4a7472dd4098f08d17d1bfe4527fe5d5d601ed72dc444023882369eb31605276523

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t10525958.exe
      Filesize

      169KB

      MD5

      9c3d371b2f24d7470f6546cf93ed86bf

      SHA1

      d948829ad83aff9f326a264a3a71bf0ecb1ad75c

      SHA256

      b352b8a2f3fc65cf4f3d8678ad941f4e21c207ba50771aa54c43af20edd50f23

      SHA512

      e38fbdc40ea72557e6292a895b4331436e8d5ddd74684e6415c598994c03c4a7472dd4098f08d17d1bfe4527fe5d5d601ed72dc444023882369eb31605276523

    • C:\Windows\Temp\1.exe
      Filesize

      168KB

      MD5

      f16fb63d4e551d3808e8f01f2671b57e

      SHA1

      781153ad6235a1152da112de1fb39a6f2d063575

      SHA256

      8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

      SHA512

      fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

    • C:\Windows\Temp\1.exe
      Filesize

      168KB

      MD5

      f16fb63d4e551d3808e8f01f2671b57e

      SHA1

      781153ad6235a1152da112de1fb39a6f2d063575

      SHA256

      8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

      SHA512

      fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

    • C:\Windows\Temp\1.exe
      Filesize

      168KB

      MD5

      f16fb63d4e551d3808e8f01f2671b57e

      SHA1

      781153ad6235a1152da112de1fb39a6f2d063575

      SHA256

      8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

      SHA512

      fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

    • memory/1200-2346-0x00000000050A0000-0x00000000050B0000-memory.dmp
      Filesize

      64KB

    • memory/1200-2339-0x00000000050A0000-0x00000000050B0000-memory.dmp
      Filesize

      64KB

    • memory/1200-2338-0x0000000005270000-0x00000000052AC000-memory.dmp
      Filesize

      240KB

    • memory/1200-2337-0x0000000005210000-0x0000000005222000-memory.dmp
      Filesize

      72KB

    • memory/1200-2336-0x0000000005300000-0x000000000540A000-memory.dmp
      Filesize

      1.0MB

    • memory/1200-2335-0x0000000005810000-0x0000000005E28000-memory.dmp
      Filesize

      6.1MB

    • memory/1200-2331-0x00000000008C0000-0x00000000008EE000-memory.dmp
      Filesize

      184KB

    • memory/2404-204-0x0000000005520000-0x0000000005580000-memory.dmp
      Filesize

      384KB

    • memory/2404-226-0x0000000005520000-0x0000000005580000-memory.dmp
      Filesize

      384KB

    • memory/2404-184-0x0000000005520000-0x0000000005580000-memory.dmp
      Filesize

      384KB

    • memory/2404-186-0x0000000005520000-0x0000000005580000-memory.dmp
      Filesize

      384KB

    • memory/2404-188-0x0000000005520000-0x0000000005580000-memory.dmp
      Filesize

      384KB

    • memory/2404-190-0x0000000005520000-0x0000000005580000-memory.dmp
      Filesize

      384KB

    • memory/2404-192-0x0000000005520000-0x0000000005580000-memory.dmp
      Filesize

      384KB

    • memory/2404-194-0x0000000005520000-0x0000000005580000-memory.dmp
      Filesize

      384KB

    • memory/2404-196-0x0000000005520000-0x0000000005580000-memory.dmp
      Filesize

      384KB

    • memory/2404-198-0x0000000005520000-0x0000000005580000-memory.dmp
      Filesize

      384KB

    • memory/2404-200-0x0000000005520000-0x0000000005580000-memory.dmp
      Filesize

      384KB

    • memory/2404-202-0x0000000005520000-0x0000000005580000-memory.dmp
      Filesize

      384KB

    • memory/2404-180-0x0000000005520000-0x0000000005580000-memory.dmp
      Filesize

      384KB

    • memory/2404-206-0x0000000005520000-0x0000000005580000-memory.dmp
      Filesize

      384KB

    • memory/2404-208-0x0000000005520000-0x0000000005580000-memory.dmp
      Filesize

      384KB

    • memory/2404-210-0x0000000005520000-0x0000000005580000-memory.dmp
      Filesize

      384KB

    • memory/2404-212-0x0000000005520000-0x0000000005580000-memory.dmp
      Filesize

      384KB

    • memory/2404-214-0x0000000005520000-0x0000000005580000-memory.dmp
      Filesize

      384KB

    • memory/2404-216-0x0000000005520000-0x0000000005580000-memory.dmp
      Filesize

      384KB

    • memory/2404-218-0x0000000005520000-0x0000000005580000-memory.dmp
      Filesize

      384KB

    • memory/2404-220-0x0000000005520000-0x0000000005580000-memory.dmp
      Filesize

      384KB

    • memory/2404-222-0x0000000005520000-0x0000000005580000-memory.dmp
      Filesize

      384KB

    • memory/2404-224-0x0000000005520000-0x0000000005580000-memory.dmp
      Filesize

      384KB

    • memory/2404-182-0x0000000005520000-0x0000000005580000-memory.dmp
      Filesize

      384KB

    • memory/2404-228-0x0000000005520000-0x0000000005580000-memory.dmp
      Filesize

      384KB

    • memory/2404-230-0x0000000005520000-0x0000000005580000-memory.dmp
      Filesize

      384KB

    • memory/2404-2314-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
      Filesize

      64KB

    • memory/2404-2315-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
      Filesize

      64KB

    • memory/2404-2316-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
      Filesize

      64KB

    • memory/2404-178-0x0000000005520000-0x0000000005580000-memory.dmp
      Filesize

      384KB

    • memory/2404-2326-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
      Filesize

      64KB

    • memory/2404-176-0x0000000005520000-0x0000000005580000-memory.dmp
      Filesize

      384KB

    • memory/2404-174-0x0000000005520000-0x0000000005580000-memory.dmp
      Filesize

      384KB

    • memory/2404-172-0x0000000005520000-0x0000000005580000-memory.dmp
      Filesize

      384KB

    • memory/2404-2333-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
      Filesize

      64KB

    • memory/2404-170-0x0000000005520000-0x0000000005580000-memory.dmp
      Filesize

      384KB

    • memory/2404-168-0x0000000005520000-0x0000000005580000-memory.dmp
      Filesize

      384KB

    • memory/2404-167-0x0000000005520000-0x0000000005580000-memory.dmp
      Filesize

      384KB

    • memory/2404-166-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
      Filesize

      64KB

    • memory/2404-164-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
      Filesize

      64KB

    • memory/2404-165-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
      Filesize

      64KB

    • memory/2404-163-0x0000000000910000-0x000000000096B000-memory.dmp
      Filesize

      364KB

    • memory/2404-162-0x0000000004F30000-0x00000000054D4000-memory.dmp
      Filesize

      5.6MB

    • memory/3984-2345-0x0000000005530000-0x0000000005540000-memory.dmp
      Filesize

      64KB

    • memory/3984-2344-0x0000000000D60000-0x0000000000D8E000-memory.dmp
      Filesize

      184KB

    • memory/3984-2347-0x0000000005530000-0x0000000005540000-memory.dmp
      Filesize

      64KB