Analysis

  • max time kernel
    155s
  • max time network
    183s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-05-2023 03:20

General

  • Target

    71593a05bc9cb08127cee6d58c4d47035f05c3272c3b3917d846cf6802602759.exe

  • Size

    1.2MB

  • MD5

    8e2da0582683dbf07068db69b55306d1

  • SHA1

    0d956197f90d05616f3952d64a84bcbab13d1aba

  • SHA256

    71593a05bc9cb08127cee6d58c4d47035f05c3272c3b3917d846cf6802602759

  • SHA512

    9b658b5154b8a9b40d27b50270b8505fa546574ae324554f7b1bef593c3c5bf141ab04f18d416ec747604dab45277e428d52085921dbd670dae935df0169405c

  • SSDEEP

    24576:+yA4JQZTHA8YWfhF9LjeVkErzHGLB7lHaWH6Kf8id36Nyw2TG51sNvzsB:NA4iZTgaDj3wLGLVlH5aKBqkw2qirs

Malware Config

Extracted

Family

redline

Botnet

gena

C2

185.161.248.73:4164

Attributes
  • auth_value

    d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

life

C2

185.161.248.73:4164

Attributes
  • auth_value

    8685d11953530b68ad5ec703809d9f91

Signatures

  • Detects Redline Stealer samples 1 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\71593a05bc9cb08127cee6d58c4d47035f05c3272c3b3917d846cf6802602759.exe
    "C:\Users\Admin\AppData\Local\Temp\71593a05bc9cb08127cee6d58c4d47035f05c3272c3b3917d846cf6802602759.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1184
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z57349079.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z57349079.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2672
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z22773883.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z22773883.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2196
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z33633298.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z33633298.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:3584
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s82755160.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s82755160.exe
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1688
            • C:\Windows\Temp\1.exe
              "C:\Windows\Temp\1.exe"
              6⤵
              • Executes dropped EXE
              PID:2852
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 1292
              6⤵
              • Program crash
              PID:3092
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t58303961.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t58303961.exe
            5⤵
            • Executes dropped EXE
            PID:4480
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1688 -ip 1688
    1⤵
      PID:436

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    1
    T1112

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z57349079.exe
      Filesize

      1.0MB

      MD5

      0d108bb34f39e3c39fcdc1297bdacc5d

      SHA1

      101b65f0a7d3aca381bf3cdf3cccd6e0dd5bb6ad

      SHA256

      5cc61fde7f8393932e7e7c6f6fcd212c6b47529e3ee4d46ea9b2e765173714ec

      SHA512

      2d71245c8363ec5b9f0095830a76f0c3921a6a5bbd4c74d73d9e19e8462f90960eab05b65e9b445824b0568c8c11276a34cbbe4ce9d146fefab35dfafd4d3424

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z57349079.exe
      Filesize

      1.0MB

      MD5

      0d108bb34f39e3c39fcdc1297bdacc5d

      SHA1

      101b65f0a7d3aca381bf3cdf3cccd6e0dd5bb6ad

      SHA256

      5cc61fde7f8393932e7e7c6f6fcd212c6b47529e3ee4d46ea9b2e765173714ec

      SHA512

      2d71245c8363ec5b9f0095830a76f0c3921a6a5bbd4c74d73d9e19e8462f90960eab05b65e9b445824b0568c8c11276a34cbbe4ce9d146fefab35dfafd4d3424

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z22773883.exe
      Filesize

      760KB

      MD5

      38ea974893060de05b76b9e4a24314cc

      SHA1

      02e5aa5e7bf97492113290579d52b24b3d02cec9

      SHA256

      7adf1490845ddfb604198523df6509c10ebed8770a1a3f92d6f375bd13ab0ac8

      SHA512

      cab2626965a79b4d1e3c2db5eb8946f6f3b60e6f837b150c8a6a9daedee23176c12c7f911c6cf49e197925ea168e0ab70bd7321ae1dfdc196a2a03e446ff2285

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z22773883.exe
      Filesize

      760KB

      MD5

      38ea974893060de05b76b9e4a24314cc

      SHA1

      02e5aa5e7bf97492113290579d52b24b3d02cec9

      SHA256

      7adf1490845ddfb604198523df6509c10ebed8770a1a3f92d6f375bd13ab0ac8

      SHA512

      cab2626965a79b4d1e3c2db5eb8946f6f3b60e6f837b150c8a6a9daedee23176c12c7f911c6cf49e197925ea168e0ab70bd7321ae1dfdc196a2a03e446ff2285

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z33633298.exe
      Filesize

      578KB

      MD5

      8d3f895d44e986cf91b1abc2120c240c

      SHA1

      a61183a05774665815f26af4e24a697aa28c5589

      SHA256

      dac2f21af459b02ffa294e2818758dd25426669287ca0ceb881dedb9f7897ec5

      SHA512

      215f22b348b9e8aecebfc24a40aa93adb87e4040844a80467ae16336ab3163bcb0fba8afde264c2bf92af48a7305ba0f0ac2c9805459c8a63808c3a3a90bc191

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z33633298.exe
      Filesize

      578KB

      MD5

      8d3f895d44e986cf91b1abc2120c240c

      SHA1

      a61183a05774665815f26af4e24a697aa28c5589

      SHA256

      dac2f21af459b02ffa294e2818758dd25426669287ca0ceb881dedb9f7897ec5

      SHA512

      215f22b348b9e8aecebfc24a40aa93adb87e4040844a80467ae16336ab3163bcb0fba8afde264c2bf92af48a7305ba0f0ac2c9805459c8a63808c3a3a90bc191

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s82755160.exe
      Filesize

      575KB

      MD5

      45fcbcdc699cc9c7acda22ea60e811f4

      SHA1

      8be83b481df9269edd675d9da34b37c14cd13f87

      SHA256

      7819a1f33445c151fee57878f0e71fa9b585869e380a69ccd3b277dc41afa8f7

      SHA512

      9f5f64adf61fdfeff6b86b569ff473cda32d7d3c180a54750058432c405d642a1343ccec6af35d114a2d2c619b63a05db6642d859b6b55313eb3c6102d4d7270

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s82755160.exe
      Filesize

      575KB

      MD5

      45fcbcdc699cc9c7acda22ea60e811f4

      SHA1

      8be83b481df9269edd675d9da34b37c14cd13f87

      SHA256

      7819a1f33445c151fee57878f0e71fa9b585869e380a69ccd3b277dc41afa8f7

      SHA512

      9f5f64adf61fdfeff6b86b569ff473cda32d7d3c180a54750058432c405d642a1343ccec6af35d114a2d2c619b63a05db6642d859b6b55313eb3c6102d4d7270

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t58303961.exe
      Filesize

      169KB

      MD5

      a70c98f9dc734ca8de89cd1edc56d756

      SHA1

      37aea72a596d3d7bf316d0c52325856843a58e97

      SHA256

      7d7867db1d4d19846493bb9eaa131f51a5777002c4e9f1b51a586b708cc3c9e3

      SHA512

      3b86439f5824490a254bbb9936735227427a096238135b4ccbe91d38d3315f103c243e39f1718317f9ef28e424274fd88525ce9cba61d22fe6468aae3c6e29cb

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t58303961.exe
      Filesize

      169KB

      MD5

      a70c98f9dc734ca8de89cd1edc56d756

      SHA1

      37aea72a596d3d7bf316d0c52325856843a58e97

      SHA256

      7d7867db1d4d19846493bb9eaa131f51a5777002c4e9f1b51a586b708cc3c9e3

      SHA512

      3b86439f5824490a254bbb9936735227427a096238135b4ccbe91d38d3315f103c243e39f1718317f9ef28e424274fd88525ce9cba61d22fe6468aae3c6e29cb

    • C:\Windows\Temp\1.exe
      Filesize

      168KB

      MD5

      f16fb63d4e551d3808e8f01f2671b57e

      SHA1

      781153ad6235a1152da112de1fb39a6f2d063575

      SHA256

      8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

      SHA512

      fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

    • C:\Windows\Temp\1.exe
      Filesize

      168KB

      MD5

      f16fb63d4e551d3808e8f01f2671b57e

      SHA1

      781153ad6235a1152da112de1fb39a6f2d063575

      SHA256

      8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

      SHA512

      fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

    • C:\Windows\Temp\1.exe
      Filesize

      168KB

      MD5

      f16fb63d4e551d3808e8f01f2671b57e

      SHA1

      781153ad6235a1152da112de1fb39a6f2d063575

      SHA256

      8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

      SHA512

      fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

    • memory/1688-205-0x0000000005580000-0x00000000055E0000-memory.dmp
      Filesize

      384KB

    • memory/1688-217-0x0000000005580000-0x00000000055E0000-memory.dmp
      Filesize

      384KB

    • memory/1688-171-0x0000000005580000-0x00000000055E0000-memory.dmp
      Filesize

      384KB

    • memory/1688-173-0x0000000005580000-0x00000000055E0000-memory.dmp
      Filesize

      384KB

    • memory/1688-175-0x0000000005580000-0x00000000055E0000-memory.dmp
      Filesize

      384KB

    • memory/1688-179-0x0000000005580000-0x00000000055E0000-memory.dmp
      Filesize

      384KB

    • memory/1688-181-0x0000000005580000-0x00000000055E0000-memory.dmp
      Filesize

      384KB

    • memory/1688-177-0x0000000005580000-0x00000000055E0000-memory.dmp
      Filesize

      384KB

    • memory/1688-183-0x0000000005580000-0x00000000055E0000-memory.dmp
      Filesize

      384KB

    • memory/1688-185-0x0000000005580000-0x00000000055E0000-memory.dmp
      Filesize

      384KB

    • memory/1688-187-0x0000000005580000-0x00000000055E0000-memory.dmp
      Filesize

      384KB

    • memory/1688-189-0x0000000005580000-0x00000000055E0000-memory.dmp
      Filesize

      384KB

    • memory/1688-191-0x0000000005580000-0x00000000055E0000-memory.dmp
      Filesize

      384KB

    • memory/1688-193-0x0000000005580000-0x00000000055E0000-memory.dmp
      Filesize

      384KB

    • memory/1688-195-0x0000000005580000-0x00000000055E0000-memory.dmp
      Filesize

      384KB

    • memory/1688-197-0x0000000005580000-0x00000000055E0000-memory.dmp
      Filesize

      384KB

    • memory/1688-199-0x0000000005580000-0x00000000055E0000-memory.dmp
      Filesize

      384KB

    • memory/1688-201-0x0000000005580000-0x00000000055E0000-memory.dmp
      Filesize

      384KB

    • memory/1688-203-0x0000000005580000-0x00000000055E0000-memory.dmp
      Filesize

      384KB

    • memory/1688-167-0x0000000005580000-0x00000000055E0000-memory.dmp
      Filesize

      384KB

    • memory/1688-207-0x0000000005580000-0x00000000055E0000-memory.dmp
      Filesize

      384KB

    • memory/1688-209-0x0000000005580000-0x00000000055E0000-memory.dmp
      Filesize

      384KB

    • memory/1688-211-0x0000000005580000-0x00000000055E0000-memory.dmp
      Filesize

      384KB

    • memory/1688-213-0x0000000005580000-0x00000000055E0000-memory.dmp
      Filesize

      384KB

    • memory/1688-215-0x0000000005580000-0x00000000055E0000-memory.dmp
      Filesize

      384KB

    • memory/1688-169-0x0000000005580000-0x00000000055E0000-memory.dmp
      Filesize

      384KB

    • memory/1688-219-0x0000000005580000-0x00000000055E0000-memory.dmp
      Filesize

      384KB

    • memory/1688-221-0x0000000005580000-0x00000000055E0000-memory.dmp
      Filesize

      384KB

    • memory/1688-223-0x0000000005580000-0x00000000055E0000-memory.dmp
      Filesize

      384KB

    • memory/1688-225-0x0000000005580000-0x00000000055E0000-memory.dmp
      Filesize

      384KB

    • memory/1688-227-0x0000000005580000-0x00000000055E0000-memory.dmp
      Filesize

      384KB

    • memory/1688-229-0x0000000005580000-0x00000000055E0000-memory.dmp
      Filesize

      384KB

    • memory/1688-2313-0x0000000000D00000-0x0000000000D10000-memory.dmp
      Filesize

      64KB

    • memory/1688-2314-0x0000000000D00000-0x0000000000D10000-memory.dmp
      Filesize

      64KB

    • memory/1688-2315-0x0000000000D00000-0x0000000000D10000-memory.dmp
      Filesize

      64KB

    • memory/1688-2319-0x0000000000D00000-0x0000000000D10000-memory.dmp
      Filesize

      64KB

    • memory/1688-166-0x0000000005580000-0x00000000055E0000-memory.dmp
      Filesize

      384KB

    • memory/1688-2328-0x0000000000D00000-0x0000000000D10000-memory.dmp
      Filesize

      64KB

    • memory/1688-165-0x0000000000D00000-0x0000000000D10000-memory.dmp
      Filesize

      64KB

    • memory/1688-163-0x0000000000910000-0x000000000096B000-memory.dmp
      Filesize

      364KB

    • memory/1688-162-0x0000000004FD0000-0x0000000005574000-memory.dmp
      Filesize

      5.6MB

    • memory/1688-164-0x0000000000D00000-0x0000000000D10000-memory.dmp
      Filesize

      64KB

    • memory/2852-2337-0x0000000004CC0000-0x0000000004DCA000-memory.dmp
      Filesize

      1.0MB

    • memory/2852-2338-0x0000000004BD0000-0x0000000004BE2000-memory.dmp
      Filesize

      72KB

    • memory/2852-2339-0x0000000004AA0000-0x0000000004AB0000-memory.dmp
      Filesize

      64KB

    • memory/2852-2340-0x0000000004C30000-0x0000000004C6C000-memory.dmp
      Filesize

      240KB

    • memory/2852-2336-0x00000000051D0000-0x00000000057E8000-memory.dmp
      Filesize

      6.1MB

    • memory/2852-2335-0x0000000000130000-0x000000000015E000-memory.dmp
      Filesize

      184KB

    • memory/2852-2347-0x0000000004AA0000-0x0000000004AB0000-memory.dmp
      Filesize

      64KB

    • memory/4480-2345-0x0000000000AA0000-0x0000000000ACE000-memory.dmp
      Filesize

      184KB

    • memory/4480-2346-0x00000000053F0000-0x0000000005400000-memory.dmp
      Filesize

      64KB

    • memory/4480-2348-0x00000000053F0000-0x0000000005400000-memory.dmp
      Filesize

      64KB