Analysis
-
max time kernel
128s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
07-05-2023 06:57
Static task
static1
Behavioral task
behavioral1
Sample
cd68002ec3669451e1730c748f847ab471f6161474fd574255be57e31ea0a86d.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
cd68002ec3669451e1730c748f847ab471f6161474fd574255be57e31ea0a86d.exe
Resource
win10v2004-20230220-en
General
-
Target
cd68002ec3669451e1730c748f847ab471f6161474fd574255be57e31ea0a86d.exe
-
Size
794KB
-
MD5
57d6d2e3d82de6677be528853ac8ae7a
-
SHA1
bc1604fde31a34453f8e716e57c0fc8fd135ef0c
-
SHA256
cd68002ec3669451e1730c748f847ab471f6161474fd574255be57e31ea0a86d
-
SHA512
e51bcebfbb5ba77941ea11d3bf8c8447aad9d1c0c668d4153a6d3af54c536e42999e20e6c7acd539fe19a438631e44aa0ed5665bf9659c0cfcba2911ab3af6cb
-
SSDEEP
12288:yy907wF2x/tqoogg/nnJrGLR5gwSkPjXYneuuS27X4B1CbvEH+dkqf:yygN7qoPSnqRbSk7XHuYLb8Hdqf
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
dante
185.161.248.73:4164
-
auth_value
f4066af6b8a6f23125c8ee48288a3f90
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
Processes:
x28888169.exem91418467.exe1.exen30127258.exepid process 2024 x28888169.exe 1296 m91418467.exe 1960 1.exe 548 n30127258.exe -
Loads dropped DLL 9 IoCs
Processes:
cd68002ec3669451e1730c748f847ab471f6161474fd574255be57e31ea0a86d.exex28888169.exem91418467.exe1.exen30127258.exepid process 1084 cd68002ec3669451e1730c748f847ab471f6161474fd574255be57e31ea0a86d.exe 2024 x28888169.exe 2024 x28888169.exe 2024 x28888169.exe 1296 m91418467.exe 1296 m91418467.exe 1960 1.exe 2024 x28888169.exe 548 n30127258.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
cd68002ec3669451e1730c748f847ab471f6161474fd574255be57e31ea0a86d.exex28888169.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce cd68002ec3669451e1730c748f847ab471f6161474fd574255be57e31ea0a86d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" cd68002ec3669451e1730c748f847ab471f6161474fd574255be57e31ea0a86d.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce x28888169.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x28888169.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
m91418467.exedescription pid process Token: SeDebugPrivilege 1296 m91418467.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
cd68002ec3669451e1730c748f847ab471f6161474fd574255be57e31ea0a86d.exex28888169.exem91418467.exedescription pid process target process PID 1084 wrote to memory of 2024 1084 cd68002ec3669451e1730c748f847ab471f6161474fd574255be57e31ea0a86d.exe x28888169.exe PID 1084 wrote to memory of 2024 1084 cd68002ec3669451e1730c748f847ab471f6161474fd574255be57e31ea0a86d.exe x28888169.exe PID 1084 wrote to memory of 2024 1084 cd68002ec3669451e1730c748f847ab471f6161474fd574255be57e31ea0a86d.exe x28888169.exe PID 1084 wrote to memory of 2024 1084 cd68002ec3669451e1730c748f847ab471f6161474fd574255be57e31ea0a86d.exe x28888169.exe PID 1084 wrote to memory of 2024 1084 cd68002ec3669451e1730c748f847ab471f6161474fd574255be57e31ea0a86d.exe x28888169.exe PID 1084 wrote to memory of 2024 1084 cd68002ec3669451e1730c748f847ab471f6161474fd574255be57e31ea0a86d.exe x28888169.exe PID 1084 wrote to memory of 2024 1084 cd68002ec3669451e1730c748f847ab471f6161474fd574255be57e31ea0a86d.exe x28888169.exe PID 2024 wrote to memory of 1296 2024 x28888169.exe m91418467.exe PID 2024 wrote to memory of 1296 2024 x28888169.exe m91418467.exe PID 2024 wrote to memory of 1296 2024 x28888169.exe m91418467.exe PID 2024 wrote to memory of 1296 2024 x28888169.exe m91418467.exe PID 2024 wrote to memory of 1296 2024 x28888169.exe m91418467.exe PID 2024 wrote to memory of 1296 2024 x28888169.exe m91418467.exe PID 2024 wrote to memory of 1296 2024 x28888169.exe m91418467.exe PID 1296 wrote to memory of 1960 1296 m91418467.exe 1.exe PID 1296 wrote to memory of 1960 1296 m91418467.exe 1.exe PID 1296 wrote to memory of 1960 1296 m91418467.exe 1.exe PID 1296 wrote to memory of 1960 1296 m91418467.exe 1.exe PID 1296 wrote to memory of 1960 1296 m91418467.exe 1.exe PID 1296 wrote to memory of 1960 1296 m91418467.exe 1.exe PID 1296 wrote to memory of 1960 1296 m91418467.exe 1.exe PID 2024 wrote to memory of 548 2024 x28888169.exe n30127258.exe PID 2024 wrote to memory of 548 2024 x28888169.exe n30127258.exe PID 2024 wrote to memory of 548 2024 x28888169.exe n30127258.exe PID 2024 wrote to memory of 548 2024 x28888169.exe n30127258.exe PID 2024 wrote to memory of 548 2024 x28888169.exe n30127258.exe PID 2024 wrote to memory of 548 2024 x28888169.exe n30127258.exe PID 2024 wrote to memory of 548 2024 x28888169.exe n30127258.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd68002ec3669451e1730c748f847ab471f6161474fd574255be57e31ea0a86d.exe"C:\Users\Admin\AppData\Local\Temp\cd68002ec3669451e1730c748f847ab471f6161474fd574255be57e31ea0a86d.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x28888169.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x28888169.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m91418467.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m91418467.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n30127258.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n30127258.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x28888169.exeFilesize
590KB
MD57175ef3d29e93edf89f8499aaf458c9e
SHA12ab5329f197a33c435646406cf124e8005cbcdbd
SHA25653b1eaf51dbd1f5974ab204b8703b083529af2cf342ed552215691016bada9bf
SHA512ce9200dcac013a328e4a47cd51519a37cb983debc14e66372461854f809844486a9b11545ba923cadc908579ef739e5e25c069cffd56cfc9ad60697566f9bb19
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x28888169.exeFilesize
590KB
MD57175ef3d29e93edf89f8499aaf458c9e
SHA12ab5329f197a33c435646406cf124e8005cbcdbd
SHA25653b1eaf51dbd1f5974ab204b8703b083529af2cf342ed552215691016bada9bf
SHA512ce9200dcac013a328e4a47cd51519a37cb983debc14e66372461854f809844486a9b11545ba923cadc908579ef739e5e25c069cffd56cfc9ad60697566f9bb19
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m91418467.exeFilesize
530KB
MD5f1a8139aa9e8094d325038c7c4dad282
SHA15e81a3ed2ffb42f49f4b781737a6db7a2a48b49d
SHA2560947ed76d743e026290f3d91f38be1ce76ed88fc9b9cc12c25930209448ffffc
SHA5129abc63d1242fa5abd228269aab2c64a3d5e6ecc716a38324ac1fd5e77b506839fc243d29f873620d5f7a2174768c4a2ebe57345b958467f14e9e51e788efde21
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m91418467.exeFilesize
530KB
MD5f1a8139aa9e8094d325038c7c4dad282
SHA15e81a3ed2ffb42f49f4b781737a6db7a2a48b49d
SHA2560947ed76d743e026290f3d91f38be1ce76ed88fc9b9cc12c25930209448ffffc
SHA5129abc63d1242fa5abd228269aab2c64a3d5e6ecc716a38324ac1fd5e77b506839fc243d29f873620d5f7a2174768c4a2ebe57345b958467f14e9e51e788efde21
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m91418467.exeFilesize
530KB
MD5f1a8139aa9e8094d325038c7c4dad282
SHA15e81a3ed2ffb42f49f4b781737a6db7a2a48b49d
SHA2560947ed76d743e026290f3d91f38be1ce76ed88fc9b9cc12c25930209448ffffc
SHA5129abc63d1242fa5abd228269aab2c64a3d5e6ecc716a38324ac1fd5e77b506839fc243d29f873620d5f7a2174768c4a2ebe57345b958467f14e9e51e788efde21
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n30127258.exeFilesize
168KB
MD542ab1b772b0cb3a12df19fa7e948db1e
SHA118be72f8992a47bbc10d9a7c100dae49ab50f21f
SHA2560fcccf9c3b2e2aef7966b293f04ae5e52fba257b8694b41e235cf54661e273ff
SHA51282ccec7710c3b5053ec4c7f2adb0e42fcf096995c2471fc0ccb0173b129497fd3c1c76a36f1dc4dbc7212c03164641a1feeb0497674fd06df785524d9eb015d5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n30127258.exeFilesize
168KB
MD542ab1b772b0cb3a12df19fa7e948db1e
SHA118be72f8992a47bbc10d9a7c100dae49ab50f21f
SHA2560fcccf9c3b2e2aef7966b293f04ae5e52fba257b8694b41e235cf54661e273ff
SHA51282ccec7710c3b5053ec4c7f2adb0e42fcf096995c2471fc0ccb0173b129497fd3c1c76a36f1dc4dbc7212c03164641a1feeb0497674fd06df785524d9eb015d5
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\x28888169.exeFilesize
590KB
MD57175ef3d29e93edf89f8499aaf458c9e
SHA12ab5329f197a33c435646406cf124e8005cbcdbd
SHA25653b1eaf51dbd1f5974ab204b8703b083529af2cf342ed552215691016bada9bf
SHA512ce9200dcac013a328e4a47cd51519a37cb983debc14e66372461854f809844486a9b11545ba923cadc908579ef739e5e25c069cffd56cfc9ad60697566f9bb19
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\x28888169.exeFilesize
590KB
MD57175ef3d29e93edf89f8499aaf458c9e
SHA12ab5329f197a33c435646406cf124e8005cbcdbd
SHA25653b1eaf51dbd1f5974ab204b8703b083529af2cf342ed552215691016bada9bf
SHA512ce9200dcac013a328e4a47cd51519a37cb983debc14e66372461854f809844486a9b11545ba923cadc908579ef739e5e25c069cffd56cfc9ad60697566f9bb19
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\m91418467.exeFilesize
530KB
MD5f1a8139aa9e8094d325038c7c4dad282
SHA15e81a3ed2ffb42f49f4b781737a6db7a2a48b49d
SHA2560947ed76d743e026290f3d91f38be1ce76ed88fc9b9cc12c25930209448ffffc
SHA5129abc63d1242fa5abd228269aab2c64a3d5e6ecc716a38324ac1fd5e77b506839fc243d29f873620d5f7a2174768c4a2ebe57345b958467f14e9e51e788efde21
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\m91418467.exeFilesize
530KB
MD5f1a8139aa9e8094d325038c7c4dad282
SHA15e81a3ed2ffb42f49f4b781737a6db7a2a48b49d
SHA2560947ed76d743e026290f3d91f38be1ce76ed88fc9b9cc12c25930209448ffffc
SHA5129abc63d1242fa5abd228269aab2c64a3d5e6ecc716a38324ac1fd5e77b506839fc243d29f873620d5f7a2174768c4a2ebe57345b958467f14e9e51e788efde21
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\m91418467.exeFilesize
530KB
MD5f1a8139aa9e8094d325038c7c4dad282
SHA15e81a3ed2ffb42f49f4b781737a6db7a2a48b49d
SHA2560947ed76d743e026290f3d91f38be1ce76ed88fc9b9cc12c25930209448ffffc
SHA5129abc63d1242fa5abd228269aab2c64a3d5e6ecc716a38324ac1fd5e77b506839fc243d29f873620d5f7a2174768c4a2ebe57345b958467f14e9e51e788efde21
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\n30127258.exeFilesize
168KB
MD542ab1b772b0cb3a12df19fa7e948db1e
SHA118be72f8992a47bbc10d9a7c100dae49ab50f21f
SHA2560fcccf9c3b2e2aef7966b293f04ae5e52fba257b8694b41e235cf54661e273ff
SHA51282ccec7710c3b5053ec4c7f2adb0e42fcf096995c2471fc0ccb0173b129497fd3c1c76a36f1dc4dbc7212c03164641a1feeb0497674fd06df785524d9eb015d5
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\n30127258.exeFilesize
168KB
MD542ab1b772b0cb3a12df19fa7e948db1e
SHA118be72f8992a47bbc10d9a7c100dae49ab50f21f
SHA2560fcccf9c3b2e2aef7966b293f04ae5e52fba257b8694b41e235cf54661e273ff
SHA51282ccec7710c3b5053ec4c7f2adb0e42fcf096995c2471fc0ccb0173b129497fd3c1c76a36f1dc4dbc7212c03164641a1feeb0497674fd06df785524d9eb015d5
-
\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
memory/548-2249-0x0000000000180000-0x00000000001B0000-memory.dmpFilesize
192KB
-
memory/548-2250-0x00000000004A0000-0x00000000004A6000-memory.dmpFilesize
24KB
-
memory/548-2251-0x00000000048D0000-0x0000000004910000-memory.dmpFilesize
256KB
-
memory/548-2253-0x00000000048D0000-0x0000000004910000-memory.dmpFilesize
256KB
-
memory/1296-121-0x0000000002610000-0x0000000002670000-memory.dmpFilesize
384KB
-
memory/1296-143-0x0000000002610000-0x0000000002670000-memory.dmpFilesize
384KB
-
memory/1296-105-0x0000000002610000-0x0000000002670000-memory.dmpFilesize
384KB
-
memory/1296-107-0x0000000002610000-0x0000000002670000-memory.dmpFilesize
384KB
-
memory/1296-109-0x0000000002610000-0x0000000002670000-memory.dmpFilesize
384KB
-
memory/1296-111-0x0000000002610000-0x0000000002670000-memory.dmpFilesize
384KB
-
memory/1296-113-0x0000000002610000-0x0000000002670000-memory.dmpFilesize
384KB
-
memory/1296-115-0x0000000002610000-0x0000000002670000-memory.dmpFilesize
384KB
-
memory/1296-117-0x0000000002610000-0x0000000002670000-memory.dmpFilesize
384KB
-
memory/1296-119-0x0000000002610000-0x0000000002670000-memory.dmpFilesize
384KB
-
memory/1296-99-0x0000000002610000-0x0000000002670000-memory.dmpFilesize
384KB
-
memory/1296-123-0x0000000002610000-0x0000000002670000-memory.dmpFilesize
384KB
-
memory/1296-125-0x0000000002610000-0x0000000002670000-memory.dmpFilesize
384KB
-
memory/1296-127-0x0000000002610000-0x0000000002670000-memory.dmpFilesize
384KB
-
memory/1296-129-0x0000000002610000-0x0000000002670000-memory.dmpFilesize
384KB
-
memory/1296-131-0x0000000002610000-0x0000000002670000-memory.dmpFilesize
384KB
-
memory/1296-133-0x0000000002610000-0x0000000002670000-memory.dmpFilesize
384KB
-
memory/1296-135-0x0000000002610000-0x0000000002670000-memory.dmpFilesize
384KB
-
memory/1296-137-0x0000000002610000-0x0000000002670000-memory.dmpFilesize
384KB
-
memory/1296-139-0x0000000002610000-0x0000000002670000-memory.dmpFilesize
384KB
-
memory/1296-141-0x0000000002610000-0x0000000002670000-memory.dmpFilesize
384KB
-
memory/1296-101-0x0000000002610000-0x0000000002670000-memory.dmpFilesize
384KB
-
memory/1296-145-0x0000000002610000-0x0000000002670000-memory.dmpFilesize
384KB
-
memory/1296-147-0x0000000002610000-0x0000000002670000-memory.dmpFilesize
384KB
-
memory/1296-103-0x0000000002610000-0x0000000002670000-memory.dmpFilesize
384KB
-
memory/1296-91-0x0000000005160000-0x00000000051A0000-memory.dmpFilesize
256KB
-
memory/1296-90-0x0000000005160000-0x00000000051A0000-memory.dmpFilesize
256KB
-
memory/1296-89-0x0000000000310000-0x000000000036B000-memory.dmpFilesize
364KB
-
memory/1296-94-0x0000000005160000-0x00000000051A0000-memory.dmpFilesize
256KB
-
memory/1296-2231-0x00000000026A0000-0x00000000026D2000-memory.dmpFilesize
200KB
-
memory/1296-78-0x0000000002820000-0x0000000002888000-memory.dmpFilesize
416KB
-
memory/1296-95-0x0000000002610000-0x0000000002670000-memory.dmpFilesize
384KB
-
memory/1296-97-0x0000000002610000-0x0000000002670000-memory.dmpFilesize
384KB
-
memory/1296-79-0x0000000002610000-0x0000000002676000-memory.dmpFilesize
408KB
-
memory/1296-92-0x0000000002610000-0x0000000002670000-memory.dmpFilesize
384KB
-
memory/1296-87-0x0000000002610000-0x0000000002670000-memory.dmpFilesize
384KB
-
memory/1296-85-0x0000000002610000-0x0000000002670000-memory.dmpFilesize
384KB
-
memory/1296-83-0x0000000002610000-0x0000000002670000-memory.dmpFilesize
384KB
-
memory/1296-81-0x0000000002610000-0x0000000002670000-memory.dmpFilesize
384KB
-
memory/1296-80-0x0000000002610000-0x0000000002670000-memory.dmpFilesize
384KB
-
memory/1960-2242-0x00000000003D0000-0x00000000003D6000-memory.dmpFilesize
24KB
-
memory/1960-2252-0x0000000004BE0000-0x0000000004C20000-memory.dmpFilesize
256KB
-
memory/1960-2241-0x0000000000910000-0x000000000093E000-memory.dmpFilesize
184KB
-
memory/1960-2254-0x0000000004BE0000-0x0000000004C20000-memory.dmpFilesize
256KB