Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2023 06:57
Static task
static1
Behavioral task
behavioral1
Sample
cd68002ec3669451e1730c748f847ab471f6161474fd574255be57e31ea0a86d.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
cd68002ec3669451e1730c748f847ab471f6161474fd574255be57e31ea0a86d.exe
Resource
win10v2004-20230220-en
General
-
Target
cd68002ec3669451e1730c748f847ab471f6161474fd574255be57e31ea0a86d.exe
-
Size
794KB
-
MD5
57d6d2e3d82de6677be528853ac8ae7a
-
SHA1
bc1604fde31a34453f8e716e57c0fc8fd135ef0c
-
SHA256
cd68002ec3669451e1730c748f847ab471f6161474fd574255be57e31ea0a86d
-
SHA512
e51bcebfbb5ba77941ea11d3bf8c8447aad9d1c0c668d4153a6d3af54c536e42999e20e6c7acd539fe19a438631e44aa0ed5665bf9659c0cfcba2911ab3af6cb
-
SSDEEP
12288:yy907wF2x/tqoogg/nnJrGLR5gwSkPjXYneuuS27X4B1CbvEH+dkqf:yygN7qoPSnqRbSk7XHuYLb8Hdqf
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
dante
185.161.248.73:4164
-
auth_value
f4066af6b8a6f23125c8ee48288a3f90
Signatures
-
Detects Redline Stealer samples 1 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
Processes:
resource yara_rule behavioral2/memory/4424-2317-0x00000000058A0000-0x0000000005EB8000-memory.dmp redline_stealer -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
m91418467.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation m91418467.exe -
Executes dropped EXE 4 IoCs
Processes:
x28888169.exem91418467.exe1.exen30127258.exepid process 2296 x28888169.exe 1292 m91418467.exe 4424 1.exe 5028 n30127258.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
x28888169.execd68002ec3669451e1730c748f847ab471f6161474fd574255be57e31ea0a86d.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x28888169.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce cd68002ec3669451e1730c748f847ab471f6161474fd574255be57e31ea0a86d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" cd68002ec3669451e1730c748f847ab471f6161474fd574255be57e31ea0a86d.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce x28888169.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3992 1292 WerFault.exe m91418467.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
m91418467.exedescription pid process Token: SeDebugPrivilege 1292 m91418467.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
cd68002ec3669451e1730c748f847ab471f6161474fd574255be57e31ea0a86d.exex28888169.exem91418467.exedescription pid process target process PID 616 wrote to memory of 2296 616 cd68002ec3669451e1730c748f847ab471f6161474fd574255be57e31ea0a86d.exe x28888169.exe PID 616 wrote to memory of 2296 616 cd68002ec3669451e1730c748f847ab471f6161474fd574255be57e31ea0a86d.exe x28888169.exe PID 616 wrote to memory of 2296 616 cd68002ec3669451e1730c748f847ab471f6161474fd574255be57e31ea0a86d.exe x28888169.exe PID 2296 wrote to memory of 1292 2296 x28888169.exe m91418467.exe PID 2296 wrote to memory of 1292 2296 x28888169.exe m91418467.exe PID 2296 wrote to memory of 1292 2296 x28888169.exe m91418467.exe PID 1292 wrote to memory of 4424 1292 m91418467.exe 1.exe PID 1292 wrote to memory of 4424 1292 m91418467.exe 1.exe PID 1292 wrote to memory of 4424 1292 m91418467.exe 1.exe PID 2296 wrote to memory of 5028 2296 x28888169.exe n30127258.exe PID 2296 wrote to memory of 5028 2296 x28888169.exe n30127258.exe PID 2296 wrote to memory of 5028 2296 x28888169.exe n30127258.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd68002ec3669451e1730c748f847ab471f6161474fd574255be57e31ea0a86d.exe"C:\Users\Admin\AppData\Local\Temp\cd68002ec3669451e1730c748f847ab471f6161474fd574255be57e31ea0a86d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x28888169.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x28888169.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m91418467.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m91418467.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1292 -s 15284⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n30127258.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n30127258.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1292 -ip 12921⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x28888169.exeFilesize
590KB
MD57175ef3d29e93edf89f8499aaf458c9e
SHA12ab5329f197a33c435646406cf124e8005cbcdbd
SHA25653b1eaf51dbd1f5974ab204b8703b083529af2cf342ed552215691016bada9bf
SHA512ce9200dcac013a328e4a47cd51519a37cb983debc14e66372461854f809844486a9b11545ba923cadc908579ef739e5e25c069cffd56cfc9ad60697566f9bb19
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x28888169.exeFilesize
590KB
MD57175ef3d29e93edf89f8499aaf458c9e
SHA12ab5329f197a33c435646406cf124e8005cbcdbd
SHA25653b1eaf51dbd1f5974ab204b8703b083529af2cf342ed552215691016bada9bf
SHA512ce9200dcac013a328e4a47cd51519a37cb983debc14e66372461854f809844486a9b11545ba923cadc908579ef739e5e25c069cffd56cfc9ad60697566f9bb19
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m91418467.exeFilesize
530KB
MD5f1a8139aa9e8094d325038c7c4dad282
SHA15e81a3ed2ffb42f49f4b781737a6db7a2a48b49d
SHA2560947ed76d743e026290f3d91f38be1ce76ed88fc9b9cc12c25930209448ffffc
SHA5129abc63d1242fa5abd228269aab2c64a3d5e6ecc716a38324ac1fd5e77b506839fc243d29f873620d5f7a2174768c4a2ebe57345b958467f14e9e51e788efde21
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m91418467.exeFilesize
530KB
MD5f1a8139aa9e8094d325038c7c4dad282
SHA15e81a3ed2ffb42f49f4b781737a6db7a2a48b49d
SHA2560947ed76d743e026290f3d91f38be1ce76ed88fc9b9cc12c25930209448ffffc
SHA5129abc63d1242fa5abd228269aab2c64a3d5e6ecc716a38324ac1fd5e77b506839fc243d29f873620d5f7a2174768c4a2ebe57345b958467f14e9e51e788efde21
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n30127258.exeFilesize
168KB
MD542ab1b772b0cb3a12df19fa7e948db1e
SHA118be72f8992a47bbc10d9a7c100dae49ab50f21f
SHA2560fcccf9c3b2e2aef7966b293f04ae5e52fba257b8694b41e235cf54661e273ff
SHA51282ccec7710c3b5053ec4c7f2adb0e42fcf096995c2471fc0ccb0173b129497fd3c1c76a36f1dc4dbc7212c03164641a1feeb0497674fd06df785524d9eb015d5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n30127258.exeFilesize
168KB
MD542ab1b772b0cb3a12df19fa7e948db1e
SHA118be72f8992a47bbc10d9a7c100dae49ab50f21f
SHA2560fcccf9c3b2e2aef7966b293f04ae5e52fba257b8694b41e235cf54661e273ff
SHA51282ccec7710c3b5053ec4c7f2adb0e42fcf096995c2471fc0ccb0173b129497fd3c1c76a36f1dc4dbc7212c03164641a1feeb0497674fd06df785524d9eb015d5
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
memory/1292-194-0x0000000002D60000-0x0000000002DC0000-memory.dmpFilesize
384KB
-
memory/1292-202-0x0000000002D60000-0x0000000002DC0000-memory.dmpFilesize
384KB
-
memory/1292-156-0x0000000002D60000-0x0000000002DC0000-memory.dmpFilesize
384KB
-
memory/1292-158-0x0000000002D60000-0x0000000002DC0000-memory.dmpFilesize
384KB
-
memory/1292-160-0x0000000002D60000-0x0000000002DC0000-memory.dmpFilesize
384KB
-
memory/1292-162-0x0000000002D60000-0x0000000002DC0000-memory.dmpFilesize
384KB
-
memory/1292-164-0x0000000002D60000-0x0000000002DC0000-memory.dmpFilesize
384KB
-
memory/1292-166-0x0000000002D60000-0x0000000002DC0000-memory.dmpFilesize
384KB
-
memory/1292-168-0x0000000002D60000-0x0000000002DC0000-memory.dmpFilesize
384KB
-
memory/1292-170-0x0000000002D60000-0x0000000002DC0000-memory.dmpFilesize
384KB
-
memory/1292-172-0x0000000002D60000-0x0000000002DC0000-memory.dmpFilesize
384KB
-
memory/1292-174-0x0000000002D60000-0x0000000002DC0000-memory.dmpFilesize
384KB
-
memory/1292-176-0x0000000002D60000-0x0000000002DC0000-memory.dmpFilesize
384KB
-
memory/1292-178-0x0000000002D60000-0x0000000002DC0000-memory.dmpFilesize
384KB
-
memory/1292-180-0x0000000002D60000-0x0000000002DC0000-memory.dmpFilesize
384KB
-
memory/1292-182-0x0000000002D60000-0x0000000002DC0000-memory.dmpFilesize
384KB
-
memory/1292-184-0x0000000002D60000-0x0000000002DC0000-memory.dmpFilesize
384KB
-
memory/1292-186-0x0000000002D60000-0x0000000002DC0000-memory.dmpFilesize
384KB
-
memory/1292-188-0x0000000002D60000-0x0000000002DC0000-memory.dmpFilesize
384KB
-
memory/1292-190-0x0000000002D60000-0x0000000002DC0000-memory.dmpFilesize
384KB
-
memory/1292-192-0x0000000002D60000-0x0000000002DC0000-memory.dmpFilesize
384KB
-
memory/1292-153-0x0000000002D60000-0x0000000002DC0000-memory.dmpFilesize
384KB
-
memory/1292-196-0x0000000002D60000-0x0000000002DC0000-memory.dmpFilesize
384KB
-
memory/1292-198-0x0000000002D60000-0x0000000002DC0000-memory.dmpFilesize
384KB
-
memory/1292-200-0x0000000002D60000-0x0000000002DC0000-memory.dmpFilesize
384KB
-
memory/1292-154-0x0000000002D60000-0x0000000002DC0000-memory.dmpFilesize
384KB
-
memory/1292-204-0x0000000002D60000-0x0000000002DC0000-memory.dmpFilesize
384KB
-
memory/1292-206-0x0000000002D60000-0x0000000002DC0000-memory.dmpFilesize
384KB
-
memory/1292-208-0x0000000002D60000-0x0000000002DC0000-memory.dmpFilesize
384KB
-
memory/1292-210-0x0000000002D60000-0x0000000002DC0000-memory.dmpFilesize
384KB
-
memory/1292-212-0x0000000002D60000-0x0000000002DC0000-memory.dmpFilesize
384KB
-
memory/1292-214-0x0000000002D60000-0x0000000002DC0000-memory.dmpFilesize
384KB
-
memory/1292-216-0x0000000002D60000-0x0000000002DC0000-memory.dmpFilesize
384KB
-
memory/1292-2301-0x0000000005300000-0x0000000005310000-memory.dmpFilesize
64KB
-
memory/1292-2303-0x0000000005300000-0x0000000005310000-memory.dmpFilesize
64KB
-
memory/1292-2302-0x0000000005300000-0x0000000005310000-memory.dmpFilesize
64KB
-
memory/1292-2304-0x0000000005300000-0x0000000005310000-memory.dmpFilesize
64KB
-
memory/1292-152-0x0000000005300000-0x0000000005310000-memory.dmpFilesize
64KB
-
memory/1292-151-0x0000000005300000-0x0000000005310000-memory.dmpFilesize
64KB
-
memory/1292-150-0x0000000005300000-0x0000000005310000-memory.dmpFilesize
64KB
-
memory/1292-148-0x0000000000C00000-0x0000000000C5B000-memory.dmpFilesize
364KB
-
memory/1292-149-0x0000000005310000-0x00000000058B4000-memory.dmpFilesize
5.6MB
-
memory/4424-2318-0x0000000005390000-0x000000000549A000-memory.dmpFilesize
1.0MB
-
memory/4424-2319-0x00000000050F0000-0x0000000005102000-memory.dmpFilesize
72KB
-
memory/4424-2320-0x0000000005280000-0x00000000052BC000-memory.dmpFilesize
240KB
-
memory/4424-2317-0x00000000058A0000-0x0000000005EB8000-memory.dmpFilesize
6.1MB
-
memory/4424-2316-0x00000000008B0000-0x00000000008DE000-memory.dmpFilesize
184KB
-
memory/4424-2326-0x0000000005170000-0x0000000005180000-memory.dmpFilesize
64KB
-
memory/4424-2327-0x0000000005170000-0x0000000005180000-memory.dmpFilesize
64KB
-
memory/5028-2325-0x0000000000780000-0x00000000007B0000-memory.dmpFilesize
192KB
-
memory/5028-2328-0x0000000004F70000-0x0000000004F80000-memory.dmpFilesize
64KB