redline | eeb1e4b52d05ad9c691a1270d0f315d57b8ca8586e005bbd3bef501d4ef07fd4

Analysis

max time kernel
146s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2023 08:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eeb1e4b52d05ad9c691a1270d0f315d57b8ca8586e005bbd3bef501d4ef07fd4.exe
Size

1.2MB
MD5

e9861a8e9b3cccf1f82b14c0c15abe40
SHA1

e884d9d4cd56fa0c80688e3f32b843dd5c06c93a
SHA256

eeb1e4b52d05ad9c691a1270d0f315d57b8ca8586e005bbd3bef501d4ef07fd4
SHA512

3a8a43af24f6163c9a771f6fc10760dbe94f82a631f8dbb64a02cde5d0fdc15aeafdb84d5c09b2a07497c8ddd2fc12546cedfad67f8604ccf822d18f01f196f4
SSDEEP

24576:fy6IV4uwQr97A6a7GnjaDUJmgAnNVYRUVwhQr4fAJSdW/iKGx:q6Iyulr97JaI97yZw+r4pdlK

Score

10^/10

redline gena life infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

gena

185.161.248.73:4164

Attributes

auth_value
d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

life

185.161.248.73:4164

Attributes

auth_value
8685d11953530b68ad5ec703809d9f91

Signatures

Detects Redline Stealer samples 1 IoCs

This rule detects the presence of Redline Stealer samples based on their unique strings.

stealer

Processes:

resource	yara_rule
behavioral2/memory/4080-2330-0x00000000050C0000-0x00000000056D8000-memory.dmp	redline_stealer

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

s04055767.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	s04055767.exe

Executes dropped EXE 6 IoCs

Processes:

z35856542.exez02087751.exez15869636.exes04055767.exe1.exet74924208.exe

pid process

1900 z35856542.exe
3880 z02087751.exe
636 z15869636.exe
2176 s04055767.exe
4080 1.exe
4472 t74924208.exe

pid	process
1900	z35856542.exe
3880	z02087751.exe
636	z15869636.exe
2176	s04055767.exe
4080	1.exe
4472	t74924208.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

z15869636.exeeeb1e4b52d05ad9c691a1270d0f315d57b8ca8586e005bbd3bef501d4ef07fd4.exez35856542.exez02087751.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z15869636.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	eeb1e4b52d05ad9c691a1270d0f315d57b8ca8586e005bbd3bef501d4ef07fd4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	eeb1e4b52d05ad9c691a1270d0f315d57b8ca8586e005bbd3bef501d4ef07fd4.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z35856542.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z35856542.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z02087751.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z02087751.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z15869636.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4312 2176 WerFault.exe s04055767.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

s04055767.exe

description pid process

Token: SeDebugPrivilege 2176 s04055767.exe

pid	pid_target	process	target process
4312	2176	WerFault.exe	s04055767.exe

description	pid	process
Token: SeDebugPrivilege	2176	s04055767.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

eeb1e4b52d05ad9c691a1270d0f315d57b8ca8586e005bbd3bef501d4ef07fd4.exez35856542.exez02087751.exez15869636.exes04055767.exe

description	pid	process	target process
PID 1656 wrote to memory of 1900	1656	eeb1e4b52d05ad9c691a1270d0f315d57b8ca8586e005bbd3bef501d4ef07fd4.exe	z35856542.exe
PID 1656 wrote to memory of 1900	1656	eeb1e4b52d05ad9c691a1270d0f315d57b8ca8586e005bbd3bef501d4ef07fd4.exe	z35856542.exe
PID 1656 wrote to memory of 1900	1656	eeb1e4b52d05ad9c691a1270d0f315d57b8ca8586e005bbd3bef501d4ef07fd4.exe	z35856542.exe
PID 1900 wrote to memory of 3880	1900	z35856542.exe	z02087751.exe
PID 1900 wrote to memory of 3880	1900	z35856542.exe	z02087751.exe
PID 1900 wrote to memory of 3880	1900	z35856542.exe	z02087751.exe
PID 3880 wrote to memory of 636	3880	z02087751.exe	z15869636.exe
PID 3880 wrote to memory of 636	3880	z02087751.exe	z15869636.exe
PID 3880 wrote to memory of 636	3880	z02087751.exe	z15869636.exe
PID 636 wrote to memory of 2176	636	z15869636.exe	s04055767.exe
PID 636 wrote to memory of 2176	636	z15869636.exe	s04055767.exe
PID 636 wrote to memory of 2176	636	z15869636.exe	s04055767.exe
PID 2176 wrote to memory of 4080	2176	s04055767.exe	1.exe
PID 2176 wrote to memory of 4080	2176	s04055767.exe	1.exe
PID 2176 wrote to memory of 4080	2176	s04055767.exe	1.exe
PID 636 wrote to memory of 4472	636	z15869636.exe	t74924208.exe
PID 636 wrote to memory of 4472	636	z15869636.exe	t74924208.exe
PID 636 wrote to memory of 4472	636	z15869636.exe	t74924208.exe

C:\Users\Admin\AppData\Local\Temp\eeb1e4b52d05ad9c691a1270d0f315d57b8ca8586e005bbd3bef501d4ef07fd4.exe
"C:\Users\Admin\AppData\Local\Temp\eeb1e4b52d05ad9c691a1270d0f315d57b8ca8586e005bbd3bef501d4ef07fd4.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1656

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z35856542.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z35856542.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1900

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z02087751.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z02087751.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3880

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z15869636.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z15869636.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:636

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s04055767.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s04055767.exe
5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176

C:\Windows\Temp\1.exe
"C:\Windows\Temp\1.exe"
6⤵
- Executes dropped EXE
PID:4080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 992
6⤵
- Program crash
PID:4312

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t74924208.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t74924208.exe
5⤵
- Executes dropped EXE
PID:4472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2176 -ip 2176
1⤵
PID:3076

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z35856542.exe
Filesize
1.0MB

MD5
5290d99783063ac03bc99ada8a3e8b1a

SHA1
427b1accf0beee491b80f81b5bb44e937bea9793

SHA256
f1c0a089e5682de99c6047bc7bf6aef0f479f53967dd76180f9ec3594862a872

SHA512
dd8a456b836e76c4c963c81cc405d4bb2bae119f1d655f7f8de26dec7952cafd012c0da03a28cb0093384c5643f1f1261089ce09a6105b270a137df5c41262a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z35856542.exe
Filesize
1.0MB

MD5
5290d99783063ac03bc99ada8a3e8b1a

SHA1
427b1accf0beee491b80f81b5bb44e937bea9793

SHA256
f1c0a089e5682de99c6047bc7bf6aef0f479f53967dd76180f9ec3594862a872

SHA512
dd8a456b836e76c4c963c81cc405d4bb2bae119f1d655f7f8de26dec7952cafd012c0da03a28cb0093384c5643f1f1261089ce09a6105b270a137df5c41262a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z02087751.exe
Filesize
761KB

MD5
fa504b0d9b0ddd3a701c59342e044bc2

SHA1
dd5151684e7d5b1a5f46374ad23a02ad2d631d66

SHA256
149b051b1d000856d63830560e24005b87b25df15cd71e80f74e353661aba844

SHA512
671c4a50507c600e63da770c8be2028b8b56bac2c6347d08f681c16ee17b284e3cccbce5eed33c63538ebc9a22caa1ada250373af3b3554195737f9233123c6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z02087751.exe
Filesize
761KB

MD5
fa504b0d9b0ddd3a701c59342e044bc2

SHA1
dd5151684e7d5b1a5f46374ad23a02ad2d631d66

SHA256
149b051b1d000856d63830560e24005b87b25df15cd71e80f74e353661aba844

SHA512
671c4a50507c600e63da770c8be2028b8b56bac2c6347d08f681c16ee17b284e3cccbce5eed33c63538ebc9a22caa1ada250373af3b3554195737f9233123c6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z15869636.exe
Filesize
578KB

MD5
637abf2ce14f2d73ae62ca2c6d519558

SHA1
d2d30916047d9122aef7e33aea10bccb635b499c

SHA256
65a5192eb68ed481b8616a607b22d3753aec80ca2107f32a82704019186f5b15

SHA512
962cf880520af5d53975ae9981c4e15f1d653d31896d22a32f84b7c558cfdfb26fece345428f840da4fef624995a64787d7280bcc3fb666eb5ce0423e0872d2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z15869636.exe
Filesize
578KB

MD5
637abf2ce14f2d73ae62ca2c6d519558

SHA1
d2d30916047d9122aef7e33aea10bccb635b499c

SHA256
65a5192eb68ed481b8616a607b22d3753aec80ca2107f32a82704019186f5b15

SHA512
962cf880520af5d53975ae9981c4e15f1d653d31896d22a32f84b7c558cfdfb26fece345428f840da4fef624995a64787d7280bcc3fb666eb5ce0423e0872d2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s04055767.exe
Filesize
502KB

MD5
768cedb471b81503fac9cc791116dd90

SHA1
6c48d607b27667205d68512e7d64fbd6583745b5

SHA256
cb083b7f1b7fbfdda6169147f3fc3c20ad4c635a44edf4d60110813a84108808

SHA512
0ff2c42a93ab3abb0d06db461b855ee4d092ba6f49dba3a54eaa071b98b7c885a3854369deef5f3f9daea4d4a5e459db012bcb5b2a75b2e8db071d532d1e0494

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s04055767.exe
Filesize
502KB

MD5
768cedb471b81503fac9cc791116dd90

SHA1
6c48d607b27667205d68512e7d64fbd6583745b5

SHA256
cb083b7f1b7fbfdda6169147f3fc3c20ad4c635a44edf4d60110813a84108808

SHA512
0ff2c42a93ab3abb0d06db461b855ee4d092ba6f49dba3a54eaa071b98b7c885a3854369deef5f3f9daea4d4a5e459db012bcb5b2a75b2e8db071d532d1e0494

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t74924208.exe
Filesize
169KB

MD5
3d42357e5d92507d7f3d312cfc2591a3

SHA1
cc36dc2bf9899ed6b70f63535e44f96142fd1cf6

SHA256
5d45a16cea3930989fc3ea5f8bc576f68b1b3f72cc8ffc341d10b7aa0f886beb

SHA512
60a8d07cf0a84050522db67ae0c96fd5d8306bd9091782354be869148510b1db3a9d68123f3298a6cdd427716ae2bc94d52702a8e58c43989d5922225e53c1e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t74924208.exe
Filesize
169KB

MD5
3d42357e5d92507d7f3d312cfc2591a3

SHA1
cc36dc2bf9899ed6b70f63535e44f96142fd1cf6

SHA256
5d45a16cea3930989fc3ea5f8bc576f68b1b3f72cc8ffc341d10b7aa0f886beb

SHA512
60a8d07cf0a84050522db67ae0c96fd5d8306bd9091782354be869148510b1db3a9d68123f3298a6cdd427716ae2bc94d52702a8e58c43989d5922225e53c1e4

Download Submit
C:\Windows\Temp\1.exe
Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
C:\Windows\Temp\1.exe
Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
C:\Windows\Temp\1.exe
Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
memory/2176-204-0x0000000005660000-0x00000000056C0000-memory.dmp

Filesize
384KB

Download
memory/2176-216-0x0000000005660000-0x00000000056C0000-memory.dmp

Filesize
384KB

Download
memory/2176-170-0x0000000005660000-0x00000000056C0000-memory.dmp

Filesize
384KB

Download
memory/2176-172-0x0000000005660000-0x00000000056C0000-memory.dmp

Filesize
384KB

Download
memory/2176-174-0x0000000005660000-0x00000000056C0000-memory.dmp

Filesize
384KB

Download
memory/2176-176-0x0000000005660000-0x00000000056C0000-memory.dmp

Filesize
384KB

Download
memory/2176-178-0x0000000005660000-0x00000000056C0000-memory.dmp

Filesize
384KB

Download
memory/2176-180-0x0000000005660000-0x00000000056C0000-memory.dmp

Filesize
384KB

Download
memory/2176-182-0x0000000005660000-0x00000000056C0000-memory.dmp

Filesize
384KB

Download
memory/2176-184-0x0000000005660000-0x00000000056C0000-memory.dmp

Filesize
384KB

Download
memory/2176-186-0x0000000005660000-0x00000000056C0000-memory.dmp

Filesize
384KB

Download
memory/2176-188-0x0000000005660000-0x00000000056C0000-memory.dmp

Filesize
384KB

Download
memory/2176-190-0x0000000005660000-0x00000000056C0000-memory.dmp

Filesize
384KB

Download
memory/2176-192-0x0000000005660000-0x00000000056C0000-memory.dmp

Filesize
384KB

Download
memory/2176-194-0x0000000005660000-0x00000000056C0000-memory.dmp

Filesize
384KB

Download
memory/2176-196-0x0000000005660000-0x00000000056C0000-memory.dmp

Filesize
384KB

Download
memory/2176-198-0x0000000005660000-0x00000000056C0000-memory.dmp

Filesize
384KB

Download
memory/2176-200-0x0000000005660000-0x00000000056C0000-memory.dmp

Filesize
384KB

Download
memory/2176-202-0x0000000005660000-0x00000000056C0000-memory.dmp

Filesize
384KB

Download
memory/2176-168-0x0000000004FA0000-0x0000000004FB0000-memory.dmp

Filesize
64KB

Download
memory/2176-206-0x0000000005660000-0x00000000056C0000-memory.dmp

Filesize
384KB

Download
memory/2176-208-0x0000000005660000-0x00000000056C0000-memory.dmp

Filesize
384KB

Download
memory/2176-210-0x0000000005660000-0x00000000056C0000-memory.dmp

Filesize
384KB

Download
memory/2176-212-0x0000000005660000-0x00000000056C0000-memory.dmp

Filesize
384KB

Download
memory/2176-214-0x0000000005660000-0x00000000056C0000-memory.dmp

Filesize
384KB

Download
memory/2176-166-0x0000000004FA0000-0x0000000004FB0000-memory.dmp

Filesize
64KB

Download
memory/2176-218-0x0000000005660000-0x00000000056C0000-memory.dmp

Filesize
384KB

Download
memory/2176-220-0x0000000005660000-0x00000000056C0000-memory.dmp

Filesize
384KB

Download
memory/2176-222-0x0000000005660000-0x00000000056C0000-memory.dmp

Filesize
384KB

Download
memory/2176-224-0x0000000005660000-0x00000000056C0000-memory.dmp

Filesize
384KB

Download
memory/2176-226-0x0000000005660000-0x00000000056C0000-memory.dmp

Filesize
384KB

Download
memory/2176-228-0x0000000005660000-0x00000000056C0000-memory.dmp

Filesize
384KB

Download
memory/2176-230-0x0000000005660000-0x00000000056C0000-memory.dmp

Filesize
384KB

Download
memory/2176-2255-0x0000000004FA0000-0x0000000004FB0000-memory.dmp

Filesize
64KB

Download
memory/2176-2257-0x0000000004FA0000-0x0000000004FB0000-memory.dmp

Filesize
64KB

Download
memory/2176-2317-0x0000000004FA0000-0x0000000004FB0000-memory.dmp

Filesize
64KB

Download
memory/2176-165-0x0000000005660000-0x00000000056C0000-memory.dmp

Filesize
384KB

Download
memory/2176-167-0x0000000005660000-0x00000000056C0000-memory.dmp

Filesize
384KB

Download
memory/2176-164-0x0000000004FA0000-0x0000000004FB0000-memory.dmp

Filesize
64KB

Download
memory/2176-162-0x00000000050B0000-0x0000000005654000-memory.dmp

Filesize
5.6MB

Download
memory/2176-163-0x0000000002220000-0x000000000227B000-memory.dmp

Filesize
364KB

Download
memory/4080-2331-0x0000000004BB0000-0x0000000004CBA000-memory.dmp

Filesize
1.0MB

Download
memory/4080-2332-0x00000000048C0000-0x00000000048D2000-memory.dmp

Filesize
72KB

Download
memory/4080-2334-0x0000000004920000-0x000000000495C000-memory.dmp

Filesize
240KB

Download
memory/4080-2335-0x0000000004990000-0x00000000049A0000-memory.dmp

Filesize
64KB

Download
memory/4080-2330-0x00000000050C0000-0x00000000056D8000-memory.dmp

Filesize
6.1MB

Download
memory/4080-2329-0x0000000000080000-0x00000000000AE000-memory.dmp

Filesize
184KB

Download
memory/4080-2341-0x0000000004990000-0x00000000049A0000-memory.dmp

Filesize
64KB

Download
memory/4472-2339-0x00000000009B0000-0x00000000009DE000-memory.dmp

Filesize
184KB

Download
memory/4472-2340-0x0000000005380000-0x0000000005390000-memory.dmp

Filesize
64KB

Download
memory/4472-2342-0x0000000005380000-0x0000000005390000-memory.dmp

Filesize
64KB

Download