Analysis
-
max time kernel
151s -
max time network
194s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
07-05-2023 07:31
Static task
static1
Behavioral task
behavioral1
Sample
dbd31bec33edd6aa2952aa7ded847337696ab1e565ca4c592dbceb8055f32c26.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
dbd31bec33edd6aa2952aa7ded847337696ab1e565ca4c592dbceb8055f32c26.exe
Resource
win10v2004-20230220-en
General
-
Target
dbd31bec33edd6aa2952aa7ded847337696ab1e565ca4c592dbceb8055f32c26.exe
-
Size
890KB
-
MD5
108131a4e149553d7baa81e3ec477f6c
-
SHA1
1ce94c709fe4008caf036b987f017fa00a008715
-
SHA256
dbd31bec33edd6aa2952aa7ded847337696ab1e565ca4c592dbceb8055f32c26
-
SHA512
538ee826e57683cb59cbb3f52be5646267f35515fa670ad69041699f5dd0934ed92fbf3cd4a68588039aacad286623c4a325961f8ffd0144b097bf0d65bc4ce5
-
SSDEEP
12288:Yy90Bd6Lltag+8V875c36FQ86+rLvR2rRQyaNTxGPirb95Cu/frSwfprHmLfXUgM:YyL+bc+/orRK9GKfHHGwhrgXRYi0/1r
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
dork
185.161.248.73:4164
-
auth_value
e81be7d6cfb453cc812e1b4890eeadad
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
Processes:
y15898166.exep61987098.exe1.exer52056902.exepid process 1968 y15898166.exe 468 p61987098.exe 1980 1.exe 1160 r52056902.exe -
Loads dropped DLL 9 IoCs
Processes:
dbd31bec33edd6aa2952aa7ded847337696ab1e565ca4c592dbceb8055f32c26.exey15898166.exep61987098.exe1.exer52056902.exepid process 1712 dbd31bec33edd6aa2952aa7ded847337696ab1e565ca4c592dbceb8055f32c26.exe 1968 y15898166.exe 1968 y15898166.exe 1968 y15898166.exe 468 p61987098.exe 468 p61987098.exe 1980 1.exe 1968 y15898166.exe 1160 r52056902.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
dbd31bec33edd6aa2952aa7ded847337696ab1e565ca4c592dbceb8055f32c26.exey15898166.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce dbd31bec33edd6aa2952aa7ded847337696ab1e565ca4c592dbceb8055f32c26.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" dbd31bec33edd6aa2952aa7ded847337696ab1e565ca4c592dbceb8055f32c26.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce y15898166.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y15898166.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
p61987098.exedescription pid process Token: SeDebugPrivilege 468 p61987098.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
dbd31bec33edd6aa2952aa7ded847337696ab1e565ca4c592dbceb8055f32c26.exey15898166.exep61987098.exedescription pid process target process PID 1712 wrote to memory of 1968 1712 dbd31bec33edd6aa2952aa7ded847337696ab1e565ca4c592dbceb8055f32c26.exe y15898166.exe PID 1712 wrote to memory of 1968 1712 dbd31bec33edd6aa2952aa7ded847337696ab1e565ca4c592dbceb8055f32c26.exe y15898166.exe PID 1712 wrote to memory of 1968 1712 dbd31bec33edd6aa2952aa7ded847337696ab1e565ca4c592dbceb8055f32c26.exe y15898166.exe PID 1712 wrote to memory of 1968 1712 dbd31bec33edd6aa2952aa7ded847337696ab1e565ca4c592dbceb8055f32c26.exe y15898166.exe PID 1712 wrote to memory of 1968 1712 dbd31bec33edd6aa2952aa7ded847337696ab1e565ca4c592dbceb8055f32c26.exe y15898166.exe PID 1712 wrote to memory of 1968 1712 dbd31bec33edd6aa2952aa7ded847337696ab1e565ca4c592dbceb8055f32c26.exe y15898166.exe PID 1712 wrote to memory of 1968 1712 dbd31bec33edd6aa2952aa7ded847337696ab1e565ca4c592dbceb8055f32c26.exe y15898166.exe PID 1968 wrote to memory of 468 1968 y15898166.exe p61987098.exe PID 1968 wrote to memory of 468 1968 y15898166.exe p61987098.exe PID 1968 wrote to memory of 468 1968 y15898166.exe p61987098.exe PID 1968 wrote to memory of 468 1968 y15898166.exe p61987098.exe PID 1968 wrote to memory of 468 1968 y15898166.exe p61987098.exe PID 1968 wrote to memory of 468 1968 y15898166.exe p61987098.exe PID 1968 wrote to memory of 468 1968 y15898166.exe p61987098.exe PID 468 wrote to memory of 1980 468 p61987098.exe 1.exe PID 468 wrote to memory of 1980 468 p61987098.exe 1.exe PID 468 wrote to memory of 1980 468 p61987098.exe 1.exe PID 468 wrote to memory of 1980 468 p61987098.exe 1.exe PID 468 wrote to memory of 1980 468 p61987098.exe 1.exe PID 468 wrote to memory of 1980 468 p61987098.exe 1.exe PID 468 wrote to memory of 1980 468 p61987098.exe 1.exe PID 1968 wrote to memory of 1160 1968 y15898166.exe r52056902.exe PID 1968 wrote to memory of 1160 1968 y15898166.exe r52056902.exe PID 1968 wrote to memory of 1160 1968 y15898166.exe r52056902.exe PID 1968 wrote to memory of 1160 1968 y15898166.exe r52056902.exe PID 1968 wrote to memory of 1160 1968 y15898166.exe r52056902.exe PID 1968 wrote to memory of 1160 1968 y15898166.exe r52056902.exe PID 1968 wrote to memory of 1160 1968 y15898166.exe r52056902.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbd31bec33edd6aa2952aa7ded847337696ab1e565ca4c592dbceb8055f32c26.exe"C:\Users\Admin\AppData\Local\Temp\dbd31bec33edd6aa2952aa7ded847337696ab1e565ca4c592dbceb8055f32c26.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y15898166.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y15898166.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p61987098.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p61987098.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r52056902.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r52056902.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y15898166.exeFilesize
589KB
MD5ea4fe1904abcca462e16f23413367979
SHA17b96e43e096bb1c42cf4c393f83ed97767920380
SHA2569ce682ccc7ab884b889c9ee6c1218f984fe452b2ccbac0eb7b0a63942c61a7d6
SHA512d6bcb3b1a78b37ff813d3c3f6499dcc6780f83d1d0a90f0f560be0fe4cb0e48dc076245574bcc09eaac28522874b2e30e82bff0ba3f7aafcecef9ac584e84c53
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y15898166.exeFilesize
589KB
MD5ea4fe1904abcca462e16f23413367979
SHA17b96e43e096bb1c42cf4c393f83ed97767920380
SHA2569ce682ccc7ab884b889c9ee6c1218f984fe452b2ccbac0eb7b0a63942c61a7d6
SHA512d6bcb3b1a78b37ff813d3c3f6499dcc6780f83d1d0a90f0f560be0fe4cb0e48dc076245574bcc09eaac28522874b2e30e82bff0ba3f7aafcecef9ac584e84c53
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p61987098.exeFilesize
530KB
MD58a95612b6249cc2f6a877ac76aab8734
SHA1dfce657069799d8288c90fec7ad980f892de8293
SHA256bb6d1a01aeb3582e370f5cd31804ea2d953411a4fcd3783681eac9ba38b1575a
SHA5126364da83ffc4911488a929bd704187dba32282b42410162bc35f320610eedfbef0a7cf0e7e040d70316fcf0e19504f18bb0c7a3c8e937487de8d12de957e0f7b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p61987098.exeFilesize
530KB
MD58a95612b6249cc2f6a877ac76aab8734
SHA1dfce657069799d8288c90fec7ad980f892de8293
SHA256bb6d1a01aeb3582e370f5cd31804ea2d953411a4fcd3783681eac9ba38b1575a
SHA5126364da83ffc4911488a929bd704187dba32282b42410162bc35f320610eedfbef0a7cf0e7e040d70316fcf0e19504f18bb0c7a3c8e937487de8d12de957e0f7b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p61987098.exeFilesize
530KB
MD58a95612b6249cc2f6a877ac76aab8734
SHA1dfce657069799d8288c90fec7ad980f892de8293
SHA256bb6d1a01aeb3582e370f5cd31804ea2d953411a4fcd3783681eac9ba38b1575a
SHA5126364da83ffc4911488a929bd704187dba32282b42410162bc35f320610eedfbef0a7cf0e7e040d70316fcf0e19504f18bb0c7a3c8e937487de8d12de957e0f7b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r52056902.exeFilesize
168KB
MD512a4b1fa3b08aa347092c5720df7a407
SHA11ac5f6f4c5889bd479398e2dfc71a91926466074
SHA256c69f3b7938f1432635a0f91c0c782544f65a2515fdab8a044b3b9d79c52f46c1
SHA5122e1318017ce15538a735b61565d7ad33a3dbb03f8eecf881f94bef41e2c67f2c69ffa583b15c6e21901eb62a95c499b809718de6d0caee2e8cef9f6c08d4d2fe
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r52056902.exeFilesize
168KB
MD512a4b1fa3b08aa347092c5720df7a407
SHA11ac5f6f4c5889bd479398e2dfc71a91926466074
SHA256c69f3b7938f1432635a0f91c0c782544f65a2515fdab8a044b3b9d79c52f46c1
SHA5122e1318017ce15538a735b61565d7ad33a3dbb03f8eecf881f94bef41e2c67f2c69ffa583b15c6e21901eb62a95c499b809718de6d0caee2e8cef9f6c08d4d2fe
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\y15898166.exeFilesize
589KB
MD5ea4fe1904abcca462e16f23413367979
SHA17b96e43e096bb1c42cf4c393f83ed97767920380
SHA2569ce682ccc7ab884b889c9ee6c1218f984fe452b2ccbac0eb7b0a63942c61a7d6
SHA512d6bcb3b1a78b37ff813d3c3f6499dcc6780f83d1d0a90f0f560be0fe4cb0e48dc076245574bcc09eaac28522874b2e30e82bff0ba3f7aafcecef9ac584e84c53
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\y15898166.exeFilesize
589KB
MD5ea4fe1904abcca462e16f23413367979
SHA17b96e43e096bb1c42cf4c393f83ed97767920380
SHA2569ce682ccc7ab884b889c9ee6c1218f984fe452b2ccbac0eb7b0a63942c61a7d6
SHA512d6bcb3b1a78b37ff813d3c3f6499dcc6780f83d1d0a90f0f560be0fe4cb0e48dc076245574bcc09eaac28522874b2e30e82bff0ba3f7aafcecef9ac584e84c53
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\p61987098.exeFilesize
530KB
MD58a95612b6249cc2f6a877ac76aab8734
SHA1dfce657069799d8288c90fec7ad980f892de8293
SHA256bb6d1a01aeb3582e370f5cd31804ea2d953411a4fcd3783681eac9ba38b1575a
SHA5126364da83ffc4911488a929bd704187dba32282b42410162bc35f320610eedfbef0a7cf0e7e040d70316fcf0e19504f18bb0c7a3c8e937487de8d12de957e0f7b
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\p61987098.exeFilesize
530KB
MD58a95612b6249cc2f6a877ac76aab8734
SHA1dfce657069799d8288c90fec7ad980f892de8293
SHA256bb6d1a01aeb3582e370f5cd31804ea2d953411a4fcd3783681eac9ba38b1575a
SHA5126364da83ffc4911488a929bd704187dba32282b42410162bc35f320610eedfbef0a7cf0e7e040d70316fcf0e19504f18bb0c7a3c8e937487de8d12de957e0f7b
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\p61987098.exeFilesize
530KB
MD58a95612b6249cc2f6a877ac76aab8734
SHA1dfce657069799d8288c90fec7ad980f892de8293
SHA256bb6d1a01aeb3582e370f5cd31804ea2d953411a4fcd3783681eac9ba38b1575a
SHA5126364da83ffc4911488a929bd704187dba32282b42410162bc35f320610eedfbef0a7cf0e7e040d70316fcf0e19504f18bb0c7a3c8e937487de8d12de957e0f7b
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\r52056902.exeFilesize
168KB
MD512a4b1fa3b08aa347092c5720df7a407
SHA11ac5f6f4c5889bd479398e2dfc71a91926466074
SHA256c69f3b7938f1432635a0f91c0c782544f65a2515fdab8a044b3b9d79c52f46c1
SHA5122e1318017ce15538a735b61565d7ad33a3dbb03f8eecf881f94bef41e2c67f2c69ffa583b15c6e21901eb62a95c499b809718de6d0caee2e8cef9f6c08d4d2fe
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\r52056902.exeFilesize
168KB
MD512a4b1fa3b08aa347092c5720df7a407
SHA11ac5f6f4c5889bd479398e2dfc71a91926466074
SHA256c69f3b7938f1432635a0f91c0c782544f65a2515fdab8a044b3b9d79c52f46c1
SHA5122e1318017ce15538a735b61565d7ad33a3dbb03f8eecf881f94bef41e2c67f2c69ffa583b15c6e21901eb62a95c499b809718de6d0caee2e8cef9f6c08d4d2fe
-
\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
memory/468-121-0x0000000000EA0000-0x0000000000F00000-memory.dmpFilesize
384KB
-
memory/468-137-0x0000000000EA0000-0x0000000000F00000-memory.dmpFilesize
384KB
-
memory/468-93-0x0000000000EA0000-0x0000000000F00000-memory.dmpFilesize
384KB
-
memory/468-95-0x0000000000EA0000-0x0000000000F00000-memory.dmpFilesize
384KB
-
memory/468-91-0x0000000000EA0000-0x0000000000F00000-memory.dmpFilesize
384KB
-
memory/468-97-0x0000000000EA0000-0x0000000000F00000-memory.dmpFilesize
384KB
-
memory/468-99-0x0000000000EA0000-0x0000000000F00000-memory.dmpFilesize
384KB
-
memory/468-101-0x0000000000EA0000-0x0000000000F00000-memory.dmpFilesize
384KB
-
memory/468-103-0x0000000000EA0000-0x0000000000F00000-memory.dmpFilesize
384KB
-
memory/468-105-0x0000000000EA0000-0x0000000000F00000-memory.dmpFilesize
384KB
-
memory/468-107-0x0000000000EA0000-0x0000000000F00000-memory.dmpFilesize
384KB
-
memory/468-109-0x0000000000EA0000-0x0000000000F00000-memory.dmpFilesize
384KB
-
memory/468-111-0x0000000000EA0000-0x0000000000F00000-memory.dmpFilesize
384KB
-
memory/468-113-0x0000000000EA0000-0x0000000000F00000-memory.dmpFilesize
384KB
-
memory/468-117-0x0000000000EA0000-0x0000000000F00000-memory.dmpFilesize
384KB
-
memory/468-119-0x0000000000EA0000-0x0000000000F00000-memory.dmpFilesize
384KB
-
memory/468-87-0x0000000000EA0000-0x0000000000F00000-memory.dmpFilesize
384KB
-
memory/468-123-0x0000000000EA0000-0x0000000000F00000-memory.dmpFilesize
384KB
-
memory/468-125-0x0000000000EA0000-0x0000000000F00000-memory.dmpFilesize
384KB
-
memory/468-127-0x0000000000EA0000-0x0000000000F00000-memory.dmpFilesize
384KB
-
memory/468-129-0x0000000000EA0000-0x0000000000F00000-memory.dmpFilesize
384KB
-
memory/468-131-0x0000000000EA0000-0x0000000000F00000-memory.dmpFilesize
384KB
-
memory/468-133-0x0000000000EA0000-0x0000000000F00000-memory.dmpFilesize
384KB
-
memory/468-135-0x0000000000EA0000-0x0000000000F00000-memory.dmpFilesize
384KB
-
memory/468-139-0x0000000000EA0000-0x0000000000F00000-memory.dmpFilesize
384KB
-
memory/468-89-0x0000000000EA0000-0x0000000000F00000-memory.dmpFilesize
384KB
-
memory/468-141-0x0000000000EA0000-0x0000000000F00000-memory.dmpFilesize
384KB
-
memory/468-143-0x0000000000EA0000-0x0000000000F00000-memory.dmpFilesize
384KB
-
memory/468-145-0x0000000000EA0000-0x0000000000F00000-memory.dmpFilesize
384KB
-
memory/468-115-0x0000000000EA0000-0x0000000000F00000-memory.dmpFilesize
384KB
-
memory/468-207-0x0000000005400000-0x0000000005440000-memory.dmpFilesize
256KB
-
memory/468-206-0x0000000005400000-0x0000000005440000-memory.dmpFilesize
256KB
-
memory/468-2231-0x0000000005400000-0x0000000005440000-memory.dmpFilesize
256KB
-
memory/468-2233-0x0000000005400000-0x0000000005440000-memory.dmpFilesize
256KB
-
memory/468-2234-0x0000000002830000-0x0000000002862000-memory.dmpFilesize
200KB
-
memory/468-85-0x0000000000EA0000-0x0000000000F00000-memory.dmpFilesize
384KB
-
memory/468-83-0x0000000000EA0000-0x0000000000F00000-memory.dmpFilesize
384KB
-
memory/468-82-0x0000000000EA0000-0x0000000000F00000-memory.dmpFilesize
384KB
-
memory/468-2235-0x0000000005400000-0x0000000005440000-memory.dmpFilesize
256KB
-
memory/468-78-0x0000000000C10000-0x0000000000C78000-memory.dmpFilesize
416KB
-
memory/468-81-0x0000000000EA0000-0x0000000000F06000-memory.dmpFilesize
408KB
-
memory/468-79-0x0000000000270000-0x00000000002CB000-memory.dmpFilesize
364KB
-
memory/468-80-0x0000000005400000-0x0000000005440000-memory.dmpFilesize
256KB
-
memory/1160-2254-0x0000000000960000-0x0000000000990000-memory.dmpFilesize
192KB
-
memory/1160-2255-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/1160-2257-0x0000000004C20000-0x0000000004C60000-memory.dmpFilesize
256KB
-
memory/1160-2259-0x0000000004C20000-0x0000000004C60000-memory.dmpFilesize
256KB
-
memory/1980-2251-0x00000000003A0000-0x00000000003A6000-memory.dmpFilesize
24KB
-
memory/1980-2245-0x00000000013E0000-0x000000000140E000-memory.dmpFilesize
184KB
-
memory/1980-2256-0x0000000000840000-0x0000000000880000-memory.dmpFilesize
256KB
-
memory/1980-2258-0x0000000000840000-0x0000000000880000-memory.dmpFilesize
256KB