Analysis
-
max time kernel
141s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2023 07:31
Static task
static1
Behavioral task
behavioral1
Sample
dbd31bec33edd6aa2952aa7ded847337696ab1e565ca4c592dbceb8055f32c26.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
dbd31bec33edd6aa2952aa7ded847337696ab1e565ca4c592dbceb8055f32c26.exe
Resource
win10v2004-20230220-en
General
-
Target
dbd31bec33edd6aa2952aa7ded847337696ab1e565ca4c592dbceb8055f32c26.exe
-
Size
890KB
-
MD5
108131a4e149553d7baa81e3ec477f6c
-
SHA1
1ce94c709fe4008caf036b987f017fa00a008715
-
SHA256
dbd31bec33edd6aa2952aa7ded847337696ab1e565ca4c592dbceb8055f32c26
-
SHA512
538ee826e57683cb59cbb3f52be5646267f35515fa670ad69041699f5dd0934ed92fbf3cd4a68588039aacad286623c4a325961f8ffd0144b097bf0d65bc4ce5
-
SSDEEP
12288:Yy90Bd6Lltag+8V875c36FQ86+rLvR2rRQyaNTxGPirb95Cu/frSwfprHmLfXUgM:YyL+bc+/orRK9GKfHHGwhrgXRYi0/1r
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
dork
185.161.248.73:4164
-
auth_value
e81be7d6cfb453cc812e1b4890eeadad
Signatures
-
Detects Redline Stealer samples 1 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
Processes:
resource yara_rule behavioral2/memory/3416-2318-0x0000000005900000-0x0000000005F18000-memory.dmp redline_stealer -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
p61987098.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation p61987098.exe -
Executes dropped EXE 4 IoCs
Processes:
y15898166.exep61987098.exe1.exer52056902.exepid process 5060 y15898166.exe 3652 p61987098.exe 3416 1.exe 4992 r52056902.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
dbd31bec33edd6aa2952aa7ded847337696ab1e565ca4c592dbceb8055f32c26.exey15898166.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce dbd31bec33edd6aa2952aa7ded847337696ab1e565ca4c592dbceb8055f32c26.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" dbd31bec33edd6aa2952aa7ded847337696ab1e565ca4c592dbceb8055f32c26.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce y15898166.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y15898166.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1220 3652 WerFault.exe p61987098.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
p61987098.exedescription pid process Token: SeDebugPrivilege 3652 p61987098.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
dbd31bec33edd6aa2952aa7ded847337696ab1e565ca4c592dbceb8055f32c26.exey15898166.exep61987098.exedescription pid process target process PID 648 wrote to memory of 5060 648 dbd31bec33edd6aa2952aa7ded847337696ab1e565ca4c592dbceb8055f32c26.exe y15898166.exe PID 648 wrote to memory of 5060 648 dbd31bec33edd6aa2952aa7ded847337696ab1e565ca4c592dbceb8055f32c26.exe y15898166.exe PID 648 wrote to memory of 5060 648 dbd31bec33edd6aa2952aa7ded847337696ab1e565ca4c592dbceb8055f32c26.exe y15898166.exe PID 5060 wrote to memory of 3652 5060 y15898166.exe p61987098.exe PID 5060 wrote to memory of 3652 5060 y15898166.exe p61987098.exe PID 5060 wrote to memory of 3652 5060 y15898166.exe p61987098.exe PID 3652 wrote to memory of 3416 3652 p61987098.exe 1.exe PID 3652 wrote to memory of 3416 3652 p61987098.exe 1.exe PID 3652 wrote to memory of 3416 3652 p61987098.exe 1.exe PID 5060 wrote to memory of 4992 5060 y15898166.exe r52056902.exe PID 5060 wrote to memory of 4992 5060 y15898166.exe r52056902.exe PID 5060 wrote to memory of 4992 5060 y15898166.exe r52056902.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbd31bec33edd6aa2952aa7ded847337696ab1e565ca4c592dbceb8055f32c26.exe"C:\Users\Admin\AppData\Local\Temp\dbd31bec33edd6aa2952aa7ded847337696ab1e565ca4c592dbceb8055f32c26.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y15898166.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y15898166.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p61987098.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p61987098.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 12164⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r52056902.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r52056902.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3652 -ip 36521⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y15898166.exeFilesize
589KB
MD5ea4fe1904abcca462e16f23413367979
SHA17b96e43e096bb1c42cf4c393f83ed97767920380
SHA2569ce682ccc7ab884b889c9ee6c1218f984fe452b2ccbac0eb7b0a63942c61a7d6
SHA512d6bcb3b1a78b37ff813d3c3f6499dcc6780f83d1d0a90f0f560be0fe4cb0e48dc076245574bcc09eaac28522874b2e30e82bff0ba3f7aafcecef9ac584e84c53
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y15898166.exeFilesize
589KB
MD5ea4fe1904abcca462e16f23413367979
SHA17b96e43e096bb1c42cf4c393f83ed97767920380
SHA2569ce682ccc7ab884b889c9ee6c1218f984fe452b2ccbac0eb7b0a63942c61a7d6
SHA512d6bcb3b1a78b37ff813d3c3f6499dcc6780f83d1d0a90f0f560be0fe4cb0e48dc076245574bcc09eaac28522874b2e30e82bff0ba3f7aafcecef9ac584e84c53
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p61987098.exeFilesize
530KB
MD58a95612b6249cc2f6a877ac76aab8734
SHA1dfce657069799d8288c90fec7ad980f892de8293
SHA256bb6d1a01aeb3582e370f5cd31804ea2d953411a4fcd3783681eac9ba38b1575a
SHA5126364da83ffc4911488a929bd704187dba32282b42410162bc35f320610eedfbef0a7cf0e7e040d70316fcf0e19504f18bb0c7a3c8e937487de8d12de957e0f7b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p61987098.exeFilesize
530KB
MD58a95612b6249cc2f6a877ac76aab8734
SHA1dfce657069799d8288c90fec7ad980f892de8293
SHA256bb6d1a01aeb3582e370f5cd31804ea2d953411a4fcd3783681eac9ba38b1575a
SHA5126364da83ffc4911488a929bd704187dba32282b42410162bc35f320610eedfbef0a7cf0e7e040d70316fcf0e19504f18bb0c7a3c8e937487de8d12de957e0f7b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r52056902.exeFilesize
168KB
MD512a4b1fa3b08aa347092c5720df7a407
SHA11ac5f6f4c5889bd479398e2dfc71a91926466074
SHA256c69f3b7938f1432635a0f91c0c782544f65a2515fdab8a044b3b9d79c52f46c1
SHA5122e1318017ce15538a735b61565d7ad33a3dbb03f8eecf881f94bef41e2c67f2c69ffa583b15c6e21901eb62a95c499b809718de6d0caee2e8cef9f6c08d4d2fe
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r52056902.exeFilesize
168KB
MD512a4b1fa3b08aa347092c5720df7a407
SHA11ac5f6f4c5889bd479398e2dfc71a91926466074
SHA256c69f3b7938f1432635a0f91c0c782544f65a2515fdab8a044b3b9d79c52f46c1
SHA5122e1318017ce15538a735b61565d7ad33a3dbb03f8eecf881f94bef41e2c67f2c69ffa583b15c6e21901eb62a95c499b809718de6d0caee2e8cef9f6c08d4d2fe
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
memory/3416-2321-0x0000000005320000-0x000000000535C000-memory.dmpFilesize
240KB
-
memory/3416-2319-0x00000000053F0000-0x00000000054FA000-memory.dmpFilesize
1.0MB
-
memory/3416-2318-0x0000000005900000-0x0000000005F18000-memory.dmpFilesize
6.1MB
-
memory/3416-2317-0x0000000000970000-0x000000000099E000-memory.dmpFilesize
184KB
-
memory/3416-2320-0x00000000052B0000-0x00000000052C2000-memory.dmpFilesize
72KB
-
memory/3416-2322-0x00000000052D0000-0x00000000052E0000-memory.dmpFilesize
64KB
-
memory/3416-2329-0x00000000052D0000-0x00000000052E0000-memory.dmpFilesize
64KB
-
memory/3652-163-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/3652-207-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/3652-167-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/3652-171-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/3652-173-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/3652-175-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/3652-177-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/3652-179-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/3652-183-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/3652-181-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/3652-185-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/3652-187-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/3652-189-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/3652-191-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/3652-193-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/3652-195-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/3652-197-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/3652-199-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/3652-201-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/3652-203-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/3652-205-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/3652-169-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/3652-209-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/3652-211-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/3652-213-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/3652-215-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/3652-217-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/3652-1522-0x0000000005140000-0x0000000005150000-memory.dmpFilesize
64KB
-
memory/3652-1524-0x0000000005140000-0x0000000005150000-memory.dmpFilesize
64KB
-
memory/3652-165-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/3652-161-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/3652-159-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/3652-157-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/3652-156-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/3652-155-0x0000000005150000-0x00000000056F4000-memory.dmpFilesize
5.6MB
-
memory/3652-153-0x0000000005140000-0x0000000005150000-memory.dmpFilesize
64KB
-
memory/3652-152-0x0000000005140000-0x0000000005150000-memory.dmpFilesize
64KB
-
memory/3652-151-0x0000000005140000-0x0000000005150000-memory.dmpFilesize
64KB
-
memory/3652-150-0x0000000000400000-0x0000000000A95000-memory.dmpFilesize
6.6MB
-
memory/3652-149-0x0000000005140000-0x0000000005150000-memory.dmpFilesize
64KB
-
memory/3652-148-0x0000000002600000-0x000000000265B000-memory.dmpFilesize
364KB
-
memory/4992-2328-0x00000000058C0000-0x00000000058D0000-memory.dmpFilesize
64KB
-
memory/4992-2327-0x0000000000FF0000-0x0000000001020000-memory.dmpFilesize
192KB
-
memory/4992-2330-0x00000000058C0000-0x00000000058D0000-memory.dmpFilesize
64KB