Analysis
-
max time kernel
194s -
max time network
276s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
07-05-2023 07:34
Static task
static1
Behavioral task
behavioral1
Sample
dcf65c2cf0babcb76d18cf50624b855e1ed50ff085bb3d44f0f0494577c41ff7.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
dcf65c2cf0babcb76d18cf50624b855e1ed50ff085bb3d44f0f0494577c41ff7.exe
Resource
win10v2004-20230220-en
General
-
Target
dcf65c2cf0babcb76d18cf50624b855e1ed50ff085bb3d44f0f0494577c41ff7.exe
-
Size
793KB
-
MD5
2268a4562404b7c1933826775aa3c222
-
SHA1
3ca41707b561552de974691010e19d22ce46d524
-
SHA256
dcf65c2cf0babcb76d18cf50624b855e1ed50ff085bb3d44f0f0494577c41ff7
-
SHA512
c9dc903b3a385ccad9670255d1331cf42b662a01891f886ebafbd74fbb73030dc8ebca3c846353233abe05cf6ad47e3df0c75820187dd214d3e0b56d1cf6d4a1
-
SSDEEP
24576:ZydHh9dN21nvRYeKha0DOP8+cXhWb+T0qC:MdHJY1v30OPTcXk+TL
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
dante
185.161.248.73:4164
-
auth_value
f4066af6b8a6f23125c8ee48288a3f90
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
Processes:
x47385169.exem99987968.exe1.exen31242500.exepid process 1268 x47385169.exe 684 m99987968.exe 1852 1.exe 1312 n31242500.exe -
Loads dropped DLL 9 IoCs
Processes:
dcf65c2cf0babcb76d18cf50624b855e1ed50ff085bb3d44f0f0494577c41ff7.exex47385169.exem99987968.exe1.exen31242500.exepid process 904 dcf65c2cf0babcb76d18cf50624b855e1ed50ff085bb3d44f0f0494577c41ff7.exe 1268 x47385169.exe 1268 x47385169.exe 1268 x47385169.exe 684 m99987968.exe 684 m99987968.exe 1852 1.exe 1268 x47385169.exe 1312 n31242500.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
dcf65c2cf0babcb76d18cf50624b855e1ed50ff085bb3d44f0f0494577c41ff7.exex47385169.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce dcf65c2cf0babcb76d18cf50624b855e1ed50ff085bb3d44f0f0494577c41ff7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" dcf65c2cf0babcb76d18cf50624b855e1ed50ff085bb3d44f0f0494577c41ff7.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce x47385169.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x47385169.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
m99987968.exedescription pid process Token: SeDebugPrivilege 684 m99987968.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
dcf65c2cf0babcb76d18cf50624b855e1ed50ff085bb3d44f0f0494577c41ff7.exex47385169.exem99987968.exedescription pid process target process PID 904 wrote to memory of 1268 904 dcf65c2cf0babcb76d18cf50624b855e1ed50ff085bb3d44f0f0494577c41ff7.exe x47385169.exe PID 904 wrote to memory of 1268 904 dcf65c2cf0babcb76d18cf50624b855e1ed50ff085bb3d44f0f0494577c41ff7.exe x47385169.exe PID 904 wrote to memory of 1268 904 dcf65c2cf0babcb76d18cf50624b855e1ed50ff085bb3d44f0f0494577c41ff7.exe x47385169.exe PID 904 wrote to memory of 1268 904 dcf65c2cf0babcb76d18cf50624b855e1ed50ff085bb3d44f0f0494577c41ff7.exe x47385169.exe PID 904 wrote to memory of 1268 904 dcf65c2cf0babcb76d18cf50624b855e1ed50ff085bb3d44f0f0494577c41ff7.exe x47385169.exe PID 904 wrote to memory of 1268 904 dcf65c2cf0babcb76d18cf50624b855e1ed50ff085bb3d44f0f0494577c41ff7.exe x47385169.exe PID 904 wrote to memory of 1268 904 dcf65c2cf0babcb76d18cf50624b855e1ed50ff085bb3d44f0f0494577c41ff7.exe x47385169.exe PID 1268 wrote to memory of 684 1268 x47385169.exe m99987968.exe PID 1268 wrote to memory of 684 1268 x47385169.exe m99987968.exe PID 1268 wrote to memory of 684 1268 x47385169.exe m99987968.exe PID 1268 wrote to memory of 684 1268 x47385169.exe m99987968.exe PID 1268 wrote to memory of 684 1268 x47385169.exe m99987968.exe PID 1268 wrote to memory of 684 1268 x47385169.exe m99987968.exe PID 1268 wrote to memory of 684 1268 x47385169.exe m99987968.exe PID 684 wrote to memory of 1852 684 m99987968.exe 1.exe PID 684 wrote to memory of 1852 684 m99987968.exe 1.exe PID 684 wrote to memory of 1852 684 m99987968.exe 1.exe PID 684 wrote to memory of 1852 684 m99987968.exe 1.exe PID 684 wrote to memory of 1852 684 m99987968.exe 1.exe PID 684 wrote to memory of 1852 684 m99987968.exe 1.exe PID 684 wrote to memory of 1852 684 m99987968.exe 1.exe PID 1268 wrote to memory of 1312 1268 x47385169.exe n31242500.exe PID 1268 wrote to memory of 1312 1268 x47385169.exe n31242500.exe PID 1268 wrote to memory of 1312 1268 x47385169.exe n31242500.exe PID 1268 wrote to memory of 1312 1268 x47385169.exe n31242500.exe PID 1268 wrote to memory of 1312 1268 x47385169.exe n31242500.exe PID 1268 wrote to memory of 1312 1268 x47385169.exe n31242500.exe PID 1268 wrote to memory of 1312 1268 x47385169.exe n31242500.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dcf65c2cf0babcb76d18cf50624b855e1ed50ff085bb3d44f0f0494577c41ff7.exe"C:\Users\Admin\AppData\Local\Temp\dcf65c2cf0babcb76d18cf50624b855e1ed50ff085bb3d44f0f0494577c41ff7.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x47385169.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x47385169.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m99987968.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m99987968.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n31242500.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n31242500.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x47385169.exeFilesize
589KB
MD5771bf92802432ba741cd994731779d5a
SHA196344b132338ff45a83e30f5e8af88c752cab397
SHA2569b1172de72a161700019c788c2b65bd7fd1a8be1be59ea0136b8080b9f50e2dc
SHA512785f304dea5398478137d49512ff1bd2bae964d23dfdcdcc3bda946a57839d2dcae6585f62efb59f741c8a67d765559a8fa46b28e15650756c6a94a4a89c2634
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x47385169.exeFilesize
589KB
MD5771bf92802432ba741cd994731779d5a
SHA196344b132338ff45a83e30f5e8af88c752cab397
SHA2569b1172de72a161700019c788c2b65bd7fd1a8be1be59ea0136b8080b9f50e2dc
SHA512785f304dea5398478137d49512ff1bd2bae964d23dfdcdcc3bda946a57839d2dcae6585f62efb59f741c8a67d765559a8fa46b28e15650756c6a94a4a89c2634
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m99987968.exeFilesize
530KB
MD5d4fe896f57e55d601a5b34f537c1aef9
SHA1ada72fe2ee1c96113b2c9804c90afb647fc81a71
SHA25661e3e56f0c89f9f7ae8f4f82d7b6f194dea23b00d38e91fb3defc0643a1affe2
SHA512115d954431b362f663aa6ff71a79dfe80360c2b70abc08cd8afafb0406417411d0f42d9911758bc707dd9200210a004cbe3adbd724ab05aa7a6bd84307ab0330
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m99987968.exeFilesize
530KB
MD5d4fe896f57e55d601a5b34f537c1aef9
SHA1ada72fe2ee1c96113b2c9804c90afb647fc81a71
SHA25661e3e56f0c89f9f7ae8f4f82d7b6f194dea23b00d38e91fb3defc0643a1affe2
SHA512115d954431b362f663aa6ff71a79dfe80360c2b70abc08cd8afafb0406417411d0f42d9911758bc707dd9200210a004cbe3adbd724ab05aa7a6bd84307ab0330
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m99987968.exeFilesize
530KB
MD5d4fe896f57e55d601a5b34f537c1aef9
SHA1ada72fe2ee1c96113b2c9804c90afb647fc81a71
SHA25661e3e56f0c89f9f7ae8f4f82d7b6f194dea23b00d38e91fb3defc0643a1affe2
SHA512115d954431b362f663aa6ff71a79dfe80360c2b70abc08cd8afafb0406417411d0f42d9911758bc707dd9200210a004cbe3adbd724ab05aa7a6bd84307ab0330
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n31242500.exeFilesize
168KB
MD5f8cc0efeed85cfb6e14e11cfc96bc2f4
SHA1f622555e30e0ce07f5f78ff0c6a6e101ca2a8272
SHA256353e0330b6a17e485708c5bec59170eef1a26da04f4d4f2c269fc677232e7dea
SHA51278515b830a6b72e03f91a0eeca95d812a21bf2ecd29f6af0408382c2719794e89a84aaa68a916b94d705839655685735f1b0ffcd3e1c87394071a192d1b123ba
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n31242500.exeFilesize
168KB
MD5f8cc0efeed85cfb6e14e11cfc96bc2f4
SHA1f622555e30e0ce07f5f78ff0c6a6e101ca2a8272
SHA256353e0330b6a17e485708c5bec59170eef1a26da04f4d4f2c269fc677232e7dea
SHA51278515b830a6b72e03f91a0eeca95d812a21bf2ecd29f6af0408382c2719794e89a84aaa68a916b94d705839655685735f1b0ffcd3e1c87394071a192d1b123ba
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\x47385169.exeFilesize
589KB
MD5771bf92802432ba741cd994731779d5a
SHA196344b132338ff45a83e30f5e8af88c752cab397
SHA2569b1172de72a161700019c788c2b65bd7fd1a8be1be59ea0136b8080b9f50e2dc
SHA512785f304dea5398478137d49512ff1bd2bae964d23dfdcdcc3bda946a57839d2dcae6585f62efb59f741c8a67d765559a8fa46b28e15650756c6a94a4a89c2634
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\x47385169.exeFilesize
589KB
MD5771bf92802432ba741cd994731779d5a
SHA196344b132338ff45a83e30f5e8af88c752cab397
SHA2569b1172de72a161700019c788c2b65bd7fd1a8be1be59ea0136b8080b9f50e2dc
SHA512785f304dea5398478137d49512ff1bd2bae964d23dfdcdcc3bda946a57839d2dcae6585f62efb59f741c8a67d765559a8fa46b28e15650756c6a94a4a89c2634
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\m99987968.exeFilesize
530KB
MD5d4fe896f57e55d601a5b34f537c1aef9
SHA1ada72fe2ee1c96113b2c9804c90afb647fc81a71
SHA25661e3e56f0c89f9f7ae8f4f82d7b6f194dea23b00d38e91fb3defc0643a1affe2
SHA512115d954431b362f663aa6ff71a79dfe80360c2b70abc08cd8afafb0406417411d0f42d9911758bc707dd9200210a004cbe3adbd724ab05aa7a6bd84307ab0330
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\m99987968.exeFilesize
530KB
MD5d4fe896f57e55d601a5b34f537c1aef9
SHA1ada72fe2ee1c96113b2c9804c90afb647fc81a71
SHA25661e3e56f0c89f9f7ae8f4f82d7b6f194dea23b00d38e91fb3defc0643a1affe2
SHA512115d954431b362f663aa6ff71a79dfe80360c2b70abc08cd8afafb0406417411d0f42d9911758bc707dd9200210a004cbe3adbd724ab05aa7a6bd84307ab0330
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\m99987968.exeFilesize
530KB
MD5d4fe896f57e55d601a5b34f537c1aef9
SHA1ada72fe2ee1c96113b2c9804c90afb647fc81a71
SHA25661e3e56f0c89f9f7ae8f4f82d7b6f194dea23b00d38e91fb3defc0643a1affe2
SHA512115d954431b362f663aa6ff71a79dfe80360c2b70abc08cd8afafb0406417411d0f42d9911758bc707dd9200210a004cbe3adbd724ab05aa7a6bd84307ab0330
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\n31242500.exeFilesize
168KB
MD5f8cc0efeed85cfb6e14e11cfc96bc2f4
SHA1f622555e30e0ce07f5f78ff0c6a6e101ca2a8272
SHA256353e0330b6a17e485708c5bec59170eef1a26da04f4d4f2c269fc677232e7dea
SHA51278515b830a6b72e03f91a0eeca95d812a21bf2ecd29f6af0408382c2719794e89a84aaa68a916b94d705839655685735f1b0ffcd3e1c87394071a192d1b123ba
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\n31242500.exeFilesize
168KB
MD5f8cc0efeed85cfb6e14e11cfc96bc2f4
SHA1f622555e30e0ce07f5f78ff0c6a6e101ca2a8272
SHA256353e0330b6a17e485708c5bec59170eef1a26da04f4d4f2c269fc677232e7dea
SHA51278515b830a6b72e03f91a0eeca95d812a21bf2ecd29f6af0408382c2719794e89a84aaa68a916b94d705839655685735f1b0ffcd3e1c87394071a192d1b123ba
-
\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
memory/684-121-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/684-139-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/684-91-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/684-93-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/684-95-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/684-97-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/684-99-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/684-101-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/684-103-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/684-107-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/684-105-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/684-111-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/684-113-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/684-115-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/684-117-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/684-119-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/684-87-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/684-123-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/684-125-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/684-127-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/684-129-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/684-131-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/684-133-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/684-135-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/684-137-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/684-89-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/684-141-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/684-143-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/684-145-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/684-147-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/684-109-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/684-2231-0x0000000005520000-0x0000000005552000-memory.dmpFilesize
200KB
-
memory/684-2233-0x0000000002880000-0x00000000028C0000-memory.dmpFilesize
256KB
-
memory/684-2234-0x0000000000260000-0x00000000002BB000-memory.dmpFilesize
364KB
-
memory/684-85-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/684-84-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/684-83-0x0000000002880000-0x00000000028C0000-memory.dmpFilesize
256KB
-
memory/684-82-0x0000000002880000-0x00000000028C0000-memory.dmpFilesize
256KB
-
memory/684-81-0x0000000002880000-0x00000000028C0000-memory.dmpFilesize
256KB
-
memory/684-78-0x0000000000260000-0x00000000002BB000-memory.dmpFilesize
364KB
-
memory/684-80-0x00000000050B0000-0x0000000005116000-memory.dmpFilesize
408KB
-
memory/684-79-0x00000000028C0000-0x0000000002928000-memory.dmpFilesize
416KB
-
memory/1312-2252-0x00000000012D0000-0x0000000001300000-memory.dmpFilesize
192KB
-
memory/1312-2253-0x0000000000020000-0x0000000000026000-memory.dmpFilesize
24KB
-
memory/1312-2254-0x0000000004CE0000-0x0000000004D20000-memory.dmpFilesize
256KB
-
memory/1312-2256-0x0000000004CE0000-0x0000000004D20000-memory.dmpFilesize
256KB
-
memory/1852-2246-0x00000000001E0000-0x000000000020E000-memory.dmpFilesize
184KB
-
memory/1852-2251-0x0000000000210000-0x0000000000216000-memory.dmpFilesize
24KB
-
memory/1852-2255-0x0000000004D80000-0x0000000004DC0000-memory.dmpFilesize
256KB
-
memory/1852-2257-0x0000000004D80000-0x0000000004DC0000-memory.dmpFilesize
256KB