Analysis
-
max time kernel
150s -
max time network
208s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2023 07:34
Static task
static1
Behavioral task
behavioral1
Sample
dcf65c2cf0babcb76d18cf50624b855e1ed50ff085bb3d44f0f0494577c41ff7.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
dcf65c2cf0babcb76d18cf50624b855e1ed50ff085bb3d44f0f0494577c41ff7.exe
Resource
win10v2004-20230220-en
General
-
Target
dcf65c2cf0babcb76d18cf50624b855e1ed50ff085bb3d44f0f0494577c41ff7.exe
-
Size
793KB
-
MD5
2268a4562404b7c1933826775aa3c222
-
SHA1
3ca41707b561552de974691010e19d22ce46d524
-
SHA256
dcf65c2cf0babcb76d18cf50624b855e1ed50ff085bb3d44f0f0494577c41ff7
-
SHA512
c9dc903b3a385ccad9670255d1331cf42b662a01891f886ebafbd74fbb73030dc8ebca3c846353233abe05cf6ad47e3df0c75820187dd214d3e0b56d1cf6d4a1
-
SSDEEP
24576:ZydHh9dN21nvRYeKha0DOP8+cXhWb+T0qC:MdHJY1v30OPTcXk+TL
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
dante
185.161.248.73:4164
-
auth_value
f4066af6b8a6f23125c8ee48288a3f90
Signatures
-
Detects Redline Stealer samples 1 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
Processes:
resource yara_rule behavioral2/memory/4188-2322-0x0000000005BF0000-0x0000000006208000-memory.dmp redline_stealer -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
m99987968.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation m99987968.exe -
Executes dropped EXE 4 IoCs
Processes:
x47385169.exem99987968.exe1.exen31242500.exepid process 3432 x47385169.exe 2768 m99987968.exe 4188 1.exe 2628 n31242500.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
dcf65c2cf0babcb76d18cf50624b855e1ed50ff085bb3d44f0f0494577c41ff7.exex47385169.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" dcf65c2cf0babcb76d18cf50624b855e1ed50ff085bb3d44f0f0494577c41ff7.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce x47385169.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x47385169.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce dcf65c2cf0babcb76d18cf50624b855e1ed50ff085bb3d44f0f0494577c41ff7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3580 2768 WerFault.exe m99987968.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
m99987968.exedescription pid process Token: SeDebugPrivilege 2768 m99987968.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
dcf65c2cf0babcb76d18cf50624b855e1ed50ff085bb3d44f0f0494577c41ff7.exex47385169.exem99987968.exedescription pid process target process PID 3160 wrote to memory of 3432 3160 dcf65c2cf0babcb76d18cf50624b855e1ed50ff085bb3d44f0f0494577c41ff7.exe x47385169.exe PID 3160 wrote to memory of 3432 3160 dcf65c2cf0babcb76d18cf50624b855e1ed50ff085bb3d44f0f0494577c41ff7.exe x47385169.exe PID 3160 wrote to memory of 3432 3160 dcf65c2cf0babcb76d18cf50624b855e1ed50ff085bb3d44f0f0494577c41ff7.exe x47385169.exe PID 3432 wrote to memory of 2768 3432 x47385169.exe m99987968.exe PID 3432 wrote to memory of 2768 3432 x47385169.exe m99987968.exe PID 3432 wrote to memory of 2768 3432 x47385169.exe m99987968.exe PID 2768 wrote to memory of 4188 2768 m99987968.exe 1.exe PID 2768 wrote to memory of 4188 2768 m99987968.exe 1.exe PID 2768 wrote to memory of 4188 2768 m99987968.exe 1.exe PID 3432 wrote to memory of 2628 3432 x47385169.exe n31242500.exe PID 3432 wrote to memory of 2628 3432 x47385169.exe n31242500.exe PID 3432 wrote to memory of 2628 3432 x47385169.exe n31242500.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dcf65c2cf0babcb76d18cf50624b855e1ed50ff085bb3d44f0f0494577c41ff7.exe"C:\Users\Admin\AppData\Local\Temp\dcf65c2cf0babcb76d18cf50624b855e1ed50ff085bb3d44f0f0494577c41ff7.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x47385169.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x47385169.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m99987968.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m99987968.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 13724⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n31242500.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n31242500.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2768 -ip 27681⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x47385169.exeFilesize
589KB
MD5771bf92802432ba741cd994731779d5a
SHA196344b132338ff45a83e30f5e8af88c752cab397
SHA2569b1172de72a161700019c788c2b65bd7fd1a8be1be59ea0136b8080b9f50e2dc
SHA512785f304dea5398478137d49512ff1bd2bae964d23dfdcdcc3bda946a57839d2dcae6585f62efb59f741c8a67d765559a8fa46b28e15650756c6a94a4a89c2634
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x47385169.exeFilesize
589KB
MD5771bf92802432ba741cd994731779d5a
SHA196344b132338ff45a83e30f5e8af88c752cab397
SHA2569b1172de72a161700019c788c2b65bd7fd1a8be1be59ea0136b8080b9f50e2dc
SHA512785f304dea5398478137d49512ff1bd2bae964d23dfdcdcc3bda946a57839d2dcae6585f62efb59f741c8a67d765559a8fa46b28e15650756c6a94a4a89c2634
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m99987968.exeFilesize
530KB
MD5d4fe896f57e55d601a5b34f537c1aef9
SHA1ada72fe2ee1c96113b2c9804c90afb647fc81a71
SHA25661e3e56f0c89f9f7ae8f4f82d7b6f194dea23b00d38e91fb3defc0643a1affe2
SHA512115d954431b362f663aa6ff71a79dfe80360c2b70abc08cd8afafb0406417411d0f42d9911758bc707dd9200210a004cbe3adbd724ab05aa7a6bd84307ab0330
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m99987968.exeFilesize
530KB
MD5d4fe896f57e55d601a5b34f537c1aef9
SHA1ada72fe2ee1c96113b2c9804c90afb647fc81a71
SHA25661e3e56f0c89f9f7ae8f4f82d7b6f194dea23b00d38e91fb3defc0643a1affe2
SHA512115d954431b362f663aa6ff71a79dfe80360c2b70abc08cd8afafb0406417411d0f42d9911758bc707dd9200210a004cbe3adbd724ab05aa7a6bd84307ab0330
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n31242500.exeFilesize
168KB
MD5f8cc0efeed85cfb6e14e11cfc96bc2f4
SHA1f622555e30e0ce07f5f78ff0c6a6e101ca2a8272
SHA256353e0330b6a17e485708c5bec59170eef1a26da04f4d4f2c269fc677232e7dea
SHA51278515b830a6b72e03f91a0eeca95d812a21bf2ecd29f6af0408382c2719794e89a84aaa68a916b94d705839655685735f1b0ffcd3e1c87394071a192d1b123ba
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n31242500.exeFilesize
168KB
MD5f8cc0efeed85cfb6e14e11cfc96bc2f4
SHA1f622555e30e0ce07f5f78ff0c6a6e101ca2a8272
SHA256353e0330b6a17e485708c5bec59170eef1a26da04f4d4f2c269fc677232e7dea
SHA51278515b830a6b72e03f91a0eeca95d812a21bf2ecd29f6af0408382c2719794e89a84aaa68a916b94d705839655685735f1b0ffcd3e1c87394071a192d1b123ba
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
memory/2628-2334-0x00000000051A0000-0x00000000051B0000-memory.dmpFilesize
64KB
-
memory/2628-2332-0x00000000051A0000-0x00000000051B0000-memory.dmpFilesize
64KB
-
memory/2628-2331-0x0000000000940000-0x0000000000970000-memory.dmpFilesize
192KB
-
memory/2768-164-0x0000000005810000-0x0000000005870000-memory.dmpFilesize
384KB
-
memory/2768-208-0x0000000005810000-0x0000000005870000-memory.dmpFilesize
384KB
-
memory/2768-162-0x0000000005810000-0x0000000005870000-memory.dmpFilesize
384KB
-
memory/2768-158-0x0000000005810000-0x0000000005870000-memory.dmpFilesize
384KB
-
memory/2768-166-0x0000000005810000-0x0000000005870000-memory.dmpFilesize
384KB
-
memory/2768-168-0x0000000005810000-0x0000000005870000-memory.dmpFilesize
384KB
-
memory/2768-170-0x0000000005810000-0x0000000005870000-memory.dmpFilesize
384KB
-
memory/2768-172-0x0000000005810000-0x0000000005870000-memory.dmpFilesize
384KB
-
memory/2768-174-0x0000000005810000-0x0000000005870000-memory.dmpFilesize
384KB
-
memory/2768-176-0x0000000005810000-0x0000000005870000-memory.dmpFilesize
384KB
-
memory/2768-178-0x0000000005810000-0x0000000005870000-memory.dmpFilesize
384KB
-
memory/2768-180-0x0000000005810000-0x0000000005870000-memory.dmpFilesize
384KB
-
memory/2768-182-0x0000000005810000-0x0000000005870000-memory.dmpFilesize
384KB
-
memory/2768-184-0x0000000005810000-0x0000000005870000-memory.dmpFilesize
384KB
-
memory/2768-186-0x0000000005810000-0x0000000005870000-memory.dmpFilesize
384KB
-
memory/2768-188-0x0000000005810000-0x0000000005870000-memory.dmpFilesize
384KB
-
memory/2768-190-0x0000000005810000-0x0000000005870000-memory.dmpFilesize
384KB
-
memory/2768-192-0x0000000005810000-0x0000000005870000-memory.dmpFilesize
384KB
-
memory/2768-194-0x0000000005810000-0x0000000005870000-memory.dmpFilesize
384KB
-
memory/2768-196-0x0000000005810000-0x0000000005870000-memory.dmpFilesize
384KB
-
memory/2768-198-0x0000000005810000-0x0000000005870000-memory.dmpFilesize
384KB
-
memory/2768-200-0x0000000005810000-0x0000000005870000-memory.dmpFilesize
384KB
-
memory/2768-206-0x0000000005810000-0x0000000005870000-memory.dmpFilesize
384KB
-
memory/2768-204-0x0000000005810000-0x0000000005870000-memory.dmpFilesize
384KB
-
memory/2768-202-0x0000000005810000-0x0000000005870000-memory.dmpFilesize
384KB
-
memory/2768-160-0x0000000005810000-0x0000000005870000-memory.dmpFilesize
384KB
-
memory/2768-210-0x0000000005810000-0x0000000005870000-memory.dmpFilesize
384KB
-
memory/2768-212-0x0000000005810000-0x0000000005870000-memory.dmpFilesize
384KB
-
memory/2768-214-0x0000000005810000-0x0000000005870000-memory.dmpFilesize
384KB
-
memory/2768-216-0x0000000005810000-0x0000000005870000-memory.dmpFilesize
384KB
-
memory/2768-2301-0x0000000002A90000-0x0000000002AA0000-memory.dmpFilesize
64KB
-
memory/2768-2302-0x0000000002A90000-0x0000000002AA0000-memory.dmpFilesize
64KB
-
memory/2768-2303-0x0000000002A90000-0x0000000002AA0000-memory.dmpFilesize
64KB
-
memory/2768-156-0x0000000005810000-0x0000000005870000-memory.dmpFilesize
384KB
-
memory/2768-154-0x0000000005810000-0x0000000005870000-memory.dmpFilesize
384KB
-
memory/2768-153-0x0000000005810000-0x0000000005870000-memory.dmpFilesize
384KB
-
memory/2768-148-0x0000000002790000-0x00000000027EB000-memory.dmpFilesize
364KB
-
memory/2768-2317-0x0000000002A90000-0x0000000002AA0000-memory.dmpFilesize
64KB
-
memory/2768-149-0x0000000002A90000-0x0000000002AA0000-memory.dmpFilesize
64KB
-
memory/2768-150-0x0000000002A90000-0x0000000002AA0000-memory.dmpFilesize
64KB
-
memory/2768-151-0x0000000002A90000-0x0000000002AA0000-memory.dmpFilesize
64KB
-
memory/2768-152-0x0000000005260000-0x0000000005804000-memory.dmpFilesize
5.6MB
-
memory/4188-2326-0x0000000005360000-0x000000000539C000-memory.dmpFilesize
240KB
-
memory/4188-2325-0x00000000052C0000-0x00000000052D0000-memory.dmpFilesize
64KB
-
memory/4188-2324-0x0000000005300000-0x0000000005312000-memory.dmpFilesize
72KB
-
memory/4188-2323-0x00000000056E0000-0x00000000057EA000-memory.dmpFilesize
1.0MB
-
memory/4188-2322-0x0000000005BF0000-0x0000000006208000-memory.dmpFilesize
6.1MB
-
memory/4188-2333-0x00000000052C0000-0x00000000052D0000-memory.dmpFilesize
64KB
-
memory/4188-2316-0x0000000000A70000-0x0000000000A9E000-memory.dmpFilesize
184KB