Analysis
-
max time kernel
130s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
07-05-2023 07:35
Static task
static1
Behavioral task
behavioral1
Sample
ddb8175d303ed2d36480b9cd0e23b28c5afd5ecc8a8950ae8c453c20668c2bef.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
ddb8175d303ed2d36480b9cd0e23b28c5afd5ecc8a8950ae8c453c20668c2bef.exe
Resource
win10v2004-20230221-en
General
-
Target
ddb8175d303ed2d36480b9cd0e23b28c5afd5ecc8a8950ae8c453c20668c2bef.exe
-
Size
891KB
-
MD5
6a02ee6def7faffa88444d2cb0173ec6
-
SHA1
45afe19afc920cb25fe4dbb4464368007a0c0bc0
-
SHA256
ddb8175d303ed2d36480b9cd0e23b28c5afd5ecc8a8950ae8c453c20668c2bef
-
SHA512
c4c209c4a8a0ef872ae3b26dfe9e8fd593c8cef35c51edd0721ec9252ad0cc4e4f76e2339bbe6b246ba4792ab09a54664a8bf689b24cd6199f5acb2a27ce1862
-
SSDEEP
24576:LyUR2V6nyhI8PJnaPwMihsCQH96ZRsKrP91CQg+hFY:+UIVeyh/PJaPwMYJdZm8l1jF
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
dork
185.161.248.73:4164
-
auth_value
e81be7d6cfb453cc812e1b4890eeadad
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
Processes:
y77546526.exep89459289.exe1.exer88606309.exepid process 1436 y77546526.exe 468 p89459289.exe 1820 1.exe 944 r88606309.exe -
Loads dropped DLL 9 IoCs
Processes:
ddb8175d303ed2d36480b9cd0e23b28c5afd5ecc8a8950ae8c453c20668c2bef.exey77546526.exep89459289.exe1.exer88606309.exepid process 1484 ddb8175d303ed2d36480b9cd0e23b28c5afd5ecc8a8950ae8c453c20668c2bef.exe 1436 y77546526.exe 1436 y77546526.exe 1436 y77546526.exe 468 p89459289.exe 468 p89459289.exe 1820 1.exe 1436 y77546526.exe 944 r88606309.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
ddb8175d303ed2d36480b9cd0e23b28c5afd5ecc8a8950ae8c453c20668c2bef.exey77546526.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce ddb8175d303ed2d36480b9cd0e23b28c5afd5ecc8a8950ae8c453c20668c2bef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" ddb8175d303ed2d36480b9cd0e23b28c5afd5ecc8a8950ae8c453c20668c2bef.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce y77546526.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y77546526.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
p89459289.exedescription pid process Token: SeDebugPrivilege 468 p89459289.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
ddb8175d303ed2d36480b9cd0e23b28c5afd5ecc8a8950ae8c453c20668c2bef.exey77546526.exep89459289.exedescription pid process target process PID 1484 wrote to memory of 1436 1484 ddb8175d303ed2d36480b9cd0e23b28c5afd5ecc8a8950ae8c453c20668c2bef.exe y77546526.exe PID 1484 wrote to memory of 1436 1484 ddb8175d303ed2d36480b9cd0e23b28c5afd5ecc8a8950ae8c453c20668c2bef.exe y77546526.exe PID 1484 wrote to memory of 1436 1484 ddb8175d303ed2d36480b9cd0e23b28c5afd5ecc8a8950ae8c453c20668c2bef.exe y77546526.exe PID 1484 wrote to memory of 1436 1484 ddb8175d303ed2d36480b9cd0e23b28c5afd5ecc8a8950ae8c453c20668c2bef.exe y77546526.exe PID 1484 wrote to memory of 1436 1484 ddb8175d303ed2d36480b9cd0e23b28c5afd5ecc8a8950ae8c453c20668c2bef.exe y77546526.exe PID 1484 wrote to memory of 1436 1484 ddb8175d303ed2d36480b9cd0e23b28c5afd5ecc8a8950ae8c453c20668c2bef.exe y77546526.exe PID 1484 wrote to memory of 1436 1484 ddb8175d303ed2d36480b9cd0e23b28c5afd5ecc8a8950ae8c453c20668c2bef.exe y77546526.exe PID 1436 wrote to memory of 468 1436 y77546526.exe p89459289.exe PID 1436 wrote to memory of 468 1436 y77546526.exe p89459289.exe PID 1436 wrote to memory of 468 1436 y77546526.exe p89459289.exe PID 1436 wrote to memory of 468 1436 y77546526.exe p89459289.exe PID 1436 wrote to memory of 468 1436 y77546526.exe p89459289.exe PID 1436 wrote to memory of 468 1436 y77546526.exe p89459289.exe PID 1436 wrote to memory of 468 1436 y77546526.exe p89459289.exe PID 468 wrote to memory of 1820 468 p89459289.exe 1.exe PID 468 wrote to memory of 1820 468 p89459289.exe 1.exe PID 468 wrote to memory of 1820 468 p89459289.exe 1.exe PID 468 wrote to memory of 1820 468 p89459289.exe 1.exe PID 468 wrote to memory of 1820 468 p89459289.exe 1.exe PID 468 wrote to memory of 1820 468 p89459289.exe 1.exe PID 468 wrote to memory of 1820 468 p89459289.exe 1.exe PID 1436 wrote to memory of 944 1436 y77546526.exe r88606309.exe PID 1436 wrote to memory of 944 1436 y77546526.exe r88606309.exe PID 1436 wrote to memory of 944 1436 y77546526.exe r88606309.exe PID 1436 wrote to memory of 944 1436 y77546526.exe r88606309.exe PID 1436 wrote to memory of 944 1436 y77546526.exe r88606309.exe PID 1436 wrote to memory of 944 1436 y77546526.exe r88606309.exe PID 1436 wrote to memory of 944 1436 y77546526.exe r88606309.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddb8175d303ed2d36480b9cd0e23b28c5afd5ecc8a8950ae8c453c20668c2bef.exe"C:\Users\Admin\AppData\Local\Temp\ddb8175d303ed2d36480b9cd0e23b28c5afd5ecc8a8950ae8c453c20668c2bef.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y77546526.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y77546526.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p89459289.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p89459289.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r88606309.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r88606309.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y77546526.exeFilesize
590KB
MD5a06fb629d078805137b4c4d7cf86d6a3
SHA18f32c5d1044ee098354c0f599e06d31f88392c7f
SHA2569c5f212d1cae061ffbbd56b2eb486542593c127dcfab38316f24b569c24cd5c9
SHA512633d8ef8fb96bb790d0e3bc0805ee76f4906b42758fa87ff143a5ad9831d178e0d0ef49a4e60e41c198bab50dbdfada650f39b77fc4ddc03b8ac86ec4d748ccc
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y77546526.exeFilesize
590KB
MD5a06fb629d078805137b4c4d7cf86d6a3
SHA18f32c5d1044ee098354c0f599e06d31f88392c7f
SHA2569c5f212d1cae061ffbbd56b2eb486542593c127dcfab38316f24b569c24cd5c9
SHA512633d8ef8fb96bb790d0e3bc0805ee76f4906b42758fa87ff143a5ad9831d178e0d0ef49a4e60e41c198bab50dbdfada650f39b77fc4ddc03b8ac86ec4d748ccc
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p89459289.exeFilesize
530KB
MD5502e4fab6f2f199e48a52bdcbd07d803
SHA191c16825080f204d45d91ba456313df95c073063
SHA256da96334e73233a677659446d987b96933655a8c54e4009a84256afacde700e5a
SHA5125279b4bfb1fc0f6ae5c229510a5eae813904c3b9ab81b3d99c7cc915626faa9202d3c7e9f548696f3c19c506a74071292e5cfab7eeed0dc8925effd285ff85af
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p89459289.exeFilesize
530KB
MD5502e4fab6f2f199e48a52bdcbd07d803
SHA191c16825080f204d45d91ba456313df95c073063
SHA256da96334e73233a677659446d987b96933655a8c54e4009a84256afacde700e5a
SHA5125279b4bfb1fc0f6ae5c229510a5eae813904c3b9ab81b3d99c7cc915626faa9202d3c7e9f548696f3c19c506a74071292e5cfab7eeed0dc8925effd285ff85af
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p89459289.exeFilesize
530KB
MD5502e4fab6f2f199e48a52bdcbd07d803
SHA191c16825080f204d45d91ba456313df95c073063
SHA256da96334e73233a677659446d987b96933655a8c54e4009a84256afacde700e5a
SHA5125279b4bfb1fc0f6ae5c229510a5eae813904c3b9ab81b3d99c7cc915626faa9202d3c7e9f548696f3c19c506a74071292e5cfab7eeed0dc8925effd285ff85af
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r88606309.exeFilesize
168KB
MD5f7681c7cccd518880082f56e9f7a9965
SHA1a25809e268e78c93cff85c5a8b5369a6d37b238a
SHA256d6b2d8a22711058e4e325765e6e34cad66e7726d95a2f3d027aa778c494a1ec8
SHA512ed18067db1a9e92fc6c67ec205d9d2377a5c861b007cd08236b8fe788884c42677040235dfe243df3e5c5a66a7a55e4a4edf4842501c06dc1179822a080109af
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r88606309.exeFilesize
168KB
MD5f7681c7cccd518880082f56e9f7a9965
SHA1a25809e268e78c93cff85c5a8b5369a6d37b238a
SHA256d6b2d8a22711058e4e325765e6e34cad66e7726d95a2f3d027aa778c494a1ec8
SHA512ed18067db1a9e92fc6c67ec205d9d2377a5c861b007cd08236b8fe788884c42677040235dfe243df3e5c5a66a7a55e4a4edf4842501c06dc1179822a080109af
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\y77546526.exeFilesize
590KB
MD5a06fb629d078805137b4c4d7cf86d6a3
SHA18f32c5d1044ee098354c0f599e06d31f88392c7f
SHA2569c5f212d1cae061ffbbd56b2eb486542593c127dcfab38316f24b569c24cd5c9
SHA512633d8ef8fb96bb790d0e3bc0805ee76f4906b42758fa87ff143a5ad9831d178e0d0ef49a4e60e41c198bab50dbdfada650f39b77fc4ddc03b8ac86ec4d748ccc
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\y77546526.exeFilesize
590KB
MD5a06fb629d078805137b4c4d7cf86d6a3
SHA18f32c5d1044ee098354c0f599e06d31f88392c7f
SHA2569c5f212d1cae061ffbbd56b2eb486542593c127dcfab38316f24b569c24cd5c9
SHA512633d8ef8fb96bb790d0e3bc0805ee76f4906b42758fa87ff143a5ad9831d178e0d0ef49a4e60e41c198bab50dbdfada650f39b77fc4ddc03b8ac86ec4d748ccc
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\p89459289.exeFilesize
530KB
MD5502e4fab6f2f199e48a52bdcbd07d803
SHA191c16825080f204d45d91ba456313df95c073063
SHA256da96334e73233a677659446d987b96933655a8c54e4009a84256afacde700e5a
SHA5125279b4bfb1fc0f6ae5c229510a5eae813904c3b9ab81b3d99c7cc915626faa9202d3c7e9f548696f3c19c506a74071292e5cfab7eeed0dc8925effd285ff85af
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\p89459289.exeFilesize
530KB
MD5502e4fab6f2f199e48a52bdcbd07d803
SHA191c16825080f204d45d91ba456313df95c073063
SHA256da96334e73233a677659446d987b96933655a8c54e4009a84256afacde700e5a
SHA5125279b4bfb1fc0f6ae5c229510a5eae813904c3b9ab81b3d99c7cc915626faa9202d3c7e9f548696f3c19c506a74071292e5cfab7eeed0dc8925effd285ff85af
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\p89459289.exeFilesize
530KB
MD5502e4fab6f2f199e48a52bdcbd07d803
SHA191c16825080f204d45d91ba456313df95c073063
SHA256da96334e73233a677659446d987b96933655a8c54e4009a84256afacde700e5a
SHA5125279b4bfb1fc0f6ae5c229510a5eae813904c3b9ab81b3d99c7cc915626faa9202d3c7e9f548696f3c19c506a74071292e5cfab7eeed0dc8925effd285ff85af
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\r88606309.exeFilesize
168KB
MD5f7681c7cccd518880082f56e9f7a9965
SHA1a25809e268e78c93cff85c5a8b5369a6d37b238a
SHA256d6b2d8a22711058e4e325765e6e34cad66e7726d95a2f3d027aa778c494a1ec8
SHA512ed18067db1a9e92fc6c67ec205d9d2377a5c861b007cd08236b8fe788884c42677040235dfe243df3e5c5a66a7a55e4a4edf4842501c06dc1179822a080109af
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\r88606309.exeFilesize
168KB
MD5f7681c7cccd518880082f56e9f7a9965
SHA1a25809e268e78c93cff85c5a8b5369a6d37b238a
SHA256d6b2d8a22711058e4e325765e6e34cad66e7726d95a2f3d027aa778c494a1ec8
SHA512ed18067db1a9e92fc6c67ec205d9d2377a5c861b007cd08236b8fe788884c42677040235dfe243df3e5c5a66a7a55e4a4edf4842501c06dc1179822a080109af
-
\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
memory/468-121-0x0000000000E80000-0x0000000000EE0000-memory.dmpFilesize
384KB
-
memory/468-147-0x0000000000E80000-0x0000000000EE0000-memory.dmpFilesize
384KB
-
memory/468-93-0x0000000000E80000-0x0000000000EE0000-memory.dmpFilesize
384KB
-
memory/468-95-0x0000000000E80000-0x0000000000EE0000-memory.dmpFilesize
384KB
-
memory/468-97-0x0000000000E80000-0x0000000000EE0000-memory.dmpFilesize
384KB
-
memory/468-99-0x0000000000E80000-0x0000000000EE0000-memory.dmpFilesize
384KB
-
memory/468-103-0x0000000000E80000-0x0000000000EE0000-memory.dmpFilesize
384KB
-
memory/468-101-0x0000000000E80000-0x0000000000EE0000-memory.dmpFilesize
384KB
-
memory/468-105-0x0000000000E80000-0x0000000000EE0000-memory.dmpFilesize
384KB
-
memory/468-107-0x0000000000E80000-0x0000000000EE0000-memory.dmpFilesize
384KB
-
memory/468-113-0x0000000000E80000-0x0000000000EE0000-memory.dmpFilesize
384KB
-
memory/468-111-0x0000000000E80000-0x0000000000EE0000-memory.dmpFilesize
384KB
-
memory/468-115-0x0000000000E80000-0x0000000000EE0000-memory.dmpFilesize
384KB
-
memory/468-119-0x0000000000E80000-0x0000000000EE0000-memory.dmpFilesize
384KB
-
memory/468-91-0x0000000000E80000-0x0000000000EE0000-memory.dmpFilesize
384KB
-
memory/468-125-0x0000000000E80000-0x0000000000EE0000-memory.dmpFilesize
384KB
-
memory/468-124-0x0000000005150000-0x0000000005190000-memory.dmpFilesize
256KB
-
memory/468-129-0x0000000000E80000-0x0000000000EE0000-memory.dmpFilesize
384KB
-
memory/468-131-0x0000000000E80000-0x0000000000EE0000-memory.dmpFilesize
384KB
-
memory/468-135-0x0000000000E80000-0x0000000000EE0000-memory.dmpFilesize
384KB
-
memory/468-137-0x0000000000E80000-0x0000000000EE0000-memory.dmpFilesize
384KB
-
memory/468-133-0x0000000000E80000-0x0000000000EE0000-memory.dmpFilesize
384KB
-
memory/468-139-0x0000000000E80000-0x0000000000EE0000-memory.dmpFilesize
384KB
-
memory/468-141-0x0000000000E80000-0x0000000000EE0000-memory.dmpFilesize
384KB
-
memory/468-143-0x0000000000E80000-0x0000000000EE0000-memory.dmpFilesize
384KB
-
memory/468-89-0x0000000000E80000-0x0000000000EE0000-memory.dmpFilesize
384KB
-
memory/468-145-0x0000000000E80000-0x0000000000EE0000-memory.dmpFilesize
384KB
-
memory/468-127-0x0000000000E80000-0x0000000000EE0000-memory.dmpFilesize
384KB
-
memory/468-123-0x0000000005150000-0x0000000005190000-memory.dmpFilesize
256KB
-
memory/468-117-0x0000000000E80000-0x0000000000EE0000-memory.dmpFilesize
384KB
-
memory/468-109-0x0000000000E80000-0x0000000000EE0000-memory.dmpFilesize
384KB
-
memory/468-2231-0x0000000005150000-0x0000000005190000-memory.dmpFilesize
256KB
-
memory/468-2232-0x0000000001110000-0x0000000001142000-memory.dmpFilesize
200KB
-
memory/468-87-0x0000000000E80000-0x0000000000EE0000-memory.dmpFilesize
384KB
-
memory/468-85-0x0000000000E80000-0x0000000000EE0000-memory.dmpFilesize
384KB
-
memory/468-83-0x0000000000E80000-0x0000000000EE0000-memory.dmpFilesize
384KB
-
memory/468-82-0x0000000000E80000-0x0000000000EE0000-memory.dmpFilesize
384KB
-
memory/468-78-0x00000000028E0000-0x0000000002948000-memory.dmpFilesize
416KB
-
memory/468-81-0x0000000000E80000-0x0000000000EE6000-memory.dmpFilesize
408KB
-
memory/468-80-0x0000000005150000-0x0000000005190000-memory.dmpFilesize
256KB
-
memory/468-79-0x0000000000280000-0x00000000002DB000-memory.dmpFilesize
364KB
-
memory/944-2250-0x0000000000390000-0x00000000003C0000-memory.dmpFilesize
192KB
-
memory/944-2251-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/944-2253-0x0000000004BF0000-0x0000000004C30000-memory.dmpFilesize
256KB
-
memory/944-2255-0x0000000004BF0000-0x0000000004C30000-memory.dmpFilesize
256KB
-
memory/1820-2249-0x00000000005F0000-0x00000000005F6000-memory.dmpFilesize
24KB
-
memory/1820-2242-0x0000000001060000-0x000000000108E000-memory.dmpFilesize
184KB
-
memory/1820-2252-0x0000000000660000-0x00000000006A0000-memory.dmpFilesize
256KB
-
memory/1820-2254-0x0000000000660000-0x00000000006A0000-memory.dmpFilesize
256KB