Analysis
-
max time kernel
216s -
max time network
324s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
07-05-2023 07:55
Static task
static1
Behavioral task
behavioral1
Sample
e5bf3a8567e73fcb4b53140c0c04bfa3bbbc18e8045903701e9da29e1858785b.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
e5bf3a8567e73fcb4b53140c0c04bfa3bbbc18e8045903701e9da29e1858785b.exe
Resource
win10v2004-20230220-en
General
-
Target
e5bf3a8567e73fcb4b53140c0c04bfa3bbbc18e8045903701e9da29e1858785b.exe
-
Size
851KB
-
MD5
875e072932f0fecdf3d2bd28da5df115
-
SHA1
3aa1adbb0b20f91401c8dafea890f2bf5f82fd2e
-
SHA256
e5bf3a8567e73fcb4b53140c0c04bfa3bbbc18e8045903701e9da29e1858785b
-
SHA512
d9c260916cbce5f97b8717acb7cbe09db726377aeba1b13e55fc32211d10924acda5e04566f82a1e73d1b87ad5781aebc32a2485fc655e129c79a8f42151efe0
-
SSDEEP
12288:7y90y9hku3+iJWVToParWmPISvA3C/zsaX437KvOZuWc4vdGGPHKiTQh9QN7zy90:7ytZ3v4FrWFSo3tKdB49HtTLvuMWY
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
dante
185.161.248.73:4164
-
auth_value
f4066af6b8a6f23125c8ee48288a3f90
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
Processes:
y03167197.exep15904255.exe1.exer63738273.exepid process 1880 y03167197.exe 1928 p15904255.exe 564 1.exe 1560 r63738273.exe -
Loads dropped DLL 9 IoCs
Processes:
e5bf3a8567e73fcb4b53140c0c04bfa3bbbc18e8045903701e9da29e1858785b.exey03167197.exep15904255.exe1.exer63738273.exepid process 952 e5bf3a8567e73fcb4b53140c0c04bfa3bbbc18e8045903701e9da29e1858785b.exe 1880 y03167197.exe 1880 y03167197.exe 1880 y03167197.exe 1928 p15904255.exe 1928 p15904255.exe 564 1.exe 1880 y03167197.exe 1560 r63738273.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
y03167197.exee5bf3a8567e73fcb4b53140c0c04bfa3bbbc18e8045903701e9da29e1858785b.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce y03167197.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y03167197.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce e5bf3a8567e73fcb4b53140c0c04bfa3bbbc18e8045903701e9da29e1858785b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" e5bf3a8567e73fcb4b53140c0c04bfa3bbbc18e8045903701e9da29e1858785b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
p15904255.exedescription pid process Token: SeDebugPrivilege 1928 p15904255.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
e5bf3a8567e73fcb4b53140c0c04bfa3bbbc18e8045903701e9da29e1858785b.exey03167197.exep15904255.exedescription pid process target process PID 952 wrote to memory of 1880 952 e5bf3a8567e73fcb4b53140c0c04bfa3bbbc18e8045903701e9da29e1858785b.exe y03167197.exe PID 952 wrote to memory of 1880 952 e5bf3a8567e73fcb4b53140c0c04bfa3bbbc18e8045903701e9da29e1858785b.exe y03167197.exe PID 952 wrote to memory of 1880 952 e5bf3a8567e73fcb4b53140c0c04bfa3bbbc18e8045903701e9da29e1858785b.exe y03167197.exe PID 952 wrote to memory of 1880 952 e5bf3a8567e73fcb4b53140c0c04bfa3bbbc18e8045903701e9da29e1858785b.exe y03167197.exe PID 952 wrote to memory of 1880 952 e5bf3a8567e73fcb4b53140c0c04bfa3bbbc18e8045903701e9da29e1858785b.exe y03167197.exe PID 952 wrote to memory of 1880 952 e5bf3a8567e73fcb4b53140c0c04bfa3bbbc18e8045903701e9da29e1858785b.exe y03167197.exe PID 952 wrote to memory of 1880 952 e5bf3a8567e73fcb4b53140c0c04bfa3bbbc18e8045903701e9da29e1858785b.exe y03167197.exe PID 1880 wrote to memory of 1928 1880 y03167197.exe p15904255.exe PID 1880 wrote to memory of 1928 1880 y03167197.exe p15904255.exe PID 1880 wrote to memory of 1928 1880 y03167197.exe p15904255.exe PID 1880 wrote to memory of 1928 1880 y03167197.exe p15904255.exe PID 1880 wrote to memory of 1928 1880 y03167197.exe p15904255.exe PID 1880 wrote to memory of 1928 1880 y03167197.exe p15904255.exe PID 1880 wrote to memory of 1928 1880 y03167197.exe p15904255.exe PID 1928 wrote to memory of 564 1928 p15904255.exe 1.exe PID 1928 wrote to memory of 564 1928 p15904255.exe 1.exe PID 1928 wrote to memory of 564 1928 p15904255.exe 1.exe PID 1928 wrote to memory of 564 1928 p15904255.exe 1.exe PID 1928 wrote to memory of 564 1928 p15904255.exe 1.exe PID 1928 wrote to memory of 564 1928 p15904255.exe 1.exe PID 1928 wrote to memory of 564 1928 p15904255.exe 1.exe PID 1880 wrote to memory of 1560 1880 y03167197.exe r63738273.exe PID 1880 wrote to memory of 1560 1880 y03167197.exe r63738273.exe PID 1880 wrote to memory of 1560 1880 y03167197.exe r63738273.exe PID 1880 wrote to memory of 1560 1880 y03167197.exe r63738273.exe PID 1880 wrote to memory of 1560 1880 y03167197.exe r63738273.exe PID 1880 wrote to memory of 1560 1880 y03167197.exe r63738273.exe PID 1880 wrote to memory of 1560 1880 y03167197.exe r63738273.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5bf3a8567e73fcb4b53140c0c04bfa3bbbc18e8045903701e9da29e1858785b.exe"C:\Users\Admin\AppData\Local\Temp\e5bf3a8567e73fcb4b53140c0c04bfa3bbbc18e8045903701e9da29e1858785b.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y03167197.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y03167197.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p15904255.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p15904255.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r63738273.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r63738273.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y03167197.exeFilesize
570KB
MD56c5eeeacce20279c36abd307c736c22e
SHA16d9157ff290caa2eae23b1783ab71db565d88473
SHA256f62852d448fe3b8ceb13641d3fd387217763ae23fc38fe609de0006e4848db49
SHA512bb19683f00c89a0b15c85e4202e6bb6b2076c1ef419b074d6ea5f98619879a4b0d3e41e3a3a3e47fe81c24909a2a8728e4bce012c30c090d9dbe8bc6b9f7be7a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y03167197.exeFilesize
570KB
MD56c5eeeacce20279c36abd307c736c22e
SHA16d9157ff290caa2eae23b1783ab71db565d88473
SHA256f62852d448fe3b8ceb13641d3fd387217763ae23fc38fe609de0006e4848db49
SHA512bb19683f00c89a0b15c85e4202e6bb6b2076c1ef419b074d6ea5f98619879a4b0d3e41e3a3a3e47fe81c24909a2a8728e4bce012c30c090d9dbe8bc6b9f7be7a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p15904255.exeFilesize
476KB
MD55954eace74a29622f1f937f2bbcb3149
SHA1df2e6eaacf70d7786a06089a19aad6ed828571f7
SHA2561f2bc0bc587f001eead661b36fe8badcb63f4eb2a9b96c5a4c45aa5dca7330e4
SHA512d1067fc3901ed55077fb5bd219723be2505f29caafca11f39231205394c25da38239945b0cd59579907b04b75b36e102f1849fa09156232da7295a0b3700e1f9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p15904255.exeFilesize
476KB
MD55954eace74a29622f1f937f2bbcb3149
SHA1df2e6eaacf70d7786a06089a19aad6ed828571f7
SHA2561f2bc0bc587f001eead661b36fe8badcb63f4eb2a9b96c5a4c45aa5dca7330e4
SHA512d1067fc3901ed55077fb5bd219723be2505f29caafca11f39231205394c25da38239945b0cd59579907b04b75b36e102f1849fa09156232da7295a0b3700e1f9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p15904255.exeFilesize
476KB
MD55954eace74a29622f1f937f2bbcb3149
SHA1df2e6eaacf70d7786a06089a19aad6ed828571f7
SHA2561f2bc0bc587f001eead661b36fe8badcb63f4eb2a9b96c5a4c45aa5dca7330e4
SHA512d1067fc3901ed55077fb5bd219723be2505f29caafca11f39231205394c25da38239945b0cd59579907b04b75b36e102f1849fa09156232da7295a0b3700e1f9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r63738273.exeFilesize
169KB
MD53549cf3482a166f1aeb5cf8f19299c18
SHA178497bdd7228795019e295a2ff0cfef4aa3581a9
SHA256ae0bc33340bc1ec6d6ee7e0bb10f4130378216dbb648ad812ae5bc15c3fb28fb
SHA512b4d19e8b9717d9b016f67c9609815f7f2a9c35dab8963000ddbe39277e183f48582a6928a905d4e830b95901f82854aa46b944d135fd51a0285b477b3ed00302
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r63738273.exeFilesize
169KB
MD53549cf3482a166f1aeb5cf8f19299c18
SHA178497bdd7228795019e295a2ff0cfef4aa3581a9
SHA256ae0bc33340bc1ec6d6ee7e0bb10f4130378216dbb648ad812ae5bc15c3fb28fb
SHA512b4d19e8b9717d9b016f67c9609815f7f2a9c35dab8963000ddbe39277e183f48582a6928a905d4e830b95901f82854aa46b944d135fd51a0285b477b3ed00302
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\y03167197.exeFilesize
570KB
MD56c5eeeacce20279c36abd307c736c22e
SHA16d9157ff290caa2eae23b1783ab71db565d88473
SHA256f62852d448fe3b8ceb13641d3fd387217763ae23fc38fe609de0006e4848db49
SHA512bb19683f00c89a0b15c85e4202e6bb6b2076c1ef419b074d6ea5f98619879a4b0d3e41e3a3a3e47fe81c24909a2a8728e4bce012c30c090d9dbe8bc6b9f7be7a
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\y03167197.exeFilesize
570KB
MD56c5eeeacce20279c36abd307c736c22e
SHA16d9157ff290caa2eae23b1783ab71db565d88473
SHA256f62852d448fe3b8ceb13641d3fd387217763ae23fc38fe609de0006e4848db49
SHA512bb19683f00c89a0b15c85e4202e6bb6b2076c1ef419b074d6ea5f98619879a4b0d3e41e3a3a3e47fe81c24909a2a8728e4bce012c30c090d9dbe8bc6b9f7be7a
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\p15904255.exeFilesize
476KB
MD55954eace74a29622f1f937f2bbcb3149
SHA1df2e6eaacf70d7786a06089a19aad6ed828571f7
SHA2561f2bc0bc587f001eead661b36fe8badcb63f4eb2a9b96c5a4c45aa5dca7330e4
SHA512d1067fc3901ed55077fb5bd219723be2505f29caafca11f39231205394c25da38239945b0cd59579907b04b75b36e102f1849fa09156232da7295a0b3700e1f9
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\p15904255.exeFilesize
476KB
MD55954eace74a29622f1f937f2bbcb3149
SHA1df2e6eaacf70d7786a06089a19aad6ed828571f7
SHA2561f2bc0bc587f001eead661b36fe8badcb63f4eb2a9b96c5a4c45aa5dca7330e4
SHA512d1067fc3901ed55077fb5bd219723be2505f29caafca11f39231205394c25da38239945b0cd59579907b04b75b36e102f1849fa09156232da7295a0b3700e1f9
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\p15904255.exeFilesize
476KB
MD55954eace74a29622f1f937f2bbcb3149
SHA1df2e6eaacf70d7786a06089a19aad6ed828571f7
SHA2561f2bc0bc587f001eead661b36fe8badcb63f4eb2a9b96c5a4c45aa5dca7330e4
SHA512d1067fc3901ed55077fb5bd219723be2505f29caafca11f39231205394c25da38239945b0cd59579907b04b75b36e102f1849fa09156232da7295a0b3700e1f9
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\r63738273.exeFilesize
169KB
MD53549cf3482a166f1aeb5cf8f19299c18
SHA178497bdd7228795019e295a2ff0cfef4aa3581a9
SHA256ae0bc33340bc1ec6d6ee7e0bb10f4130378216dbb648ad812ae5bc15c3fb28fb
SHA512b4d19e8b9717d9b016f67c9609815f7f2a9c35dab8963000ddbe39277e183f48582a6928a905d4e830b95901f82854aa46b944d135fd51a0285b477b3ed00302
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\r63738273.exeFilesize
169KB
MD53549cf3482a166f1aeb5cf8f19299c18
SHA178497bdd7228795019e295a2ff0cfef4aa3581a9
SHA256ae0bc33340bc1ec6d6ee7e0bb10f4130378216dbb648ad812ae5bc15c3fb28fb
SHA512b4d19e8b9717d9b016f67c9609815f7f2a9c35dab8963000ddbe39277e183f48582a6928a905d4e830b95901f82854aa46b944d135fd51a0285b477b3ed00302
-
\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
memory/564-2245-0x00000000001E0000-0x000000000020E000-memory.dmpFilesize
184KB
-
memory/564-2246-0x0000000000490000-0x0000000000496000-memory.dmpFilesize
24KB
-
memory/564-2256-0x0000000004A60000-0x0000000004AA0000-memory.dmpFilesize
256KB
-
memory/564-2258-0x0000000004A60000-0x0000000004AA0000-memory.dmpFilesize
256KB
-
memory/1560-2253-0x0000000000E90000-0x0000000000EC0000-memory.dmpFilesize
192KB
-
memory/1560-2254-0x00000000003C0000-0x00000000003C6000-memory.dmpFilesize
24KB
-
memory/1560-2255-0x0000000000BA0000-0x0000000000BE0000-memory.dmpFilesize
256KB
-
memory/1560-2257-0x0000000000BA0000-0x0000000000BE0000-memory.dmpFilesize
256KB
-
memory/1928-124-0x00000000025B0000-0x0000000002610000-memory.dmpFilesize
384KB
-
memory/1928-116-0x00000000025B0000-0x0000000002610000-memory.dmpFilesize
384KB
-
memory/1928-108-0x00000000025B0000-0x0000000002610000-memory.dmpFilesize
384KB
-
memory/1928-110-0x00000000025B0000-0x0000000002610000-memory.dmpFilesize
384KB
-
memory/1928-112-0x00000000025B0000-0x0000000002610000-memory.dmpFilesize
384KB
-
memory/1928-114-0x00000000025B0000-0x0000000002610000-memory.dmpFilesize
384KB
-
memory/1928-118-0x00000000025B0000-0x0000000002610000-memory.dmpFilesize
384KB
-
memory/1928-120-0x00000000025B0000-0x0000000002610000-memory.dmpFilesize
384KB
-
memory/1928-106-0x00000000025B0000-0x0000000002610000-memory.dmpFilesize
384KB
-
memory/1928-126-0x00000000025B0000-0x0000000002610000-memory.dmpFilesize
384KB
-
memory/1928-130-0x00000000025B0000-0x0000000002610000-memory.dmpFilesize
384KB
-
memory/1928-132-0x00000000025B0000-0x0000000002610000-memory.dmpFilesize
384KB
-
memory/1928-128-0x00000000025B0000-0x0000000002610000-memory.dmpFilesize
384KB
-
memory/1928-136-0x00000000025B0000-0x0000000002610000-memory.dmpFilesize
384KB
-
memory/1928-134-0x00000000025B0000-0x0000000002610000-memory.dmpFilesize
384KB
-
memory/1928-140-0x00000000025B0000-0x0000000002610000-memory.dmpFilesize
384KB
-
memory/1928-142-0x00000000025B0000-0x0000000002610000-memory.dmpFilesize
384KB
-
memory/1928-144-0x00000000025B0000-0x0000000002610000-memory.dmpFilesize
384KB
-
memory/1928-146-0x00000000025B0000-0x0000000002610000-memory.dmpFilesize
384KB
-
memory/1928-138-0x00000000025B0000-0x0000000002610000-memory.dmpFilesize
384KB
-
memory/1928-122-0x00000000025B0000-0x0000000002610000-memory.dmpFilesize
384KB
-
memory/1928-104-0x00000000025B0000-0x0000000002610000-memory.dmpFilesize
384KB
-
memory/1928-2231-0x0000000004E40000-0x0000000004E80000-memory.dmpFilesize
256KB
-
memory/1928-2230-0x0000000004E40000-0x0000000004E80000-memory.dmpFilesize
256KB
-
memory/1928-2233-0x0000000002120000-0x0000000002152000-memory.dmpFilesize
200KB
-
memory/1928-2235-0x0000000004E40000-0x0000000004E80000-memory.dmpFilesize
256KB
-
memory/1928-101-0x0000000000250000-0x00000000002AB000-memory.dmpFilesize
364KB
-
memory/1928-102-0x0000000004E40000-0x0000000004E80000-memory.dmpFilesize
256KB
-
memory/1928-103-0x0000000004E40000-0x0000000004E80000-memory.dmpFilesize
256KB
-
memory/1928-99-0x00000000025B0000-0x0000000002610000-memory.dmpFilesize
384KB
-
memory/1928-97-0x00000000025B0000-0x0000000002610000-memory.dmpFilesize
384KB
-
memory/1928-95-0x00000000025B0000-0x0000000002610000-memory.dmpFilesize
384KB
-
memory/1928-93-0x00000000025B0000-0x0000000002610000-memory.dmpFilesize
384KB
-
memory/1928-91-0x00000000025B0000-0x0000000002610000-memory.dmpFilesize
384KB
-
memory/1928-89-0x00000000025B0000-0x0000000002610000-memory.dmpFilesize
384KB
-
memory/1928-87-0x00000000025B0000-0x0000000002610000-memory.dmpFilesize
384KB
-
memory/1928-85-0x00000000025B0000-0x0000000002610000-memory.dmpFilesize
384KB
-
memory/1928-83-0x00000000025B0000-0x0000000002610000-memory.dmpFilesize
384KB
-
memory/1928-81-0x00000000025B0000-0x0000000002610000-memory.dmpFilesize
384KB
-
memory/1928-80-0x00000000025B0000-0x0000000002610000-memory.dmpFilesize
384KB
-
memory/1928-79-0x00000000025B0000-0x0000000002616000-memory.dmpFilesize
408KB
-
memory/1928-78-0x0000000002540000-0x00000000025A8000-memory.dmpFilesize
416KB