Analysis
-
max time kernel
134s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
07-05-2023 08:34
Static task
static1
Behavioral task
behavioral1
Sample
f572400bc785c5842cc6feae59b23307af14f1602a6ca793a56f8adb0b03759e.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
f572400bc785c5842cc6feae59b23307af14f1602a6ca793a56f8adb0b03759e.exe
Resource
win10v2004-20230220-en
General
-
Target
f572400bc785c5842cc6feae59b23307af14f1602a6ca793a56f8adb0b03759e.exe
-
Size
849KB
-
MD5
61e42b25bb32a74aafebeab9705c00d3
-
SHA1
483afac22e2133e5d19b25bb5d9d0999733ce9ef
-
SHA256
f572400bc785c5842cc6feae59b23307af14f1602a6ca793a56f8adb0b03759e
-
SHA512
7f9287aa4b54cc5ab446ef903f27b7b05ad5746455e7e46b74b05fd053ebc0cc8dcab7cdfddb30023a3b9799472288eeeb7cc801725f8ebdae2a95043851a6e8
-
SSDEEP
24576:Yy/Oaex4GjLrGVsRlfSsIRAryQ0S8mzt5:f/Oaex7rGOvfIAf0Szh
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
danko
185.161.248.73:4164
-
auth_value
784d42a6c1eb1a5060b8bcd3696f5f1e
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
Processes:
y15322509.exep57167190.exe1.exer05242457.exepid process 1988 y15322509.exe 556 p57167190.exe 1724 1.exe 1892 r05242457.exe -
Loads dropped DLL 9 IoCs
Processes:
f572400bc785c5842cc6feae59b23307af14f1602a6ca793a56f8adb0b03759e.exey15322509.exep57167190.exe1.exer05242457.exepid process 2044 f572400bc785c5842cc6feae59b23307af14f1602a6ca793a56f8adb0b03759e.exe 1988 y15322509.exe 1988 y15322509.exe 1988 y15322509.exe 556 p57167190.exe 556 p57167190.exe 1724 1.exe 1988 y15322509.exe 1892 r05242457.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
y15322509.exef572400bc785c5842cc6feae59b23307af14f1602a6ca793a56f8adb0b03759e.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce y15322509.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y15322509.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce f572400bc785c5842cc6feae59b23307af14f1602a6ca793a56f8adb0b03759e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" f572400bc785c5842cc6feae59b23307af14f1602a6ca793a56f8adb0b03759e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
p57167190.exedescription pid process Token: SeDebugPrivilege 556 p57167190.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
f572400bc785c5842cc6feae59b23307af14f1602a6ca793a56f8adb0b03759e.exey15322509.exep57167190.exedescription pid process target process PID 2044 wrote to memory of 1988 2044 f572400bc785c5842cc6feae59b23307af14f1602a6ca793a56f8adb0b03759e.exe y15322509.exe PID 2044 wrote to memory of 1988 2044 f572400bc785c5842cc6feae59b23307af14f1602a6ca793a56f8adb0b03759e.exe y15322509.exe PID 2044 wrote to memory of 1988 2044 f572400bc785c5842cc6feae59b23307af14f1602a6ca793a56f8adb0b03759e.exe y15322509.exe PID 2044 wrote to memory of 1988 2044 f572400bc785c5842cc6feae59b23307af14f1602a6ca793a56f8adb0b03759e.exe y15322509.exe PID 2044 wrote to memory of 1988 2044 f572400bc785c5842cc6feae59b23307af14f1602a6ca793a56f8adb0b03759e.exe y15322509.exe PID 2044 wrote to memory of 1988 2044 f572400bc785c5842cc6feae59b23307af14f1602a6ca793a56f8adb0b03759e.exe y15322509.exe PID 2044 wrote to memory of 1988 2044 f572400bc785c5842cc6feae59b23307af14f1602a6ca793a56f8adb0b03759e.exe y15322509.exe PID 1988 wrote to memory of 556 1988 y15322509.exe p57167190.exe PID 1988 wrote to memory of 556 1988 y15322509.exe p57167190.exe PID 1988 wrote to memory of 556 1988 y15322509.exe p57167190.exe PID 1988 wrote to memory of 556 1988 y15322509.exe p57167190.exe PID 1988 wrote to memory of 556 1988 y15322509.exe p57167190.exe PID 1988 wrote to memory of 556 1988 y15322509.exe p57167190.exe PID 1988 wrote to memory of 556 1988 y15322509.exe p57167190.exe PID 556 wrote to memory of 1724 556 p57167190.exe 1.exe PID 556 wrote to memory of 1724 556 p57167190.exe 1.exe PID 556 wrote to memory of 1724 556 p57167190.exe 1.exe PID 556 wrote to memory of 1724 556 p57167190.exe 1.exe PID 556 wrote to memory of 1724 556 p57167190.exe 1.exe PID 556 wrote to memory of 1724 556 p57167190.exe 1.exe PID 556 wrote to memory of 1724 556 p57167190.exe 1.exe PID 1988 wrote to memory of 1892 1988 y15322509.exe r05242457.exe PID 1988 wrote to memory of 1892 1988 y15322509.exe r05242457.exe PID 1988 wrote to memory of 1892 1988 y15322509.exe r05242457.exe PID 1988 wrote to memory of 1892 1988 y15322509.exe r05242457.exe PID 1988 wrote to memory of 1892 1988 y15322509.exe r05242457.exe PID 1988 wrote to memory of 1892 1988 y15322509.exe r05242457.exe PID 1988 wrote to memory of 1892 1988 y15322509.exe r05242457.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f572400bc785c5842cc6feae59b23307af14f1602a6ca793a56f8adb0b03759e.exe"C:\Users\Admin\AppData\Local\Temp\f572400bc785c5842cc6feae59b23307af14f1602a6ca793a56f8adb0b03759e.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y15322509.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y15322509.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p57167190.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p57167190.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r05242457.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r05242457.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y15322509.exeFilesize
569KB
MD5d9469a57c942c29c7f513abb77468a70
SHA19af08ca9e4a8d9dec92bb0cc52a5bd5f1de0d031
SHA25682ea199c0f2026981c97c1a29b6113b0a02a48099af722d90c0539fbba6ce0cf
SHA512f64bf4f7408a284c6cbb9636e32db7e78f56154e7d4431998e141c141d24d8a542279f57f08447572165b65ea7b618dcabe8f9a69605cc848f10e85b2ab87f00
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y15322509.exeFilesize
569KB
MD5d9469a57c942c29c7f513abb77468a70
SHA19af08ca9e4a8d9dec92bb0cc52a5bd5f1de0d031
SHA25682ea199c0f2026981c97c1a29b6113b0a02a48099af722d90c0539fbba6ce0cf
SHA512f64bf4f7408a284c6cbb9636e32db7e78f56154e7d4431998e141c141d24d8a542279f57f08447572165b65ea7b618dcabe8f9a69605cc848f10e85b2ab87f00
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p57167190.exeFilesize
479KB
MD58ad26b015e91ebfd0351f2e0cf2a2062
SHA12f93de107958207dbc1ccc2ab772287226488247
SHA25694fcbfb32738dc203bb258c83a01ed7e61cca9cd28c0a99b2b022109fc24efec
SHA5128f4f39345466ce42af14a12992741960ee3947a78ff78053732d1d8a5301616bf6393489ed54f09d0202893b7712cc4569da46bccbadda5348928a7a06a38fdc
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p57167190.exeFilesize
479KB
MD58ad26b015e91ebfd0351f2e0cf2a2062
SHA12f93de107958207dbc1ccc2ab772287226488247
SHA25694fcbfb32738dc203bb258c83a01ed7e61cca9cd28c0a99b2b022109fc24efec
SHA5128f4f39345466ce42af14a12992741960ee3947a78ff78053732d1d8a5301616bf6393489ed54f09d0202893b7712cc4569da46bccbadda5348928a7a06a38fdc
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p57167190.exeFilesize
479KB
MD58ad26b015e91ebfd0351f2e0cf2a2062
SHA12f93de107958207dbc1ccc2ab772287226488247
SHA25694fcbfb32738dc203bb258c83a01ed7e61cca9cd28c0a99b2b022109fc24efec
SHA5128f4f39345466ce42af14a12992741960ee3947a78ff78053732d1d8a5301616bf6393489ed54f09d0202893b7712cc4569da46bccbadda5348928a7a06a38fdc
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r05242457.exeFilesize
168KB
MD5a859d15c9dd9792ad42c614ec3af4bc3
SHA1a78b82bd3a2fb22ee17831d3a50255fa6eb4cb1e
SHA2563b36cff63a3c46ca53c366daa0b85ad4e4e18ae37ca7809207e9930c0d12c573
SHA512d94dff698654550f78677e5a4ec67d01a7895ed87ecdec7eaaaa7731955b8006648ce96f420f4c12f13c0638175017096ae355f68658e583916046932437cbd7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r05242457.exeFilesize
168KB
MD5a859d15c9dd9792ad42c614ec3af4bc3
SHA1a78b82bd3a2fb22ee17831d3a50255fa6eb4cb1e
SHA2563b36cff63a3c46ca53c366daa0b85ad4e4e18ae37ca7809207e9930c0d12c573
SHA512d94dff698654550f78677e5a4ec67d01a7895ed87ecdec7eaaaa7731955b8006648ce96f420f4c12f13c0638175017096ae355f68658e583916046932437cbd7
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\y15322509.exeFilesize
569KB
MD5d9469a57c942c29c7f513abb77468a70
SHA19af08ca9e4a8d9dec92bb0cc52a5bd5f1de0d031
SHA25682ea199c0f2026981c97c1a29b6113b0a02a48099af722d90c0539fbba6ce0cf
SHA512f64bf4f7408a284c6cbb9636e32db7e78f56154e7d4431998e141c141d24d8a542279f57f08447572165b65ea7b618dcabe8f9a69605cc848f10e85b2ab87f00
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\y15322509.exeFilesize
569KB
MD5d9469a57c942c29c7f513abb77468a70
SHA19af08ca9e4a8d9dec92bb0cc52a5bd5f1de0d031
SHA25682ea199c0f2026981c97c1a29b6113b0a02a48099af722d90c0539fbba6ce0cf
SHA512f64bf4f7408a284c6cbb9636e32db7e78f56154e7d4431998e141c141d24d8a542279f57f08447572165b65ea7b618dcabe8f9a69605cc848f10e85b2ab87f00
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\p57167190.exeFilesize
479KB
MD58ad26b015e91ebfd0351f2e0cf2a2062
SHA12f93de107958207dbc1ccc2ab772287226488247
SHA25694fcbfb32738dc203bb258c83a01ed7e61cca9cd28c0a99b2b022109fc24efec
SHA5128f4f39345466ce42af14a12992741960ee3947a78ff78053732d1d8a5301616bf6393489ed54f09d0202893b7712cc4569da46bccbadda5348928a7a06a38fdc
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\p57167190.exeFilesize
479KB
MD58ad26b015e91ebfd0351f2e0cf2a2062
SHA12f93de107958207dbc1ccc2ab772287226488247
SHA25694fcbfb32738dc203bb258c83a01ed7e61cca9cd28c0a99b2b022109fc24efec
SHA5128f4f39345466ce42af14a12992741960ee3947a78ff78053732d1d8a5301616bf6393489ed54f09d0202893b7712cc4569da46bccbadda5348928a7a06a38fdc
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\p57167190.exeFilesize
479KB
MD58ad26b015e91ebfd0351f2e0cf2a2062
SHA12f93de107958207dbc1ccc2ab772287226488247
SHA25694fcbfb32738dc203bb258c83a01ed7e61cca9cd28c0a99b2b022109fc24efec
SHA5128f4f39345466ce42af14a12992741960ee3947a78ff78053732d1d8a5301616bf6393489ed54f09d0202893b7712cc4569da46bccbadda5348928a7a06a38fdc
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\r05242457.exeFilesize
168KB
MD5a859d15c9dd9792ad42c614ec3af4bc3
SHA1a78b82bd3a2fb22ee17831d3a50255fa6eb4cb1e
SHA2563b36cff63a3c46ca53c366daa0b85ad4e4e18ae37ca7809207e9930c0d12c573
SHA512d94dff698654550f78677e5a4ec67d01a7895ed87ecdec7eaaaa7731955b8006648ce96f420f4c12f13c0638175017096ae355f68658e583916046932437cbd7
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\r05242457.exeFilesize
168KB
MD5a859d15c9dd9792ad42c614ec3af4bc3
SHA1a78b82bd3a2fb22ee17831d3a50255fa6eb4cb1e
SHA2563b36cff63a3c46ca53c366daa0b85ad4e4e18ae37ca7809207e9930c0d12c573
SHA512d94dff698654550f78677e5a4ec67d01a7895ed87ecdec7eaaaa7731955b8006648ce96f420f4c12f13c0638175017096ae355f68658e583916046932437cbd7
-
\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
memory/556-119-0x00000000025F0000-0x0000000002650000-memory.dmpFilesize
384KB
-
memory/556-137-0x00000000025F0000-0x0000000002650000-memory.dmpFilesize
384KB
-
memory/556-96-0x00000000025F0000-0x0000000002650000-memory.dmpFilesize
384KB
-
memory/556-92-0x00000000025F0000-0x0000000002650000-memory.dmpFilesize
384KB
-
memory/556-102-0x00000000025F0000-0x0000000002650000-memory.dmpFilesize
384KB
-
memory/556-100-0x00000000025F0000-0x0000000002650000-memory.dmpFilesize
384KB
-
memory/556-98-0x00000000025F0000-0x0000000002650000-memory.dmpFilesize
384KB
-
memory/556-104-0x00000000025F0000-0x0000000002650000-memory.dmpFilesize
384KB
-
memory/556-106-0x00000000025F0000-0x0000000002650000-memory.dmpFilesize
384KB
-
memory/556-108-0x00000000025F0000-0x0000000002650000-memory.dmpFilesize
384KB
-
memory/556-111-0x0000000004D10000-0x0000000004D50000-memory.dmpFilesize
256KB
-
memory/556-110-0x00000000025F0000-0x0000000002650000-memory.dmpFilesize
384KB
-
memory/556-115-0x0000000004D10000-0x0000000004D50000-memory.dmpFilesize
256KB
-
memory/556-114-0x00000000025F0000-0x0000000002650000-memory.dmpFilesize
384KB
-
memory/556-113-0x0000000004D10000-0x0000000004D50000-memory.dmpFilesize
256KB
-
memory/556-121-0x00000000025F0000-0x0000000002650000-memory.dmpFilesize
384KB
-
memory/556-86-0x00000000025F0000-0x0000000002650000-memory.dmpFilesize
384KB
-
memory/556-117-0x00000000025F0000-0x0000000002650000-memory.dmpFilesize
384KB
-
memory/556-125-0x00000000025F0000-0x0000000002650000-memory.dmpFilesize
384KB
-
memory/556-123-0x00000000025F0000-0x0000000002650000-memory.dmpFilesize
384KB
-
memory/556-127-0x00000000025F0000-0x0000000002650000-memory.dmpFilesize
384KB
-
memory/556-129-0x00000000025F0000-0x0000000002650000-memory.dmpFilesize
384KB
-
memory/556-131-0x00000000025F0000-0x0000000002650000-memory.dmpFilesize
384KB
-
memory/556-133-0x00000000025F0000-0x0000000002650000-memory.dmpFilesize
384KB
-
memory/556-135-0x00000000025F0000-0x0000000002650000-memory.dmpFilesize
384KB
-
memory/556-94-0x00000000025F0000-0x0000000002650000-memory.dmpFilesize
384KB
-
memory/556-143-0x00000000025F0000-0x0000000002650000-memory.dmpFilesize
384KB
-
memory/556-141-0x00000000025F0000-0x0000000002650000-memory.dmpFilesize
384KB
-
memory/556-139-0x00000000025F0000-0x0000000002650000-memory.dmpFilesize
384KB
-
memory/556-147-0x00000000025F0000-0x0000000002650000-memory.dmpFilesize
384KB
-
memory/556-145-0x00000000025F0000-0x0000000002650000-memory.dmpFilesize
384KB
-
memory/556-2231-0x0000000005260000-0x0000000005292000-memory.dmpFilesize
200KB
-
memory/556-2234-0x0000000004D10000-0x0000000004D50000-memory.dmpFilesize
256KB
-
memory/556-88-0x00000000025F0000-0x0000000002650000-memory.dmpFilesize
384KB
-
memory/556-2237-0x0000000004D10000-0x0000000004D50000-memory.dmpFilesize
256KB
-
memory/556-2238-0x0000000004D10000-0x0000000004D50000-memory.dmpFilesize
256KB
-
memory/556-2239-0x0000000004D10000-0x0000000004D50000-memory.dmpFilesize
256KB
-
memory/556-90-0x00000000025F0000-0x0000000002650000-memory.dmpFilesize
384KB
-
memory/556-84-0x00000000025F0000-0x0000000002650000-memory.dmpFilesize
384KB
-
memory/556-82-0x00000000025F0000-0x0000000002650000-memory.dmpFilesize
384KB
-
memory/556-78-0x0000000000820000-0x000000000087B000-memory.dmpFilesize
364KB
-
memory/556-79-0x0000000004C90000-0x0000000004CF8000-memory.dmpFilesize
416KB
-
memory/556-81-0x00000000025F0000-0x0000000002650000-memory.dmpFilesize
384KB
-
memory/556-80-0x00000000025F0000-0x0000000002656000-memory.dmpFilesize
408KB
-
memory/1724-2247-0x0000000000480000-0x0000000000486000-memory.dmpFilesize
24KB
-
memory/1724-2246-0x0000000001120000-0x000000000114E000-memory.dmpFilesize
184KB
-
memory/1724-2258-0x0000000004C70000-0x0000000004CB0000-memory.dmpFilesize
256KB
-
memory/1892-2254-0x0000000000360000-0x0000000000390000-memory.dmpFilesize
192KB
-
memory/1892-2255-0x0000000000660000-0x0000000000666000-memory.dmpFilesize
24KB
-
memory/1892-2256-0x00000000045E0000-0x0000000004620000-memory.dmpFilesize
256KB
-
memory/1892-2257-0x00000000045E0000-0x0000000004620000-memory.dmpFilesize
256KB