Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2023 08:47
Static task
static1
Behavioral task
behavioral1
Sample
faed29eb766db600961f9423a479f19c7d4d64724814e28d73b0502d520d7033.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
faed29eb766db600961f9423a479f19c7d4d64724814e28d73b0502d520d7033.exe
Resource
win10v2004-20230220-en
General
-
Target
faed29eb766db600961f9423a479f19c7d4d64724814e28d73b0502d520d7033.exe
-
Size
851KB
-
MD5
0790baaf9bbcb07269d4dc0d035dd66f
-
SHA1
b3ef4b950f79283490c547813f97ff23a878a1d2
-
SHA256
faed29eb766db600961f9423a479f19c7d4d64724814e28d73b0502d520d7033
-
SHA512
b442da8418870b6f51b62849eb41802d2e144e309fd3e7dc215adf302af3e5ac08a1bf6db916836df74ff6501cb0c090e54fe7b45777059d242ab4c0314436ee
-
SSDEEP
12288:8y90dQ8Zi3+uGRofOv6FIVppH/QBC+NE7k7N96NBnGP+J3huywkFBh4igIfKkTeX:8yR8c3NGSmv4IV//QBS+9w6+qiX4EIX
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
danko
185.161.248.73:4164
-
auth_value
784d42a6c1eb1a5060b8bcd3696f5f1e
Signatures
-
Detects Redline Stealer samples 1 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
Processes:
resource yara_rule behavioral2/memory/1600-2313-0x0000000005660000-0x0000000005C78000-memory.dmp redline_stealer -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
p86171959.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation p86171959.exe -
Executes dropped EXE 4 IoCs
Processes:
y69423032.exep86171959.exe1.exer80757657.exepid process 1332 y69423032.exe 2508 p86171959.exe 1600 1.exe 2368 r80757657.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
y69423032.exefaed29eb766db600961f9423a479f19c7d4d64724814e28d73b0502d520d7033.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce y69423032.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y69423032.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce faed29eb766db600961f9423a479f19c7d4d64724814e28d73b0502d520d7033.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" faed29eb766db600961f9423a479f19c7d4d64724814e28d73b0502d520d7033.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2024 2508 WerFault.exe p86171959.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
p86171959.exedescription pid process Token: SeDebugPrivilege 2508 p86171959.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
faed29eb766db600961f9423a479f19c7d4d64724814e28d73b0502d520d7033.exey69423032.exep86171959.exedescription pid process target process PID 1912 wrote to memory of 1332 1912 faed29eb766db600961f9423a479f19c7d4d64724814e28d73b0502d520d7033.exe y69423032.exe PID 1912 wrote to memory of 1332 1912 faed29eb766db600961f9423a479f19c7d4d64724814e28d73b0502d520d7033.exe y69423032.exe PID 1912 wrote to memory of 1332 1912 faed29eb766db600961f9423a479f19c7d4d64724814e28d73b0502d520d7033.exe y69423032.exe PID 1332 wrote to memory of 2508 1332 y69423032.exe p86171959.exe PID 1332 wrote to memory of 2508 1332 y69423032.exe p86171959.exe PID 1332 wrote to memory of 2508 1332 y69423032.exe p86171959.exe PID 2508 wrote to memory of 1600 2508 p86171959.exe 1.exe PID 2508 wrote to memory of 1600 2508 p86171959.exe 1.exe PID 2508 wrote to memory of 1600 2508 p86171959.exe 1.exe PID 1332 wrote to memory of 2368 1332 y69423032.exe r80757657.exe PID 1332 wrote to memory of 2368 1332 y69423032.exe r80757657.exe PID 1332 wrote to memory of 2368 1332 y69423032.exe r80757657.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\faed29eb766db600961f9423a479f19c7d4d64724814e28d73b0502d520d7033.exe"C:\Users\Admin\AppData\Local\Temp\faed29eb766db600961f9423a479f19c7d4d64724814e28d73b0502d520d7033.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y69423032.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y69423032.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p86171959.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p86171959.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 13764⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r80757657.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r80757657.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2508 -ip 25081⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y69423032.exeFilesize
569KB
MD5411669898f499da44ab5cc6cfeab270e
SHA1d272cae58364ffecd74d45c6084b5f9645b81d5a
SHA256d620eaaf5856242da16c075ae6e7d5df910e0a5a840a92ff98cf62a17ea4f93c
SHA5126b7bf6d2b9857a5b6911574eb4611845a2b559574c1d93b8afdf3a66c129a983f7b5d037c3555be93d7d18d31d5ed49ab37fef8c159775fd3b1359b25ab75a55
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y69423032.exeFilesize
569KB
MD5411669898f499da44ab5cc6cfeab270e
SHA1d272cae58364ffecd74d45c6084b5f9645b81d5a
SHA256d620eaaf5856242da16c075ae6e7d5df910e0a5a840a92ff98cf62a17ea4f93c
SHA5126b7bf6d2b9857a5b6911574eb4611845a2b559574c1d93b8afdf3a66c129a983f7b5d037c3555be93d7d18d31d5ed49ab37fef8c159775fd3b1359b25ab75a55
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p86171959.exeFilesize
479KB
MD5e100b2b108c216349f0a23c4246832ba
SHA175d7a6acd17c8346537d4ed70d573e91c6ac6987
SHA2562ad773c306ffdf53c03fc7fb0f8dddeb4d7bac07bcb1b7304c45afab6c5b366f
SHA5128b5a9c284b76821ed84f74d725df4488aabc063d4de43e120c12096b6012744722c13ade6fba8c732b3dd34d47c023b18678d6b5d9c2f2920eae6feb715d433d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p86171959.exeFilesize
479KB
MD5e100b2b108c216349f0a23c4246832ba
SHA175d7a6acd17c8346537d4ed70d573e91c6ac6987
SHA2562ad773c306ffdf53c03fc7fb0f8dddeb4d7bac07bcb1b7304c45afab6c5b366f
SHA5128b5a9c284b76821ed84f74d725df4488aabc063d4de43e120c12096b6012744722c13ade6fba8c732b3dd34d47c023b18678d6b5d9c2f2920eae6feb715d433d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r80757657.exeFilesize
168KB
MD518f52efe409f70ad3082b5aa025490bc
SHA119c175ffc3b861e409d9c5e745d5c6b4fb4c3453
SHA256014b6466efc95f6f7da12842bd567f92fa46ec1d3b1103594411134544af9f4b
SHA512fd157f9fd5fdec0e2307b0ed23daf790553257be4a903978539c23a0b2958ec0d1c3c918b084263ea86a6352988f8b7db613b89425750e4b7563f44c62352303
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r80757657.exeFilesize
168KB
MD518f52efe409f70ad3082b5aa025490bc
SHA119c175ffc3b861e409d9c5e745d5c6b4fb4c3453
SHA256014b6466efc95f6f7da12842bd567f92fa46ec1d3b1103594411134544af9f4b
SHA512fd157f9fd5fdec0e2307b0ed23daf790553257be4a903978539c23a0b2958ec0d1c3c918b084263ea86a6352988f8b7db613b89425750e4b7563f44c62352303
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
memory/1600-2315-0x00000000028E0000-0x00000000028F2000-memory.dmpFilesize
72KB
-
memory/1600-2317-0x0000000005030000-0x0000000005040000-memory.dmpFilesize
64KB
-
memory/1600-2316-0x0000000004FB0000-0x0000000004FEC000-memory.dmpFilesize
240KB
-
memory/1600-2314-0x0000000005150000-0x000000000525A000-memory.dmpFilesize
1.0MB
-
memory/1600-2313-0x0000000005660000-0x0000000005C78000-memory.dmpFilesize
6.1MB
-
memory/1600-2311-0x00000000005F0000-0x000000000061E000-memory.dmpFilesize
184KB
-
memory/1600-2324-0x0000000005030000-0x0000000005040000-memory.dmpFilesize
64KB
-
memory/2368-2322-0x0000000000B70000-0x0000000000BA0000-memory.dmpFilesize
192KB
-
memory/2368-2323-0x0000000005510000-0x0000000005520000-memory.dmpFilesize
64KB
-
memory/2368-2325-0x0000000005510000-0x0000000005520000-memory.dmpFilesize
64KB
-
memory/2508-165-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/2508-211-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/2508-176-0x0000000004EA0000-0x0000000004EB0000-memory.dmpFilesize
64KB
-
memory/2508-179-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/2508-181-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/2508-183-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/2508-185-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/2508-187-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/2508-189-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/2508-191-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/2508-193-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/2508-195-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/2508-197-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/2508-199-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/2508-201-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/2508-203-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/2508-205-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/2508-207-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/2508-209-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/2508-177-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/2508-213-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/2508-215-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/2508-2299-0x0000000004EA0000-0x0000000004EB0000-memory.dmpFilesize
64KB
-
memory/2508-175-0x0000000004EA0000-0x0000000004EB0000-memory.dmpFilesize
64KB
-
memory/2508-173-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/2508-171-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/2508-169-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/2508-167-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/2508-163-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/2508-161-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/2508-159-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/2508-157-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/2508-155-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/2508-153-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/2508-151-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/2508-150-0x00000000054C0000-0x0000000005520000-memory.dmpFilesize
384KB
-
memory/2508-149-0x0000000004EB0000-0x0000000005454000-memory.dmpFilesize
5.6MB
-
memory/2508-148-0x0000000000820000-0x000000000087B000-memory.dmpFilesize
364KB