Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2023 08:55
Static task
static1
Behavioral task
behavioral1
Sample
fda0eb2979823212cf1a55a682673bcee9dbd7912e151e2d166cddffe766a37f.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
fda0eb2979823212cf1a55a682673bcee9dbd7912e151e2d166cddffe766a37f.exe
Resource
win10v2004-20230220-en
General
-
Target
fda0eb2979823212cf1a55a682673bcee9dbd7912e151e2d166cddffe766a37f.exe
-
Size
851KB
-
MD5
b6a129eabbd3c054b34cee1459a999d2
-
SHA1
3625aae1af2302877dcb62e27148fc14765aed96
-
SHA256
fda0eb2979823212cf1a55a682673bcee9dbd7912e151e2d166cddffe766a37f
-
SHA512
7524799e293e67d02b9ea2e9b26f3c4120a8e1214eb8b964a6c7ce8b812a0527767698a85e89f673123fb8e6efbef758bf0b2dff78ef25b7ee4ea246a09a92fe
-
SSDEEP
24576:LyyFFSLgZCuSXDzAbqjrf4TSQYm+U2J6nA9:+QSsZeIbKoSs+U2J6A
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
danko
185.161.248.73:4164
-
auth_value
784d42a6c1eb1a5060b8bcd3696f5f1e
Signatures
-
Detects Redline Stealer samples 1 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
Processes:
resource yara_rule behavioral2/memory/1020-2317-0x0000000005660000-0x0000000005C78000-memory.dmp redline_stealer -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
p31305204.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation p31305204.exe -
Executes dropped EXE 4 IoCs
Processes:
y29741275.exep31305204.exe1.exer19737771.exepid process 3908 y29741275.exe 1892 p31305204.exe 1020 1.exe 3792 r19737771.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
fda0eb2979823212cf1a55a682673bcee9dbd7912e151e2d166cddffe766a37f.exey29741275.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" fda0eb2979823212cf1a55a682673bcee9dbd7912e151e2d166cddffe766a37f.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce y29741275.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y29741275.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce fda0eb2979823212cf1a55a682673bcee9dbd7912e151e2d166cddffe766a37f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4976 1892 WerFault.exe p31305204.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
p31305204.exedescription pid process Token: SeDebugPrivilege 1892 p31305204.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
fda0eb2979823212cf1a55a682673bcee9dbd7912e151e2d166cddffe766a37f.exey29741275.exep31305204.exedescription pid process target process PID 3520 wrote to memory of 3908 3520 fda0eb2979823212cf1a55a682673bcee9dbd7912e151e2d166cddffe766a37f.exe y29741275.exe PID 3520 wrote to memory of 3908 3520 fda0eb2979823212cf1a55a682673bcee9dbd7912e151e2d166cddffe766a37f.exe y29741275.exe PID 3520 wrote to memory of 3908 3520 fda0eb2979823212cf1a55a682673bcee9dbd7912e151e2d166cddffe766a37f.exe y29741275.exe PID 3908 wrote to memory of 1892 3908 y29741275.exe p31305204.exe PID 3908 wrote to memory of 1892 3908 y29741275.exe p31305204.exe PID 3908 wrote to memory of 1892 3908 y29741275.exe p31305204.exe PID 1892 wrote to memory of 1020 1892 p31305204.exe 1.exe PID 1892 wrote to memory of 1020 1892 p31305204.exe 1.exe PID 1892 wrote to memory of 1020 1892 p31305204.exe 1.exe PID 3908 wrote to memory of 3792 3908 y29741275.exe r19737771.exe PID 3908 wrote to memory of 3792 3908 y29741275.exe r19737771.exe PID 3908 wrote to memory of 3792 3908 y29741275.exe r19737771.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fda0eb2979823212cf1a55a682673bcee9dbd7912e151e2d166cddffe766a37f.exe"C:\Users\Admin\AppData\Local\Temp\fda0eb2979823212cf1a55a682673bcee9dbd7912e151e2d166cddffe766a37f.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y29741275.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y29741275.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p31305204.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p31305204.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 15284⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r19737771.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r19737771.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1892 -ip 18921⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y29741275.exeFilesize
569KB
MD5c4874a03f662dd14cec233c356941de0
SHA1daf82fd57a438e9ee8b6c6a433835e77e5e941ef
SHA256f51ee90fcb59613518e8b2f03f166f0a50f9f7efe4614756b441d1350ea9c49b
SHA512f6a196bd450b7089d13639f83ff84c7493fd0fd86c6057c3e02a937f118fdafa8dffdd0a633bfe126635d2884ce24f38129367f895a64d073e4dcaef9e2206b6
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y29741275.exeFilesize
569KB
MD5c4874a03f662dd14cec233c356941de0
SHA1daf82fd57a438e9ee8b6c6a433835e77e5e941ef
SHA256f51ee90fcb59613518e8b2f03f166f0a50f9f7efe4614756b441d1350ea9c49b
SHA512f6a196bd450b7089d13639f83ff84c7493fd0fd86c6057c3e02a937f118fdafa8dffdd0a633bfe126635d2884ce24f38129367f895a64d073e4dcaef9e2206b6
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p31305204.exeFilesize
479KB
MD5b058114c386a55e2801494c373d567cb
SHA18e8ce4a394bd16ef0a896b853950c8149b7ba3c3
SHA2565988bb8d31f8e4c86e3d72775d503b2b63fda395ccfc21c10fb32256133c5d54
SHA5121c09a4109d777807b0aa3693c72016cdaf39830adba63fa8ed6d51ffa7c42884db74ca70747a1aded0093e51533dcd57472c489ed580d62fb622743602604eaa
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p31305204.exeFilesize
479KB
MD5b058114c386a55e2801494c373d567cb
SHA18e8ce4a394bd16ef0a896b853950c8149b7ba3c3
SHA2565988bb8d31f8e4c86e3d72775d503b2b63fda395ccfc21c10fb32256133c5d54
SHA5121c09a4109d777807b0aa3693c72016cdaf39830adba63fa8ed6d51ffa7c42884db74ca70747a1aded0093e51533dcd57472c489ed580d62fb622743602604eaa
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r19737771.exeFilesize
169KB
MD580c213304fb49f9559e8c806773e7feb
SHA11c3b7b859721703a2563b9f14b1a9b976b55b6c1
SHA256a5841ddfeb748afa75efbadf3514e3fc5f1b6e9648414c6a1a6cae62e3f2bca3
SHA5127df1ff9e4331400a161ca845efc2ea8e9bebec7943b19c37b5cab9e49797cac254bc903a3d99a38f21ca133e2536e6e6f0c828fc1e83ed0336393d71496d960f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r19737771.exeFilesize
169KB
MD580c213304fb49f9559e8c806773e7feb
SHA11c3b7b859721703a2563b9f14b1a9b976b55b6c1
SHA256a5841ddfeb748afa75efbadf3514e3fc5f1b6e9648414c6a1a6cae62e3f2bca3
SHA5127df1ff9e4331400a161ca845efc2ea8e9bebec7943b19c37b5cab9e49797cac254bc903a3d99a38f21ca133e2536e6e6f0c828fc1e83ed0336393d71496d960f
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
memory/1020-2320-0x00000000050C0000-0x00000000050FC000-memory.dmpFilesize
240KB
-
memory/1020-2318-0x0000000005150000-0x000000000525A000-memory.dmpFilesize
1.0MB
-
memory/1020-2317-0x0000000005660000-0x0000000005C78000-memory.dmpFilesize
6.1MB
-
memory/1020-2315-0x0000000000700000-0x000000000072E000-memory.dmpFilesize
184KB
-
memory/1020-2319-0x0000000005060000-0x0000000005072000-memory.dmpFilesize
72KB
-
memory/1020-2321-0x0000000002AA0000-0x0000000002AB0000-memory.dmpFilesize
64KB
-
memory/1020-2328-0x0000000002AA0000-0x0000000002AB0000-memory.dmpFilesize
64KB
-
memory/1892-168-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/1892-188-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/1892-174-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/1892-176-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/1892-171-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/1892-170-0x0000000004FD0000-0x0000000004FE0000-memory.dmpFilesize
64KB
-
memory/1892-178-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/1892-180-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/1892-182-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/1892-192-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/1892-194-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/1892-190-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/1892-198-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/1892-196-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/1892-204-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/1892-206-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/1892-202-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/1892-208-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/1892-210-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/1892-200-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/1892-212-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/1892-214-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/1892-216-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/1892-172-0x0000000004FD0000-0x0000000004FE0000-memory.dmpFilesize
64KB
-
memory/1892-186-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/1892-184-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/1892-2302-0x0000000004FD0000-0x0000000004FE0000-memory.dmpFilesize
64KB
-
memory/1892-2301-0x0000000004FD0000-0x0000000004FE0000-memory.dmpFilesize
64KB
-
memory/1892-2300-0x0000000004FD0000-0x0000000004FE0000-memory.dmpFilesize
64KB
-
memory/1892-167-0x0000000004FD0000-0x0000000004FE0000-memory.dmpFilesize
64KB
-
memory/1892-165-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/1892-163-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/1892-161-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/1892-2316-0x0000000004FD0000-0x0000000004FE0000-memory.dmpFilesize
64KB
-
memory/1892-151-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/1892-159-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/1892-157-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/1892-153-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/1892-155-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/1892-150-0x0000000004F50000-0x0000000004FB0000-memory.dmpFilesize
384KB
-
memory/1892-149-0x00000000050E0000-0x0000000005684000-memory.dmpFilesize
5.6MB
-
memory/1892-148-0x0000000000820000-0x000000000087B000-memory.dmpFilesize
364KB
-
memory/3792-2327-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/3792-2326-0x0000000000470000-0x00000000004A0000-memory.dmpFilesize
192KB
-
memory/3792-2329-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB