Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2023 08:55
Static task
static1
Behavioral task
behavioral1
Sample
fde3abeb1ebd5d78b5a15bb1dc2f0cdfd9a5f6edc5ea7b15cbcee435063100f8.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
fde3abeb1ebd5d78b5a15bb1dc2f0cdfd9a5f6edc5ea7b15cbcee435063100f8.exe
Resource
win10v2004-20230220-en
General
-
Target
fde3abeb1ebd5d78b5a15bb1dc2f0cdfd9a5f6edc5ea7b15cbcee435063100f8.exe
-
Size
783KB
-
MD5
af48de321abd875ace116cb993804da3
-
SHA1
e61f246c71280b1bb41a1ba93f3dc45f6d64d530
-
SHA256
fde3abeb1ebd5d78b5a15bb1dc2f0cdfd9a5f6edc5ea7b15cbcee435063100f8
-
SHA512
efbda5b1cad7b362edfd82097bf81ecc9667d812779244edb7102da48f4be896ed4b0fc6b6df1b9bdd1ddf5a9202096b45cc47e182cbd1db8ca361fdfc95f406
-
SSDEEP
12288:ky90vB77ggWRZNoFOrHHXIQHDHgZgsxzRQyBkwugKpcitAPTP+M:kyiBPg7rNa+HHXIQjHg2sXkwFLUAz
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
dark
185.161.248.73:4164
-
auth_value
ae85b01f66afe8770afeed560513fc2d
Signatures
-
Detects Redline Stealer samples 1 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
Processes:
resource yara_rule behavioral2/memory/4800-2313-0x0000000005A00000-0x0000000006018000-memory.dmp redline_stealer -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
m09818457.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation m09818457.exe -
Executes dropped EXE 4 IoCs
Processes:
x49831610.exem09818457.exe1.exen63419538.exepid process 4240 x49831610.exe 4560 m09818457.exe 4800 1.exe 5032 n63419538.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
fde3abeb1ebd5d78b5a15bb1dc2f0cdfd9a5f6edc5ea7b15cbcee435063100f8.exex49831610.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" fde3abeb1ebd5d78b5a15bb1dc2f0cdfd9a5f6edc5ea7b15cbcee435063100f8.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce x49831610.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x49831610.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce fde3abeb1ebd5d78b5a15bb1dc2f0cdfd9a5f6edc5ea7b15cbcee435063100f8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4228 4560 WerFault.exe m09818457.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
m09818457.exedescription pid process Token: SeDebugPrivilege 4560 m09818457.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
fde3abeb1ebd5d78b5a15bb1dc2f0cdfd9a5f6edc5ea7b15cbcee435063100f8.exex49831610.exem09818457.exedescription pid process target process PID 3448 wrote to memory of 4240 3448 fde3abeb1ebd5d78b5a15bb1dc2f0cdfd9a5f6edc5ea7b15cbcee435063100f8.exe x49831610.exe PID 3448 wrote to memory of 4240 3448 fde3abeb1ebd5d78b5a15bb1dc2f0cdfd9a5f6edc5ea7b15cbcee435063100f8.exe x49831610.exe PID 3448 wrote to memory of 4240 3448 fde3abeb1ebd5d78b5a15bb1dc2f0cdfd9a5f6edc5ea7b15cbcee435063100f8.exe x49831610.exe PID 4240 wrote to memory of 4560 4240 x49831610.exe m09818457.exe PID 4240 wrote to memory of 4560 4240 x49831610.exe m09818457.exe PID 4240 wrote to memory of 4560 4240 x49831610.exe m09818457.exe PID 4560 wrote to memory of 4800 4560 m09818457.exe 1.exe PID 4560 wrote to memory of 4800 4560 m09818457.exe 1.exe PID 4560 wrote to memory of 4800 4560 m09818457.exe 1.exe PID 4240 wrote to memory of 5032 4240 x49831610.exe n63419538.exe PID 4240 wrote to memory of 5032 4240 x49831610.exe n63419538.exe PID 4240 wrote to memory of 5032 4240 x49831610.exe n63419538.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fde3abeb1ebd5d78b5a15bb1dc2f0cdfd9a5f6edc5ea7b15cbcee435063100f8.exe"C:\Users\Admin\AppData\Local\Temp\fde3abeb1ebd5d78b5a15bb1dc2f0cdfd9a5f6edc5ea7b15cbcee435063100f8.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x49831610.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x49831610.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m09818457.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m09818457.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 14444⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n63419538.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n63419538.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4560 -ip 45601⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x49831610.exeFilesize
578KB
MD5fa7e2eed006cfbfd79d160d0c1f5ec0a
SHA1a15f3d9f6dda3e219fc36cc1fd7eeebd40e9683a
SHA256834bf55d4acd63f474a1f300bf45c69a6288f6deb672337f87625d889727f887
SHA512e2f8c2e1d95253bdfca42d5fd6f93ef123aede9dca82064e481ff3d89804cd426412d665d7f0d9a8b4d8bc4411563206814d19c5b7251603e9af281e8d7a6042
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x49831610.exeFilesize
578KB
MD5fa7e2eed006cfbfd79d160d0c1f5ec0a
SHA1a15f3d9f6dda3e219fc36cc1fd7eeebd40e9683a
SHA256834bf55d4acd63f474a1f300bf45c69a6288f6deb672337f87625d889727f887
SHA512e2f8c2e1d95253bdfca42d5fd6f93ef123aede9dca82064e481ff3d89804cd426412d665d7f0d9a8b4d8bc4411563206814d19c5b7251603e9af281e8d7a6042
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m09818457.exeFilesize
575KB
MD5d02105641a55ae4bc4f437a0ff8b1eb9
SHA1735c5a6baff47c3f402b53092dd3eac48e75250b
SHA25611e50390ed3d2dbff6ffab9344cf99cb7e8427532eede50a1db2e737608b7e37
SHA512a726d15961154fa7fe376ca98efe4c689950863247fc87a760dbc8c60945edf3cc38c158af2b58c939fc364c06a4fa729f222984ada2130d03b5c664cb51536d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m09818457.exeFilesize
575KB
MD5d02105641a55ae4bc4f437a0ff8b1eb9
SHA1735c5a6baff47c3f402b53092dd3eac48e75250b
SHA25611e50390ed3d2dbff6ffab9344cf99cb7e8427532eede50a1db2e737608b7e37
SHA512a726d15961154fa7fe376ca98efe4c689950863247fc87a760dbc8c60945edf3cc38c158af2b58c939fc364c06a4fa729f222984ada2130d03b5c664cb51536d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n63419538.exeFilesize
172KB
MD54d18b89f370a9803e03d63fc576762a3
SHA139f7b5a4325ef9d9bbad2d50894958f5fb11fe92
SHA2568097e9a3394b13476680fc0a0c65e5d08e67a10febc8cb6789913c85da5e9e66
SHA512f92fb3216dafe6cb6259704ffbdf4f60126a239f63dd22d2ec46f324675b05308af01b03d3f79b986f2c61bf3ef279d17506904f3f2a0be52c962374e10668cc
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n63419538.exeFilesize
172KB
MD54d18b89f370a9803e03d63fc576762a3
SHA139f7b5a4325ef9d9bbad2d50894958f5fb11fe92
SHA2568097e9a3394b13476680fc0a0c65e5d08e67a10febc8cb6789913c85da5e9e66
SHA512f92fb3216dafe6cb6259704ffbdf4f60126a239f63dd22d2ec46f324675b05308af01b03d3f79b986f2c61bf3ef279d17506904f3f2a0be52c962374e10668cc
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
memory/4560-190-0x0000000005660000-0x00000000056C0000-memory.dmpFilesize
384KB
-
memory/4560-202-0x0000000005660000-0x00000000056C0000-memory.dmpFilesize
384KB
-
memory/4560-156-0x0000000005660000-0x00000000056C0000-memory.dmpFilesize
384KB
-
memory/4560-158-0x0000000005660000-0x00000000056C0000-memory.dmpFilesize
384KB
-
memory/4560-160-0x0000000005660000-0x00000000056C0000-memory.dmpFilesize
384KB
-
memory/4560-162-0x0000000005660000-0x00000000056C0000-memory.dmpFilesize
384KB
-
memory/4560-164-0x0000000005660000-0x00000000056C0000-memory.dmpFilesize
384KB
-
memory/4560-166-0x0000000005660000-0x00000000056C0000-memory.dmpFilesize
384KB
-
memory/4560-168-0x0000000005660000-0x00000000056C0000-memory.dmpFilesize
384KB
-
memory/4560-170-0x0000000005660000-0x00000000056C0000-memory.dmpFilesize
384KB
-
memory/4560-172-0x0000000005660000-0x00000000056C0000-memory.dmpFilesize
384KB
-
memory/4560-174-0x0000000005660000-0x00000000056C0000-memory.dmpFilesize
384KB
-
memory/4560-176-0x0000000005660000-0x00000000056C0000-memory.dmpFilesize
384KB
-
memory/4560-178-0x0000000005660000-0x00000000056C0000-memory.dmpFilesize
384KB
-
memory/4560-180-0x0000000005660000-0x00000000056C0000-memory.dmpFilesize
384KB
-
memory/4560-182-0x0000000005660000-0x00000000056C0000-memory.dmpFilesize
384KB
-
memory/4560-184-0x0000000005660000-0x00000000056C0000-memory.dmpFilesize
384KB
-
memory/4560-186-0x0000000005660000-0x00000000056C0000-memory.dmpFilesize
384KB
-
memory/4560-188-0x0000000005660000-0x00000000056C0000-memory.dmpFilesize
384KB
-
memory/4560-153-0x0000000005660000-0x00000000056C0000-memory.dmpFilesize
384KB
-
memory/4560-192-0x0000000005660000-0x00000000056C0000-memory.dmpFilesize
384KB
-
memory/4560-194-0x0000000005660000-0x00000000056C0000-memory.dmpFilesize
384KB
-
memory/4560-196-0x0000000005660000-0x00000000056C0000-memory.dmpFilesize
384KB
-
memory/4560-198-0x0000000005660000-0x00000000056C0000-memory.dmpFilesize
384KB
-
memory/4560-200-0x0000000005660000-0x00000000056C0000-memory.dmpFilesize
384KB
-
memory/4560-154-0x0000000005660000-0x00000000056C0000-memory.dmpFilesize
384KB
-
memory/4560-204-0x0000000005660000-0x00000000056C0000-memory.dmpFilesize
384KB
-
memory/4560-206-0x0000000005660000-0x00000000056C0000-memory.dmpFilesize
384KB
-
memory/4560-208-0x0000000005660000-0x00000000056C0000-memory.dmpFilesize
384KB
-
memory/4560-210-0x0000000005660000-0x00000000056C0000-memory.dmpFilesize
384KB
-
memory/4560-212-0x0000000005660000-0x00000000056C0000-memory.dmpFilesize
384KB
-
memory/4560-214-0x0000000005660000-0x00000000056C0000-memory.dmpFilesize
384KB
-
memory/4560-216-0x0000000005660000-0x00000000056C0000-memory.dmpFilesize
384KB
-
memory/4560-2300-0x0000000005060000-0x0000000005070000-memory.dmpFilesize
64KB
-
memory/4560-152-0x0000000005060000-0x0000000005070000-memory.dmpFilesize
64KB
-
memory/4560-151-0x0000000005060000-0x0000000005070000-memory.dmpFilesize
64KB
-
memory/4560-150-0x0000000005060000-0x0000000005070000-memory.dmpFilesize
64KB
-
memory/4560-148-0x0000000000840000-0x000000000089B000-memory.dmpFilesize
364KB
-
memory/4560-149-0x0000000005070000-0x0000000005614000-memory.dmpFilesize
5.6MB
-
memory/4800-2314-0x00000000054F0000-0x00000000055FA000-memory.dmpFilesize
1.0MB
-
memory/4800-2315-0x0000000005390000-0x00000000053A2000-memory.dmpFilesize
72KB
-
memory/4800-2316-0x0000000005420000-0x000000000545C000-memory.dmpFilesize
240KB
-
memory/4800-2318-0x00000000053D0000-0x00000000053E0000-memory.dmpFilesize
64KB
-
memory/4800-2313-0x0000000005A00000-0x0000000006018000-memory.dmpFilesize
6.1MB
-
memory/4800-2312-0x0000000000A50000-0x0000000000A7E000-memory.dmpFilesize
184KB
-
memory/4800-2325-0x00000000053D0000-0x00000000053E0000-memory.dmpFilesize
64KB
-
memory/5032-2323-0x0000000000750000-0x0000000000780000-memory.dmpFilesize
192KB
-
memory/5032-2324-0x00000000050B0000-0x00000000050C0000-memory.dmpFilesize
64KB
-
memory/5032-2326-0x00000000050B0000-0x00000000050C0000-memory.dmpFilesize
64KB