Analysis
-
max time kernel
125s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
07-05-2023 08:56
Static task
static1
Behavioral task
behavioral1
Sample
fe170fe6e49af8e9674e5dca56a0e85d140fe34acef70bef0ffe1b7376556001.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
fe170fe6e49af8e9674e5dca56a0e85d140fe34acef70bef0ffe1b7376556001.exe
Resource
win10v2004-20230221-en
General
-
Target
fe170fe6e49af8e9674e5dca56a0e85d140fe34acef70bef0ffe1b7376556001.exe
-
Size
795KB
-
MD5
b892afeb1ce4ab22ed605925d01efaf9
-
SHA1
81cdecc07f60373bfe2cef24ad651eb4ad6de2bf
-
SHA256
fe170fe6e49af8e9674e5dca56a0e85d140fe34acef70bef0ffe1b7376556001
-
SHA512
5fc72ec4c05471ba073394bb5b74939a696ff15cb729db509b964df5a2f57d40324c2d2b89c1d2815ab0995f598da55e249afcbf59766ec412e24c7a897a2c1e
-
SSDEEP
24576:eyygowoVQ39hj+WPn8thhuzGaOoTDH30:tygwa3Pn8thhu1L
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
danko
185.161.248.73:4164
-
auth_value
784d42a6c1eb1a5060b8bcd3696f5f1e
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
Processes:
x42067858.exem21465780.exe1.exen84097109.exepid process 1324 x42067858.exe 804 m21465780.exe 364 1.exe 904 n84097109.exe -
Loads dropped DLL 9 IoCs
Processes:
fe170fe6e49af8e9674e5dca56a0e85d140fe34acef70bef0ffe1b7376556001.exex42067858.exem21465780.exe1.exen84097109.exepid process 1308 fe170fe6e49af8e9674e5dca56a0e85d140fe34acef70bef0ffe1b7376556001.exe 1324 x42067858.exe 1324 x42067858.exe 1324 x42067858.exe 804 m21465780.exe 804 m21465780.exe 364 1.exe 1324 x42067858.exe 904 n84097109.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
fe170fe6e49af8e9674e5dca56a0e85d140fe34acef70bef0ffe1b7376556001.exex42067858.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce fe170fe6e49af8e9674e5dca56a0e85d140fe34acef70bef0ffe1b7376556001.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" fe170fe6e49af8e9674e5dca56a0e85d140fe34acef70bef0ffe1b7376556001.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce x42067858.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x42067858.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
m21465780.exedescription pid process Token: SeDebugPrivilege 804 m21465780.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
fe170fe6e49af8e9674e5dca56a0e85d140fe34acef70bef0ffe1b7376556001.exex42067858.exem21465780.exedescription pid process target process PID 1308 wrote to memory of 1324 1308 fe170fe6e49af8e9674e5dca56a0e85d140fe34acef70bef0ffe1b7376556001.exe x42067858.exe PID 1308 wrote to memory of 1324 1308 fe170fe6e49af8e9674e5dca56a0e85d140fe34acef70bef0ffe1b7376556001.exe x42067858.exe PID 1308 wrote to memory of 1324 1308 fe170fe6e49af8e9674e5dca56a0e85d140fe34acef70bef0ffe1b7376556001.exe x42067858.exe PID 1308 wrote to memory of 1324 1308 fe170fe6e49af8e9674e5dca56a0e85d140fe34acef70bef0ffe1b7376556001.exe x42067858.exe PID 1308 wrote to memory of 1324 1308 fe170fe6e49af8e9674e5dca56a0e85d140fe34acef70bef0ffe1b7376556001.exe x42067858.exe PID 1308 wrote to memory of 1324 1308 fe170fe6e49af8e9674e5dca56a0e85d140fe34acef70bef0ffe1b7376556001.exe x42067858.exe PID 1308 wrote to memory of 1324 1308 fe170fe6e49af8e9674e5dca56a0e85d140fe34acef70bef0ffe1b7376556001.exe x42067858.exe PID 1324 wrote to memory of 804 1324 x42067858.exe m21465780.exe PID 1324 wrote to memory of 804 1324 x42067858.exe m21465780.exe PID 1324 wrote to memory of 804 1324 x42067858.exe m21465780.exe PID 1324 wrote to memory of 804 1324 x42067858.exe m21465780.exe PID 1324 wrote to memory of 804 1324 x42067858.exe m21465780.exe PID 1324 wrote to memory of 804 1324 x42067858.exe m21465780.exe PID 1324 wrote to memory of 804 1324 x42067858.exe m21465780.exe PID 804 wrote to memory of 364 804 m21465780.exe 1.exe PID 804 wrote to memory of 364 804 m21465780.exe 1.exe PID 804 wrote to memory of 364 804 m21465780.exe 1.exe PID 804 wrote to memory of 364 804 m21465780.exe 1.exe PID 804 wrote to memory of 364 804 m21465780.exe 1.exe PID 804 wrote to memory of 364 804 m21465780.exe 1.exe PID 804 wrote to memory of 364 804 m21465780.exe 1.exe PID 1324 wrote to memory of 904 1324 x42067858.exe n84097109.exe PID 1324 wrote to memory of 904 1324 x42067858.exe n84097109.exe PID 1324 wrote to memory of 904 1324 x42067858.exe n84097109.exe PID 1324 wrote to memory of 904 1324 x42067858.exe n84097109.exe PID 1324 wrote to memory of 904 1324 x42067858.exe n84097109.exe PID 1324 wrote to memory of 904 1324 x42067858.exe n84097109.exe PID 1324 wrote to memory of 904 1324 x42067858.exe n84097109.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe170fe6e49af8e9674e5dca56a0e85d140fe34acef70bef0ffe1b7376556001.exe"C:\Users\Admin\AppData\Local\Temp\fe170fe6e49af8e9674e5dca56a0e85d140fe34acef70bef0ffe1b7376556001.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x42067858.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x42067858.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m21465780.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m21465780.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n84097109.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n84097109.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x42067858.exeFilesize
590KB
MD53d10adf2bac8f41df7d5e627ab83e1ea
SHA14bc8ca336e3f0ce84e95edb0ade378080374cede
SHA256ec96634cd2a5df3f967a2760cf19d60d3ad56f7e9a4cf924ef75a02a4f2ddd86
SHA5125f85d3be04812bf242d772c346181e8bb027ff40e604089ce821d3371558cc2f38b93002d0af3b28422e42c684d810cff9dab05c71c02dbb5d9a41786309c10e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x42067858.exeFilesize
590KB
MD53d10adf2bac8f41df7d5e627ab83e1ea
SHA14bc8ca336e3f0ce84e95edb0ade378080374cede
SHA256ec96634cd2a5df3f967a2760cf19d60d3ad56f7e9a4cf924ef75a02a4f2ddd86
SHA5125f85d3be04812bf242d772c346181e8bb027ff40e604089ce821d3371558cc2f38b93002d0af3b28422e42c684d810cff9dab05c71c02dbb5d9a41786309c10e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m21465780.exeFilesize
530KB
MD5b8fa58e6ea85f84dde79210ccf6db1b6
SHA1147e000c7daabba6f0e762037b6452c352e0e339
SHA25608611893e4a6ec951bd1357a90b9fa7daa85d1bf05a46daf7f91bdeb78dd609d
SHA5125e62224b4325852ff70c6c7d288c77b741557ca4001408be1e4b3a168210d39fa92f4a65ef3f45c9bc499ed48d02146c6f456aa75f1140b624c6989c5b435c17
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m21465780.exeFilesize
530KB
MD5b8fa58e6ea85f84dde79210ccf6db1b6
SHA1147e000c7daabba6f0e762037b6452c352e0e339
SHA25608611893e4a6ec951bd1357a90b9fa7daa85d1bf05a46daf7f91bdeb78dd609d
SHA5125e62224b4325852ff70c6c7d288c77b741557ca4001408be1e4b3a168210d39fa92f4a65ef3f45c9bc499ed48d02146c6f456aa75f1140b624c6989c5b435c17
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m21465780.exeFilesize
530KB
MD5b8fa58e6ea85f84dde79210ccf6db1b6
SHA1147e000c7daabba6f0e762037b6452c352e0e339
SHA25608611893e4a6ec951bd1357a90b9fa7daa85d1bf05a46daf7f91bdeb78dd609d
SHA5125e62224b4325852ff70c6c7d288c77b741557ca4001408be1e4b3a168210d39fa92f4a65ef3f45c9bc499ed48d02146c6f456aa75f1140b624c6989c5b435c17
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n84097109.exeFilesize
169KB
MD5ccf0323ce289a61f3fa33a048f0edf66
SHA1114faca0ed97c152132f1fab0d69be465c7888a4
SHA2565e46ba5f413f08c250e662c407f38129d2746d4de85e4b64d8fb7c6540bff035
SHA512b996b2fa523bb3122cd9a83e3f15ac2a6d06f6fffd6ed706bd689c7829fa1613169bd58e71176339e7b21af2a7f73e4be9c2490eebb413fb1eaf89206e136c0a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n84097109.exeFilesize
169KB
MD5ccf0323ce289a61f3fa33a048f0edf66
SHA1114faca0ed97c152132f1fab0d69be465c7888a4
SHA2565e46ba5f413f08c250e662c407f38129d2746d4de85e4b64d8fb7c6540bff035
SHA512b996b2fa523bb3122cd9a83e3f15ac2a6d06f6fffd6ed706bd689c7829fa1613169bd58e71176339e7b21af2a7f73e4be9c2490eebb413fb1eaf89206e136c0a
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\x42067858.exeFilesize
590KB
MD53d10adf2bac8f41df7d5e627ab83e1ea
SHA14bc8ca336e3f0ce84e95edb0ade378080374cede
SHA256ec96634cd2a5df3f967a2760cf19d60d3ad56f7e9a4cf924ef75a02a4f2ddd86
SHA5125f85d3be04812bf242d772c346181e8bb027ff40e604089ce821d3371558cc2f38b93002d0af3b28422e42c684d810cff9dab05c71c02dbb5d9a41786309c10e
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\x42067858.exeFilesize
590KB
MD53d10adf2bac8f41df7d5e627ab83e1ea
SHA14bc8ca336e3f0ce84e95edb0ade378080374cede
SHA256ec96634cd2a5df3f967a2760cf19d60d3ad56f7e9a4cf924ef75a02a4f2ddd86
SHA5125f85d3be04812bf242d772c346181e8bb027ff40e604089ce821d3371558cc2f38b93002d0af3b28422e42c684d810cff9dab05c71c02dbb5d9a41786309c10e
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\m21465780.exeFilesize
530KB
MD5b8fa58e6ea85f84dde79210ccf6db1b6
SHA1147e000c7daabba6f0e762037b6452c352e0e339
SHA25608611893e4a6ec951bd1357a90b9fa7daa85d1bf05a46daf7f91bdeb78dd609d
SHA5125e62224b4325852ff70c6c7d288c77b741557ca4001408be1e4b3a168210d39fa92f4a65ef3f45c9bc499ed48d02146c6f456aa75f1140b624c6989c5b435c17
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\m21465780.exeFilesize
530KB
MD5b8fa58e6ea85f84dde79210ccf6db1b6
SHA1147e000c7daabba6f0e762037b6452c352e0e339
SHA25608611893e4a6ec951bd1357a90b9fa7daa85d1bf05a46daf7f91bdeb78dd609d
SHA5125e62224b4325852ff70c6c7d288c77b741557ca4001408be1e4b3a168210d39fa92f4a65ef3f45c9bc499ed48d02146c6f456aa75f1140b624c6989c5b435c17
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\m21465780.exeFilesize
530KB
MD5b8fa58e6ea85f84dde79210ccf6db1b6
SHA1147e000c7daabba6f0e762037b6452c352e0e339
SHA25608611893e4a6ec951bd1357a90b9fa7daa85d1bf05a46daf7f91bdeb78dd609d
SHA5125e62224b4325852ff70c6c7d288c77b741557ca4001408be1e4b3a168210d39fa92f4a65ef3f45c9bc499ed48d02146c6f456aa75f1140b624c6989c5b435c17
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\n84097109.exeFilesize
169KB
MD5ccf0323ce289a61f3fa33a048f0edf66
SHA1114faca0ed97c152132f1fab0d69be465c7888a4
SHA2565e46ba5f413f08c250e662c407f38129d2746d4de85e4b64d8fb7c6540bff035
SHA512b996b2fa523bb3122cd9a83e3f15ac2a6d06f6fffd6ed706bd689c7829fa1613169bd58e71176339e7b21af2a7f73e4be9c2490eebb413fb1eaf89206e136c0a
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\n84097109.exeFilesize
169KB
MD5ccf0323ce289a61f3fa33a048f0edf66
SHA1114faca0ed97c152132f1fab0d69be465c7888a4
SHA2565e46ba5f413f08c250e662c407f38129d2746d4de85e4b64d8fb7c6540bff035
SHA512b996b2fa523bb3122cd9a83e3f15ac2a6d06f6fffd6ed706bd689c7829fa1613169bd58e71176339e7b21af2a7f73e4be9c2490eebb413fb1eaf89206e136c0a
-
\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
memory/364-2252-0x0000000000BB0000-0x0000000000BF0000-memory.dmpFilesize
256KB
-
memory/364-2250-0x0000000000BB0000-0x0000000000BF0000-memory.dmpFilesize
256KB
-
memory/364-2245-0x0000000000320000-0x0000000000326000-memory.dmpFilesize
24KB
-
memory/364-2240-0x0000000000820000-0x000000000084E000-memory.dmpFilesize
184KB
-
memory/804-118-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/804-138-0x00000000051E0000-0x0000000005220000-memory.dmpFilesize
256KB
-
memory/804-104-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/804-102-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/804-108-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/804-106-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/804-112-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/804-110-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/804-114-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/804-116-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/804-100-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/804-122-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/804-124-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/804-120-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/804-128-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/804-126-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/804-134-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/804-132-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/804-130-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/804-137-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/804-136-0x00000000051E0000-0x0000000005220000-memory.dmpFilesize
256KB
-
memory/804-98-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/804-141-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/804-140-0x00000000051E0000-0x0000000005220000-memory.dmpFilesize
256KB
-
memory/804-143-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/804-145-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/804-147-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/804-2230-0x0000000001280000-0x00000000012B2000-memory.dmpFilesize
200KB
-
memory/804-94-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/804-96-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/804-92-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/804-90-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/804-88-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/804-86-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/804-84-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/804-82-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/804-81-0x00000000028F0000-0x0000000002950000-memory.dmpFilesize
384KB
-
memory/804-78-0x00000000002A0000-0x00000000002FB000-memory.dmpFilesize
364KB
-
memory/804-80-0x00000000028F0000-0x0000000002956000-memory.dmpFilesize
408KB
-
memory/804-79-0x0000000002BC0000-0x0000000002C28000-memory.dmpFilesize
416KB
-
memory/904-2249-0x0000000000330000-0x0000000000336000-memory.dmpFilesize
24KB
-
memory/904-2251-0x0000000000CB0000-0x0000000000CF0000-memory.dmpFilesize
256KB
-
memory/904-2248-0x0000000000D00000-0x0000000000D30000-memory.dmpFilesize
192KB
-
memory/904-2253-0x0000000000CB0000-0x0000000000CF0000-memory.dmpFilesize
256KB