Analysis
-
max time kernel
152s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2023 08:56
Static task
static1
Behavioral task
behavioral1
Sample
fe170fe6e49af8e9674e5dca56a0e85d140fe34acef70bef0ffe1b7376556001.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
fe170fe6e49af8e9674e5dca56a0e85d140fe34acef70bef0ffe1b7376556001.exe
Resource
win10v2004-20230221-en
General
-
Target
fe170fe6e49af8e9674e5dca56a0e85d140fe34acef70bef0ffe1b7376556001.exe
-
Size
795KB
-
MD5
b892afeb1ce4ab22ed605925d01efaf9
-
SHA1
81cdecc07f60373bfe2cef24ad651eb4ad6de2bf
-
SHA256
fe170fe6e49af8e9674e5dca56a0e85d140fe34acef70bef0ffe1b7376556001
-
SHA512
5fc72ec4c05471ba073394bb5b74939a696ff15cb729db509b964df5a2f57d40324c2d2b89c1d2815ab0995f598da55e249afcbf59766ec412e24c7a897a2c1e
-
SSDEEP
24576:eyygowoVQ39hj+WPn8thhuzGaOoTDH30:tygwa3Pn8thhu1L
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
danko
185.161.248.73:4164
-
auth_value
784d42a6c1eb1a5060b8bcd3696f5f1e
Signatures
-
Detects Redline Stealer samples 1 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
Processes:
resource yara_rule behavioral2/memory/1496-2317-0x000000000AEF0000-0x000000000B508000-memory.dmp redline_stealer -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
m21465780.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation m21465780.exe -
Executes dropped EXE 4 IoCs
Processes:
x42067858.exem21465780.exe1.exen84097109.exepid process 2516 x42067858.exe 4448 m21465780.exe 1496 1.exe 2068 n84097109.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
x42067858.exefe170fe6e49af8e9674e5dca56a0e85d140fe34acef70bef0ffe1b7376556001.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce x42067858.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x42067858.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce fe170fe6e49af8e9674e5dca56a0e85d140fe34acef70bef0ffe1b7376556001.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" fe170fe6e49af8e9674e5dca56a0e85d140fe34acef70bef0ffe1b7376556001.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 616 4448 WerFault.exe m21465780.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
m21465780.exedescription pid process Token: SeDebugPrivilege 4448 m21465780.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
fe170fe6e49af8e9674e5dca56a0e85d140fe34acef70bef0ffe1b7376556001.exex42067858.exem21465780.exedescription pid process target process PID 2008 wrote to memory of 2516 2008 fe170fe6e49af8e9674e5dca56a0e85d140fe34acef70bef0ffe1b7376556001.exe x42067858.exe PID 2008 wrote to memory of 2516 2008 fe170fe6e49af8e9674e5dca56a0e85d140fe34acef70bef0ffe1b7376556001.exe x42067858.exe PID 2008 wrote to memory of 2516 2008 fe170fe6e49af8e9674e5dca56a0e85d140fe34acef70bef0ffe1b7376556001.exe x42067858.exe PID 2516 wrote to memory of 4448 2516 x42067858.exe m21465780.exe PID 2516 wrote to memory of 4448 2516 x42067858.exe m21465780.exe PID 2516 wrote to memory of 4448 2516 x42067858.exe m21465780.exe PID 4448 wrote to memory of 1496 4448 m21465780.exe 1.exe PID 4448 wrote to memory of 1496 4448 m21465780.exe 1.exe PID 4448 wrote to memory of 1496 4448 m21465780.exe 1.exe PID 2516 wrote to memory of 2068 2516 x42067858.exe n84097109.exe PID 2516 wrote to memory of 2068 2516 x42067858.exe n84097109.exe PID 2516 wrote to memory of 2068 2516 x42067858.exe n84097109.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe170fe6e49af8e9674e5dca56a0e85d140fe34acef70bef0ffe1b7376556001.exe"C:\Users\Admin\AppData\Local\Temp\fe170fe6e49af8e9674e5dca56a0e85d140fe34acef70bef0ffe1b7376556001.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x42067858.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x42067858.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m21465780.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m21465780.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 13844⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n84097109.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n84097109.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4448 -ip 44481⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x42067858.exeFilesize
590KB
MD53d10adf2bac8f41df7d5e627ab83e1ea
SHA14bc8ca336e3f0ce84e95edb0ade378080374cede
SHA256ec96634cd2a5df3f967a2760cf19d60d3ad56f7e9a4cf924ef75a02a4f2ddd86
SHA5125f85d3be04812bf242d772c346181e8bb027ff40e604089ce821d3371558cc2f38b93002d0af3b28422e42c684d810cff9dab05c71c02dbb5d9a41786309c10e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x42067858.exeFilesize
590KB
MD53d10adf2bac8f41df7d5e627ab83e1ea
SHA14bc8ca336e3f0ce84e95edb0ade378080374cede
SHA256ec96634cd2a5df3f967a2760cf19d60d3ad56f7e9a4cf924ef75a02a4f2ddd86
SHA5125f85d3be04812bf242d772c346181e8bb027ff40e604089ce821d3371558cc2f38b93002d0af3b28422e42c684d810cff9dab05c71c02dbb5d9a41786309c10e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m21465780.exeFilesize
530KB
MD5b8fa58e6ea85f84dde79210ccf6db1b6
SHA1147e000c7daabba6f0e762037b6452c352e0e339
SHA25608611893e4a6ec951bd1357a90b9fa7daa85d1bf05a46daf7f91bdeb78dd609d
SHA5125e62224b4325852ff70c6c7d288c77b741557ca4001408be1e4b3a168210d39fa92f4a65ef3f45c9bc499ed48d02146c6f456aa75f1140b624c6989c5b435c17
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m21465780.exeFilesize
530KB
MD5b8fa58e6ea85f84dde79210ccf6db1b6
SHA1147e000c7daabba6f0e762037b6452c352e0e339
SHA25608611893e4a6ec951bd1357a90b9fa7daa85d1bf05a46daf7f91bdeb78dd609d
SHA5125e62224b4325852ff70c6c7d288c77b741557ca4001408be1e4b3a168210d39fa92f4a65ef3f45c9bc499ed48d02146c6f456aa75f1140b624c6989c5b435c17
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n84097109.exeFilesize
169KB
MD5ccf0323ce289a61f3fa33a048f0edf66
SHA1114faca0ed97c152132f1fab0d69be465c7888a4
SHA2565e46ba5f413f08c250e662c407f38129d2746d4de85e4b64d8fb7c6540bff035
SHA512b996b2fa523bb3122cd9a83e3f15ac2a6d06f6fffd6ed706bd689c7829fa1613169bd58e71176339e7b21af2a7f73e4be9c2490eebb413fb1eaf89206e136c0a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n84097109.exeFilesize
169KB
MD5ccf0323ce289a61f3fa33a048f0edf66
SHA1114faca0ed97c152132f1fab0d69be465c7888a4
SHA2565e46ba5f413f08c250e662c407f38129d2746d4de85e4b64d8fb7c6540bff035
SHA512b996b2fa523bb3122cd9a83e3f15ac2a6d06f6fffd6ed706bd689c7829fa1613169bd58e71176339e7b21af2a7f73e4be9c2490eebb413fb1eaf89206e136c0a
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
memory/1496-2317-0x000000000AEF0000-0x000000000B508000-memory.dmpFilesize
6.1MB
-
memory/1496-2328-0x0000000005540000-0x0000000005550000-memory.dmpFilesize
64KB
-
memory/1496-2316-0x0000000000B90000-0x0000000000BBE000-memory.dmpFilesize
184KB
-
memory/1496-2321-0x0000000005540000-0x0000000005550000-memory.dmpFilesize
64KB
-
memory/1496-2320-0x000000000A960000-0x000000000A99C000-memory.dmpFilesize
240KB
-
memory/1496-2319-0x000000000A900000-0x000000000A912000-memory.dmpFilesize
72KB
-
memory/1496-2318-0x000000000A9E0000-0x000000000AAEA000-memory.dmpFilesize
1.0MB
-
memory/2068-2327-0x00000000056B0000-0x00000000056C0000-memory.dmpFilesize
64KB
-
memory/2068-2326-0x0000000000CF0000-0x0000000000D20000-memory.dmpFilesize
192KB
-
memory/2068-2329-0x00000000056B0000-0x00000000056C0000-memory.dmpFilesize
64KB
-
memory/4448-184-0x0000000002C30000-0x0000000002C90000-memory.dmpFilesize
384KB
-
memory/4448-204-0x0000000002C30000-0x0000000002C90000-memory.dmpFilesize
384KB
-
memory/4448-166-0x0000000002C30000-0x0000000002C90000-memory.dmpFilesize
384KB
-
memory/4448-168-0x0000000002C30000-0x0000000002C90000-memory.dmpFilesize
384KB
-
memory/4448-170-0x0000000002C30000-0x0000000002C90000-memory.dmpFilesize
384KB
-
memory/4448-172-0x0000000002C30000-0x0000000002C90000-memory.dmpFilesize
384KB
-
memory/4448-174-0x0000000002C30000-0x0000000002C90000-memory.dmpFilesize
384KB
-
memory/4448-176-0x0000000002C30000-0x0000000002C90000-memory.dmpFilesize
384KB
-
memory/4448-178-0x0000000002C30000-0x0000000002C90000-memory.dmpFilesize
384KB
-
memory/4448-180-0x0000000002C30000-0x0000000002C90000-memory.dmpFilesize
384KB
-
memory/4448-182-0x0000000002C30000-0x0000000002C90000-memory.dmpFilesize
384KB
-
memory/4448-162-0x0000000002C30000-0x0000000002C90000-memory.dmpFilesize
384KB
-
memory/4448-186-0x0000000002C30000-0x0000000002C90000-memory.dmpFilesize
384KB
-
memory/4448-188-0x0000000002C30000-0x0000000002C90000-memory.dmpFilesize
384KB
-
memory/4448-190-0x0000000002C30000-0x0000000002C90000-memory.dmpFilesize
384KB
-
memory/4448-192-0x0000000002C30000-0x0000000002C90000-memory.dmpFilesize
384KB
-
memory/4448-194-0x0000000002C30000-0x0000000002C90000-memory.dmpFilesize
384KB
-
memory/4448-196-0x0000000002C30000-0x0000000002C90000-memory.dmpFilesize
384KB
-
memory/4448-198-0x0000000002C30000-0x0000000002C90000-memory.dmpFilesize
384KB
-
memory/4448-200-0x0000000002C30000-0x0000000002C90000-memory.dmpFilesize
384KB
-
memory/4448-202-0x0000000002C30000-0x0000000002C90000-memory.dmpFilesize
384KB
-
memory/4448-164-0x0000000002C30000-0x0000000002C90000-memory.dmpFilesize
384KB
-
memory/4448-206-0x0000000002C30000-0x0000000002C90000-memory.dmpFilesize
384KB
-
memory/4448-208-0x0000000002C30000-0x0000000002C90000-memory.dmpFilesize
384KB
-
memory/4448-210-0x0000000002C30000-0x0000000002C90000-memory.dmpFilesize
384KB
-
memory/4448-212-0x0000000002C30000-0x0000000002C90000-memory.dmpFilesize
384KB
-
memory/4448-214-0x0000000002C30000-0x0000000002C90000-memory.dmpFilesize
384KB
-
memory/4448-216-0x0000000002C30000-0x0000000002C90000-memory.dmpFilesize
384KB
-
memory/4448-160-0x0000000002C30000-0x0000000002C90000-memory.dmpFilesize
384KB
-
memory/4448-158-0x0000000002C30000-0x0000000002C90000-memory.dmpFilesize
384KB
-
memory/4448-156-0x0000000002C30000-0x0000000002C90000-memory.dmpFilesize
384KB
-
memory/4448-154-0x0000000002C30000-0x0000000002C90000-memory.dmpFilesize
384KB
-
memory/4448-153-0x0000000002C30000-0x0000000002C90000-memory.dmpFilesize
384KB
-
memory/4448-152-0x0000000005280000-0x0000000005290000-memory.dmpFilesize
64KB
-
memory/4448-151-0x0000000005280000-0x0000000005290000-memory.dmpFilesize
64KB
-
memory/4448-150-0x0000000005290000-0x0000000005834000-memory.dmpFilesize
5.6MB
-
memory/4448-149-0x0000000005280000-0x0000000005290000-memory.dmpFilesize
64KB
-
memory/4448-148-0x00000000026F0000-0x000000000274B000-memory.dmpFilesize
364KB
-
memory/4448-2300-0x0000000005280000-0x0000000005290000-memory.dmpFilesize
64KB
-
memory/4448-2302-0x0000000005280000-0x0000000005290000-memory.dmpFilesize
64KB
-
memory/4448-2310-0x0000000005280000-0x0000000005290000-memory.dmpFilesize
64KB
-
memory/4448-2311-0x0000000005280000-0x0000000005290000-memory.dmpFilesize
64KB