Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2023 08:59
Static task
static1
Behavioral task
behavioral1
Sample
fed12116ecd4d628acaa6480cfe6eede063115d584e937c6238ca95c6c7263e4.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
fed12116ecd4d628acaa6480cfe6eede063115d584e937c6238ca95c6c7263e4.exe
Resource
win10v2004-20230220-en
General
-
Target
fed12116ecd4d628acaa6480cfe6eede063115d584e937c6238ca95c6c7263e4.exe
-
Size
891KB
-
MD5
2804c66763de88b634d5271e0284b82e
-
SHA1
8a11cd5e916dd7381010078b5da51d6dd142ae40
-
SHA256
fed12116ecd4d628acaa6480cfe6eede063115d584e937c6238ca95c6c7263e4
-
SHA512
d62e94d5f83ea2a8d77f8df5ecd260f400bce97f0c6ed9b780a9045382d9b288ae667b732d0393d4bf28be6c18a3955c9523d3d430e606c6ee0727365a62e215
-
SSDEEP
12288:ky9048KKxc0oKDnSPkAnaPF6iUsCQrgC5QcfCRAgT+OC9XtsnkVd/ybEE:ky2cNPJnaPF6iUsCQcVKOC9ZfKbEE
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
dork
185.161.248.73:4164
-
auth_value
e81be7d6cfb453cc812e1b4890eeadad
Signatures
-
Detects Redline Stealer samples 1 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
Processes:
resource yara_rule behavioral2/memory/3396-2314-0x00000000055E0000-0x0000000005BF8000-memory.dmp redline_stealer -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
p60311300.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation p60311300.exe -
Executes dropped EXE 4 IoCs
Processes:
y02122831.exep60311300.exe1.exer71109936.exepid process 2984 y02122831.exe 812 p60311300.exe 3396 1.exe 4560 r71109936.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
y02122831.exefed12116ecd4d628acaa6480cfe6eede063115d584e937c6238ca95c6c7263e4.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y02122831.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce fed12116ecd4d628acaa6480cfe6eede063115d584e937c6238ca95c6c7263e4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" fed12116ecd4d628acaa6480cfe6eede063115d584e937c6238ca95c6c7263e4.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce y02122831.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 112 812 WerFault.exe p60311300.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
p60311300.exedescription pid process Token: SeDebugPrivilege 812 p60311300.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
fed12116ecd4d628acaa6480cfe6eede063115d584e937c6238ca95c6c7263e4.exey02122831.exep60311300.exedescription pid process target process PID 4268 wrote to memory of 2984 4268 fed12116ecd4d628acaa6480cfe6eede063115d584e937c6238ca95c6c7263e4.exe y02122831.exe PID 4268 wrote to memory of 2984 4268 fed12116ecd4d628acaa6480cfe6eede063115d584e937c6238ca95c6c7263e4.exe y02122831.exe PID 4268 wrote to memory of 2984 4268 fed12116ecd4d628acaa6480cfe6eede063115d584e937c6238ca95c6c7263e4.exe y02122831.exe PID 2984 wrote to memory of 812 2984 y02122831.exe p60311300.exe PID 2984 wrote to memory of 812 2984 y02122831.exe p60311300.exe PID 2984 wrote to memory of 812 2984 y02122831.exe p60311300.exe PID 812 wrote to memory of 3396 812 p60311300.exe 1.exe PID 812 wrote to memory of 3396 812 p60311300.exe 1.exe PID 812 wrote to memory of 3396 812 p60311300.exe 1.exe PID 2984 wrote to memory of 4560 2984 y02122831.exe r71109936.exe PID 2984 wrote to memory of 4560 2984 y02122831.exe r71109936.exe PID 2984 wrote to memory of 4560 2984 y02122831.exe r71109936.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fed12116ecd4d628acaa6480cfe6eede063115d584e937c6238ca95c6c7263e4.exe"C:\Users\Admin\AppData\Local\Temp\fed12116ecd4d628acaa6480cfe6eede063115d584e937c6238ca95c6c7263e4.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y02122831.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y02122831.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p60311300.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p60311300.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 812 -s 13844⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r71109936.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r71109936.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 812 -ip 8121⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y02122831.exeFilesize
590KB
MD59fed9eda930149ab4b1c26ac56873be6
SHA18b81d0b9b2e12cb61b78b5f1845258010eca7863
SHA256e8536a80e26be726aa74b6ff0890249e2642201989e164990f21b031c42a816c
SHA512642128eec6c68dbac65e64bf9287f97672671e25ff9cc9670f23c80cf98ccd115d80d14c0d4778f492e912730087f982657b1c9026fc4d5e60cd235abd70a36d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y02122831.exeFilesize
590KB
MD59fed9eda930149ab4b1c26ac56873be6
SHA18b81d0b9b2e12cb61b78b5f1845258010eca7863
SHA256e8536a80e26be726aa74b6ff0890249e2642201989e164990f21b031c42a816c
SHA512642128eec6c68dbac65e64bf9287f97672671e25ff9cc9670f23c80cf98ccd115d80d14c0d4778f492e912730087f982657b1c9026fc4d5e60cd235abd70a36d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p60311300.exeFilesize
530KB
MD53a0fc439f91883b1792228c687b5eb7b
SHA19d785caea105f68b67a2ad088e58066d9196e44f
SHA25668b4970070b2ad2b33ccb81e5659f71fa14a0ce29baa35e27a6b92bb0d931a72
SHA51235790bf92c61f14ec19823e8af1bf027d4c24d4f404bd08eb63f7a4a00e906df9aba200f1665a6054c53999626223b589bf2247d64e6aa6058f399637e835ca9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p60311300.exeFilesize
530KB
MD53a0fc439f91883b1792228c687b5eb7b
SHA19d785caea105f68b67a2ad088e58066d9196e44f
SHA25668b4970070b2ad2b33ccb81e5659f71fa14a0ce29baa35e27a6b92bb0d931a72
SHA51235790bf92c61f14ec19823e8af1bf027d4c24d4f404bd08eb63f7a4a00e906df9aba200f1665a6054c53999626223b589bf2247d64e6aa6058f399637e835ca9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r71109936.exeFilesize
168KB
MD5d87d61daf62274e2a3372e9ecb4c8c30
SHA1121cd4f5bd449ac29eb5d01985195b9b946698ac
SHA256f5b316511dddc331c750dc622ab1a3eaca1536f4c02b5c4e941bd5c0e7c7824c
SHA5124acb4d473431fb11bfe92e41e2eeea792967ff0845bde0c71f4373b5a8876c6d86a240adc606fe8788425317ee2294b2b9bef07dbe51bc8b06d76ec4dbb9f7c7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r71109936.exeFilesize
168KB
MD5d87d61daf62274e2a3372e9ecb4c8c30
SHA1121cd4f5bd449ac29eb5d01985195b9b946698ac
SHA256f5b316511dddc331c750dc622ab1a3eaca1536f4c02b5c4e941bd5c0e7c7824c
SHA5124acb4d473431fb11bfe92e41e2eeea792967ff0845bde0c71f4373b5a8876c6d86a240adc606fe8788425317ee2294b2b9bef07dbe51bc8b06d76ec4dbb9f7c7
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
memory/812-194-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/812-202-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/812-156-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/812-158-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/812-160-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/812-162-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/812-164-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/812-166-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/812-168-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/812-170-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/812-172-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/812-174-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/812-176-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/812-178-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/812-180-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/812-182-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/812-184-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/812-186-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/812-188-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/812-190-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/812-192-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/812-152-0x0000000002AC0000-0x0000000002AD0000-memory.dmpFilesize
64KB
-
memory/812-196-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/812-198-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/812-200-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/812-154-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/812-204-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/812-206-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/812-208-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/812-210-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/812-214-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/812-212-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/812-216-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/812-153-0x0000000005740000-0x00000000057A0000-memory.dmpFilesize
384KB
-
memory/812-151-0x0000000002AC0000-0x0000000002AD0000-memory.dmpFilesize
64KB
-
memory/812-150-0x0000000005190000-0x0000000005734000-memory.dmpFilesize
5.6MB
-
memory/812-148-0x0000000002700000-0x000000000275B000-memory.dmpFilesize
364KB
-
memory/812-2313-0x0000000002AC0000-0x0000000002AD0000-memory.dmpFilesize
64KB
-
memory/812-149-0x0000000002AC0000-0x0000000002AD0000-memory.dmpFilesize
64KB
-
memory/812-2320-0x0000000002AC0000-0x0000000002AD0000-memory.dmpFilesize
64KB
-
memory/812-2319-0x0000000002AC0000-0x0000000002AD0000-memory.dmpFilesize
64KB
-
memory/3396-2317-0x0000000005040000-0x000000000507C000-memory.dmpFilesize
240KB
-
memory/3396-2318-0x0000000004EB0000-0x0000000004EC0000-memory.dmpFilesize
64KB
-
memory/3396-2316-0x0000000004FE0000-0x0000000004FF2000-memory.dmpFilesize
72KB
-
memory/3396-2315-0x00000000050D0000-0x00000000051DA000-memory.dmpFilesize
1.0MB
-
memory/3396-2314-0x00000000055E0000-0x0000000005BF8000-memory.dmpFilesize
6.1MB
-
memory/3396-2312-0x0000000000690000-0x00000000006BE000-memory.dmpFilesize
184KB
-
memory/3396-2327-0x0000000004EB0000-0x0000000004EC0000-memory.dmpFilesize
64KB
-
memory/4560-2325-0x0000000000590000-0x00000000005C0000-memory.dmpFilesize
192KB
-
memory/4560-2326-0x0000000004EB0000-0x0000000004EC0000-memory.dmpFilesize
64KB
-
memory/4560-2328-0x0000000004EB0000-0x0000000004EC0000-memory.dmpFilesize
64KB