Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
07-05-2023 09:00
Static task
static1
Behavioral task
behavioral1
Sample
ff712edd1f0e1f0d8a592be1707f275fbc10522f7d6e61eaa612e96ded0fbbf2.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
ff712edd1f0e1f0d8a592be1707f275fbc10522f7d6e61eaa612e96ded0fbbf2.exe
Resource
win10v2004-20230220-en
General
-
Target
ff712edd1f0e1f0d8a592be1707f275fbc10522f7d6e61eaa612e96ded0fbbf2.exe
-
Size
773KB
-
MD5
4804a2b6aefae575c048ae3c27119d4e
-
SHA1
f148465558f5ca216396b4309d0b6e1526b7dab5
-
SHA256
ff712edd1f0e1f0d8a592be1707f275fbc10522f7d6e61eaa612e96ded0fbbf2
-
SHA512
9aab853085cc10a4177696e477c06c279dabc1f3af1283ab076d51b59c01b415522775d4954e42cb7115c86cb6e7fd6da8741c15f228dd04179efd4888c0fb06
-
SSDEEP
12288:By90PbQCAC402oxz5iNss/N+P6U39WP25hDbJeZmnKRHlYlT4fNzdEOzida+d:ByM9vgNsSN+P99W8l2HGlT3Iida+d
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
donka
185.161.248.73:4164
-
auth_value
ebd13e189a2e7c34425e5f4c46bb7a55
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
Processes:
x84908061.exem69739828.exe1.exen20021811.exepid process 1716 x84908061.exe 1708 m69739828.exe 856 1.exe 1924 n20021811.exe -
Loads dropped DLL 9 IoCs
Processes:
ff712edd1f0e1f0d8a592be1707f275fbc10522f7d6e61eaa612e96ded0fbbf2.exex84908061.exem69739828.exe1.exen20021811.exepid process 1428 ff712edd1f0e1f0d8a592be1707f275fbc10522f7d6e61eaa612e96ded0fbbf2.exe 1716 x84908061.exe 1716 x84908061.exe 1716 x84908061.exe 1708 m69739828.exe 1708 m69739828.exe 856 1.exe 1716 x84908061.exe 1924 n20021811.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
ff712edd1f0e1f0d8a592be1707f275fbc10522f7d6e61eaa612e96ded0fbbf2.exex84908061.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce ff712edd1f0e1f0d8a592be1707f275fbc10522f7d6e61eaa612e96ded0fbbf2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" ff712edd1f0e1f0d8a592be1707f275fbc10522f7d6e61eaa612e96ded0fbbf2.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce x84908061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x84908061.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
m69739828.exedescription pid process Token: SeDebugPrivilege 1708 m69739828.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
ff712edd1f0e1f0d8a592be1707f275fbc10522f7d6e61eaa612e96ded0fbbf2.exex84908061.exem69739828.exedescription pid process target process PID 1428 wrote to memory of 1716 1428 ff712edd1f0e1f0d8a592be1707f275fbc10522f7d6e61eaa612e96ded0fbbf2.exe x84908061.exe PID 1428 wrote to memory of 1716 1428 ff712edd1f0e1f0d8a592be1707f275fbc10522f7d6e61eaa612e96ded0fbbf2.exe x84908061.exe PID 1428 wrote to memory of 1716 1428 ff712edd1f0e1f0d8a592be1707f275fbc10522f7d6e61eaa612e96ded0fbbf2.exe x84908061.exe PID 1428 wrote to memory of 1716 1428 ff712edd1f0e1f0d8a592be1707f275fbc10522f7d6e61eaa612e96ded0fbbf2.exe x84908061.exe PID 1428 wrote to memory of 1716 1428 ff712edd1f0e1f0d8a592be1707f275fbc10522f7d6e61eaa612e96ded0fbbf2.exe x84908061.exe PID 1428 wrote to memory of 1716 1428 ff712edd1f0e1f0d8a592be1707f275fbc10522f7d6e61eaa612e96ded0fbbf2.exe x84908061.exe PID 1428 wrote to memory of 1716 1428 ff712edd1f0e1f0d8a592be1707f275fbc10522f7d6e61eaa612e96ded0fbbf2.exe x84908061.exe PID 1716 wrote to memory of 1708 1716 x84908061.exe m69739828.exe PID 1716 wrote to memory of 1708 1716 x84908061.exe m69739828.exe PID 1716 wrote to memory of 1708 1716 x84908061.exe m69739828.exe PID 1716 wrote to memory of 1708 1716 x84908061.exe m69739828.exe PID 1716 wrote to memory of 1708 1716 x84908061.exe m69739828.exe PID 1716 wrote to memory of 1708 1716 x84908061.exe m69739828.exe PID 1716 wrote to memory of 1708 1716 x84908061.exe m69739828.exe PID 1708 wrote to memory of 856 1708 m69739828.exe 1.exe PID 1708 wrote to memory of 856 1708 m69739828.exe 1.exe PID 1708 wrote to memory of 856 1708 m69739828.exe 1.exe PID 1708 wrote to memory of 856 1708 m69739828.exe 1.exe PID 1708 wrote to memory of 856 1708 m69739828.exe 1.exe PID 1708 wrote to memory of 856 1708 m69739828.exe 1.exe PID 1708 wrote to memory of 856 1708 m69739828.exe 1.exe PID 1716 wrote to memory of 1924 1716 x84908061.exe n20021811.exe PID 1716 wrote to memory of 1924 1716 x84908061.exe n20021811.exe PID 1716 wrote to memory of 1924 1716 x84908061.exe n20021811.exe PID 1716 wrote to memory of 1924 1716 x84908061.exe n20021811.exe PID 1716 wrote to memory of 1924 1716 x84908061.exe n20021811.exe PID 1716 wrote to memory of 1924 1716 x84908061.exe n20021811.exe PID 1716 wrote to memory of 1924 1716 x84908061.exe n20021811.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff712edd1f0e1f0d8a592be1707f275fbc10522f7d6e61eaa612e96ded0fbbf2.exe"C:\Users\Admin\AppData\Local\Temp\ff712edd1f0e1f0d8a592be1707f275fbc10522f7d6e61eaa612e96ded0fbbf2.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x84908061.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x84908061.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m69739828.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m69739828.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n20021811.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n20021811.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x84908061.exeFilesize
570KB
MD5cc45a49588419c5b9e3fe1f0340f721a
SHA1287b4342405b1ff2673be7c584bdd9bcafddc372
SHA256f8e10cd6b8a4855ffc7a016f8f0c751c36ba436efc1614c23c9be1e25d6955a9
SHA5122a3c2f0c550660e13c83a77037b3d8f639b7ac7fd8c5de533f3c79da7fe4714db30f705bc917fa0dd6df5a1c2a2a431093c62a9cb98ccd6fb92da1dc748f977d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x84908061.exeFilesize
570KB
MD5cc45a49588419c5b9e3fe1f0340f721a
SHA1287b4342405b1ff2673be7c584bdd9bcafddc372
SHA256f8e10cd6b8a4855ffc7a016f8f0c751c36ba436efc1614c23c9be1e25d6955a9
SHA5122a3c2f0c550660e13c83a77037b3d8f639b7ac7fd8c5de533f3c79da7fe4714db30f705bc917fa0dd6df5a1c2a2a431093c62a9cb98ccd6fb92da1dc748f977d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m69739828.exeFilesize
475KB
MD52e52681deb6c262b2adb052933d6416c
SHA17156d595089c686aecdf54bf692b88188fa73c26
SHA256fd657e1d8aded41823a52e89e6521ff31625a6bfbd3a107e2a5f392ffe900406
SHA512a3096bc0b0b6b1989b74383e565e29f766bd46462d75767160f457ebb7b4e5f5c37279551cc60ae81efdb76e8ec794c4ff08395482e56cc2b87b2715dd7b07f8
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m69739828.exeFilesize
475KB
MD52e52681deb6c262b2adb052933d6416c
SHA17156d595089c686aecdf54bf692b88188fa73c26
SHA256fd657e1d8aded41823a52e89e6521ff31625a6bfbd3a107e2a5f392ffe900406
SHA512a3096bc0b0b6b1989b74383e565e29f766bd46462d75767160f457ebb7b4e5f5c37279551cc60ae81efdb76e8ec794c4ff08395482e56cc2b87b2715dd7b07f8
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m69739828.exeFilesize
475KB
MD52e52681deb6c262b2adb052933d6416c
SHA17156d595089c686aecdf54bf692b88188fa73c26
SHA256fd657e1d8aded41823a52e89e6521ff31625a6bfbd3a107e2a5f392ffe900406
SHA512a3096bc0b0b6b1989b74383e565e29f766bd46462d75767160f457ebb7b4e5f5c37279551cc60ae81efdb76e8ec794c4ff08395482e56cc2b87b2715dd7b07f8
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n20021811.exeFilesize
168KB
MD55ac1980a69bd02985cc2b7c3a6fb236c
SHA1657654013a4befcd80364684b951edb19e0b7fda
SHA256f20dafc211983f33d8e2e8299f146d33a0b4f9bfb0c5db9238e9e6d146bcab05
SHA5123f19ee90ca66401b44c25fc4dc580a53c3dcf02068d50aad7c3337000d16c958ea9b3476c5921b1648290c08478a89a2e2e96527116358ca43a74d52f154b3fe
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n20021811.exeFilesize
168KB
MD55ac1980a69bd02985cc2b7c3a6fb236c
SHA1657654013a4befcd80364684b951edb19e0b7fda
SHA256f20dafc211983f33d8e2e8299f146d33a0b4f9bfb0c5db9238e9e6d146bcab05
SHA5123f19ee90ca66401b44c25fc4dc580a53c3dcf02068d50aad7c3337000d16c958ea9b3476c5921b1648290c08478a89a2e2e96527116358ca43a74d52f154b3fe
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\x84908061.exeFilesize
570KB
MD5cc45a49588419c5b9e3fe1f0340f721a
SHA1287b4342405b1ff2673be7c584bdd9bcafddc372
SHA256f8e10cd6b8a4855ffc7a016f8f0c751c36ba436efc1614c23c9be1e25d6955a9
SHA5122a3c2f0c550660e13c83a77037b3d8f639b7ac7fd8c5de533f3c79da7fe4714db30f705bc917fa0dd6df5a1c2a2a431093c62a9cb98ccd6fb92da1dc748f977d
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\x84908061.exeFilesize
570KB
MD5cc45a49588419c5b9e3fe1f0340f721a
SHA1287b4342405b1ff2673be7c584bdd9bcafddc372
SHA256f8e10cd6b8a4855ffc7a016f8f0c751c36ba436efc1614c23c9be1e25d6955a9
SHA5122a3c2f0c550660e13c83a77037b3d8f639b7ac7fd8c5de533f3c79da7fe4714db30f705bc917fa0dd6df5a1c2a2a431093c62a9cb98ccd6fb92da1dc748f977d
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\m69739828.exeFilesize
475KB
MD52e52681deb6c262b2adb052933d6416c
SHA17156d595089c686aecdf54bf692b88188fa73c26
SHA256fd657e1d8aded41823a52e89e6521ff31625a6bfbd3a107e2a5f392ffe900406
SHA512a3096bc0b0b6b1989b74383e565e29f766bd46462d75767160f457ebb7b4e5f5c37279551cc60ae81efdb76e8ec794c4ff08395482e56cc2b87b2715dd7b07f8
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\m69739828.exeFilesize
475KB
MD52e52681deb6c262b2adb052933d6416c
SHA17156d595089c686aecdf54bf692b88188fa73c26
SHA256fd657e1d8aded41823a52e89e6521ff31625a6bfbd3a107e2a5f392ffe900406
SHA512a3096bc0b0b6b1989b74383e565e29f766bd46462d75767160f457ebb7b4e5f5c37279551cc60ae81efdb76e8ec794c4ff08395482e56cc2b87b2715dd7b07f8
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\m69739828.exeFilesize
475KB
MD52e52681deb6c262b2adb052933d6416c
SHA17156d595089c686aecdf54bf692b88188fa73c26
SHA256fd657e1d8aded41823a52e89e6521ff31625a6bfbd3a107e2a5f392ffe900406
SHA512a3096bc0b0b6b1989b74383e565e29f766bd46462d75767160f457ebb7b4e5f5c37279551cc60ae81efdb76e8ec794c4ff08395482e56cc2b87b2715dd7b07f8
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\n20021811.exeFilesize
168KB
MD55ac1980a69bd02985cc2b7c3a6fb236c
SHA1657654013a4befcd80364684b951edb19e0b7fda
SHA256f20dafc211983f33d8e2e8299f146d33a0b4f9bfb0c5db9238e9e6d146bcab05
SHA5123f19ee90ca66401b44c25fc4dc580a53c3dcf02068d50aad7c3337000d16c958ea9b3476c5921b1648290c08478a89a2e2e96527116358ca43a74d52f154b3fe
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\n20021811.exeFilesize
168KB
MD55ac1980a69bd02985cc2b7c3a6fb236c
SHA1657654013a4befcd80364684b951edb19e0b7fda
SHA256f20dafc211983f33d8e2e8299f146d33a0b4f9bfb0c5db9238e9e6d146bcab05
SHA5123f19ee90ca66401b44c25fc4dc580a53c3dcf02068d50aad7c3337000d16c958ea9b3476c5921b1648290c08478a89a2e2e96527116358ca43a74d52f154b3fe
-
\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
memory/856-2240-0x00000000013A0000-0x00000000013CE000-memory.dmpFilesize
184KB
-
memory/856-2249-0x00000000002A0000-0x00000000002A6000-memory.dmpFilesize
24KB
-
memory/856-2250-0x0000000004C30000-0x0000000004C70000-memory.dmpFilesize
256KB
-
memory/856-2252-0x0000000004C30000-0x0000000004C70000-memory.dmpFilesize
256KB
-
memory/1708-113-0x0000000002570000-0x00000000025D0000-memory.dmpFilesize
384KB
-
memory/1708-135-0x0000000002570000-0x00000000025D0000-memory.dmpFilesize
384KB
-
memory/1708-98-0x0000000002570000-0x00000000025D0000-memory.dmpFilesize
384KB
-
memory/1708-97-0x0000000004DF0000-0x0000000004E30000-memory.dmpFilesize
256KB
-
memory/1708-103-0x0000000002570000-0x00000000025D0000-memory.dmpFilesize
384KB
-
memory/1708-101-0x0000000002570000-0x00000000025D0000-memory.dmpFilesize
384KB
-
memory/1708-107-0x0000000002570000-0x00000000025D0000-memory.dmpFilesize
384KB
-
memory/1708-109-0x0000000002570000-0x00000000025D0000-memory.dmpFilesize
384KB
-
memory/1708-105-0x0000000002570000-0x00000000025D0000-memory.dmpFilesize
384KB
-
memory/1708-111-0x0000000002570000-0x00000000025D0000-memory.dmpFilesize
384KB
-
memory/1708-95-0x0000000004DF0000-0x0000000004E30000-memory.dmpFilesize
256KB
-
memory/1708-115-0x0000000002570000-0x00000000025D0000-memory.dmpFilesize
384KB
-
memory/1708-117-0x0000000002570000-0x00000000025D0000-memory.dmpFilesize
384KB
-
memory/1708-121-0x0000000002570000-0x00000000025D0000-memory.dmpFilesize
384KB
-
memory/1708-123-0x0000000002570000-0x00000000025D0000-memory.dmpFilesize
384KB
-
memory/1708-119-0x0000000002570000-0x00000000025D0000-memory.dmpFilesize
384KB
-
memory/1708-127-0x0000000002570000-0x00000000025D0000-memory.dmpFilesize
384KB
-
memory/1708-125-0x0000000002570000-0x00000000025D0000-memory.dmpFilesize
384KB
-
memory/1708-129-0x0000000002570000-0x00000000025D0000-memory.dmpFilesize
384KB
-
memory/1708-131-0x0000000002570000-0x00000000025D0000-memory.dmpFilesize
384KB
-
memory/1708-133-0x0000000002570000-0x00000000025D0000-memory.dmpFilesize
384KB
-
memory/1708-99-0x0000000004DF0000-0x0000000004E30000-memory.dmpFilesize
256KB
-
memory/1708-137-0x0000000002570000-0x00000000025D0000-memory.dmpFilesize
384KB
-
memory/1708-139-0x0000000002570000-0x00000000025D0000-memory.dmpFilesize
384KB
-
memory/1708-141-0x0000000002570000-0x00000000025D0000-memory.dmpFilesize
384KB
-
memory/1708-143-0x0000000002570000-0x00000000025D0000-memory.dmpFilesize
384KB
-
memory/1708-147-0x0000000002570000-0x00000000025D0000-memory.dmpFilesize
384KB
-
memory/1708-145-0x0000000002570000-0x00000000025D0000-memory.dmpFilesize
384KB
-
memory/1708-93-0x0000000000340000-0x000000000039B000-memory.dmpFilesize
364KB
-
memory/1708-94-0x0000000002570000-0x00000000025D0000-memory.dmpFilesize
384KB
-
memory/1708-85-0x0000000002570000-0x00000000025D0000-memory.dmpFilesize
384KB
-
memory/1708-89-0x0000000002570000-0x00000000025D0000-memory.dmpFilesize
384KB
-
memory/1708-91-0x0000000002570000-0x00000000025D0000-memory.dmpFilesize
384KB
-
memory/1708-87-0x0000000002570000-0x00000000025D0000-memory.dmpFilesize
384KB
-
memory/1708-83-0x0000000002570000-0x00000000025D0000-memory.dmpFilesize
384KB
-
memory/1708-81-0x0000000002570000-0x00000000025D0000-memory.dmpFilesize
384KB
-
memory/1708-2230-0x0000000004D50000-0x0000000004D82000-memory.dmpFilesize
200KB
-
memory/1708-78-0x0000000002250000-0x00000000022B8000-memory.dmpFilesize
416KB
-
memory/1708-80-0x0000000002570000-0x00000000025D0000-memory.dmpFilesize
384KB
-
memory/1708-79-0x0000000002570000-0x00000000025D6000-memory.dmpFilesize
408KB
-
memory/1924-2248-0x00000000002A0000-0x00000000002A6000-memory.dmpFilesize
24KB
-
memory/1924-2251-0x0000000004C80000-0x0000000004CC0000-memory.dmpFilesize
256KB
-
memory/1924-2247-0x0000000001170000-0x00000000011A0000-memory.dmpFilesize
192KB
-
memory/1924-2253-0x0000000004C80000-0x0000000004CC0000-memory.dmpFilesize
256KB