Analysis
-
max time kernel
124s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
07-05-2023 09:02
Static task
static1
Behavioral task
behavioral1
Sample
ffe42fae950ee339dc679dc639ac103d38b9483734edc22d40b5ae855fa58e27.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
ffe42fae950ee339dc679dc639ac103d38b9483734edc22d40b5ae855fa58e27.exe
Resource
win10v2004-20230220-en
General
-
Target
ffe42fae950ee339dc679dc639ac103d38b9483734edc22d40b5ae855fa58e27.exe
-
Size
793KB
-
MD5
d33303beb9deec44b607aaa36b66ddfa
-
SHA1
c9db30d3bb6cf67a23197df4b0dc256a97c70b65
-
SHA256
ffe42fae950ee339dc679dc639ac103d38b9483734edc22d40b5ae855fa58e27
-
SHA512
af4a8f59e6c28795500e4255e835830a5109ec56d3ce38bcbc1e2e8e8c23a2f4ffd1f446450fb65d4b1e4fa2944103b9002d9b8f184cc105e65b4d938d5bc2d1
-
SSDEEP
12288:Zy90Lg9dU2nlQlU1eRvoEmAJJc9WAID082QE4Dj5beAcuz8TuNd0V/:ZyD9y2nlQVRQMMY0NtOj8uQTMO/
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
dork
185.161.248.73:4164
-
auth_value
e81be7d6cfb453cc812e1b4890eeadad
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
Processes:
x03665549.exem96113001.exe1.exen20339921.exepid process 1676 x03665549.exe 1916 m96113001.exe 1780 1.exe 1716 n20339921.exe -
Loads dropped DLL 9 IoCs
Processes:
ffe42fae950ee339dc679dc639ac103d38b9483734edc22d40b5ae855fa58e27.exex03665549.exem96113001.exe1.exen20339921.exepid process 1428 ffe42fae950ee339dc679dc639ac103d38b9483734edc22d40b5ae855fa58e27.exe 1676 x03665549.exe 1676 x03665549.exe 1676 x03665549.exe 1916 m96113001.exe 1916 m96113001.exe 1780 1.exe 1676 x03665549.exe 1716 n20339921.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
ffe42fae950ee339dc679dc639ac103d38b9483734edc22d40b5ae855fa58e27.exex03665549.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce ffe42fae950ee339dc679dc639ac103d38b9483734edc22d40b5ae855fa58e27.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" ffe42fae950ee339dc679dc639ac103d38b9483734edc22d40b5ae855fa58e27.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce x03665549.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x03665549.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
m96113001.exedescription pid process Token: SeDebugPrivilege 1916 m96113001.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
ffe42fae950ee339dc679dc639ac103d38b9483734edc22d40b5ae855fa58e27.exex03665549.exem96113001.exedescription pid process target process PID 1428 wrote to memory of 1676 1428 ffe42fae950ee339dc679dc639ac103d38b9483734edc22d40b5ae855fa58e27.exe x03665549.exe PID 1428 wrote to memory of 1676 1428 ffe42fae950ee339dc679dc639ac103d38b9483734edc22d40b5ae855fa58e27.exe x03665549.exe PID 1428 wrote to memory of 1676 1428 ffe42fae950ee339dc679dc639ac103d38b9483734edc22d40b5ae855fa58e27.exe x03665549.exe PID 1428 wrote to memory of 1676 1428 ffe42fae950ee339dc679dc639ac103d38b9483734edc22d40b5ae855fa58e27.exe x03665549.exe PID 1428 wrote to memory of 1676 1428 ffe42fae950ee339dc679dc639ac103d38b9483734edc22d40b5ae855fa58e27.exe x03665549.exe PID 1428 wrote to memory of 1676 1428 ffe42fae950ee339dc679dc639ac103d38b9483734edc22d40b5ae855fa58e27.exe x03665549.exe PID 1428 wrote to memory of 1676 1428 ffe42fae950ee339dc679dc639ac103d38b9483734edc22d40b5ae855fa58e27.exe x03665549.exe PID 1676 wrote to memory of 1916 1676 x03665549.exe m96113001.exe PID 1676 wrote to memory of 1916 1676 x03665549.exe m96113001.exe PID 1676 wrote to memory of 1916 1676 x03665549.exe m96113001.exe PID 1676 wrote to memory of 1916 1676 x03665549.exe m96113001.exe PID 1676 wrote to memory of 1916 1676 x03665549.exe m96113001.exe PID 1676 wrote to memory of 1916 1676 x03665549.exe m96113001.exe PID 1676 wrote to memory of 1916 1676 x03665549.exe m96113001.exe PID 1916 wrote to memory of 1780 1916 m96113001.exe 1.exe PID 1916 wrote to memory of 1780 1916 m96113001.exe 1.exe PID 1916 wrote to memory of 1780 1916 m96113001.exe 1.exe PID 1916 wrote to memory of 1780 1916 m96113001.exe 1.exe PID 1916 wrote to memory of 1780 1916 m96113001.exe 1.exe PID 1916 wrote to memory of 1780 1916 m96113001.exe 1.exe PID 1916 wrote to memory of 1780 1916 m96113001.exe 1.exe PID 1676 wrote to memory of 1716 1676 x03665549.exe n20339921.exe PID 1676 wrote to memory of 1716 1676 x03665549.exe n20339921.exe PID 1676 wrote to memory of 1716 1676 x03665549.exe n20339921.exe PID 1676 wrote to memory of 1716 1676 x03665549.exe n20339921.exe PID 1676 wrote to memory of 1716 1676 x03665549.exe n20339921.exe PID 1676 wrote to memory of 1716 1676 x03665549.exe n20339921.exe PID 1676 wrote to memory of 1716 1676 x03665549.exe n20339921.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ffe42fae950ee339dc679dc639ac103d38b9483734edc22d40b5ae855fa58e27.exe"C:\Users\Admin\AppData\Local\Temp\ffe42fae950ee339dc679dc639ac103d38b9483734edc22d40b5ae855fa58e27.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x03665549.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x03665549.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m96113001.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m96113001.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n20339921.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n20339921.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x03665549.exeFilesize
589KB
MD55e534fa65278adcbc961f6f38322bcea
SHA1426e472c18a9094705e789085930e4d8970a2f96
SHA256dce8399d3283738f7e98c0be203bc9bd19418022b30397de3a2a9294e96fb290
SHA512422ee5d10809e9f7c579814e9391d39cf39fe8b4a41b21dffadbdabbf65deec7d06a62060cf4113e087e87f08faae69778fa2bbe029946ccdd0b8868742cadf5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x03665549.exeFilesize
589KB
MD55e534fa65278adcbc961f6f38322bcea
SHA1426e472c18a9094705e789085930e4d8970a2f96
SHA256dce8399d3283738f7e98c0be203bc9bd19418022b30397de3a2a9294e96fb290
SHA512422ee5d10809e9f7c579814e9391d39cf39fe8b4a41b21dffadbdabbf65deec7d06a62060cf4113e087e87f08faae69778fa2bbe029946ccdd0b8868742cadf5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m96113001.exeFilesize
529KB
MD575494b4a3e3a6bfae6d4e86c502439ab
SHA1cade4195e2d04207a79e554fac745849e11106a5
SHA25620b46cb43c17ccd3b5cb83ce8649729ab73bc89308beda9aba2f031aa93ea969
SHA512a03e9fef6fef6fe8340af7e3846a883c62a754641868ecd9b923d96dd56fc3aaf98b5d8f9f350af778b52277eaac5f1a8db334f406680659de27f00f629f128b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m96113001.exeFilesize
529KB
MD575494b4a3e3a6bfae6d4e86c502439ab
SHA1cade4195e2d04207a79e554fac745849e11106a5
SHA25620b46cb43c17ccd3b5cb83ce8649729ab73bc89308beda9aba2f031aa93ea969
SHA512a03e9fef6fef6fe8340af7e3846a883c62a754641868ecd9b923d96dd56fc3aaf98b5d8f9f350af778b52277eaac5f1a8db334f406680659de27f00f629f128b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m96113001.exeFilesize
529KB
MD575494b4a3e3a6bfae6d4e86c502439ab
SHA1cade4195e2d04207a79e554fac745849e11106a5
SHA25620b46cb43c17ccd3b5cb83ce8649729ab73bc89308beda9aba2f031aa93ea969
SHA512a03e9fef6fef6fe8340af7e3846a883c62a754641868ecd9b923d96dd56fc3aaf98b5d8f9f350af778b52277eaac5f1a8db334f406680659de27f00f629f128b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n20339921.exeFilesize
168KB
MD507f2fc3bc8e62fee7789bee00d89ece1
SHA1c392b12462a57fa0b7949470516c6d568a051f88
SHA256769690331b5e35fe84ce094529570965d34dbaf6d04058473935ed51d4b340dc
SHA5122e1ddc80d1ce56c8d660273d53411e98ea2c7e4ddf0e6946dc5fb9fcc7fae66471eb51bdb0ba6f4744bff9631e9f4bc62c35ccafc97a451cdac6d2de3b898ad0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n20339921.exeFilesize
168KB
MD507f2fc3bc8e62fee7789bee00d89ece1
SHA1c392b12462a57fa0b7949470516c6d568a051f88
SHA256769690331b5e35fe84ce094529570965d34dbaf6d04058473935ed51d4b340dc
SHA5122e1ddc80d1ce56c8d660273d53411e98ea2c7e4ddf0e6946dc5fb9fcc7fae66471eb51bdb0ba6f4744bff9631e9f4bc62c35ccafc97a451cdac6d2de3b898ad0
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\x03665549.exeFilesize
589KB
MD55e534fa65278adcbc961f6f38322bcea
SHA1426e472c18a9094705e789085930e4d8970a2f96
SHA256dce8399d3283738f7e98c0be203bc9bd19418022b30397de3a2a9294e96fb290
SHA512422ee5d10809e9f7c579814e9391d39cf39fe8b4a41b21dffadbdabbf65deec7d06a62060cf4113e087e87f08faae69778fa2bbe029946ccdd0b8868742cadf5
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\x03665549.exeFilesize
589KB
MD55e534fa65278adcbc961f6f38322bcea
SHA1426e472c18a9094705e789085930e4d8970a2f96
SHA256dce8399d3283738f7e98c0be203bc9bd19418022b30397de3a2a9294e96fb290
SHA512422ee5d10809e9f7c579814e9391d39cf39fe8b4a41b21dffadbdabbf65deec7d06a62060cf4113e087e87f08faae69778fa2bbe029946ccdd0b8868742cadf5
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\m96113001.exeFilesize
529KB
MD575494b4a3e3a6bfae6d4e86c502439ab
SHA1cade4195e2d04207a79e554fac745849e11106a5
SHA25620b46cb43c17ccd3b5cb83ce8649729ab73bc89308beda9aba2f031aa93ea969
SHA512a03e9fef6fef6fe8340af7e3846a883c62a754641868ecd9b923d96dd56fc3aaf98b5d8f9f350af778b52277eaac5f1a8db334f406680659de27f00f629f128b
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\m96113001.exeFilesize
529KB
MD575494b4a3e3a6bfae6d4e86c502439ab
SHA1cade4195e2d04207a79e554fac745849e11106a5
SHA25620b46cb43c17ccd3b5cb83ce8649729ab73bc89308beda9aba2f031aa93ea969
SHA512a03e9fef6fef6fe8340af7e3846a883c62a754641868ecd9b923d96dd56fc3aaf98b5d8f9f350af778b52277eaac5f1a8db334f406680659de27f00f629f128b
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\m96113001.exeFilesize
529KB
MD575494b4a3e3a6bfae6d4e86c502439ab
SHA1cade4195e2d04207a79e554fac745849e11106a5
SHA25620b46cb43c17ccd3b5cb83ce8649729ab73bc89308beda9aba2f031aa93ea969
SHA512a03e9fef6fef6fe8340af7e3846a883c62a754641868ecd9b923d96dd56fc3aaf98b5d8f9f350af778b52277eaac5f1a8db334f406680659de27f00f629f128b
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\n20339921.exeFilesize
168KB
MD507f2fc3bc8e62fee7789bee00d89ece1
SHA1c392b12462a57fa0b7949470516c6d568a051f88
SHA256769690331b5e35fe84ce094529570965d34dbaf6d04058473935ed51d4b340dc
SHA5122e1ddc80d1ce56c8d660273d53411e98ea2c7e4ddf0e6946dc5fb9fcc7fae66471eb51bdb0ba6f4744bff9631e9f4bc62c35ccafc97a451cdac6d2de3b898ad0
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\n20339921.exeFilesize
168KB
MD507f2fc3bc8e62fee7789bee00d89ece1
SHA1c392b12462a57fa0b7949470516c6d568a051f88
SHA256769690331b5e35fe84ce094529570965d34dbaf6d04058473935ed51d4b340dc
SHA5122e1ddc80d1ce56c8d660273d53411e98ea2c7e4ddf0e6946dc5fb9fcc7fae66471eb51bdb0ba6f4744bff9631e9f4bc62c35ccafc97a451cdac6d2de3b898ad0
-
\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
memory/1716-2247-0x0000000000370000-0x0000000000376000-memory.dmpFilesize
24KB
-
memory/1716-2246-0x0000000000D90000-0x0000000000DC0000-memory.dmpFilesize
192KB
-
memory/1716-2248-0x0000000000500000-0x0000000000540000-memory.dmpFilesize
256KB
-
memory/1716-2250-0x0000000000500000-0x0000000000540000-memory.dmpFilesize
256KB
-
memory/1780-2243-0x0000000000360000-0x0000000000366000-memory.dmpFilesize
24KB
-
memory/1780-2249-0x0000000000A60000-0x0000000000AA0000-memory.dmpFilesize
256KB
-
memory/1780-2238-0x0000000001390000-0x00000000013BE000-memory.dmpFilesize
184KB
-
memory/1780-2251-0x0000000000A60000-0x0000000000AA0000-memory.dmpFilesize
256KB
-
memory/1916-85-0x00000000050E0000-0x0000000005140000-memory.dmpFilesize
384KB
-
memory/1916-143-0x00000000050E0000-0x0000000005140000-memory.dmpFilesize
384KB
-
memory/1916-109-0x00000000050E0000-0x0000000005140000-memory.dmpFilesize
384KB
-
memory/1916-115-0x00000000050E0000-0x0000000005140000-memory.dmpFilesize
384KB
-
memory/1916-113-0x00000000050E0000-0x0000000005140000-memory.dmpFilesize
384KB
-
memory/1916-111-0x00000000050E0000-0x0000000005140000-memory.dmpFilesize
384KB
-
memory/1916-117-0x00000000050E0000-0x0000000005140000-memory.dmpFilesize
384KB
-
memory/1916-119-0x00000000050E0000-0x0000000005140000-memory.dmpFilesize
384KB
-
memory/1916-121-0x00000000050E0000-0x0000000005140000-memory.dmpFilesize
384KB
-
memory/1916-123-0x00000000050E0000-0x0000000005140000-memory.dmpFilesize
384KB
-
memory/1916-125-0x00000000050E0000-0x0000000005140000-memory.dmpFilesize
384KB
-
memory/1916-127-0x00000000050E0000-0x0000000005140000-memory.dmpFilesize
384KB
-
memory/1916-131-0x00000000050E0000-0x0000000005140000-memory.dmpFilesize
384KB
-
memory/1916-129-0x00000000050E0000-0x0000000005140000-memory.dmpFilesize
384KB
-
memory/1916-135-0x00000000050E0000-0x0000000005140000-memory.dmpFilesize
384KB
-
memory/1916-133-0x00000000050E0000-0x0000000005140000-memory.dmpFilesize
384KB
-
memory/1916-137-0x00000000050E0000-0x0000000005140000-memory.dmpFilesize
384KB
-
memory/1916-139-0x00000000050E0000-0x0000000005140000-memory.dmpFilesize
384KB
-
memory/1916-141-0x00000000050E0000-0x0000000005140000-memory.dmpFilesize
384KB
-
memory/1916-107-0x00000000050E0000-0x0000000005140000-memory.dmpFilesize
384KB
-
memory/1916-145-0x00000000050E0000-0x0000000005140000-memory.dmpFilesize
384KB
-
memory/1916-2228-0x0000000002750000-0x0000000002782000-memory.dmpFilesize
200KB
-
memory/1916-103-0x00000000050E0000-0x0000000005140000-memory.dmpFilesize
384KB
-
memory/1916-105-0x00000000050E0000-0x0000000005140000-memory.dmpFilesize
384KB
-
memory/1916-101-0x00000000050E0000-0x0000000005140000-memory.dmpFilesize
384KB
-
memory/1916-99-0x00000000050E0000-0x0000000005140000-memory.dmpFilesize
384KB
-
memory/1916-97-0x00000000050E0000-0x0000000005140000-memory.dmpFilesize
384KB
-
memory/1916-95-0x00000000050E0000-0x0000000005140000-memory.dmpFilesize
384KB
-
memory/1916-93-0x00000000050E0000-0x0000000005140000-memory.dmpFilesize
384KB
-
memory/1916-91-0x00000000050E0000-0x0000000005140000-memory.dmpFilesize
384KB
-
memory/1916-89-0x00000000050E0000-0x0000000005140000-memory.dmpFilesize
384KB
-
memory/1916-87-0x00000000050E0000-0x0000000005140000-memory.dmpFilesize
384KB
-
memory/1916-83-0x00000000050E0000-0x0000000005140000-memory.dmpFilesize
384KB
-
memory/1916-82-0x00000000050E0000-0x0000000005140000-memory.dmpFilesize
384KB
-
memory/1916-81-0x00000000050E0000-0x0000000005146000-memory.dmpFilesize
408KB
-
memory/1916-80-0x0000000005030000-0x0000000005070000-memory.dmpFilesize
256KB
-
memory/1916-79-0x00000000002C0000-0x000000000031B000-memory.dmpFilesize
364KB
-
memory/1916-78-0x0000000005070000-0x00000000050D8000-memory.dmpFilesize
416KB