Analysis
-
max time kernel
142s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
06-09-2023 19:25
Static task
static1
Behavioral task
behavioral1
Sample
y6467268_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
y6467268_JC.exe
Resource
win10v2004-20230831-en
General
-
Target
y6467268_JC.exe
-
Size
1.4MB
-
MD5
ddb5fe9c48ec02d43fe40e3be0fb6972
-
SHA1
adaa8c52351c2412be289f2179ec5ecd7d5c1fcb
-
SHA256
688dfa93e23ecdf662eab782b42fad8732a4a1fa2d39b0a9be1f0c19efb3ede7
-
SHA512
6f6eb01817abaa514f9d989a0339760ed29e64aba390b2214562f36314c3173275bf0b249c50f613e6560169b99d9151f85f8b2abb544ecc91d01a3e3c9eab7a
-
SSDEEP
24576:lyj3+xivG7etKyElnVkgoog/HvHSqOUc1rPM16pHhVno8/2zoIpqDdfO5Bmbs74s:Aj3+gvGytKyElVjo1PvTOtE1YVvrfdX2
Malware Config
Extracted
amadey
3.87
77.91.68.18/nice/index.php
-
install_dir
b40d11255d
-
install_file
saves.exe
-
strings_key
fa622dfc42544927a6471829ee1fa9fe
Extracted
redline
gena
77.91.124.82:19071
-
auth_value
93c20961cb6b06b2d5781c212db6201e
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
l9391158.exesaves.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4078585466-1563564224-3678410669-1000\Control Panel\International\Geo\Nation l9391158.exe Key value queried \REGISTRY\USER\S-1-5-21-4078585466-1563564224-3678410669-1000\Control Panel\International\Geo\Nation saves.exe -
Executes dropped EXE 8 IoCs
Processes:
y5067832.exey3348048.exel9391158.exesaves.exem9231099.exen9917940.exesaves.exesaves.exepid process 3056 y5067832.exe 2620 y3348048.exe 964 l9391158.exe 4056 saves.exe 236 m9231099.exe 4884 n9917940.exe 4444 saves.exe 1544 saves.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4188 rundll32.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
y6467268_JC.exey5067832.exey3348048.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" y6467268_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y5067832.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" y3348048.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 45 IoCs
Processes:
y6467268_JC.exey5067832.exey3348048.exel9391158.exesaves.execmd.exedescription pid process target process PID 2364 wrote to memory of 3056 2364 y6467268_JC.exe y5067832.exe PID 2364 wrote to memory of 3056 2364 y6467268_JC.exe y5067832.exe PID 2364 wrote to memory of 3056 2364 y6467268_JC.exe y5067832.exe PID 3056 wrote to memory of 2620 3056 y5067832.exe y3348048.exe PID 3056 wrote to memory of 2620 3056 y5067832.exe y3348048.exe PID 3056 wrote to memory of 2620 3056 y5067832.exe y3348048.exe PID 2620 wrote to memory of 964 2620 y3348048.exe l9391158.exe PID 2620 wrote to memory of 964 2620 y3348048.exe l9391158.exe PID 2620 wrote to memory of 964 2620 y3348048.exe l9391158.exe PID 964 wrote to memory of 4056 964 l9391158.exe saves.exe PID 964 wrote to memory of 4056 964 l9391158.exe saves.exe PID 964 wrote to memory of 4056 964 l9391158.exe saves.exe PID 2620 wrote to memory of 236 2620 y3348048.exe m9231099.exe PID 2620 wrote to memory of 236 2620 y3348048.exe m9231099.exe PID 2620 wrote to memory of 236 2620 y3348048.exe m9231099.exe PID 4056 wrote to memory of 756 4056 saves.exe schtasks.exe PID 4056 wrote to memory of 756 4056 saves.exe schtasks.exe PID 4056 wrote to memory of 756 4056 saves.exe schtasks.exe PID 4056 wrote to memory of 2288 4056 saves.exe cmd.exe PID 4056 wrote to memory of 2288 4056 saves.exe cmd.exe PID 4056 wrote to memory of 2288 4056 saves.exe cmd.exe PID 2288 wrote to memory of 4684 2288 cmd.exe cmd.exe PID 2288 wrote to memory of 4684 2288 cmd.exe cmd.exe PID 2288 wrote to memory of 4684 2288 cmd.exe cmd.exe PID 2288 wrote to memory of 4572 2288 cmd.exe cacls.exe PID 2288 wrote to memory of 4572 2288 cmd.exe cacls.exe PID 2288 wrote to memory of 4572 2288 cmd.exe cacls.exe PID 2288 wrote to memory of 1452 2288 cmd.exe cacls.exe PID 2288 wrote to memory of 1452 2288 cmd.exe cacls.exe PID 2288 wrote to memory of 1452 2288 cmd.exe cacls.exe PID 2288 wrote to memory of 1460 2288 cmd.exe cmd.exe PID 2288 wrote to memory of 1460 2288 cmd.exe cmd.exe PID 2288 wrote to memory of 1460 2288 cmd.exe cmd.exe PID 2288 wrote to memory of 4824 2288 cmd.exe cacls.exe PID 2288 wrote to memory of 4824 2288 cmd.exe cacls.exe PID 2288 wrote to memory of 4824 2288 cmd.exe cacls.exe PID 2288 wrote to memory of 2724 2288 cmd.exe cacls.exe PID 2288 wrote to memory of 2724 2288 cmd.exe cacls.exe PID 2288 wrote to memory of 2724 2288 cmd.exe cacls.exe PID 3056 wrote to memory of 4884 3056 y5067832.exe n9917940.exe PID 3056 wrote to memory of 4884 3056 y5067832.exe n9917940.exe PID 3056 wrote to memory of 4884 3056 y5067832.exe n9917940.exe PID 4056 wrote to memory of 4188 4056 saves.exe rundll32.exe PID 4056 wrote to memory of 4188 4056 saves.exe rundll32.exe PID 4056 wrote to memory of 4188 4056 saves.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\y6467268_JC.exe"C:\Users\Admin\AppData\Local\Temp\y6467268_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5067832.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5067832.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3348048.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3348048.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9391158.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9391158.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m9231099.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m9231099.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n9917940.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n9917940.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5067832.exeFilesize
475KB
MD509458a612ad515bcee06c9f05c0ad518
SHA117d67c380412b11df1fa5841264a3bb85c027397
SHA256671660af885889fde9a8bd7b35efa5deaf4349c7ac810d086cb899ab79c4e9ea
SHA512b7c9b9b54b62a3001c960a2f5151340b52eea25541f4e98faeefc1b7ee4def1d184eb9b954bc4a662e75535ab2b2a0775ea531380686ecae2e96f62d7a88b6ed
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5067832.exeFilesize
475KB
MD509458a612ad515bcee06c9f05c0ad518
SHA117d67c380412b11df1fa5841264a3bb85c027397
SHA256671660af885889fde9a8bd7b35efa5deaf4349c7ac810d086cb899ab79c4e9ea
SHA512b7c9b9b54b62a3001c960a2f5151340b52eea25541f4e98faeefc1b7ee4def1d184eb9b954bc4a662e75535ab2b2a0775ea531380686ecae2e96f62d7a88b6ed
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n9917940.exeFilesize
175KB
MD5283a8ed481ca9d10a931282448987930
SHA16fcf6d5259abb5e3288ddc6b0bed8f3be7344481
SHA256613ad358da3db305a1260c13c5a7d95b01c8de9deaf0de6fdaf967a6534c2458
SHA512912a6369aefe1c1bc8a7fa7bff70d2b7fbc6b39f090f1e553430f6a1700fe67727d686057f9cf2fe0c4718498fbd781acb9e6d8b8f9bd82cac0f3faeecaa07f6
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n9917940.exeFilesize
175KB
MD5283a8ed481ca9d10a931282448987930
SHA16fcf6d5259abb5e3288ddc6b0bed8f3be7344481
SHA256613ad358da3db305a1260c13c5a7d95b01c8de9deaf0de6fdaf967a6534c2458
SHA512912a6369aefe1c1bc8a7fa7bff70d2b7fbc6b39f090f1e553430f6a1700fe67727d686057f9cf2fe0c4718498fbd781acb9e6d8b8f9bd82cac0f3faeecaa07f6
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3348048.exeFilesize
319KB
MD566bd5207bdc5dd5fd0d7aa1c3f493bb9
SHA15e6d5a294bca8101bbeeebd6afbc27a5ab45550f
SHA25699df4e0a7d2c13d02c7fae90e701138105be6f1bda80b0916672681988a1628d
SHA512fd805cf8b5c9f9b9ff1497cb4020743ce115c955cc70b5b379b88777c21779afbd13731d9d789f250707ccf00ee18c43e54e93bc1b719bc39aff28380eede530
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3348048.exeFilesize
319KB
MD566bd5207bdc5dd5fd0d7aa1c3f493bb9
SHA15e6d5a294bca8101bbeeebd6afbc27a5ab45550f
SHA25699df4e0a7d2c13d02c7fae90e701138105be6f1bda80b0916672681988a1628d
SHA512fd805cf8b5c9f9b9ff1497cb4020743ce115c955cc70b5b379b88777c21779afbd13731d9d789f250707ccf00ee18c43e54e93bc1b719bc39aff28380eede530
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9391158.exeFilesize
335KB
MD5ea01de5e8dd73d933a9987216c9d85f6
SHA11f84c96b86c972c9380904fba8b85edc43ce68e7
SHA25645937ccfdd37b4fdfac988092e1e920a8c0ede0efae4bc4f4314c39b00ffa2d2
SHA512f62a25f9a0cd88c6582cf9ee9d9ae7cb2e7273ce66ab8c4258d0b7619fcf7d41db44d89d72567385156db7bde7ac35585393eabcd129c79a7e19c81da3ce479a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9391158.exeFilesize
335KB
MD5ea01de5e8dd73d933a9987216c9d85f6
SHA11f84c96b86c972c9380904fba8b85edc43ce68e7
SHA25645937ccfdd37b4fdfac988092e1e920a8c0ede0efae4bc4f4314c39b00ffa2d2
SHA512f62a25f9a0cd88c6582cf9ee9d9ae7cb2e7273ce66ab8c4258d0b7619fcf7d41db44d89d72567385156db7bde7ac35585393eabcd129c79a7e19c81da3ce479a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m9231099.exeFilesize
141KB
MD5d48c848a958f3c64250197b8365c2242
SHA1c4d38c197294131643824efe0609ea59cd6a38cb
SHA256b07b6f97d58c6d300b5dbe432c8641a48b7da234ffa411d0ef2265c01cd7efeb
SHA5128c52e778f0c3f3a0277d8a4f718e4740e88e2197afeafbed2c5e2f7cc522ed806c602d3f09de77c8a249d822a9a50f6863bbd59fd580adb8856577fd94541cbc
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m9231099.exeFilesize
141KB
MD5d48c848a958f3c64250197b8365c2242
SHA1c4d38c197294131643824efe0609ea59cd6a38cb
SHA256b07b6f97d58c6d300b5dbe432c8641a48b7da234ffa411d0ef2265c01cd7efeb
SHA5128c52e778f0c3f3a0277d8a4f718e4740e88e2197afeafbed2c5e2f7cc522ed806c602d3f09de77c8a249d822a9a50f6863bbd59fd580adb8856577fd94541cbc
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeFilesize
335KB
MD5ea01de5e8dd73d933a9987216c9d85f6
SHA11f84c96b86c972c9380904fba8b85edc43ce68e7
SHA25645937ccfdd37b4fdfac988092e1e920a8c0ede0efae4bc4f4314c39b00ffa2d2
SHA512f62a25f9a0cd88c6582cf9ee9d9ae7cb2e7273ce66ab8c4258d0b7619fcf7d41db44d89d72567385156db7bde7ac35585393eabcd129c79a7e19c81da3ce479a
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeFilesize
335KB
MD5ea01de5e8dd73d933a9987216c9d85f6
SHA11f84c96b86c972c9380904fba8b85edc43ce68e7
SHA25645937ccfdd37b4fdfac988092e1e920a8c0ede0efae4bc4f4314c39b00ffa2d2
SHA512f62a25f9a0cd88c6582cf9ee9d9ae7cb2e7273ce66ab8c4258d0b7619fcf7d41db44d89d72567385156db7bde7ac35585393eabcd129c79a7e19c81da3ce479a
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeFilesize
335KB
MD5ea01de5e8dd73d933a9987216c9d85f6
SHA11f84c96b86c972c9380904fba8b85edc43ce68e7
SHA25645937ccfdd37b4fdfac988092e1e920a8c0ede0efae4bc4f4314c39b00ffa2d2
SHA512f62a25f9a0cd88c6582cf9ee9d9ae7cb2e7273ce66ab8c4258d0b7619fcf7d41db44d89d72567385156db7bde7ac35585393eabcd129c79a7e19c81da3ce479a
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeFilesize
335KB
MD5ea01de5e8dd73d933a9987216c9d85f6
SHA11f84c96b86c972c9380904fba8b85edc43ce68e7
SHA25645937ccfdd37b4fdfac988092e1e920a8c0ede0efae4bc4f4314c39b00ffa2d2
SHA512f62a25f9a0cd88c6582cf9ee9d9ae7cb2e7273ce66ab8c4258d0b7619fcf7d41db44d89d72567385156db7bde7ac35585393eabcd129c79a7e19c81da3ce479a
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeFilesize
335KB
MD5ea01de5e8dd73d933a9987216c9d85f6
SHA11f84c96b86c972c9380904fba8b85edc43ce68e7
SHA25645937ccfdd37b4fdfac988092e1e920a8c0ede0efae4bc4f4314c39b00ffa2d2
SHA512f62a25f9a0cd88c6582cf9ee9d9ae7cb2e7273ce66ab8c4258d0b7619fcf7d41db44d89d72567385156db7bde7ac35585393eabcd129c79a7e19c81da3ce479a
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD5374bfdcfcf19f4edfe949022092848d2
SHA1df5ee40497e98efcfba30012452d433373d287d4
SHA256224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f
SHA512bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7
-
memory/4884-36-0x0000000000EB0000-0x0000000000EE0000-memory.dmpFilesize
192KB
-
memory/4884-43-0x0000000072E40000-0x00000000735F0000-memory.dmpFilesize
7.7MB
-
memory/4884-44-0x00000000057F0000-0x0000000005800000-memory.dmpFilesize
64KB
-
memory/4884-42-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/4884-41-0x00000000057F0000-0x0000000005800000-memory.dmpFilesize
64KB
-
memory/4884-40-0x0000000005780000-0x0000000005792000-memory.dmpFilesize
72KB
-
memory/4884-39-0x0000000005B10000-0x0000000005C1A000-memory.dmpFilesize
1.0MB
-
memory/4884-38-0x0000000006020000-0x0000000006638000-memory.dmpFilesize
6.1MB
-
memory/4884-37-0x0000000072E40000-0x00000000735F0000-memory.dmpFilesize
7.7MB