Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
05-03-2023 19:11
Static task
static1
Behavioral task
behavioral1
Sample
b17edadffa1f147d0e1dbe7dd5296584a0dafdc6d4682bd61db38d43116be087.exe
Resource
win10-20230220-en
General
-
Target
b17edadffa1f147d0e1dbe7dd5296584a0dafdc6d4682bd61db38d43116be087.exe
-
Size
526KB
-
MD5
ddda2347a7f8f0038f1dea6f5f19b212
-
SHA1
8132f718eefc676fc8495db3a6ab1c4573cc19ba
-
SHA256
b17edadffa1f147d0e1dbe7dd5296584a0dafdc6d4682bd61db38d43116be087
-
SHA512
b689371f4375c85dfc05149529875c1edb59ba53a83dcd739833c71b004eb2ae585ae4c9ca27057b31721d707893cbc99c04e86e8998572d9ff806f009d571b4
-
SSDEEP
12288:zMrZy90eRzyBfDNWIAnJTeDAOZ5QnBuva16yRYE6KA11vc:WyPaD4IYTesOv6BrvZyJc
Malware Config
Extracted
redline
fud
193.233.20.27:4123
-
auth_value
cddc991efd6918ad5321d80dac884b40
Extracted
redline
fabio
193.233.20.27:4123
-
auth_value
56b82736c3f56b13be8e64c87d2cf9e5
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" sf73iF58fV18.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" sf73iF58fV18.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" sf73iF58fV18.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" sf73iF58fV18.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" sf73iF58fV18.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
resource yara_rule behavioral1/memory/2956-141-0x0000000002670000-0x00000000026B6000-memory.dmp family_redline behavioral1/memory/2956-143-0x00000000026F0000-0x0000000002734000-memory.dmp family_redline behavioral1/memory/2956-148-0x00000000026F0000-0x000000000272E000-memory.dmp family_redline behavioral1/memory/2956-149-0x00000000026F0000-0x000000000272E000-memory.dmp family_redline behavioral1/memory/2956-151-0x00000000026F0000-0x000000000272E000-memory.dmp family_redline behavioral1/memory/2956-153-0x00000000026F0000-0x000000000272E000-memory.dmp family_redline behavioral1/memory/2956-155-0x00000000026F0000-0x000000000272E000-memory.dmp family_redline behavioral1/memory/2956-157-0x00000000026F0000-0x000000000272E000-memory.dmp family_redline behavioral1/memory/2956-159-0x00000000026F0000-0x000000000272E000-memory.dmp family_redline behavioral1/memory/2956-161-0x00000000026F0000-0x000000000272E000-memory.dmp family_redline behavioral1/memory/2956-163-0x00000000026F0000-0x000000000272E000-memory.dmp family_redline behavioral1/memory/2956-165-0x00000000026F0000-0x000000000272E000-memory.dmp family_redline behavioral1/memory/2956-167-0x00000000026F0000-0x000000000272E000-memory.dmp family_redline behavioral1/memory/2956-169-0x00000000026F0000-0x000000000272E000-memory.dmp family_redline behavioral1/memory/2956-171-0x00000000026F0000-0x000000000272E000-memory.dmp family_redline behavioral1/memory/2956-173-0x00000000026F0000-0x000000000272E000-memory.dmp family_redline behavioral1/memory/2956-175-0x00000000026F0000-0x000000000272E000-memory.dmp family_redline behavioral1/memory/2956-177-0x00000000026F0000-0x000000000272E000-memory.dmp family_redline behavioral1/memory/2956-179-0x00000000026F0000-0x000000000272E000-memory.dmp family_redline behavioral1/memory/2956-181-0x00000000026F0000-0x000000000272E000-memory.dmp family_redline behavioral1/memory/2956-183-0x00000000026F0000-0x000000000272E000-memory.dmp family_redline behavioral1/memory/2956-185-0x00000000026F0000-0x000000000272E000-memory.dmp family_redline behavioral1/memory/2956-187-0x00000000026F0000-0x000000000272E000-memory.dmp family_redline behavioral1/memory/2956-189-0x00000000026F0000-0x000000000272E000-memory.dmp family_redline behavioral1/memory/2956-191-0x00000000026F0000-0x000000000272E000-memory.dmp family_redline behavioral1/memory/2956-193-0x00000000026F0000-0x000000000272E000-memory.dmp family_redline behavioral1/memory/2956-195-0x00000000026F0000-0x000000000272E000-memory.dmp family_redline behavioral1/memory/2956-197-0x00000000026F0000-0x000000000272E000-memory.dmp family_redline behavioral1/memory/2956-199-0x00000000026F0000-0x000000000272E000-memory.dmp family_redline behavioral1/memory/2956-201-0x00000000026F0000-0x000000000272E000-memory.dmp family_redline behavioral1/memory/2956-203-0x00000000026F0000-0x000000000272E000-memory.dmp family_redline behavioral1/memory/2956-205-0x00000000026F0000-0x000000000272E000-memory.dmp family_redline behavioral1/memory/2956-207-0x00000000026F0000-0x000000000272E000-memory.dmp family_redline behavioral1/memory/2956-209-0x00000000026F0000-0x000000000272E000-memory.dmp family_redline behavioral1/memory/2956-211-0x00000000026F0000-0x000000000272E000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
pid Process 3160 vhPV8344Ub.exe 4360 sf73iF58fV18.exe 2956 tf02ii99oU80.exe 1940 uhnW21qo40jA.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" sf73iF58fV18.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce b17edadffa1f147d0e1dbe7dd5296584a0dafdc6d4682bd61db38d43116be087.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" b17edadffa1f147d0e1dbe7dd5296584a0dafdc6d4682bd61db38d43116be087.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce vhPV8344Ub.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" vhPV8344Ub.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4360 sf73iF58fV18.exe 4360 sf73iF58fV18.exe 2956 tf02ii99oU80.exe 2956 tf02ii99oU80.exe 1940 uhnW21qo40jA.exe 1940 uhnW21qo40jA.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4360 sf73iF58fV18.exe Token: SeDebugPrivilege 2956 tf02ii99oU80.exe Token: SeDebugPrivilege 1940 uhnW21qo40jA.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2896 wrote to memory of 3160 2896 b17edadffa1f147d0e1dbe7dd5296584a0dafdc6d4682bd61db38d43116be087.exe 66 PID 2896 wrote to memory of 3160 2896 b17edadffa1f147d0e1dbe7dd5296584a0dafdc6d4682bd61db38d43116be087.exe 66 PID 2896 wrote to memory of 3160 2896 b17edadffa1f147d0e1dbe7dd5296584a0dafdc6d4682bd61db38d43116be087.exe 66 PID 3160 wrote to memory of 4360 3160 vhPV8344Ub.exe 67 PID 3160 wrote to memory of 4360 3160 vhPV8344Ub.exe 67 PID 3160 wrote to memory of 2956 3160 vhPV8344Ub.exe 68 PID 3160 wrote to memory of 2956 3160 vhPV8344Ub.exe 68 PID 3160 wrote to memory of 2956 3160 vhPV8344Ub.exe 68 PID 2896 wrote to memory of 1940 2896 b17edadffa1f147d0e1dbe7dd5296584a0dafdc6d4682bd61db38d43116be087.exe 70 PID 2896 wrote to memory of 1940 2896 b17edadffa1f147d0e1dbe7dd5296584a0dafdc6d4682bd61db38d43116be087.exe 70 PID 2896 wrote to memory of 1940 2896 b17edadffa1f147d0e1dbe7dd5296584a0dafdc6d4682bd61db38d43116be087.exe 70
Processes
-
C:\Users\Admin\AppData\Local\Temp\b17edadffa1f147d0e1dbe7dd5296584a0dafdc6d4682bd61db38d43116be087.exe"C:\Users\Admin\AppData\Local\Temp\b17edadffa1f147d0e1dbe7dd5296584a0dafdc6d4682bd61db38d43116be087.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhPV8344Ub.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhPV8344Ub.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf73iF58fV18.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf73iF58fV18.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4360
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf02ii99oU80.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf02ii99oU80.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2956
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\uhnW21qo40jA.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\uhnW21qo40jA.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1940
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD5edf9446b94abd7b431aa9201a157a5c3
SHA1ba2af6fb45ed6a546c3a9e74674420fc4f0e942e
SHA256c5a29805ae1c8027a26fe0e4094eb1eb607e1bd719bad36a1803465e987260c7
SHA512e58bf34859cf0df1dd69870796936e4a778e490117130446585de61bc9ebb40ca7338daadea0775f6e2789b842888c97fe8ccfdea0a13f71c658b927c6f1ddf8
-
Filesize
175KB
MD5edf9446b94abd7b431aa9201a157a5c3
SHA1ba2af6fb45ed6a546c3a9e74674420fc4f0e942e
SHA256c5a29805ae1c8027a26fe0e4094eb1eb607e1bd719bad36a1803465e987260c7
SHA512e58bf34859cf0df1dd69870796936e4a778e490117130446585de61bc9ebb40ca7338daadea0775f6e2789b842888c97fe8ccfdea0a13f71c658b927c6f1ddf8
-
Filesize
381KB
MD514c887a9ef100af3c6dcc7ac3ef3f2cc
SHA19ae35f5815eb5b4624eca4e28e25d74b70f537d9
SHA256df33f5bc276c11c1326967823ca3e6181679e2f94513d934e7a6ffb521dd3480
SHA512412d431b991538179416309adf4beeddf142afa0a58bea18c3e7eac51265fca7551526c38e926556df3e3ec8823e44c274dbdb4f87786048b62ff834e200745d
-
Filesize
381KB
MD514c887a9ef100af3c6dcc7ac3ef3f2cc
SHA19ae35f5815eb5b4624eca4e28e25d74b70f537d9
SHA256df33f5bc276c11c1326967823ca3e6181679e2f94513d934e7a6ffb521dd3480
SHA512412d431b991538179416309adf4beeddf142afa0a58bea18c3e7eac51265fca7551526c38e926556df3e3ec8823e44c274dbdb4f87786048b62ff834e200745d
-
Filesize
11KB
MD54759c87cb8aae3b368ce489ed3888406
SHA1428b9a715af61d129a9a86145884f344a557f1aa
SHA25648ebc806315e6f54059fd03b98c5c853e0e3a457b1f1d8dc6fa61f57470b7f62
SHA512e8b16bbc37b67efcbee78d2085487f57d909e4e84160e6fbef838a403f5642d86b330db35ea0887b89629176ed684a8d2c4ef76a32724dbb4b35aead6ef16d04
-
Filesize
11KB
MD54759c87cb8aae3b368ce489ed3888406
SHA1428b9a715af61d129a9a86145884f344a557f1aa
SHA25648ebc806315e6f54059fd03b98c5c853e0e3a457b1f1d8dc6fa61f57470b7f62
SHA512e8b16bbc37b67efcbee78d2085487f57d909e4e84160e6fbef838a403f5642d86b330db35ea0887b89629176ed684a8d2c4ef76a32724dbb4b35aead6ef16d04
-
Filesize
292KB
MD5bd407beaed8912f6f9f5b269e5a85686
SHA1f9d8fc6c0a1ca9a1e0af1ca278f629994df04b1b
SHA2563fb5f126878146985387aac28dc8b1c17d8ee6ae3630a0c754c135138180d367
SHA51279eca3bfa76f241986888271cbcf4858a6eb2c729b1dbebcf000ae13b9fb1e981360c930e40c39437c027794ecce33d9302e6db93d65208ad6bb458aa1b2ff72
-
Filesize
292KB
MD5bd407beaed8912f6f9f5b269e5a85686
SHA1f9d8fc6c0a1ca9a1e0af1ca278f629994df04b1b
SHA2563fb5f126878146985387aac28dc8b1c17d8ee6ae3630a0c754c135138180d367
SHA51279eca3bfa76f241986888271cbcf4858a6eb2c729b1dbebcf000ae13b9fb1e981360c930e40c39437c027794ecce33d9302e6db93d65208ad6bb458aa1b2ff72