Analysis
-
max time kernel
144s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
23-03-2023 22:08
Static task
static1
Behavioral task
behavioral1
Sample
4edde1b4eefde61a0c9053e3178b421e41a52c2b7e90400d1999f6bf74ee5180.exe
Resource
win10v2004-20230220-en
General
-
Target
4edde1b4eefde61a0c9053e3178b421e41a52c2b7e90400d1999f6bf74ee5180.exe
-
Size
544KB
-
MD5
c80bfd882ff35f5c921cabf4efbc781b
-
SHA1
de95f697b3ff7c174cdda03b408ff2eafef71149
-
SHA256
4edde1b4eefde61a0c9053e3178b421e41a52c2b7e90400d1999f6bf74ee5180
-
SHA512
c0310780686fe3c3291ea0b7db030d1e962642f74b7489de57c13567f60ffac08c45c5a577a4dfb0e41b0e90f9da683bd787196cfbd764e994ade90d991f3a42
-
SSDEEP
12288:sMr0y90ajj0l1000qR46PoGLEpqgUZMLzwSixXqAcR0H:4yDjcbLWUM/PzR0H
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
real
193.233.20.31:4125
-
auth_value
bb22a50228754849387d5f4d1611e71b
Signatures
-
Processes:
pro3104.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection pro3104.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro3104.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro3104.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro3104.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro3104.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro3104.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/4720-157-0x00000000029D0000-0x0000000002A0E000-memory.dmp family_redline behavioral1/memory/4720-160-0x00000000029D0000-0x0000000002A0E000-memory.dmp family_redline behavioral1/memory/4720-158-0x00000000029D0000-0x0000000002A0E000-memory.dmp family_redline behavioral1/memory/4720-162-0x00000000029D0000-0x0000000002A0E000-memory.dmp family_redline behavioral1/memory/4720-164-0x00000000029D0000-0x0000000002A0E000-memory.dmp family_redline behavioral1/memory/4720-166-0x00000000029D0000-0x0000000002A0E000-memory.dmp family_redline behavioral1/memory/4720-168-0x00000000029D0000-0x0000000002A0E000-memory.dmp family_redline behavioral1/memory/4720-170-0x00000000029D0000-0x0000000002A0E000-memory.dmp family_redline behavioral1/memory/4720-172-0x00000000029D0000-0x0000000002A0E000-memory.dmp family_redline behavioral1/memory/4720-174-0x00000000029D0000-0x0000000002A0E000-memory.dmp family_redline behavioral1/memory/4720-176-0x00000000029D0000-0x0000000002A0E000-memory.dmp family_redline behavioral1/memory/4720-178-0x00000000029D0000-0x0000000002A0E000-memory.dmp family_redline behavioral1/memory/4720-180-0x00000000029D0000-0x0000000002A0E000-memory.dmp family_redline behavioral1/memory/4720-182-0x00000000029D0000-0x0000000002A0E000-memory.dmp family_redline behavioral1/memory/4720-184-0x00000000029D0000-0x0000000002A0E000-memory.dmp family_redline behavioral1/memory/4720-186-0x00000000029D0000-0x0000000002A0E000-memory.dmp family_redline behavioral1/memory/4720-188-0x00000000029D0000-0x0000000002A0E000-memory.dmp family_redline behavioral1/memory/4720-190-0x00000000029D0000-0x0000000002A0E000-memory.dmp family_redline behavioral1/memory/4720-192-0x00000000029D0000-0x0000000002A0E000-memory.dmp family_redline behavioral1/memory/4720-194-0x00000000029D0000-0x0000000002A0E000-memory.dmp family_redline behavioral1/memory/4720-196-0x00000000029D0000-0x0000000002A0E000-memory.dmp family_redline behavioral1/memory/4720-198-0x00000000029D0000-0x0000000002A0E000-memory.dmp family_redline behavioral1/memory/4720-200-0x00000000029D0000-0x0000000002A0E000-memory.dmp family_redline behavioral1/memory/4720-202-0x00000000029D0000-0x0000000002A0E000-memory.dmp family_redline behavioral1/memory/4720-204-0x00000000029D0000-0x0000000002A0E000-memory.dmp family_redline behavioral1/memory/4720-206-0x00000000029D0000-0x0000000002A0E000-memory.dmp family_redline behavioral1/memory/4720-208-0x00000000029D0000-0x0000000002A0E000-memory.dmp family_redline behavioral1/memory/4720-210-0x00000000029D0000-0x0000000002A0E000-memory.dmp family_redline behavioral1/memory/4720-212-0x00000000029D0000-0x0000000002A0E000-memory.dmp family_redline behavioral1/memory/4720-214-0x00000000029D0000-0x0000000002A0E000-memory.dmp family_redline behavioral1/memory/4720-216-0x00000000029D0000-0x0000000002A0E000-memory.dmp family_redline behavioral1/memory/4720-218-0x00000000029D0000-0x0000000002A0E000-memory.dmp family_redline behavioral1/memory/4720-220-0x00000000029D0000-0x0000000002A0E000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
unio7920.exepro3104.exequ4825.exesi447675.exepid process 2356 unio7920.exe 3688 pro3104.exe 4720 qu4825.exe 60 si447675.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro3104.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" pro3104.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
4edde1b4eefde61a0c9053e3178b421e41a52c2b7e90400d1999f6bf74ee5180.exeunio7920.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 4edde1b4eefde61a0c9053e3178b421e41a52c2b7e90400d1999f6bf74ee5180.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 4edde1b4eefde61a0c9053e3178b421e41a52c2b7e90400d1999f6bf74ee5180.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce unio7920.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" unio7920.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4428 4720 WerFault.exe qu4825.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro3104.exequ4825.exesi447675.exepid process 3688 pro3104.exe 3688 pro3104.exe 4720 qu4825.exe 4720 qu4825.exe 60 si447675.exe 60 si447675.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro3104.exequ4825.exesi447675.exedescription pid process Token: SeDebugPrivilege 3688 pro3104.exe Token: SeDebugPrivilege 4720 qu4825.exe Token: SeDebugPrivilege 60 si447675.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
4edde1b4eefde61a0c9053e3178b421e41a52c2b7e90400d1999f6bf74ee5180.exeunio7920.exedescription pid process target process PID 1228 wrote to memory of 2356 1228 4edde1b4eefde61a0c9053e3178b421e41a52c2b7e90400d1999f6bf74ee5180.exe unio7920.exe PID 1228 wrote to memory of 2356 1228 4edde1b4eefde61a0c9053e3178b421e41a52c2b7e90400d1999f6bf74ee5180.exe unio7920.exe PID 1228 wrote to memory of 2356 1228 4edde1b4eefde61a0c9053e3178b421e41a52c2b7e90400d1999f6bf74ee5180.exe unio7920.exe PID 2356 wrote to memory of 3688 2356 unio7920.exe pro3104.exe PID 2356 wrote to memory of 3688 2356 unio7920.exe pro3104.exe PID 2356 wrote to memory of 4720 2356 unio7920.exe qu4825.exe PID 2356 wrote to memory of 4720 2356 unio7920.exe qu4825.exe PID 2356 wrote to memory of 4720 2356 unio7920.exe qu4825.exe PID 1228 wrote to memory of 60 1228 4edde1b4eefde61a0c9053e3178b421e41a52c2b7e90400d1999f6bf74ee5180.exe si447675.exe PID 1228 wrote to memory of 60 1228 4edde1b4eefde61a0c9053e3178b421e41a52c2b7e90400d1999f6bf74ee5180.exe si447675.exe PID 1228 wrote to memory of 60 1228 4edde1b4eefde61a0c9053e3178b421e41a52c2b7e90400d1999f6bf74ee5180.exe si447675.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4edde1b4eefde61a0c9053e3178b421e41a52c2b7e90400d1999f6bf74ee5180.exe"C:\Users\Admin\AppData\Local\Temp\4edde1b4eefde61a0c9053e3178b421e41a52c2b7e90400d1999f6bf74ee5180.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio7920.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio7920.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3104.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3104.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3688
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4825.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4825.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4720 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 13284⤵
- Program crash
PID:4428
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si447675.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si447675.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:60
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4720 -ip 47201⤵PID:796
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD541707338e1e2d868aa699ac0dd2e77b0
SHA136e0dfba09f9fb409faf0f9a99217d0d0c524b82
SHA2568d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557
SHA51280c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2
-
Filesize
175KB
MD541707338e1e2d868aa699ac0dd2e77b0
SHA136e0dfba09f9fb409faf0f9a99217d0d0c524b82
SHA2568d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557
SHA51280c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2
-
Filesize
402KB
MD55c04cbcf256eb83ee042c7b48b0f7112
SHA13891657626bdf431c02c7e3c310896a84042f773
SHA2561b741f8c4585c3ede4569b4602cd640130b4a76440244ec7f9a4f636f025b183
SHA5128dc5ada21f0337c08dc1c9420a66c6d61bef15bcd02d2deea837da73ce3bb4c90e37dbf67dfe3f7aabb3d82ae03c71002f0faf96c09ea3309a2acf7607026136
-
Filesize
402KB
MD55c04cbcf256eb83ee042c7b48b0f7112
SHA13891657626bdf431c02c7e3c310896a84042f773
SHA2561b741f8c4585c3ede4569b4602cd640130b4a76440244ec7f9a4f636f025b183
SHA5128dc5ada21f0337c08dc1c9420a66c6d61bef15bcd02d2deea837da73ce3bb4c90e37dbf67dfe3f7aabb3d82ae03c71002f0faf96c09ea3309a2acf7607026136
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
349KB
MD58130662e7692c0f1fadc7bb19f4a5769
SHA154799d72bf5abd25ad737dd3fc125e180e1ec4a4
SHA256e8b2b824936bf76f41231b82da5c717be62e03bd0f9a9edbfcff4eff58ad9940
SHA5128c1ea50e2bd1d72b8bce0469b47502a34259fc9491ed3fdeed613f2b20aa681da2e71cbe489ace989e7be60f3f916a7e085d519229e4aaff1fdb013653ecf14b
-
Filesize
349KB
MD58130662e7692c0f1fadc7bb19f4a5769
SHA154799d72bf5abd25ad737dd3fc125e180e1ec4a4
SHA256e8b2b824936bf76f41231b82da5c717be62e03bd0f9a9edbfcff4eff58ad9940
SHA5128c1ea50e2bd1d72b8bce0469b47502a34259fc9491ed3fdeed613f2b20aa681da2e71cbe489ace989e7be60f3f916a7e085d519229e4aaff1fdb013653ecf14b