Analysis
-
max time kernel
115s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
23-03-2023 21:43
Static task
static1
Behavioral task
behavioral1
Sample
da8f1140ec9e29ececafec6f8894c62b3c07e9300ddfa76507bca92ca104f7cc.exe
Resource
win10v2004-20230220-en
General
-
Target
da8f1140ec9e29ececafec6f8894c62b3c07e9300ddfa76507bca92ca104f7cc.exe
-
Size
544KB
-
MD5
9a9f53018a4243f6f655954ecf7cc487
-
SHA1
5a99a69fe7e49b103617219b9ca8f4e70c48be01
-
SHA256
da8f1140ec9e29ececafec6f8894c62b3c07e9300ddfa76507bca92ca104f7cc
-
SHA512
bcd9d766556971c4b28c9632cd624ee787dca8553734c6d4b72eb8198d08eb4390dd335d9cd4f6e26f94c26091fcc51b19c8f8acf77c2a67d41c9efdf91ea226
-
SSDEEP
12288:gMr8y90rllnpjKTANWviDf90OJJZqgUbML/wqjeUZOTRQl+fx:sywpjTLB3WMDdVgw+5
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
real
193.233.20.31:4125
-
auth_value
bb22a50228754849387d5f4d1611e71b
Signatures
-
Processes:
pro3579.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection pro3579.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro3579.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro3579.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro3579.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro3579.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro3579.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/636-158-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/636-161-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/636-159-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/636-163-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/636-165-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/636-167-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/636-169-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/636-171-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/636-173-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/636-175-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/636-177-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/636-179-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/636-181-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/636-183-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/636-185-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/636-187-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/636-189-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/636-191-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/636-193-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/636-195-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/636-197-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/636-199-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/636-201-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/636-203-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/636-205-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/636-207-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/636-209-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/636-211-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/636-213-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/636-215-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/636-217-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/636-219-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/636-221-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
unio5801.exepro3579.exequ8049.exesi409946.exepid process 376 unio5801.exe 3580 pro3579.exe 636 qu8049.exe 3884 si409946.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro3579.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" pro3579.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
da8f1140ec9e29ececafec6f8894c62b3c07e9300ddfa76507bca92ca104f7cc.exeunio5801.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce da8f1140ec9e29ececafec6f8894c62b3c07e9300ddfa76507bca92ca104f7cc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" da8f1140ec9e29ececafec6f8894c62b3c07e9300ddfa76507bca92ca104f7cc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce unio5801.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" unio5801.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1772 636 WerFault.exe qu8049.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro3579.exequ8049.exesi409946.exepid process 3580 pro3579.exe 3580 pro3579.exe 636 qu8049.exe 636 qu8049.exe 3884 si409946.exe 3884 si409946.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro3579.exequ8049.exesi409946.exedescription pid process Token: SeDebugPrivilege 3580 pro3579.exe Token: SeDebugPrivilege 636 qu8049.exe Token: SeDebugPrivilege 3884 si409946.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
da8f1140ec9e29ececafec6f8894c62b3c07e9300ddfa76507bca92ca104f7cc.exeunio5801.exedescription pid process target process PID 1240 wrote to memory of 376 1240 da8f1140ec9e29ececafec6f8894c62b3c07e9300ddfa76507bca92ca104f7cc.exe unio5801.exe PID 1240 wrote to memory of 376 1240 da8f1140ec9e29ececafec6f8894c62b3c07e9300ddfa76507bca92ca104f7cc.exe unio5801.exe PID 1240 wrote to memory of 376 1240 da8f1140ec9e29ececafec6f8894c62b3c07e9300ddfa76507bca92ca104f7cc.exe unio5801.exe PID 376 wrote to memory of 3580 376 unio5801.exe pro3579.exe PID 376 wrote to memory of 3580 376 unio5801.exe pro3579.exe PID 376 wrote to memory of 636 376 unio5801.exe qu8049.exe PID 376 wrote to memory of 636 376 unio5801.exe qu8049.exe PID 376 wrote to memory of 636 376 unio5801.exe qu8049.exe PID 1240 wrote to memory of 3884 1240 da8f1140ec9e29ececafec6f8894c62b3c07e9300ddfa76507bca92ca104f7cc.exe si409946.exe PID 1240 wrote to memory of 3884 1240 da8f1140ec9e29ececafec6f8894c62b3c07e9300ddfa76507bca92ca104f7cc.exe si409946.exe PID 1240 wrote to memory of 3884 1240 da8f1140ec9e29ececafec6f8894c62b3c07e9300ddfa76507bca92ca104f7cc.exe si409946.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\da8f1140ec9e29ececafec6f8894c62b3c07e9300ddfa76507bca92ca104f7cc.exe"C:\Users\Admin\AppData\Local\Temp\da8f1140ec9e29ececafec6f8894c62b3c07e9300ddfa76507bca92ca104f7cc.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio5801.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio5801.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3579.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3579.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8049.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8049.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 13364⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si409946.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si409946.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 636 -ip 6361⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si409946.exeFilesize
175KB
MD541707338e1e2d868aa699ac0dd2e77b0
SHA136e0dfba09f9fb409faf0f9a99217d0d0c524b82
SHA2568d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557
SHA51280c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si409946.exeFilesize
175KB
MD541707338e1e2d868aa699ac0dd2e77b0
SHA136e0dfba09f9fb409faf0f9a99217d0d0c524b82
SHA2568d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557
SHA51280c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio5801.exeFilesize
402KB
MD5141a2d84e32a313d839fa9b5d84c2c54
SHA131f827f5dadf11a7938c57f051f15b5a67ae7631
SHA256144b92068bb7aab12ac642a0e5031d25f61d413ac2064a818a329f94bb5a537f
SHA512e21385a827aaffbf964f1690773b49af56680d7b3ec687c93600074f6af7c3ebf78cb73837d5e54f747051327141f89ab0b006296da1f7f2e3bf012b66cf5e03
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio5801.exeFilesize
402KB
MD5141a2d84e32a313d839fa9b5d84c2c54
SHA131f827f5dadf11a7938c57f051f15b5a67ae7631
SHA256144b92068bb7aab12ac642a0e5031d25f61d413ac2064a818a329f94bb5a537f
SHA512e21385a827aaffbf964f1690773b49af56680d7b3ec687c93600074f6af7c3ebf78cb73837d5e54f747051327141f89ab0b006296da1f7f2e3bf012b66cf5e03
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3579.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3579.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8049.exeFilesize
349KB
MD5d6a22412b10f0f8ac26a2463483daf61
SHA1a1960867d07b655f9ceb8b911d51a24cc569442e
SHA25677f1fb8e6d6633b17237b93791b0fc35a507e416896fe9f3c51a539fdcf18cc6
SHA512027793c6d60f50aa5d751fa0f97a63030151061fc94a4917b19a45ba858c6f628c97308d0e3a36eb49cb3c9fab533b968b9a9ab24b93507b18f2e2fb3c744023
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8049.exeFilesize
349KB
MD5d6a22412b10f0f8ac26a2463483daf61
SHA1a1960867d07b655f9ceb8b911d51a24cc569442e
SHA25677f1fb8e6d6633b17237b93791b0fc35a507e416896fe9f3c51a539fdcf18cc6
SHA512027793c6d60f50aa5d751fa0f97a63030151061fc94a4917b19a45ba858c6f628c97308d0e3a36eb49cb3c9fab533b968b9a9ab24b93507b18f2e2fb3c744023
-
memory/636-153-0x0000000002250000-0x000000000229B000-memory.dmpFilesize
300KB
-
memory/636-154-0x0000000004E30000-0x0000000004E40000-memory.dmpFilesize
64KB
-
memory/636-155-0x0000000004E30000-0x0000000004E40000-memory.dmpFilesize
64KB
-
memory/636-156-0x0000000004E30000-0x0000000004E40000-memory.dmpFilesize
64KB
-
memory/636-157-0x0000000004E40000-0x00000000053E4000-memory.dmpFilesize
5.6MB
-
memory/636-158-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/636-161-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/636-159-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/636-163-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/636-165-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/636-167-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/636-169-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/636-171-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/636-173-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/636-175-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/636-177-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/636-179-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/636-181-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/636-183-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/636-185-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/636-187-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/636-189-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/636-191-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/636-193-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/636-195-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/636-197-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/636-199-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/636-201-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/636-203-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/636-205-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/636-207-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/636-209-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/636-211-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/636-213-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/636-215-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/636-217-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/636-219-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/636-221-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/636-1064-0x00000000054F0000-0x0000000005B08000-memory.dmpFilesize
6.1MB
-
memory/636-1065-0x0000000005B10000-0x0000000005C1A000-memory.dmpFilesize
1.0MB
-
memory/636-1066-0x0000000005C40000-0x0000000005C52000-memory.dmpFilesize
72KB
-
memory/636-1067-0x0000000005C60000-0x0000000005C9C000-memory.dmpFilesize
240KB
-
memory/636-1068-0x0000000004E30000-0x0000000004E40000-memory.dmpFilesize
64KB
-
memory/636-1069-0x0000000005F50000-0x0000000005FE2000-memory.dmpFilesize
584KB
-
memory/636-1071-0x0000000005FF0000-0x0000000006056000-memory.dmpFilesize
408KB
-
memory/636-1072-0x0000000004E30000-0x0000000004E40000-memory.dmpFilesize
64KB
-
memory/636-1073-0x0000000004E30000-0x0000000004E40000-memory.dmpFilesize
64KB
-
memory/636-1074-0x0000000004E30000-0x0000000004E40000-memory.dmpFilesize
64KB
-
memory/636-1075-0x0000000006710000-0x00000000068D2000-memory.dmpFilesize
1.8MB
-
memory/636-1076-0x00000000068F0000-0x0000000006E1C000-memory.dmpFilesize
5.2MB
-
memory/636-1077-0x0000000006F50000-0x0000000006FC6000-memory.dmpFilesize
472KB
-
memory/636-1078-0x0000000006FE0000-0x0000000007030000-memory.dmpFilesize
320KB
-
memory/636-1079-0x0000000004E30000-0x0000000004E40000-memory.dmpFilesize
64KB
-
memory/3580-147-0x0000000000030000-0x000000000003A000-memory.dmpFilesize
40KB
-
memory/3884-1085-0x0000000000300000-0x0000000000332000-memory.dmpFilesize
200KB
-
memory/3884-1086-0x0000000004E80000-0x0000000004E90000-memory.dmpFilesize
64KB