Analysis
-
max time kernel
54s -
max time network
72s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
23-03-2023 21:59
Static task
static1
Behavioral task
behavioral1
Sample
997d4271638e6afed859b0bedfafde01d7b84162a3a90a8ddb6ecb3e98aaf4cc.exe
Resource
win10-20230220-en
General
-
Target
997d4271638e6afed859b0bedfafde01d7b84162a3a90a8ddb6ecb3e98aaf4cc.exe
-
Size
544KB
-
MD5
cc6cd99091be4d73c4e505c1b4a45de7
-
SHA1
94a013c72b3ec54afa4aaf3794b5f49c591156af
-
SHA256
997d4271638e6afed859b0bedfafde01d7b84162a3a90a8ddb6ecb3e98aaf4cc
-
SHA512
6b9952cdbed1aefa06a13c9aca9ac2b03f25f8b507a6dfde97b040f4ab4d64b083cb6d614069c80f5979ca363ecff685df4d891385a87cdc3d6cd7363734bdf0
-
SSDEEP
12288:MMrey90krBYsJnVwihff+0Oz0DqgU+MLXw695DNtvdoC3whq:qyJVYoSiQQDM7TZFo2wk
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
real
193.233.20.31:4125
-
auth_value
bb22a50228754849387d5f4d1611e71b
Signatures
-
Processes:
pro1819.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro1819.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro1819.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro1819.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro1819.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro1819.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
Processes:
resource yara_rule behavioral1/memory/4200-140-0x00000000023F0000-0x0000000002436000-memory.dmp family_redline behavioral1/memory/4200-142-0x00000000025C0000-0x0000000002604000-memory.dmp family_redline behavioral1/memory/4200-147-0x00000000025C0000-0x00000000025FE000-memory.dmp family_redline behavioral1/memory/4200-148-0x00000000025C0000-0x00000000025FE000-memory.dmp family_redline behavioral1/memory/4200-150-0x00000000025C0000-0x00000000025FE000-memory.dmp family_redline behavioral1/memory/4200-152-0x00000000025C0000-0x00000000025FE000-memory.dmp family_redline behavioral1/memory/4200-154-0x00000000025C0000-0x00000000025FE000-memory.dmp family_redline behavioral1/memory/4200-156-0x00000000025C0000-0x00000000025FE000-memory.dmp family_redline behavioral1/memory/4200-158-0x00000000025C0000-0x00000000025FE000-memory.dmp family_redline behavioral1/memory/4200-160-0x00000000025C0000-0x00000000025FE000-memory.dmp family_redline behavioral1/memory/4200-162-0x00000000025C0000-0x00000000025FE000-memory.dmp family_redline behavioral1/memory/4200-164-0x00000000025C0000-0x00000000025FE000-memory.dmp family_redline behavioral1/memory/4200-166-0x00000000025C0000-0x00000000025FE000-memory.dmp family_redline behavioral1/memory/4200-168-0x00000000025C0000-0x00000000025FE000-memory.dmp family_redline behavioral1/memory/4200-170-0x00000000025C0000-0x00000000025FE000-memory.dmp family_redline behavioral1/memory/4200-172-0x00000000025C0000-0x00000000025FE000-memory.dmp family_redline behavioral1/memory/4200-174-0x00000000025C0000-0x00000000025FE000-memory.dmp family_redline behavioral1/memory/4200-176-0x00000000025C0000-0x00000000025FE000-memory.dmp family_redline behavioral1/memory/4200-178-0x00000000025C0000-0x00000000025FE000-memory.dmp family_redline behavioral1/memory/4200-180-0x00000000025C0000-0x00000000025FE000-memory.dmp family_redline behavioral1/memory/4200-182-0x00000000025C0000-0x00000000025FE000-memory.dmp family_redline behavioral1/memory/4200-184-0x00000000025C0000-0x00000000025FE000-memory.dmp family_redline behavioral1/memory/4200-186-0x00000000025C0000-0x00000000025FE000-memory.dmp family_redline behavioral1/memory/4200-188-0x00000000025C0000-0x00000000025FE000-memory.dmp family_redline behavioral1/memory/4200-190-0x00000000025C0000-0x00000000025FE000-memory.dmp family_redline behavioral1/memory/4200-192-0x00000000025C0000-0x00000000025FE000-memory.dmp family_redline behavioral1/memory/4200-194-0x00000000025C0000-0x00000000025FE000-memory.dmp family_redline behavioral1/memory/4200-196-0x00000000025C0000-0x00000000025FE000-memory.dmp family_redline behavioral1/memory/4200-198-0x00000000025C0000-0x00000000025FE000-memory.dmp family_redline behavioral1/memory/4200-200-0x00000000025C0000-0x00000000025FE000-memory.dmp family_redline behavioral1/memory/4200-202-0x00000000025C0000-0x00000000025FE000-memory.dmp family_redline behavioral1/memory/4200-204-0x00000000025C0000-0x00000000025FE000-memory.dmp family_redline behavioral1/memory/4200-206-0x00000000025C0000-0x00000000025FE000-memory.dmp family_redline behavioral1/memory/4200-208-0x00000000025C0000-0x00000000025FE000-memory.dmp family_redline behavioral1/memory/4200-210-0x00000000025C0000-0x00000000025FE000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
unio9309.exepro1819.exequ5847.exesi231870.exepid process 3372 unio9309.exe 4348 pro1819.exe 4200 qu5847.exe 4600 si231870.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro1819.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" pro1819.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
997d4271638e6afed859b0bedfafde01d7b84162a3a90a8ddb6ecb3e98aaf4cc.exeunio9309.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 997d4271638e6afed859b0bedfafde01d7b84162a3a90a8ddb6ecb3e98aaf4cc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce unio9309.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" unio9309.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 997d4271638e6afed859b0bedfafde01d7b84162a3a90a8ddb6ecb3e98aaf4cc.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro1819.exequ5847.exesi231870.exepid process 4348 pro1819.exe 4348 pro1819.exe 4200 qu5847.exe 4200 qu5847.exe 4600 si231870.exe 4600 si231870.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro1819.exequ5847.exesi231870.exedescription pid process Token: SeDebugPrivilege 4348 pro1819.exe Token: SeDebugPrivilege 4200 qu5847.exe Token: SeDebugPrivilege 4600 si231870.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
997d4271638e6afed859b0bedfafde01d7b84162a3a90a8ddb6ecb3e98aaf4cc.exeunio9309.exedescription pid process target process PID 3240 wrote to memory of 3372 3240 997d4271638e6afed859b0bedfafde01d7b84162a3a90a8ddb6ecb3e98aaf4cc.exe unio9309.exe PID 3240 wrote to memory of 3372 3240 997d4271638e6afed859b0bedfafde01d7b84162a3a90a8ddb6ecb3e98aaf4cc.exe unio9309.exe PID 3240 wrote to memory of 3372 3240 997d4271638e6afed859b0bedfafde01d7b84162a3a90a8ddb6ecb3e98aaf4cc.exe unio9309.exe PID 3372 wrote to memory of 4348 3372 unio9309.exe pro1819.exe PID 3372 wrote to memory of 4348 3372 unio9309.exe pro1819.exe PID 3372 wrote to memory of 4200 3372 unio9309.exe qu5847.exe PID 3372 wrote to memory of 4200 3372 unio9309.exe qu5847.exe PID 3372 wrote to memory of 4200 3372 unio9309.exe qu5847.exe PID 3240 wrote to memory of 4600 3240 997d4271638e6afed859b0bedfafde01d7b84162a3a90a8ddb6ecb3e98aaf4cc.exe si231870.exe PID 3240 wrote to memory of 4600 3240 997d4271638e6afed859b0bedfafde01d7b84162a3a90a8ddb6ecb3e98aaf4cc.exe si231870.exe PID 3240 wrote to memory of 4600 3240 997d4271638e6afed859b0bedfafde01d7b84162a3a90a8ddb6ecb3e98aaf4cc.exe si231870.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\997d4271638e6afed859b0bedfafde01d7b84162a3a90a8ddb6ecb3e98aaf4cc.exe"C:\Users\Admin\AppData\Local\Temp\997d4271638e6afed859b0bedfafde01d7b84162a3a90a8ddb6ecb3e98aaf4cc.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio9309.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio9309.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1819.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1819.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5847.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5847.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si231870.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si231870.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si231870.exeFilesize
175KB
MD541707338e1e2d868aa699ac0dd2e77b0
SHA136e0dfba09f9fb409faf0f9a99217d0d0c524b82
SHA2568d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557
SHA51280c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si231870.exeFilesize
175KB
MD541707338e1e2d868aa699ac0dd2e77b0
SHA136e0dfba09f9fb409faf0f9a99217d0d0c524b82
SHA2568d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557
SHA51280c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio9309.exeFilesize
402KB
MD5ff33b59e160dc6f99857f4e86e55c3dc
SHA13b2a8a8806d9179012fe3f899269a6579f3264b3
SHA256b8bebe7e93b67150c1ab4b160f35aaeaa5678a4bee9e0b11d871e6d93af11eb0
SHA512fec7315aa07da0a9427c2f851936fda138d2214fdc931253e214a55ed5c8ba08c50039a72bf7cb12dd3ba0bc4a45c3ddb840983a75d4d6b334449f719e2d6676
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio9309.exeFilesize
402KB
MD5ff33b59e160dc6f99857f4e86e55c3dc
SHA13b2a8a8806d9179012fe3f899269a6579f3264b3
SHA256b8bebe7e93b67150c1ab4b160f35aaeaa5678a4bee9e0b11d871e6d93af11eb0
SHA512fec7315aa07da0a9427c2f851936fda138d2214fdc931253e214a55ed5c8ba08c50039a72bf7cb12dd3ba0bc4a45c3ddb840983a75d4d6b334449f719e2d6676
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1819.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1819.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5847.exeFilesize
349KB
MD5c8b3385254927c0ddd6cf09a8cfedbaa
SHA17d8e6614aa4640e7da9f0fbcacab4e92438df6ae
SHA25627bffd254246ede6acc358ba4e5b1d8a8a7e7a0962ae421c0bb1d594cd3efe74
SHA51249adf6652012f48afbadd1c56b3d2f89aa2010d28623156b832f3c270a4130eafd8248f5616c3b63cac0aeb33a56fd9dd720cd3ce75634d68e6c3f8a0f49e44d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5847.exeFilesize
349KB
MD5c8b3385254927c0ddd6cf09a8cfedbaa
SHA17d8e6614aa4640e7da9f0fbcacab4e92438df6ae
SHA25627bffd254246ede6acc358ba4e5b1d8a8a7e7a0962ae421c0bb1d594cd3efe74
SHA51249adf6652012f48afbadd1c56b3d2f89aa2010d28623156b832f3c270a4130eafd8248f5616c3b63cac0aeb33a56fd9dd720cd3ce75634d68e6c3f8a0f49e44d
-
memory/4200-140-0x00000000023F0000-0x0000000002436000-memory.dmpFilesize
280KB
-
memory/4200-141-0x0000000004FA0000-0x000000000549E000-memory.dmpFilesize
5.0MB
-
memory/4200-142-0x00000000025C0000-0x0000000002604000-memory.dmpFilesize
272KB
-
memory/4200-143-0x00000000007F0000-0x000000000083B000-memory.dmpFilesize
300KB
-
memory/4200-144-0x0000000004F90000-0x0000000004FA0000-memory.dmpFilesize
64KB
-
memory/4200-145-0x0000000004F90000-0x0000000004FA0000-memory.dmpFilesize
64KB
-
memory/4200-146-0x0000000004F90000-0x0000000004FA0000-memory.dmpFilesize
64KB
-
memory/4200-147-0x00000000025C0000-0x00000000025FE000-memory.dmpFilesize
248KB
-
memory/4200-148-0x00000000025C0000-0x00000000025FE000-memory.dmpFilesize
248KB
-
memory/4200-150-0x00000000025C0000-0x00000000025FE000-memory.dmpFilesize
248KB
-
memory/4200-152-0x00000000025C0000-0x00000000025FE000-memory.dmpFilesize
248KB
-
memory/4200-154-0x00000000025C0000-0x00000000025FE000-memory.dmpFilesize
248KB
-
memory/4200-156-0x00000000025C0000-0x00000000025FE000-memory.dmpFilesize
248KB
-
memory/4200-158-0x00000000025C0000-0x00000000025FE000-memory.dmpFilesize
248KB
-
memory/4200-160-0x00000000025C0000-0x00000000025FE000-memory.dmpFilesize
248KB
-
memory/4200-162-0x00000000025C0000-0x00000000025FE000-memory.dmpFilesize
248KB
-
memory/4200-164-0x00000000025C0000-0x00000000025FE000-memory.dmpFilesize
248KB
-
memory/4200-166-0x00000000025C0000-0x00000000025FE000-memory.dmpFilesize
248KB
-
memory/4200-168-0x00000000025C0000-0x00000000025FE000-memory.dmpFilesize
248KB
-
memory/4200-170-0x00000000025C0000-0x00000000025FE000-memory.dmpFilesize
248KB
-
memory/4200-172-0x00000000025C0000-0x00000000025FE000-memory.dmpFilesize
248KB
-
memory/4200-174-0x00000000025C0000-0x00000000025FE000-memory.dmpFilesize
248KB
-
memory/4200-176-0x00000000025C0000-0x00000000025FE000-memory.dmpFilesize
248KB
-
memory/4200-178-0x00000000025C0000-0x00000000025FE000-memory.dmpFilesize
248KB
-
memory/4200-180-0x00000000025C0000-0x00000000025FE000-memory.dmpFilesize
248KB
-
memory/4200-182-0x00000000025C0000-0x00000000025FE000-memory.dmpFilesize
248KB
-
memory/4200-184-0x00000000025C0000-0x00000000025FE000-memory.dmpFilesize
248KB
-
memory/4200-186-0x00000000025C0000-0x00000000025FE000-memory.dmpFilesize
248KB
-
memory/4200-188-0x00000000025C0000-0x00000000025FE000-memory.dmpFilesize
248KB
-
memory/4200-190-0x00000000025C0000-0x00000000025FE000-memory.dmpFilesize
248KB
-
memory/4200-192-0x00000000025C0000-0x00000000025FE000-memory.dmpFilesize
248KB
-
memory/4200-194-0x00000000025C0000-0x00000000025FE000-memory.dmpFilesize
248KB
-
memory/4200-196-0x00000000025C0000-0x00000000025FE000-memory.dmpFilesize
248KB
-
memory/4200-198-0x00000000025C0000-0x00000000025FE000-memory.dmpFilesize
248KB
-
memory/4200-200-0x00000000025C0000-0x00000000025FE000-memory.dmpFilesize
248KB
-
memory/4200-202-0x00000000025C0000-0x00000000025FE000-memory.dmpFilesize
248KB
-
memory/4200-204-0x00000000025C0000-0x00000000025FE000-memory.dmpFilesize
248KB
-
memory/4200-206-0x00000000025C0000-0x00000000025FE000-memory.dmpFilesize
248KB
-
memory/4200-208-0x00000000025C0000-0x00000000025FE000-memory.dmpFilesize
248KB
-
memory/4200-210-0x00000000025C0000-0x00000000025FE000-memory.dmpFilesize
248KB
-
memory/4200-1053-0x0000000005AB0000-0x00000000060B6000-memory.dmpFilesize
6.0MB
-
memory/4200-1054-0x00000000054A0000-0x00000000055AA000-memory.dmpFilesize
1.0MB
-
memory/4200-1055-0x0000000004F10000-0x0000000004F22000-memory.dmpFilesize
72KB
-
memory/4200-1056-0x0000000004F30000-0x0000000004F6E000-memory.dmpFilesize
248KB
-
memory/4200-1057-0x00000000056B0000-0x00000000056FB000-memory.dmpFilesize
300KB
-
memory/4200-1058-0x0000000004F90000-0x0000000004FA0000-memory.dmpFilesize
64KB
-
memory/4200-1060-0x0000000005830000-0x00000000058C2000-memory.dmpFilesize
584KB
-
memory/4200-1061-0x00000000058D0000-0x0000000005936000-memory.dmpFilesize
408KB
-
memory/4200-1062-0x00000000065F0000-0x00000000067B2000-memory.dmpFilesize
1.8MB
-
memory/4200-1063-0x00000000067C0000-0x0000000006CEC000-memory.dmpFilesize
5.2MB
-
memory/4200-1064-0x0000000004F90000-0x0000000004FA0000-memory.dmpFilesize
64KB
-
memory/4200-1065-0x0000000004F90000-0x0000000004FA0000-memory.dmpFilesize
64KB
-
memory/4200-1066-0x0000000006E20000-0x0000000006E96000-memory.dmpFilesize
472KB
-
memory/4200-1067-0x0000000006EA0000-0x0000000006EF0000-memory.dmpFilesize
320KB
-
memory/4200-1068-0x0000000004F90000-0x0000000004FA0000-memory.dmpFilesize
64KB
-
memory/4348-134-0x0000000000D90000-0x0000000000D9A000-memory.dmpFilesize
40KB
-
memory/4600-1074-0x00000000009B0000-0x00000000009E2000-memory.dmpFilesize
200KB
-
memory/4600-1075-0x0000000005270000-0x00000000052BB000-memory.dmpFilesize
300KB
-
memory/4600-1076-0x0000000005260000-0x0000000005270000-memory.dmpFilesize
64KB