Analysis
-
max time kernel
158s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
23-03-2023 22:31
Static task
static1
Behavioral task
behavioral1
Sample
eeb1890f28121e00dcd6376f20cba0e6e947cc4cbf4a2ff3921fa4a1bbc2aba8.exe
Resource
win10v2004-20230220-en
General
-
Target
eeb1890f28121e00dcd6376f20cba0e6e947cc4cbf4a2ff3921fa4a1bbc2aba8.exe
-
Size
544KB
-
MD5
3e5af2ff740e3c00c4f2f3b88358952e
-
SHA1
1a76a3c0a03051bb415a49fe5c3f0b4520b9a80f
-
SHA256
eeb1890f28121e00dcd6376f20cba0e6e947cc4cbf4a2ff3921fa4a1bbc2aba8
-
SHA512
61cfd2af754d4bd06381e308da89c48dad8f9d60902603df7103264cf88cf182d3bc97683868c85b405fe3e96e26a628917c5f00f852e6fac9db4dfcea0a8d66
-
SSDEEP
12288:TMrpy90VxHnhYe2gYLs5+t7dz3qzUMML9wHUqRDWscDW31d:GyOFnhYe2gtEZdzg5Mh6UmyscC3n
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
real
193.233.20.31:4125
-
auth_value
bb22a50228754849387d5f4d1611e71b
Signatures
-
Processes:
pro0153.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection pro0153.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro0153.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro0153.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro0153.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro0153.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro0153.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/764-158-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/764-159-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/764-161-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/764-163-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/764-165-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/764-167-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/764-169-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/764-171-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/764-173-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/764-175-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/764-177-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/764-179-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/764-181-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/764-183-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/764-185-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/764-187-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/764-189-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/764-191-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/764-193-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/764-195-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/764-197-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/764-199-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/764-201-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/764-203-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/764-205-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/764-207-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/764-209-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/764-211-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/764-213-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/764-215-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/764-217-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/764-219-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline behavioral1/memory/764-221-0x0000000004CC0000-0x0000000004CFE000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
unio3219.exepro0153.exequ3893.exesi968710.exepid process 2232 unio3219.exe 4560 pro0153.exe 764 qu3893.exe 1280 si968710.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro0153.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" pro0153.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
eeb1890f28121e00dcd6376f20cba0e6e947cc4cbf4a2ff3921fa4a1bbc2aba8.exeunio3219.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce eeb1890f28121e00dcd6376f20cba0e6e947cc4cbf4a2ff3921fa4a1bbc2aba8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" eeb1890f28121e00dcd6376f20cba0e6e947cc4cbf4a2ff3921fa4a1bbc2aba8.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce unio3219.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" unio3219.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 3328 sc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1836 764 WerFault.exe qu3893.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro0153.exequ3893.exesi968710.exepid process 4560 pro0153.exe 4560 pro0153.exe 764 qu3893.exe 764 qu3893.exe 1280 si968710.exe 1280 si968710.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro0153.exequ3893.exesi968710.exedescription pid process Token: SeDebugPrivilege 4560 pro0153.exe Token: SeDebugPrivilege 764 qu3893.exe Token: SeDebugPrivilege 1280 si968710.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
eeb1890f28121e00dcd6376f20cba0e6e947cc4cbf4a2ff3921fa4a1bbc2aba8.exeunio3219.exedescription pid process target process PID 2588 wrote to memory of 2232 2588 eeb1890f28121e00dcd6376f20cba0e6e947cc4cbf4a2ff3921fa4a1bbc2aba8.exe unio3219.exe PID 2588 wrote to memory of 2232 2588 eeb1890f28121e00dcd6376f20cba0e6e947cc4cbf4a2ff3921fa4a1bbc2aba8.exe unio3219.exe PID 2588 wrote to memory of 2232 2588 eeb1890f28121e00dcd6376f20cba0e6e947cc4cbf4a2ff3921fa4a1bbc2aba8.exe unio3219.exe PID 2232 wrote to memory of 4560 2232 unio3219.exe pro0153.exe PID 2232 wrote to memory of 4560 2232 unio3219.exe pro0153.exe PID 2232 wrote to memory of 764 2232 unio3219.exe qu3893.exe PID 2232 wrote to memory of 764 2232 unio3219.exe qu3893.exe PID 2232 wrote to memory of 764 2232 unio3219.exe qu3893.exe PID 2588 wrote to memory of 1280 2588 eeb1890f28121e00dcd6376f20cba0e6e947cc4cbf4a2ff3921fa4a1bbc2aba8.exe si968710.exe PID 2588 wrote to memory of 1280 2588 eeb1890f28121e00dcd6376f20cba0e6e947cc4cbf4a2ff3921fa4a1bbc2aba8.exe si968710.exe PID 2588 wrote to memory of 1280 2588 eeb1890f28121e00dcd6376f20cba0e6e947cc4cbf4a2ff3921fa4a1bbc2aba8.exe si968710.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eeb1890f28121e00dcd6376f20cba0e6e947cc4cbf4a2ff3921fa4a1bbc2aba8.exe"C:\Users\Admin\AppData\Local\Temp\eeb1890f28121e00dcd6376f20cba0e6e947cc4cbf4a2ff3921fa4a1bbc2aba8.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio3219.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio3219.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0153.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0153.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3893.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3893.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 17244⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si968710.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si968710.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 764 -ip 7641⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si968710.exeFilesize
175KB
MD541707338e1e2d868aa699ac0dd2e77b0
SHA136e0dfba09f9fb409faf0f9a99217d0d0c524b82
SHA2568d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557
SHA51280c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si968710.exeFilesize
175KB
MD541707338e1e2d868aa699ac0dd2e77b0
SHA136e0dfba09f9fb409faf0f9a99217d0d0c524b82
SHA2568d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557
SHA51280c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio3219.exeFilesize
402KB
MD571595f72f1fdca3844c94327b5ee789c
SHA1fbe9f09f2447af6a8cc6a08b74d87091b866d9ff
SHA25633b0a4c18726da83dc37d92fedd9c65d75db8543da458fb329ce34e39eb40500
SHA51246c6953832d4351f6f4d6984b8c5f700099fc16fd283acc10885d95c899246d3f09cf7247a438a54d040d6b7b80417b5046ee69c6e43ebe526486de3d6b3883f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio3219.exeFilesize
402KB
MD571595f72f1fdca3844c94327b5ee789c
SHA1fbe9f09f2447af6a8cc6a08b74d87091b866d9ff
SHA25633b0a4c18726da83dc37d92fedd9c65d75db8543da458fb329ce34e39eb40500
SHA51246c6953832d4351f6f4d6984b8c5f700099fc16fd283acc10885d95c899246d3f09cf7247a438a54d040d6b7b80417b5046ee69c6e43ebe526486de3d6b3883f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0153.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0153.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3893.exeFilesize
349KB
MD5406b84821cf32ab5cf9982a39f0403fc
SHA1bc798f100c6c408cd74dcdb3f428796d6c03934a
SHA256147ac1c1b11bb0a2619578512808d0228637b823e854f87212162ebc7995bd65
SHA512b3adca6745461a1a12165d6da4ae11da1d3c5f956be532fa45f6d00b88691940c0d72fefc568778bbd4af5e2866ed7821011af6a8e59730998ae1c1d100069cd
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3893.exeFilesize
349KB
MD5406b84821cf32ab5cf9982a39f0403fc
SHA1bc798f100c6c408cd74dcdb3f428796d6c03934a
SHA256147ac1c1b11bb0a2619578512808d0228637b823e854f87212162ebc7995bd65
SHA512b3adca6745461a1a12165d6da4ae11da1d3c5f956be532fa45f6d00b88691940c0d72fefc568778bbd4af5e2866ed7821011af6a8e59730998ae1c1d100069cd
-
memory/764-153-0x0000000002370000-0x00000000023BB000-memory.dmpFilesize
300KB
-
memory/764-156-0x0000000004E20000-0x00000000053C4000-memory.dmpFilesize
5.6MB
-
memory/764-155-0x0000000004E10000-0x0000000004E20000-memory.dmpFilesize
64KB
-
memory/764-157-0x0000000004E10000-0x0000000004E20000-memory.dmpFilesize
64KB
-
memory/764-154-0x0000000004E10000-0x0000000004E20000-memory.dmpFilesize
64KB
-
memory/764-158-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/764-159-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/764-161-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/764-163-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/764-165-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/764-167-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/764-169-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/764-171-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/764-173-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/764-175-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/764-177-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/764-179-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/764-181-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/764-183-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/764-185-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/764-187-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/764-189-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/764-191-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/764-193-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/764-195-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/764-197-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/764-199-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/764-201-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/764-203-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/764-205-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/764-207-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/764-209-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/764-211-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/764-213-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/764-215-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/764-217-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/764-219-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/764-221-0x0000000004CC0000-0x0000000004CFE000-memory.dmpFilesize
248KB
-
memory/764-1064-0x00000000054D0000-0x0000000005AE8000-memory.dmpFilesize
6.1MB
-
memory/764-1065-0x0000000005B00000-0x0000000005C0A000-memory.dmpFilesize
1.0MB
-
memory/764-1066-0x0000000005C40000-0x0000000005C52000-memory.dmpFilesize
72KB
-
memory/764-1067-0x0000000005C60000-0x0000000005C9C000-memory.dmpFilesize
240KB
-
memory/764-1068-0x0000000004E10000-0x0000000004E20000-memory.dmpFilesize
64KB
-
memory/764-1069-0x0000000005F50000-0x0000000005FE2000-memory.dmpFilesize
584KB
-
memory/764-1070-0x0000000005FF0000-0x0000000006056000-memory.dmpFilesize
408KB
-
memory/764-1072-0x0000000004E10000-0x0000000004E20000-memory.dmpFilesize
64KB
-
memory/764-1073-0x0000000004E10000-0x0000000004E20000-memory.dmpFilesize
64KB
-
memory/764-1074-0x0000000006840000-0x00000000068B6000-memory.dmpFilesize
472KB
-
memory/764-1075-0x00000000068C0000-0x0000000006910000-memory.dmpFilesize
320KB
-
memory/764-1076-0x0000000004E10000-0x0000000004E20000-memory.dmpFilesize
64KB
-
memory/764-1077-0x0000000007BF0000-0x0000000007DB2000-memory.dmpFilesize
1.8MB
-
memory/764-1078-0x0000000007DC0000-0x00000000082EC000-memory.dmpFilesize
5.2MB
-
memory/1280-1084-0x0000000000EC0000-0x0000000000EF2000-memory.dmpFilesize
200KB
-
memory/1280-1085-0x0000000005A70000-0x0000000005A80000-memory.dmpFilesize
64KB
-
memory/1280-1086-0x0000000005A70000-0x0000000005A80000-memory.dmpFilesize
64KB
-
memory/4560-147-0x0000000000B80000-0x0000000000B8A000-memory.dmpFilesize
40KB