Analysis
-
max time kernel
146s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
23-03-2023 13:55
Static task
static1
Behavioral task
behavioral1
Sample
d6347648b7f19bc3a3e3fd363db648c1cbe81fdeac06e7d394e65b28430a6fa8.exe
Resource
win10v2004-20230220-en
General
-
Target
d6347648b7f19bc3a3e3fd363db648c1cbe81fdeac06e7d394e65b28430a6fa8.exe
-
Size
544KB
-
MD5
8ce05dc0300fa2fa1b0ac61b074f167e
-
SHA1
99f450e59787527c8e1849ec0f299ab4b2f5fe8a
-
SHA256
d6347648b7f19bc3a3e3fd363db648c1cbe81fdeac06e7d394e65b28430a6fa8
-
SHA512
1d284efa8ad6db425c1e3c6a7b6a489d5e53846cdf32c1bfef69d4d8281a0a3640624bdc082d59c5a3d867c8a2e62c7c55f8e1c7c9765f5ee3244d302c8d8c26
-
SSDEEP
12288:sMruy907yNLwSi+Z+qJ2uW1nXaWHiKxF59Qr7PNqZhN8l6V:ayUyNwJ+Z+qE1XpLk7PNqhH
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
lown
193.233.20.31:4125
-
auth_value
4cf836e062bcdc2a4fdbf410f5747ec7
Signatures
-
Processes:
h18Rl01.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" h18Rl01.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection h18Rl01.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" h18Rl01.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" h18Rl01.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" h18Rl01.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" h18Rl01.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/4576-157-0x0000000002800000-0x000000000283E000-memory.dmp family_redline behavioral1/memory/4576-158-0x0000000002800000-0x000000000283E000-memory.dmp family_redline behavioral1/memory/4576-160-0x0000000002800000-0x000000000283E000-memory.dmp family_redline behavioral1/memory/4576-162-0x0000000002800000-0x000000000283E000-memory.dmp family_redline behavioral1/memory/4576-164-0x0000000002800000-0x000000000283E000-memory.dmp family_redline behavioral1/memory/4576-166-0x0000000002800000-0x000000000283E000-memory.dmp family_redline behavioral1/memory/4576-168-0x0000000002800000-0x000000000283E000-memory.dmp family_redline behavioral1/memory/4576-172-0x0000000002800000-0x000000000283E000-memory.dmp family_redline behavioral1/memory/4576-170-0x0000000002800000-0x000000000283E000-memory.dmp family_redline behavioral1/memory/4576-174-0x0000000002800000-0x000000000283E000-memory.dmp family_redline behavioral1/memory/4576-176-0x0000000002800000-0x000000000283E000-memory.dmp family_redline behavioral1/memory/4576-178-0x0000000002800000-0x000000000283E000-memory.dmp family_redline behavioral1/memory/4576-180-0x0000000002800000-0x000000000283E000-memory.dmp family_redline behavioral1/memory/4576-182-0x0000000002800000-0x000000000283E000-memory.dmp family_redline behavioral1/memory/4576-184-0x0000000002800000-0x000000000283E000-memory.dmp family_redline behavioral1/memory/4576-187-0x0000000002800000-0x000000000283E000-memory.dmp family_redline behavioral1/memory/4576-189-0x0000000002800000-0x000000000283E000-memory.dmp family_redline behavioral1/memory/4576-191-0x0000000002800000-0x000000000283E000-memory.dmp family_redline behavioral1/memory/4576-193-0x0000000002800000-0x000000000283E000-memory.dmp family_redline behavioral1/memory/4576-195-0x0000000002800000-0x000000000283E000-memory.dmp family_redline behavioral1/memory/4576-197-0x0000000002800000-0x000000000283E000-memory.dmp family_redline behavioral1/memory/4576-199-0x0000000002800000-0x000000000283E000-memory.dmp family_redline behavioral1/memory/4576-201-0x0000000002800000-0x000000000283E000-memory.dmp family_redline behavioral1/memory/4576-203-0x0000000002800000-0x000000000283E000-memory.dmp family_redline behavioral1/memory/4576-205-0x0000000002800000-0x000000000283E000-memory.dmp family_redline behavioral1/memory/4576-207-0x0000000002800000-0x000000000283E000-memory.dmp family_redline behavioral1/memory/4576-209-0x0000000002800000-0x000000000283E000-memory.dmp family_redline behavioral1/memory/4576-211-0x0000000002800000-0x000000000283E000-memory.dmp family_redline behavioral1/memory/4576-213-0x0000000002800000-0x000000000283E000-memory.dmp family_redline behavioral1/memory/4576-215-0x0000000002800000-0x000000000283E000-memory.dmp family_redline behavioral1/memory/4576-217-0x0000000002800000-0x000000000283E000-memory.dmp family_redline behavioral1/memory/4576-219-0x0000000002800000-0x000000000283E000-memory.dmp family_redline behavioral1/memory/4576-221-0x0000000002800000-0x000000000283E000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
niba4735.exeh18Rl01.exeiGrcc85.exel32al05.exepid process 4820 niba4735.exe 1240 h18Rl01.exe 4576 iGrcc85.exe 3776 l32al05.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
h18Rl01.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" h18Rl01.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
d6347648b7f19bc3a3e3fd363db648c1cbe81fdeac06e7d394e65b28430a6fa8.exeniba4735.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce d6347648b7f19bc3a3e3fd363db648c1cbe81fdeac06e7d394e65b28430a6fa8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" d6347648b7f19bc3a3e3fd363db648c1cbe81fdeac06e7d394e65b28430a6fa8.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce niba4735.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" niba4735.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3616 4576 WerFault.exe iGrcc85.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
h18Rl01.exeiGrcc85.exel32al05.exepid process 1240 h18Rl01.exe 1240 h18Rl01.exe 4576 iGrcc85.exe 4576 iGrcc85.exe 3776 l32al05.exe 3776 l32al05.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
h18Rl01.exeiGrcc85.exel32al05.exedescription pid process Token: SeDebugPrivilege 1240 h18Rl01.exe Token: SeDebugPrivilege 4576 iGrcc85.exe Token: SeDebugPrivilege 3776 l32al05.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
d6347648b7f19bc3a3e3fd363db648c1cbe81fdeac06e7d394e65b28430a6fa8.exeniba4735.exedescription pid process target process PID 712 wrote to memory of 4820 712 d6347648b7f19bc3a3e3fd363db648c1cbe81fdeac06e7d394e65b28430a6fa8.exe niba4735.exe PID 712 wrote to memory of 4820 712 d6347648b7f19bc3a3e3fd363db648c1cbe81fdeac06e7d394e65b28430a6fa8.exe niba4735.exe PID 712 wrote to memory of 4820 712 d6347648b7f19bc3a3e3fd363db648c1cbe81fdeac06e7d394e65b28430a6fa8.exe niba4735.exe PID 4820 wrote to memory of 1240 4820 niba4735.exe h18Rl01.exe PID 4820 wrote to memory of 1240 4820 niba4735.exe h18Rl01.exe PID 4820 wrote to memory of 4576 4820 niba4735.exe iGrcc85.exe PID 4820 wrote to memory of 4576 4820 niba4735.exe iGrcc85.exe PID 4820 wrote to memory of 4576 4820 niba4735.exe iGrcc85.exe PID 712 wrote to memory of 3776 712 d6347648b7f19bc3a3e3fd363db648c1cbe81fdeac06e7d394e65b28430a6fa8.exe l32al05.exe PID 712 wrote to memory of 3776 712 d6347648b7f19bc3a3e3fd363db648c1cbe81fdeac06e7d394e65b28430a6fa8.exe l32al05.exe PID 712 wrote to memory of 3776 712 d6347648b7f19bc3a3e3fd363db648c1cbe81fdeac06e7d394e65b28430a6fa8.exe l32al05.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6347648b7f19bc3a3e3fd363db648c1cbe81fdeac06e7d394e65b28430a6fa8.exe"C:\Users\Admin\AppData\Local\Temp\d6347648b7f19bc3a3e3fd363db648c1cbe81fdeac06e7d394e65b28430a6fa8.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba4735.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba4735.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h18Rl01.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h18Rl01.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iGrcc85.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iGrcc85.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 13284⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l32al05.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l32al05.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4576 -ip 45761⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l32al05.exeFilesize
175KB
MD550809fe16d7c482c1f4a2ea19fdcbc0a
SHA111b6f69c06a724da15183b16039c5cbc86016158
SHA25609917b67829de37b5d6be8115c8f8321f436554f426a24e079257a8368051cb1
SHA512c35170e5eb6dabda9fd2d289153df829957ca8e9665178529a1ba36395155bb34f489372993ec694d10bea490c86cef2ae152e2df480288aca8e796ba135261f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l32al05.exeFilesize
175KB
MD550809fe16d7c482c1f4a2ea19fdcbc0a
SHA111b6f69c06a724da15183b16039c5cbc86016158
SHA25609917b67829de37b5d6be8115c8f8321f436554f426a24e079257a8368051cb1
SHA512c35170e5eb6dabda9fd2d289153df829957ca8e9665178529a1ba36395155bb34f489372993ec694d10bea490c86cef2ae152e2df480288aca8e796ba135261f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba4735.exeFilesize
402KB
MD5f2d33c62dd84c5a0050811b48ab735ee
SHA1be1927540a2f1d3ec0e77b5f4e977e1d0da5cd83
SHA25662e081eaef3368518cb571d008c94f90756f3a7db7b2381a35d240ae74fdd4ba
SHA5128e954053656eab67127bac2ce3690214fb0d5eef1f795584a114f9e9a7b245ffeb7b54f92cefb0a0b15a55e4d51ed89fae63b32c61935180be52a5c76a2879f5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba4735.exeFilesize
402KB
MD5f2d33c62dd84c5a0050811b48ab735ee
SHA1be1927540a2f1d3ec0e77b5f4e977e1d0da5cd83
SHA25662e081eaef3368518cb571d008c94f90756f3a7db7b2381a35d240ae74fdd4ba
SHA5128e954053656eab67127bac2ce3690214fb0d5eef1f795584a114f9e9a7b245ffeb7b54f92cefb0a0b15a55e4d51ed89fae63b32c61935180be52a5c76a2879f5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h18Rl01.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h18Rl01.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iGrcc85.exeFilesize
349KB
MD56425b19422c1e462e9bf4545deab419c
SHA168fb7080848b539e5664931ecc990b0b45e0eefa
SHA256b2d277a0c52cdec5a497f75183126bb11661acd18274ae6495c5091c89458041
SHA512a1144727a9f10a2775017dc12c6df0094a1fb670b75f417d1aa29163495a3f3784f687f7ece4e9c0579e50010da62820f613f774db19780f5b46d564f984fd25
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iGrcc85.exeFilesize
349KB
MD56425b19422c1e462e9bf4545deab419c
SHA168fb7080848b539e5664931ecc990b0b45e0eefa
SHA256b2d277a0c52cdec5a497f75183126bb11661acd18274ae6495c5091c89458041
SHA512a1144727a9f10a2775017dc12c6df0094a1fb670b75f417d1aa29163495a3f3784f687f7ece4e9c0579e50010da62820f613f774db19780f5b46d564f984fd25
-
memory/1240-147-0x0000000000ED0000-0x0000000000EDA000-memory.dmpFilesize
40KB
-
memory/3776-1085-0x00000000007D0000-0x0000000000802000-memory.dmpFilesize
200KB
-
memory/3776-1086-0x0000000002B10000-0x0000000002B20000-memory.dmpFilesize
64KB
-
memory/4576-189-0x0000000002800000-0x000000000283E000-memory.dmpFilesize
248KB
-
memory/4576-201-0x0000000002800000-0x000000000283E000-memory.dmpFilesize
248KB
-
memory/4576-155-0x00000000027F0000-0x0000000002800000-memory.dmpFilesize
64KB
-
memory/4576-156-0x0000000004D90000-0x0000000005334000-memory.dmpFilesize
5.6MB
-
memory/4576-157-0x0000000002800000-0x000000000283E000-memory.dmpFilesize
248KB
-
memory/4576-158-0x0000000002800000-0x000000000283E000-memory.dmpFilesize
248KB
-
memory/4576-160-0x0000000002800000-0x000000000283E000-memory.dmpFilesize
248KB
-
memory/4576-162-0x0000000002800000-0x000000000283E000-memory.dmpFilesize
248KB
-
memory/4576-164-0x0000000002800000-0x000000000283E000-memory.dmpFilesize
248KB
-
memory/4576-166-0x0000000002800000-0x000000000283E000-memory.dmpFilesize
248KB
-
memory/4576-168-0x0000000002800000-0x000000000283E000-memory.dmpFilesize
248KB
-
memory/4576-172-0x0000000002800000-0x000000000283E000-memory.dmpFilesize
248KB
-
memory/4576-170-0x0000000002800000-0x000000000283E000-memory.dmpFilesize
248KB
-
memory/4576-174-0x0000000002800000-0x000000000283E000-memory.dmpFilesize
248KB
-
memory/4576-176-0x0000000002800000-0x000000000283E000-memory.dmpFilesize
248KB
-
memory/4576-178-0x0000000002800000-0x000000000283E000-memory.dmpFilesize
248KB
-
memory/4576-180-0x0000000002800000-0x000000000283E000-memory.dmpFilesize
248KB
-
memory/4576-182-0x0000000002800000-0x000000000283E000-memory.dmpFilesize
248KB
-
memory/4576-184-0x0000000002800000-0x000000000283E000-memory.dmpFilesize
248KB
-
memory/4576-186-0x00000000027F0000-0x0000000002800000-memory.dmpFilesize
64KB
-
memory/4576-187-0x0000000002800000-0x000000000283E000-memory.dmpFilesize
248KB
-
memory/4576-153-0x00000000009B0000-0x00000000009FB000-memory.dmpFilesize
300KB
-
memory/4576-191-0x0000000002800000-0x000000000283E000-memory.dmpFilesize
248KB
-
memory/4576-193-0x0000000002800000-0x000000000283E000-memory.dmpFilesize
248KB
-
memory/4576-195-0x0000000002800000-0x000000000283E000-memory.dmpFilesize
248KB
-
memory/4576-197-0x0000000002800000-0x000000000283E000-memory.dmpFilesize
248KB
-
memory/4576-199-0x0000000002800000-0x000000000283E000-memory.dmpFilesize
248KB
-
memory/4576-154-0x00000000027F0000-0x0000000002800000-memory.dmpFilesize
64KB
-
memory/4576-203-0x0000000002800000-0x000000000283E000-memory.dmpFilesize
248KB
-
memory/4576-205-0x0000000002800000-0x000000000283E000-memory.dmpFilesize
248KB
-
memory/4576-207-0x0000000002800000-0x000000000283E000-memory.dmpFilesize
248KB
-
memory/4576-209-0x0000000002800000-0x000000000283E000-memory.dmpFilesize
248KB
-
memory/4576-211-0x0000000002800000-0x000000000283E000-memory.dmpFilesize
248KB
-
memory/4576-213-0x0000000002800000-0x000000000283E000-memory.dmpFilesize
248KB
-
memory/4576-215-0x0000000002800000-0x000000000283E000-memory.dmpFilesize
248KB
-
memory/4576-217-0x0000000002800000-0x000000000283E000-memory.dmpFilesize
248KB
-
memory/4576-219-0x0000000002800000-0x000000000283E000-memory.dmpFilesize
248KB
-
memory/4576-221-0x0000000002800000-0x000000000283E000-memory.dmpFilesize
248KB
-
memory/4576-1064-0x0000000005480000-0x0000000005A98000-memory.dmpFilesize
6.1MB
-
memory/4576-1065-0x0000000005B00000-0x0000000005C0A000-memory.dmpFilesize
1.0MB
-
memory/4576-1066-0x0000000005C40000-0x0000000005C52000-memory.dmpFilesize
72KB
-
memory/4576-1067-0x0000000005C60000-0x0000000005C9C000-memory.dmpFilesize
240KB
-
memory/4576-1068-0x00000000027F0000-0x0000000002800000-memory.dmpFilesize
64KB
-
memory/4576-1069-0x00000000027F0000-0x0000000002800000-memory.dmpFilesize
64KB
-
memory/4576-1070-0x0000000005F50000-0x0000000005FB6000-memory.dmpFilesize
408KB
-
memory/4576-1072-0x00000000027F0000-0x0000000002800000-memory.dmpFilesize
64KB
-
memory/4576-1073-0x0000000006600000-0x0000000006692000-memory.dmpFilesize
584KB
-
memory/4576-1074-0x00000000027F0000-0x0000000002800000-memory.dmpFilesize
64KB
-
memory/4576-1075-0x0000000006950000-0x0000000006B12000-memory.dmpFilesize
1.8MB
-
memory/4576-1076-0x0000000006B30000-0x000000000705C000-memory.dmpFilesize
5.2MB
-
memory/4576-1077-0x00000000027F0000-0x0000000002800000-memory.dmpFilesize
64KB
-
memory/4576-1078-0x0000000008330000-0x00000000083A6000-memory.dmpFilesize
472KB
-
memory/4576-1079-0x00000000083C0000-0x0000000008410000-memory.dmpFilesize
320KB