Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
23-03-2023 20:18
Static task
static1
Behavioral task
behavioral1
Sample
9f16599b6c536c749d369a5ef0dd9968054b068ee7a8d10a1889e210185cce89.exe
Resource
win10v2004-20230220-en
General
-
Target
9f16599b6c536c749d369a5ef0dd9968054b068ee7a8d10a1889e210185cce89.exe
-
Size
544KB
-
MD5
6d85a69cba3d56afb36bbcc8cba9262a
-
SHA1
487d60f813130cf78a02b5a63471ffab1956cafc
-
SHA256
9f16599b6c536c749d369a5ef0dd9968054b068ee7a8d10a1889e210185cce89
-
SHA512
70469a719b39284238c7d294f9c115f3136891a61645f4b3e2cb728a4a004f99408e7534f54048f69598ea08a34a49487673e9bdb060a290f88dcf2f4f0c612e
-
SSDEEP
12288:+Mrgy907t0Kyfn11FDvJUUqgUVML5wJ0oLwxvyUP/NPF:KyMkfn/Fzm44MdBXj
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
lown
193.233.20.31:4125
-
auth_value
4cf836e062bcdc2a4fdbf410f5747ec7
Signatures
-
Processes:
h41Pk92.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" h41Pk92.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" h41Pk92.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" h41Pk92.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" h41Pk92.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection h41Pk92.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" h41Pk92.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/5060-158-0x0000000002980000-0x00000000029BE000-memory.dmp family_redline behavioral1/memory/5060-159-0x0000000002980000-0x00000000029BE000-memory.dmp family_redline behavioral1/memory/5060-161-0x0000000002980000-0x00000000029BE000-memory.dmp family_redline behavioral1/memory/5060-163-0x0000000002980000-0x00000000029BE000-memory.dmp family_redline behavioral1/memory/5060-165-0x0000000002980000-0x00000000029BE000-memory.dmp family_redline behavioral1/memory/5060-167-0x0000000002980000-0x00000000029BE000-memory.dmp family_redline behavioral1/memory/5060-169-0x0000000002980000-0x00000000029BE000-memory.dmp family_redline behavioral1/memory/5060-171-0x0000000002980000-0x00000000029BE000-memory.dmp family_redline behavioral1/memory/5060-173-0x0000000002980000-0x00000000029BE000-memory.dmp family_redline behavioral1/memory/5060-175-0x0000000002980000-0x00000000029BE000-memory.dmp family_redline behavioral1/memory/5060-177-0x0000000002980000-0x00000000029BE000-memory.dmp family_redline behavioral1/memory/5060-179-0x0000000002980000-0x00000000029BE000-memory.dmp family_redline behavioral1/memory/5060-181-0x0000000002980000-0x00000000029BE000-memory.dmp family_redline behavioral1/memory/5060-183-0x0000000002980000-0x00000000029BE000-memory.dmp family_redline behavioral1/memory/5060-185-0x0000000002980000-0x00000000029BE000-memory.dmp family_redline behavioral1/memory/5060-187-0x0000000002980000-0x00000000029BE000-memory.dmp family_redline behavioral1/memory/5060-189-0x0000000002980000-0x00000000029BE000-memory.dmp family_redline behavioral1/memory/5060-191-0x0000000002980000-0x00000000029BE000-memory.dmp family_redline behavioral1/memory/5060-193-0x0000000002980000-0x00000000029BE000-memory.dmp family_redline behavioral1/memory/5060-195-0x0000000002980000-0x00000000029BE000-memory.dmp family_redline behavioral1/memory/5060-197-0x0000000002980000-0x00000000029BE000-memory.dmp family_redline behavioral1/memory/5060-199-0x0000000002980000-0x00000000029BE000-memory.dmp family_redline behavioral1/memory/5060-201-0x0000000002980000-0x00000000029BE000-memory.dmp family_redline behavioral1/memory/5060-203-0x0000000002980000-0x00000000029BE000-memory.dmp family_redline behavioral1/memory/5060-205-0x0000000002980000-0x00000000029BE000-memory.dmp family_redline behavioral1/memory/5060-207-0x0000000002980000-0x00000000029BE000-memory.dmp family_redline behavioral1/memory/5060-209-0x0000000002980000-0x00000000029BE000-memory.dmp family_redline behavioral1/memory/5060-211-0x0000000002980000-0x00000000029BE000-memory.dmp family_redline behavioral1/memory/5060-213-0x0000000002980000-0x00000000029BE000-memory.dmp family_redline behavioral1/memory/5060-215-0x0000000002980000-0x00000000029BE000-memory.dmp family_redline behavioral1/memory/5060-217-0x0000000002980000-0x00000000029BE000-memory.dmp family_redline behavioral1/memory/5060-219-0x0000000002980000-0x00000000029BE000-memory.dmp family_redline behavioral1/memory/5060-221-0x0000000002980000-0x00000000029BE000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
niba8851.exeh41Pk92.exeisueZ15.exel90vP47.exepid process 3788 niba8851.exe 4280 h41Pk92.exe 5060 isueZ15.exe 3604 l90vP47.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
h41Pk92.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" h41Pk92.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
niba8851.exe9f16599b6c536c749d369a5ef0dd9968054b068ee7a8d10a1889e210185cce89.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce niba8851.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" niba8851.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 9f16599b6c536c749d369a5ef0dd9968054b068ee7a8d10a1889e210185cce89.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 9f16599b6c536c749d369a5ef0dd9968054b068ee7a8d10a1889e210185cce89.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2708 5060 WerFault.exe isueZ15.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
h41Pk92.exeisueZ15.exel90vP47.exepid process 4280 h41Pk92.exe 4280 h41Pk92.exe 5060 isueZ15.exe 5060 isueZ15.exe 3604 l90vP47.exe 3604 l90vP47.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
h41Pk92.exeisueZ15.exel90vP47.exedescription pid process Token: SeDebugPrivilege 4280 h41Pk92.exe Token: SeDebugPrivilege 5060 isueZ15.exe Token: SeDebugPrivilege 3604 l90vP47.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
9f16599b6c536c749d369a5ef0dd9968054b068ee7a8d10a1889e210185cce89.exeniba8851.exedescription pid process target process PID 3364 wrote to memory of 3788 3364 9f16599b6c536c749d369a5ef0dd9968054b068ee7a8d10a1889e210185cce89.exe niba8851.exe PID 3364 wrote to memory of 3788 3364 9f16599b6c536c749d369a5ef0dd9968054b068ee7a8d10a1889e210185cce89.exe niba8851.exe PID 3364 wrote to memory of 3788 3364 9f16599b6c536c749d369a5ef0dd9968054b068ee7a8d10a1889e210185cce89.exe niba8851.exe PID 3788 wrote to memory of 4280 3788 niba8851.exe h41Pk92.exe PID 3788 wrote to memory of 4280 3788 niba8851.exe h41Pk92.exe PID 3788 wrote to memory of 5060 3788 niba8851.exe isueZ15.exe PID 3788 wrote to memory of 5060 3788 niba8851.exe isueZ15.exe PID 3788 wrote to memory of 5060 3788 niba8851.exe isueZ15.exe PID 3364 wrote to memory of 3604 3364 9f16599b6c536c749d369a5ef0dd9968054b068ee7a8d10a1889e210185cce89.exe l90vP47.exe PID 3364 wrote to memory of 3604 3364 9f16599b6c536c749d369a5ef0dd9968054b068ee7a8d10a1889e210185cce89.exe l90vP47.exe PID 3364 wrote to memory of 3604 3364 9f16599b6c536c749d369a5ef0dd9968054b068ee7a8d10a1889e210185cce89.exe l90vP47.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f16599b6c536c749d369a5ef0dd9968054b068ee7a8d10a1889e210185cce89.exe"C:\Users\Admin\AppData\Local\Temp\9f16599b6c536c749d369a5ef0dd9968054b068ee7a8d10a1889e210185cce89.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba8851.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba8851.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h41Pk92.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h41Pk92.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\isueZ15.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\isueZ15.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 13484⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l90vP47.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l90vP47.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5060 -ip 50601⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l90vP47.exeFilesize
175KB
MD550809fe16d7c482c1f4a2ea19fdcbc0a
SHA111b6f69c06a724da15183b16039c5cbc86016158
SHA25609917b67829de37b5d6be8115c8f8321f436554f426a24e079257a8368051cb1
SHA512c35170e5eb6dabda9fd2d289153df829957ca8e9665178529a1ba36395155bb34f489372993ec694d10bea490c86cef2ae152e2df480288aca8e796ba135261f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l90vP47.exeFilesize
175KB
MD550809fe16d7c482c1f4a2ea19fdcbc0a
SHA111b6f69c06a724da15183b16039c5cbc86016158
SHA25609917b67829de37b5d6be8115c8f8321f436554f426a24e079257a8368051cb1
SHA512c35170e5eb6dabda9fd2d289153df829957ca8e9665178529a1ba36395155bb34f489372993ec694d10bea490c86cef2ae152e2df480288aca8e796ba135261f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba8851.exeFilesize
402KB
MD5b860c286a60ab2ce32b8ece2bbead9e2
SHA162824ed0b6afee1152d0a6a760ce952892062850
SHA2564edd165dc08fe6fbdff6022fd83ca627be496fafe1a39ae20fc15f8552dad3c9
SHA512cc1603f7d1b52e134912c68ea2a77fc20ed71375a63e073b9d13164636dad6d43579b1aede26b2b51e4ab166f76945fb4cd3c6fc5ca1b81a8cefb8177da5ec6f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba8851.exeFilesize
402KB
MD5b860c286a60ab2ce32b8ece2bbead9e2
SHA162824ed0b6afee1152d0a6a760ce952892062850
SHA2564edd165dc08fe6fbdff6022fd83ca627be496fafe1a39ae20fc15f8552dad3c9
SHA512cc1603f7d1b52e134912c68ea2a77fc20ed71375a63e073b9d13164636dad6d43579b1aede26b2b51e4ab166f76945fb4cd3c6fc5ca1b81a8cefb8177da5ec6f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h41Pk92.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h41Pk92.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\isueZ15.exeFilesize
349KB
MD5c58fea049f83bb1e2727d6aa0af27368
SHA13e260a33e1017b2f2da4836c1e9118e0b0f2a8d0
SHA256a964ce65e882eb3471255e3b6f36319f119f75ee16e8bf8fe52db59083fbfd58
SHA5126211b70809a2f25bb7213e5a60f4c70ca614deac127c069f091a633806061d6c7b12d78d6af758ca9556db1b89f43b288c945b220e2700b1f639af0137fff2a5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\isueZ15.exeFilesize
349KB
MD5c58fea049f83bb1e2727d6aa0af27368
SHA13e260a33e1017b2f2da4836c1e9118e0b0f2a8d0
SHA256a964ce65e882eb3471255e3b6f36319f119f75ee16e8bf8fe52db59083fbfd58
SHA5126211b70809a2f25bb7213e5a60f4c70ca614deac127c069f091a633806061d6c7b12d78d6af758ca9556db1b89f43b288c945b220e2700b1f639af0137fff2a5
-
memory/3604-1086-0x00000000003A0000-0x00000000003D2000-memory.dmpFilesize
200KB
-
memory/3604-1087-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/4280-147-0x0000000000630000-0x000000000063A000-memory.dmpFilesize
40KB
-
memory/5060-189-0x0000000002980000-0x00000000029BE000-memory.dmpFilesize
248KB
-
memory/5060-201-0x0000000002980000-0x00000000029BE000-memory.dmpFilesize
248KB
-
memory/5060-155-0x0000000004DA0000-0x0000000004DB0000-memory.dmpFilesize
64KB
-
memory/5060-156-0x0000000004DA0000-0x0000000004DB0000-memory.dmpFilesize
64KB
-
memory/5060-157-0x0000000004DA0000-0x0000000004DB0000-memory.dmpFilesize
64KB
-
memory/5060-158-0x0000000002980000-0x00000000029BE000-memory.dmpFilesize
248KB
-
memory/5060-159-0x0000000002980000-0x00000000029BE000-memory.dmpFilesize
248KB
-
memory/5060-161-0x0000000002980000-0x00000000029BE000-memory.dmpFilesize
248KB
-
memory/5060-163-0x0000000002980000-0x00000000029BE000-memory.dmpFilesize
248KB
-
memory/5060-165-0x0000000002980000-0x00000000029BE000-memory.dmpFilesize
248KB
-
memory/5060-167-0x0000000002980000-0x00000000029BE000-memory.dmpFilesize
248KB
-
memory/5060-169-0x0000000002980000-0x00000000029BE000-memory.dmpFilesize
248KB
-
memory/5060-171-0x0000000002980000-0x00000000029BE000-memory.dmpFilesize
248KB
-
memory/5060-173-0x0000000002980000-0x00000000029BE000-memory.dmpFilesize
248KB
-
memory/5060-175-0x0000000002980000-0x00000000029BE000-memory.dmpFilesize
248KB
-
memory/5060-177-0x0000000002980000-0x00000000029BE000-memory.dmpFilesize
248KB
-
memory/5060-179-0x0000000002980000-0x00000000029BE000-memory.dmpFilesize
248KB
-
memory/5060-181-0x0000000002980000-0x00000000029BE000-memory.dmpFilesize
248KB
-
memory/5060-183-0x0000000002980000-0x00000000029BE000-memory.dmpFilesize
248KB
-
memory/5060-185-0x0000000002980000-0x00000000029BE000-memory.dmpFilesize
248KB
-
memory/5060-187-0x0000000002980000-0x00000000029BE000-memory.dmpFilesize
248KB
-
memory/5060-153-0x0000000000C40000-0x0000000000C8B000-memory.dmpFilesize
300KB
-
memory/5060-191-0x0000000002980000-0x00000000029BE000-memory.dmpFilesize
248KB
-
memory/5060-193-0x0000000002980000-0x00000000029BE000-memory.dmpFilesize
248KB
-
memory/5060-195-0x0000000002980000-0x00000000029BE000-memory.dmpFilesize
248KB
-
memory/5060-197-0x0000000002980000-0x00000000029BE000-memory.dmpFilesize
248KB
-
memory/5060-199-0x0000000002980000-0x00000000029BE000-memory.dmpFilesize
248KB
-
memory/5060-154-0x0000000004DB0000-0x0000000005354000-memory.dmpFilesize
5.6MB
-
memory/5060-203-0x0000000002980000-0x00000000029BE000-memory.dmpFilesize
248KB
-
memory/5060-205-0x0000000002980000-0x00000000029BE000-memory.dmpFilesize
248KB
-
memory/5060-207-0x0000000002980000-0x00000000029BE000-memory.dmpFilesize
248KB
-
memory/5060-209-0x0000000002980000-0x00000000029BE000-memory.dmpFilesize
248KB
-
memory/5060-211-0x0000000002980000-0x00000000029BE000-memory.dmpFilesize
248KB
-
memory/5060-213-0x0000000002980000-0x00000000029BE000-memory.dmpFilesize
248KB
-
memory/5060-215-0x0000000002980000-0x00000000029BE000-memory.dmpFilesize
248KB
-
memory/5060-217-0x0000000002980000-0x00000000029BE000-memory.dmpFilesize
248KB
-
memory/5060-219-0x0000000002980000-0x00000000029BE000-memory.dmpFilesize
248KB
-
memory/5060-221-0x0000000002980000-0x00000000029BE000-memory.dmpFilesize
248KB
-
memory/5060-1064-0x0000000005360000-0x0000000005978000-memory.dmpFilesize
6.1MB
-
memory/5060-1065-0x00000000059C0000-0x0000000005ACA000-memory.dmpFilesize
1.0MB
-
memory/5060-1066-0x0000000005B00000-0x0000000005B12000-memory.dmpFilesize
72KB
-
memory/5060-1067-0x0000000004DA0000-0x0000000004DB0000-memory.dmpFilesize
64KB
-
memory/5060-1068-0x0000000005B20000-0x0000000005B5C000-memory.dmpFilesize
240KB
-
memory/5060-1070-0x0000000004DA0000-0x0000000004DB0000-memory.dmpFilesize
64KB
-
memory/5060-1071-0x0000000004DA0000-0x0000000004DB0000-memory.dmpFilesize
64KB
-
memory/5060-1072-0x0000000004DA0000-0x0000000004DB0000-memory.dmpFilesize
64KB
-
memory/5060-1073-0x0000000005E10000-0x0000000005EA2000-memory.dmpFilesize
584KB
-
memory/5060-1074-0x0000000005EB0000-0x0000000005F16000-memory.dmpFilesize
408KB
-
memory/5060-1075-0x00000000066D0000-0x0000000006746000-memory.dmpFilesize
472KB
-
memory/5060-1076-0x0000000004DA0000-0x0000000004DB0000-memory.dmpFilesize
64KB
-
memory/5060-1077-0x0000000006750000-0x00000000067A0000-memory.dmpFilesize
320KB
-
memory/5060-1078-0x0000000006900000-0x0000000006AC2000-memory.dmpFilesize
1.8MB
-
memory/5060-1079-0x0000000006AD0000-0x0000000006FFC000-memory.dmpFilesize
5.2MB