Analysis
-
max time kernel
145s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
23-03-2023 20:01
Static task
static1
Behavioral task
behavioral1
Sample
c049cff535b58e0b6f218fa5e59705bc4ddbbe0c27574ffe77142c47aa138e6c.exe
Resource
win10v2004-20230221-en
General
-
Target
c049cff535b58e0b6f218fa5e59705bc4ddbbe0c27574ffe77142c47aa138e6c.exe
-
Size
544KB
-
MD5
fe5541da7047542fa8a083b3171ebb2a
-
SHA1
03f647b6b92c6d51ae45b9165a2a803193294ea2
-
SHA256
c049cff535b58e0b6f218fa5e59705bc4ddbbe0c27574ffe77142c47aa138e6c
-
SHA512
1d245b9ea8892ecace01f35e62ab5680dace7c5eab0aa85ab9312acfb4542c0220ff9bede425c949e533c4ba47cbc8051057a2c29b3fbbfd7f35ac8b81862b8b
-
SSDEEP
12288:SMr4y90ZXKLPQO0YWzt+D6wzp/pc2uQL24Dl:mysCUjzKZ/pc2fXJ
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
lown
193.233.20.31:4125
-
auth_value
4cf836e062bcdc2a4fdbf410f5747ec7
Signatures
-
Processes:
h93yz77.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" h93yz77.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" h93yz77.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" h93yz77.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" h93yz77.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" h93yz77.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection h93yz77.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
Processes:
resource yara_rule behavioral1/memory/3380-155-0x00000000028D0000-0x000000000290E000-memory.dmp family_redline behavioral1/memory/3380-158-0x00000000028D0000-0x000000000290E000-memory.dmp family_redline behavioral1/memory/3380-156-0x00000000028D0000-0x000000000290E000-memory.dmp family_redline behavioral1/memory/3380-160-0x00000000028D0000-0x000000000290E000-memory.dmp family_redline behavioral1/memory/3380-162-0x00000000028D0000-0x000000000290E000-memory.dmp family_redline behavioral1/memory/3380-164-0x00000000028D0000-0x000000000290E000-memory.dmp family_redline behavioral1/memory/3380-166-0x00000000028D0000-0x000000000290E000-memory.dmp family_redline behavioral1/memory/3380-168-0x00000000028D0000-0x000000000290E000-memory.dmp family_redline behavioral1/memory/3380-170-0x00000000028D0000-0x000000000290E000-memory.dmp family_redline behavioral1/memory/3380-172-0x00000000028D0000-0x000000000290E000-memory.dmp family_redline behavioral1/memory/3380-174-0x00000000028D0000-0x000000000290E000-memory.dmp family_redline behavioral1/memory/3380-176-0x00000000028D0000-0x000000000290E000-memory.dmp family_redline behavioral1/memory/3380-178-0x00000000028D0000-0x000000000290E000-memory.dmp family_redline behavioral1/memory/3380-180-0x00000000028D0000-0x000000000290E000-memory.dmp family_redline behavioral1/memory/3380-182-0x00000000028D0000-0x000000000290E000-memory.dmp family_redline behavioral1/memory/3380-184-0x00000000028D0000-0x000000000290E000-memory.dmp family_redline behavioral1/memory/3380-188-0x0000000004F80000-0x0000000004F90000-memory.dmp family_redline behavioral1/memory/3380-187-0x00000000028D0000-0x000000000290E000-memory.dmp family_redline behavioral1/memory/3380-191-0x00000000028D0000-0x000000000290E000-memory.dmp family_redline behavioral1/memory/3380-193-0x00000000028D0000-0x000000000290E000-memory.dmp family_redline behavioral1/memory/3380-195-0x00000000028D0000-0x000000000290E000-memory.dmp family_redline behavioral1/memory/3380-197-0x00000000028D0000-0x000000000290E000-memory.dmp family_redline behavioral1/memory/3380-199-0x00000000028D0000-0x000000000290E000-memory.dmp family_redline behavioral1/memory/3380-201-0x00000000028D0000-0x000000000290E000-memory.dmp family_redline behavioral1/memory/3380-203-0x00000000028D0000-0x000000000290E000-memory.dmp family_redline behavioral1/memory/3380-205-0x00000000028D0000-0x000000000290E000-memory.dmp family_redline behavioral1/memory/3380-207-0x00000000028D0000-0x000000000290E000-memory.dmp family_redline behavioral1/memory/3380-209-0x00000000028D0000-0x000000000290E000-memory.dmp family_redline behavioral1/memory/3380-211-0x00000000028D0000-0x000000000290E000-memory.dmp family_redline behavioral1/memory/3380-213-0x00000000028D0000-0x000000000290E000-memory.dmp family_redline behavioral1/memory/3380-215-0x00000000028D0000-0x000000000290E000-memory.dmp family_redline behavioral1/memory/3380-217-0x00000000028D0000-0x000000000290E000-memory.dmp family_redline behavioral1/memory/3380-219-0x00000000028D0000-0x000000000290E000-memory.dmp family_redline behavioral1/memory/3380-221-0x00000000028D0000-0x000000000290E000-memory.dmp family_redline behavioral1/memory/3380-1074-0x0000000004F80000-0x0000000004F90000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
niba5216.exeh93yz77.exeiedqm51.exel53px15.exepid process 1320 niba5216.exe 3696 h93yz77.exe 3380 iedqm51.exe 4676 l53px15.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
h93yz77.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" h93yz77.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
c049cff535b58e0b6f218fa5e59705bc4ddbbe0c27574ffe77142c47aa138e6c.exeniba5216.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce c049cff535b58e0b6f218fa5e59705bc4ddbbe0c27574ffe77142c47aa138e6c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c049cff535b58e0b6f218fa5e59705bc4ddbbe0c27574ffe77142c47aa138e6c.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce niba5216.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" niba5216.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 3928 sc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
h93yz77.exeiedqm51.exel53px15.exepid process 3696 h93yz77.exe 3696 h93yz77.exe 3380 iedqm51.exe 3380 iedqm51.exe 4676 l53px15.exe 4676 l53px15.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
h93yz77.exeiedqm51.exel53px15.exedescription pid process Token: SeDebugPrivilege 3696 h93yz77.exe Token: SeDebugPrivilege 3380 iedqm51.exe Token: SeDebugPrivilege 4676 l53px15.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
c049cff535b58e0b6f218fa5e59705bc4ddbbe0c27574ffe77142c47aa138e6c.exeniba5216.exedescription pid process target process PID 1968 wrote to memory of 1320 1968 c049cff535b58e0b6f218fa5e59705bc4ddbbe0c27574ffe77142c47aa138e6c.exe niba5216.exe PID 1968 wrote to memory of 1320 1968 c049cff535b58e0b6f218fa5e59705bc4ddbbe0c27574ffe77142c47aa138e6c.exe niba5216.exe PID 1968 wrote to memory of 1320 1968 c049cff535b58e0b6f218fa5e59705bc4ddbbe0c27574ffe77142c47aa138e6c.exe niba5216.exe PID 1320 wrote to memory of 3696 1320 niba5216.exe h93yz77.exe PID 1320 wrote to memory of 3696 1320 niba5216.exe h93yz77.exe PID 1320 wrote to memory of 3380 1320 niba5216.exe iedqm51.exe PID 1320 wrote to memory of 3380 1320 niba5216.exe iedqm51.exe PID 1320 wrote to memory of 3380 1320 niba5216.exe iedqm51.exe PID 1968 wrote to memory of 4676 1968 c049cff535b58e0b6f218fa5e59705bc4ddbbe0c27574ffe77142c47aa138e6c.exe l53px15.exe PID 1968 wrote to memory of 4676 1968 c049cff535b58e0b6f218fa5e59705bc4ddbbe0c27574ffe77142c47aa138e6c.exe l53px15.exe PID 1968 wrote to memory of 4676 1968 c049cff535b58e0b6f218fa5e59705bc4ddbbe0c27574ffe77142c47aa138e6c.exe l53px15.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c049cff535b58e0b6f218fa5e59705bc4ddbbe0c27574ffe77142c47aa138e6c.exe"C:\Users\Admin\AppData\Local\Temp\c049cff535b58e0b6f218fa5e59705bc4ddbbe0c27574ffe77142c47aa138e6c.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba5216.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba5216.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h93yz77.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h93yz77.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iedqm51.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iedqm51.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l53px15.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l53px15.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l53px15.exeFilesize
175KB
MD550809fe16d7c482c1f4a2ea19fdcbc0a
SHA111b6f69c06a724da15183b16039c5cbc86016158
SHA25609917b67829de37b5d6be8115c8f8321f436554f426a24e079257a8368051cb1
SHA512c35170e5eb6dabda9fd2d289153df829957ca8e9665178529a1ba36395155bb34f489372993ec694d10bea490c86cef2ae152e2df480288aca8e796ba135261f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l53px15.exeFilesize
175KB
MD550809fe16d7c482c1f4a2ea19fdcbc0a
SHA111b6f69c06a724da15183b16039c5cbc86016158
SHA25609917b67829de37b5d6be8115c8f8321f436554f426a24e079257a8368051cb1
SHA512c35170e5eb6dabda9fd2d289153df829957ca8e9665178529a1ba36395155bb34f489372993ec694d10bea490c86cef2ae152e2df480288aca8e796ba135261f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba5216.exeFilesize
402KB
MD524ccd7b9df6549d09aa9ea14ee137e31
SHA1fe60be1182c774296af2eddd6ca7ba9e8ab0aac1
SHA256d05dc3388034c7770414309461b6b1916aabcaa76d10974c564257d74117e576
SHA51247aaea2677facf7d41a509a1839dbdd9326fc0b0388a77401b31b2b1fc81a1147a4a0a5b78558ad054900bea4ea7f96082bd1e908e4cd1e6b8e0cfb20e73285a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba5216.exeFilesize
402KB
MD524ccd7b9df6549d09aa9ea14ee137e31
SHA1fe60be1182c774296af2eddd6ca7ba9e8ab0aac1
SHA256d05dc3388034c7770414309461b6b1916aabcaa76d10974c564257d74117e576
SHA51247aaea2677facf7d41a509a1839dbdd9326fc0b0388a77401b31b2b1fc81a1147a4a0a5b78558ad054900bea4ea7f96082bd1e908e4cd1e6b8e0cfb20e73285a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h93yz77.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h93yz77.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iedqm51.exeFilesize
349KB
MD50d99082ac33345a678852b7bb39352b2
SHA1152cbcd9c30f3fa4d66bf082aff88f7a1abc9ffe
SHA256551f87329c0f48a4ea228cc719c7844d6f914de659f6db38601f1a2d3a26a50d
SHA512724ac5a09b3447e2f0254fea00bc5e1afde0d0f06780ffac99ab4f8ff9a7041161e121dda0a0c3ae3840bfe7d87e14e8005085c6da0754cbcd0e1fdcfdae8f59
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iedqm51.exeFilesize
349KB
MD50d99082ac33345a678852b7bb39352b2
SHA1152cbcd9c30f3fa4d66bf082aff88f7a1abc9ffe
SHA256551f87329c0f48a4ea228cc719c7844d6f914de659f6db38601f1a2d3a26a50d
SHA512724ac5a09b3447e2f0254fea00bc5e1afde0d0f06780ffac99ab4f8ff9a7041161e121dda0a0c3ae3840bfe7d87e14e8005085c6da0754cbcd0e1fdcfdae8f59
-
memory/3380-153-0x0000000002250000-0x000000000229B000-memory.dmpFilesize
300KB
-
memory/3380-154-0x0000000004F90000-0x0000000005534000-memory.dmpFilesize
5.6MB
-
memory/3380-155-0x00000000028D0000-0x000000000290E000-memory.dmpFilesize
248KB
-
memory/3380-158-0x00000000028D0000-0x000000000290E000-memory.dmpFilesize
248KB
-
memory/3380-156-0x00000000028D0000-0x000000000290E000-memory.dmpFilesize
248KB
-
memory/3380-160-0x00000000028D0000-0x000000000290E000-memory.dmpFilesize
248KB
-
memory/3380-162-0x00000000028D0000-0x000000000290E000-memory.dmpFilesize
248KB
-
memory/3380-164-0x00000000028D0000-0x000000000290E000-memory.dmpFilesize
248KB
-
memory/3380-166-0x00000000028D0000-0x000000000290E000-memory.dmpFilesize
248KB
-
memory/3380-168-0x00000000028D0000-0x000000000290E000-memory.dmpFilesize
248KB
-
memory/3380-170-0x00000000028D0000-0x000000000290E000-memory.dmpFilesize
248KB
-
memory/3380-172-0x00000000028D0000-0x000000000290E000-memory.dmpFilesize
248KB
-
memory/3380-174-0x00000000028D0000-0x000000000290E000-memory.dmpFilesize
248KB
-
memory/3380-176-0x00000000028D0000-0x000000000290E000-memory.dmpFilesize
248KB
-
memory/3380-178-0x00000000028D0000-0x000000000290E000-memory.dmpFilesize
248KB
-
memory/3380-180-0x00000000028D0000-0x000000000290E000-memory.dmpFilesize
248KB
-
memory/3380-182-0x00000000028D0000-0x000000000290E000-memory.dmpFilesize
248KB
-
memory/3380-184-0x00000000028D0000-0x000000000290E000-memory.dmpFilesize
248KB
-
memory/3380-186-0x0000000004F80000-0x0000000004F90000-memory.dmpFilesize
64KB
-
memory/3380-188-0x0000000004F80000-0x0000000004F90000-memory.dmpFilesize
64KB
-
memory/3380-187-0x00000000028D0000-0x000000000290E000-memory.dmpFilesize
248KB
-
memory/3380-190-0x0000000004F80000-0x0000000004F90000-memory.dmpFilesize
64KB
-
memory/3380-191-0x00000000028D0000-0x000000000290E000-memory.dmpFilesize
248KB
-
memory/3380-193-0x00000000028D0000-0x000000000290E000-memory.dmpFilesize
248KB
-
memory/3380-195-0x00000000028D0000-0x000000000290E000-memory.dmpFilesize
248KB
-
memory/3380-197-0x00000000028D0000-0x000000000290E000-memory.dmpFilesize
248KB
-
memory/3380-199-0x00000000028D0000-0x000000000290E000-memory.dmpFilesize
248KB
-
memory/3380-201-0x00000000028D0000-0x000000000290E000-memory.dmpFilesize
248KB
-
memory/3380-203-0x00000000028D0000-0x000000000290E000-memory.dmpFilesize
248KB
-
memory/3380-205-0x00000000028D0000-0x000000000290E000-memory.dmpFilesize
248KB
-
memory/3380-207-0x00000000028D0000-0x000000000290E000-memory.dmpFilesize
248KB
-
memory/3380-209-0x00000000028D0000-0x000000000290E000-memory.dmpFilesize
248KB
-
memory/3380-211-0x00000000028D0000-0x000000000290E000-memory.dmpFilesize
248KB
-
memory/3380-213-0x00000000028D0000-0x000000000290E000-memory.dmpFilesize
248KB
-
memory/3380-215-0x00000000028D0000-0x000000000290E000-memory.dmpFilesize
248KB
-
memory/3380-217-0x00000000028D0000-0x000000000290E000-memory.dmpFilesize
248KB
-
memory/3380-219-0x00000000028D0000-0x000000000290E000-memory.dmpFilesize
248KB
-
memory/3380-221-0x00000000028D0000-0x000000000290E000-memory.dmpFilesize
248KB
-
memory/3380-1064-0x0000000005540000-0x0000000005B58000-memory.dmpFilesize
6.1MB
-
memory/3380-1065-0x0000000004DE0000-0x0000000004EEA000-memory.dmpFilesize
1.0MB
-
memory/3380-1066-0x0000000004F20000-0x0000000004F32000-memory.dmpFilesize
72KB
-
memory/3380-1067-0x0000000004F40000-0x0000000004F7C000-memory.dmpFilesize
240KB
-
memory/3380-1068-0x0000000004F80000-0x0000000004F90000-memory.dmpFilesize
64KB
-
memory/3380-1069-0x0000000005E10000-0x0000000005E76000-memory.dmpFilesize
408KB
-
memory/3380-1071-0x0000000006610000-0x00000000066A2000-memory.dmpFilesize
584KB
-
memory/3380-1072-0x0000000006810000-0x0000000006886000-memory.dmpFilesize
472KB
-
memory/3380-1073-0x0000000006890000-0x00000000068E0000-memory.dmpFilesize
320KB
-
memory/3380-1074-0x0000000004F80000-0x0000000004F90000-memory.dmpFilesize
64KB
-
memory/3380-1075-0x0000000004F80000-0x0000000004F90000-memory.dmpFilesize
64KB
-
memory/3380-1076-0x0000000006B00000-0x0000000006CC2000-memory.dmpFilesize
1.8MB
-
memory/3380-1077-0x0000000006CD0000-0x00000000071FC000-memory.dmpFilesize
5.2MB
-
memory/3380-1078-0x0000000004F80000-0x0000000004F90000-memory.dmpFilesize
64KB
-
memory/3696-147-0x0000000000680000-0x000000000068A000-memory.dmpFilesize
40KB
-
memory/4676-1084-0x0000000000470000-0x00000000004A2000-memory.dmpFilesize
200KB
-
memory/4676-1085-0x00000000050D0000-0x00000000050E0000-memory.dmpFilesize
64KB