Analysis
-
max time kernel
144s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
23-03-2023 20:08
Static task
static1
Behavioral task
behavioral1
Sample
d4eaeebf0f886b75a9f2ebe860f4e1d6d180c013dd3bb30b65554bbfd979faa7.exe
Resource
win10v2004-20230220-en
General
-
Target
d4eaeebf0f886b75a9f2ebe860f4e1d6d180c013dd3bb30b65554bbfd979faa7.exe
-
Size
545KB
-
MD5
ce1be5b06853be637cb68c3ee6c9bd6f
-
SHA1
c953cec30769c51d30627c37046b8da537e6c0cb
-
SHA256
d4eaeebf0f886b75a9f2ebe860f4e1d6d180c013dd3bb30b65554bbfd979faa7
-
SHA512
68b2c99f5909ac34cd277f90043968778043196f9618a4e7af2d1a8454a613eec0c0b728158def1cb901e28c58e55f53789d1d1da4f0eb1f524d1d192e3095e8
-
SSDEEP
12288:YMrsy90yG3adg5jYdV+Se6vrWgS/Dkua1I5sEELtve:0y1G3O0Ok6ve/2EXEL9e
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
real
193.233.20.31:4125
-
auth_value
bb22a50228754849387d5f4d1611e71b
Signatures
-
Processes:
pro9325.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro9325.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro9325.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro9325.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro9325.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection pro9325.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro9325.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/4460-158-0x00000000052E0000-0x000000000531E000-memory.dmp family_redline behavioral1/memory/4460-161-0x00000000052E0000-0x000000000531E000-memory.dmp family_redline behavioral1/memory/4460-159-0x00000000052E0000-0x000000000531E000-memory.dmp family_redline behavioral1/memory/4460-163-0x00000000052E0000-0x000000000531E000-memory.dmp family_redline behavioral1/memory/4460-165-0x00000000052E0000-0x000000000531E000-memory.dmp family_redline behavioral1/memory/4460-167-0x00000000052E0000-0x000000000531E000-memory.dmp family_redline behavioral1/memory/4460-169-0x00000000052E0000-0x000000000531E000-memory.dmp family_redline behavioral1/memory/4460-171-0x00000000052E0000-0x000000000531E000-memory.dmp family_redline behavioral1/memory/4460-173-0x00000000052E0000-0x000000000531E000-memory.dmp family_redline behavioral1/memory/4460-175-0x00000000052E0000-0x000000000531E000-memory.dmp family_redline behavioral1/memory/4460-177-0x00000000052E0000-0x000000000531E000-memory.dmp family_redline behavioral1/memory/4460-179-0x00000000052E0000-0x000000000531E000-memory.dmp family_redline behavioral1/memory/4460-181-0x00000000052E0000-0x000000000531E000-memory.dmp family_redline behavioral1/memory/4460-183-0x00000000052E0000-0x000000000531E000-memory.dmp family_redline behavioral1/memory/4460-185-0x00000000052E0000-0x000000000531E000-memory.dmp family_redline behavioral1/memory/4460-187-0x00000000052E0000-0x000000000531E000-memory.dmp family_redline behavioral1/memory/4460-189-0x00000000052E0000-0x000000000531E000-memory.dmp family_redline behavioral1/memory/4460-191-0x00000000052E0000-0x000000000531E000-memory.dmp family_redline behavioral1/memory/4460-193-0x00000000052E0000-0x000000000531E000-memory.dmp family_redline behavioral1/memory/4460-195-0x00000000052E0000-0x000000000531E000-memory.dmp family_redline behavioral1/memory/4460-197-0x00000000052E0000-0x000000000531E000-memory.dmp family_redline behavioral1/memory/4460-199-0x00000000052E0000-0x000000000531E000-memory.dmp family_redline behavioral1/memory/4460-201-0x00000000052E0000-0x000000000531E000-memory.dmp family_redline behavioral1/memory/4460-203-0x00000000052E0000-0x000000000531E000-memory.dmp family_redline behavioral1/memory/4460-205-0x00000000052E0000-0x000000000531E000-memory.dmp family_redline behavioral1/memory/4460-207-0x00000000052E0000-0x000000000531E000-memory.dmp family_redline behavioral1/memory/4460-209-0x00000000052E0000-0x000000000531E000-memory.dmp family_redline behavioral1/memory/4460-211-0x00000000052E0000-0x000000000531E000-memory.dmp family_redline behavioral1/memory/4460-213-0x00000000052E0000-0x000000000531E000-memory.dmp family_redline behavioral1/memory/4460-215-0x00000000052E0000-0x000000000531E000-memory.dmp family_redline behavioral1/memory/4460-217-0x00000000052E0000-0x000000000531E000-memory.dmp family_redline behavioral1/memory/4460-219-0x00000000052E0000-0x000000000531E000-memory.dmp family_redline behavioral1/memory/4460-221-0x00000000052E0000-0x000000000531E000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
unio2712.exepro9325.exequ3800.exesi986149.exepid process 4644 unio2712.exe 556 pro9325.exe 4460 qu3800.exe 4476 si986149.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro9325.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" pro9325.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
d4eaeebf0f886b75a9f2ebe860f4e1d6d180c013dd3bb30b65554bbfd979faa7.exeunio2712.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce d4eaeebf0f886b75a9f2ebe860f4e1d6d180c013dd3bb30b65554bbfd979faa7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" d4eaeebf0f886b75a9f2ebe860f4e1d6d180c013dd3bb30b65554bbfd979faa7.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce unio2712.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" unio2712.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4620 4460 WerFault.exe qu3800.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro9325.exequ3800.exesi986149.exepid process 556 pro9325.exe 556 pro9325.exe 4460 qu3800.exe 4460 qu3800.exe 4476 si986149.exe 4476 si986149.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro9325.exequ3800.exesi986149.exedescription pid process Token: SeDebugPrivilege 556 pro9325.exe Token: SeDebugPrivilege 4460 qu3800.exe Token: SeDebugPrivilege 4476 si986149.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
d4eaeebf0f886b75a9f2ebe860f4e1d6d180c013dd3bb30b65554bbfd979faa7.exeunio2712.exedescription pid process target process PID 1192 wrote to memory of 4644 1192 d4eaeebf0f886b75a9f2ebe860f4e1d6d180c013dd3bb30b65554bbfd979faa7.exe unio2712.exe PID 1192 wrote to memory of 4644 1192 d4eaeebf0f886b75a9f2ebe860f4e1d6d180c013dd3bb30b65554bbfd979faa7.exe unio2712.exe PID 1192 wrote to memory of 4644 1192 d4eaeebf0f886b75a9f2ebe860f4e1d6d180c013dd3bb30b65554bbfd979faa7.exe unio2712.exe PID 4644 wrote to memory of 556 4644 unio2712.exe pro9325.exe PID 4644 wrote to memory of 556 4644 unio2712.exe pro9325.exe PID 4644 wrote to memory of 4460 4644 unio2712.exe qu3800.exe PID 4644 wrote to memory of 4460 4644 unio2712.exe qu3800.exe PID 4644 wrote to memory of 4460 4644 unio2712.exe qu3800.exe PID 1192 wrote to memory of 4476 1192 d4eaeebf0f886b75a9f2ebe860f4e1d6d180c013dd3bb30b65554bbfd979faa7.exe si986149.exe PID 1192 wrote to memory of 4476 1192 d4eaeebf0f886b75a9f2ebe860f4e1d6d180c013dd3bb30b65554bbfd979faa7.exe si986149.exe PID 1192 wrote to memory of 4476 1192 d4eaeebf0f886b75a9f2ebe860f4e1d6d180c013dd3bb30b65554bbfd979faa7.exe si986149.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4eaeebf0f886b75a9f2ebe860f4e1d6d180c013dd3bb30b65554bbfd979faa7.exe"C:\Users\Admin\AppData\Local\Temp\d4eaeebf0f886b75a9f2ebe860f4e1d6d180c013dd3bb30b65554bbfd979faa7.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio2712.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio2712.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9325.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9325.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:556 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3800.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3800.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4460 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 13364⤵
- Program crash
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si986149.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si986149.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4476
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4460 -ip 44601⤵PID:4536
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si986149.exeFilesize
175KB
MD541707338e1e2d868aa699ac0dd2e77b0
SHA136e0dfba09f9fb409faf0f9a99217d0d0c524b82
SHA2568d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557
SHA51280c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si986149.exeFilesize
175KB
MD541707338e1e2d868aa699ac0dd2e77b0
SHA136e0dfba09f9fb409faf0f9a99217d0d0c524b82
SHA2568d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557
SHA51280c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio2712.exeFilesize
402KB
MD544e9ddd823ed611ede5723194219be0d
SHA1a60c3dc32edcc844de77245b020781ffd080972c
SHA256cb27ffba10381ef1ee2b0c67d62c289336dfc79c3e74c3b6aff68866aa82e047
SHA512c9b42a59cc6484107f667107034e38f389df6bbd8ac4f5577ac3be9291445a5933f181d076fd1be25a3a0d209fd17445bd7f9db757aa37bec237d48b77554751
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio2712.exeFilesize
402KB
MD544e9ddd823ed611ede5723194219be0d
SHA1a60c3dc32edcc844de77245b020781ffd080972c
SHA256cb27ffba10381ef1ee2b0c67d62c289336dfc79c3e74c3b6aff68866aa82e047
SHA512c9b42a59cc6484107f667107034e38f389df6bbd8ac4f5577ac3be9291445a5933f181d076fd1be25a3a0d209fd17445bd7f9db757aa37bec237d48b77554751
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9325.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9325.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3800.exeFilesize
350KB
MD55802af64ebbdbae0dc947a3c8c7f637d
SHA1f34c383686e20759f698347f0eef1338be4d65c6
SHA256d0aa3d5bdd1fade1952e8c68fe51b0a265d9d9540fe8d9c5ecf8c7d8eaf23a65
SHA512e61ee4535e5868871fa74ded4097218c87e0c38e0f79973ce653581b581a1696699934b06238c9dc001496a5f43ab982d80cf7d74b9f4510d50db22ac88de9ad
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3800.exeFilesize
350KB
MD55802af64ebbdbae0dc947a3c8c7f637d
SHA1f34c383686e20759f698347f0eef1338be4d65c6
SHA256d0aa3d5bdd1fade1952e8c68fe51b0a265d9d9540fe8d9c5ecf8c7d8eaf23a65
SHA512e61ee4535e5868871fa74ded4097218c87e0c38e0f79973ce653581b581a1696699934b06238c9dc001496a5f43ab982d80cf7d74b9f4510d50db22ac88de9ad
-
memory/556-147-0x00000000005D0000-0x00000000005DA000-memory.dmpFilesize
40KB
-
memory/4460-153-0x0000000004CF0000-0x0000000005294000-memory.dmpFilesize
5.6MB
-
memory/4460-154-0x0000000002360000-0x00000000023AB000-memory.dmpFilesize
300KB
-
memory/4460-156-0x0000000002740000-0x0000000002750000-memory.dmpFilesize
64KB
-
memory/4460-155-0x0000000002740000-0x0000000002750000-memory.dmpFilesize
64KB
-
memory/4460-157-0x0000000002740000-0x0000000002750000-memory.dmpFilesize
64KB
-
memory/4460-158-0x00000000052E0000-0x000000000531E000-memory.dmpFilesize
248KB
-
memory/4460-161-0x00000000052E0000-0x000000000531E000-memory.dmpFilesize
248KB
-
memory/4460-159-0x00000000052E0000-0x000000000531E000-memory.dmpFilesize
248KB
-
memory/4460-163-0x00000000052E0000-0x000000000531E000-memory.dmpFilesize
248KB
-
memory/4460-165-0x00000000052E0000-0x000000000531E000-memory.dmpFilesize
248KB
-
memory/4460-167-0x00000000052E0000-0x000000000531E000-memory.dmpFilesize
248KB
-
memory/4460-169-0x00000000052E0000-0x000000000531E000-memory.dmpFilesize
248KB
-
memory/4460-171-0x00000000052E0000-0x000000000531E000-memory.dmpFilesize
248KB
-
memory/4460-173-0x00000000052E0000-0x000000000531E000-memory.dmpFilesize
248KB
-
memory/4460-175-0x00000000052E0000-0x000000000531E000-memory.dmpFilesize
248KB
-
memory/4460-177-0x00000000052E0000-0x000000000531E000-memory.dmpFilesize
248KB
-
memory/4460-179-0x00000000052E0000-0x000000000531E000-memory.dmpFilesize
248KB
-
memory/4460-181-0x00000000052E0000-0x000000000531E000-memory.dmpFilesize
248KB
-
memory/4460-183-0x00000000052E0000-0x000000000531E000-memory.dmpFilesize
248KB
-
memory/4460-185-0x00000000052E0000-0x000000000531E000-memory.dmpFilesize
248KB
-
memory/4460-187-0x00000000052E0000-0x000000000531E000-memory.dmpFilesize
248KB
-
memory/4460-189-0x00000000052E0000-0x000000000531E000-memory.dmpFilesize
248KB
-
memory/4460-191-0x00000000052E0000-0x000000000531E000-memory.dmpFilesize
248KB
-
memory/4460-193-0x00000000052E0000-0x000000000531E000-memory.dmpFilesize
248KB
-
memory/4460-195-0x00000000052E0000-0x000000000531E000-memory.dmpFilesize
248KB
-
memory/4460-197-0x00000000052E0000-0x000000000531E000-memory.dmpFilesize
248KB
-
memory/4460-199-0x00000000052E0000-0x000000000531E000-memory.dmpFilesize
248KB
-
memory/4460-201-0x00000000052E0000-0x000000000531E000-memory.dmpFilesize
248KB
-
memory/4460-203-0x00000000052E0000-0x000000000531E000-memory.dmpFilesize
248KB
-
memory/4460-205-0x00000000052E0000-0x000000000531E000-memory.dmpFilesize
248KB
-
memory/4460-207-0x00000000052E0000-0x000000000531E000-memory.dmpFilesize
248KB
-
memory/4460-209-0x00000000052E0000-0x000000000531E000-memory.dmpFilesize
248KB
-
memory/4460-211-0x00000000052E0000-0x000000000531E000-memory.dmpFilesize
248KB
-
memory/4460-213-0x00000000052E0000-0x000000000531E000-memory.dmpFilesize
248KB
-
memory/4460-215-0x00000000052E0000-0x000000000531E000-memory.dmpFilesize
248KB
-
memory/4460-217-0x00000000052E0000-0x000000000531E000-memory.dmpFilesize
248KB
-
memory/4460-219-0x00000000052E0000-0x000000000531E000-memory.dmpFilesize
248KB
-
memory/4460-221-0x00000000052E0000-0x000000000531E000-memory.dmpFilesize
248KB
-
memory/4460-1064-0x0000000005460000-0x0000000005A78000-memory.dmpFilesize
6.1MB
-
memory/4460-1065-0x0000000005B00000-0x0000000005C0A000-memory.dmpFilesize
1.0MB
-
memory/4460-1066-0x0000000005C40000-0x0000000005C52000-memory.dmpFilesize
72KB
-
memory/4460-1067-0x0000000005C60000-0x0000000005C9C000-memory.dmpFilesize
240KB
-
memory/4460-1068-0x0000000002740000-0x0000000002750000-memory.dmpFilesize
64KB
-
memory/4460-1070-0x0000000005F50000-0x0000000005FB6000-memory.dmpFilesize
408KB
-
memory/4460-1071-0x0000000006620000-0x00000000066B2000-memory.dmpFilesize
584KB
-
memory/4460-1072-0x0000000002740000-0x0000000002750000-memory.dmpFilesize
64KB
-
memory/4460-1073-0x0000000002740000-0x0000000002750000-memory.dmpFilesize
64KB
-
memory/4460-1074-0x00000000066F0000-0x0000000006766000-memory.dmpFilesize
472KB
-
memory/4460-1075-0x0000000006780000-0x00000000067D0000-memory.dmpFilesize
320KB
-
memory/4460-1076-0x0000000006900000-0x0000000006AC2000-memory.dmpFilesize
1.8MB
-
memory/4460-1077-0x0000000006AD0000-0x0000000006FFC000-memory.dmpFilesize
5.2MB
-
memory/4460-1078-0x0000000002740000-0x0000000002750000-memory.dmpFilesize
64KB
-
memory/4476-1084-0x0000000000530000-0x0000000000562000-memory.dmpFilesize
200KB
-
memory/4476-1085-0x0000000005190000-0x00000000051A0000-memory.dmpFilesize
64KB