Analysis
-
max time kernel
53s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
23-03-2023 20:10
Static task
static1
Behavioral task
behavioral1
Sample
0d15490d94b84267b6c00da3aa28845379d85b3d84fce9a2ff3977269bef3ea5.exe
Resource
win10-20230220-en
General
-
Target
0d15490d94b84267b6c00da3aa28845379d85b3d84fce9a2ff3977269bef3ea5.exe
-
Size
544KB
-
MD5
ae1ad3cc96daebf5b128b524ed3a736f
-
SHA1
ba05526c1f8ce46c0cd997b409ce0bddaeab3d55
-
SHA256
0d15490d94b84267b6c00da3aa28845379d85b3d84fce9a2ff3977269bef3ea5
-
SHA512
9c2c6ee6a871737306c1d2a5ee810f30aaea4b630d34524fc0e072098e95ff045f3d13e5a16ca07c7d18a4e5b59ce09063f86f0a70fd736de7d3a774dd4d7c2c
-
SSDEEP
12288:XMrCy900vUrYRLq9uXkW6FtKMTdbyGS/DQ95xIrUT:9yvpAu0frKn/adT
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
real
193.233.20.31:4125
-
auth_value
bb22a50228754849387d5f4d1611e71b
Signatures
-
Processes:
pro7445.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro7445.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro7445.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro7445.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro7445.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro7445.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
Processes:
resource yara_rule behavioral1/memory/4064-141-0x0000000002700000-0x0000000002746000-memory.dmp family_redline behavioral1/memory/4064-143-0x0000000004C90000-0x0000000004CD4000-memory.dmp family_redline behavioral1/memory/4064-148-0x0000000004C90000-0x0000000004CCE000-memory.dmp family_redline behavioral1/memory/4064-149-0x0000000004C90000-0x0000000004CCE000-memory.dmp family_redline behavioral1/memory/4064-151-0x0000000004C90000-0x0000000004CCE000-memory.dmp family_redline behavioral1/memory/4064-153-0x0000000004C90000-0x0000000004CCE000-memory.dmp family_redline behavioral1/memory/4064-155-0x0000000004C90000-0x0000000004CCE000-memory.dmp family_redline behavioral1/memory/4064-159-0x0000000004C90000-0x0000000004CCE000-memory.dmp family_redline behavioral1/memory/4064-161-0x0000000004C90000-0x0000000004CCE000-memory.dmp family_redline behavioral1/memory/4064-157-0x0000000004C90000-0x0000000004CCE000-memory.dmp family_redline behavioral1/memory/4064-163-0x0000000004C90000-0x0000000004CCE000-memory.dmp family_redline behavioral1/memory/4064-165-0x0000000004C90000-0x0000000004CCE000-memory.dmp family_redline behavioral1/memory/4064-167-0x0000000004C90000-0x0000000004CCE000-memory.dmp family_redline behavioral1/memory/4064-169-0x0000000004C90000-0x0000000004CCE000-memory.dmp family_redline behavioral1/memory/4064-171-0x0000000004C90000-0x0000000004CCE000-memory.dmp family_redline behavioral1/memory/4064-173-0x0000000004C90000-0x0000000004CCE000-memory.dmp family_redline behavioral1/memory/4064-175-0x0000000004C90000-0x0000000004CCE000-memory.dmp family_redline behavioral1/memory/4064-177-0x0000000004C90000-0x0000000004CCE000-memory.dmp family_redline behavioral1/memory/4064-179-0x0000000004C90000-0x0000000004CCE000-memory.dmp family_redline behavioral1/memory/4064-181-0x0000000004C90000-0x0000000004CCE000-memory.dmp family_redline behavioral1/memory/4064-183-0x0000000004C90000-0x0000000004CCE000-memory.dmp family_redline behavioral1/memory/4064-185-0x0000000004C90000-0x0000000004CCE000-memory.dmp family_redline behavioral1/memory/4064-193-0x0000000004C90000-0x0000000004CCE000-memory.dmp family_redline behavioral1/memory/4064-203-0x0000000004C90000-0x0000000004CCE000-memory.dmp family_redline behavioral1/memory/4064-201-0x0000000004C90000-0x0000000004CCE000-memory.dmp family_redline behavioral1/memory/4064-199-0x0000000004C90000-0x0000000004CCE000-memory.dmp family_redline behavioral1/memory/4064-205-0x0000000004C90000-0x0000000004CCE000-memory.dmp family_redline behavioral1/memory/4064-209-0x0000000004C90000-0x0000000004CCE000-memory.dmp family_redline behavioral1/memory/4064-211-0x0000000004C90000-0x0000000004CCE000-memory.dmp family_redline behavioral1/memory/4064-207-0x0000000004C90000-0x0000000004CCE000-memory.dmp family_redline behavioral1/memory/4064-197-0x0000000004C90000-0x0000000004CCE000-memory.dmp family_redline behavioral1/memory/4064-195-0x0000000004C90000-0x0000000004CCE000-memory.dmp family_redline behavioral1/memory/4064-191-0x0000000004C90000-0x0000000004CCE000-memory.dmp family_redline behavioral1/memory/4064-189-0x0000000004C90000-0x0000000004CCE000-memory.dmp family_redline behavioral1/memory/4064-187-0x0000000004C90000-0x0000000004CCE000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
unio1334.exepro7445.exequ5735.exesi522837.exepid process 2580 unio1334.exe 2940 pro7445.exe 4064 qu5735.exe 1304 si522837.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro7445.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" pro7445.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
0d15490d94b84267b6c00da3aa28845379d85b3d84fce9a2ff3977269bef3ea5.exeunio1334.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 0d15490d94b84267b6c00da3aa28845379d85b3d84fce9a2ff3977269bef3ea5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 0d15490d94b84267b6c00da3aa28845379d85b3d84fce9a2ff3977269bef3ea5.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce unio1334.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" unio1334.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro7445.exequ5735.exesi522837.exepid process 2940 pro7445.exe 2940 pro7445.exe 4064 qu5735.exe 4064 qu5735.exe 1304 si522837.exe 1304 si522837.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro7445.exequ5735.exesi522837.exedescription pid process Token: SeDebugPrivilege 2940 pro7445.exe Token: SeDebugPrivilege 4064 qu5735.exe Token: SeDebugPrivilege 1304 si522837.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
0d15490d94b84267b6c00da3aa28845379d85b3d84fce9a2ff3977269bef3ea5.exeunio1334.exedescription pid process target process PID 2424 wrote to memory of 2580 2424 0d15490d94b84267b6c00da3aa28845379d85b3d84fce9a2ff3977269bef3ea5.exe unio1334.exe PID 2424 wrote to memory of 2580 2424 0d15490d94b84267b6c00da3aa28845379d85b3d84fce9a2ff3977269bef3ea5.exe unio1334.exe PID 2424 wrote to memory of 2580 2424 0d15490d94b84267b6c00da3aa28845379d85b3d84fce9a2ff3977269bef3ea5.exe unio1334.exe PID 2580 wrote to memory of 2940 2580 unio1334.exe pro7445.exe PID 2580 wrote to memory of 2940 2580 unio1334.exe pro7445.exe PID 2580 wrote to memory of 4064 2580 unio1334.exe qu5735.exe PID 2580 wrote to memory of 4064 2580 unio1334.exe qu5735.exe PID 2580 wrote to memory of 4064 2580 unio1334.exe qu5735.exe PID 2424 wrote to memory of 1304 2424 0d15490d94b84267b6c00da3aa28845379d85b3d84fce9a2ff3977269bef3ea5.exe si522837.exe PID 2424 wrote to memory of 1304 2424 0d15490d94b84267b6c00da3aa28845379d85b3d84fce9a2ff3977269bef3ea5.exe si522837.exe PID 2424 wrote to memory of 1304 2424 0d15490d94b84267b6c00da3aa28845379d85b3d84fce9a2ff3977269bef3ea5.exe si522837.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d15490d94b84267b6c00da3aa28845379d85b3d84fce9a2ff3977269bef3ea5.exe"C:\Users\Admin\AppData\Local\Temp\0d15490d94b84267b6c00da3aa28845379d85b3d84fce9a2ff3977269bef3ea5.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio1334.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio1334.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7445.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7445.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5735.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5735.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si522837.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si522837.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1304
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si522837.exeFilesize
175KB
MD541707338e1e2d868aa699ac0dd2e77b0
SHA136e0dfba09f9fb409faf0f9a99217d0d0c524b82
SHA2568d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557
SHA51280c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si522837.exeFilesize
175KB
MD541707338e1e2d868aa699ac0dd2e77b0
SHA136e0dfba09f9fb409faf0f9a99217d0d0c524b82
SHA2568d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557
SHA51280c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio1334.exeFilesize
402KB
MD5a83c38cfb62632adf3f4b629fb9433e6
SHA1f407b556295c886ab1ae418c449b7765642081c6
SHA2565b93d5569032de08fb549aa9ca2f7bed603facc776307a0e91719f67ffcb7542
SHA51284aaf74faa9efaf5bb0e8d29fee168c3eb6af7378fcd06ed5168a6a88aeb7a6641d021741649baaf65e0176d4130ca633639a23bbff7a23b33807222fa404d8e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio1334.exeFilesize
402KB
MD5a83c38cfb62632adf3f4b629fb9433e6
SHA1f407b556295c886ab1ae418c449b7765642081c6
SHA2565b93d5569032de08fb549aa9ca2f7bed603facc776307a0e91719f67ffcb7542
SHA51284aaf74faa9efaf5bb0e8d29fee168c3eb6af7378fcd06ed5168a6a88aeb7a6641d021741649baaf65e0176d4130ca633639a23bbff7a23b33807222fa404d8e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7445.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7445.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5735.exeFilesize
350KB
MD5e7f8224404f863f1e7700cc801dda651
SHA10ad89b7a19bb46a60feda451ac1338f0ad48458a
SHA2567aa620322e0bda75b70ee2324b2808dd26fb07b84c057c7c9f3efcbb2620cf3b
SHA5123bbeb99440193628305d5370b26d75460ea56fafb855e69c68977af3f302f32be5ec8196578eaf82725f50ce116241e3f3c28f26f41234e9dce41c799e60fdc7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5735.exeFilesize
350KB
MD5e7f8224404f863f1e7700cc801dda651
SHA10ad89b7a19bb46a60feda451ac1338f0ad48458a
SHA2567aa620322e0bda75b70ee2324b2808dd26fb07b84c057c7c9f3efcbb2620cf3b
SHA5123bbeb99440193628305d5370b26d75460ea56fafb855e69c68977af3f302f32be5ec8196578eaf82725f50ce116241e3f3c28f26f41234e9dce41c799e60fdc7
-
memory/1304-1075-0x0000000000320000-0x0000000000352000-memory.dmpFilesize
200KB
-
memory/1304-1076-0x0000000004BE0000-0x0000000004C2B000-memory.dmpFilesize
300KB
-
memory/1304-1077-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/2940-135-0x0000000000A00000-0x0000000000A0A000-memory.dmpFilesize
40KB
-
memory/4064-175-0x0000000004C90000-0x0000000004CCE000-memory.dmpFilesize
248KB
-
memory/4064-203-0x0000000004C90000-0x0000000004CCE000-memory.dmpFilesize
248KB
-
memory/4064-145-0x0000000004E20000-0x0000000004E30000-memory.dmpFilesize
64KB
-
memory/4064-144-0x00000000007F0000-0x000000000083B000-memory.dmpFilesize
300KB
-
memory/4064-146-0x0000000004E20000-0x0000000004E30000-memory.dmpFilesize
64KB
-
memory/4064-148-0x0000000004C90000-0x0000000004CCE000-memory.dmpFilesize
248KB
-
memory/4064-149-0x0000000004C90000-0x0000000004CCE000-memory.dmpFilesize
248KB
-
memory/4064-147-0x0000000004E20000-0x0000000004E30000-memory.dmpFilesize
64KB
-
memory/4064-151-0x0000000004C90000-0x0000000004CCE000-memory.dmpFilesize
248KB
-
memory/4064-153-0x0000000004C90000-0x0000000004CCE000-memory.dmpFilesize
248KB
-
memory/4064-155-0x0000000004C90000-0x0000000004CCE000-memory.dmpFilesize
248KB
-
memory/4064-159-0x0000000004C90000-0x0000000004CCE000-memory.dmpFilesize
248KB
-
memory/4064-161-0x0000000004C90000-0x0000000004CCE000-memory.dmpFilesize
248KB
-
memory/4064-157-0x0000000004C90000-0x0000000004CCE000-memory.dmpFilesize
248KB
-
memory/4064-163-0x0000000004C90000-0x0000000004CCE000-memory.dmpFilesize
248KB
-
memory/4064-165-0x0000000004C90000-0x0000000004CCE000-memory.dmpFilesize
248KB
-
memory/4064-167-0x0000000004C90000-0x0000000004CCE000-memory.dmpFilesize
248KB
-
memory/4064-169-0x0000000004C90000-0x0000000004CCE000-memory.dmpFilesize
248KB
-
memory/4064-171-0x0000000004C90000-0x0000000004CCE000-memory.dmpFilesize
248KB
-
memory/4064-173-0x0000000004C90000-0x0000000004CCE000-memory.dmpFilesize
248KB
-
memory/4064-142-0x0000000004E30000-0x000000000532E000-memory.dmpFilesize
5.0MB
-
memory/4064-177-0x0000000004C90000-0x0000000004CCE000-memory.dmpFilesize
248KB
-
memory/4064-179-0x0000000004C90000-0x0000000004CCE000-memory.dmpFilesize
248KB
-
memory/4064-181-0x0000000004C90000-0x0000000004CCE000-memory.dmpFilesize
248KB
-
memory/4064-183-0x0000000004C90000-0x0000000004CCE000-memory.dmpFilesize
248KB
-
memory/4064-185-0x0000000004C90000-0x0000000004CCE000-memory.dmpFilesize
248KB
-
memory/4064-193-0x0000000004C90000-0x0000000004CCE000-memory.dmpFilesize
248KB
-
memory/4064-143-0x0000000004C90000-0x0000000004CD4000-memory.dmpFilesize
272KB
-
memory/4064-201-0x0000000004C90000-0x0000000004CCE000-memory.dmpFilesize
248KB
-
memory/4064-199-0x0000000004C90000-0x0000000004CCE000-memory.dmpFilesize
248KB
-
memory/4064-205-0x0000000004C90000-0x0000000004CCE000-memory.dmpFilesize
248KB
-
memory/4064-209-0x0000000004C90000-0x0000000004CCE000-memory.dmpFilesize
248KB
-
memory/4064-211-0x0000000004C90000-0x0000000004CCE000-memory.dmpFilesize
248KB
-
memory/4064-207-0x0000000004C90000-0x0000000004CCE000-memory.dmpFilesize
248KB
-
memory/4064-197-0x0000000004C90000-0x0000000004CCE000-memory.dmpFilesize
248KB
-
memory/4064-195-0x0000000004C90000-0x0000000004CCE000-memory.dmpFilesize
248KB
-
memory/4064-191-0x0000000004C90000-0x0000000004CCE000-memory.dmpFilesize
248KB
-
memory/4064-189-0x0000000004C90000-0x0000000004CCE000-memory.dmpFilesize
248KB
-
memory/4064-187-0x0000000004C90000-0x0000000004CCE000-memory.dmpFilesize
248KB
-
memory/4064-1054-0x0000000005940000-0x0000000005F46000-memory.dmpFilesize
6.0MB
-
memory/4064-1055-0x0000000005330000-0x000000000543A000-memory.dmpFilesize
1.0MB
-
memory/4064-1056-0x0000000004DD0000-0x0000000004DE2000-memory.dmpFilesize
72KB
-
memory/4064-1057-0x0000000005440000-0x000000000547E000-memory.dmpFilesize
248KB
-
memory/4064-1058-0x0000000005580000-0x00000000055CB000-memory.dmpFilesize
300KB
-
memory/4064-1059-0x0000000004E20000-0x0000000004E30000-memory.dmpFilesize
64KB
-
memory/4064-1061-0x00000000056F0000-0x0000000005782000-memory.dmpFilesize
584KB
-
memory/4064-1062-0x0000000005790000-0x00000000057F6000-memory.dmpFilesize
408KB
-
memory/4064-1063-0x0000000004E20000-0x0000000004E30000-memory.dmpFilesize
64KB
-
memory/4064-1064-0x0000000004E20000-0x0000000004E30000-memory.dmpFilesize
64KB
-
memory/4064-1065-0x00000000065B0000-0x0000000006772000-memory.dmpFilesize
1.8MB
-
memory/4064-141-0x0000000002700000-0x0000000002746000-memory.dmpFilesize
280KB
-
memory/4064-1066-0x0000000006780000-0x0000000006CAC000-memory.dmpFilesize
5.2MB
-
memory/4064-1067-0x0000000006F20000-0x0000000006F96000-memory.dmpFilesize
472KB
-
memory/4064-1068-0x0000000006FA0000-0x0000000006FF0000-memory.dmpFilesize
320KB
-
memory/4064-1069-0x0000000004E20000-0x0000000004E30000-memory.dmpFilesize
64KB