Analysis
-
max time kernel
55s -
max time network
58s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
23-03-2023 20:13
Static task
static1
Behavioral task
behavioral1
Sample
9741e4893f9e34693bf28e6066f9f2ffa7f49cb97e4e49395eb2a57e4a1dd8ab.exe
Resource
win10-20230220-en
General
-
Target
9741e4893f9e34693bf28e6066f9f2ffa7f49cb97e4e49395eb2a57e4a1dd8ab.exe
-
Size
544KB
-
MD5
7d781864a4af736e7bf2d30546a3ce4b
-
SHA1
f1786393013a0988b7514f29184f7fb2a00b559a
-
SHA256
9741e4893f9e34693bf28e6066f9f2ffa7f49cb97e4e49395eb2a57e4a1dd8ab
-
SHA512
9e24c7f76a96ffb8dc0acdaf0b19beb9c452fe1b88cfd79f14818742e78bb087349e873f07f6346d8eb66c82908ab54fab44c1cd79bba8ec73cd0ae0e73bcce3
-
SSDEEP
12288:+Mrqy90YXcUXJ9YLTklEbjqgUIMLXweOWqPW:IyfH9YLQYpMjCRPW
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
real
193.233.20.31:4125
-
auth_value
bb22a50228754849387d5f4d1611e71b
Signatures
-
Processes:
pro7795.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro7795.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro7795.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro7795.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro7795.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro7795.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
Processes:
resource yara_rule behavioral1/memory/2072-139-0x0000000000AE0000-0x0000000000B26000-memory.dmp family_redline behavioral1/memory/2072-141-0x0000000002480000-0x00000000024C4000-memory.dmp family_redline behavioral1/memory/2072-145-0x0000000002480000-0x00000000024BE000-memory.dmp family_redline behavioral1/memory/2072-146-0x0000000002480000-0x00000000024BE000-memory.dmp family_redline behavioral1/memory/2072-148-0x0000000002480000-0x00000000024BE000-memory.dmp family_redline behavioral1/memory/2072-150-0x0000000002480000-0x00000000024BE000-memory.dmp family_redline behavioral1/memory/2072-152-0x0000000002480000-0x00000000024BE000-memory.dmp family_redline behavioral1/memory/2072-154-0x0000000002480000-0x00000000024BE000-memory.dmp family_redline behavioral1/memory/2072-156-0x0000000002480000-0x00000000024BE000-memory.dmp family_redline behavioral1/memory/2072-158-0x0000000002480000-0x00000000024BE000-memory.dmp family_redline behavioral1/memory/2072-160-0x0000000002480000-0x00000000024BE000-memory.dmp family_redline behavioral1/memory/2072-162-0x0000000002480000-0x00000000024BE000-memory.dmp family_redline behavioral1/memory/2072-164-0x0000000002480000-0x00000000024BE000-memory.dmp family_redline behavioral1/memory/2072-166-0x0000000002480000-0x00000000024BE000-memory.dmp family_redline behavioral1/memory/2072-168-0x0000000002480000-0x00000000024BE000-memory.dmp family_redline behavioral1/memory/2072-170-0x0000000002480000-0x00000000024BE000-memory.dmp family_redline behavioral1/memory/2072-172-0x0000000002480000-0x00000000024BE000-memory.dmp family_redline behavioral1/memory/2072-174-0x0000000002480000-0x00000000024BE000-memory.dmp family_redline behavioral1/memory/2072-176-0x0000000002480000-0x00000000024BE000-memory.dmp family_redline behavioral1/memory/2072-178-0x0000000002480000-0x00000000024BE000-memory.dmp family_redline behavioral1/memory/2072-180-0x0000000002480000-0x00000000024BE000-memory.dmp family_redline behavioral1/memory/2072-182-0x0000000002480000-0x00000000024BE000-memory.dmp family_redline behavioral1/memory/2072-184-0x0000000002480000-0x00000000024BE000-memory.dmp family_redline behavioral1/memory/2072-186-0x0000000002480000-0x00000000024BE000-memory.dmp family_redline behavioral1/memory/2072-188-0x0000000002480000-0x00000000024BE000-memory.dmp family_redline behavioral1/memory/2072-190-0x0000000002480000-0x00000000024BE000-memory.dmp family_redline behavioral1/memory/2072-192-0x0000000002480000-0x00000000024BE000-memory.dmp family_redline behavioral1/memory/2072-194-0x0000000002480000-0x00000000024BE000-memory.dmp family_redline behavioral1/memory/2072-196-0x0000000002480000-0x00000000024BE000-memory.dmp family_redline behavioral1/memory/2072-198-0x0000000002480000-0x00000000024BE000-memory.dmp family_redline behavioral1/memory/2072-200-0x0000000002480000-0x00000000024BE000-memory.dmp family_redline behavioral1/memory/2072-202-0x0000000002480000-0x00000000024BE000-memory.dmp family_redline behavioral1/memory/2072-204-0x0000000002480000-0x00000000024BE000-memory.dmp family_redline behavioral1/memory/2072-206-0x0000000002480000-0x00000000024BE000-memory.dmp family_redline behavioral1/memory/2072-208-0x0000000002480000-0x00000000024BE000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
unio0348.exepro7795.exequ5117.exesi700459.exepid process 2572 unio0348.exe 3484 pro7795.exe 2072 qu5117.exe 4792 si700459.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro7795.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" pro7795.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
9741e4893f9e34693bf28e6066f9f2ffa7f49cb97e4e49395eb2a57e4a1dd8ab.exeunio0348.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 9741e4893f9e34693bf28e6066f9f2ffa7f49cb97e4e49395eb2a57e4a1dd8ab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 9741e4893f9e34693bf28e6066f9f2ffa7f49cb97e4e49395eb2a57e4a1dd8ab.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce unio0348.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" unio0348.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro7795.exequ5117.exesi700459.exepid process 3484 pro7795.exe 3484 pro7795.exe 2072 qu5117.exe 2072 qu5117.exe 4792 si700459.exe 4792 si700459.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro7795.exequ5117.exesi700459.exedescription pid process Token: SeDebugPrivilege 3484 pro7795.exe Token: SeDebugPrivilege 2072 qu5117.exe Token: SeDebugPrivilege 4792 si700459.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
9741e4893f9e34693bf28e6066f9f2ffa7f49cb97e4e49395eb2a57e4a1dd8ab.exeunio0348.exedescription pid process target process PID 2436 wrote to memory of 2572 2436 9741e4893f9e34693bf28e6066f9f2ffa7f49cb97e4e49395eb2a57e4a1dd8ab.exe unio0348.exe PID 2436 wrote to memory of 2572 2436 9741e4893f9e34693bf28e6066f9f2ffa7f49cb97e4e49395eb2a57e4a1dd8ab.exe unio0348.exe PID 2436 wrote to memory of 2572 2436 9741e4893f9e34693bf28e6066f9f2ffa7f49cb97e4e49395eb2a57e4a1dd8ab.exe unio0348.exe PID 2572 wrote to memory of 3484 2572 unio0348.exe pro7795.exe PID 2572 wrote to memory of 3484 2572 unio0348.exe pro7795.exe PID 2572 wrote to memory of 2072 2572 unio0348.exe qu5117.exe PID 2572 wrote to memory of 2072 2572 unio0348.exe qu5117.exe PID 2572 wrote to memory of 2072 2572 unio0348.exe qu5117.exe PID 2436 wrote to memory of 4792 2436 9741e4893f9e34693bf28e6066f9f2ffa7f49cb97e4e49395eb2a57e4a1dd8ab.exe si700459.exe PID 2436 wrote to memory of 4792 2436 9741e4893f9e34693bf28e6066f9f2ffa7f49cb97e4e49395eb2a57e4a1dd8ab.exe si700459.exe PID 2436 wrote to memory of 4792 2436 9741e4893f9e34693bf28e6066f9f2ffa7f49cb97e4e49395eb2a57e4a1dd8ab.exe si700459.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9741e4893f9e34693bf28e6066f9f2ffa7f49cb97e4e49395eb2a57e4a1dd8ab.exe"C:\Users\Admin\AppData\Local\Temp\9741e4893f9e34693bf28e6066f9f2ffa7f49cb97e4e49395eb2a57e4a1dd8ab.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio0348.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio0348.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7795.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7795.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5117.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5117.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si700459.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si700459.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4792
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si700459.exeFilesize
175KB
MD541707338e1e2d868aa699ac0dd2e77b0
SHA136e0dfba09f9fb409faf0f9a99217d0d0c524b82
SHA2568d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557
SHA51280c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si700459.exeFilesize
175KB
MD541707338e1e2d868aa699ac0dd2e77b0
SHA136e0dfba09f9fb409faf0f9a99217d0d0c524b82
SHA2568d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557
SHA51280c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio0348.exeFilesize
402KB
MD5411e52bb4c81951be03734e9e8ca7fd1
SHA1e1210e1a45f30f579db32d2149f99d4687e09c3f
SHA2564ad366004cdf74c0cc84f53cfa5eedffecac109daaded166298224c613c71f6e
SHA5121583bfbae93357f9f1d09798ce39d3cb426442acfd5713a99a37a89686e66ca5dc6b1e89f672d823c95d24a9dc355a2064d0b8fb3321e1c4bedd6c407e67bb3f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio0348.exeFilesize
402KB
MD5411e52bb4c81951be03734e9e8ca7fd1
SHA1e1210e1a45f30f579db32d2149f99d4687e09c3f
SHA2564ad366004cdf74c0cc84f53cfa5eedffecac109daaded166298224c613c71f6e
SHA5121583bfbae93357f9f1d09798ce39d3cb426442acfd5713a99a37a89686e66ca5dc6b1e89f672d823c95d24a9dc355a2064d0b8fb3321e1c4bedd6c407e67bb3f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7795.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7795.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5117.exeFilesize
349KB
MD5b3b5d2109efd4f2b5f350c5417b46932
SHA198772a2741a3c0bbbdf0da890c2c44b3cc5b4b7b
SHA256dbac7a7d83667c3dbecbcf28ed03c030114a5f0c2a51dd14de4668c4f4cf2774
SHA5126249f3602bd9735b29ab0f24ff18970ee00a41aa5611cc554d035d66be04317c3bd62446f3bdaf29e477f82e10258e2dbc37d8405552aa4acb1aa5beb5178680
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5117.exeFilesize
349KB
MD5b3b5d2109efd4f2b5f350c5417b46932
SHA198772a2741a3c0bbbdf0da890c2c44b3cc5b4b7b
SHA256dbac7a7d83667c3dbecbcf28ed03c030114a5f0c2a51dd14de4668c4f4cf2774
SHA5126249f3602bd9735b29ab0f24ff18970ee00a41aa5611cc554d035d66be04317c3bd62446f3bdaf29e477f82e10258e2dbc37d8405552aa4acb1aa5beb5178680
-
memory/2072-138-0x0000000000890000-0x00000000008DB000-memory.dmpFilesize
300KB
-
memory/2072-139-0x0000000000AE0000-0x0000000000B26000-memory.dmpFilesize
280KB
-
memory/2072-140-0x0000000004F20000-0x000000000541E000-memory.dmpFilesize
5.0MB
-
memory/2072-141-0x0000000002480000-0x00000000024C4000-memory.dmpFilesize
272KB
-
memory/2072-142-0x0000000004F10000-0x0000000004F20000-memory.dmpFilesize
64KB
-
memory/2072-143-0x0000000004F10000-0x0000000004F20000-memory.dmpFilesize
64KB
-
memory/2072-144-0x0000000004F10000-0x0000000004F20000-memory.dmpFilesize
64KB
-
memory/2072-145-0x0000000002480000-0x00000000024BE000-memory.dmpFilesize
248KB
-
memory/2072-146-0x0000000002480000-0x00000000024BE000-memory.dmpFilesize
248KB
-
memory/2072-148-0x0000000002480000-0x00000000024BE000-memory.dmpFilesize
248KB
-
memory/2072-150-0x0000000002480000-0x00000000024BE000-memory.dmpFilesize
248KB
-
memory/2072-152-0x0000000002480000-0x00000000024BE000-memory.dmpFilesize
248KB
-
memory/2072-154-0x0000000002480000-0x00000000024BE000-memory.dmpFilesize
248KB
-
memory/2072-156-0x0000000002480000-0x00000000024BE000-memory.dmpFilesize
248KB
-
memory/2072-158-0x0000000002480000-0x00000000024BE000-memory.dmpFilesize
248KB
-
memory/2072-160-0x0000000002480000-0x00000000024BE000-memory.dmpFilesize
248KB
-
memory/2072-162-0x0000000002480000-0x00000000024BE000-memory.dmpFilesize
248KB
-
memory/2072-164-0x0000000002480000-0x00000000024BE000-memory.dmpFilesize
248KB
-
memory/2072-166-0x0000000002480000-0x00000000024BE000-memory.dmpFilesize
248KB
-
memory/2072-168-0x0000000002480000-0x00000000024BE000-memory.dmpFilesize
248KB
-
memory/2072-170-0x0000000002480000-0x00000000024BE000-memory.dmpFilesize
248KB
-
memory/2072-172-0x0000000002480000-0x00000000024BE000-memory.dmpFilesize
248KB
-
memory/2072-174-0x0000000002480000-0x00000000024BE000-memory.dmpFilesize
248KB
-
memory/2072-176-0x0000000002480000-0x00000000024BE000-memory.dmpFilesize
248KB
-
memory/2072-178-0x0000000002480000-0x00000000024BE000-memory.dmpFilesize
248KB
-
memory/2072-180-0x0000000002480000-0x00000000024BE000-memory.dmpFilesize
248KB
-
memory/2072-182-0x0000000002480000-0x00000000024BE000-memory.dmpFilesize
248KB
-
memory/2072-184-0x0000000002480000-0x00000000024BE000-memory.dmpFilesize
248KB
-
memory/2072-186-0x0000000002480000-0x00000000024BE000-memory.dmpFilesize
248KB
-
memory/2072-188-0x0000000002480000-0x00000000024BE000-memory.dmpFilesize
248KB
-
memory/2072-190-0x0000000002480000-0x00000000024BE000-memory.dmpFilesize
248KB
-
memory/2072-192-0x0000000002480000-0x00000000024BE000-memory.dmpFilesize
248KB
-
memory/2072-194-0x0000000002480000-0x00000000024BE000-memory.dmpFilesize
248KB
-
memory/2072-196-0x0000000002480000-0x00000000024BE000-memory.dmpFilesize
248KB
-
memory/2072-198-0x0000000002480000-0x00000000024BE000-memory.dmpFilesize
248KB
-
memory/2072-200-0x0000000002480000-0x00000000024BE000-memory.dmpFilesize
248KB
-
memory/2072-202-0x0000000002480000-0x00000000024BE000-memory.dmpFilesize
248KB
-
memory/2072-204-0x0000000002480000-0x00000000024BE000-memory.dmpFilesize
248KB
-
memory/2072-206-0x0000000002480000-0x00000000024BE000-memory.dmpFilesize
248KB
-
memory/2072-208-0x0000000002480000-0x00000000024BE000-memory.dmpFilesize
248KB
-
memory/2072-1051-0x0000000005A30000-0x0000000006036000-memory.dmpFilesize
6.0MB
-
memory/2072-1052-0x0000000004DD0000-0x0000000004EDA000-memory.dmpFilesize
1.0MB
-
memory/2072-1053-0x0000000004EE0000-0x0000000004EF2000-memory.dmpFilesize
72KB
-
memory/2072-1054-0x0000000005420000-0x000000000545E000-memory.dmpFilesize
248KB
-
memory/2072-1055-0x0000000004F10000-0x0000000004F20000-memory.dmpFilesize
64KB
-
memory/2072-1056-0x0000000005560000-0x00000000055AB000-memory.dmpFilesize
300KB
-
memory/2072-1058-0x0000000004F10000-0x0000000004F20000-memory.dmpFilesize
64KB
-
memory/2072-1059-0x0000000004F10000-0x0000000004F20000-memory.dmpFilesize
64KB
-
memory/2072-1060-0x0000000004F10000-0x0000000004F20000-memory.dmpFilesize
64KB
-
memory/2072-1061-0x00000000056F0000-0x0000000005782000-memory.dmpFilesize
584KB
-
memory/2072-1062-0x0000000005790000-0x00000000057F6000-memory.dmpFilesize
408KB
-
memory/2072-1063-0x0000000006600000-0x00000000067C2000-memory.dmpFilesize
1.8MB
-
memory/2072-1064-0x00000000067D0000-0x0000000006CFC000-memory.dmpFilesize
5.2MB
-
memory/2072-1065-0x0000000004F10000-0x0000000004F20000-memory.dmpFilesize
64KB
-
memory/2072-1066-0x00000000081B0000-0x0000000008226000-memory.dmpFilesize
472KB
-
memory/2072-1067-0x0000000008230000-0x0000000008280000-memory.dmpFilesize
320KB
-
memory/3484-132-0x00000000006A0000-0x00000000006AA000-memory.dmpFilesize
40KB
-
memory/4792-1073-0x0000000000DB0000-0x0000000000DE2000-memory.dmpFilesize
200KB
-
memory/4792-1074-0x00000000057F0000-0x000000000583B000-memory.dmpFilesize
300KB
-
memory/4792-1075-0x00000000055F0000-0x0000000005600000-memory.dmpFilesize
64KB