Analysis
-
max time kernel
81s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
23-03-2023 21:19
Static task
static1
Behavioral task
behavioral1
Sample
2bafe4091f6d373fc083197d4e3ec00611ce37909c1dc1c210512da745c78615.exe
Resource
win10v2004-20230221-en
General
-
Target
2bafe4091f6d373fc083197d4e3ec00611ce37909c1dc1c210512da745c78615.exe
-
Size
544KB
-
MD5
5fcd326c7be9ba5f2f4d7da934224f4d
-
SHA1
1b44c489e413e9ba840f497ff52f273ebd3805c5
-
SHA256
2bafe4091f6d373fc083197d4e3ec00611ce37909c1dc1c210512da745c78615
-
SHA512
c0e6a30c6ba1431476f65c100eab678c194f0d5f1c4f52153760eb29699120e46026daeaedd88c4ab471d165e8b3acf14e7cd7323f83086e16d5628bb50a790b
-
SSDEEP
12288:tMrCy90vCEWeM+svqbep398okrKXlqgUQMLTwTnseAPnIkBoVL:jyCtM4epkebtMv6nOhBod
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
real
193.233.20.31:4125
-
auth_value
bb22a50228754849387d5f4d1611e71b
Signatures
-
Processes:
pro5997.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection pro5997.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro5997.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro5997.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro5997.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro5997.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro5997.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
Processes:
resource yara_rule behavioral1/memory/3736-156-0x00000000029A0000-0x00000000029DE000-memory.dmp family_redline behavioral1/memory/3736-157-0x00000000029A0000-0x00000000029DE000-memory.dmp family_redline behavioral1/memory/3736-159-0x00000000029A0000-0x00000000029DE000-memory.dmp family_redline behavioral1/memory/3736-161-0x00000000029A0000-0x00000000029DE000-memory.dmp family_redline behavioral1/memory/3736-163-0x00000000029A0000-0x00000000029DE000-memory.dmp family_redline behavioral1/memory/3736-165-0x00000000029A0000-0x00000000029DE000-memory.dmp family_redline behavioral1/memory/3736-167-0x00000000029A0000-0x00000000029DE000-memory.dmp family_redline behavioral1/memory/3736-169-0x00000000029A0000-0x00000000029DE000-memory.dmp family_redline behavioral1/memory/3736-171-0x00000000029A0000-0x00000000029DE000-memory.dmp family_redline behavioral1/memory/3736-173-0x00000000029A0000-0x00000000029DE000-memory.dmp family_redline behavioral1/memory/3736-175-0x00000000029A0000-0x00000000029DE000-memory.dmp family_redline behavioral1/memory/3736-177-0x00000000029A0000-0x00000000029DE000-memory.dmp family_redline behavioral1/memory/3736-179-0x00000000029A0000-0x00000000029DE000-memory.dmp family_redline behavioral1/memory/3736-181-0x00000000029A0000-0x00000000029DE000-memory.dmp family_redline behavioral1/memory/3736-183-0x00000000029A0000-0x00000000029DE000-memory.dmp family_redline behavioral1/memory/3736-185-0x00000000029A0000-0x00000000029DE000-memory.dmp family_redline behavioral1/memory/3736-187-0x00000000029A0000-0x00000000029DE000-memory.dmp family_redline behavioral1/memory/3736-189-0x00000000029A0000-0x00000000029DE000-memory.dmp family_redline behavioral1/memory/3736-191-0x00000000029A0000-0x00000000029DE000-memory.dmp family_redline behavioral1/memory/3736-193-0x00000000029A0000-0x00000000029DE000-memory.dmp family_redline behavioral1/memory/3736-196-0x00000000029A0000-0x00000000029DE000-memory.dmp family_redline behavioral1/memory/3736-199-0x00000000029A0000-0x00000000029DE000-memory.dmp family_redline behavioral1/memory/3736-201-0x00000000029A0000-0x00000000029DE000-memory.dmp family_redline behavioral1/memory/3736-203-0x00000000029A0000-0x00000000029DE000-memory.dmp family_redline behavioral1/memory/3736-205-0x00000000029A0000-0x00000000029DE000-memory.dmp family_redline behavioral1/memory/3736-207-0x00000000029A0000-0x00000000029DE000-memory.dmp family_redline behavioral1/memory/3736-209-0x00000000029A0000-0x00000000029DE000-memory.dmp family_redline behavioral1/memory/3736-211-0x00000000029A0000-0x00000000029DE000-memory.dmp family_redline behavioral1/memory/3736-213-0x00000000029A0000-0x00000000029DE000-memory.dmp family_redline behavioral1/memory/3736-215-0x00000000029A0000-0x00000000029DE000-memory.dmp family_redline behavioral1/memory/3736-217-0x00000000029A0000-0x00000000029DE000-memory.dmp family_redline behavioral1/memory/3736-219-0x00000000029A0000-0x00000000029DE000-memory.dmp family_redline behavioral1/memory/3736-221-0x00000000029A0000-0x00000000029DE000-memory.dmp family_redline behavioral1/memory/3736-1071-0x0000000002990000-0x00000000029A0000-memory.dmp family_redline behavioral1/memory/3736-1072-0x0000000002990000-0x00000000029A0000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
unio0540.exepro5997.exequ0082.exesi299284.exepid process 520 unio0540.exe 4176 pro5997.exe 3736 qu0082.exe 716 si299284.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro5997.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" pro5997.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
2bafe4091f6d373fc083197d4e3ec00611ce37909c1dc1c210512da745c78615.exeunio0540.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 2bafe4091f6d373fc083197d4e3ec00611ce37909c1dc1c210512da745c78615.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 2bafe4091f6d373fc083197d4e3ec00611ce37909c1dc1c210512da745c78615.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce unio0540.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" unio0540.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3108 3736 WerFault.exe qu0082.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro5997.exequ0082.exesi299284.exepid process 4176 pro5997.exe 4176 pro5997.exe 3736 qu0082.exe 3736 qu0082.exe 716 si299284.exe 716 si299284.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro5997.exequ0082.exesi299284.exedescription pid process Token: SeDebugPrivilege 4176 pro5997.exe Token: SeDebugPrivilege 3736 qu0082.exe Token: SeDebugPrivilege 716 si299284.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
2bafe4091f6d373fc083197d4e3ec00611ce37909c1dc1c210512da745c78615.exeunio0540.exedescription pid process target process PID 1388 wrote to memory of 520 1388 2bafe4091f6d373fc083197d4e3ec00611ce37909c1dc1c210512da745c78615.exe unio0540.exe PID 1388 wrote to memory of 520 1388 2bafe4091f6d373fc083197d4e3ec00611ce37909c1dc1c210512da745c78615.exe unio0540.exe PID 1388 wrote to memory of 520 1388 2bafe4091f6d373fc083197d4e3ec00611ce37909c1dc1c210512da745c78615.exe unio0540.exe PID 520 wrote to memory of 4176 520 unio0540.exe pro5997.exe PID 520 wrote to memory of 4176 520 unio0540.exe pro5997.exe PID 520 wrote to memory of 3736 520 unio0540.exe qu0082.exe PID 520 wrote to memory of 3736 520 unio0540.exe qu0082.exe PID 520 wrote to memory of 3736 520 unio0540.exe qu0082.exe PID 1388 wrote to memory of 716 1388 2bafe4091f6d373fc083197d4e3ec00611ce37909c1dc1c210512da745c78615.exe si299284.exe PID 1388 wrote to memory of 716 1388 2bafe4091f6d373fc083197d4e3ec00611ce37909c1dc1c210512da745c78615.exe si299284.exe PID 1388 wrote to memory of 716 1388 2bafe4091f6d373fc083197d4e3ec00611ce37909c1dc1c210512da745c78615.exe si299284.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bafe4091f6d373fc083197d4e3ec00611ce37909c1dc1c210512da745c78615.exe"C:\Users\Admin\AppData\Local\Temp\2bafe4091f6d373fc083197d4e3ec00611ce37909c1dc1c210512da745c78615.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio0540.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio0540.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5997.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5997.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0082.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0082.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 15324⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si299284.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si299284.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3736 -ip 37361⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si299284.exeFilesize
175KB
MD541707338e1e2d868aa699ac0dd2e77b0
SHA136e0dfba09f9fb409faf0f9a99217d0d0c524b82
SHA2568d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557
SHA51280c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si299284.exeFilesize
175KB
MD541707338e1e2d868aa699ac0dd2e77b0
SHA136e0dfba09f9fb409faf0f9a99217d0d0c524b82
SHA2568d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557
SHA51280c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio0540.exeFilesize
402KB
MD593d8f542f2de89ee9074b41446562d5d
SHA1831f294875ac70ad1ba7215f9cca2b58820cabe2
SHA256995ebf866314ffd4c1236622b8f41e230082f50eb168ae8ea321b62e830083db
SHA512cc4f8580e41ce4db746a8b2fb192fef86f0d16e61c0faf07cc5ab6b7ea0684fcd11f9e5a8e2c60c184b9436e31f261dde94ed58125416395421c5e5ea1bf8075
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio0540.exeFilesize
402KB
MD593d8f542f2de89ee9074b41446562d5d
SHA1831f294875ac70ad1ba7215f9cca2b58820cabe2
SHA256995ebf866314ffd4c1236622b8f41e230082f50eb168ae8ea321b62e830083db
SHA512cc4f8580e41ce4db746a8b2fb192fef86f0d16e61c0faf07cc5ab6b7ea0684fcd11f9e5a8e2c60c184b9436e31f261dde94ed58125416395421c5e5ea1bf8075
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5997.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5997.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0082.exeFilesize
349KB
MD5ae82862c5e15d7999dec39b061ef7f1d
SHA13dd5cd5e1d88d95b01d5afda33aabaf170b82c2b
SHA256e1947f79dc317f0c346e84fb4e82f40cd9b7b5ebc73a73e843577c69eee87ce4
SHA512dd5d3f6cda76692bd3df7621140bd20194a3b5e561cd07c21351114bd7b81f29e686168841a73da87d1dc35fffb71007efe12639766de67de5b3de6278dba319
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0082.exeFilesize
349KB
MD5ae82862c5e15d7999dec39b061ef7f1d
SHA13dd5cd5e1d88d95b01d5afda33aabaf170b82c2b
SHA256e1947f79dc317f0c346e84fb4e82f40cd9b7b5ebc73a73e843577c69eee87ce4
SHA512dd5d3f6cda76692bd3df7621140bd20194a3b5e561cd07c21351114bd7b81f29e686168841a73da87d1dc35fffb71007efe12639766de67de5b3de6278dba319
-
memory/716-1085-0x0000000000D00000-0x0000000000D32000-memory.dmpFilesize
200KB
-
memory/716-1086-0x00000000055A0000-0x00000000055B0000-memory.dmpFilesize
64KB
-
memory/3736-195-0x0000000002990000-0x00000000029A0000-memory.dmpFilesize
64KB
-
memory/3736-203-0x00000000029A0000-0x00000000029DE000-memory.dmpFilesize
248KB
-
memory/3736-156-0x00000000029A0000-0x00000000029DE000-memory.dmpFilesize
248KB
-
memory/3736-157-0x00000000029A0000-0x00000000029DE000-memory.dmpFilesize
248KB
-
memory/3736-159-0x00000000029A0000-0x00000000029DE000-memory.dmpFilesize
248KB
-
memory/3736-161-0x00000000029A0000-0x00000000029DE000-memory.dmpFilesize
248KB
-
memory/3736-163-0x00000000029A0000-0x00000000029DE000-memory.dmpFilesize
248KB
-
memory/3736-165-0x00000000029A0000-0x00000000029DE000-memory.dmpFilesize
248KB
-
memory/3736-167-0x00000000029A0000-0x00000000029DE000-memory.dmpFilesize
248KB
-
memory/3736-169-0x00000000029A0000-0x00000000029DE000-memory.dmpFilesize
248KB
-
memory/3736-171-0x00000000029A0000-0x00000000029DE000-memory.dmpFilesize
248KB
-
memory/3736-173-0x00000000029A0000-0x00000000029DE000-memory.dmpFilesize
248KB
-
memory/3736-175-0x00000000029A0000-0x00000000029DE000-memory.dmpFilesize
248KB
-
memory/3736-177-0x00000000029A0000-0x00000000029DE000-memory.dmpFilesize
248KB
-
memory/3736-179-0x00000000029A0000-0x00000000029DE000-memory.dmpFilesize
248KB
-
memory/3736-181-0x00000000029A0000-0x00000000029DE000-memory.dmpFilesize
248KB
-
memory/3736-183-0x00000000029A0000-0x00000000029DE000-memory.dmpFilesize
248KB
-
memory/3736-185-0x00000000029A0000-0x00000000029DE000-memory.dmpFilesize
248KB
-
memory/3736-187-0x00000000029A0000-0x00000000029DE000-memory.dmpFilesize
248KB
-
memory/3736-189-0x00000000029A0000-0x00000000029DE000-memory.dmpFilesize
248KB
-
memory/3736-191-0x00000000029A0000-0x00000000029DE000-memory.dmpFilesize
248KB
-
memory/3736-193-0x00000000029A0000-0x00000000029DE000-memory.dmpFilesize
248KB
-
memory/3736-154-0x0000000002990000-0x00000000029A0000-memory.dmpFilesize
64KB
-
memory/3736-196-0x00000000029A0000-0x00000000029DE000-memory.dmpFilesize
248KB
-
memory/3736-197-0x0000000002990000-0x00000000029A0000-memory.dmpFilesize
64KB
-
memory/3736-199-0x00000000029A0000-0x00000000029DE000-memory.dmpFilesize
248KB
-
memory/3736-201-0x00000000029A0000-0x00000000029DE000-memory.dmpFilesize
248KB
-
memory/3736-155-0x0000000004D70000-0x0000000005314000-memory.dmpFilesize
5.6MB
-
memory/3736-205-0x00000000029A0000-0x00000000029DE000-memory.dmpFilesize
248KB
-
memory/3736-207-0x00000000029A0000-0x00000000029DE000-memory.dmpFilesize
248KB
-
memory/3736-209-0x00000000029A0000-0x00000000029DE000-memory.dmpFilesize
248KB
-
memory/3736-211-0x00000000029A0000-0x00000000029DE000-memory.dmpFilesize
248KB
-
memory/3736-213-0x00000000029A0000-0x00000000029DE000-memory.dmpFilesize
248KB
-
memory/3736-215-0x00000000029A0000-0x00000000029DE000-memory.dmpFilesize
248KB
-
memory/3736-217-0x00000000029A0000-0x00000000029DE000-memory.dmpFilesize
248KB
-
memory/3736-219-0x00000000029A0000-0x00000000029DE000-memory.dmpFilesize
248KB
-
memory/3736-221-0x00000000029A0000-0x00000000029DE000-memory.dmpFilesize
248KB
-
memory/3736-1064-0x0000000005320000-0x0000000005938000-memory.dmpFilesize
6.1MB
-
memory/3736-1065-0x00000000059C0000-0x0000000005ACA000-memory.dmpFilesize
1.0MB
-
memory/3736-1066-0x0000000005B00000-0x0000000005B12000-memory.dmpFilesize
72KB
-
memory/3736-1067-0x0000000005B20000-0x0000000005B5C000-memory.dmpFilesize
240KB
-
memory/3736-1068-0x0000000002990000-0x00000000029A0000-memory.dmpFilesize
64KB
-
memory/3736-1070-0x0000000002990000-0x00000000029A0000-memory.dmpFilesize
64KB
-
memory/3736-1071-0x0000000002990000-0x00000000029A0000-memory.dmpFilesize
64KB
-
memory/3736-1072-0x0000000002990000-0x00000000029A0000-memory.dmpFilesize
64KB
-
memory/3736-1073-0x0000000005E10000-0x0000000005EA2000-memory.dmpFilesize
584KB
-
memory/3736-1074-0x0000000005EB0000-0x0000000005F16000-memory.dmpFilesize
408KB
-
memory/3736-1075-0x00000000065B0000-0x0000000006626000-memory.dmpFilesize
472KB
-
memory/3736-1076-0x0000000006640000-0x0000000006690000-memory.dmpFilesize
320KB
-
memory/3736-153-0x00000000008B0000-0x00000000008FB000-memory.dmpFilesize
300KB
-
memory/3736-1077-0x0000000006930000-0x0000000006AF2000-memory.dmpFilesize
1.8MB
-
memory/3736-1078-0x0000000002990000-0x00000000029A0000-memory.dmpFilesize
64KB
-
memory/3736-1079-0x0000000006B00000-0x000000000702C000-memory.dmpFilesize
5.2MB
-
memory/4176-147-0x00000000009D0000-0x00000000009DA000-memory.dmpFilesize
40KB