Analysis
-
max time kernel
86s -
max time network
89s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
23-03-2023 20:36
Static task
static1
Behavioral task
behavioral1
Sample
4761043cd3a5b7ff72232c297e06d26a4318841c9797b32b03bbe2ec69bfa3d4.exe
Resource
win10-20230220-en
General
-
Target
4761043cd3a5b7ff72232c297e06d26a4318841c9797b32b03bbe2ec69bfa3d4.exe
-
Size
544KB
-
MD5
552f0b59cbe0ef9b0c3ab4808349bcf0
-
SHA1
f57f3273db19097a9340a458be7d0aad4c6cfdbb
-
SHA256
4761043cd3a5b7ff72232c297e06d26a4318841c9797b32b03bbe2ec69bfa3d4
-
SHA512
8b65a5433151219569cfa93ca88a1905c82fcfd684bd41b81bceea74f865a86562aa9386d754f408afee5a1bf8d9a1d76a679c299ae02df8faacc7cf9f023949
-
SSDEEP
12288:wMrKy90Zg8dDhsJ7SbPSJuIjp8mqgU4MLjwJwO+Ull4fN:qywDmSbPlSlMvm+UUN
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
lown
193.233.20.31:4125
-
auth_value
4cf836e062bcdc2a4fdbf410f5747ec7
Signatures
-
Processes:
h59eg54.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" h59eg54.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" h59eg54.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" h59eg54.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" h59eg54.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" h59eg54.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 36 IoCs
Processes:
resource yara_rule behavioral1/memory/4292-139-0x0000000002390000-0x00000000023D6000-memory.dmp family_redline behavioral1/memory/4292-143-0x0000000002640000-0x0000000002684000-memory.dmp family_redline behavioral1/memory/4292-146-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4292-147-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4292-149-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4292-153-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4292-155-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4292-151-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4292-157-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4292-159-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4292-161-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4292-163-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4292-165-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4292-167-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4292-169-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4292-171-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4292-173-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4292-175-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4292-177-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4292-179-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4292-181-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4292-183-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4292-185-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4292-187-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4292-189-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4292-191-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4292-193-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4292-195-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4292-197-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4292-199-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4292-201-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4292-203-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4292-205-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4292-207-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4292-209-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4292-1061-0x0000000004EF0000-0x0000000004F00000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
niba1687.exeh59eg54.exeiNpcB47.exel97Ho96.exepid process 1008 niba1687.exe 4252 h59eg54.exe 4292 iNpcB47.exe 4428 l97Ho96.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
h59eg54.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" h59eg54.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
4761043cd3a5b7ff72232c297e06d26a4318841c9797b32b03bbe2ec69bfa3d4.exeniba1687.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 4761043cd3a5b7ff72232c297e06d26a4318841c9797b32b03bbe2ec69bfa3d4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 4761043cd3a5b7ff72232c297e06d26a4318841c9797b32b03bbe2ec69bfa3d4.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce niba1687.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" niba1687.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
h59eg54.exeiNpcB47.exel97Ho96.exepid process 4252 h59eg54.exe 4252 h59eg54.exe 4292 iNpcB47.exe 4292 iNpcB47.exe 4428 l97Ho96.exe 4428 l97Ho96.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
h59eg54.exeiNpcB47.exel97Ho96.exedescription pid process Token: SeDebugPrivilege 4252 h59eg54.exe Token: SeDebugPrivilege 4292 iNpcB47.exe Token: SeDebugPrivilege 4428 l97Ho96.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
4761043cd3a5b7ff72232c297e06d26a4318841c9797b32b03bbe2ec69bfa3d4.exeniba1687.exedescription pid process target process PID 2272 wrote to memory of 1008 2272 4761043cd3a5b7ff72232c297e06d26a4318841c9797b32b03bbe2ec69bfa3d4.exe niba1687.exe PID 2272 wrote to memory of 1008 2272 4761043cd3a5b7ff72232c297e06d26a4318841c9797b32b03bbe2ec69bfa3d4.exe niba1687.exe PID 2272 wrote to memory of 1008 2272 4761043cd3a5b7ff72232c297e06d26a4318841c9797b32b03bbe2ec69bfa3d4.exe niba1687.exe PID 1008 wrote to memory of 4252 1008 niba1687.exe h59eg54.exe PID 1008 wrote to memory of 4252 1008 niba1687.exe h59eg54.exe PID 1008 wrote to memory of 4292 1008 niba1687.exe iNpcB47.exe PID 1008 wrote to memory of 4292 1008 niba1687.exe iNpcB47.exe PID 1008 wrote to memory of 4292 1008 niba1687.exe iNpcB47.exe PID 2272 wrote to memory of 4428 2272 4761043cd3a5b7ff72232c297e06d26a4318841c9797b32b03bbe2ec69bfa3d4.exe l97Ho96.exe PID 2272 wrote to memory of 4428 2272 4761043cd3a5b7ff72232c297e06d26a4318841c9797b32b03bbe2ec69bfa3d4.exe l97Ho96.exe PID 2272 wrote to memory of 4428 2272 4761043cd3a5b7ff72232c297e06d26a4318841c9797b32b03bbe2ec69bfa3d4.exe l97Ho96.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4761043cd3a5b7ff72232c297e06d26a4318841c9797b32b03bbe2ec69bfa3d4.exe"C:\Users\Admin\AppData\Local\Temp\4761043cd3a5b7ff72232c297e06d26a4318841c9797b32b03bbe2ec69bfa3d4.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba1687.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba1687.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h59eg54.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h59eg54.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iNpcB47.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iNpcB47.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l97Ho96.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l97Ho96.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l97Ho96.exeFilesize
175KB
MD550809fe16d7c482c1f4a2ea19fdcbc0a
SHA111b6f69c06a724da15183b16039c5cbc86016158
SHA25609917b67829de37b5d6be8115c8f8321f436554f426a24e079257a8368051cb1
SHA512c35170e5eb6dabda9fd2d289153df829957ca8e9665178529a1ba36395155bb34f489372993ec694d10bea490c86cef2ae152e2df480288aca8e796ba135261f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l97Ho96.exeFilesize
175KB
MD550809fe16d7c482c1f4a2ea19fdcbc0a
SHA111b6f69c06a724da15183b16039c5cbc86016158
SHA25609917b67829de37b5d6be8115c8f8321f436554f426a24e079257a8368051cb1
SHA512c35170e5eb6dabda9fd2d289153df829957ca8e9665178529a1ba36395155bb34f489372993ec694d10bea490c86cef2ae152e2df480288aca8e796ba135261f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba1687.exeFilesize
402KB
MD53fcda632f2f22f587f34cdfa1315b8ae
SHA19174917f3e4381b18dd61b09a5c187ce6b2c938b
SHA256cd7559cdb1a8581ffbcdac3609c9d61afbe15f3ef53051419e3411631bc39a05
SHA512853b8f15c78fb1b26543da51e59373d8e2ae18ce1d5a040f789c5c33e83c9bace092a440e98ea322f3073d0098973de2025e362c5926dc7bb6ffb9a341e78b6a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba1687.exeFilesize
402KB
MD53fcda632f2f22f587f34cdfa1315b8ae
SHA19174917f3e4381b18dd61b09a5c187ce6b2c938b
SHA256cd7559cdb1a8581ffbcdac3609c9d61afbe15f3ef53051419e3411631bc39a05
SHA512853b8f15c78fb1b26543da51e59373d8e2ae18ce1d5a040f789c5c33e83c9bace092a440e98ea322f3073d0098973de2025e362c5926dc7bb6ffb9a341e78b6a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h59eg54.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h59eg54.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iNpcB47.exeFilesize
349KB
MD50efe40cd309f890cf93035c90dee4c6b
SHA105df61032bc4740c12c98fa8330e5d1d81c2dedd
SHA256f1be074ce779c2f395755f0cc5f1de62329174d61534490df307c7ee0eb1685d
SHA512c972e438462855602e8cd8006d69c68ce7da8d312c94d1bf51ae1c76b5307e6126c9cdb84a4bbd2d5880554a7e224a6ad3789c62d1597f2b9f12f20f5d71ba23
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iNpcB47.exeFilesize
349KB
MD50efe40cd309f890cf93035c90dee4c6b
SHA105df61032bc4740c12c98fa8330e5d1d81c2dedd
SHA256f1be074ce779c2f395755f0cc5f1de62329174d61534490df307c7ee0eb1685d
SHA512c972e438462855602e8cd8006d69c68ce7da8d312c94d1bf51ae1c76b5307e6126c9cdb84a4bbd2d5880554a7e224a6ad3789c62d1597f2b9f12f20f5d71ba23
-
memory/4252-133-0x0000000000700000-0x000000000070A000-memory.dmpFilesize
40KB
-
memory/4292-139-0x0000000002390000-0x00000000023D6000-memory.dmpFilesize
280KB
-
memory/4292-140-0x0000000004F00000-0x00000000053FE000-memory.dmpFilesize
5.0MB
-
memory/4292-141-0x0000000000720000-0x000000000076B000-memory.dmpFilesize
300KB
-
memory/4292-142-0x0000000004EF0000-0x0000000004F00000-memory.dmpFilesize
64KB
-
memory/4292-143-0x0000000002640000-0x0000000002684000-memory.dmpFilesize
272KB
-
memory/4292-145-0x0000000004EF0000-0x0000000004F00000-memory.dmpFilesize
64KB
-
memory/4292-144-0x0000000004EF0000-0x0000000004F00000-memory.dmpFilesize
64KB
-
memory/4292-146-0x0000000002640000-0x000000000267E000-memory.dmpFilesize
248KB
-
memory/4292-147-0x0000000002640000-0x000000000267E000-memory.dmpFilesize
248KB
-
memory/4292-149-0x0000000002640000-0x000000000267E000-memory.dmpFilesize
248KB
-
memory/4292-153-0x0000000002640000-0x000000000267E000-memory.dmpFilesize
248KB
-
memory/4292-155-0x0000000002640000-0x000000000267E000-memory.dmpFilesize
248KB
-
memory/4292-151-0x0000000002640000-0x000000000267E000-memory.dmpFilesize
248KB
-
memory/4292-157-0x0000000002640000-0x000000000267E000-memory.dmpFilesize
248KB
-
memory/4292-159-0x0000000002640000-0x000000000267E000-memory.dmpFilesize
248KB
-
memory/4292-161-0x0000000002640000-0x000000000267E000-memory.dmpFilesize
248KB
-
memory/4292-163-0x0000000002640000-0x000000000267E000-memory.dmpFilesize
248KB
-
memory/4292-165-0x0000000002640000-0x000000000267E000-memory.dmpFilesize
248KB
-
memory/4292-167-0x0000000002640000-0x000000000267E000-memory.dmpFilesize
248KB
-
memory/4292-169-0x0000000002640000-0x000000000267E000-memory.dmpFilesize
248KB
-
memory/4292-171-0x0000000002640000-0x000000000267E000-memory.dmpFilesize
248KB
-
memory/4292-173-0x0000000002640000-0x000000000267E000-memory.dmpFilesize
248KB
-
memory/4292-175-0x0000000002640000-0x000000000267E000-memory.dmpFilesize
248KB
-
memory/4292-177-0x0000000002640000-0x000000000267E000-memory.dmpFilesize
248KB
-
memory/4292-179-0x0000000002640000-0x000000000267E000-memory.dmpFilesize
248KB
-
memory/4292-181-0x0000000002640000-0x000000000267E000-memory.dmpFilesize
248KB
-
memory/4292-183-0x0000000002640000-0x000000000267E000-memory.dmpFilesize
248KB
-
memory/4292-185-0x0000000002640000-0x000000000267E000-memory.dmpFilesize
248KB
-
memory/4292-187-0x0000000002640000-0x000000000267E000-memory.dmpFilesize
248KB
-
memory/4292-189-0x0000000002640000-0x000000000267E000-memory.dmpFilesize
248KB
-
memory/4292-191-0x0000000002640000-0x000000000267E000-memory.dmpFilesize
248KB
-
memory/4292-193-0x0000000002640000-0x000000000267E000-memory.dmpFilesize
248KB
-
memory/4292-195-0x0000000002640000-0x000000000267E000-memory.dmpFilesize
248KB
-
memory/4292-197-0x0000000002640000-0x000000000267E000-memory.dmpFilesize
248KB
-
memory/4292-199-0x0000000002640000-0x000000000267E000-memory.dmpFilesize
248KB
-
memory/4292-201-0x0000000002640000-0x000000000267E000-memory.dmpFilesize
248KB
-
memory/4292-203-0x0000000002640000-0x000000000267E000-memory.dmpFilesize
248KB
-
memory/4292-205-0x0000000002640000-0x000000000267E000-memory.dmpFilesize
248KB
-
memory/4292-207-0x0000000002640000-0x000000000267E000-memory.dmpFilesize
248KB
-
memory/4292-209-0x0000000002640000-0x000000000267E000-memory.dmpFilesize
248KB
-
memory/4292-1052-0x0000000005400000-0x0000000005A06000-memory.dmpFilesize
6.0MB
-
memory/4292-1053-0x0000000005A10000-0x0000000005B1A000-memory.dmpFilesize
1.0MB
-
memory/4292-1054-0x0000000005B40000-0x0000000005B52000-memory.dmpFilesize
72KB
-
memory/4292-1055-0x0000000005B60000-0x0000000005B9E000-memory.dmpFilesize
248KB
-
memory/4292-1056-0x0000000005CB0000-0x0000000005CFB000-memory.dmpFilesize
300KB
-
memory/4292-1057-0x0000000004EF0000-0x0000000004F00000-memory.dmpFilesize
64KB
-
memory/4292-1059-0x0000000005E40000-0x0000000005EA6000-memory.dmpFilesize
408KB
-
memory/4292-1060-0x0000000004EF0000-0x0000000004F00000-memory.dmpFilesize
64KB
-
memory/4292-1061-0x0000000004EF0000-0x0000000004F00000-memory.dmpFilesize
64KB
-
memory/4292-1062-0x00000000063E0000-0x0000000006472000-memory.dmpFilesize
584KB
-
memory/4292-1063-0x0000000006970000-0x00000000069E6000-memory.dmpFilesize
472KB
-
memory/4292-1064-0x00000000069F0000-0x0000000006A40000-memory.dmpFilesize
320KB
-
memory/4292-1065-0x0000000004EF0000-0x0000000004F00000-memory.dmpFilesize
64KB
-
memory/4292-1066-0x0000000006BA0000-0x0000000006D62000-memory.dmpFilesize
1.8MB
-
memory/4292-1067-0x0000000006D70000-0x000000000729C000-memory.dmpFilesize
5.2MB
-
memory/4428-1073-0x0000000000650000-0x0000000000682000-memory.dmpFilesize
200KB
-
memory/4428-1074-0x0000000005090000-0x00000000050DB000-memory.dmpFilesize
300KB
-
memory/4428-1075-0x0000000005270000-0x0000000005280000-memory.dmpFilesize
64KB