Analysis
-
max time kernel
101s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
23-03-2023 21:05
Static task
static1
Behavioral task
behavioral1
Sample
822ed1cd1c1bb25c8a81b0b0a806edd7693d30407c03e0ddf8ed9fe7cedb0de0.exe
Resource
win10v2004-20230220-en
General
-
Target
822ed1cd1c1bb25c8a81b0b0a806edd7693d30407c03e0ddf8ed9fe7cedb0de0.exe
-
Size
544KB
-
MD5
b5285b009174662d6a6dec056b4c5970
-
SHA1
7d0943d44e36e88785629e62ccd310c2fb9b4efc
-
SHA256
822ed1cd1c1bb25c8a81b0b0a806edd7693d30407c03e0ddf8ed9fe7cedb0de0
-
SHA512
316e05663f018dd3ee64305465c7fa039b2950b00ba1112fa128ec025ce0a11666e6190ccb99629ca0b58169807ef876ca28d3f0306eb5f13dd1742d53d52af9
-
SSDEEP
12288:mMrYy90+bhyARfN0OjYuqgUZML4wMraZ/0NHPvvspqJm:ayvfndwMktxNvHspqA
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
real
193.233.20.31:4125
-
auth_value
bb22a50228754849387d5f4d1611e71b
Signatures
-
Processes:
pro3726.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro3726.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro3726.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro3726.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro3726.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro3726.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection pro3726.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/1260-158-0x00000000027A0000-0x00000000027DE000-memory.dmp family_redline behavioral1/memory/1260-159-0x00000000027A0000-0x00000000027DE000-memory.dmp family_redline behavioral1/memory/1260-161-0x00000000027A0000-0x00000000027DE000-memory.dmp family_redline behavioral1/memory/1260-163-0x00000000027A0000-0x00000000027DE000-memory.dmp family_redline behavioral1/memory/1260-165-0x00000000027A0000-0x00000000027DE000-memory.dmp family_redline behavioral1/memory/1260-167-0x00000000027A0000-0x00000000027DE000-memory.dmp family_redline behavioral1/memory/1260-169-0x00000000027A0000-0x00000000027DE000-memory.dmp family_redline behavioral1/memory/1260-171-0x00000000027A0000-0x00000000027DE000-memory.dmp family_redline behavioral1/memory/1260-173-0x00000000027A0000-0x00000000027DE000-memory.dmp family_redline behavioral1/memory/1260-175-0x00000000027A0000-0x00000000027DE000-memory.dmp family_redline behavioral1/memory/1260-177-0x00000000027A0000-0x00000000027DE000-memory.dmp family_redline behavioral1/memory/1260-179-0x00000000027A0000-0x00000000027DE000-memory.dmp family_redline behavioral1/memory/1260-181-0x00000000027A0000-0x00000000027DE000-memory.dmp family_redline behavioral1/memory/1260-183-0x00000000027A0000-0x00000000027DE000-memory.dmp family_redline behavioral1/memory/1260-185-0x00000000027A0000-0x00000000027DE000-memory.dmp family_redline behavioral1/memory/1260-187-0x00000000027A0000-0x00000000027DE000-memory.dmp family_redline behavioral1/memory/1260-189-0x00000000027A0000-0x00000000027DE000-memory.dmp family_redline behavioral1/memory/1260-191-0x00000000027A0000-0x00000000027DE000-memory.dmp family_redline behavioral1/memory/1260-193-0x00000000027A0000-0x00000000027DE000-memory.dmp family_redline behavioral1/memory/1260-195-0x00000000027A0000-0x00000000027DE000-memory.dmp family_redline behavioral1/memory/1260-197-0x00000000027A0000-0x00000000027DE000-memory.dmp family_redline behavioral1/memory/1260-199-0x00000000027A0000-0x00000000027DE000-memory.dmp family_redline behavioral1/memory/1260-201-0x00000000027A0000-0x00000000027DE000-memory.dmp family_redline behavioral1/memory/1260-203-0x00000000027A0000-0x00000000027DE000-memory.dmp family_redline behavioral1/memory/1260-205-0x00000000027A0000-0x00000000027DE000-memory.dmp family_redline behavioral1/memory/1260-207-0x00000000027A0000-0x00000000027DE000-memory.dmp family_redline behavioral1/memory/1260-209-0x00000000027A0000-0x00000000027DE000-memory.dmp family_redline behavioral1/memory/1260-213-0x00000000027A0000-0x00000000027DE000-memory.dmp family_redline behavioral1/memory/1260-211-0x00000000027A0000-0x00000000027DE000-memory.dmp family_redline behavioral1/memory/1260-215-0x00000000027A0000-0x00000000027DE000-memory.dmp family_redline behavioral1/memory/1260-217-0x00000000027A0000-0x00000000027DE000-memory.dmp family_redline behavioral1/memory/1260-219-0x00000000027A0000-0x00000000027DE000-memory.dmp family_redline behavioral1/memory/1260-221-0x00000000027A0000-0x00000000027DE000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
unio5158.exepro3726.exequ5745.exesi462170.exepid process 2368 unio5158.exe 1196 pro3726.exe 1260 qu5745.exe 544 si462170.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro3726.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" pro3726.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
unio5158.exe822ed1cd1c1bb25c8a81b0b0a806edd7693d30407c03e0ddf8ed9fe7cedb0de0.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" unio5158.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 822ed1cd1c1bb25c8a81b0b0a806edd7693d30407c03e0ddf8ed9fe7cedb0de0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 822ed1cd1c1bb25c8a81b0b0a806edd7693d30407c03e0ddf8ed9fe7cedb0de0.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce unio5158.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4860 1260 WerFault.exe qu5745.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro3726.exequ5745.exesi462170.exepid process 1196 pro3726.exe 1196 pro3726.exe 1260 qu5745.exe 1260 qu5745.exe 544 si462170.exe 544 si462170.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro3726.exequ5745.exesi462170.exedescription pid process Token: SeDebugPrivilege 1196 pro3726.exe Token: SeDebugPrivilege 1260 qu5745.exe Token: SeDebugPrivilege 544 si462170.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
822ed1cd1c1bb25c8a81b0b0a806edd7693d30407c03e0ddf8ed9fe7cedb0de0.exeunio5158.exedescription pid process target process PID 2104 wrote to memory of 2368 2104 822ed1cd1c1bb25c8a81b0b0a806edd7693d30407c03e0ddf8ed9fe7cedb0de0.exe unio5158.exe PID 2104 wrote to memory of 2368 2104 822ed1cd1c1bb25c8a81b0b0a806edd7693d30407c03e0ddf8ed9fe7cedb0de0.exe unio5158.exe PID 2104 wrote to memory of 2368 2104 822ed1cd1c1bb25c8a81b0b0a806edd7693d30407c03e0ddf8ed9fe7cedb0de0.exe unio5158.exe PID 2368 wrote to memory of 1196 2368 unio5158.exe pro3726.exe PID 2368 wrote to memory of 1196 2368 unio5158.exe pro3726.exe PID 2368 wrote to memory of 1260 2368 unio5158.exe qu5745.exe PID 2368 wrote to memory of 1260 2368 unio5158.exe qu5745.exe PID 2368 wrote to memory of 1260 2368 unio5158.exe qu5745.exe PID 2104 wrote to memory of 544 2104 822ed1cd1c1bb25c8a81b0b0a806edd7693d30407c03e0ddf8ed9fe7cedb0de0.exe si462170.exe PID 2104 wrote to memory of 544 2104 822ed1cd1c1bb25c8a81b0b0a806edd7693d30407c03e0ddf8ed9fe7cedb0de0.exe si462170.exe PID 2104 wrote to memory of 544 2104 822ed1cd1c1bb25c8a81b0b0a806edd7693d30407c03e0ddf8ed9fe7cedb0de0.exe si462170.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\822ed1cd1c1bb25c8a81b0b0a806edd7693d30407c03e0ddf8ed9fe7cedb0de0.exe"C:\Users\Admin\AppData\Local\Temp\822ed1cd1c1bb25c8a81b0b0a806edd7693d30407c03e0ddf8ed9fe7cedb0de0.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio5158.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio5158.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3726.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3726.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5745.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5745.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1260 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 19244⤵
- Program crash
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si462170.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si462170.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:544
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1260 -ip 12601⤵PID:688
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si462170.exeFilesize
175KB
MD541707338e1e2d868aa699ac0dd2e77b0
SHA136e0dfba09f9fb409faf0f9a99217d0d0c524b82
SHA2568d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557
SHA51280c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si462170.exeFilesize
175KB
MD541707338e1e2d868aa699ac0dd2e77b0
SHA136e0dfba09f9fb409faf0f9a99217d0d0c524b82
SHA2568d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557
SHA51280c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio5158.exeFilesize
402KB
MD568a38a4fd2bb0cf6a85500fe4b0a0b5f
SHA175d7838272067a84d68ff4d814ecd52693033b74
SHA2562fa890936d2264de0f81654caed43b1e7f5726bf1171c44515ce313ef9706eb6
SHA512a1b36e119767445842c4496b6cbe57f80b13c2aeef14e833ca960916be33bd9ee00b4ea9dd5ca347996e152316da4f5680c981c16dee5e9f6536bd14c74ddeb8
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio5158.exeFilesize
402KB
MD568a38a4fd2bb0cf6a85500fe4b0a0b5f
SHA175d7838272067a84d68ff4d814ecd52693033b74
SHA2562fa890936d2264de0f81654caed43b1e7f5726bf1171c44515ce313ef9706eb6
SHA512a1b36e119767445842c4496b6cbe57f80b13c2aeef14e833ca960916be33bd9ee00b4ea9dd5ca347996e152316da4f5680c981c16dee5e9f6536bd14c74ddeb8
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3726.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3726.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5745.exeFilesize
349KB
MD5cfa3e08132df309f9fdf2522a51fe7ef
SHA162968a446c2aa89652044b8ac69680b4cd1a232b
SHA256939deb061567e7946cd0b7f5dac712313600f941d7dde9f3e9dc2051d7ac2504
SHA512635a40b0099946a9994113777f0b93aa82d8c4884b1f969149a9ca5ecd317e5134e01b2ff333a2fa6e2fba2acc4fab9e9eeee90fb10c84ffc862f90662198c6a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5745.exeFilesize
349KB
MD5cfa3e08132df309f9fdf2522a51fe7ef
SHA162968a446c2aa89652044b8ac69680b4cd1a232b
SHA256939deb061567e7946cd0b7f5dac712313600f941d7dde9f3e9dc2051d7ac2504
SHA512635a40b0099946a9994113777f0b93aa82d8c4884b1f969149a9ca5ecd317e5134e01b2ff333a2fa6e2fba2acc4fab9e9eeee90fb10c84ffc862f90662198c6a
-
memory/544-1084-0x00000000008F0000-0x0000000000922000-memory.dmpFilesize
200KB
-
memory/544-1085-0x0000000005480000-0x0000000005490000-memory.dmpFilesize
64KB
-
memory/1196-147-0x00000000008B0000-0x00000000008BA000-memory.dmpFilesize
40KB
-
memory/1260-187-0x00000000027A0000-0x00000000027DE000-memory.dmpFilesize
248KB
-
memory/1260-199-0x00000000027A0000-0x00000000027DE000-memory.dmpFilesize
248KB
-
memory/1260-155-0x0000000004EB0000-0x0000000004EC0000-memory.dmpFilesize
64KB
-
memory/1260-157-0x0000000004EB0000-0x0000000004EC0000-memory.dmpFilesize
64KB
-
memory/1260-158-0x00000000027A0000-0x00000000027DE000-memory.dmpFilesize
248KB
-
memory/1260-159-0x00000000027A0000-0x00000000027DE000-memory.dmpFilesize
248KB
-
memory/1260-161-0x00000000027A0000-0x00000000027DE000-memory.dmpFilesize
248KB
-
memory/1260-163-0x00000000027A0000-0x00000000027DE000-memory.dmpFilesize
248KB
-
memory/1260-165-0x00000000027A0000-0x00000000027DE000-memory.dmpFilesize
248KB
-
memory/1260-167-0x00000000027A0000-0x00000000027DE000-memory.dmpFilesize
248KB
-
memory/1260-169-0x00000000027A0000-0x00000000027DE000-memory.dmpFilesize
248KB
-
memory/1260-171-0x00000000027A0000-0x00000000027DE000-memory.dmpFilesize
248KB
-
memory/1260-173-0x00000000027A0000-0x00000000027DE000-memory.dmpFilesize
248KB
-
memory/1260-175-0x00000000027A0000-0x00000000027DE000-memory.dmpFilesize
248KB
-
memory/1260-177-0x00000000027A0000-0x00000000027DE000-memory.dmpFilesize
248KB
-
memory/1260-179-0x00000000027A0000-0x00000000027DE000-memory.dmpFilesize
248KB
-
memory/1260-181-0x00000000027A0000-0x00000000027DE000-memory.dmpFilesize
248KB
-
memory/1260-183-0x00000000027A0000-0x00000000027DE000-memory.dmpFilesize
248KB
-
memory/1260-185-0x00000000027A0000-0x00000000027DE000-memory.dmpFilesize
248KB
-
memory/1260-154-0x0000000002260000-0x00000000022AB000-memory.dmpFilesize
300KB
-
memory/1260-189-0x00000000027A0000-0x00000000027DE000-memory.dmpFilesize
248KB
-
memory/1260-191-0x00000000027A0000-0x00000000027DE000-memory.dmpFilesize
248KB
-
memory/1260-193-0x00000000027A0000-0x00000000027DE000-memory.dmpFilesize
248KB
-
memory/1260-195-0x00000000027A0000-0x00000000027DE000-memory.dmpFilesize
248KB
-
memory/1260-197-0x00000000027A0000-0x00000000027DE000-memory.dmpFilesize
248KB
-
memory/1260-156-0x0000000004EB0000-0x0000000004EC0000-memory.dmpFilesize
64KB
-
memory/1260-201-0x00000000027A0000-0x00000000027DE000-memory.dmpFilesize
248KB
-
memory/1260-203-0x00000000027A0000-0x00000000027DE000-memory.dmpFilesize
248KB
-
memory/1260-205-0x00000000027A0000-0x00000000027DE000-memory.dmpFilesize
248KB
-
memory/1260-207-0x00000000027A0000-0x00000000027DE000-memory.dmpFilesize
248KB
-
memory/1260-209-0x00000000027A0000-0x00000000027DE000-memory.dmpFilesize
248KB
-
memory/1260-213-0x00000000027A0000-0x00000000027DE000-memory.dmpFilesize
248KB
-
memory/1260-211-0x00000000027A0000-0x00000000027DE000-memory.dmpFilesize
248KB
-
memory/1260-215-0x00000000027A0000-0x00000000027DE000-memory.dmpFilesize
248KB
-
memory/1260-217-0x00000000027A0000-0x00000000027DE000-memory.dmpFilesize
248KB
-
memory/1260-219-0x00000000027A0000-0x00000000027DE000-memory.dmpFilesize
248KB
-
memory/1260-221-0x00000000027A0000-0x00000000027DE000-memory.dmpFilesize
248KB
-
memory/1260-1064-0x0000000005570000-0x0000000005B88000-memory.dmpFilesize
6.1MB
-
memory/1260-1065-0x0000000005B90000-0x0000000005C9A000-memory.dmpFilesize
1.0MB
-
memory/1260-1066-0x0000000004E50000-0x0000000004E62000-memory.dmpFilesize
72KB
-
memory/1260-1067-0x0000000004E70000-0x0000000004EAC000-memory.dmpFilesize
240KB
-
memory/1260-1068-0x0000000004EB0000-0x0000000004EC0000-memory.dmpFilesize
64KB
-
memory/1260-1070-0x0000000005F50000-0x0000000005FE2000-memory.dmpFilesize
584KB
-
memory/1260-1071-0x0000000005FF0000-0x0000000006056000-memory.dmpFilesize
408KB
-
memory/1260-1072-0x0000000004EB0000-0x0000000004EC0000-memory.dmpFilesize
64KB
-
memory/1260-1073-0x0000000004EB0000-0x0000000004EC0000-memory.dmpFilesize
64KB
-
memory/1260-1074-0x0000000004EB0000-0x0000000004EC0000-memory.dmpFilesize
64KB
-
memory/1260-1075-0x0000000007AC0000-0x0000000007C82000-memory.dmpFilesize
1.8MB
-
memory/1260-153-0x0000000004EC0000-0x0000000005464000-memory.dmpFilesize
5.6MB
-
memory/1260-1076-0x0000000007CE0000-0x000000000820C000-memory.dmpFilesize
5.2MB
-
memory/1260-1077-0x0000000002600000-0x0000000002676000-memory.dmpFilesize
472KB
-
memory/1260-1078-0x0000000008500000-0x0000000008550000-memory.dmpFilesize
320KB