Analysis
-
max time kernel
142s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
24-03-2023 22:45
Static task
static1
Behavioral task
behavioral1
Sample
d0ff6bcf8114ae79ca478abd15ec7fdc682b81b57cafc7e534a24a531ced084f.exe
Resource
win10v2004-20230220-en
General
-
Target
d0ff6bcf8114ae79ca478abd15ec7fdc682b81b57cafc7e534a24a531ced084f.exe
-
Size
556KB
-
MD5
05b8b76539012d1d6fcc06283722ca7d
-
SHA1
941c14efb343c11cf15c0ab0797a404598a684c1
-
SHA256
d0ff6bcf8114ae79ca478abd15ec7fdc682b81b57cafc7e534a24a531ced084f
-
SHA512
a2cf2a3a9a022112de1d4e4da740f57d4f044d458bc2bc7809bea106accc1a428e3b1b19c1ba7276060fb39fa7c6ce79e1981c1e7bbf684beeda9a538d9121b9
-
SSDEEP
12288:+Mrmy90Q1LvmRlzr5Fo9NqgH3HL2FpgOf:EyledFgqOHegS
Malware Config
Extracted
redline
boris
193.233.20.32:4125
-
auth_value
766b5bdf6dbefcf7ca223351952fc38f
Extracted
redline
lida
193.233.20.32:4125
-
auth_value
24052aa2e9b85984a98d80cf08623e8d
Signatures
-
Processes:
h74Rn68.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" h74Rn68.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" h74Rn68.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" h74Rn68.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" h74Rn68.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" h74Rn68.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection h74Rn68.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/4392-157-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/4392-158-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/4392-160-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/4392-162-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/4392-164-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/4392-166-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/4392-168-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/4392-170-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/4392-172-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/4392-174-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/4392-180-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/4392-186-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/4392-184-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/4392-182-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/4392-190-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/4392-188-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/4392-178-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/4392-192-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/4392-176-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/4392-194-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/4392-196-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/4392-199-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/4392-203-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/4392-211-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/4392-215-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/4392-213-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/4392-209-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/4392-207-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/4392-221-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/4392-219-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/4392-217-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/4392-205-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/4392-201-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
niba5863.exeh74Rn68.exeiyrta47.exel51YS84.exepid process 4908 niba5863.exe 5044 h74Rn68.exe 4392 iyrta47.exe 2380 l51YS84.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
h74Rn68.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" h74Rn68.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
d0ff6bcf8114ae79ca478abd15ec7fdc682b81b57cafc7e534a24a531ced084f.exeniba5863.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce d0ff6bcf8114ae79ca478abd15ec7fdc682b81b57cafc7e534a24a531ced084f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" d0ff6bcf8114ae79ca478abd15ec7fdc682b81b57cafc7e534a24a531ced084f.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce niba5863.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" niba5863.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3892 4392 WerFault.exe iyrta47.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
h74Rn68.exeiyrta47.exel51YS84.exepid process 5044 h74Rn68.exe 5044 h74Rn68.exe 4392 iyrta47.exe 4392 iyrta47.exe 2380 l51YS84.exe 2380 l51YS84.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
h74Rn68.exeiyrta47.exel51YS84.exedescription pid process Token: SeDebugPrivilege 5044 h74Rn68.exe Token: SeDebugPrivilege 4392 iyrta47.exe Token: SeDebugPrivilege 2380 l51YS84.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
d0ff6bcf8114ae79ca478abd15ec7fdc682b81b57cafc7e534a24a531ced084f.exeniba5863.exedescription pid process target process PID 2704 wrote to memory of 4908 2704 d0ff6bcf8114ae79ca478abd15ec7fdc682b81b57cafc7e534a24a531ced084f.exe niba5863.exe PID 2704 wrote to memory of 4908 2704 d0ff6bcf8114ae79ca478abd15ec7fdc682b81b57cafc7e534a24a531ced084f.exe niba5863.exe PID 2704 wrote to memory of 4908 2704 d0ff6bcf8114ae79ca478abd15ec7fdc682b81b57cafc7e534a24a531ced084f.exe niba5863.exe PID 4908 wrote to memory of 5044 4908 niba5863.exe h74Rn68.exe PID 4908 wrote to memory of 5044 4908 niba5863.exe h74Rn68.exe PID 4908 wrote to memory of 4392 4908 niba5863.exe iyrta47.exe PID 4908 wrote to memory of 4392 4908 niba5863.exe iyrta47.exe PID 4908 wrote to memory of 4392 4908 niba5863.exe iyrta47.exe PID 2704 wrote to memory of 2380 2704 d0ff6bcf8114ae79ca478abd15ec7fdc682b81b57cafc7e534a24a531ced084f.exe l51YS84.exe PID 2704 wrote to memory of 2380 2704 d0ff6bcf8114ae79ca478abd15ec7fdc682b81b57cafc7e534a24a531ced084f.exe l51YS84.exe PID 2704 wrote to memory of 2380 2704 d0ff6bcf8114ae79ca478abd15ec7fdc682b81b57cafc7e534a24a531ced084f.exe l51YS84.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0ff6bcf8114ae79ca478abd15ec7fdc682b81b57cafc7e534a24a531ced084f.exe"C:\Users\Admin\AppData\Local\Temp\d0ff6bcf8114ae79ca478abd15ec7fdc682b81b57cafc7e534a24a531ced084f.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba5863.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba5863.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h74Rn68.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h74Rn68.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iyrta47.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iyrta47.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4392 -s 13364⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l51YS84.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l51YS84.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4392 -ip 43921⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l51YS84.exeFilesize
175KB
MD56b06147bf5fd26306978a93fe83127a4
SHA17b14ff42f4441b985591ef5b7d4cc703f0bbcdfa
SHA25611e6d45ae92fc4505f14f550d01d97a42fba91a999b900daf843251772c755e0
SHA512603007d99e52da5739040fee891c193123dc5741985de1c3dde091dd07e759336ec749312e4ab95d05c1c6681f10e56b4e9aee67d633a97b6aa25c5119f4d6b4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l51YS84.exeFilesize
175KB
MD56b06147bf5fd26306978a93fe83127a4
SHA17b14ff42f4441b985591ef5b7d4cc703f0bbcdfa
SHA25611e6d45ae92fc4505f14f550d01d97a42fba91a999b900daf843251772c755e0
SHA512603007d99e52da5739040fee891c193123dc5741985de1c3dde091dd07e759336ec749312e4ab95d05c1c6681f10e56b4e9aee67d633a97b6aa25c5119f4d6b4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba5863.exeFilesize
414KB
MD5de2fcbe7d66018b8ac67842110400c3c
SHA1f8d03444a2c08927cdf5652e2d1b2516a6b9c962
SHA256bd936b2098f0325803d2813a843f858dfb2dc4e623056036cb2e19ee528cfabf
SHA512137ecd6403cb8cd3abf5c65f7d7cbc5ba912ee0efc82ed99075c7c84c18a67a361a7a8600139a88929d3ae3ee41af6a1c5266d93935fbe988716b987df3a2430
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba5863.exeFilesize
414KB
MD5de2fcbe7d66018b8ac67842110400c3c
SHA1f8d03444a2c08927cdf5652e2d1b2516a6b9c962
SHA256bd936b2098f0325803d2813a843f858dfb2dc4e623056036cb2e19ee528cfabf
SHA512137ecd6403cb8cd3abf5c65f7d7cbc5ba912ee0efc82ed99075c7c84c18a67a361a7a8600139a88929d3ae3ee41af6a1c5266d93935fbe988716b987df3a2430
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h74Rn68.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h74Rn68.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iyrta47.exeFilesize
387KB
MD5756078bca8450fb9d1e06ce04d0f79f3
SHA1dfb969ebb4f5a94fd476a138939a0d790c29f6b8
SHA256855639a98de2e9204cba6a6c0196f762cc1a29888b4c0e314284a23aa9be457f
SHA5122fbdc410d8a9c14eb8d54fd1d8c86b8940670415aeadf267f2400247c60007be71e9beb13a5d10fb2e4283905e205abed78456e03c6c3f716b02baef30b5b941
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iyrta47.exeFilesize
387KB
MD5756078bca8450fb9d1e06ce04d0f79f3
SHA1dfb969ebb4f5a94fd476a138939a0d790c29f6b8
SHA256855639a98de2e9204cba6a6c0196f762cc1a29888b4c0e314284a23aa9be457f
SHA5122fbdc410d8a9c14eb8d54fd1d8c86b8940670415aeadf267f2400247c60007be71e9beb13a5d10fb2e4283905e205abed78456e03c6c3f716b02baef30b5b941
-
memory/2380-1086-0x0000000000800000-0x0000000000832000-memory.dmpFilesize
200KB
-
memory/2380-1087-0x00000000050A0000-0x00000000050B0000-memory.dmpFilesize
64KB
-
memory/4392-176-0x0000000004E20000-0x0000000004E5F000-memory.dmpFilesize
252KB
-
memory/4392-203-0x0000000004E20000-0x0000000004E5F000-memory.dmpFilesize
252KB
-
memory/4392-155-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/4392-156-0x0000000007480000-0x0000000007A24000-memory.dmpFilesize
5.6MB
-
memory/4392-157-0x0000000004E20000-0x0000000004E5F000-memory.dmpFilesize
252KB
-
memory/4392-158-0x0000000004E20000-0x0000000004E5F000-memory.dmpFilesize
252KB
-
memory/4392-160-0x0000000004E20000-0x0000000004E5F000-memory.dmpFilesize
252KB
-
memory/4392-162-0x0000000004E20000-0x0000000004E5F000-memory.dmpFilesize
252KB
-
memory/4392-164-0x0000000004E20000-0x0000000004E5F000-memory.dmpFilesize
252KB
-
memory/4392-166-0x0000000004E20000-0x0000000004E5F000-memory.dmpFilesize
252KB
-
memory/4392-168-0x0000000004E20000-0x0000000004E5F000-memory.dmpFilesize
252KB
-
memory/4392-170-0x0000000004E20000-0x0000000004E5F000-memory.dmpFilesize
252KB
-
memory/4392-172-0x0000000004E20000-0x0000000004E5F000-memory.dmpFilesize
252KB
-
memory/4392-174-0x0000000004E20000-0x0000000004E5F000-memory.dmpFilesize
252KB
-
memory/4392-180-0x0000000004E20000-0x0000000004E5F000-memory.dmpFilesize
252KB
-
memory/4392-186-0x0000000004E20000-0x0000000004E5F000-memory.dmpFilesize
252KB
-
memory/4392-184-0x0000000004E20000-0x0000000004E5F000-memory.dmpFilesize
252KB
-
memory/4392-182-0x0000000004E20000-0x0000000004E5F000-memory.dmpFilesize
252KB
-
memory/4392-190-0x0000000004E20000-0x0000000004E5F000-memory.dmpFilesize
252KB
-
memory/4392-188-0x0000000004E20000-0x0000000004E5F000-memory.dmpFilesize
252KB
-
memory/4392-178-0x0000000004E20000-0x0000000004E5F000-memory.dmpFilesize
252KB
-
memory/4392-192-0x0000000004E20000-0x0000000004E5F000-memory.dmpFilesize
252KB
-
memory/4392-153-0x0000000002B90000-0x0000000002BDB000-memory.dmpFilesize
300KB
-
memory/4392-194-0x0000000004E20000-0x0000000004E5F000-memory.dmpFilesize
252KB
-
memory/4392-196-0x0000000004E20000-0x0000000004E5F000-memory.dmpFilesize
252KB
-
memory/4392-197-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/4392-199-0x0000000004E20000-0x0000000004E5F000-memory.dmpFilesize
252KB
-
memory/4392-154-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/4392-211-0x0000000004E20000-0x0000000004E5F000-memory.dmpFilesize
252KB
-
memory/4392-215-0x0000000004E20000-0x0000000004E5F000-memory.dmpFilesize
252KB
-
memory/4392-213-0x0000000004E20000-0x0000000004E5F000-memory.dmpFilesize
252KB
-
memory/4392-209-0x0000000004E20000-0x0000000004E5F000-memory.dmpFilesize
252KB
-
memory/4392-207-0x0000000004E20000-0x0000000004E5F000-memory.dmpFilesize
252KB
-
memory/4392-221-0x0000000004E20000-0x0000000004E5F000-memory.dmpFilesize
252KB
-
memory/4392-219-0x0000000004E20000-0x0000000004E5F000-memory.dmpFilesize
252KB
-
memory/4392-217-0x0000000004E20000-0x0000000004E5F000-memory.dmpFilesize
252KB
-
memory/4392-205-0x0000000004E20000-0x0000000004E5F000-memory.dmpFilesize
252KB
-
memory/4392-201-0x0000000004E20000-0x0000000004E5F000-memory.dmpFilesize
252KB
-
memory/4392-1064-0x0000000007A30000-0x0000000008048000-memory.dmpFilesize
6.1MB
-
memory/4392-1065-0x0000000008050000-0x000000000815A000-memory.dmpFilesize
1.0MB
-
memory/4392-1066-0x00000000073C0000-0x00000000073D2000-memory.dmpFilesize
72KB
-
memory/4392-1067-0x00000000073E0000-0x000000000741C000-memory.dmpFilesize
240KB
-
memory/4392-1068-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/4392-1070-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/4392-1071-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/4392-1072-0x00000000083C0000-0x0000000008452000-memory.dmpFilesize
584KB
-
memory/4392-1073-0x0000000008460000-0x00000000084C6000-memory.dmpFilesize
408KB
-
memory/4392-1074-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/4392-1075-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/4392-1076-0x0000000009F50000-0x000000000A112000-memory.dmpFilesize
1.8MB
-
memory/4392-1077-0x000000000A120000-0x000000000A64C000-memory.dmpFilesize
5.2MB
-
memory/4392-1078-0x0000000004D30000-0x0000000004DA6000-memory.dmpFilesize
472KB
-
memory/4392-1079-0x000000000A770000-0x000000000A7C0000-memory.dmpFilesize
320KB
-
memory/5044-147-0x0000000000CE0000-0x0000000000CEA000-memory.dmpFilesize
40KB