Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
24-03-2023 00:09
Static task
static1
Behavioral task
behavioral1
Sample
3452dbeabc0efb9eb6af590bd0d2e2a33c1488cda2037e0ee288f9434a84ab05.exe
Resource
win10v2004-20230221-en
General
-
Target
3452dbeabc0efb9eb6af590bd0d2e2a33c1488cda2037e0ee288f9434a84ab05.exe
-
Size
546KB
-
MD5
0c02fae05c764b09ab7934bfb7d3a0d6
-
SHA1
530ae387f98e628bde6c0d084f0905c6d76eed8b
-
SHA256
3452dbeabc0efb9eb6af590bd0d2e2a33c1488cda2037e0ee288f9434a84ab05
-
SHA512
1c28bbd5eff08a6ebdbb7f72e7a2cf6b24eee925cfab487b86c5f17cc196337b7b49206eb8abd3ddcfbc6c6694c2c0694f6a5afb67382a983c9926b90cca0f3f
-
SSDEEP
12288:AMrXy90kgmkg7B+XDIdOJTYstiwLPlE7ZqnBu/KV:nyJlGNxW7ZMSKV
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
real
193.233.20.31:4125
-
auth_value
bb22a50228754849387d5f4d1611e71b
Signatures
-
Processes:
pro1103.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection pro1103.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro1103.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro1103.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro1103.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro1103.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro1103.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/4504-156-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4504-157-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4504-159-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4504-161-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4504-163-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4504-165-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4504-167-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4504-169-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4504-171-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4504-173-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4504-175-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4504-177-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4504-184-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4504-186-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4504-188-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4504-190-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4504-180-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4504-192-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4504-194-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4504-196-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4504-198-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4504-200-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4504-206-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4504-204-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4504-202-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4504-208-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4504-210-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4504-212-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4504-214-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4504-216-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4504-218-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4504-220-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4504-222-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
unio2490.exepro1103.exequ7503.exesi525493.exepid process 4176 unio2490.exe 636 pro1103.exe 4504 qu7503.exe 796 si525493.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro1103.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" pro1103.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
3452dbeabc0efb9eb6af590bd0d2e2a33c1488cda2037e0ee288f9434a84ab05.exeunio2490.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 3452dbeabc0efb9eb6af590bd0d2e2a33c1488cda2037e0ee288f9434a84ab05.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce unio2490.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" unio2490.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 3452dbeabc0efb9eb6af590bd0d2e2a33c1488cda2037e0ee288f9434a84ab05.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4904 4504 WerFault.exe qu7503.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro1103.exequ7503.exesi525493.exepid process 636 pro1103.exe 636 pro1103.exe 4504 qu7503.exe 4504 qu7503.exe 796 si525493.exe 796 si525493.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro1103.exequ7503.exesi525493.exedescription pid process Token: SeDebugPrivilege 636 pro1103.exe Token: SeDebugPrivilege 4504 qu7503.exe Token: SeDebugPrivilege 796 si525493.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
3452dbeabc0efb9eb6af590bd0d2e2a33c1488cda2037e0ee288f9434a84ab05.exeunio2490.exedescription pid process target process PID 1032 wrote to memory of 4176 1032 3452dbeabc0efb9eb6af590bd0d2e2a33c1488cda2037e0ee288f9434a84ab05.exe unio2490.exe PID 1032 wrote to memory of 4176 1032 3452dbeabc0efb9eb6af590bd0d2e2a33c1488cda2037e0ee288f9434a84ab05.exe unio2490.exe PID 1032 wrote to memory of 4176 1032 3452dbeabc0efb9eb6af590bd0d2e2a33c1488cda2037e0ee288f9434a84ab05.exe unio2490.exe PID 4176 wrote to memory of 636 4176 unio2490.exe pro1103.exe PID 4176 wrote to memory of 636 4176 unio2490.exe pro1103.exe PID 4176 wrote to memory of 4504 4176 unio2490.exe qu7503.exe PID 4176 wrote to memory of 4504 4176 unio2490.exe qu7503.exe PID 4176 wrote to memory of 4504 4176 unio2490.exe qu7503.exe PID 1032 wrote to memory of 796 1032 3452dbeabc0efb9eb6af590bd0d2e2a33c1488cda2037e0ee288f9434a84ab05.exe si525493.exe PID 1032 wrote to memory of 796 1032 3452dbeabc0efb9eb6af590bd0d2e2a33c1488cda2037e0ee288f9434a84ab05.exe si525493.exe PID 1032 wrote to memory of 796 1032 3452dbeabc0efb9eb6af590bd0d2e2a33c1488cda2037e0ee288f9434a84ab05.exe si525493.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3452dbeabc0efb9eb6af590bd0d2e2a33c1488cda2037e0ee288f9434a84ab05.exe"C:\Users\Admin\AppData\Local\Temp\3452dbeabc0efb9eb6af590bd0d2e2a33c1488cda2037e0ee288f9434a84ab05.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio2490.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio2490.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1103.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1103.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:636 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7503.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7503.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4504 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 13404⤵
- Program crash
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si525493.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si525493.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:796
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4504 -ip 45041⤵PID:768
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si525493.exeFilesize
175KB
MD541707338e1e2d868aa699ac0dd2e77b0
SHA136e0dfba09f9fb409faf0f9a99217d0d0c524b82
SHA2568d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557
SHA51280c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si525493.exeFilesize
175KB
MD541707338e1e2d868aa699ac0dd2e77b0
SHA136e0dfba09f9fb409faf0f9a99217d0d0c524b82
SHA2568d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557
SHA51280c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio2490.exeFilesize
404KB
MD590b46a809af3f808124eed6be84f584a
SHA123520bb51e862f036d3e1140b4c96622d208a8dc
SHA256a37c7855bf01ba5397533a5b07f74ae6b521939cb3df030280d05dac6e62a1d8
SHA512e4c9e4b6d8b2862ca7a9e8667354896e2d3ba35eea87bcd19272e0fc6d5b58bcc7a9b2da8c95d95ce858474c75a0a2661d261267be2c9fa217b3feaa7f41df3d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio2490.exeFilesize
404KB
MD590b46a809af3f808124eed6be84f584a
SHA123520bb51e862f036d3e1140b4c96622d208a8dc
SHA256a37c7855bf01ba5397533a5b07f74ae6b521939cb3df030280d05dac6e62a1d8
SHA512e4c9e4b6d8b2862ca7a9e8667354896e2d3ba35eea87bcd19272e0fc6d5b58bcc7a9b2da8c95d95ce858474c75a0a2661d261267be2c9fa217b3feaa7f41df3d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1103.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1103.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7503.exeFilesize
358KB
MD5edf76bbe8305b0faacef511f2625dae9
SHA1d021b6236fb23eafe2eda3d1f7db391fc9703dee
SHA256c5e13603fc982e4b376d64303d60c772b717176a776494c0d6b124e3e5862e71
SHA5123a0bd371a00c8e8dbe352bf126f3c6a67ba90ffd5f4ff6edaa394554a77f37c6395ac875dcbf5ebf40496ba002d3d57121c9c1c9e5736467406c6a20d4733368
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7503.exeFilesize
358KB
MD5edf76bbe8305b0faacef511f2625dae9
SHA1d021b6236fb23eafe2eda3d1f7db391fc9703dee
SHA256c5e13603fc982e4b376d64303d60c772b717176a776494c0d6b124e3e5862e71
SHA5123a0bd371a00c8e8dbe352bf126f3c6a67ba90ffd5f4ff6edaa394554a77f37c6395ac875dcbf5ebf40496ba002d3d57121c9c1c9e5736467406c6a20d4733368
-
memory/636-148-0x0000000000670000-0x000000000067A000-memory.dmpFilesize
40KB
-
memory/796-1087-0x0000000000B90000-0x0000000000BC2000-memory.dmpFilesize
200KB
-
memory/796-1088-0x00000000054E0000-0x00000000054F0000-memory.dmpFilesize
64KB
-
memory/4504-180-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4504-206-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4504-156-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4504-157-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4504-159-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4504-161-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4504-163-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4504-165-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4504-167-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4504-169-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4504-171-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4504-173-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4504-175-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4504-177-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4504-179-0x0000000004F60000-0x0000000004F70000-memory.dmpFilesize
64KB
-
memory/4504-181-0x0000000004F60000-0x0000000004F70000-memory.dmpFilesize
64KB
-
memory/4504-184-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4504-186-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4504-188-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4504-190-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4504-182-0x0000000004F60000-0x0000000004F70000-memory.dmpFilesize
64KB
-
memory/4504-154-0x00000000008A0000-0x00000000008EB000-memory.dmpFilesize
300KB
-
memory/4504-192-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4504-194-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4504-196-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4504-198-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4504-200-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4504-155-0x0000000004F70000-0x0000000005514000-memory.dmpFilesize
5.6MB
-
memory/4504-204-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4504-202-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4504-208-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4504-210-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4504-212-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4504-214-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4504-216-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4504-218-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4504-220-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4504-222-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4504-1065-0x0000000005520000-0x0000000005B38000-memory.dmpFilesize
6.1MB
-
memory/4504-1066-0x0000000005B40000-0x0000000005C4A000-memory.dmpFilesize
1.0MB
-
memory/4504-1067-0x0000000005C50000-0x0000000005C62000-memory.dmpFilesize
72KB
-
memory/4504-1068-0x0000000004F60000-0x0000000004F70000-memory.dmpFilesize
64KB
-
memory/4504-1069-0x0000000005C70000-0x0000000005CAC000-memory.dmpFilesize
240KB
-
memory/4504-1071-0x0000000005F50000-0x0000000005FE2000-memory.dmpFilesize
584KB
-
memory/4504-1072-0x0000000005FF0000-0x0000000006056000-memory.dmpFilesize
408KB
-
memory/4504-1073-0x0000000004F60000-0x0000000004F70000-memory.dmpFilesize
64KB
-
memory/4504-1074-0x0000000004F60000-0x0000000004F70000-memory.dmpFilesize
64KB
-
memory/4504-1075-0x0000000004F60000-0x0000000004F70000-memory.dmpFilesize
64KB
-
memory/4504-1076-0x0000000004F60000-0x0000000004F70000-memory.dmpFilesize
64KB
-
memory/4504-1077-0x0000000006710000-0x00000000068D2000-memory.dmpFilesize
1.8MB
-
memory/4504-1078-0x00000000068F0000-0x0000000006E1C000-memory.dmpFilesize
5.2MB
-
memory/4504-1079-0x00000000071B0000-0x0000000007226000-memory.dmpFilesize
472KB
-
memory/4504-1080-0x0000000007230000-0x0000000007280000-memory.dmpFilesize
320KB