Analysis
-
max time kernel
114s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
24-03-2023 00:11
Static task
static1
Behavioral task
behavioral1
Sample
27d88c8cb7a0de490f31df142b7e9fe4e11fc3c90eef397f924bdcf6793794c0.exe
Resource
win10v2004-20230220-en
General
-
Target
27d88c8cb7a0de490f31df142b7e9fe4e11fc3c90eef397f924bdcf6793794c0.exe
-
Size
546KB
-
MD5
d56efaff2482283da4a66d89f863a2cc
-
SHA1
13e374131f7f22d615dbe826165c43166049c34e
-
SHA256
27d88c8cb7a0de490f31df142b7e9fe4e11fc3c90eef397f924bdcf6793794c0
-
SHA512
d2863de247c14adf8603937ff89998c6e9ad5b9c62eb018fb6234e6cf0491f5b58445243b762aff1e01cb9070a8487c0b572ca3d672cae81cbee06be1c497c00
-
SSDEEP
12288:wMrIy90aoemQIOsclIqp4estqwLEwJYq1+j:oy/tmaKu4jxELC+j
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
real
193.233.20.31:4125
-
auth_value
bb22a50228754849387d5f4d1611e71b
Signatures
-
Processes:
pro9135.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro9135.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro9135.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro9135.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection pro9135.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro9135.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro9135.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 34 IoCs
Processes:
resource yara_rule behavioral1/memory/2016-155-0x00000000053C0000-0x00000000053FE000-memory.dmp family_redline behavioral1/memory/2016-156-0x00000000053C0000-0x00000000053FE000-memory.dmp family_redline behavioral1/memory/2016-158-0x00000000053C0000-0x00000000053FE000-memory.dmp family_redline behavioral1/memory/2016-160-0x00000000053C0000-0x00000000053FE000-memory.dmp family_redline behavioral1/memory/2016-162-0x00000000053C0000-0x00000000053FE000-memory.dmp family_redline behavioral1/memory/2016-164-0x00000000053C0000-0x00000000053FE000-memory.dmp family_redline behavioral1/memory/2016-166-0x00000000053C0000-0x00000000053FE000-memory.dmp family_redline behavioral1/memory/2016-168-0x00000000053C0000-0x00000000053FE000-memory.dmp family_redline behavioral1/memory/2016-170-0x00000000053C0000-0x00000000053FE000-memory.dmp family_redline behavioral1/memory/2016-172-0x00000000053C0000-0x00000000053FE000-memory.dmp family_redline behavioral1/memory/2016-174-0x00000000053C0000-0x00000000053FE000-memory.dmp family_redline behavioral1/memory/2016-176-0x00000000053C0000-0x00000000053FE000-memory.dmp family_redline behavioral1/memory/2016-178-0x00000000053C0000-0x00000000053FE000-memory.dmp family_redline behavioral1/memory/2016-180-0x00000000053C0000-0x00000000053FE000-memory.dmp family_redline behavioral1/memory/2016-183-0x00000000053C0000-0x00000000053FE000-memory.dmp family_redline behavioral1/memory/2016-187-0x00000000053C0000-0x00000000053FE000-memory.dmp family_redline behavioral1/memory/2016-189-0x00000000053C0000-0x00000000053FE000-memory.dmp family_redline behavioral1/memory/2016-191-0x00000000053C0000-0x00000000053FE000-memory.dmp family_redline behavioral1/memory/2016-193-0x00000000053C0000-0x00000000053FE000-memory.dmp family_redline behavioral1/memory/2016-195-0x00000000053C0000-0x00000000053FE000-memory.dmp family_redline behavioral1/memory/2016-197-0x00000000053C0000-0x00000000053FE000-memory.dmp family_redline behavioral1/memory/2016-199-0x00000000053C0000-0x00000000053FE000-memory.dmp family_redline behavioral1/memory/2016-201-0x00000000053C0000-0x00000000053FE000-memory.dmp family_redline behavioral1/memory/2016-203-0x00000000053C0000-0x00000000053FE000-memory.dmp family_redline behavioral1/memory/2016-205-0x00000000053C0000-0x00000000053FE000-memory.dmp family_redline behavioral1/memory/2016-207-0x00000000053C0000-0x00000000053FE000-memory.dmp family_redline behavioral1/memory/2016-211-0x00000000053C0000-0x00000000053FE000-memory.dmp family_redline behavioral1/memory/2016-209-0x00000000053C0000-0x00000000053FE000-memory.dmp family_redline behavioral1/memory/2016-213-0x00000000053C0000-0x00000000053FE000-memory.dmp family_redline behavioral1/memory/2016-215-0x00000000053C0000-0x00000000053FE000-memory.dmp family_redline behavioral1/memory/2016-217-0x00000000053C0000-0x00000000053FE000-memory.dmp family_redline behavioral1/memory/2016-219-0x00000000053C0000-0x00000000053FE000-memory.dmp family_redline behavioral1/memory/2016-221-0x00000000053C0000-0x00000000053FE000-memory.dmp family_redline behavioral1/memory/2016-1073-0x0000000004DC0000-0x0000000004DD0000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
unio0114.exepro9135.exequ9165.exesi594161.exepid process 2012 unio0114.exe 4780 pro9135.exe 2016 qu9165.exe 3100 si594161.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro9135.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" pro9135.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
27d88c8cb7a0de490f31df142b7e9fe4e11fc3c90eef397f924bdcf6793794c0.exeunio0114.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 27d88c8cb7a0de490f31df142b7e9fe4e11fc3c90eef397f924bdcf6793794c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 27d88c8cb7a0de490f31df142b7e9fe4e11fc3c90eef397f924bdcf6793794c0.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce unio0114.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" unio0114.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4940 2016 WerFault.exe qu9165.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro9135.exequ9165.exesi594161.exepid process 4780 pro9135.exe 4780 pro9135.exe 2016 qu9165.exe 2016 qu9165.exe 3100 si594161.exe 3100 si594161.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro9135.exequ9165.exesi594161.exedescription pid process Token: SeDebugPrivilege 4780 pro9135.exe Token: SeDebugPrivilege 2016 qu9165.exe Token: SeDebugPrivilege 3100 si594161.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
27d88c8cb7a0de490f31df142b7e9fe4e11fc3c90eef397f924bdcf6793794c0.exeunio0114.exedescription pid process target process PID 4244 wrote to memory of 2012 4244 27d88c8cb7a0de490f31df142b7e9fe4e11fc3c90eef397f924bdcf6793794c0.exe unio0114.exe PID 4244 wrote to memory of 2012 4244 27d88c8cb7a0de490f31df142b7e9fe4e11fc3c90eef397f924bdcf6793794c0.exe unio0114.exe PID 4244 wrote to memory of 2012 4244 27d88c8cb7a0de490f31df142b7e9fe4e11fc3c90eef397f924bdcf6793794c0.exe unio0114.exe PID 2012 wrote to memory of 4780 2012 unio0114.exe pro9135.exe PID 2012 wrote to memory of 4780 2012 unio0114.exe pro9135.exe PID 2012 wrote to memory of 2016 2012 unio0114.exe qu9165.exe PID 2012 wrote to memory of 2016 2012 unio0114.exe qu9165.exe PID 2012 wrote to memory of 2016 2012 unio0114.exe qu9165.exe PID 4244 wrote to memory of 3100 4244 27d88c8cb7a0de490f31df142b7e9fe4e11fc3c90eef397f924bdcf6793794c0.exe si594161.exe PID 4244 wrote to memory of 3100 4244 27d88c8cb7a0de490f31df142b7e9fe4e11fc3c90eef397f924bdcf6793794c0.exe si594161.exe PID 4244 wrote to memory of 3100 4244 27d88c8cb7a0de490f31df142b7e9fe4e11fc3c90eef397f924bdcf6793794c0.exe si594161.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\27d88c8cb7a0de490f31df142b7e9fe4e11fc3c90eef397f924bdcf6793794c0.exe"C:\Users\Admin\AppData\Local\Temp\27d88c8cb7a0de490f31df142b7e9fe4e11fc3c90eef397f924bdcf6793794c0.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio0114.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio0114.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9135.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9135.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9165.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9165.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 13484⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si594161.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si594161.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2016 -ip 20161⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si594161.exeFilesize
175KB
MD541707338e1e2d868aa699ac0dd2e77b0
SHA136e0dfba09f9fb409faf0f9a99217d0d0c524b82
SHA2568d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557
SHA51280c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si594161.exeFilesize
175KB
MD541707338e1e2d868aa699ac0dd2e77b0
SHA136e0dfba09f9fb409faf0f9a99217d0d0c524b82
SHA2568d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557
SHA51280c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio0114.exeFilesize
404KB
MD514b43dfd8640757e193efc3dcd91bbe2
SHA12aef34e7987022a6cafcea7f006c89923fb97d32
SHA2563a53c74d4470decdd30259a47608c780f7e2fbcc7a6307261257443193473550
SHA51279d5fe70c2c7351d4f580c2ae0827f9d5aab6f3d69adc086894eb4ddec4d6e93491c00b858d6f5579053280004e3436bec714c9bab1329b5bba76b390cff1840
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio0114.exeFilesize
404KB
MD514b43dfd8640757e193efc3dcd91bbe2
SHA12aef34e7987022a6cafcea7f006c89923fb97d32
SHA2563a53c74d4470decdd30259a47608c780f7e2fbcc7a6307261257443193473550
SHA51279d5fe70c2c7351d4f580c2ae0827f9d5aab6f3d69adc086894eb4ddec4d6e93491c00b858d6f5579053280004e3436bec714c9bab1329b5bba76b390cff1840
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9135.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9135.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9165.exeFilesize
358KB
MD5d37bd15ad95130b268666e87d65fcc88
SHA1c17a1c52425f3fb3002b3bc4bbab3d4dc226da9d
SHA256c49980890bb8b0613228737113320fc81c1a80abff8da0d3f2b280d15b2326df
SHA512d0e60a64c50172002ce3cabe151ece74baff166ecf2ec5cdd0ad12c25d3a9a4de32ddf5ca74f0c8f805d2368c2e544f55fde4a05a357a00afb46f5bbadedca8c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9165.exeFilesize
358KB
MD5d37bd15ad95130b268666e87d65fcc88
SHA1c17a1c52425f3fb3002b3bc4bbab3d4dc226da9d
SHA256c49980890bb8b0613228737113320fc81c1a80abff8da0d3f2b280d15b2326df
SHA512d0e60a64c50172002ce3cabe151ece74baff166ecf2ec5cdd0ad12c25d3a9a4de32ddf5ca74f0c8f805d2368c2e544f55fde4a05a357a00afb46f5bbadedca8c
-
memory/2016-153-0x0000000002370000-0x00000000023BB000-memory.dmpFilesize
300KB
-
memory/2016-154-0x0000000004DD0000-0x0000000005374000-memory.dmpFilesize
5.6MB
-
memory/2016-155-0x00000000053C0000-0x00000000053FE000-memory.dmpFilesize
248KB
-
memory/2016-156-0x00000000053C0000-0x00000000053FE000-memory.dmpFilesize
248KB
-
memory/2016-158-0x00000000053C0000-0x00000000053FE000-memory.dmpFilesize
248KB
-
memory/2016-160-0x00000000053C0000-0x00000000053FE000-memory.dmpFilesize
248KB
-
memory/2016-162-0x00000000053C0000-0x00000000053FE000-memory.dmpFilesize
248KB
-
memory/2016-164-0x00000000053C0000-0x00000000053FE000-memory.dmpFilesize
248KB
-
memory/2016-166-0x00000000053C0000-0x00000000053FE000-memory.dmpFilesize
248KB
-
memory/2016-168-0x00000000053C0000-0x00000000053FE000-memory.dmpFilesize
248KB
-
memory/2016-170-0x00000000053C0000-0x00000000053FE000-memory.dmpFilesize
248KB
-
memory/2016-172-0x00000000053C0000-0x00000000053FE000-memory.dmpFilesize
248KB
-
memory/2016-174-0x00000000053C0000-0x00000000053FE000-memory.dmpFilesize
248KB
-
memory/2016-176-0x00000000053C0000-0x00000000053FE000-memory.dmpFilesize
248KB
-
memory/2016-178-0x00000000053C0000-0x00000000053FE000-memory.dmpFilesize
248KB
-
memory/2016-180-0x00000000053C0000-0x00000000053FE000-memory.dmpFilesize
248KB
-
memory/2016-182-0x0000000004DC0000-0x0000000004DD0000-memory.dmpFilesize
64KB
-
memory/2016-184-0x0000000004DC0000-0x0000000004DD0000-memory.dmpFilesize
64KB
-
memory/2016-183-0x00000000053C0000-0x00000000053FE000-memory.dmpFilesize
248KB
-
memory/2016-187-0x00000000053C0000-0x00000000053FE000-memory.dmpFilesize
248KB
-
memory/2016-186-0x0000000004DC0000-0x0000000004DD0000-memory.dmpFilesize
64KB
-
memory/2016-189-0x00000000053C0000-0x00000000053FE000-memory.dmpFilesize
248KB
-
memory/2016-191-0x00000000053C0000-0x00000000053FE000-memory.dmpFilesize
248KB
-
memory/2016-193-0x00000000053C0000-0x00000000053FE000-memory.dmpFilesize
248KB
-
memory/2016-195-0x00000000053C0000-0x00000000053FE000-memory.dmpFilesize
248KB
-
memory/2016-197-0x00000000053C0000-0x00000000053FE000-memory.dmpFilesize
248KB
-
memory/2016-199-0x00000000053C0000-0x00000000053FE000-memory.dmpFilesize
248KB
-
memory/2016-201-0x00000000053C0000-0x00000000053FE000-memory.dmpFilesize
248KB
-
memory/2016-203-0x00000000053C0000-0x00000000053FE000-memory.dmpFilesize
248KB
-
memory/2016-205-0x00000000053C0000-0x00000000053FE000-memory.dmpFilesize
248KB
-
memory/2016-207-0x00000000053C0000-0x00000000053FE000-memory.dmpFilesize
248KB
-
memory/2016-211-0x00000000053C0000-0x00000000053FE000-memory.dmpFilesize
248KB
-
memory/2016-209-0x00000000053C0000-0x00000000053FE000-memory.dmpFilesize
248KB
-
memory/2016-213-0x00000000053C0000-0x00000000053FE000-memory.dmpFilesize
248KB
-
memory/2016-215-0x00000000053C0000-0x00000000053FE000-memory.dmpFilesize
248KB
-
memory/2016-217-0x00000000053C0000-0x00000000053FE000-memory.dmpFilesize
248KB
-
memory/2016-219-0x00000000053C0000-0x00000000053FE000-memory.dmpFilesize
248KB
-
memory/2016-221-0x00000000053C0000-0x00000000053FE000-memory.dmpFilesize
248KB
-
memory/2016-1064-0x0000000005460000-0x0000000005A78000-memory.dmpFilesize
6.1MB
-
memory/2016-1065-0x0000000005B00000-0x0000000005C0A000-memory.dmpFilesize
1.0MB
-
memory/2016-1066-0x0000000005C40000-0x0000000005C52000-memory.dmpFilesize
72KB
-
memory/2016-1067-0x0000000005C60000-0x0000000005C9C000-memory.dmpFilesize
240KB
-
memory/2016-1068-0x0000000004DC0000-0x0000000004DD0000-memory.dmpFilesize
64KB
-
memory/2016-1069-0x0000000005F50000-0x0000000005FE2000-memory.dmpFilesize
584KB
-
memory/2016-1070-0x0000000005FF0000-0x0000000006056000-memory.dmpFilesize
408KB
-
memory/2016-1072-0x0000000004DC0000-0x0000000004DD0000-memory.dmpFilesize
64KB
-
memory/2016-1073-0x0000000004DC0000-0x0000000004DD0000-memory.dmpFilesize
64KB
-
memory/2016-1074-0x0000000004DC0000-0x0000000004DD0000-memory.dmpFilesize
64KB
-
memory/2016-1075-0x0000000006960000-0x00000000069D6000-memory.dmpFilesize
472KB
-
memory/2016-1076-0x00000000069E0000-0x0000000006A30000-memory.dmpFilesize
320KB
-
memory/2016-1077-0x0000000006A50000-0x0000000006C12000-memory.dmpFilesize
1.8MB
-
memory/2016-1078-0x0000000004DC0000-0x0000000004DD0000-memory.dmpFilesize
64KB
-
memory/2016-1079-0x0000000006C20000-0x000000000714C000-memory.dmpFilesize
5.2MB
-
memory/3100-1085-0x0000000000AF0000-0x0000000000B22000-memory.dmpFilesize
200KB
-
memory/3100-1086-0x00000000056F0000-0x0000000005700000-memory.dmpFilesize
64KB
-
memory/4780-147-0x0000000000BD0000-0x0000000000BDA000-memory.dmpFilesize
40KB