Analysis
-
max time kernel
81s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
24-03-2023 01:16
Static task
static1
Behavioral task
behavioral1
Sample
209195dbcd7a6c9b8cb3f2227729b163f08f89f97ef9bbf2ddc745114ef2e82f.exe
Resource
win10v2004-20230221-en
General
-
Target
209195dbcd7a6c9b8cb3f2227729b163f08f89f97ef9bbf2ddc745114ef2e82f.exe
-
Size
546KB
-
MD5
e156ed1c4042411d791fbc92a1bf7193
-
SHA1
578056d46d4b6e738511f53c9e1d922d7ff045a5
-
SHA256
209195dbcd7a6c9b8cb3f2227729b163f08f89f97ef9bbf2ddc745114ef2e82f
-
SHA512
eb472340f4322ff47b6a077e17ee6ee5fa2ead2e1be197318425d7a399264e0d1fbaec2cc913510bef81f5aa1fd76d8c52409370d1aa3d2523c585aca21d51b3
-
SSDEEP
12288:/MrAy90CMYYSdQSyTyFaS7OwvxstywL5v0Kiis9l0pf:DyWYiu2R5v0680
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
real
193.233.20.31:4125
-
auth_value
bb22a50228754849387d5f4d1611e71b
Signatures
-
Processes:
pro8837.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro8837.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro8837.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro8837.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection pro8837.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro8837.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro8837.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/3368-154-0x0000000004CD0000-0x0000000004D0E000-memory.dmp family_redline behavioral1/memory/3368-155-0x0000000004CD0000-0x0000000004D0E000-memory.dmp family_redline behavioral1/memory/3368-157-0x0000000004CD0000-0x0000000004D0E000-memory.dmp family_redline behavioral1/memory/3368-159-0x0000000004CD0000-0x0000000004D0E000-memory.dmp family_redline behavioral1/memory/3368-161-0x0000000004CD0000-0x0000000004D0E000-memory.dmp family_redline behavioral1/memory/3368-164-0x0000000004CD0000-0x0000000004D0E000-memory.dmp family_redline behavioral1/memory/3368-168-0x0000000004CD0000-0x0000000004D0E000-memory.dmp family_redline behavioral1/memory/3368-171-0x0000000004CD0000-0x0000000004D0E000-memory.dmp family_redline behavioral1/memory/3368-173-0x0000000004CD0000-0x0000000004D0E000-memory.dmp family_redline behavioral1/memory/3368-175-0x0000000004CD0000-0x0000000004D0E000-memory.dmp family_redline behavioral1/memory/3368-177-0x0000000004CD0000-0x0000000004D0E000-memory.dmp family_redline behavioral1/memory/3368-179-0x0000000004CD0000-0x0000000004D0E000-memory.dmp family_redline behavioral1/memory/3368-181-0x0000000004CD0000-0x0000000004D0E000-memory.dmp family_redline behavioral1/memory/3368-183-0x0000000004CD0000-0x0000000004D0E000-memory.dmp family_redline behavioral1/memory/3368-185-0x0000000004CD0000-0x0000000004D0E000-memory.dmp family_redline behavioral1/memory/3368-187-0x0000000004CD0000-0x0000000004D0E000-memory.dmp family_redline behavioral1/memory/3368-189-0x0000000004CD0000-0x0000000004D0E000-memory.dmp family_redline behavioral1/memory/3368-191-0x0000000004CD0000-0x0000000004D0E000-memory.dmp family_redline behavioral1/memory/3368-193-0x0000000004CD0000-0x0000000004D0E000-memory.dmp family_redline behavioral1/memory/3368-195-0x0000000004CD0000-0x0000000004D0E000-memory.dmp family_redline behavioral1/memory/3368-201-0x0000000004CD0000-0x0000000004D0E000-memory.dmp family_redline behavioral1/memory/3368-199-0x0000000004CD0000-0x0000000004D0E000-memory.dmp family_redline behavioral1/memory/3368-197-0x0000000004CD0000-0x0000000004D0E000-memory.dmp family_redline behavioral1/memory/3368-203-0x0000000004CD0000-0x0000000004D0E000-memory.dmp family_redline behavioral1/memory/3368-205-0x0000000004CD0000-0x0000000004D0E000-memory.dmp family_redline behavioral1/memory/3368-207-0x0000000004CD0000-0x0000000004D0E000-memory.dmp family_redline behavioral1/memory/3368-209-0x0000000004CD0000-0x0000000004D0E000-memory.dmp family_redline behavioral1/memory/3368-211-0x0000000004CD0000-0x0000000004D0E000-memory.dmp family_redline behavioral1/memory/3368-213-0x0000000004CD0000-0x0000000004D0E000-memory.dmp family_redline behavioral1/memory/3368-215-0x0000000004CD0000-0x0000000004D0E000-memory.dmp family_redline behavioral1/memory/3368-217-0x0000000004CD0000-0x0000000004D0E000-memory.dmp family_redline behavioral1/memory/3368-219-0x0000000004CD0000-0x0000000004D0E000-memory.dmp family_redline behavioral1/memory/3368-221-0x0000000004CD0000-0x0000000004D0E000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
unio1959.exepro8837.exequ2964.exesi454613.exepid process 4828 unio1959.exe 4036 pro8837.exe 3368 qu2964.exe 672 si454613.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro8837.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" pro8837.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
209195dbcd7a6c9b8cb3f2227729b163f08f89f97ef9bbf2ddc745114ef2e82f.exeunio1959.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 209195dbcd7a6c9b8cb3f2227729b163f08f89f97ef9bbf2ddc745114ef2e82f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 209195dbcd7a6c9b8cb3f2227729b163f08f89f97ef9bbf2ddc745114ef2e82f.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce unio1959.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" unio1959.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 944 3368 WerFault.exe qu2964.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro8837.exequ2964.exesi454613.exepid process 4036 pro8837.exe 4036 pro8837.exe 3368 qu2964.exe 3368 qu2964.exe 672 si454613.exe 672 si454613.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro8837.exequ2964.exesi454613.exedescription pid process Token: SeDebugPrivilege 4036 pro8837.exe Token: SeDebugPrivilege 3368 qu2964.exe Token: SeDebugPrivilege 672 si454613.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
209195dbcd7a6c9b8cb3f2227729b163f08f89f97ef9bbf2ddc745114ef2e82f.exeunio1959.exedescription pid process target process PID 2588 wrote to memory of 4828 2588 209195dbcd7a6c9b8cb3f2227729b163f08f89f97ef9bbf2ddc745114ef2e82f.exe unio1959.exe PID 2588 wrote to memory of 4828 2588 209195dbcd7a6c9b8cb3f2227729b163f08f89f97ef9bbf2ddc745114ef2e82f.exe unio1959.exe PID 2588 wrote to memory of 4828 2588 209195dbcd7a6c9b8cb3f2227729b163f08f89f97ef9bbf2ddc745114ef2e82f.exe unio1959.exe PID 4828 wrote to memory of 4036 4828 unio1959.exe pro8837.exe PID 4828 wrote to memory of 4036 4828 unio1959.exe pro8837.exe PID 4828 wrote to memory of 3368 4828 unio1959.exe qu2964.exe PID 4828 wrote to memory of 3368 4828 unio1959.exe qu2964.exe PID 4828 wrote to memory of 3368 4828 unio1959.exe qu2964.exe PID 2588 wrote to memory of 672 2588 209195dbcd7a6c9b8cb3f2227729b163f08f89f97ef9bbf2ddc745114ef2e82f.exe si454613.exe PID 2588 wrote to memory of 672 2588 209195dbcd7a6c9b8cb3f2227729b163f08f89f97ef9bbf2ddc745114ef2e82f.exe si454613.exe PID 2588 wrote to memory of 672 2588 209195dbcd7a6c9b8cb3f2227729b163f08f89f97ef9bbf2ddc745114ef2e82f.exe si454613.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\209195dbcd7a6c9b8cb3f2227729b163f08f89f97ef9bbf2ddc745114ef2e82f.exe"C:\Users\Admin\AppData\Local\Temp\209195dbcd7a6c9b8cb3f2227729b163f08f89f97ef9bbf2ddc745114ef2e82f.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio1959.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio1959.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8837.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8837.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2964.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2964.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 13244⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si454613.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si454613.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3368 -ip 33681⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si454613.exeFilesize
175KB
MD541707338e1e2d868aa699ac0dd2e77b0
SHA136e0dfba09f9fb409faf0f9a99217d0d0c524b82
SHA2568d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557
SHA51280c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si454613.exeFilesize
175KB
MD541707338e1e2d868aa699ac0dd2e77b0
SHA136e0dfba09f9fb409faf0f9a99217d0d0c524b82
SHA2568d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557
SHA51280c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio1959.exeFilesize
404KB
MD5adf0f92d4ca72a6725f00fc1f995c026
SHA1361f9eb1970193c9cbfece0ba5d93856d7a30545
SHA2565df958ed48718852d1be7be74bb1312f9d2c25adc725d87d53d5acc31028e3ad
SHA512aa3d71e6b756de30f942000874a8e0f1573727f2b91550f1d70cae19eb34c07471a0dcaeb4dd02b449212a3c939cd2f874dc01d93d93207e1a84b1256f6af226
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio1959.exeFilesize
404KB
MD5adf0f92d4ca72a6725f00fc1f995c026
SHA1361f9eb1970193c9cbfece0ba5d93856d7a30545
SHA2565df958ed48718852d1be7be74bb1312f9d2c25adc725d87d53d5acc31028e3ad
SHA512aa3d71e6b756de30f942000874a8e0f1573727f2b91550f1d70cae19eb34c07471a0dcaeb4dd02b449212a3c939cd2f874dc01d93d93207e1a84b1256f6af226
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8837.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8837.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2964.exeFilesize
358KB
MD512d85cd8dd38c7bfedb358892ec632f1
SHA1f44339af21cebae2d6cd6701bfec66d02528907d
SHA25684538e94632479fe17190bd4d2c424147f16c4bd625fee9f1f23889bf4f6488a
SHA512fdbdb5b6db621b002b5ebb3d38de1fae1d72fcf8ef3dabd635fbba74cb1bf3a332bfb55c861a4e2db62a6b1e8ef2aeba97621adb9231cff06b0a08429219f56b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2964.exeFilesize
358KB
MD512d85cd8dd38c7bfedb358892ec632f1
SHA1f44339af21cebae2d6cd6701bfec66d02528907d
SHA25684538e94632479fe17190bd4d2c424147f16c4bd625fee9f1f23889bf4f6488a
SHA512fdbdb5b6db621b002b5ebb3d38de1fae1d72fcf8ef3dabd635fbba74cb1bf3a332bfb55c861a4e2db62a6b1e8ef2aeba97621adb9231cff06b0a08429219f56b
-
memory/672-1085-0x00000000004C0000-0x00000000004F2000-memory.dmpFilesize
200KB
-
memory/672-1086-0x00000000050E0000-0x00000000050F0000-memory.dmpFilesize
64KB
-
memory/3368-191-0x0000000004CD0000-0x0000000004D0E000-memory.dmpFilesize
248KB
-
memory/3368-197-0x0000000004CD0000-0x0000000004D0E000-memory.dmpFilesize
248KB
-
memory/3368-155-0x0000000004CD0000-0x0000000004D0E000-memory.dmpFilesize
248KB
-
memory/3368-157-0x0000000004CD0000-0x0000000004D0E000-memory.dmpFilesize
248KB
-
memory/3368-159-0x0000000004CD0000-0x0000000004D0E000-memory.dmpFilesize
248KB
-
memory/3368-161-0x0000000004CD0000-0x0000000004D0E000-memory.dmpFilesize
248KB
-
memory/3368-164-0x0000000004CD0000-0x0000000004D0E000-memory.dmpFilesize
248KB
-
memory/3368-167-0x0000000004D80000-0x0000000004D90000-memory.dmpFilesize
64KB
-
memory/3368-168-0x0000000004CD0000-0x0000000004D0E000-memory.dmpFilesize
248KB
-
memory/3368-166-0x0000000004D80000-0x0000000004D90000-memory.dmpFilesize
64KB
-
memory/3368-163-0x0000000000870000-0x00000000008BB000-memory.dmpFilesize
300KB
-
memory/3368-171-0x0000000004CD0000-0x0000000004D0E000-memory.dmpFilesize
248KB
-
memory/3368-173-0x0000000004CD0000-0x0000000004D0E000-memory.dmpFilesize
248KB
-
memory/3368-169-0x0000000004D80000-0x0000000004D90000-memory.dmpFilesize
64KB
-
memory/3368-175-0x0000000004CD0000-0x0000000004D0E000-memory.dmpFilesize
248KB
-
memory/3368-177-0x0000000004CD0000-0x0000000004D0E000-memory.dmpFilesize
248KB
-
memory/3368-179-0x0000000004CD0000-0x0000000004D0E000-memory.dmpFilesize
248KB
-
memory/3368-181-0x0000000004CD0000-0x0000000004D0E000-memory.dmpFilesize
248KB
-
memory/3368-183-0x0000000004CD0000-0x0000000004D0E000-memory.dmpFilesize
248KB
-
memory/3368-185-0x0000000004CD0000-0x0000000004D0E000-memory.dmpFilesize
248KB
-
memory/3368-187-0x0000000004CD0000-0x0000000004D0E000-memory.dmpFilesize
248KB
-
memory/3368-189-0x0000000004CD0000-0x0000000004D0E000-memory.dmpFilesize
248KB
-
memory/3368-153-0x0000000004D90000-0x0000000005334000-memory.dmpFilesize
5.6MB
-
memory/3368-193-0x0000000004CD0000-0x0000000004D0E000-memory.dmpFilesize
248KB
-
memory/3368-195-0x0000000004CD0000-0x0000000004D0E000-memory.dmpFilesize
248KB
-
memory/3368-201-0x0000000004CD0000-0x0000000004D0E000-memory.dmpFilesize
248KB
-
memory/3368-199-0x0000000004CD0000-0x0000000004D0E000-memory.dmpFilesize
248KB
-
memory/3368-154-0x0000000004CD0000-0x0000000004D0E000-memory.dmpFilesize
248KB
-
memory/3368-203-0x0000000004CD0000-0x0000000004D0E000-memory.dmpFilesize
248KB
-
memory/3368-205-0x0000000004CD0000-0x0000000004D0E000-memory.dmpFilesize
248KB
-
memory/3368-207-0x0000000004CD0000-0x0000000004D0E000-memory.dmpFilesize
248KB
-
memory/3368-209-0x0000000004CD0000-0x0000000004D0E000-memory.dmpFilesize
248KB
-
memory/3368-211-0x0000000004CD0000-0x0000000004D0E000-memory.dmpFilesize
248KB
-
memory/3368-213-0x0000000004CD0000-0x0000000004D0E000-memory.dmpFilesize
248KB
-
memory/3368-215-0x0000000004CD0000-0x0000000004D0E000-memory.dmpFilesize
248KB
-
memory/3368-217-0x0000000004CD0000-0x0000000004D0E000-memory.dmpFilesize
248KB
-
memory/3368-219-0x0000000004CD0000-0x0000000004D0E000-memory.dmpFilesize
248KB
-
memory/3368-221-0x0000000004CD0000-0x0000000004D0E000-memory.dmpFilesize
248KB
-
memory/3368-1064-0x0000000005480000-0x0000000005A98000-memory.dmpFilesize
6.1MB
-
memory/3368-1065-0x0000000005B00000-0x0000000005C0A000-memory.dmpFilesize
1.0MB
-
memory/3368-1066-0x0000000005C40000-0x0000000005C52000-memory.dmpFilesize
72KB
-
memory/3368-1067-0x0000000004D80000-0x0000000004D90000-memory.dmpFilesize
64KB
-
memory/3368-1068-0x0000000005C60000-0x0000000005C9C000-memory.dmpFilesize
240KB
-
memory/3368-1070-0x0000000005F50000-0x0000000005FB6000-memory.dmpFilesize
408KB
-
memory/3368-1071-0x0000000006620000-0x00000000066B2000-memory.dmpFilesize
584KB
-
memory/3368-1072-0x00000000066E0000-0x0000000006756000-memory.dmpFilesize
472KB
-
memory/3368-1073-0x0000000006780000-0x00000000067D0000-memory.dmpFilesize
320KB
-
memory/3368-1074-0x0000000004D80000-0x0000000004D90000-memory.dmpFilesize
64KB
-
memory/3368-1075-0x0000000004D80000-0x0000000004D90000-memory.dmpFilesize
64KB
-
memory/3368-1076-0x0000000004D80000-0x0000000004D90000-memory.dmpFilesize
64KB
-
memory/3368-1077-0x0000000006BB0000-0x0000000006D72000-memory.dmpFilesize
1.8MB
-
memory/3368-1078-0x0000000004D80000-0x0000000004D90000-memory.dmpFilesize
64KB
-
memory/3368-1079-0x0000000006D80000-0x00000000072AC000-memory.dmpFilesize
5.2MB
-
memory/4036-147-0x0000000000020000-0x000000000002A000-memory.dmpFilesize
40KB