Analysis
-
max time kernel
98s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
24-03-2023 01:24
Static task
static1
Behavioral task
behavioral1
Sample
04d08122b3829291296b62e43a805445b4754995c0d7282b870c4179df43094c.exe
Resource
win10v2004-20230220-en
General
-
Target
04d08122b3829291296b62e43a805445b4754995c0d7282b870c4179df43094c.exe
-
Size
546KB
-
MD5
4a8527d676705923c956bf87a7b1b902
-
SHA1
98fd0fb55b12a246da7b08ef9f137e2601512ee5
-
SHA256
04d08122b3829291296b62e43a805445b4754995c0d7282b870c4179df43094c
-
SHA512
24c85be3862198f34c90f1789caf92a10938a92e317611b3bb02eaa0ba82c56b6795a8e44661227f65c1dd4492f330b955e45869ea0fd9d72e19bae7f9e4f028
-
SSDEEP
12288:BMrcy90A+yp17fgT6ywNjLUdi7X/y3ttwLt39Dipcn2ASPNB:9yiypCeyIjgdc2Qt39DicAB
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
real
193.233.20.31:4125
-
auth_value
bb22a50228754849387d5f4d1611e71b
Signatures
-
Processes:
pro5028.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro5028.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro5028.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro5028.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro5028.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection pro5028.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro5028.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/4540-158-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/4540-161-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/4540-159-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/4540-163-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/4540-165-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/4540-167-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/4540-169-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/4540-171-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/4540-173-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/4540-175-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/4540-177-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/4540-179-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/4540-181-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/4540-183-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/4540-185-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/4540-187-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/4540-189-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/4540-191-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/4540-193-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/4540-195-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/4540-197-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/4540-199-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/4540-201-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/4540-203-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/4540-205-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/4540-207-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/4540-209-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/4540-211-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/4540-213-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/4540-215-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/4540-217-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/4540-219-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/4540-221-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
unio6663.exepro5028.exequ4860.exesi333104.exepid process 4344 unio6663.exe 1800 pro5028.exe 4540 qu4860.exe 452 si333104.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro5028.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" pro5028.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
04d08122b3829291296b62e43a805445b4754995c0d7282b870c4179df43094c.exeunio6663.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 04d08122b3829291296b62e43a805445b4754995c0d7282b870c4179df43094c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 04d08122b3829291296b62e43a805445b4754995c0d7282b870c4179df43094c.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce unio6663.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" unio6663.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2652 4540 WerFault.exe qu4860.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro5028.exequ4860.exesi333104.exepid process 1800 pro5028.exe 1800 pro5028.exe 4540 qu4860.exe 4540 qu4860.exe 452 si333104.exe 452 si333104.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro5028.exequ4860.exesi333104.exedescription pid process Token: SeDebugPrivilege 1800 pro5028.exe Token: SeDebugPrivilege 4540 qu4860.exe Token: SeDebugPrivilege 452 si333104.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
04d08122b3829291296b62e43a805445b4754995c0d7282b870c4179df43094c.exeunio6663.exedescription pid process target process PID 3268 wrote to memory of 4344 3268 04d08122b3829291296b62e43a805445b4754995c0d7282b870c4179df43094c.exe unio6663.exe PID 3268 wrote to memory of 4344 3268 04d08122b3829291296b62e43a805445b4754995c0d7282b870c4179df43094c.exe unio6663.exe PID 3268 wrote to memory of 4344 3268 04d08122b3829291296b62e43a805445b4754995c0d7282b870c4179df43094c.exe unio6663.exe PID 4344 wrote to memory of 1800 4344 unio6663.exe pro5028.exe PID 4344 wrote to memory of 1800 4344 unio6663.exe pro5028.exe PID 4344 wrote to memory of 4540 4344 unio6663.exe qu4860.exe PID 4344 wrote to memory of 4540 4344 unio6663.exe qu4860.exe PID 4344 wrote to memory of 4540 4344 unio6663.exe qu4860.exe PID 3268 wrote to memory of 452 3268 04d08122b3829291296b62e43a805445b4754995c0d7282b870c4179df43094c.exe si333104.exe PID 3268 wrote to memory of 452 3268 04d08122b3829291296b62e43a805445b4754995c0d7282b870c4179df43094c.exe si333104.exe PID 3268 wrote to memory of 452 3268 04d08122b3829291296b62e43a805445b4754995c0d7282b870c4179df43094c.exe si333104.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\04d08122b3829291296b62e43a805445b4754995c0d7282b870c4179df43094c.exe"C:\Users\Admin\AppData\Local\Temp\04d08122b3829291296b62e43a805445b4754995c0d7282b870c4179df43094c.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio6663.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio6663.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5028.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5028.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4860.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4860.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 13604⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si333104.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si333104.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4540 -ip 45401⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si333104.exeFilesize
175KB
MD541707338e1e2d868aa699ac0dd2e77b0
SHA136e0dfba09f9fb409faf0f9a99217d0d0c524b82
SHA2568d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557
SHA51280c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si333104.exeFilesize
175KB
MD541707338e1e2d868aa699ac0dd2e77b0
SHA136e0dfba09f9fb409faf0f9a99217d0d0c524b82
SHA2568d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557
SHA51280c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio6663.exeFilesize
404KB
MD57c89beed715e23d11d18a656d49d09da
SHA180a74f2000068885fb26e92722785f13627c6843
SHA25637a6d47256d3b77afae8a62a330835fa554859f2dbbf2854b323614726fe79eb
SHA5129f137220f0bfd95ba1963e7ecc7220d63207565d13673bd2578c818ca14e872e439d7de5b918b5615bb45c028b7d600767a3139ab40e10efc97077056ad37f73
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio6663.exeFilesize
404KB
MD57c89beed715e23d11d18a656d49d09da
SHA180a74f2000068885fb26e92722785f13627c6843
SHA25637a6d47256d3b77afae8a62a330835fa554859f2dbbf2854b323614726fe79eb
SHA5129f137220f0bfd95ba1963e7ecc7220d63207565d13673bd2578c818ca14e872e439d7de5b918b5615bb45c028b7d600767a3139ab40e10efc97077056ad37f73
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5028.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5028.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4860.exeFilesize
358KB
MD51ee74a295e48006059b3b3633fd4bf96
SHA1564bc5aae464987d7ecdf7fd4ff89008b8fb11a4
SHA256baff1baf7154323e98ca3fa8840cc8c16e8b8ffd4fecfb052e2d7d7b9e466a8c
SHA51287c0326662b98c6f5228453129c135008bef9c5466ac2f7aef3f36a5e95200ca144272f8115df1d22b010240967b31a894e8c4f15c4102923075eb4fc07918c5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4860.exeFilesize
358KB
MD51ee74a295e48006059b3b3633fd4bf96
SHA1564bc5aae464987d7ecdf7fd4ff89008b8fb11a4
SHA256baff1baf7154323e98ca3fa8840cc8c16e8b8ffd4fecfb052e2d7d7b9e466a8c
SHA51287c0326662b98c6f5228453129c135008bef9c5466ac2f7aef3f36a5e95200ca144272f8115df1d22b010240967b31a894e8c4f15c4102923075eb4fc07918c5
-
memory/452-1084-0x00000000000B0000-0x00000000000E2000-memory.dmpFilesize
200KB
-
memory/452-1085-0x00000000049C0000-0x00000000049D0000-memory.dmpFilesize
64KB
-
memory/1800-147-0x0000000000FC0000-0x0000000000FCA000-memory.dmpFilesize
40KB
-
memory/4540-185-0x0000000004CF0000-0x0000000004D2E000-memory.dmpFilesize
248KB
-
memory/4540-197-0x0000000004CF0000-0x0000000004D2E000-memory.dmpFilesize
248KB
-
memory/4540-156-0x0000000004DD0000-0x0000000005374000-memory.dmpFilesize
5.6MB
-
memory/4540-157-0x0000000004DC0000-0x0000000004DD0000-memory.dmpFilesize
64KB
-
memory/4540-155-0x0000000004DC0000-0x0000000004DD0000-memory.dmpFilesize
64KB
-
memory/4540-158-0x0000000004CF0000-0x0000000004D2E000-memory.dmpFilesize
248KB
-
memory/4540-161-0x0000000004CF0000-0x0000000004D2E000-memory.dmpFilesize
248KB
-
memory/4540-159-0x0000000004CF0000-0x0000000004D2E000-memory.dmpFilesize
248KB
-
memory/4540-163-0x0000000004CF0000-0x0000000004D2E000-memory.dmpFilesize
248KB
-
memory/4540-165-0x0000000004CF0000-0x0000000004D2E000-memory.dmpFilesize
248KB
-
memory/4540-167-0x0000000004CF0000-0x0000000004D2E000-memory.dmpFilesize
248KB
-
memory/4540-169-0x0000000004CF0000-0x0000000004D2E000-memory.dmpFilesize
248KB
-
memory/4540-171-0x0000000004CF0000-0x0000000004D2E000-memory.dmpFilesize
248KB
-
memory/4540-173-0x0000000004CF0000-0x0000000004D2E000-memory.dmpFilesize
248KB
-
memory/4540-175-0x0000000004CF0000-0x0000000004D2E000-memory.dmpFilesize
248KB
-
memory/4540-177-0x0000000004CF0000-0x0000000004D2E000-memory.dmpFilesize
248KB
-
memory/4540-179-0x0000000004CF0000-0x0000000004D2E000-memory.dmpFilesize
248KB
-
memory/4540-181-0x0000000004CF0000-0x0000000004D2E000-memory.dmpFilesize
248KB
-
memory/4540-183-0x0000000004CF0000-0x0000000004D2E000-memory.dmpFilesize
248KB
-
memory/4540-153-0x0000000002260000-0x00000000022AB000-memory.dmpFilesize
300KB
-
memory/4540-187-0x0000000004CF0000-0x0000000004D2E000-memory.dmpFilesize
248KB
-
memory/4540-189-0x0000000004CF0000-0x0000000004D2E000-memory.dmpFilesize
248KB
-
memory/4540-191-0x0000000004CF0000-0x0000000004D2E000-memory.dmpFilesize
248KB
-
memory/4540-193-0x0000000004CF0000-0x0000000004D2E000-memory.dmpFilesize
248KB
-
memory/4540-195-0x0000000004CF0000-0x0000000004D2E000-memory.dmpFilesize
248KB
-
memory/4540-154-0x0000000004DC0000-0x0000000004DD0000-memory.dmpFilesize
64KB
-
memory/4540-199-0x0000000004CF0000-0x0000000004D2E000-memory.dmpFilesize
248KB
-
memory/4540-201-0x0000000004CF0000-0x0000000004D2E000-memory.dmpFilesize
248KB
-
memory/4540-203-0x0000000004CF0000-0x0000000004D2E000-memory.dmpFilesize
248KB
-
memory/4540-205-0x0000000004CF0000-0x0000000004D2E000-memory.dmpFilesize
248KB
-
memory/4540-207-0x0000000004CF0000-0x0000000004D2E000-memory.dmpFilesize
248KB
-
memory/4540-209-0x0000000004CF0000-0x0000000004D2E000-memory.dmpFilesize
248KB
-
memory/4540-211-0x0000000004CF0000-0x0000000004D2E000-memory.dmpFilesize
248KB
-
memory/4540-213-0x0000000004CF0000-0x0000000004D2E000-memory.dmpFilesize
248KB
-
memory/4540-215-0x0000000004CF0000-0x0000000004D2E000-memory.dmpFilesize
248KB
-
memory/4540-217-0x0000000004CF0000-0x0000000004D2E000-memory.dmpFilesize
248KB
-
memory/4540-219-0x0000000004CF0000-0x0000000004D2E000-memory.dmpFilesize
248KB
-
memory/4540-221-0x0000000004CF0000-0x0000000004D2E000-memory.dmpFilesize
248KB
-
memory/4540-1064-0x0000000005480000-0x0000000005A98000-memory.dmpFilesize
6.1MB
-
memory/4540-1065-0x0000000005B00000-0x0000000005C0A000-memory.dmpFilesize
1.0MB
-
memory/4540-1066-0x0000000005C40000-0x0000000005C52000-memory.dmpFilesize
72KB
-
memory/4540-1067-0x0000000005C60000-0x0000000005C9C000-memory.dmpFilesize
240KB
-
memory/4540-1068-0x0000000004DC0000-0x0000000004DD0000-memory.dmpFilesize
64KB
-
memory/4540-1069-0x0000000005F50000-0x0000000005FE2000-memory.dmpFilesize
584KB
-
memory/4540-1070-0x0000000005FF0000-0x0000000006056000-memory.dmpFilesize
408KB
-
memory/4540-1072-0x0000000004DC0000-0x0000000004DD0000-memory.dmpFilesize
64KB
-
memory/4540-1073-0x0000000004DC0000-0x0000000004DD0000-memory.dmpFilesize
64KB
-
memory/4540-1074-0x00000000066F0000-0x0000000006766000-memory.dmpFilesize
472KB
-
memory/4540-1075-0x0000000006780000-0x00000000067D0000-memory.dmpFilesize
320KB
-
memory/4540-1076-0x0000000006B80000-0x0000000006D42000-memory.dmpFilesize
1.8MB
-
memory/4540-1077-0x0000000006D90000-0x00000000072BC000-memory.dmpFilesize
5.2MB
-
memory/4540-1078-0x0000000004DC0000-0x0000000004DD0000-memory.dmpFilesize
64KB