Analysis
-
max time kernel
54s -
max time network
146s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
24-03-2023 07:51
Static task
static1
Behavioral task
behavioral1
Sample
6930e3c829638b5d6218bf29a8f0f9b73ea6392fa340e4525ca0930e2379da5a.exe
Resource
win10-20230220-en
General
-
Target
6930e3c829638b5d6218bf29a8f0f9b73ea6392fa340e4525ca0930e2379da5a.exe
-
Size
540KB
-
MD5
dbb45948b728c2fb34ab3d97cc7c7fa5
-
SHA1
fe53f666d64c21dc5165447dbfc25eb2002e2fc9
-
SHA256
6930e3c829638b5d6218bf29a8f0f9b73ea6392fa340e4525ca0930e2379da5a
-
SHA512
e59e5cda4a66a795b3e3e4effb451053443b7f14cdabf6dfffe9bfe25c2ea598f0dbc5a31f9ba34e3c74f3d79cc4a03166937f163baed9358ab4f6df3c8076bf
-
SSDEEP
12288:iMr8y90c3b6BYmWMGNsZFJuKz7MOlHbHE65c9P7bcoYu/txxq:CyJ62mWbNsDIK7lHA6uWo3/zM
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
bolt
193.233.20.31:4125
-
auth_value
29540c7bf0277243e2faf6601e15a754
Signatures
-
Processes:
h96iZ76.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" h96iZ76.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" h96iZ76.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" h96iZ76.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" h96iZ76.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" h96iZ76.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
Processes:
resource yara_rule behavioral1/memory/2384-141-0x0000000004BF0000-0x0000000004C36000-memory.dmp family_redline behavioral1/memory/2384-143-0x0000000007610000-0x0000000007654000-memory.dmp family_redline behavioral1/memory/2384-144-0x0000000007610000-0x000000000764E000-memory.dmp family_redline behavioral1/memory/2384-145-0x0000000007610000-0x000000000764E000-memory.dmp family_redline behavioral1/memory/2384-147-0x0000000007610000-0x000000000764E000-memory.dmp family_redline behavioral1/memory/2384-149-0x0000000007610000-0x000000000764E000-memory.dmp family_redline behavioral1/memory/2384-151-0x0000000007610000-0x000000000764E000-memory.dmp family_redline behavioral1/memory/2384-155-0x0000000007610000-0x000000000764E000-memory.dmp family_redline behavioral1/memory/2384-153-0x0000000007610000-0x000000000764E000-memory.dmp family_redline behavioral1/memory/2384-157-0x0000000007610000-0x000000000764E000-memory.dmp family_redline behavioral1/memory/2384-164-0x0000000007610000-0x000000000764E000-memory.dmp family_redline behavioral1/memory/2384-159-0x0000000007610000-0x000000000764E000-memory.dmp family_redline behavioral1/memory/2384-169-0x0000000007610000-0x000000000764E000-memory.dmp family_redline behavioral1/memory/2384-167-0x0000000007610000-0x000000000764E000-memory.dmp family_redline behavioral1/memory/2384-171-0x0000000007610000-0x000000000764E000-memory.dmp family_redline behavioral1/memory/2384-173-0x0000000007610000-0x000000000764E000-memory.dmp family_redline behavioral1/memory/2384-175-0x0000000007610000-0x000000000764E000-memory.dmp family_redline behavioral1/memory/2384-177-0x0000000007610000-0x000000000764E000-memory.dmp family_redline behavioral1/memory/2384-179-0x0000000007610000-0x000000000764E000-memory.dmp family_redline behavioral1/memory/2384-181-0x0000000007610000-0x000000000764E000-memory.dmp family_redline behavioral1/memory/2384-183-0x0000000007610000-0x000000000764E000-memory.dmp family_redline behavioral1/memory/2384-185-0x0000000007610000-0x000000000764E000-memory.dmp family_redline behavioral1/memory/2384-187-0x0000000007610000-0x000000000764E000-memory.dmp family_redline behavioral1/memory/2384-189-0x0000000007610000-0x000000000764E000-memory.dmp family_redline behavioral1/memory/2384-191-0x0000000007610000-0x000000000764E000-memory.dmp family_redline behavioral1/memory/2384-193-0x0000000007610000-0x000000000764E000-memory.dmp family_redline behavioral1/memory/2384-195-0x0000000007610000-0x000000000764E000-memory.dmp family_redline behavioral1/memory/2384-197-0x0000000007610000-0x000000000764E000-memory.dmp family_redline behavioral1/memory/2384-199-0x0000000007610000-0x000000000764E000-memory.dmp family_redline behavioral1/memory/2384-201-0x0000000007610000-0x000000000764E000-memory.dmp family_redline behavioral1/memory/2384-203-0x0000000007610000-0x000000000764E000-memory.dmp family_redline behavioral1/memory/2384-205-0x0000000007610000-0x000000000764E000-memory.dmp family_redline behavioral1/memory/2384-207-0x0000000007610000-0x000000000764E000-memory.dmp family_redline behavioral1/memory/2384-209-0x0000000007610000-0x000000000764E000-memory.dmp family_redline behavioral1/memory/2384-211-0x0000000007610000-0x000000000764E000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
niba7438.exeh96iZ76.exeivuoX30.exel65Pp84.exepid process 1556 niba7438.exe 2312 h96iZ76.exe 2384 ivuoX30.exe 4536 l65Pp84.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
h96iZ76.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" h96iZ76.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
niba7438.exe6930e3c829638b5d6218bf29a8f0f9b73ea6392fa340e4525ca0930e2379da5a.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" niba7438.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 6930e3c829638b5d6218bf29a8f0f9b73ea6392fa340e4525ca0930e2379da5a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 6930e3c829638b5d6218bf29a8f0f9b73ea6392fa340e4525ca0930e2379da5a.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce niba7438.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
h96iZ76.exeivuoX30.exel65Pp84.exepid process 2312 h96iZ76.exe 2312 h96iZ76.exe 2384 ivuoX30.exe 2384 ivuoX30.exe 4536 l65Pp84.exe 4536 l65Pp84.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
h96iZ76.exeivuoX30.exel65Pp84.exedescription pid process Token: SeDebugPrivilege 2312 h96iZ76.exe Token: SeDebugPrivilege 2384 ivuoX30.exe Token: SeDebugPrivilege 4536 l65Pp84.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
6930e3c829638b5d6218bf29a8f0f9b73ea6392fa340e4525ca0930e2379da5a.exeniba7438.exedescription pid process target process PID 1836 wrote to memory of 1556 1836 6930e3c829638b5d6218bf29a8f0f9b73ea6392fa340e4525ca0930e2379da5a.exe niba7438.exe PID 1836 wrote to memory of 1556 1836 6930e3c829638b5d6218bf29a8f0f9b73ea6392fa340e4525ca0930e2379da5a.exe niba7438.exe PID 1836 wrote to memory of 1556 1836 6930e3c829638b5d6218bf29a8f0f9b73ea6392fa340e4525ca0930e2379da5a.exe niba7438.exe PID 1556 wrote to memory of 2312 1556 niba7438.exe h96iZ76.exe PID 1556 wrote to memory of 2312 1556 niba7438.exe h96iZ76.exe PID 1556 wrote to memory of 2384 1556 niba7438.exe ivuoX30.exe PID 1556 wrote to memory of 2384 1556 niba7438.exe ivuoX30.exe PID 1556 wrote to memory of 2384 1556 niba7438.exe ivuoX30.exe PID 1836 wrote to memory of 4536 1836 6930e3c829638b5d6218bf29a8f0f9b73ea6392fa340e4525ca0930e2379da5a.exe l65Pp84.exe PID 1836 wrote to memory of 4536 1836 6930e3c829638b5d6218bf29a8f0f9b73ea6392fa340e4525ca0930e2379da5a.exe l65Pp84.exe PID 1836 wrote to memory of 4536 1836 6930e3c829638b5d6218bf29a8f0f9b73ea6392fa340e4525ca0930e2379da5a.exe l65Pp84.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6930e3c829638b5d6218bf29a8f0f9b73ea6392fa340e4525ca0930e2379da5a.exe"C:\Users\Admin\AppData\Local\Temp\6930e3c829638b5d6218bf29a8f0f9b73ea6392fa340e4525ca0930e2379da5a.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba7438.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba7438.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h96iZ76.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h96iZ76.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ivuoX30.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ivuoX30.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l65Pp84.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l65Pp84.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l65Pp84.exeFilesize
175KB
MD578efaf7292c2027da40635ca1aae855a
SHA1686227a48e23b382a06c74f17d9b6f36e76042fd
SHA2562f1381bbe319ee3d19b3e07704205a3d31a7ffb7b5b7c282b9d884682bc892ab
SHA51219e22ec7ad2295a1a3f4cbabb2e005df674ff3731cc33b74e175e10fcc4e482c8f0ce9c8722a8d14a0f9f9ad6e37360ce6816215512bea8324cd87a9fefc852a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l65Pp84.exeFilesize
175KB
MD578efaf7292c2027da40635ca1aae855a
SHA1686227a48e23b382a06c74f17d9b6f36e76042fd
SHA2562f1381bbe319ee3d19b3e07704205a3d31a7ffb7b5b7c282b9d884682bc892ab
SHA51219e22ec7ad2295a1a3f4cbabb2e005df674ff3731cc33b74e175e10fcc4e482c8f0ce9c8722a8d14a0f9f9ad6e37360ce6816215512bea8324cd87a9fefc852a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba7438.exeFilesize
397KB
MD5f1281e2ec4a1ea3007742c31913e6c6b
SHA13741062e350605066c7013d84c229458c881380a
SHA2564c53d7fda187fbf25bae39a01cde00779d2dcd60a1da6f3b0293ec844ff2b11f
SHA51240d58c0e2f8462c91fe90e2f375440923d7277de4bf073c2b688dde9a99ebd97f70f2e472838f00db49a894e3628a7cfab4e5bb95d8a059a23cc3e6cf8618f0b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba7438.exeFilesize
397KB
MD5f1281e2ec4a1ea3007742c31913e6c6b
SHA13741062e350605066c7013d84c229458c881380a
SHA2564c53d7fda187fbf25bae39a01cde00779d2dcd60a1da6f3b0293ec844ff2b11f
SHA51240d58c0e2f8462c91fe90e2f375440923d7277de4bf073c2b688dde9a99ebd97f70f2e472838f00db49a894e3628a7cfab4e5bb95d8a059a23cc3e6cf8618f0b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h96iZ76.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h96iZ76.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ivuoX30.exeFilesize
355KB
MD5fb691f10ad40e06187fb609e9720c990
SHA145d43cbade078247190b166061960aee938814f8
SHA25672bf83f475ed20ef32e5849c1498e69b1ed8c1fba7fdf561ce75a2aa75920602
SHA5120a9decab66438ac62849e40dbc923d03c0a46a134eb200a1a60f23b6ac51ae6bf250be3c567155cdc87402e5bd58c5da16b3f98cf2e5add1a071494a28976e82
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ivuoX30.exeFilesize
355KB
MD5fb691f10ad40e06187fb609e9720c990
SHA145d43cbade078247190b166061960aee938814f8
SHA25672bf83f475ed20ef32e5849c1498e69b1ed8c1fba7fdf561ce75a2aa75920602
SHA5120a9decab66438ac62849e40dbc923d03c0a46a134eb200a1a60f23b6ac51ae6bf250be3c567155cdc87402e5bd58c5da16b3f98cf2e5add1a071494a28976e82
-
memory/2312-135-0x0000000000DC0000-0x0000000000DCA000-memory.dmpFilesize
40KB
-
memory/2384-141-0x0000000004BF0000-0x0000000004C36000-memory.dmpFilesize
280KB
-
memory/2384-142-0x0000000007110000-0x000000000760E000-memory.dmpFilesize
5.0MB
-
memory/2384-143-0x0000000007610000-0x0000000007654000-memory.dmpFilesize
272KB
-
memory/2384-144-0x0000000007610000-0x000000000764E000-memory.dmpFilesize
248KB
-
memory/2384-145-0x0000000007610000-0x000000000764E000-memory.dmpFilesize
248KB
-
memory/2384-147-0x0000000007610000-0x000000000764E000-memory.dmpFilesize
248KB
-
memory/2384-149-0x0000000007610000-0x000000000764E000-memory.dmpFilesize
248KB
-
memory/2384-151-0x0000000007610000-0x000000000764E000-memory.dmpFilesize
248KB
-
memory/2384-155-0x0000000007610000-0x000000000764E000-memory.dmpFilesize
248KB
-
memory/2384-153-0x0000000007610000-0x000000000764E000-memory.dmpFilesize
248KB
-
memory/2384-157-0x0000000007610000-0x000000000764E000-memory.dmpFilesize
248KB
-
memory/2384-160-0x0000000002BE0000-0x0000000002C2B000-memory.dmpFilesize
300KB
-
memory/2384-161-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/2384-164-0x0000000007610000-0x000000000764E000-memory.dmpFilesize
248KB
-
memory/2384-163-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/2384-159-0x0000000007610000-0x000000000764E000-memory.dmpFilesize
248KB
-
memory/2384-166-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/2384-169-0x0000000007610000-0x000000000764E000-memory.dmpFilesize
248KB
-
memory/2384-167-0x0000000007610000-0x000000000764E000-memory.dmpFilesize
248KB
-
memory/2384-171-0x0000000007610000-0x000000000764E000-memory.dmpFilesize
248KB
-
memory/2384-173-0x0000000007610000-0x000000000764E000-memory.dmpFilesize
248KB
-
memory/2384-175-0x0000000007610000-0x000000000764E000-memory.dmpFilesize
248KB
-
memory/2384-177-0x0000000007610000-0x000000000764E000-memory.dmpFilesize
248KB
-
memory/2384-179-0x0000000007610000-0x000000000764E000-memory.dmpFilesize
248KB
-
memory/2384-181-0x0000000007610000-0x000000000764E000-memory.dmpFilesize
248KB
-
memory/2384-183-0x0000000007610000-0x000000000764E000-memory.dmpFilesize
248KB
-
memory/2384-185-0x0000000007610000-0x000000000764E000-memory.dmpFilesize
248KB
-
memory/2384-187-0x0000000007610000-0x000000000764E000-memory.dmpFilesize
248KB
-
memory/2384-189-0x0000000007610000-0x000000000764E000-memory.dmpFilesize
248KB
-
memory/2384-191-0x0000000007610000-0x000000000764E000-memory.dmpFilesize
248KB
-
memory/2384-193-0x0000000007610000-0x000000000764E000-memory.dmpFilesize
248KB
-
memory/2384-195-0x0000000007610000-0x000000000764E000-memory.dmpFilesize
248KB
-
memory/2384-197-0x0000000007610000-0x000000000764E000-memory.dmpFilesize
248KB
-
memory/2384-199-0x0000000007610000-0x000000000764E000-memory.dmpFilesize
248KB
-
memory/2384-201-0x0000000007610000-0x000000000764E000-memory.dmpFilesize
248KB
-
memory/2384-203-0x0000000007610000-0x000000000764E000-memory.dmpFilesize
248KB
-
memory/2384-205-0x0000000007610000-0x000000000764E000-memory.dmpFilesize
248KB
-
memory/2384-207-0x0000000007610000-0x000000000764E000-memory.dmpFilesize
248KB
-
memory/2384-209-0x0000000007610000-0x000000000764E000-memory.dmpFilesize
248KB
-
memory/2384-211-0x0000000007610000-0x000000000764E000-memory.dmpFilesize
248KB
-
memory/2384-1054-0x00000000076A0000-0x0000000007CA6000-memory.dmpFilesize
6.0MB
-
memory/2384-1055-0x0000000007D30000-0x0000000007E3A000-memory.dmpFilesize
1.0MB
-
memory/2384-1056-0x0000000007E70000-0x0000000007E82000-memory.dmpFilesize
72KB
-
memory/2384-1057-0x0000000007E90000-0x0000000007ECE000-memory.dmpFilesize
248KB
-
memory/2384-1058-0x0000000007FE0000-0x000000000802B000-memory.dmpFilesize
300KB
-
memory/2384-1059-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/2384-1061-0x0000000008170000-0x00000000081D6000-memory.dmpFilesize
408KB
-
memory/2384-1062-0x0000000008860000-0x00000000088F2000-memory.dmpFilesize
584KB
-
memory/2384-1063-0x0000000008A00000-0x0000000008A76000-memory.dmpFilesize
472KB
-
memory/2384-1064-0x0000000008A80000-0x0000000008AD0000-memory.dmpFilesize
320KB
-
memory/2384-1065-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/2384-1066-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/2384-1067-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/2384-1068-0x0000000008C50000-0x0000000008E12000-memory.dmpFilesize
1.8MB
-
memory/2384-1069-0x0000000008E20000-0x000000000934C000-memory.dmpFilesize
5.2MB
-
memory/4536-1075-0x0000000000BB0000-0x0000000000BE2000-memory.dmpFilesize
200KB
-
memory/4536-1076-0x00000000055F0000-0x000000000563B000-memory.dmpFilesize
300KB
-
memory/4536-1077-0x0000000005700000-0x0000000005710000-memory.dmpFilesize
64KB