Analysis
-
max time kernel
76s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
24-03-2023 11:06
Static task
static1
Behavioral task
behavioral1
Sample
40a5d2004a3e94bed03f0d0b05e1f37dda638fbfbd865f3a87e96be66538fc76.exe
Resource
win10v2004-20230220-en
General
-
Target
40a5d2004a3e94bed03f0d0b05e1f37dda638fbfbd865f3a87e96be66538fc76.exe
-
Size
539KB
-
MD5
938f04b86a72fde9b48bfc63771a2bf3
-
SHA1
7c12e47f94ab6572d311b20c7ed4eed9e65e6685
-
SHA256
40a5d2004a3e94bed03f0d0b05e1f37dda638fbfbd865f3a87e96be66538fc76
-
SHA512
4bbd8b2acf2915cf9049c601b9b0c48eb827b5376cc887838b06daf73322fb3075d56015e8ed91b5bc0813071df20667525618672ef72fb155de09dd6994576f
-
SSDEEP
12288:UMrRy90V/CJdr6xHLuUNjzPgssYaEG3W3XDMgeGi:ly5zCruOjzPc5RWHnI
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
goga
193.233.20.31:4125
-
auth_value
d23290cf37dcc5419576040359a72599
Signatures
-
Processes:
h75cW96.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" h75cW96.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" h75cW96.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" h75cW96.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" h75cW96.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" h75cW96.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection h75cW96.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
Processes:
resource yara_rule behavioral1/memory/2144-155-0x00000000076F0000-0x000000000772E000-memory.dmp family_redline behavioral1/memory/2144-156-0x00000000076F0000-0x000000000772E000-memory.dmp family_redline behavioral1/memory/2144-158-0x00000000076F0000-0x000000000772E000-memory.dmp family_redline behavioral1/memory/2144-160-0x00000000076F0000-0x000000000772E000-memory.dmp family_redline behavioral1/memory/2144-162-0x00000000076F0000-0x000000000772E000-memory.dmp family_redline behavioral1/memory/2144-164-0x00000000076F0000-0x000000000772E000-memory.dmp family_redline behavioral1/memory/2144-166-0x00000000076F0000-0x000000000772E000-memory.dmp family_redline behavioral1/memory/2144-168-0x00000000076F0000-0x000000000772E000-memory.dmp family_redline behavioral1/memory/2144-170-0x00000000076F0000-0x000000000772E000-memory.dmp family_redline behavioral1/memory/2144-172-0x00000000076F0000-0x000000000772E000-memory.dmp family_redline behavioral1/memory/2144-174-0x00000000076F0000-0x000000000772E000-memory.dmp family_redline behavioral1/memory/2144-181-0x00000000076F0000-0x000000000772E000-memory.dmp family_redline behavioral1/memory/2144-183-0x00000000076F0000-0x000000000772E000-memory.dmp family_redline behavioral1/memory/2144-178-0x00000000076F0000-0x000000000772E000-memory.dmp family_redline behavioral1/memory/2144-185-0x00000000076F0000-0x000000000772E000-memory.dmp family_redline behavioral1/memory/2144-187-0x00000000076F0000-0x000000000772E000-memory.dmp family_redline behavioral1/memory/2144-189-0x00000000076F0000-0x000000000772E000-memory.dmp family_redline behavioral1/memory/2144-191-0x00000000076F0000-0x000000000772E000-memory.dmp family_redline behavioral1/memory/2144-193-0x00000000076F0000-0x000000000772E000-memory.dmp family_redline behavioral1/memory/2144-195-0x00000000076F0000-0x000000000772E000-memory.dmp family_redline behavioral1/memory/2144-197-0x00000000076F0000-0x000000000772E000-memory.dmp family_redline behavioral1/memory/2144-199-0x00000000076F0000-0x000000000772E000-memory.dmp family_redline behavioral1/memory/2144-201-0x00000000076F0000-0x000000000772E000-memory.dmp family_redline behavioral1/memory/2144-203-0x00000000076F0000-0x000000000772E000-memory.dmp family_redline behavioral1/memory/2144-205-0x00000000076F0000-0x000000000772E000-memory.dmp family_redline behavioral1/memory/2144-207-0x00000000076F0000-0x000000000772E000-memory.dmp family_redline behavioral1/memory/2144-209-0x00000000076F0000-0x000000000772E000-memory.dmp family_redline behavioral1/memory/2144-211-0x00000000076F0000-0x000000000772E000-memory.dmp family_redline behavioral1/memory/2144-213-0x00000000076F0000-0x000000000772E000-memory.dmp family_redline behavioral1/memory/2144-215-0x00000000076F0000-0x000000000772E000-memory.dmp family_redline behavioral1/memory/2144-217-0x00000000076F0000-0x000000000772E000-memory.dmp family_redline behavioral1/memory/2144-219-0x00000000076F0000-0x000000000772E000-memory.dmp family_redline behavioral1/memory/2144-221-0x00000000076F0000-0x000000000772E000-memory.dmp family_redline behavioral1/memory/2144-1072-0x0000000007130000-0x0000000007140000-memory.dmp family_redline behavioral1/memory/2144-1073-0x0000000007130000-0x0000000007140000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
niba2862.exeh75cW96.exeiffbJ25.exel53VG69.exepid process 2364 niba2862.exe 4960 h75cW96.exe 2144 iffbJ25.exe 2720 l53VG69.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
h75cW96.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" h75cW96.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
niba2862.exe40a5d2004a3e94bed03f0d0b05e1f37dda638fbfbd865f3a87e96be66538fc76.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" niba2862.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 40a5d2004a3e94bed03f0d0b05e1f37dda638fbfbd865f3a87e96be66538fc76.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 40a5d2004a3e94bed03f0d0b05e1f37dda638fbfbd865f3a87e96be66538fc76.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce niba2862.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2952 2144 WerFault.exe iffbJ25.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
h75cW96.exeiffbJ25.exel53VG69.exepid process 4960 h75cW96.exe 4960 h75cW96.exe 2144 iffbJ25.exe 2144 iffbJ25.exe 2720 l53VG69.exe 2720 l53VG69.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
h75cW96.exeiffbJ25.exel53VG69.exedescription pid process Token: SeDebugPrivilege 4960 h75cW96.exe Token: SeDebugPrivilege 2144 iffbJ25.exe Token: SeDebugPrivilege 2720 l53VG69.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
40a5d2004a3e94bed03f0d0b05e1f37dda638fbfbd865f3a87e96be66538fc76.exeniba2862.exedescription pid process target process PID 1776 wrote to memory of 2364 1776 40a5d2004a3e94bed03f0d0b05e1f37dda638fbfbd865f3a87e96be66538fc76.exe niba2862.exe PID 1776 wrote to memory of 2364 1776 40a5d2004a3e94bed03f0d0b05e1f37dda638fbfbd865f3a87e96be66538fc76.exe niba2862.exe PID 1776 wrote to memory of 2364 1776 40a5d2004a3e94bed03f0d0b05e1f37dda638fbfbd865f3a87e96be66538fc76.exe niba2862.exe PID 2364 wrote to memory of 4960 2364 niba2862.exe h75cW96.exe PID 2364 wrote to memory of 4960 2364 niba2862.exe h75cW96.exe PID 2364 wrote to memory of 2144 2364 niba2862.exe iffbJ25.exe PID 2364 wrote to memory of 2144 2364 niba2862.exe iffbJ25.exe PID 2364 wrote to memory of 2144 2364 niba2862.exe iffbJ25.exe PID 1776 wrote to memory of 2720 1776 40a5d2004a3e94bed03f0d0b05e1f37dda638fbfbd865f3a87e96be66538fc76.exe l53VG69.exe PID 1776 wrote to memory of 2720 1776 40a5d2004a3e94bed03f0d0b05e1f37dda638fbfbd865f3a87e96be66538fc76.exe l53VG69.exe PID 1776 wrote to memory of 2720 1776 40a5d2004a3e94bed03f0d0b05e1f37dda638fbfbd865f3a87e96be66538fc76.exe l53VG69.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\40a5d2004a3e94bed03f0d0b05e1f37dda638fbfbd865f3a87e96be66538fc76.exe"C:\Users\Admin\AppData\Local\Temp\40a5d2004a3e94bed03f0d0b05e1f37dda638fbfbd865f3a87e96be66538fc76.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba2862.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba2862.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h75cW96.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h75cW96.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iffbJ25.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iffbJ25.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 13484⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l53VG69.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l53VG69.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2144 -ip 21441⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l53VG69.exeFilesize
175KB
MD5834e79ce5b49bb7bc25edd39928edd0d
SHA19e4f3409d2c6b8227a915cbe02c6c5d743ef2abb
SHA2563ecc77ed05720896aabce3b251ccc35d2fe651c21132d1d5dd09e7ac5d0615fe
SHA512b7cebd169f45874eb23779661358e094085e85ba421007ef2f569e38a7174235d6c0326d8eef25c629483916852519d871dfe0135b85ed1113345948b18ed637
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l53VG69.exeFilesize
175KB
MD5834e79ce5b49bb7bc25edd39928edd0d
SHA19e4f3409d2c6b8227a915cbe02c6c5d743ef2abb
SHA2563ecc77ed05720896aabce3b251ccc35d2fe651c21132d1d5dd09e7ac5d0615fe
SHA512b7cebd169f45874eb23779661358e094085e85ba421007ef2f569e38a7174235d6c0326d8eef25c629483916852519d871dfe0135b85ed1113345948b18ed637
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba2862.exeFilesize
397KB
MD521b4294df9441dbc0767507e55351c7b
SHA19b78f043287f36e4812ac282c637edb9a74536c8
SHA2565b988f12e7fbfcd2001f881364a9344666558c674f37ff5859ffad69eac3a129
SHA51296978ed2ad998280d8189df228b6c050bf790bc5ff71d396f145521bee616b7d938f40c14fa6e25912fc6e081244486f16862a3b4e90734b1cd015f48dd0f777
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba2862.exeFilesize
397KB
MD521b4294df9441dbc0767507e55351c7b
SHA19b78f043287f36e4812ac282c637edb9a74536c8
SHA2565b988f12e7fbfcd2001f881364a9344666558c674f37ff5859ffad69eac3a129
SHA51296978ed2ad998280d8189df228b6c050bf790bc5ff71d396f145521bee616b7d938f40c14fa6e25912fc6e081244486f16862a3b4e90734b1cd015f48dd0f777
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h75cW96.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h75cW96.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iffbJ25.exeFilesize
356KB
MD53544c4a2326ed1c72da34b01146fe0e8
SHA1cc682758102e7b8db408db26929cc4cb563c664e
SHA256aa598715b0852d39b9603b0816418d02e1998b830e0e2d023f18e9b49fe07270
SHA51251a6647e90d836ab17dca8e12e235e325fa5ca42a722f1e99ebbed67f03ad207c37affa3c93472ce988679035b329238055d62997442f064e7b4a95f3fe472ee
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iffbJ25.exeFilesize
356KB
MD53544c4a2326ed1c72da34b01146fe0e8
SHA1cc682758102e7b8db408db26929cc4cb563c664e
SHA256aa598715b0852d39b9603b0816418d02e1998b830e0e2d023f18e9b49fe07270
SHA51251a6647e90d836ab17dca8e12e235e325fa5ca42a722f1e99ebbed67f03ad207c37affa3c93472ce988679035b329238055d62997442f064e7b4a95f3fe472ee
-
memory/2144-153-0x0000000002C60000-0x0000000002CAB000-memory.dmpFilesize
300KB
-
memory/2144-154-0x0000000007140000-0x00000000076E4000-memory.dmpFilesize
5.6MB
-
memory/2144-155-0x00000000076F0000-0x000000000772E000-memory.dmpFilesize
248KB
-
memory/2144-156-0x00000000076F0000-0x000000000772E000-memory.dmpFilesize
248KB
-
memory/2144-158-0x00000000076F0000-0x000000000772E000-memory.dmpFilesize
248KB
-
memory/2144-160-0x00000000076F0000-0x000000000772E000-memory.dmpFilesize
248KB
-
memory/2144-162-0x00000000076F0000-0x000000000772E000-memory.dmpFilesize
248KB
-
memory/2144-164-0x00000000076F0000-0x000000000772E000-memory.dmpFilesize
248KB
-
memory/2144-166-0x00000000076F0000-0x000000000772E000-memory.dmpFilesize
248KB
-
memory/2144-168-0x00000000076F0000-0x000000000772E000-memory.dmpFilesize
248KB
-
memory/2144-170-0x00000000076F0000-0x000000000772E000-memory.dmpFilesize
248KB
-
memory/2144-172-0x00000000076F0000-0x000000000772E000-memory.dmpFilesize
248KB
-
memory/2144-175-0x0000000007130000-0x0000000007140000-memory.dmpFilesize
64KB
-
memory/2144-174-0x00000000076F0000-0x000000000772E000-memory.dmpFilesize
248KB
-
memory/2144-176-0x0000000007130000-0x0000000007140000-memory.dmpFilesize
64KB
-
memory/2144-181-0x00000000076F0000-0x000000000772E000-memory.dmpFilesize
248KB
-
memory/2144-183-0x00000000076F0000-0x000000000772E000-memory.dmpFilesize
248KB
-
memory/2144-179-0x0000000007130000-0x0000000007140000-memory.dmpFilesize
64KB
-
memory/2144-178-0x00000000076F0000-0x000000000772E000-memory.dmpFilesize
248KB
-
memory/2144-185-0x00000000076F0000-0x000000000772E000-memory.dmpFilesize
248KB
-
memory/2144-187-0x00000000076F0000-0x000000000772E000-memory.dmpFilesize
248KB
-
memory/2144-189-0x00000000076F0000-0x000000000772E000-memory.dmpFilesize
248KB
-
memory/2144-191-0x00000000076F0000-0x000000000772E000-memory.dmpFilesize
248KB
-
memory/2144-193-0x00000000076F0000-0x000000000772E000-memory.dmpFilesize
248KB
-
memory/2144-195-0x00000000076F0000-0x000000000772E000-memory.dmpFilesize
248KB
-
memory/2144-197-0x00000000076F0000-0x000000000772E000-memory.dmpFilesize
248KB
-
memory/2144-199-0x00000000076F0000-0x000000000772E000-memory.dmpFilesize
248KB
-
memory/2144-201-0x00000000076F0000-0x000000000772E000-memory.dmpFilesize
248KB
-
memory/2144-203-0x00000000076F0000-0x000000000772E000-memory.dmpFilesize
248KB
-
memory/2144-205-0x00000000076F0000-0x000000000772E000-memory.dmpFilesize
248KB
-
memory/2144-207-0x00000000076F0000-0x000000000772E000-memory.dmpFilesize
248KB
-
memory/2144-209-0x00000000076F0000-0x000000000772E000-memory.dmpFilesize
248KB
-
memory/2144-211-0x00000000076F0000-0x000000000772E000-memory.dmpFilesize
248KB
-
memory/2144-213-0x00000000076F0000-0x000000000772E000-memory.dmpFilesize
248KB
-
memory/2144-215-0x00000000076F0000-0x000000000772E000-memory.dmpFilesize
248KB
-
memory/2144-217-0x00000000076F0000-0x000000000772E000-memory.dmpFilesize
248KB
-
memory/2144-219-0x00000000076F0000-0x000000000772E000-memory.dmpFilesize
248KB
-
memory/2144-221-0x00000000076F0000-0x000000000772E000-memory.dmpFilesize
248KB
-
memory/2144-1064-0x00000000078D0000-0x0000000007EE8000-memory.dmpFilesize
6.1MB
-
memory/2144-1065-0x0000000007F70000-0x000000000807A000-memory.dmpFilesize
1.0MB
-
memory/2144-1066-0x00000000080B0000-0x00000000080C2000-memory.dmpFilesize
72KB
-
memory/2144-1067-0x00000000080D0000-0x000000000810C000-memory.dmpFilesize
240KB
-
memory/2144-1068-0x0000000007130000-0x0000000007140000-memory.dmpFilesize
64KB
-
memory/2144-1070-0x00000000083C0000-0x0000000008452000-memory.dmpFilesize
584KB
-
memory/2144-1071-0x0000000008460000-0x00000000084C6000-memory.dmpFilesize
408KB
-
memory/2144-1072-0x0000000007130000-0x0000000007140000-memory.dmpFilesize
64KB
-
memory/2144-1073-0x0000000007130000-0x0000000007140000-memory.dmpFilesize
64KB
-
memory/2144-1074-0x0000000007130000-0x0000000007140000-memory.dmpFilesize
64KB
-
memory/2144-1075-0x0000000008B60000-0x0000000008BD6000-memory.dmpFilesize
472KB
-
memory/2144-1076-0x0000000008BF0000-0x0000000008C40000-memory.dmpFilesize
320KB
-
memory/2144-1077-0x0000000008C70000-0x0000000008E32000-memory.dmpFilesize
1.8MB
-
memory/2144-1078-0x0000000008E40000-0x000000000936C000-memory.dmpFilesize
5.2MB
-
memory/2144-1079-0x0000000007130000-0x0000000007140000-memory.dmpFilesize
64KB
-
memory/2720-1085-0x0000000000900000-0x0000000000932000-memory.dmpFilesize
200KB
-
memory/2720-1086-0x0000000005260000-0x0000000005270000-memory.dmpFilesize
64KB
-
memory/2720-1087-0x0000000005260000-0x0000000005270000-memory.dmpFilesize
64KB
-
memory/4960-147-0x0000000000FF0000-0x0000000000FFA000-memory.dmpFilesize
40KB