Analysis
-
max time kernel
85s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
24-03-2023 11:07
Static task
static1
Behavioral task
behavioral1
Sample
cb8b41fbef8c9d620b994ec15c8215dcd24df38651a4833aa9939780013410d0.exe
Resource
win10v2004-20230220-en
General
-
Target
cb8b41fbef8c9d620b994ec15c8215dcd24df38651a4833aa9939780013410d0.exe
-
Size
539KB
-
MD5
c83182ec9e206ed0f89fca5e71e5153c
-
SHA1
e049322681ff262272d97b48433cddc673864021
-
SHA256
cb8b41fbef8c9d620b994ec15c8215dcd24df38651a4833aa9939780013410d0
-
SHA512
ec0b178f74c02049e99e6bc614d716b27fc08db73dda759223078ee9c109aef51d19e14cb1c19d75cb61f80edc1471981f80edd68cc3fe33c25ced05f3c038e0
-
SSDEEP
12288:FMrYy90+1ZLgxndTmz/5sxOBUNc1AgsxL4Dn+FceygC:xyJOoDOc1AB3FceyH
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
hero
193.233.20.31:4125
-
auth_value
11f3c75a88ca461bcc8d6bf60a1193e3
Signatures
-
Processes:
pro9000.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection pro9000.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro9000.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro9000.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro9000.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro9000.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro9000.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/1844-158-0x0000000007710000-0x000000000774E000-memory.dmp family_redline behavioral1/memory/1844-157-0x0000000007710000-0x000000000774E000-memory.dmp family_redline behavioral1/memory/1844-160-0x0000000007710000-0x000000000774E000-memory.dmp family_redline behavioral1/memory/1844-162-0x0000000007710000-0x000000000774E000-memory.dmp family_redline behavioral1/memory/1844-164-0x0000000007710000-0x000000000774E000-memory.dmp family_redline behavioral1/memory/1844-166-0x0000000007710000-0x000000000774E000-memory.dmp family_redline behavioral1/memory/1844-168-0x0000000007710000-0x000000000774E000-memory.dmp family_redline behavioral1/memory/1844-170-0x0000000007710000-0x000000000774E000-memory.dmp family_redline behavioral1/memory/1844-172-0x0000000007710000-0x000000000774E000-memory.dmp family_redline behavioral1/memory/1844-174-0x0000000007710000-0x000000000774E000-memory.dmp family_redline behavioral1/memory/1844-176-0x0000000007710000-0x000000000774E000-memory.dmp family_redline behavioral1/memory/1844-178-0x0000000007710000-0x000000000774E000-memory.dmp family_redline behavioral1/memory/1844-180-0x0000000007710000-0x000000000774E000-memory.dmp family_redline behavioral1/memory/1844-182-0x0000000007710000-0x000000000774E000-memory.dmp family_redline behavioral1/memory/1844-184-0x0000000007710000-0x000000000774E000-memory.dmp family_redline behavioral1/memory/1844-186-0x0000000007710000-0x000000000774E000-memory.dmp family_redline behavioral1/memory/1844-188-0x0000000007710000-0x000000000774E000-memory.dmp family_redline behavioral1/memory/1844-190-0x0000000007710000-0x000000000774E000-memory.dmp family_redline behavioral1/memory/1844-192-0x0000000007710000-0x000000000774E000-memory.dmp family_redline behavioral1/memory/1844-194-0x0000000007710000-0x000000000774E000-memory.dmp family_redline behavioral1/memory/1844-196-0x0000000007710000-0x000000000774E000-memory.dmp family_redline behavioral1/memory/1844-198-0x0000000007710000-0x000000000774E000-memory.dmp family_redline behavioral1/memory/1844-200-0x0000000007710000-0x000000000774E000-memory.dmp family_redline behavioral1/memory/1844-202-0x0000000007710000-0x000000000774E000-memory.dmp family_redline behavioral1/memory/1844-204-0x0000000007710000-0x000000000774E000-memory.dmp family_redline behavioral1/memory/1844-206-0x0000000007710000-0x000000000774E000-memory.dmp family_redline behavioral1/memory/1844-208-0x0000000007710000-0x000000000774E000-memory.dmp family_redline behavioral1/memory/1844-210-0x0000000007710000-0x000000000774E000-memory.dmp family_redline behavioral1/memory/1844-212-0x0000000007710000-0x000000000774E000-memory.dmp family_redline behavioral1/memory/1844-214-0x0000000007710000-0x000000000774E000-memory.dmp family_redline behavioral1/memory/1844-216-0x0000000007710000-0x000000000774E000-memory.dmp family_redline behavioral1/memory/1844-218-0x0000000007710000-0x000000000774E000-memory.dmp family_redline behavioral1/memory/1844-220-0x0000000007710000-0x000000000774E000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
unio6424.exepro9000.exequ5071.exesi546977.exepid process 1476 unio6424.exe 1088 pro9000.exe 1844 qu5071.exe 1168 si546977.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro9000.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" pro9000.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
unio6424.execb8b41fbef8c9d620b994ec15c8215dcd24df38651a4833aa9939780013410d0.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" unio6424.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce cb8b41fbef8c9d620b994ec15c8215dcd24df38651a4833aa9939780013410d0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" cb8b41fbef8c9d620b994ec15c8215dcd24df38651a4833aa9939780013410d0.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce unio6424.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4124 1844 WerFault.exe qu5071.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro9000.exequ5071.exesi546977.exepid process 1088 pro9000.exe 1088 pro9000.exe 1844 qu5071.exe 1844 qu5071.exe 1168 si546977.exe 1168 si546977.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro9000.exequ5071.exesi546977.exedescription pid process Token: SeDebugPrivilege 1088 pro9000.exe Token: SeDebugPrivilege 1844 qu5071.exe Token: SeDebugPrivilege 1168 si546977.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
cb8b41fbef8c9d620b994ec15c8215dcd24df38651a4833aa9939780013410d0.exeunio6424.exedescription pid process target process PID 4456 wrote to memory of 1476 4456 cb8b41fbef8c9d620b994ec15c8215dcd24df38651a4833aa9939780013410d0.exe unio6424.exe PID 4456 wrote to memory of 1476 4456 cb8b41fbef8c9d620b994ec15c8215dcd24df38651a4833aa9939780013410d0.exe unio6424.exe PID 4456 wrote to memory of 1476 4456 cb8b41fbef8c9d620b994ec15c8215dcd24df38651a4833aa9939780013410d0.exe unio6424.exe PID 1476 wrote to memory of 1088 1476 unio6424.exe pro9000.exe PID 1476 wrote to memory of 1088 1476 unio6424.exe pro9000.exe PID 1476 wrote to memory of 1844 1476 unio6424.exe qu5071.exe PID 1476 wrote to memory of 1844 1476 unio6424.exe qu5071.exe PID 1476 wrote to memory of 1844 1476 unio6424.exe qu5071.exe PID 4456 wrote to memory of 1168 4456 cb8b41fbef8c9d620b994ec15c8215dcd24df38651a4833aa9939780013410d0.exe si546977.exe PID 4456 wrote to memory of 1168 4456 cb8b41fbef8c9d620b994ec15c8215dcd24df38651a4833aa9939780013410d0.exe si546977.exe PID 4456 wrote to memory of 1168 4456 cb8b41fbef8c9d620b994ec15c8215dcd24df38651a4833aa9939780013410d0.exe si546977.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb8b41fbef8c9d620b994ec15c8215dcd24df38651a4833aa9939780013410d0.exe"C:\Users\Admin\AppData\Local\Temp\cb8b41fbef8c9d620b994ec15c8215dcd24df38651a4833aa9939780013410d0.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio6424.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio6424.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9000.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9000.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5071.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5071.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 16404⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si546977.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si546977.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1844 -ip 18441⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si546977.exeFilesize
175KB
MD57c11dfe7837f2079d50113de0e973682
SHA1fae072addd4d56ab67d08ab82da4aac5d7223960
SHA256442d9cc0073a6d45abbed64eb9891912091d444fe4dd368924d1b8cf7c59e65b
SHA51206085d23ead5955185736af64754c343a796af98b68c8013ba20b19a5c52eb92066698b86633d54438fe6ad5455c3c3c4625cf03d15439ab486e22388bd8cab7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si546977.exeFilesize
175KB
MD57c11dfe7837f2079d50113de0e973682
SHA1fae072addd4d56ab67d08ab82da4aac5d7223960
SHA256442d9cc0073a6d45abbed64eb9891912091d444fe4dd368924d1b8cf7c59e65b
SHA51206085d23ead5955185736af64754c343a796af98b68c8013ba20b19a5c52eb92066698b86633d54438fe6ad5455c3c3c4625cf03d15439ab486e22388bd8cab7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio6424.exeFilesize
397KB
MD5f6f582f94cd5f5b9f16466f0600ebc2e
SHA17765c73f94d6fb9348a254eab72ceae22eeb2d15
SHA2560847de4414baee8effe3895e5d71b29683261a40f977fc3bc3cd48452aa771b0
SHA512299d0d85a2e6f31c1adf11d5c90a5edbd0fbfb3480361a3ed5a5efd915589a9820e3146011a96f9487599dfd75d5172d4b6c2c45f50feaf76d99e79dc38b5833
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio6424.exeFilesize
397KB
MD5f6f582f94cd5f5b9f16466f0600ebc2e
SHA17765c73f94d6fb9348a254eab72ceae22eeb2d15
SHA2560847de4414baee8effe3895e5d71b29683261a40f977fc3bc3cd48452aa771b0
SHA512299d0d85a2e6f31c1adf11d5c90a5edbd0fbfb3480361a3ed5a5efd915589a9820e3146011a96f9487599dfd75d5172d4b6c2c45f50feaf76d99e79dc38b5833
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9000.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9000.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5071.exeFilesize
356KB
MD5ca6efd65887fe9b5a4effbfdd0c63845
SHA18d4d0433e71c8d9b8fc60453fe34601b79a116b1
SHA256752635f97eddc616d5c5007252c80c55fe45604dc1075de7b82f82010168e3e4
SHA512e5fef796b3642f407464894ff57aaeb2810ec12febee842137d2ff0ea0abbae117007742a578dc5b9b12e9d0dee259f4ee7cbc459907cb2678d5e434e5a3a0dd
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5071.exeFilesize
356KB
MD5ca6efd65887fe9b5a4effbfdd0c63845
SHA18d4d0433e71c8d9b8fc60453fe34601b79a116b1
SHA256752635f97eddc616d5c5007252c80c55fe45604dc1075de7b82f82010168e3e4
SHA512e5fef796b3642f407464894ff57aaeb2810ec12febee842137d2ff0ea0abbae117007742a578dc5b9b12e9d0dee259f4ee7cbc459907cb2678d5e434e5a3a0dd
-
memory/1088-147-0x0000000000780000-0x000000000078A000-memory.dmpFilesize
40KB
-
memory/1168-1083-0x0000000000290000-0x00000000002C2000-memory.dmpFilesize
200KB
-
memory/1168-1084-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/1844-186-0x0000000007710000-0x000000000774E000-memory.dmpFilesize
248KB
-
memory/1844-198-0x0000000007710000-0x000000000774E000-memory.dmpFilesize
248KB
-
memory/1844-154-0x0000000002B90000-0x0000000002BDB000-memory.dmpFilesize
300KB
-
memory/1844-158-0x0000000007710000-0x000000000774E000-memory.dmpFilesize
248KB
-
memory/1844-157-0x0000000007710000-0x000000000774E000-memory.dmpFilesize
248KB
-
memory/1844-156-0x00000000047E0000-0x00000000047F0000-memory.dmpFilesize
64KB
-
memory/1844-160-0x0000000007710000-0x000000000774E000-memory.dmpFilesize
248KB
-
memory/1844-162-0x0000000007710000-0x000000000774E000-memory.dmpFilesize
248KB
-
memory/1844-164-0x0000000007710000-0x000000000774E000-memory.dmpFilesize
248KB
-
memory/1844-166-0x0000000007710000-0x000000000774E000-memory.dmpFilesize
248KB
-
memory/1844-168-0x0000000007710000-0x000000000774E000-memory.dmpFilesize
248KB
-
memory/1844-170-0x0000000007710000-0x000000000774E000-memory.dmpFilesize
248KB
-
memory/1844-172-0x0000000007710000-0x000000000774E000-memory.dmpFilesize
248KB
-
memory/1844-174-0x0000000007710000-0x000000000774E000-memory.dmpFilesize
248KB
-
memory/1844-176-0x0000000007710000-0x000000000774E000-memory.dmpFilesize
248KB
-
memory/1844-178-0x0000000007710000-0x000000000774E000-memory.dmpFilesize
248KB
-
memory/1844-180-0x0000000007710000-0x000000000774E000-memory.dmpFilesize
248KB
-
memory/1844-182-0x0000000007710000-0x000000000774E000-memory.dmpFilesize
248KB
-
memory/1844-184-0x0000000007710000-0x000000000774E000-memory.dmpFilesize
248KB
-
memory/1844-153-0x0000000007160000-0x0000000007704000-memory.dmpFilesize
5.6MB
-
memory/1844-188-0x0000000007710000-0x000000000774E000-memory.dmpFilesize
248KB
-
memory/1844-190-0x0000000007710000-0x000000000774E000-memory.dmpFilesize
248KB
-
memory/1844-192-0x0000000007710000-0x000000000774E000-memory.dmpFilesize
248KB
-
memory/1844-194-0x0000000007710000-0x000000000774E000-memory.dmpFilesize
248KB
-
memory/1844-196-0x0000000007710000-0x000000000774E000-memory.dmpFilesize
248KB
-
memory/1844-155-0x00000000047E0000-0x00000000047F0000-memory.dmpFilesize
64KB
-
memory/1844-200-0x0000000007710000-0x000000000774E000-memory.dmpFilesize
248KB
-
memory/1844-202-0x0000000007710000-0x000000000774E000-memory.dmpFilesize
248KB
-
memory/1844-204-0x0000000007710000-0x000000000774E000-memory.dmpFilesize
248KB
-
memory/1844-206-0x0000000007710000-0x000000000774E000-memory.dmpFilesize
248KB
-
memory/1844-208-0x0000000007710000-0x000000000774E000-memory.dmpFilesize
248KB
-
memory/1844-210-0x0000000007710000-0x000000000774E000-memory.dmpFilesize
248KB
-
memory/1844-212-0x0000000007710000-0x000000000774E000-memory.dmpFilesize
248KB
-
memory/1844-214-0x0000000007710000-0x000000000774E000-memory.dmpFilesize
248KB
-
memory/1844-216-0x0000000007710000-0x000000000774E000-memory.dmpFilesize
248KB
-
memory/1844-218-0x0000000007710000-0x000000000774E000-memory.dmpFilesize
248KB
-
memory/1844-220-0x0000000007710000-0x000000000774E000-memory.dmpFilesize
248KB
-
memory/1844-1063-0x00000000078D0000-0x0000000007EE8000-memory.dmpFilesize
6.1MB
-
memory/1844-1064-0x0000000007F70000-0x000000000807A000-memory.dmpFilesize
1.0MB
-
memory/1844-1065-0x00000000080B0000-0x00000000080C2000-memory.dmpFilesize
72KB
-
memory/1844-1067-0x00000000080D0000-0x000000000810C000-memory.dmpFilesize
240KB
-
memory/1844-1066-0x00000000047E0000-0x00000000047F0000-memory.dmpFilesize
64KB
-
memory/1844-1068-0x00000000083C0000-0x0000000008452000-memory.dmpFilesize
584KB
-
memory/1844-1070-0x0000000008460000-0x00000000084C6000-memory.dmpFilesize
408KB
-
memory/1844-1071-0x0000000008C80000-0x0000000008E42000-memory.dmpFilesize
1.8MB
-
memory/1844-1072-0x0000000008E60000-0x000000000938C000-memory.dmpFilesize
5.2MB
-
memory/1844-1073-0x00000000047E0000-0x00000000047F0000-memory.dmpFilesize
64KB
-
memory/1844-1074-0x00000000047E0000-0x00000000047F0000-memory.dmpFilesize
64KB
-
memory/1844-1075-0x0000000009610000-0x0000000009686000-memory.dmpFilesize
472KB
-
memory/1844-1076-0x00000000096A0000-0x00000000096F0000-memory.dmpFilesize
320KB
-
memory/1844-1078-0x00000000047E0000-0x00000000047F0000-memory.dmpFilesize
64KB