Analysis
-
max time kernel
113s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
24-03-2023 10:15
Static task
static1
Behavioral task
behavioral1
Sample
42d72bed17a0641c4f0bad8e200e82f4b016b029e7aed1d4c634aad7da1ae9f6.exe
Resource
win10v2004-20230220-en
General
-
Target
42d72bed17a0641c4f0bad8e200e82f4b016b029e7aed1d4c634aad7da1ae9f6.exe
-
Size
538KB
-
MD5
b01efde9960a5f65e718f6cad76dedd0
-
SHA1
b6c525f6e5630ae4aabc7790836f37bae31fb609
-
SHA256
42d72bed17a0641c4f0bad8e200e82f4b016b029e7aed1d4c634aad7da1ae9f6
-
SHA512
a5590155e8873bcf251dff97c7e515692194359956b562a831ccb55cde4a74d42d2b38088a7dd0e49d8df1d5d10409efab27b6128e0f928f845188a0104d080c
-
SSDEEP
12288:DMrTy90/1vrjjWupydeqSe6ciCB+DsPoDYdxJI4+QWlxL4JWl0D+3bMe:oyuh/aPrPEaiYPATv4Jw0+P
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
bolt
193.233.20.31:4125
-
auth_value
29540c7bf0277243e2faf6601e15a754
Signatures
-
Processes:
h21an77.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection h21an77.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" h21an77.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" h21an77.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" h21an77.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" h21an77.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" h21an77.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
Processes:
resource yara_rule behavioral1/memory/4216-155-0x0000000007140000-0x000000000717E000-memory.dmp family_redline behavioral1/memory/4216-156-0x0000000007140000-0x000000000717E000-memory.dmp family_redline behavioral1/memory/4216-160-0x0000000007140000-0x000000000717E000-memory.dmp family_redline behavioral1/memory/4216-158-0x0000000007140000-0x000000000717E000-memory.dmp family_redline behavioral1/memory/4216-162-0x0000000007140000-0x000000000717E000-memory.dmp family_redline behavioral1/memory/4216-164-0x0000000007140000-0x000000000717E000-memory.dmp family_redline behavioral1/memory/4216-166-0x0000000007140000-0x000000000717E000-memory.dmp family_redline behavioral1/memory/4216-168-0x0000000007140000-0x000000000717E000-memory.dmp family_redline behavioral1/memory/4216-170-0x0000000007140000-0x000000000717E000-memory.dmp family_redline behavioral1/memory/4216-172-0x0000000007140000-0x000000000717E000-memory.dmp family_redline behavioral1/memory/4216-177-0x0000000007140000-0x000000000717E000-memory.dmp family_redline behavioral1/memory/4216-176-0x0000000007260000-0x0000000007270000-memory.dmp family_redline behavioral1/memory/4216-179-0x0000000007140000-0x000000000717E000-memory.dmp family_redline behavioral1/memory/4216-181-0x0000000007140000-0x000000000717E000-memory.dmp family_redline behavioral1/memory/4216-183-0x0000000007140000-0x000000000717E000-memory.dmp family_redline behavioral1/memory/4216-185-0x0000000007140000-0x000000000717E000-memory.dmp family_redline behavioral1/memory/4216-187-0x0000000007140000-0x000000000717E000-memory.dmp family_redline behavioral1/memory/4216-189-0x0000000007140000-0x000000000717E000-memory.dmp family_redline behavioral1/memory/4216-191-0x0000000007140000-0x000000000717E000-memory.dmp family_redline behavioral1/memory/4216-193-0x0000000007140000-0x000000000717E000-memory.dmp family_redline behavioral1/memory/4216-195-0x0000000007140000-0x000000000717E000-memory.dmp family_redline behavioral1/memory/4216-197-0x0000000007140000-0x000000000717E000-memory.dmp family_redline behavioral1/memory/4216-199-0x0000000007140000-0x000000000717E000-memory.dmp family_redline behavioral1/memory/4216-201-0x0000000007140000-0x000000000717E000-memory.dmp family_redline behavioral1/memory/4216-203-0x0000000007140000-0x000000000717E000-memory.dmp family_redline behavioral1/memory/4216-205-0x0000000007140000-0x000000000717E000-memory.dmp family_redline behavioral1/memory/4216-207-0x0000000007140000-0x000000000717E000-memory.dmp family_redline behavioral1/memory/4216-209-0x0000000007140000-0x000000000717E000-memory.dmp family_redline behavioral1/memory/4216-211-0x0000000007140000-0x000000000717E000-memory.dmp family_redline behavioral1/memory/4216-213-0x0000000007140000-0x000000000717E000-memory.dmp family_redline behavioral1/memory/4216-215-0x0000000007140000-0x000000000717E000-memory.dmp family_redline behavioral1/memory/4216-217-0x0000000007140000-0x000000000717E000-memory.dmp family_redline behavioral1/memory/4216-219-0x0000000007140000-0x000000000717E000-memory.dmp family_redline behavioral1/memory/4216-221-0x0000000007140000-0x000000000717E000-memory.dmp family_redline behavioral1/memory/4216-1075-0x0000000007260000-0x0000000007270000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
niba9564.exeh21an77.exeiuqYp82.exel43WJ85.exepid process 3284 niba9564.exe 756 h21an77.exe 4216 iuqYp82.exe 2212 l43WJ85.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
h21an77.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" h21an77.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
42d72bed17a0641c4f0bad8e200e82f4b016b029e7aed1d4c634aad7da1ae9f6.exeniba9564.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 42d72bed17a0641c4f0bad8e200e82f4b016b029e7aed1d4c634aad7da1ae9f6.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce niba9564.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" niba9564.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 42d72bed17a0641c4f0bad8e200e82f4b016b029e7aed1d4c634aad7da1ae9f6.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4880 4216 WerFault.exe iuqYp82.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
h21an77.exeiuqYp82.exel43WJ85.exepid process 756 h21an77.exe 756 h21an77.exe 4216 iuqYp82.exe 4216 iuqYp82.exe 2212 l43WJ85.exe 2212 l43WJ85.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
h21an77.exeiuqYp82.exel43WJ85.exedescription pid process Token: SeDebugPrivilege 756 h21an77.exe Token: SeDebugPrivilege 4216 iuqYp82.exe Token: SeDebugPrivilege 2212 l43WJ85.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
42d72bed17a0641c4f0bad8e200e82f4b016b029e7aed1d4c634aad7da1ae9f6.exeniba9564.exedescription pid process target process PID 4656 wrote to memory of 3284 4656 42d72bed17a0641c4f0bad8e200e82f4b016b029e7aed1d4c634aad7da1ae9f6.exe niba9564.exe PID 4656 wrote to memory of 3284 4656 42d72bed17a0641c4f0bad8e200e82f4b016b029e7aed1d4c634aad7da1ae9f6.exe niba9564.exe PID 4656 wrote to memory of 3284 4656 42d72bed17a0641c4f0bad8e200e82f4b016b029e7aed1d4c634aad7da1ae9f6.exe niba9564.exe PID 3284 wrote to memory of 756 3284 niba9564.exe h21an77.exe PID 3284 wrote to memory of 756 3284 niba9564.exe h21an77.exe PID 3284 wrote to memory of 4216 3284 niba9564.exe iuqYp82.exe PID 3284 wrote to memory of 4216 3284 niba9564.exe iuqYp82.exe PID 3284 wrote to memory of 4216 3284 niba9564.exe iuqYp82.exe PID 4656 wrote to memory of 2212 4656 42d72bed17a0641c4f0bad8e200e82f4b016b029e7aed1d4c634aad7da1ae9f6.exe l43WJ85.exe PID 4656 wrote to memory of 2212 4656 42d72bed17a0641c4f0bad8e200e82f4b016b029e7aed1d4c634aad7da1ae9f6.exe l43WJ85.exe PID 4656 wrote to memory of 2212 4656 42d72bed17a0641c4f0bad8e200e82f4b016b029e7aed1d4c634aad7da1ae9f6.exe l43WJ85.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\42d72bed17a0641c4f0bad8e200e82f4b016b029e7aed1d4c634aad7da1ae9f6.exe"C:\Users\Admin\AppData\Local\Temp\42d72bed17a0641c4f0bad8e200e82f4b016b029e7aed1d4c634aad7da1ae9f6.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba9564.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba9564.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h21an77.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h21an77.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:756 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iuqYp82.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iuqYp82.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4216 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 13364⤵
- Program crash
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l43WJ85.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l43WJ85.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2212
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4216 -ip 42161⤵PID:2716
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l43WJ85.exeFilesize
175KB
MD578efaf7292c2027da40635ca1aae855a
SHA1686227a48e23b382a06c74f17d9b6f36e76042fd
SHA2562f1381bbe319ee3d19b3e07704205a3d31a7ffb7b5b7c282b9d884682bc892ab
SHA51219e22ec7ad2295a1a3f4cbabb2e005df674ff3731cc33b74e175e10fcc4e482c8f0ce9c8722a8d14a0f9f9ad6e37360ce6816215512bea8324cd87a9fefc852a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l43WJ85.exeFilesize
175KB
MD578efaf7292c2027da40635ca1aae855a
SHA1686227a48e23b382a06c74f17d9b6f36e76042fd
SHA2562f1381bbe319ee3d19b3e07704205a3d31a7ffb7b5b7c282b9d884682bc892ab
SHA51219e22ec7ad2295a1a3f4cbabb2e005df674ff3731cc33b74e175e10fcc4e482c8f0ce9c8722a8d14a0f9f9ad6e37360ce6816215512bea8324cd87a9fefc852a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba9564.exeFilesize
396KB
MD5a9609cd69bfbf3b64816275012728ef3
SHA1adde4048e7714683913ec8c903cbea70aa6d0dc4
SHA256002a5b068d752852e63d7c44c418b52a126f64c26fb2b07ae24810ead21d1303
SHA512eaba10cfb76af4360892d4ec7f2f312625a9eee686a4c571db00277d783f520401926ad1ba4bc6a8f5589be658f1ec93b4458f5775ffd2ce6adee97faf3b69f9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba9564.exeFilesize
396KB
MD5a9609cd69bfbf3b64816275012728ef3
SHA1adde4048e7714683913ec8c903cbea70aa6d0dc4
SHA256002a5b068d752852e63d7c44c418b52a126f64c26fb2b07ae24810ead21d1303
SHA512eaba10cfb76af4360892d4ec7f2f312625a9eee686a4c571db00277d783f520401926ad1ba4bc6a8f5589be658f1ec93b4458f5775ffd2ce6adee97faf3b69f9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h21an77.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h21an77.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iuqYp82.exeFilesize
355KB
MD5da8b39456bd29755afae1dbec2c3123e
SHA1900589236df65ee76e7207ecec7ec3080c021843
SHA2563b413b41ba5a33b8136696fd9bc09e5018ce36b9ebf8ca4c6de1a0bce80b5263
SHA5124dfb73a3754e45d7a86a94fecef016a74979b704d3abae56df61075efe8d3727531d963ce00c4fd74a2fb4bc57d84043e5a919f3fdda3172d844205033b04559
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iuqYp82.exeFilesize
355KB
MD5da8b39456bd29755afae1dbec2c3123e
SHA1900589236df65ee76e7207ecec7ec3080c021843
SHA2563b413b41ba5a33b8136696fd9bc09e5018ce36b9ebf8ca4c6de1a0bce80b5263
SHA5124dfb73a3754e45d7a86a94fecef016a74979b704d3abae56df61075efe8d3727531d963ce00c4fd74a2fb4bc57d84043e5a919f3fdda3172d844205033b04559
-
memory/756-147-0x0000000000B50000-0x0000000000B5A000-memory.dmpFilesize
40KB
-
memory/2212-1085-0x00000000009F0000-0x0000000000A22000-memory.dmpFilesize
200KB
-
memory/2212-1086-0x0000000005330000-0x0000000005340000-memory.dmpFilesize
64KB
-
memory/4216-189-0x0000000007140000-0x000000000717E000-memory.dmpFilesize
248KB
-
memory/4216-201-0x0000000007140000-0x000000000717E000-memory.dmpFilesize
248KB
-
memory/4216-155-0x0000000007140000-0x000000000717E000-memory.dmpFilesize
248KB
-
memory/4216-156-0x0000000007140000-0x000000000717E000-memory.dmpFilesize
248KB
-
memory/4216-160-0x0000000007140000-0x000000000717E000-memory.dmpFilesize
248KB
-
memory/4216-158-0x0000000007140000-0x000000000717E000-memory.dmpFilesize
248KB
-
memory/4216-162-0x0000000007140000-0x000000000717E000-memory.dmpFilesize
248KB
-
memory/4216-164-0x0000000007140000-0x000000000717E000-memory.dmpFilesize
248KB
-
memory/4216-166-0x0000000007140000-0x000000000717E000-memory.dmpFilesize
248KB
-
memory/4216-168-0x0000000007140000-0x000000000717E000-memory.dmpFilesize
248KB
-
memory/4216-170-0x0000000007140000-0x000000000717E000-memory.dmpFilesize
248KB
-
memory/4216-172-0x0000000007140000-0x000000000717E000-memory.dmpFilesize
248KB
-
memory/4216-175-0x0000000007260000-0x0000000007270000-memory.dmpFilesize
64KB
-
memory/4216-177-0x0000000007140000-0x000000000717E000-memory.dmpFilesize
248KB
-
memory/4216-176-0x0000000007260000-0x0000000007270000-memory.dmpFilesize
64KB
-
memory/4216-173-0x0000000007260000-0x0000000007270000-memory.dmpFilesize
64KB
-
memory/4216-179-0x0000000007140000-0x000000000717E000-memory.dmpFilesize
248KB
-
memory/4216-181-0x0000000007140000-0x000000000717E000-memory.dmpFilesize
248KB
-
memory/4216-183-0x0000000007140000-0x000000000717E000-memory.dmpFilesize
248KB
-
memory/4216-185-0x0000000007140000-0x000000000717E000-memory.dmpFilesize
248KB
-
memory/4216-187-0x0000000007140000-0x000000000717E000-memory.dmpFilesize
248KB
-
memory/4216-153-0x0000000002CD0000-0x0000000002D1B000-memory.dmpFilesize
300KB
-
memory/4216-191-0x0000000007140000-0x000000000717E000-memory.dmpFilesize
248KB
-
memory/4216-193-0x0000000007140000-0x000000000717E000-memory.dmpFilesize
248KB
-
memory/4216-195-0x0000000007140000-0x000000000717E000-memory.dmpFilesize
248KB
-
memory/4216-197-0x0000000007140000-0x000000000717E000-memory.dmpFilesize
248KB
-
memory/4216-199-0x0000000007140000-0x000000000717E000-memory.dmpFilesize
248KB
-
memory/4216-154-0x0000000007270000-0x0000000007814000-memory.dmpFilesize
5.6MB
-
memory/4216-203-0x0000000007140000-0x000000000717E000-memory.dmpFilesize
248KB
-
memory/4216-205-0x0000000007140000-0x000000000717E000-memory.dmpFilesize
248KB
-
memory/4216-207-0x0000000007140000-0x000000000717E000-memory.dmpFilesize
248KB
-
memory/4216-209-0x0000000007140000-0x000000000717E000-memory.dmpFilesize
248KB
-
memory/4216-211-0x0000000007140000-0x000000000717E000-memory.dmpFilesize
248KB
-
memory/4216-213-0x0000000007140000-0x000000000717E000-memory.dmpFilesize
248KB
-
memory/4216-215-0x0000000007140000-0x000000000717E000-memory.dmpFilesize
248KB
-
memory/4216-217-0x0000000007140000-0x000000000717E000-memory.dmpFilesize
248KB
-
memory/4216-219-0x0000000007140000-0x000000000717E000-memory.dmpFilesize
248KB
-
memory/4216-221-0x0000000007140000-0x000000000717E000-memory.dmpFilesize
248KB
-
memory/4216-1064-0x0000000007820000-0x0000000007E38000-memory.dmpFilesize
6.1MB
-
memory/4216-1065-0x0000000007E40000-0x0000000007F4A000-memory.dmpFilesize
1.0MB
-
memory/4216-1066-0x0000000007F70000-0x0000000007F82000-memory.dmpFilesize
72KB
-
memory/4216-1067-0x0000000007F90000-0x0000000007FCC000-memory.dmpFilesize
240KB
-
memory/4216-1068-0x0000000007260000-0x0000000007270000-memory.dmpFilesize
64KB
-
memory/4216-1070-0x0000000008280000-0x0000000008312000-memory.dmpFilesize
584KB
-
memory/4216-1071-0x0000000008320000-0x0000000008386000-memory.dmpFilesize
408KB
-
memory/4216-1072-0x0000000008A20000-0x0000000008A96000-memory.dmpFilesize
472KB
-
memory/4216-1073-0x0000000008AB0000-0x0000000008B00000-memory.dmpFilesize
320KB
-
memory/4216-1074-0x0000000007260000-0x0000000007270000-memory.dmpFilesize
64KB
-
memory/4216-1075-0x0000000007260000-0x0000000007270000-memory.dmpFilesize
64KB
-
memory/4216-1076-0x0000000007260000-0x0000000007270000-memory.dmpFilesize
64KB
-
memory/4216-1077-0x0000000008D70000-0x0000000008F32000-memory.dmpFilesize
1.8MB
-
memory/4216-1078-0x0000000008F40000-0x000000000946C000-memory.dmpFilesize
5.2MB
-
memory/4216-1080-0x0000000007260000-0x0000000007270000-memory.dmpFilesize
64KB