Analysis
-
max time kernel
111s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
24-03-2023 10:29
Static task
static1
Behavioral task
behavioral1
Sample
1d5c5157b56cb0de94fca98e161b964c000148e7acd6787e74ba16e00c56ddce.exe
Resource
win10v2004-20230221-en
General
-
Target
1d5c5157b56cb0de94fca98e161b964c000148e7acd6787e74ba16e00c56ddce.exe
-
Size
539KB
-
MD5
511f3b586f518076732578b4d404f108
-
SHA1
94af9cb96bcbb88e501546de748e68195d4562de
-
SHA256
1d5c5157b56cb0de94fca98e161b964c000148e7acd6787e74ba16e00c56ddce
-
SHA512
bc0c745ba45e66b2c09075d71af31b4fdc646350647dda0c6532dbd4098058a2664b8b51c7ca91dbde0788f0d349663fc1189d8f75c695859eca063162e26465
-
SSDEEP
12288:2Mr4y90ZqrZjgqcYgujnnGvYTxtI4+cLucBVpww6CmU:CyVJ/nGvYNkuuObOU
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
hero
193.233.20.31:4125
-
auth_value
11f3c75a88ca461bcc8d6bf60a1193e3
Signatures
-
Processes:
pro1451.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro1451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro1451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro1451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection pro1451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro1451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro1451.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/4444-158-0x0000000007730000-0x000000000776E000-memory.dmp family_redline behavioral1/memory/4444-159-0x0000000007730000-0x000000000776E000-memory.dmp family_redline behavioral1/memory/4444-161-0x0000000007730000-0x000000000776E000-memory.dmp family_redline behavioral1/memory/4444-163-0x0000000007730000-0x000000000776E000-memory.dmp family_redline behavioral1/memory/4444-165-0x0000000007730000-0x000000000776E000-memory.dmp family_redline behavioral1/memory/4444-167-0x0000000007730000-0x000000000776E000-memory.dmp family_redline behavioral1/memory/4444-169-0x0000000007730000-0x000000000776E000-memory.dmp family_redline behavioral1/memory/4444-171-0x0000000007730000-0x000000000776E000-memory.dmp family_redline behavioral1/memory/4444-173-0x0000000007730000-0x000000000776E000-memory.dmp family_redline behavioral1/memory/4444-175-0x0000000007730000-0x000000000776E000-memory.dmp family_redline behavioral1/memory/4444-177-0x0000000007730000-0x000000000776E000-memory.dmp family_redline behavioral1/memory/4444-179-0x0000000007730000-0x000000000776E000-memory.dmp family_redline behavioral1/memory/4444-181-0x0000000007730000-0x000000000776E000-memory.dmp family_redline behavioral1/memory/4444-183-0x0000000007730000-0x000000000776E000-memory.dmp family_redline behavioral1/memory/4444-185-0x0000000007730000-0x000000000776E000-memory.dmp family_redline behavioral1/memory/4444-187-0x0000000007730000-0x000000000776E000-memory.dmp family_redline behavioral1/memory/4444-189-0x0000000007730000-0x000000000776E000-memory.dmp family_redline behavioral1/memory/4444-191-0x0000000007730000-0x000000000776E000-memory.dmp family_redline behavioral1/memory/4444-193-0x0000000007730000-0x000000000776E000-memory.dmp family_redline behavioral1/memory/4444-195-0x0000000007730000-0x000000000776E000-memory.dmp family_redline behavioral1/memory/4444-197-0x0000000007730000-0x000000000776E000-memory.dmp family_redline behavioral1/memory/4444-199-0x0000000007730000-0x000000000776E000-memory.dmp family_redline behavioral1/memory/4444-201-0x0000000007730000-0x000000000776E000-memory.dmp family_redline behavioral1/memory/4444-203-0x0000000007730000-0x000000000776E000-memory.dmp family_redline behavioral1/memory/4444-205-0x0000000007730000-0x000000000776E000-memory.dmp family_redline behavioral1/memory/4444-207-0x0000000007730000-0x000000000776E000-memory.dmp family_redline behavioral1/memory/4444-209-0x0000000007730000-0x000000000776E000-memory.dmp family_redline behavioral1/memory/4444-211-0x0000000007730000-0x000000000776E000-memory.dmp family_redline behavioral1/memory/4444-213-0x0000000007730000-0x000000000776E000-memory.dmp family_redline behavioral1/memory/4444-215-0x0000000007730000-0x000000000776E000-memory.dmp family_redline behavioral1/memory/4444-217-0x0000000007730000-0x000000000776E000-memory.dmp family_redline behavioral1/memory/4444-219-0x0000000007730000-0x000000000776E000-memory.dmp family_redline behavioral1/memory/4444-221-0x0000000007730000-0x000000000776E000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
unio7225.exepro1451.exequ1344.exesi046837.exepid process 2220 unio7225.exe 3656 pro1451.exe 4444 qu1344.exe 4856 si046837.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro1451.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" pro1451.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
1d5c5157b56cb0de94fca98e161b964c000148e7acd6787e74ba16e00c56ddce.exeunio7225.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 1d5c5157b56cb0de94fca98e161b964c000148e7acd6787e74ba16e00c56ddce.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1d5c5157b56cb0de94fca98e161b964c000148e7acd6787e74ba16e00c56ddce.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce unio7225.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" unio7225.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3284 4444 WerFault.exe qu1344.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro1451.exequ1344.exesi046837.exepid process 3656 pro1451.exe 3656 pro1451.exe 4444 qu1344.exe 4444 qu1344.exe 4856 si046837.exe 4856 si046837.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro1451.exequ1344.exesi046837.exedescription pid process Token: SeDebugPrivilege 3656 pro1451.exe Token: SeDebugPrivilege 4444 qu1344.exe Token: SeDebugPrivilege 4856 si046837.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
1d5c5157b56cb0de94fca98e161b964c000148e7acd6787e74ba16e00c56ddce.exeunio7225.exedescription pid process target process PID 4312 wrote to memory of 2220 4312 1d5c5157b56cb0de94fca98e161b964c000148e7acd6787e74ba16e00c56ddce.exe unio7225.exe PID 4312 wrote to memory of 2220 4312 1d5c5157b56cb0de94fca98e161b964c000148e7acd6787e74ba16e00c56ddce.exe unio7225.exe PID 4312 wrote to memory of 2220 4312 1d5c5157b56cb0de94fca98e161b964c000148e7acd6787e74ba16e00c56ddce.exe unio7225.exe PID 2220 wrote to memory of 3656 2220 unio7225.exe pro1451.exe PID 2220 wrote to memory of 3656 2220 unio7225.exe pro1451.exe PID 2220 wrote to memory of 4444 2220 unio7225.exe qu1344.exe PID 2220 wrote to memory of 4444 2220 unio7225.exe qu1344.exe PID 2220 wrote to memory of 4444 2220 unio7225.exe qu1344.exe PID 4312 wrote to memory of 4856 4312 1d5c5157b56cb0de94fca98e161b964c000148e7acd6787e74ba16e00c56ddce.exe si046837.exe PID 4312 wrote to memory of 4856 4312 1d5c5157b56cb0de94fca98e161b964c000148e7acd6787e74ba16e00c56ddce.exe si046837.exe PID 4312 wrote to memory of 4856 4312 1d5c5157b56cb0de94fca98e161b964c000148e7acd6787e74ba16e00c56ddce.exe si046837.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d5c5157b56cb0de94fca98e161b964c000148e7acd6787e74ba16e00c56ddce.exe"C:\Users\Admin\AppData\Local\Temp\1d5c5157b56cb0de94fca98e161b964c000148e7acd6787e74ba16e00c56ddce.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio7225.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio7225.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1451.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1451.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1344.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1344.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 12804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si046837.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si046837.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4444 -ip 44441⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si046837.exeFilesize
175KB
MD57c11dfe7837f2079d50113de0e973682
SHA1fae072addd4d56ab67d08ab82da4aac5d7223960
SHA256442d9cc0073a6d45abbed64eb9891912091d444fe4dd368924d1b8cf7c59e65b
SHA51206085d23ead5955185736af64754c343a796af98b68c8013ba20b19a5c52eb92066698b86633d54438fe6ad5455c3c3c4625cf03d15439ab486e22388bd8cab7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si046837.exeFilesize
175KB
MD57c11dfe7837f2079d50113de0e973682
SHA1fae072addd4d56ab67d08ab82da4aac5d7223960
SHA256442d9cc0073a6d45abbed64eb9891912091d444fe4dd368924d1b8cf7c59e65b
SHA51206085d23ead5955185736af64754c343a796af98b68c8013ba20b19a5c52eb92066698b86633d54438fe6ad5455c3c3c4625cf03d15439ab486e22388bd8cab7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio7225.exeFilesize
397KB
MD5999c985a7da714a7d344622a5794a3ef
SHA170372d0a441105acafa9960fee835b96135588fa
SHA256e3fdbf8e1e5fb875c63fda4fbd3f138e7456818727c05ec78a181057dfa0bbfd
SHA5123f6f6eb28bed3e4a42e041d606ca6953c9c47661d2cfef8ada997023e71fc3f74ea2ccce4f031f9ec7ed3b23a72c31160255e382bef38b0f1441fc3188b76333
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio7225.exeFilesize
397KB
MD5999c985a7da714a7d344622a5794a3ef
SHA170372d0a441105acafa9960fee835b96135588fa
SHA256e3fdbf8e1e5fb875c63fda4fbd3f138e7456818727c05ec78a181057dfa0bbfd
SHA5123f6f6eb28bed3e4a42e041d606ca6953c9c47661d2cfef8ada997023e71fc3f74ea2ccce4f031f9ec7ed3b23a72c31160255e382bef38b0f1441fc3188b76333
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1451.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1451.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1344.exeFilesize
355KB
MD5120027e993577b5f987bd0878df14fe6
SHA1d6930f72f11820313ab4029a993987e310026e3d
SHA2562348a0778af431314dc27b2f8b8fcea8f5192b35ed3c303558f7f8d03255ced1
SHA51219545e91502aaf2ef99fc9daf5ea724042566aea5664174c6d4ee9993ec41bf5a6318df519b30ada90d90c17d0ce4eca2dbcb6565a0386c90987b4f940ad1c2a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1344.exeFilesize
355KB
MD5120027e993577b5f987bd0878df14fe6
SHA1d6930f72f11820313ab4029a993987e310026e3d
SHA2562348a0778af431314dc27b2f8b8fcea8f5192b35ed3c303558f7f8d03255ced1
SHA51219545e91502aaf2ef99fc9daf5ea724042566aea5664174c6d4ee9993ec41bf5a6318df519b30ada90d90c17d0ce4eca2dbcb6565a0386c90987b4f940ad1c2a
-
memory/3656-147-0x00000000009F0000-0x00000000009FA000-memory.dmpFilesize
40KB
-
memory/4444-153-0x0000000007140000-0x00000000076E4000-memory.dmpFilesize
5.6MB
-
memory/4444-154-0x0000000002B90000-0x0000000002BDB000-memory.dmpFilesize
300KB
-
memory/4444-155-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB
-
memory/4444-156-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB
-
memory/4444-157-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB
-
memory/4444-158-0x0000000007730000-0x000000000776E000-memory.dmpFilesize
248KB
-
memory/4444-159-0x0000000007730000-0x000000000776E000-memory.dmpFilesize
248KB
-
memory/4444-161-0x0000000007730000-0x000000000776E000-memory.dmpFilesize
248KB
-
memory/4444-163-0x0000000007730000-0x000000000776E000-memory.dmpFilesize
248KB
-
memory/4444-165-0x0000000007730000-0x000000000776E000-memory.dmpFilesize
248KB
-
memory/4444-167-0x0000000007730000-0x000000000776E000-memory.dmpFilesize
248KB
-
memory/4444-169-0x0000000007730000-0x000000000776E000-memory.dmpFilesize
248KB
-
memory/4444-171-0x0000000007730000-0x000000000776E000-memory.dmpFilesize
248KB
-
memory/4444-173-0x0000000007730000-0x000000000776E000-memory.dmpFilesize
248KB
-
memory/4444-175-0x0000000007730000-0x000000000776E000-memory.dmpFilesize
248KB
-
memory/4444-177-0x0000000007730000-0x000000000776E000-memory.dmpFilesize
248KB
-
memory/4444-179-0x0000000007730000-0x000000000776E000-memory.dmpFilesize
248KB
-
memory/4444-181-0x0000000007730000-0x000000000776E000-memory.dmpFilesize
248KB
-
memory/4444-183-0x0000000007730000-0x000000000776E000-memory.dmpFilesize
248KB
-
memory/4444-185-0x0000000007730000-0x000000000776E000-memory.dmpFilesize
248KB
-
memory/4444-187-0x0000000007730000-0x000000000776E000-memory.dmpFilesize
248KB
-
memory/4444-189-0x0000000007730000-0x000000000776E000-memory.dmpFilesize
248KB
-
memory/4444-191-0x0000000007730000-0x000000000776E000-memory.dmpFilesize
248KB
-
memory/4444-193-0x0000000007730000-0x000000000776E000-memory.dmpFilesize
248KB
-
memory/4444-195-0x0000000007730000-0x000000000776E000-memory.dmpFilesize
248KB
-
memory/4444-197-0x0000000007730000-0x000000000776E000-memory.dmpFilesize
248KB
-
memory/4444-199-0x0000000007730000-0x000000000776E000-memory.dmpFilesize
248KB
-
memory/4444-201-0x0000000007730000-0x000000000776E000-memory.dmpFilesize
248KB
-
memory/4444-203-0x0000000007730000-0x000000000776E000-memory.dmpFilesize
248KB
-
memory/4444-205-0x0000000007730000-0x000000000776E000-memory.dmpFilesize
248KB
-
memory/4444-207-0x0000000007730000-0x000000000776E000-memory.dmpFilesize
248KB
-
memory/4444-209-0x0000000007730000-0x000000000776E000-memory.dmpFilesize
248KB
-
memory/4444-211-0x0000000007730000-0x000000000776E000-memory.dmpFilesize
248KB
-
memory/4444-213-0x0000000007730000-0x000000000776E000-memory.dmpFilesize
248KB
-
memory/4444-215-0x0000000007730000-0x000000000776E000-memory.dmpFilesize
248KB
-
memory/4444-217-0x0000000007730000-0x000000000776E000-memory.dmpFilesize
248KB
-
memory/4444-219-0x0000000007730000-0x000000000776E000-memory.dmpFilesize
248KB
-
memory/4444-221-0x0000000007730000-0x000000000776E000-memory.dmpFilesize
248KB
-
memory/4444-1064-0x00000000078D0000-0x0000000007EE8000-memory.dmpFilesize
6.1MB
-
memory/4444-1065-0x0000000007F70000-0x000000000807A000-memory.dmpFilesize
1.0MB
-
memory/4444-1066-0x00000000080B0000-0x00000000080C2000-memory.dmpFilesize
72KB
-
memory/4444-1067-0x00000000080D0000-0x000000000810C000-memory.dmpFilesize
240KB
-
memory/4444-1068-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB
-
memory/4444-1070-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB
-
memory/4444-1071-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB
-
memory/4444-1072-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB
-
memory/4444-1073-0x00000000083C0000-0x0000000008426000-memory.dmpFilesize
408KB
-
memory/4444-1074-0x0000000008B90000-0x0000000008C22000-memory.dmpFilesize
584KB
-
memory/4444-1075-0x0000000008DC0000-0x0000000008F82000-memory.dmpFilesize
1.8MB
-
memory/4444-1076-0x0000000008FA0000-0x00000000094CC000-memory.dmpFilesize
5.2MB
-
memory/4444-1077-0x0000000009760000-0x00000000097D6000-memory.dmpFilesize
472KB
-
memory/4444-1078-0x00000000097E0000-0x0000000009830000-memory.dmpFilesize
320KB
-
memory/4444-1079-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB
-
memory/4856-1085-0x0000000000F60000-0x0000000000F92000-memory.dmpFilesize
200KB
-
memory/4856-1086-0x0000000005BB0000-0x0000000005BC0000-memory.dmpFilesize
64KB