Analysis
-
max time kernel
54s -
max time network
139s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
24-03-2023 10:41
Static task
static1
Behavioral task
behavioral1
Sample
df2312a047214ffe7b363c9d2c1ca1f6b31580063a83922b5982e006185d9002.exe
Resource
win10-20230220-en
General
-
Target
df2312a047214ffe7b363c9d2c1ca1f6b31580063a83922b5982e006185d9002.exe
-
Size
538KB
-
MD5
cc4e6583fb40b9a9e678133edd458910
-
SHA1
b7d0633f72c80777375f5cc9d4e2d0b0884709dc
-
SHA256
df2312a047214ffe7b363c9d2c1ca1f6b31580063a83922b5982e006185d9002
-
SHA512
2a8b75b83b0106e284d1499f9c5f45d73ddb0b3766e929956b3bb98f1ffb4ffd68af680b9848edc3925e8563f33ba11df6e1078ac92d09e462a7cc4f60d98540
-
SSDEEP
12288:6Mr+y90HrwW9GdzfGuj5Be7YrxlI4+c+R6k4O2pwf9M:gykMWuvj5Y7Y1cnF4Hpw6
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
hero
193.233.20.31:4125
-
auth_value
11f3c75a88ca461bcc8d6bf60a1193e3
Signatures
-
Processes:
pro1027.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro1027.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro1027.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro1027.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro1027.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro1027.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
Processes:
resource yara_rule behavioral1/memory/5108-137-0x0000000004C10000-0x0000000004C56000-memory.dmp family_redline behavioral1/memory/5108-139-0x0000000007110000-0x0000000007154000-memory.dmp family_redline behavioral1/memory/5108-140-0x0000000007110000-0x000000000714E000-memory.dmp family_redline behavioral1/memory/5108-141-0x0000000007110000-0x000000000714E000-memory.dmp family_redline behavioral1/memory/5108-145-0x0000000007110000-0x000000000714E000-memory.dmp family_redline behavioral1/memory/5108-147-0x0000000007110000-0x000000000714E000-memory.dmp family_redline behavioral1/memory/5108-143-0x0000000007110000-0x000000000714E000-memory.dmp family_redline behavioral1/memory/5108-149-0x0000000007110000-0x000000000714E000-memory.dmp family_redline behavioral1/memory/5108-151-0x0000000007110000-0x000000000714E000-memory.dmp family_redline behavioral1/memory/5108-155-0x0000000007110000-0x000000000714E000-memory.dmp family_redline behavioral1/memory/5108-157-0x0000000007110000-0x000000000714E000-memory.dmp family_redline behavioral1/memory/5108-153-0x0000000007110000-0x000000000714E000-memory.dmp family_redline behavioral1/memory/5108-159-0x0000000007110000-0x000000000714E000-memory.dmp family_redline behavioral1/memory/5108-166-0x0000000007110000-0x000000000714E000-memory.dmp family_redline behavioral1/memory/5108-164-0x0000000007110000-0x000000000714E000-memory.dmp family_redline behavioral1/memory/5108-168-0x0000000007110000-0x000000000714E000-memory.dmp family_redline behavioral1/memory/5108-170-0x0000000007110000-0x000000000714E000-memory.dmp family_redline behavioral1/memory/5108-172-0x0000000007110000-0x000000000714E000-memory.dmp family_redline behavioral1/memory/5108-174-0x0000000007110000-0x000000000714E000-memory.dmp family_redline behavioral1/memory/5108-176-0x0000000007110000-0x000000000714E000-memory.dmp family_redline behavioral1/memory/5108-178-0x0000000007110000-0x000000000714E000-memory.dmp family_redline behavioral1/memory/5108-180-0x0000000007110000-0x000000000714E000-memory.dmp family_redline behavioral1/memory/5108-182-0x0000000007110000-0x000000000714E000-memory.dmp family_redline behavioral1/memory/5108-184-0x0000000007110000-0x000000000714E000-memory.dmp family_redline behavioral1/memory/5108-186-0x0000000007110000-0x000000000714E000-memory.dmp family_redline behavioral1/memory/5108-188-0x0000000007110000-0x000000000714E000-memory.dmp family_redline behavioral1/memory/5108-190-0x0000000007110000-0x000000000714E000-memory.dmp family_redline behavioral1/memory/5108-192-0x0000000007110000-0x000000000714E000-memory.dmp family_redline behavioral1/memory/5108-196-0x0000000007110000-0x000000000714E000-memory.dmp family_redline behavioral1/memory/5108-194-0x0000000007110000-0x000000000714E000-memory.dmp family_redline behavioral1/memory/5108-198-0x0000000007110000-0x000000000714E000-memory.dmp family_redline behavioral1/memory/5108-200-0x0000000007110000-0x000000000714E000-memory.dmp family_redline behavioral1/memory/5108-202-0x0000000007110000-0x000000000714E000-memory.dmp family_redline behavioral1/memory/5108-204-0x0000000007110000-0x000000000714E000-memory.dmp family_redline behavioral1/memory/5108-206-0x0000000007110000-0x000000000714E000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
unio9406.exepro1027.exequ8687.exesi354314.exepid process 3548 unio9406.exe 2348 pro1027.exe 5108 qu8687.exe 1776 si354314.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro1027.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" pro1027.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
unio9406.exedf2312a047214ffe7b363c9d2c1ca1f6b31580063a83922b5982e006185d9002.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" unio9406.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce df2312a047214ffe7b363c9d2c1ca1f6b31580063a83922b5982e006185d9002.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" df2312a047214ffe7b363c9d2c1ca1f6b31580063a83922b5982e006185d9002.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce unio9406.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro1027.exequ8687.exesi354314.exepid process 2348 pro1027.exe 2348 pro1027.exe 5108 qu8687.exe 5108 qu8687.exe 1776 si354314.exe 1776 si354314.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro1027.exequ8687.exesi354314.exedescription pid process Token: SeDebugPrivilege 2348 pro1027.exe Token: SeDebugPrivilege 5108 qu8687.exe Token: SeDebugPrivilege 1776 si354314.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
df2312a047214ffe7b363c9d2c1ca1f6b31580063a83922b5982e006185d9002.exeunio9406.exedescription pid process target process PID 4124 wrote to memory of 3548 4124 df2312a047214ffe7b363c9d2c1ca1f6b31580063a83922b5982e006185d9002.exe unio9406.exe PID 4124 wrote to memory of 3548 4124 df2312a047214ffe7b363c9d2c1ca1f6b31580063a83922b5982e006185d9002.exe unio9406.exe PID 4124 wrote to memory of 3548 4124 df2312a047214ffe7b363c9d2c1ca1f6b31580063a83922b5982e006185d9002.exe unio9406.exe PID 3548 wrote to memory of 2348 3548 unio9406.exe pro1027.exe PID 3548 wrote to memory of 2348 3548 unio9406.exe pro1027.exe PID 3548 wrote to memory of 5108 3548 unio9406.exe qu8687.exe PID 3548 wrote to memory of 5108 3548 unio9406.exe qu8687.exe PID 3548 wrote to memory of 5108 3548 unio9406.exe qu8687.exe PID 4124 wrote to memory of 1776 4124 df2312a047214ffe7b363c9d2c1ca1f6b31580063a83922b5982e006185d9002.exe si354314.exe PID 4124 wrote to memory of 1776 4124 df2312a047214ffe7b363c9d2c1ca1f6b31580063a83922b5982e006185d9002.exe si354314.exe PID 4124 wrote to memory of 1776 4124 df2312a047214ffe7b363c9d2c1ca1f6b31580063a83922b5982e006185d9002.exe si354314.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\df2312a047214ffe7b363c9d2c1ca1f6b31580063a83922b5982e006185d9002.exe"C:\Users\Admin\AppData\Local\Temp\df2312a047214ffe7b363c9d2c1ca1f6b31580063a83922b5982e006185d9002.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio9406.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio9406.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1027.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1027.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8687.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8687.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si354314.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si354314.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si354314.exeFilesize
175KB
MD57c11dfe7837f2079d50113de0e973682
SHA1fae072addd4d56ab67d08ab82da4aac5d7223960
SHA256442d9cc0073a6d45abbed64eb9891912091d444fe4dd368924d1b8cf7c59e65b
SHA51206085d23ead5955185736af64754c343a796af98b68c8013ba20b19a5c52eb92066698b86633d54438fe6ad5455c3c3c4625cf03d15439ab486e22388bd8cab7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si354314.exeFilesize
175KB
MD57c11dfe7837f2079d50113de0e973682
SHA1fae072addd4d56ab67d08ab82da4aac5d7223960
SHA256442d9cc0073a6d45abbed64eb9891912091d444fe4dd368924d1b8cf7c59e65b
SHA51206085d23ead5955185736af64754c343a796af98b68c8013ba20b19a5c52eb92066698b86633d54438fe6ad5455c3c3c4625cf03d15439ab486e22388bd8cab7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio9406.exeFilesize
396KB
MD5c7ae12081775b0dc4e57de1032e3ca16
SHA1090f8f4db037cc226a738ce104a1f238d6e01bff
SHA25615beed755e36e46bf533affedb36bb98845f78eff6e3177b9e51c93999ea4577
SHA512b5eb64371dc47d80ffec09f40227ba435b80feb03be4b2e5b21506be8c54c477996e24e352f6e5b7187e12ea9746248bf978a9b1b878e82fad876391b1c1cff3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio9406.exeFilesize
396KB
MD5c7ae12081775b0dc4e57de1032e3ca16
SHA1090f8f4db037cc226a738ce104a1f238d6e01bff
SHA25615beed755e36e46bf533affedb36bb98845f78eff6e3177b9e51c93999ea4577
SHA512b5eb64371dc47d80ffec09f40227ba435b80feb03be4b2e5b21506be8c54c477996e24e352f6e5b7187e12ea9746248bf978a9b1b878e82fad876391b1c1cff3
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1027.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1027.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8687.exeFilesize
355KB
MD5a0d3cb076c2135ac301eb7e3b3c84db4
SHA1a8da9ee851c1408616d65d75d5794b9c93699293
SHA256d83edbe9992fd3b960b9e82cb4d2db2c47d217f076999df26b21aa58b5b368a1
SHA5129c18af30d389fdefab911dfec609af98851c73c26d3f60b7ff0a5a6b00db46466a645e8daac9061f83bc74aae21be6357aa8d9c5f76ea8e65de71e61c9bd5ac1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8687.exeFilesize
355KB
MD5a0d3cb076c2135ac301eb7e3b3c84db4
SHA1a8da9ee851c1408616d65d75d5794b9c93699293
SHA256d83edbe9992fd3b960b9e82cb4d2db2c47d217f076999df26b21aa58b5b368a1
SHA5129c18af30d389fdefab911dfec609af98851c73c26d3f60b7ff0a5a6b00db46466a645e8daac9061f83bc74aae21be6357aa8d9c5f76ea8e65de71e61c9bd5ac1
-
memory/1776-1071-0x0000000000A80000-0x0000000000AB2000-memory.dmpFilesize
200KB
-
memory/1776-1072-0x0000000005300000-0x000000000534B000-memory.dmpFilesize
300KB
-
memory/1776-1073-0x0000000005350000-0x0000000005360000-memory.dmpFilesize
64KB
-
memory/2348-130-0x0000000000010000-0x000000000001A000-memory.dmpFilesize
40KB
-
memory/5108-174-0x0000000007110000-0x000000000714E000-memory.dmpFilesize
248KB
-
memory/5108-184-0x0000000007110000-0x000000000714E000-memory.dmpFilesize
248KB
-
memory/5108-139-0x0000000007110000-0x0000000007154000-memory.dmpFilesize
272KB
-
memory/5108-140-0x0000000007110000-0x000000000714E000-memory.dmpFilesize
248KB
-
memory/5108-141-0x0000000007110000-0x000000000714E000-memory.dmpFilesize
248KB
-
memory/5108-145-0x0000000007110000-0x000000000714E000-memory.dmpFilesize
248KB
-
memory/5108-147-0x0000000007110000-0x000000000714E000-memory.dmpFilesize
248KB
-
memory/5108-143-0x0000000007110000-0x000000000714E000-memory.dmpFilesize
248KB
-
memory/5108-149-0x0000000007110000-0x000000000714E000-memory.dmpFilesize
248KB
-
memory/5108-151-0x0000000007110000-0x000000000714E000-memory.dmpFilesize
248KB
-
memory/5108-155-0x0000000007110000-0x000000000714E000-memory.dmpFilesize
248KB
-
memory/5108-157-0x0000000007110000-0x000000000714E000-memory.dmpFilesize
248KB
-
memory/5108-153-0x0000000007110000-0x000000000714E000-memory.dmpFilesize
248KB
-
memory/5108-159-0x0000000007110000-0x000000000714E000-memory.dmpFilesize
248KB
-
memory/5108-161-0x00000000072C0000-0x00000000072D0000-memory.dmpFilesize
64KB
-
memory/5108-160-0x00000000072C0000-0x00000000072D0000-memory.dmpFilesize
64KB
-
memory/5108-163-0x00000000072C0000-0x00000000072D0000-memory.dmpFilesize
64KB
-
memory/5108-166-0x0000000007110000-0x000000000714E000-memory.dmpFilesize
248KB
-
memory/5108-164-0x0000000007110000-0x000000000714E000-memory.dmpFilesize
248KB
-
memory/5108-168-0x0000000007110000-0x000000000714E000-memory.dmpFilesize
248KB
-
memory/5108-170-0x0000000007110000-0x000000000714E000-memory.dmpFilesize
248KB
-
memory/5108-172-0x0000000007110000-0x000000000714E000-memory.dmpFilesize
248KB
-
memory/5108-137-0x0000000004C10000-0x0000000004C56000-memory.dmpFilesize
280KB
-
memory/5108-176-0x0000000007110000-0x000000000714E000-memory.dmpFilesize
248KB
-
memory/5108-178-0x0000000007110000-0x000000000714E000-memory.dmpFilesize
248KB
-
memory/5108-180-0x0000000007110000-0x000000000714E000-memory.dmpFilesize
248KB
-
memory/5108-182-0x0000000007110000-0x000000000714E000-memory.dmpFilesize
248KB
-
memory/5108-138-0x00000000072D0000-0x00000000077CE000-memory.dmpFilesize
5.0MB
-
memory/5108-186-0x0000000007110000-0x000000000714E000-memory.dmpFilesize
248KB
-
memory/5108-188-0x0000000007110000-0x000000000714E000-memory.dmpFilesize
248KB
-
memory/5108-190-0x0000000007110000-0x000000000714E000-memory.dmpFilesize
248KB
-
memory/5108-192-0x0000000007110000-0x000000000714E000-memory.dmpFilesize
248KB
-
memory/5108-196-0x0000000007110000-0x000000000714E000-memory.dmpFilesize
248KB
-
memory/5108-194-0x0000000007110000-0x000000000714E000-memory.dmpFilesize
248KB
-
memory/5108-198-0x0000000007110000-0x000000000714E000-memory.dmpFilesize
248KB
-
memory/5108-200-0x0000000007110000-0x000000000714E000-memory.dmpFilesize
248KB
-
memory/5108-202-0x0000000007110000-0x000000000714E000-memory.dmpFilesize
248KB
-
memory/5108-204-0x0000000007110000-0x000000000714E000-memory.dmpFilesize
248KB
-
memory/5108-206-0x0000000007110000-0x000000000714E000-memory.dmpFilesize
248KB
-
memory/5108-1049-0x00000000077D0000-0x0000000007DD6000-memory.dmpFilesize
6.0MB
-
memory/5108-1050-0x0000000007DE0000-0x0000000007EEA000-memory.dmpFilesize
1.0MB
-
memory/5108-1051-0x0000000007240000-0x0000000007252000-memory.dmpFilesize
72KB
-
memory/5108-1052-0x0000000007260000-0x000000000729E000-memory.dmpFilesize
248KB
-
memory/5108-1053-0x0000000007FF0000-0x000000000803B000-memory.dmpFilesize
300KB
-
memory/5108-1054-0x00000000072C0000-0x00000000072D0000-memory.dmpFilesize
64KB
-
memory/5108-1056-0x0000000008170000-0x00000000081D6000-memory.dmpFilesize
408KB
-
memory/5108-1057-0x0000000008710000-0x00000000087A2000-memory.dmpFilesize
584KB
-
memory/5108-1058-0x00000000072C0000-0x00000000072D0000-memory.dmpFilesize
64KB
-
memory/5108-1059-0x00000000072C0000-0x00000000072D0000-memory.dmpFilesize
64KB
-
memory/5108-1060-0x00000000072C0000-0x00000000072D0000-memory.dmpFilesize
64KB
-
memory/5108-1061-0x0000000008A20000-0x0000000008A96000-memory.dmpFilesize
472KB
-
memory/5108-136-0x0000000004580000-0x00000000045CB000-memory.dmpFilesize
300KB
-
memory/5108-1062-0x0000000008AA0000-0x0000000008AF0000-memory.dmpFilesize
320KB
-
memory/5108-1063-0x00000000072C0000-0x00000000072D0000-memory.dmpFilesize
64KB
-
memory/5108-1064-0x0000000008C50000-0x0000000008E12000-memory.dmpFilesize
1.8MB
-
memory/5108-1065-0x0000000008E20000-0x000000000934C000-memory.dmpFilesize
5.2MB