Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
24-03-2023 11:50
Static task
static1
Behavioral task
behavioral1
Sample
40c3ecb2f304438e45dbec054971255cd2aac8a109113ae2eb264174589dbd0c.exe
Resource
win10v2004-20230220-en
General
-
Target
40c3ecb2f304438e45dbec054971255cd2aac8a109113ae2eb264174589dbd0c.exe
-
Size
539KB
-
MD5
83b1b26bd2c49bffb712715c5bebff39
-
SHA1
626d82fd3b3b21d2e0f6e589e5ca2f30930fbf4d
-
SHA256
40c3ecb2f304438e45dbec054971255cd2aac8a109113ae2eb264174589dbd0c
-
SHA512
09aa377d814c80f3264fe45c3ae800987df9ecdfbf7fc26ff21401286aab0f2cf6474298a7d87117aa66eb0183da804b69b833218f7d3fa55676ca288be212dd
-
SSDEEP
12288:cMr2y903fRjozbo89UaQrCZdngLFAZ9Y+ib0m:SyGp0bBQ0dga9Yr
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
hero
193.233.20.31:4125
-
auth_value
11f3c75a88ca461bcc8d6bf60a1193e3
Signatures
-
Processes:
pro9246.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro9246.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro9246.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro9246.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection pro9246.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro9246.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro9246.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/4948-157-0x0000000004F20000-0x0000000004F5E000-memory.dmp family_redline behavioral1/memory/4948-160-0x0000000004F20000-0x0000000004F5E000-memory.dmp family_redline behavioral1/memory/4948-158-0x0000000004F20000-0x0000000004F5E000-memory.dmp family_redline behavioral1/memory/4948-162-0x0000000004F20000-0x0000000004F5E000-memory.dmp family_redline behavioral1/memory/4948-164-0x0000000004F20000-0x0000000004F5E000-memory.dmp family_redline behavioral1/memory/4948-166-0x0000000004F20000-0x0000000004F5E000-memory.dmp family_redline behavioral1/memory/4948-168-0x0000000004F20000-0x0000000004F5E000-memory.dmp family_redline behavioral1/memory/4948-170-0x0000000004F20000-0x0000000004F5E000-memory.dmp family_redline behavioral1/memory/4948-174-0x0000000004F20000-0x0000000004F5E000-memory.dmp family_redline behavioral1/memory/4948-172-0x0000000004F20000-0x0000000004F5E000-memory.dmp family_redline behavioral1/memory/4948-176-0x0000000004F20000-0x0000000004F5E000-memory.dmp family_redline behavioral1/memory/4948-178-0x0000000004F20000-0x0000000004F5E000-memory.dmp family_redline behavioral1/memory/4948-180-0x0000000004F20000-0x0000000004F5E000-memory.dmp family_redline behavioral1/memory/4948-182-0x0000000004F20000-0x0000000004F5E000-memory.dmp family_redline behavioral1/memory/4948-184-0x0000000004F20000-0x0000000004F5E000-memory.dmp family_redline behavioral1/memory/4948-186-0x0000000004F20000-0x0000000004F5E000-memory.dmp family_redline behavioral1/memory/4948-188-0x0000000004F20000-0x0000000004F5E000-memory.dmp family_redline behavioral1/memory/4948-190-0x0000000004F20000-0x0000000004F5E000-memory.dmp family_redline behavioral1/memory/4948-192-0x0000000004F20000-0x0000000004F5E000-memory.dmp family_redline behavioral1/memory/4948-194-0x0000000004F20000-0x0000000004F5E000-memory.dmp family_redline behavioral1/memory/4948-196-0x0000000004F20000-0x0000000004F5E000-memory.dmp family_redline behavioral1/memory/4948-198-0x0000000004F20000-0x0000000004F5E000-memory.dmp family_redline behavioral1/memory/4948-200-0x0000000004F20000-0x0000000004F5E000-memory.dmp family_redline behavioral1/memory/4948-202-0x0000000004F20000-0x0000000004F5E000-memory.dmp family_redline behavioral1/memory/4948-204-0x0000000004F20000-0x0000000004F5E000-memory.dmp family_redline behavioral1/memory/4948-206-0x0000000004F20000-0x0000000004F5E000-memory.dmp family_redline behavioral1/memory/4948-208-0x0000000004F20000-0x0000000004F5E000-memory.dmp family_redline behavioral1/memory/4948-210-0x0000000004F20000-0x0000000004F5E000-memory.dmp family_redline behavioral1/memory/4948-212-0x0000000004F20000-0x0000000004F5E000-memory.dmp family_redline behavioral1/memory/4948-214-0x0000000004F20000-0x0000000004F5E000-memory.dmp family_redline behavioral1/memory/4948-216-0x0000000004F20000-0x0000000004F5E000-memory.dmp family_redline behavioral1/memory/4948-218-0x0000000004F20000-0x0000000004F5E000-memory.dmp family_redline behavioral1/memory/4948-220-0x0000000004F20000-0x0000000004F5E000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
unio6917.exepro9246.exequ6746.exesi092343.exepid process 2032 unio6917.exe 2992 pro9246.exe 4948 qu6746.exe 2104 si092343.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro9246.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" pro9246.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
40c3ecb2f304438e45dbec054971255cd2aac8a109113ae2eb264174589dbd0c.exeunio6917.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 40c3ecb2f304438e45dbec054971255cd2aac8a109113ae2eb264174589dbd0c.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce unio6917.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" unio6917.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 40c3ecb2f304438e45dbec054971255cd2aac8a109113ae2eb264174589dbd0c.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1800 4948 WerFault.exe qu6746.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro9246.exequ6746.exesi092343.exepid process 2992 pro9246.exe 2992 pro9246.exe 4948 qu6746.exe 4948 qu6746.exe 2104 si092343.exe 2104 si092343.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro9246.exequ6746.exesi092343.exedescription pid process Token: SeDebugPrivilege 2992 pro9246.exe Token: SeDebugPrivilege 4948 qu6746.exe Token: SeDebugPrivilege 2104 si092343.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
40c3ecb2f304438e45dbec054971255cd2aac8a109113ae2eb264174589dbd0c.exeunio6917.exedescription pid process target process PID 1544 wrote to memory of 2032 1544 40c3ecb2f304438e45dbec054971255cd2aac8a109113ae2eb264174589dbd0c.exe unio6917.exe PID 1544 wrote to memory of 2032 1544 40c3ecb2f304438e45dbec054971255cd2aac8a109113ae2eb264174589dbd0c.exe unio6917.exe PID 1544 wrote to memory of 2032 1544 40c3ecb2f304438e45dbec054971255cd2aac8a109113ae2eb264174589dbd0c.exe unio6917.exe PID 2032 wrote to memory of 2992 2032 unio6917.exe pro9246.exe PID 2032 wrote to memory of 2992 2032 unio6917.exe pro9246.exe PID 2032 wrote to memory of 4948 2032 unio6917.exe qu6746.exe PID 2032 wrote to memory of 4948 2032 unio6917.exe qu6746.exe PID 2032 wrote to memory of 4948 2032 unio6917.exe qu6746.exe PID 1544 wrote to memory of 2104 1544 40c3ecb2f304438e45dbec054971255cd2aac8a109113ae2eb264174589dbd0c.exe si092343.exe PID 1544 wrote to memory of 2104 1544 40c3ecb2f304438e45dbec054971255cd2aac8a109113ae2eb264174589dbd0c.exe si092343.exe PID 1544 wrote to memory of 2104 1544 40c3ecb2f304438e45dbec054971255cd2aac8a109113ae2eb264174589dbd0c.exe si092343.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\40c3ecb2f304438e45dbec054971255cd2aac8a109113ae2eb264174589dbd0c.exe"C:\Users\Admin\AppData\Local\Temp\40c3ecb2f304438e45dbec054971255cd2aac8a109113ae2eb264174589dbd0c.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio6917.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio6917.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9246.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9246.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6746.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6746.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 12924⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si092343.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si092343.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4948 -ip 49481⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si092343.exeFilesize
175KB
MD57c11dfe7837f2079d50113de0e973682
SHA1fae072addd4d56ab67d08ab82da4aac5d7223960
SHA256442d9cc0073a6d45abbed64eb9891912091d444fe4dd368924d1b8cf7c59e65b
SHA51206085d23ead5955185736af64754c343a796af98b68c8013ba20b19a5c52eb92066698b86633d54438fe6ad5455c3c3c4625cf03d15439ab486e22388bd8cab7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si092343.exeFilesize
175KB
MD57c11dfe7837f2079d50113de0e973682
SHA1fae072addd4d56ab67d08ab82da4aac5d7223960
SHA256442d9cc0073a6d45abbed64eb9891912091d444fe4dd368924d1b8cf7c59e65b
SHA51206085d23ead5955185736af64754c343a796af98b68c8013ba20b19a5c52eb92066698b86633d54438fe6ad5455c3c3c4625cf03d15439ab486e22388bd8cab7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio6917.exeFilesize
397KB
MD53f5c1332a22904cd20c4d09e06bd7ce4
SHA1402fbe75292abf78027a0f97f76ae83f1b79473a
SHA256b8bfc421b4f7fae51eb0621ac163d6f1a2866a045cc922caf944eb26c1f81801
SHA512506e8548f680aff63180805a4a0386d7369a1cdca50485a6fa4ac276697fcd8e8f2c9145cb47ea4f78c958dd324f3c07224f93e5a3651ea6ae65559d85d3cedc
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio6917.exeFilesize
397KB
MD53f5c1332a22904cd20c4d09e06bd7ce4
SHA1402fbe75292abf78027a0f97f76ae83f1b79473a
SHA256b8bfc421b4f7fae51eb0621ac163d6f1a2866a045cc922caf944eb26c1f81801
SHA512506e8548f680aff63180805a4a0386d7369a1cdca50485a6fa4ac276697fcd8e8f2c9145cb47ea4f78c958dd324f3c07224f93e5a3651ea6ae65559d85d3cedc
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9246.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9246.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6746.exeFilesize
356KB
MD5d73e15c09b5c71fdc7d4f1b7d5f3b09b
SHA163ce7d6cf2a31596922ca6a17ecfdd1fa4709f3e
SHA256f12086948abadfa7b00a0f1fda7cdb7b751f9e9d834e6e84fc6b1d2f5bcb50bd
SHA51203ccc6dcf8936e9cc6d7b3644e8e69c7584c486d3f4a37f7cad9b70458665a32ae359f8cb4cede348568ea193c2052bb6669034a19f6c353bce275baf51fd688
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6746.exeFilesize
356KB
MD5d73e15c09b5c71fdc7d4f1b7d5f3b09b
SHA163ce7d6cf2a31596922ca6a17ecfdd1fa4709f3e
SHA256f12086948abadfa7b00a0f1fda7cdb7b751f9e9d834e6e84fc6b1d2f5bcb50bd
SHA51203ccc6dcf8936e9cc6d7b3644e8e69c7584c486d3f4a37f7cad9b70458665a32ae359f8cb4cede348568ea193c2052bb6669034a19f6c353bce275baf51fd688
-
memory/2104-1084-0x0000000000D70000-0x0000000000DA2000-memory.dmpFilesize
200KB
-
memory/2104-1085-0x00000000059E0000-0x00000000059F0000-memory.dmpFilesize
64KB
-
memory/2992-147-0x0000000000C80000-0x0000000000C8A000-memory.dmpFilesize
40KB
-
memory/4948-186-0x0000000004F20000-0x0000000004F5E000-memory.dmpFilesize
248KB
-
memory/4948-198-0x0000000004F20000-0x0000000004F5E000-memory.dmpFilesize
248KB
-
memory/4948-155-0x00000000073E0000-0x00000000073F0000-memory.dmpFilesize
64KB
-
memory/4948-156-0x00000000073E0000-0x00000000073F0000-memory.dmpFilesize
64KB
-
memory/4948-157-0x0000000004F20000-0x0000000004F5E000-memory.dmpFilesize
248KB
-
memory/4948-160-0x0000000004F20000-0x0000000004F5E000-memory.dmpFilesize
248KB
-
memory/4948-158-0x0000000004F20000-0x0000000004F5E000-memory.dmpFilesize
248KB
-
memory/4948-162-0x0000000004F20000-0x0000000004F5E000-memory.dmpFilesize
248KB
-
memory/4948-164-0x0000000004F20000-0x0000000004F5E000-memory.dmpFilesize
248KB
-
memory/4948-166-0x0000000004F20000-0x0000000004F5E000-memory.dmpFilesize
248KB
-
memory/4948-168-0x0000000004F20000-0x0000000004F5E000-memory.dmpFilesize
248KB
-
memory/4948-170-0x0000000004F20000-0x0000000004F5E000-memory.dmpFilesize
248KB
-
memory/4948-174-0x0000000004F20000-0x0000000004F5E000-memory.dmpFilesize
248KB
-
memory/4948-172-0x0000000004F20000-0x0000000004F5E000-memory.dmpFilesize
248KB
-
memory/4948-176-0x0000000004F20000-0x0000000004F5E000-memory.dmpFilesize
248KB
-
memory/4948-178-0x0000000004F20000-0x0000000004F5E000-memory.dmpFilesize
248KB
-
memory/4948-180-0x0000000004F20000-0x0000000004F5E000-memory.dmpFilesize
248KB
-
memory/4948-182-0x0000000004F20000-0x0000000004F5E000-memory.dmpFilesize
248KB
-
memory/4948-184-0x0000000004F20000-0x0000000004F5E000-memory.dmpFilesize
248KB
-
memory/4948-153-0x00000000073F0000-0x0000000007994000-memory.dmpFilesize
5.6MB
-
memory/4948-188-0x0000000004F20000-0x0000000004F5E000-memory.dmpFilesize
248KB
-
memory/4948-190-0x0000000004F20000-0x0000000004F5E000-memory.dmpFilesize
248KB
-
memory/4948-192-0x0000000004F20000-0x0000000004F5E000-memory.dmpFilesize
248KB
-
memory/4948-194-0x0000000004F20000-0x0000000004F5E000-memory.dmpFilesize
248KB
-
memory/4948-196-0x0000000004F20000-0x0000000004F5E000-memory.dmpFilesize
248KB
-
memory/4948-154-0x0000000002B90000-0x0000000002BDB000-memory.dmpFilesize
300KB
-
memory/4948-200-0x0000000004F20000-0x0000000004F5E000-memory.dmpFilesize
248KB
-
memory/4948-202-0x0000000004F20000-0x0000000004F5E000-memory.dmpFilesize
248KB
-
memory/4948-204-0x0000000004F20000-0x0000000004F5E000-memory.dmpFilesize
248KB
-
memory/4948-206-0x0000000004F20000-0x0000000004F5E000-memory.dmpFilesize
248KB
-
memory/4948-208-0x0000000004F20000-0x0000000004F5E000-memory.dmpFilesize
248KB
-
memory/4948-210-0x0000000004F20000-0x0000000004F5E000-memory.dmpFilesize
248KB
-
memory/4948-212-0x0000000004F20000-0x0000000004F5E000-memory.dmpFilesize
248KB
-
memory/4948-214-0x0000000004F20000-0x0000000004F5E000-memory.dmpFilesize
248KB
-
memory/4948-216-0x0000000004F20000-0x0000000004F5E000-memory.dmpFilesize
248KB
-
memory/4948-218-0x0000000004F20000-0x0000000004F5E000-memory.dmpFilesize
248KB
-
memory/4948-220-0x0000000004F20000-0x0000000004F5E000-memory.dmpFilesize
248KB
-
memory/4948-1063-0x00000000079A0000-0x0000000007FB8000-memory.dmpFilesize
6.1MB
-
memory/4948-1064-0x0000000007FC0000-0x00000000080CA000-memory.dmpFilesize
1.0MB
-
memory/4948-1065-0x00000000073C0000-0x00000000073D2000-memory.dmpFilesize
72KB
-
memory/4948-1066-0x00000000073E0000-0x00000000073F0000-memory.dmpFilesize
64KB
-
memory/4948-1067-0x00000000080D0000-0x000000000810C000-memory.dmpFilesize
240KB
-
memory/4948-1069-0x00000000083C0000-0x0000000008426000-memory.dmpFilesize
408KB
-
memory/4948-1070-0x0000000008A80000-0x0000000008B12000-memory.dmpFilesize
584KB
-
memory/4948-1071-0x00000000073E0000-0x00000000073F0000-memory.dmpFilesize
64KB
-
memory/4948-1072-0x00000000073E0000-0x00000000073F0000-memory.dmpFilesize
64KB
-
memory/4948-1073-0x00000000073E0000-0x00000000073F0000-memory.dmpFilesize
64KB
-
memory/4948-1074-0x0000000008F00000-0x0000000008F76000-memory.dmpFilesize
472KB
-
memory/4948-1075-0x0000000008F90000-0x0000000008FE0000-memory.dmpFilesize
320KB
-
memory/4948-1076-0x0000000008FF0000-0x00000000091B2000-memory.dmpFilesize
1.8MB
-
memory/4948-1077-0x00000000091C0000-0x00000000096EC000-memory.dmpFilesize
5.2MB
-
memory/4948-1078-0x00000000073E0000-0x00000000073F0000-memory.dmpFilesize
64KB