Analysis
-
max time kernel
154s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
24-03-2023 19:29
Static task
static1
Behavioral task
behavioral1
Sample
99b621b7dc92e2b1797578a2152a8c442420dce0ec9261a9d9818204a4ad8c0a.exe
Resource
win10v2004-20230220-en
General
-
Target
99b621b7dc92e2b1797578a2152a8c442420dce0ec9261a9d9818204a4ad8c0a.exe
-
Size
553KB
-
MD5
e09a6b6c3239f159bd28a4f0a68468e9
-
SHA1
7f41df980be59780f194d21a530692717289dadf
-
SHA256
99b621b7dc92e2b1797578a2152a8c442420dce0ec9261a9d9818204a4ad8c0a
-
SHA512
a02fe0eeb0faa9f79e640d2deae812628e7938baada7d9755bf169c083c95079d37486afb3eab91740b20898251721e0d5241216e17d46cd8d77218190d563c2
-
SSDEEP
12288:aMrFy90dSDOPVCOggBNMlqH9JeKykFJso33Q:zyHgqi3A
Malware Config
Extracted
redline
boris
193.233.20.32:4125
-
auth_value
766b5bdf6dbefcf7ca223351952fc38f
Extracted
redline
gena
193.233.20.32:4125
-
auth_value
93c20961cb6b06b2d5781c212db6201e
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro9949.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro9949.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro9949.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro9949.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection pro9949.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro9949.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
resource yara_rule behavioral1/memory/2256-157-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/2256-160-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/2256-158-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/2256-162-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/2256-164-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/2256-166-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/2256-168-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/2256-170-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/2256-172-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/2256-174-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/2256-176-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/2256-178-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/2256-180-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/2256-182-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/2256-184-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/2256-186-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/2256-188-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/2256-190-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/2256-192-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/2256-194-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/2256-196-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/2256-198-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/2256-200-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/2256-202-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/2256-204-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/2256-206-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/2256-208-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/2256-212-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/2256-210-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/2256-214-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/2256-216-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/2256-218-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline behavioral1/memory/2256-220-0x0000000004E20000-0x0000000004E5F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
pid Process 5044 unio6885.exe 4416 pro9949.exe 2256 qu2073.exe 948 si347530.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" pro9949.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" unio6885.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 99b621b7dc92e2b1797578a2152a8c442420dce0ec9261a9d9818204a4ad8c0a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 99b621b7dc92e2b1797578a2152a8c442420dce0ec9261a9d9818204a4ad8c0a.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce unio6885.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
pid pid_target Process procid_target 3672 2256 WerFault.exe 91 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4416 pro9949.exe 4416 pro9949.exe 2256 qu2073.exe 2256 qu2073.exe 948 si347530.exe 948 si347530.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4416 pro9949.exe Token: SeDebugPrivilege 2256 qu2073.exe Token: SeDebugPrivilege 948 si347530.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3088 wrote to memory of 5044 3088 99b621b7dc92e2b1797578a2152a8c442420dce0ec9261a9d9818204a4ad8c0a.exe 85 PID 3088 wrote to memory of 5044 3088 99b621b7dc92e2b1797578a2152a8c442420dce0ec9261a9d9818204a4ad8c0a.exe 85 PID 3088 wrote to memory of 5044 3088 99b621b7dc92e2b1797578a2152a8c442420dce0ec9261a9d9818204a4ad8c0a.exe 85 PID 5044 wrote to memory of 4416 5044 unio6885.exe 86 PID 5044 wrote to memory of 4416 5044 unio6885.exe 86 PID 5044 wrote to memory of 2256 5044 unio6885.exe 91 PID 5044 wrote to memory of 2256 5044 unio6885.exe 91 PID 5044 wrote to memory of 2256 5044 unio6885.exe 91 PID 3088 wrote to memory of 948 3088 99b621b7dc92e2b1797578a2152a8c442420dce0ec9261a9d9818204a4ad8c0a.exe 98 PID 3088 wrote to memory of 948 3088 99b621b7dc92e2b1797578a2152a8c442420dce0ec9261a9d9818204a4ad8c0a.exe 98 PID 3088 wrote to memory of 948 3088 99b621b7dc92e2b1797578a2152a8c442420dce0ec9261a9d9818204a4ad8c0a.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\99b621b7dc92e2b1797578a2152a8c442420dce0ec9261a9d9818204a4ad8c0a.exe"C:\Users\Admin\AppData\Local\Temp\99b621b7dc92e2b1797578a2152a8c442420dce0ec9261a9d9818204a4ad8c0a.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio6885.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio6885.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9949.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9949.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4416
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2073.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2073.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2256 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 13604⤵
- Program crash
PID:3672
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si347530.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si347530.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:948
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2256 -ip 22561⤵PID:3964
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD5f50023c2c4bad1bbf51efde95c575b28
SHA19e02fe5ecc82f471d8c078a0d4b9ce02fdf69ce1
SHA256a491d4a9a89a7103f18f402d20df34f1ae56d18bc779ff8a4681f52a3e65cbdb
SHA512d869c3c475811fdce251a700556018d98c639c28ec838f31e0fb3a9f91743843393d77735f14b992a7407356d109b680e2b9687385bae2ed7ffaef88b7c9fa57
-
Filesize
175KB
MD5f50023c2c4bad1bbf51efde95c575b28
SHA19e02fe5ecc82f471d8c078a0d4b9ce02fdf69ce1
SHA256a491d4a9a89a7103f18f402d20df34f1ae56d18bc779ff8a4681f52a3e65cbdb
SHA512d869c3c475811fdce251a700556018d98c639c28ec838f31e0fb3a9f91743843393d77735f14b992a7407356d109b680e2b9687385bae2ed7ffaef88b7c9fa57
-
Filesize
411KB
MD5e01d679d95e6edde6091b607ae644b20
SHA1174fbfa4aee1b55d5d91ec6465475ccb82e7c3b9
SHA25650923c6481c90e8aafbeafb0b1d021e867796db3b4a40c539c5ad1d87f5900af
SHA512d755dd9f7ae0e66517b43cd410bdd75469496cb4ca72f5a5c2c31f360746fcd3a651b5b17ecd1202521bf35f8b99ed752907e4845566b0f1defc2b37532c41f1
-
Filesize
411KB
MD5e01d679d95e6edde6091b607ae644b20
SHA1174fbfa4aee1b55d5d91ec6465475ccb82e7c3b9
SHA25650923c6481c90e8aafbeafb0b1d021e867796db3b4a40c539c5ad1d87f5900af
SHA512d755dd9f7ae0e66517b43cd410bdd75469496cb4ca72f5a5c2c31f360746fcd3a651b5b17ecd1202521bf35f8b99ed752907e4845566b0f1defc2b37532c41f1
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
386KB
MD5675175575065baf4d73fc4d9bd4e58b1
SHA150cdd0631b5be522d146c27594804154b6fedfaa
SHA25651b1b8ccb09991ac7d3dd4f440d2d78705693d5d17a8928d697ff67dc33c4c72
SHA512c928df2a26510a693fadc16765d77d56619bf378be292740e171738fbdc51cfd6964b3f45b35f670bcf7c7773c7be7419a3dad8bdc0b6a248b307e129e860f11
-
Filesize
386KB
MD5675175575065baf4d73fc4d9bd4e58b1
SHA150cdd0631b5be522d146c27594804154b6fedfaa
SHA25651b1b8ccb09991ac7d3dd4f440d2d78705693d5d17a8928d697ff67dc33c4c72
SHA512c928df2a26510a693fadc16765d77d56619bf378be292740e171738fbdc51cfd6964b3f45b35f670bcf7c7773c7be7419a3dad8bdc0b6a248b307e129e860f11