Analysis
-
max time kernel
143s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
24/03/2023, 18:58
Static task
static1
Behavioral task
behavioral1
Sample
b3b3fbad4ded5b56e4b5a39566f9ed2236c63e4ade12a5999a53259a33036528.exe
Resource
win10v2004-20230220-en
General
-
Target
b3b3fbad4ded5b56e4b5a39566f9ed2236c63e4ade12a5999a53259a33036528.exe
-
Size
553KB
-
MD5
73af8637814cfe247b91630653616037
-
SHA1
e9bf44f73ff9128813c77e5db5a3e7b058f21fd9
-
SHA256
b3b3fbad4ded5b56e4b5a39566f9ed2236c63e4ade12a5999a53259a33036528
-
SHA512
41f070a0c7635ae4543ff5bd096e0c3b4169de5ed1432dd6c0afeb8f3aee27851ec148d568bd757d861f0a9b3fe13b65c4170d63fc14b10c45459ba6d15566c5
-
SSDEEP
12288:8MrHy901zffgSD2SmjnIpQXc5FdKyGiJso54TN/AJCzMv:zycP9mrHMzz54TNopv
Malware Config
Extracted
redline
boris
193.233.20.32:4125
-
auth_value
766b5bdf6dbefcf7ca223351952fc38f
Extracted
redline
gena
193.233.20.32:4125
-
auth_value
93c20961cb6b06b2d5781c212db6201e
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection pro1357.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro1357.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro1357.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro1357.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro1357.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro1357.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
resource yara_rule behavioral1/memory/3664-157-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3664-158-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3664-160-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3664-162-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3664-164-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3664-166-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3664-168-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3664-172-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3664-170-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3664-174-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3664-182-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3664-184-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3664-180-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3664-186-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3664-178-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3664-176-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3664-194-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3664-202-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3664-204-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3664-200-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3664-198-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3664-196-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3664-210-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3664-208-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3664-206-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3664-216-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3664-220-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3664-218-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3664-214-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3664-212-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3664-192-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3664-190-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3664-188-0x0000000007150000-0x000000000718F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
pid Process 4360 unio1467.exe 4132 pro1357.exe 3664 qu7175.exe 5076 si265097.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" pro1357.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce b3b3fbad4ded5b56e4b5a39566f9ed2236c63e4ade12a5999a53259a33036528.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" b3b3fbad4ded5b56e4b5a39566f9ed2236c63e4ade12a5999a53259a33036528.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce unio1467.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" unio1467.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
pid pid_target Process procid_target 880 3664 WerFault.exe 92 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4132 pro1357.exe 4132 pro1357.exe 3664 qu7175.exe 3664 qu7175.exe 5076 si265097.exe 5076 si265097.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4132 pro1357.exe Token: SeDebugPrivilege 3664 qu7175.exe Token: SeDebugPrivilege 5076 si265097.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2020 wrote to memory of 4360 2020 b3b3fbad4ded5b56e4b5a39566f9ed2236c63e4ade12a5999a53259a33036528.exe 86 PID 2020 wrote to memory of 4360 2020 b3b3fbad4ded5b56e4b5a39566f9ed2236c63e4ade12a5999a53259a33036528.exe 86 PID 2020 wrote to memory of 4360 2020 b3b3fbad4ded5b56e4b5a39566f9ed2236c63e4ade12a5999a53259a33036528.exe 86 PID 4360 wrote to memory of 4132 4360 unio1467.exe 87 PID 4360 wrote to memory of 4132 4360 unio1467.exe 87 PID 4360 wrote to memory of 3664 4360 unio1467.exe 92 PID 4360 wrote to memory of 3664 4360 unio1467.exe 92 PID 4360 wrote to memory of 3664 4360 unio1467.exe 92 PID 2020 wrote to memory of 5076 2020 b3b3fbad4ded5b56e4b5a39566f9ed2236c63e4ade12a5999a53259a33036528.exe 100 PID 2020 wrote to memory of 5076 2020 b3b3fbad4ded5b56e4b5a39566f9ed2236c63e4ade12a5999a53259a33036528.exe 100 PID 2020 wrote to memory of 5076 2020 b3b3fbad4ded5b56e4b5a39566f9ed2236c63e4ade12a5999a53259a33036528.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\b3b3fbad4ded5b56e4b5a39566f9ed2236c63e4ade12a5999a53259a33036528.exe"C:\Users\Admin\AppData\Local\Temp\b3b3fbad4ded5b56e4b5a39566f9ed2236c63e4ade12a5999a53259a33036528.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio1467.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio1467.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1357.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1357.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4132
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7175.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7175.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3664 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 18244⤵
- Program crash
PID:880
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si265097.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si265097.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5076
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3664 -ip 36641⤵PID:3160
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD5f50023c2c4bad1bbf51efde95c575b28
SHA19e02fe5ecc82f471d8c078a0d4b9ce02fdf69ce1
SHA256a491d4a9a89a7103f18f402d20df34f1ae56d18bc779ff8a4681f52a3e65cbdb
SHA512d869c3c475811fdce251a700556018d98c639c28ec838f31e0fb3a9f91743843393d77735f14b992a7407356d109b680e2b9687385bae2ed7ffaef88b7c9fa57
-
Filesize
175KB
MD5f50023c2c4bad1bbf51efde95c575b28
SHA19e02fe5ecc82f471d8c078a0d4b9ce02fdf69ce1
SHA256a491d4a9a89a7103f18f402d20df34f1ae56d18bc779ff8a4681f52a3e65cbdb
SHA512d869c3c475811fdce251a700556018d98c639c28ec838f31e0fb3a9f91743843393d77735f14b992a7407356d109b680e2b9687385bae2ed7ffaef88b7c9fa57
-
Filesize
411KB
MD5df0e5ec6ab4f55ee976916603763680d
SHA1f3db612d5231afe1f73b89d8158dab9b0d581ff5
SHA2561b55d7a5bf38f42433bb43281e63e34fe81a359602dda985b3f5139d7eebee5e
SHA5125980d79c8b95ba194fadde7ed6fbf6b5ddb1cbb12f5eda9a524798d2e972cdfc2b602cc9930682ad17e97a54510c40b5fbd6c73dbdc4a424d8f93502e9a49566
-
Filesize
411KB
MD5df0e5ec6ab4f55ee976916603763680d
SHA1f3db612d5231afe1f73b89d8158dab9b0d581ff5
SHA2561b55d7a5bf38f42433bb43281e63e34fe81a359602dda985b3f5139d7eebee5e
SHA5125980d79c8b95ba194fadde7ed6fbf6b5ddb1cbb12f5eda9a524798d2e972cdfc2b602cc9930682ad17e97a54510c40b5fbd6c73dbdc4a424d8f93502e9a49566
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
386KB
MD57d5c9a892a6a0bdca94047067593daa6
SHA19c45ac072361729e2149ee4acd6aa3e46e7a619f
SHA256d39c6a082fbded75aa1335939f8df1ad288e02becd066ce6dfd8b4d04bc4e2af
SHA5122942742722bd94f51e4ad729c7d2065bee12744522c1bbc0d33d7c226a6fa531190a03de3aaeddb8447bff9494d56e6ebfae5c8fc7cb619b5adda0e37ce96f20
-
Filesize
386KB
MD57d5c9a892a6a0bdca94047067593daa6
SHA19c45ac072361729e2149ee4acd6aa3e46e7a619f
SHA256d39c6a082fbded75aa1335939f8df1ad288e02becd066ce6dfd8b4d04bc4e2af
SHA5122942742722bd94f51e4ad729c7d2065bee12744522c1bbc0d33d7c226a6fa531190a03de3aaeddb8447bff9494d56e6ebfae5c8fc7cb619b5adda0e37ce96f20