Analysis
-
max time kernel
101s -
max time network
104s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
24-03-2023 21:08
Static task
static1
Behavioral task
behavioral1
Sample
787f237765d692e18d27f764618cde4bca2b01e80b7d5d228285cdbb5541d88c.exe
Resource
win10-20230220-en
General
-
Target
787f237765d692e18d27f764618cde4bca2b01e80b7d5d228285cdbb5541d88c.exe
-
Size
554KB
-
MD5
3387524a6425912544616f7ecc770f0b
-
SHA1
bd6aa5c0f2024f4df37d4dd13665574421544c30
-
SHA256
787f237765d692e18d27f764618cde4bca2b01e80b7d5d228285cdbb5541d88c
-
SHA512
5a2b519ae75493dedcd2261aec1946c0e654b634abaa9fc8acac9ac0a3aa293abf882b25616a52bf0f6dc55cc782e5bbaec37dec27ea51fb6359e8f66d0a5485
-
SSDEEP
12288:QMrky90R3PYqgFnUxXRazGFRmN2oGfhOxh:kyAAqgxUJVnToGfhOxh
Malware Config
Extracted
redline
boris
193.233.20.32:4125
-
auth_value
766b5bdf6dbefcf7ca223351952fc38f
Extracted
redline
lida
193.233.20.32:4125
-
auth_value
24052aa2e9b85984a98d80cf08623e8d
Signatures
-
Processes:
h50HX77.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" h50HX77.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" h50HX77.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" h50HX77.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" h50HX77.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" h50HX77.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 36 IoCs
Processes:
resource yara_rule behavioral1/memory/4876-141-0x0000000004860000-0x00000000048A6000-memory.dmp family_redline behavioral1/memory/4876-145-0x0000000007100000-0x0000000007144000-memory.dmp family_redline behavioral1/memory/4876-149-0x0000000007100000-0x000000000713F000-memory.dmp family_redline behavioral1/memory/4876-148-0x0000000007100000-0x000000000713F000-memory.dmp family_redline behavioral1/memory/4876-151-0x0000000007100000-0x000000000713F000-memory.dmp family_redline behavioral1/memory/4876-153-0x0000000007100000-0x000000000713F000-memory.dmp family_redline behavioral1/memory/4876-155-0x0000000007100000-0x000000000713F000-memory.dmp family_redline behavioral1/memory/4876-157-0x0000000007100000-0x000000000713F000-memory.dmp family_redline behavioral1/memory/4876-159-0x0000000007100000-0x000000000713F000-memory.dmp family_redline behavioral1/memory/4876-161-0x0000000007100000-0x000000000713F000-memory.dmp family_redline behavioral1/memory/4876-163-0x0000000007100000-0x000000000713F000-memory.dmp family_redline behavioral1/memory/4876-165-0x0000000007100000-0x000000000713F000-memory.dmp family_redline behavioral1/memory/4876-167-0x0000000007100000-0x000000000713F000-memory.dmp family_redline behavioral1/memory/4876-169-0x0000000007100000-0x000000000713F000-memory.dmp family_redline behavioral1/memory/4876-171-0x0000000007100000-0x000000000713F000-memory.dmp family_redline behavioral1/memory/4876-173-0x0000000007100000-0x000000000713F000-memory.dmp family_redline behavioral1/memory/4876-175-0x0000000007100000-0x000000000713F000-memory.dmp family_redline behavioral1/memory/4876-177-0x0000000007100000-0x000000000713F000-memory.dmp family_redline behavioral1/memory/4876-179-0x0000000007100000-0x000000000713F000-memory.dmp family_redline behavioral1/memory/4876-181-0x0000000007100000-0x000000000713F000-memory.dmp family_redline behavioral1/memory/4876-183-0x0000000007100000-0x000000000713F000-memory.dmp family_redline behavioral1/memory/4876-185-0x0000000007100000-0x000000000713F000-memory.dmp family_redline behavioral1/memory/4876-187-0x0000000007100000-0x000000000713F000-memory.dmp family_redline behavioral1/memory/4876-189-0x0000000007100000-0x000000000713F000-memory.dmp family_redline behavioral1/memory/4876-191-0x0000000007100000-0x000000000713F000-memory.dmp family_redline behavioral1/memory/4876-193-0x0000000007100000-0x000000000713F000-memory.dmp family_redline behavioral1/memory/4876-199-0x0000000007100000-0x000000000713F000-memory.dmp family_redline behavioral1/memory/4876-197-0x0000000007100000-0x000000000713F000-memory.dmp family_redline behavioral1/memory/4876-201-0x0000000007100000-0x000000000713F000-memory.dmp family_redline behavioral1/memory/4876-195-0x0000000007100000-0x000000000713F000-memory.dmp family_redline behavioral1/memory/4876-209-0x0000000007100000-0x000000000713F000-memory.dmp family_redline behavioral1/memory/4876-211-0x0000000007100000-0x000000000713F000-memory.dmp family_redline behavioral1/memory/4876-207-0x0000000007100000-0x000000000713F000-memory.dmp family_redline behavioral1/memory/4876-205-0x0000000007100000-0x000000000713F000-memory.dmp family_redline behavioral1/memory/4876-203-0x0000000007100000-0x000000000713F000-memory.dmp family_redline behavioral1/memory/4876-1062-0x00000000072B0000-0x00000000072C0000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
niba7921.exeh50HX77.exeiTSPG31.exel72md12.exepid process 2564 niba7921.exe 428 h50HX77.exe 4876 iTSPG31.exe 3920 l72md12.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
h50HX77.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" h50HX77.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
niba7921.exe787f237765d692e18d27f764618cde4bca2b01e80b7d5d228285cdbb5541d88c.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce niba7921.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" niba7921.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 787f237765d692e18d27f764618cde4bca2b01e80b7d5d228285cdbb5541d88c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 787f237765d692e18d27f764618cde4bca2b01e80b7d5d228285cdbb5541d88c.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
h50HX77.exeiTSPG31.exel72md12.exepid process 428 h50HX77.exe 428 h50HX77.exe 4876 iTSPG31.exe 4876 iTSPG31.exe 3920 l72md12.exe 3920 l72md12.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
h50HX77.exeiTSPG31.exel72md12.exedescription pid process Token: SeDebugPrivilege 428 h50HX77.exe Token: SeDebugPrivilege 4876 iTSPG31.exe Token: SeDebugPrivilege 3920 l72md12.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
787f237765d692e18d27f764618cde4bca2b01e80b7d5d228285cdbb5541d88c.exeniba7921.exedescription pid process target process PID 2496 wrote to memory of 2564 2496 787f237765d692e18d27f764618cde4bca2b01e80b7d5d228285cdbb5541d88c.exe niba7921.exe PID 2496 wrote to memory of 2564 2496 787f237765d692e18d27f764618cde4bca2b01e80b7d5d228285cdbb5541d88c.exe niba7921.exe PID 2496 wrote to memory of 2564 2496 787f237765d692e18d27f764618cde4bca2b01e80b7d5d228285cdbb5541d88c.exe niba7921.exe PID 2564 wrote to memory of 428 2564 niba7921.exe h50HX77.exe PID 2564 wrote to memory of 428 2564 niba7921.exe h50HX77.exe PID 2564 wrote to memory of 4876 2564 niba7921.exe iTSPG31.exe PID 2564 wrote to memory of 4876 2564 niba7921.exe iTSPG31.exe PID 2564 wrote to memory of 4876 2564 niba7921.exe iTSPG31.exe PID 2496 wrote to memory of 3920 2496 787f237765d692e18d27f764618cde4bca2b01e80b7d5d228285cdbb5541d88c.exe l72md12.exe PID 2496 wrote to memory of 3920 2496 787f237765d692e18d27f764618cde4bca2b01e80b7d5d228285cdbb5541d88c.exe l72md12.exe PID 2496 wrote to memory of 3920 2496 787f237765d692e18d27f764618cde4bca2b01e80b7d5d228285cdbb5541d88c.exe l72md12.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\787f237765d692e18d27f764618cde4bca2b01e80b7d5d228285cdbb5541d88c.exe"C:\Users\Admin\AppData\Local\Temp\787f237765d692e18d27f764618cde4bca2b01e80b7d5d228285cdbb5541d88c.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba7921.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba7921.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h50HX77.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h50HX77.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iTSPG31.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iTSPG31.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l72md12.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l72md12.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l72md12.exeFilesize
175KB
MD56b06147bf5fd26306978a93fe83127a4
SHA17b14ff42f4441b985591ef5b7d4cc703f0bbcdfa
SHA25611e6d45ae92fc4505f14f550d01d97a42fba91a999b900daf843251772c755e0
SHA512603007d99e52da5739040fee891c193123dc5741985de1c3dde091dd07e759336ec749312e4ab95d05c1c6681f10e56b4e9aee67d633a97b6aa25c5119f4d6b4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l72md12.exeFilesize
175KB
MD56b06147bf5fd26306978a93fe83127a4
SHA17b14ff42f4441b985591ef5b7d4cc703f0bbcdfa
SHA25611e6d45ae92fc4505f14f550d01d97a42fba91a999b900daf843251772c755e0
SHA512603007d99e52da5739040fee891c193123dc5741985de1c3dde091dd07e759336ec749312e4ab95d05c1c6681f10e56b4e9aee67d633a97b6aa25c5119f4d6b4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba7921.exeFilesize
412KB
MD5cd19b107f864ccd222eeecddf8045497
SHA1f3eb3e33a2cbc6ceb13a3ce9e22a83dcf590181b
SHA2561a63a13ea576521ff8f87bb6c546bea3ae62af812c7168f6f12284a98bc16e22
SHA51203de3e94b29ba13ae2fad7267935b839a494ae8e7f82f2fb0022c0a43f9a4e0cd85d6c582524979fe578ad99be7cd9699ca5ce1a063f45584a77a84673f93fd5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba7921.exeFilesize
412KB
MD5cd19b107f864ccd222eeecddf8045497
SHA1f3eb3e33a2cbc6ceb13a3ce9e22a83dcf590181b
SHA2561a63a13ea576521ff8f87bb6c546bea3ae62af812c7168f6f12284a98bc16e22
SHA51203de3e94b29ba13ae2fad7267935b839a494ae8e7f82f2fb0022c0a43f9a4e0cd85d6c582524979fe578ad99be7cd9699ca5ce1a063f45584a77a84673f93fd5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h50HX77.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h50HX77.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iTSPG31.exeFilesize
387KB
MD54e196b7806192e734a8f3c280174212b
SHA1a2aceb0719a1e08998733dd5a68498c63f407e94
SHA256e5ecf5a8872a87c8dbcd11a6d6e45e9c5064e8a59bb5be28fdc80644f2395d1c
SHA512cc0d221747704654a97f23a1227f2ea436551aca8c71b648706fdbde51060e7924f9f9c7af318b33b83370e2829f429e476ad936f3a3406271a9bee61a05486d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iTSPG31.exeFilesize
387KB
MD54e196b7806192e734a8f3c280174212b
SHA1a2aceb0719a1e08998733dd5a68498c63f407e94
SHA256e5ecf5a8872a87c8dbcd11a6d6e45e9c5064e8a59bb5be28fdc80644f2395d1c
SHA512cc0d221747704654a97f23a1227f2ea436551aca8c71b648706fdbde51060e7924f9f9c7af318b33b83370e2829f429e476ad936f3a3406271a9bee61a05486d
-
memory/428-135-0x0000000000F20000-0x0000000000F2A000-memory.dmpFilesize
40KB
-
memory/3920-1075-0x0000000000690000-0x00000000006C2000-memory.dmpFilesize
200KB
-
memory/3920-1076-0x00000000050D0000-0x000000000511B000-memory.dmpFilesize
300KB
-
memory/3920-1077-0x0000000004EE0000-0x0000000004EF0000-memory.dmpFilesize
64KB
-
memory/4876-175-0x0000000007100000-0x000000000713F000-memory.dmpFilesize
252KB
-
memory/4876-189-0x0000000007100000-0x000000000713F000-memory.dmpFilesize
252KB
-
memory/4876-147-0x00000000072B0000-0x00000000072C0000-memory.dmpFilesize
64KB
-
memory/4876-145-0x0000000007100000-0x0000000007144000-memory.dmpFilesize
272KB
-
memory/4876-144-0x00000000072B0000-0x00000000072C0000-memory.dmpFilesize
64KB
-
memory/4876-143-0x0000000002B90000-0x0000000002BDB000-memory.dmpFilesize
300KB
-
memory/4876-149-0x0000000007100000-0x000000000713F000-memory.dmpFilesize
252KB
-
memory/4876-148-0x0000000007100000-0x000000000713F000-memory.dmpFilesize
252KB
-
memory/4876-151-0x0000000007100000-0x000000000713F000-memory.dmpFilesize
252KB
-
memory/4876-153-0x0000000007100000-0x000000000713F000-memory.dmpFilesize
252KB
-
memory/4876-155-0x0000000007100000-0x000000000713F000-memory.dmpFilesize
252KB
-
memory/4876-157-0x0000000007100000-0x000000000713F000-memory.dmpFilesize
252KB
-
memory/4876-159-0x0000000007100000-0x000000000713F000-memory.dmpFilesize
252KB
-
memory/4876-161-0x0000000007100000-0x000000000713F000-memory.dmpFilesize
252KB
-
memory/4876-163-0x0000000007100000-0x000000000713F000-memory.dmpFilesize
252KB
-
memory/4876-165-0x0000000007100000-0x000000000713F000-memory.dmpFilesize
252KB
-
memory/4876-167-0x0000000007100000-0x000000000713F000-memory.dmpFilesize
252KB
-
memory/4876-169-0x0000000007100000-0x000000000713F000-memory.dmpFilesize
252KB
-
memory/4876-171-0x0000000007100000-0x000000000713F000-memory.dmpFilesize
252KB
-
memory/4876-173-0x0000000007100000-0x000000000713F000-memory.dmpFilesize
252KB
-
memory/4876-142-0x00000000072C0000-0x00000000077BE000-memory.dmpFilesize
5.0MB
-
memory/4876-177-0x0000000007100000-0x000000000713F000-memory.dmpFilesize
252KB
-
memory/4876-179-0x0000000007100000-0x000000000713F000-memory.dmpFilesize
252KB
-
memory/4876-181-0x0000000007100000-0x000000000713F000-memory.dmpFilesize
252KB
-
memory/4876-183-0x0000000007100000-0x000000000713F000-memory.dmpFilesize
252KB
-
memory/4876-185-0x0000000007100000-0x000000000713F000-memory.dmpFilesize
252KB
-
memory/4876-187-0x0000000007100000-0x000000000713F000-memory.dmpFilesize
252KB
-
memory/4876-146-0x00000000072B0000-0x00000000072C0000-memory.dmpFilesize
64KB
-
memory/4876-191-0x0000000007100000-0x000000000713F000-memory.dmpFilesize
252KB
-
memory/4876-193-0x0000000007100000-0x000000000713F000-memory.dmpFilesize
252KB
-
memory/4876-199-0x0000000007100000-0x000000000713F000-memory.dmpFilesize
252KB
-
memory/4876-197-0x0000000007100000-0x000000000713F000-memory.dmpFilesize
252KB
-
memory/4876-201-0x0000000007100000-0x000000000713F000-memory.dmpFilesize
252KB
-
memory/4876-195-0x0000000007100000-0x000000000713F000-memory.dmpFilesize
252KB
-
memory/4876-209-0x0000000007100000-0x000000000713F000-memory.dmpFilesize
252KB
-
memory/4876-211-0x0000000007100000-0x000000000713F000-memory.dmpFilesize
252KB
-
memory/4876-207-0x0000000007100000-0x000000000713F000-memory.dmpFilesize
252KB
-
memory/4876-205-0x0000000007100000-0x000000000713F000-memory.dmpFilesize
252KB
-
memory/4876-203-0x0000000007100000-0x000000000713F000-memory.dmpFilesize
252KB
-
memory/4876-1054-0x00000000077C0000-0x0000000007DC6000-memory.dmpFilesize
6.0MB
-
memory/4876-1055-0x0000000007DD0000-0x0000000007EDA000-memory.dmpFilesize
1.0MB
-
memory/4876-1056-0x0000000007240000-0x0000000007252000-memory.dmpFilesize
72KB
-
memory/4876-1057-0x00000000072B0000-0x00000000072C0000-memory.dmpFilesize
64KB
-
memory/4876-1058-0x0000000007EE0000-0x0000000007F1E000-memory.dmpFilesize
248KB
-
memory/4876-1059-0x0000000008020000-0x000000000806B000-memory.dmpFilesize
300KB
-
memory/4876-1061-0x00000000072B0000-0x00000000072C0000-memory.dmpFilesize
64KB
-
memory/4876-1062-0x00000000072B0000-0x00000000072C0000-memory.dmpFilesize
64KB
-
memory/4876-1063-0x0000000008170000-0x0000000008202000-memory.dmpFilesize
584KB
-
memory/4876-1064-0x0000000008210000-0x0000000008276000-memory.dmpFilesize
408KB
-
memory/4876-1065-0x0000000008A10000-0x0000000008BD2000-memory.dmpFilesize
1.8MB
-
memory/4876-141-0x0000000004860000-0x00000000048A6000-memory.dmpFilesize
280KB
-
memory/4876-1066-0x0000000008BE0000-0x000000000910C000-memory.dmpFilesize
5.2MB
-
memory/4876-1067-0x0000000009390000-0x0000000009406000-memory.dmpFilesize
472KB
-
memory/4876-1068-0x0000000009420000-0x0000000009470000-memory.dmpFilesize
320KB
-
memory/4876-1069-0x00000000072B0000-0x00000000072C0000-memory.dmpFilesize
64KB