Analysis
-
max time kernel
57s -
max time network
68s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
28-03-2023 04:00
Static task
static1
Behavioral task
behavioral1
Sample
c9aabb140acf039bb2298e05d9af2b0ea4f5907c8cf400787a142e5107a22bdb.exe
Resource
win10-20230220-en
General
-
Target
c9aabb140acf039bb2298e05d9af2b0ea4f5907c8cf400787a142e5107a22bdb.exe
-
Size
689KB
-
MD5
6e7189d8affdab9c7dc094917725b58e
-
SHA1
23783ae64efb09525adb172e7e164e4e72b35988
-
SHA256
c9aabb140acf039bb2298e05d9af2b0ea4f5907c8cf400787a142e5107a22bdb
-
SHA512
ab7baa56cfced13825ad6f458725cd030615b623450a97220140010a86bffef5efb99dde03f8b2fd9e4ac4b585be8cffc5f2f815b5e8a278e04bbf7cb0b60ab5
-
SSDEEP
12288:lMrKy90gNMMumnwCorxtyg65hLuWUvQ4+DOcVGvXmJov4FMYfigDhgm2i8Mhaa:jyhxwCpffaWwV+DOcMPmJoQMYag92i8+
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Processes:
pro6060.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro6060.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro6060.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro6060.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro6060.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro6060.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/2792-179-0x00000000036D0000-0x0000000003716000-memory.dmp family_redline behavioral1/memory/2792-180-0x0000000003AF0000-0x0000000003B34000-memory.dmp family_redline behavioral1/memory/2792-181-0x0000000003AF0000-0x0000000003B2F000-memory.dmp family_redline behavioral1/memory/2792-182-0x0000000003AF0000-0x0000000003B2F000-memory.dmp family_redline behavioral1/memory/2792-184-0x0000000003AF0000-0x0000000003B2F000-memory.dmp family_redline behavioral1/memory/2792-186-0x0000000003AF0000-0x0000000003B2F000-memory.dmp family_redline behavioral1/memory/2792-188-0x0000000003AF0000-0x0000000003B2F000-memory.dmp family_redline behavioral1/memory/2792-190-0x0000000003AF0000-0x0000000003B2F000-memory.dmp family_redline behavioral1/memory/2792-192-0x0000000003AF0000-0x0000000003B2F000-memory.dmp family_redline behavioral1/memory/2792-194-0x0000000003AF0000-0x0000000003B2F000-memory.dmp family_redline behavioral1/memory/2792-196-0x0000000003AF0000-0x0000000003B2F000-memory.dmp family_redline behavioral1/memory/2792-198-0x0000000003AF0000-0x0000000003B2F000-memory.dmp family_redline behavioral1/memory/2792-200-0x0000000003AF0000-0x0000000003B2F000-memory.dmp family_redline behavioral1/memory/2792-202-0x0000000003AF0000-0x0000000003B2F000-memory.dmp family_redline behavioral1/memory/2792-204-0x0000000003AF0000-0x0000000003B2F000-memory.dmp family_redline behavioral1/memory/2792-206-0x0000000003AF0000-0x0000000003B2F000-memory.dmp family_redline behavioral1/memory/2792-208-0x0000000003AF0000-0x0000000003B2F000-memory.dmp family_redline behavioral1/memory/2792-212-0x0000000003AF0000-0x0000000003B2F000-memory.dmp family_redline behavioral1/memory/2792-214-0x0000000003AF0000-0x0000000003B2F000-memory.dmp family_redline behavioral1/memory/2792-210-0x0000000003AF0000-0x0000000003B2F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un032863.exepro6060.exequ5530.exesi350289.exepid process 2484 un032863.exe 2592 pro6060.exe 2792 qu5530.exe 3752 si350289.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro6060.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro6060.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro6060.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
c9aabb140acf039bb2298e05d9af2b0ea4f5907c8cf400787a142e5107a22bdb.exeun032863.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c9aabb140acf039bb2298e05d9af2b0ea4f5907c8cf400787a142e5107a22bdb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un032863.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un032863.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce c9aabb140acf039bb2298e05d9af2b0ea4f5907c8cf400787a142e5107a22bdb.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro6060.exequ5530.exesi350289.exepid process 2592 pro6060.exe 2592 pro6060.exe 2792 qu5530.exe 2792 qu5530.exe 3752 si350289.exe 3752 si350289.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro6060.exequ5530.exesi350289.exedescription pid process Token: SeDebugPrivilege 2592 pro6060.exe Token: SeDebugPrivilege 2792 qu5530.exe Token: SeDebugPrivilege 3752 si350289.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
c9aabb140acf039bb2298e05d9af2b0ea4f5907c8cf400787a142e5107a22bdb.exeun032863.exedescription pid process target process PID 2236 wrote to memory of 2484 2236 c9aabb140acf039bb2298e05d9af2b0ea4f5907c8cf400787a142e5107a22bdb.exe un032863.exe PID 2236 wrote to memory of 2484 2236 c9aabb140acf039bb2298e05d9af2b0ea4f5907c8cf400787a142e5107a22bdb.exe un032863.exe PID 2236 wrote to memory of 2484 2236 c9aabb140acf039bb2298e05d9af2b0ea4f5907c8cf400787a142e5107a22bdb.exe un032863.exe PID 2484 wrote to memory of 2592 2484 un032863.exe pro6060.exe PID 2484 wrote to memory of 2592 2484 un032863.exe pro6060.exe PID 2484 wrote to memory of 2592 2484 un032863.exe pro6060.exe PID 2484 wrote to memory of 2792 2484 un032863.exe qu5530.exe PID 2484 wrote to memory of 2792 2484 un032863.exe qu5530.exe PID 2484 wrote to memory of 2792 2484 un032863.exe qu5530.exe PID 2236 wrote to memory of 3752 2236 c9aabb140acf039bb2298e05d9af2b0ea4f5907c8cf400787a142e5107a22bdb.exe si350289.exe PID 2236 wrote to memory of 3752 2236 c9aabb140acf039bb2298e05d9af2b0ea4f5907c8cf400787a142e5107a22bdb.exe si350289.exe PID 2236 wrote to memory of 3752 2236 c9aabb140acf039bb2298e05d9af2b0ea4f5907c8cf400787a142e5107a22bdb.exe si350289.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9aabb140acf039bb2298e05d9af2b0ea4f5907c8cf400787a142e5107a22bdb.exe"C:\Users\Admin\AppData\Local\Temp\c9aabb140acf039bb2298e05d9af2b0ea4f5907c8cf400787a142e5107a22bdb.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un032863.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un032863.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6060.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6060.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5530.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5530.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si350289.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si350289.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si350289.exeFilesize
175KB
MD5748afa6d3eaa55ee9d7e9ce1def64a18
SHA10b917891f01f7b9b4da415664a09dacf4fd0ddbb
SHA256e2dc4274a1b95ba15c22cf5a66a997276d40cb0751d813fa65f86dc5fbb196d3
SHA512014726f3196c1b045e36349b2fb6ff81858af10f8b07302ed122aba2da005f911b7eb78a8c0c6f92e7a62278f24823e2472867f2c563c199c29c81978c6bd016
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si350289.exeFilesize
175KB
MD5748afa6d3eaa55ee9d7e9ce1def64a18
SHA10b917891f01f7b9b4da415664a09dacf4fd0ddbb
SHA256e2dc4274a1b95ba15c22cf5a66a997276d40cb0751d813fa65f86dc5fbb196d3
SHA512014726f3196c1b045e36349b2fb6ff81858af10f8b07302ed122aba2da005f911b7eb78a8c0c6f92e7a62278f24823e2472867f2c563c199c29c81978c6bd016
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un032863.exeFilesize
547KB
MD50e361dae05fb5bee38f9e23305fd5c57
SHA1bcd8d5802db069f05fb5a069635733b8160f8485
SHA2562ce10e54aa0bb23daa2f85609f13ac493a34c307f87276358603304826be81c9
SHA5123916a2783446ae2c1089c4f1f506f49b40be4572d5bbd8730e91d2a19298f15e8091a8705827a20229df4bc324342d701bf0cdc8b7ea21f92c5bbbfe98fa3b2e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un032863.exeFilesize
547KB
MD50e361dae05fb5bee38f9e23305fd5c57
SHA1bcd8d5802db069f05fb5a069635733b8160f8485
SHA2562ce10e54aa0bb23daa2f85609f13ac493a34c307f87276358603304826be81c9
SHA5123916a2783446ae2c1089c4f1f506f49b40be4572d5bbd8730e91d2a19298f15e8091a8705827a20229df4bc324342d701bf0cdc8b7ea21f92c5bbbfe98fa3b2e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6060.exeFilesize
291KB
MD5ece1fe034884ed340b87ee7cfcc789e0
SHA1226bac8111147c5bf1ac7b6d40fadb9952cf4542
SHA2567d1d54e2e24476448f518bf070c775ec76a13aee7de452bf2f0a01f7e8951048
SHA5128519710a2534e1e3e98e7916eb195e253bdc4123de1a2caca480fa9680706f0c4d254bc46902ded7cf89d6802cd17a243e1457ef67a447d326a9b5b96e084013
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6060.exeFilesize
291KB
MD5ece1fe034884ed340b87ee7cfcc789e0
SHA1226bac8111147c5bf1ac7b6d40fadb9952cf4542
SHA2567d1d54e2e24476448f518bf070c775ec76a13aee7de452bf2f0a01f7e8951048
SHA5128519710a2534e1e3e98e7916eb195e253bdc4123de1a2caca480fa9680706f0c4d254bc46902ded7cf89d6802cd17a243e1457ef67a447d326a9b5b96e084013
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5530.exeFilesize
345KB
MD50883a2d7248481b7c4faba72a1cf2d27
SHA10ce51bcac6652876be19d5fc51a5e94d6a56f189
SHA25614efca3badd86318a86195dfdf89981855591220f720ee8e1c61b205887bf424
SHA5123a956dbb61e2f1de402b4f3d300640fc6fcdb0347275dcbd4456676de83c9815611b6c71d23ac17ae170f0afb346147ab91d249cd4c16f20b69c49a6d59430b5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5530.exeFilesize
345KB
MD50883a2d7248481b7c4faba72a1cf2d27
SHA10ce51bcac6652876be19d5fc51a5e94d6a56f189
SHA25614efca3badd86318a86195dfdf89981855591220f720ee8e1c61b205887bf424
SHA5123a956dbb61e2f1de402b4f3d300640fc6fcdb0347275dcbd4456676de83c9815611b6c71d23ac17ae170f0afb346147ab91d249cd4c16f20b69c49a6d59430b5
-
memory/2592-136-0x00000000001D0000-0x00000000001FD000-memory.dmpFilesize
180KB
-
memory/2592-137-0x0000000002360000-0x0000000002370000-memory.dmpFilesize
64KB
-
memory/2592-138-0x0000000002260000-0x000000000227A000-memory.dmpFilesize
104KB
-
memory/2592-139-0x0000000004CD0000-0x00000000051CE000-memory.dmpFilesize
5.0MB
-
memory/2592-140-0x00000000024D0000-0x00000000024E8000-memory.dmpFilesize
96KB
-
memory/2592-141-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/2592-142-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/2592-144-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/2592-146-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/2592-148-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/2592-150-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/2592-152-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/2592-154-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/2592-156-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/2592-158-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/2592-162-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/2592-160-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/2592-166-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/2592-164-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/2592-168-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/2592-169-0x0000000002360000-0x0000000002370000-memory.dmpFilesize
64KB
-
memory/2592-170-0x0000000002360000-0x0000000002370000-memory.dmpFilesize
64KB
-
memory/2592-171-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/2592-172-0x0000000002360000-0x0000000002370000-memory.dmpFilesize
64KB
-
memory/2592-174-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/2792-179-0x00000000036D0000-0x0000000003716000-memory.dmpFilesize
280KB
-
memory/2792-180-0x0000000003AF0000-0x0000000003B34000-memory.dmpFilesize
272KB
-
memory/2792-181-0x0000000003AF0000-0x0000000003B2F000-memory.dmpFilesize
252KB
-
memory/2792-182-0x0000000003AF0000-0x0000000003B2F000-memory.dmpFilesize
252KB
-
memory/2792-184-0x0000000003AF0000-0x0000000003B2F000-memory.dmpFilesize
252KB
-
memory/2792-186-0x0000000003AF0000-0x0000000003B2F000-memory.dmpFilesize
252KB
-
memory/2792-188-0x0000000003AF0000-0x0000000003B2F000-memory.dmpFilesize
252KB
-
memory/2792-190-0x0000000003AF0000-0x0000000003B2F000-memory.dmpFilesize
252KB
-
memory/2792-192-0x0000000003AF0000-0x0000000003B2F000-memory.dmpFilesize
252KB
-
memory/2792-194-0x0000000003AF0000-0x0000000003B2F000-memory.dmpFilesize
252KB
-
memory/2792-196-0x0000000003AF0000-0x0000000003B2F000-memory.dmpFilesize
252KB
-
memory/2792-198-0x0000000003AF0000-0x0000000003B2F000-memory.dmpFilesize
252KB
-
memory/2792-200-0x0000000003AF0000-0x0000000003B2F000-memory.dmpFilesize
252KB
-
memory/2792-202-0x0000000003AF0000-0x0000000003B2F000-memory.dmpFilesize
252KB
-
memory/2792-204-0x0000000003AF0000-0x0000000003B2F000-memory.dmpFilesize
252KB
-
memory/2792-206-0x0000000003AF0000-0x0000000003B2F000-memory.dmpFilesize
252KB
-
memory/2792-208-0x0000000003AF0000-0x0000000003B2F000-memory.dmpFilesize
252KB
-
memory/2792-212-0x0000000003AF0000-0x0000000003B2F000-memory.dmpFilesize
252KB
-
memory/2792-214-0x0000000003AF0000-0x0000000003B2F000-memory.dmpFilesize
252KB
-
memory/2792-210-0x0000000003AF0000-0x0000000003B2F000-memory.dmpFilesize
252KB
-
memory/2792-239-0x0000000001B40000-0x0000000001B8B000-memory.dmpFilesize
300KB
-
memory/2792-240-0x00000000038A0000-0x00000000038B0000-memory.dmpFilesize
64KB
-
memory/2792-243-0x00000000038A0000-0x00000000038B0000-memory.dmpFilesize
64KB
-
memory/2792-244-0x00000000038A0000-0x00000000038B0000-memory.dmpFilesize
64KB
-
memory/2792-1091-0x0000000006670000-0x0000000006C76000-memory.dmpFilesize
6.0MB
-
memory/2792-1092-0x0000000006C80000-0x0000000006D8A000-memory.dmpFilesize
1.0MB
-
memory/2792-1093-0x0000000003B90000-0x0000000003BA2000-memory.dmpFilesize
72KB
-
memory/2792-1094-0x0000000006D90000-0x0000000006DCE000-memory.dmpFilesize
248KB
-
memory/2792-1095-0x00000000038A0000-0x00000000038B0000-memory.dmpFilesize
64KB
-
memory/2792-1096-0x0000000006ED0000-0x0000000006F1B000-memory.dmpFilesize
300KB
-
memory/2792-1097-0x0000000007010000-0x0000000007076000-memory.dmpFilesize
408KB
-
memory/2792-1099-0x00000000076D0000-0x0000000007762000-memory.dmpFilesize
584KB
-
memory/2792-1101-0x00000000038A0000-0x00000000038B0000-memory.dmpFilesize
64KB
-
memory/2792-1100-0x00000000038A0000-0x00000000038B0000-memory.dmpFilesize
64KB
-
memory/2792-1102-0x00000000038A0000-0x00000000038B0000-memory.dmpFilesize
64KB
-
memory/2792-1103-0x00000000078C0000-0x0000000007A82000-memory.dmpFilesize
1.8MB
-
memory/2792-1104-0x0000000007AA0000-0x0000000007FCC000-memory.dmpFilesize
5.2MB
-
memory/2792-1105-0x0000000008110000-0x0000000008186000-memory.dmpFilesize
472KB
-
memory/2792-1106-0x0000000008190000-0x00000000081E0000-memory.dmpFilesize
320KB
-
memory/2792-1107-0x00000000038A0000-0x00000000038B0000-memory.dmpFilesize
64KB
-
memory/3752-1113-0x00000000008B0000-0x00000000008E2000-memory.dmpFilesize
200KB
-
memory/3752-1114-0x00000000052F0000-0x000000000533B000-memory.dmpFilesize
300KB
-
memory/3752-1115-0x0000000005130000-0x0000000005140000-memory.dmpFilesize
64KB