Analysis
-
max time kernel
54s -
max time network
70s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
28-03-2023 04:13
Static task
static1
Behavioral task
behavioral1
Sample
abf6b48b010b1cf2a3609beba0996d1e48c1a90cfb7fcff7e112fe69a054ae07.exe
Resource
win10-20230220-en
General
-
Target
abf6b48b010b1cf2a3609beba0996d1e48c1a90cfb7fcff7e112fe69a054ae07.exe
-
Size
689KB
-
MD5
975bd4fe3cb20945a6501d0584c0a795
-
SHA1
8c2064d73b84fc2552fd4a911f12e46a3a7c6d9b
-
SHA256
abf6b48b010b1cf2a3609beba0996d1e48c1a90cfb7fcff7e112fe69a054ae07
-
SHA512
3727c1ac444f1b5c868958657f9ec46cba0a4f20327ade52163a7085382e422c8ef68e63893013ef43e8abc2ae7595790627e657031d8c28971c274ac05be3d7
-
SSDEEP
12288:MMrwy904sweOxCavHIu+y0y365hLu3q3eMSKI3VrdgDUMGFmJev1Fn8figSi/i2W:sy9sXOjHIuLlqfa63eLZ3Vrdd3mJeXnZ
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Processes:
pro5194.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro5194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro5194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro5194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro5194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro5194.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/1248-174-0x0000000003A30000-0x0000000003A76000-memory.dmp family_redline behavioral1/memory/1248-175-0x0000000005FC0000-0x0000000006004000-memory.dmp family_redline behavioral1/memory/1248-176-0x0000000005FC0000-0x0000000005FFF000-memory.dmp family_redline behavioral1/memory/1248-179-0x0000000005FC0000-0x0000000005FFF000-memory.dmp family_redline behavioral1/memory/1248-177-0x0000000005FC0000-0x0000000005FFF000-memory.dmp family_redline behavioral1/memory/1248-181-0x0000000005FC0000-0x0000000005FFF000-memory.dmp family_redline behavioral1/memory/1248-183-0x0000000005FC0000-0x0000000005FFF000-memory.dmp family_redline behavioral1/memory/1248-185-0x0000000005FC0000-0x0000000005FFF000-memory.dmp family_redline behavioral1/memory/1248-187-0x0000000005FC0000-0x0000000005FFF000-memory.dmp family_redline behavioral1/memory/1248-189-0x0000000005FC0000-0x0000000005FFF000-memory.dmp family_redline behavioral1/memory/1248-191-0x0000000005FC0000-0x0000000005FFF000-memory.dmp family_redline behavioral1/memory/1248-193-0x0000000005FC0000-0x0000000005FFF000-memory.dmp family_redline behavioral1/memory/1248-195-0x0000000005FC0000-0x0000000005FFF000-memory.dmp family_redline behavioral1/memory/1248-197-0x0000000005FC0000-0x0000000005FFF000-memory.dmp family_redline behavioral1/memory/1248-199-0x0000000005FC0000-0x0000000005FFF000-memory.dmp family_redline behavioral1/memory/1248-201-0x0000000005FC0000-0x0000000005FFF000-memory.dmp family_redline behavioral1/memory/1248-203-0x0000000005FC0000-0x0000000005FFF000-memory.dmp family_redline behavioral1/memory/1248-205-0x0000000005FC0000-0x0000000005FFF000-memory.dmp family_redline behavioral1/memory/1248-207-0x0000000005FC0000-0x0000000005FFF000-memory.dmp family_redline behavioral1/memory/1248-209-0x0000000005FC0000-0x0000000005FFF000-memory.dmp family_redline behavioral1/memory/1248-1097-0x0000000006090000-0x00000000060A0000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un300127.exepro5194.exequ4465.exesi368509.exepid process 4292 un300127.exe 4992 pro5194.exe 1248 qu4465.exe 2596 si368509.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro5194.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro5194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro5194.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
abf6b48b010b1cf2a3609beba0996d1e48c1a90cfb7fcff7e112fe69a054ae07.exeun300127.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" abf6b48b010b1cf2a3609beba0996d1e48c1a90cfb7fcff7e112fe69a054ae07.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un300127.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un300127.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce abf6b48b010b1cf2a3609beba0996d1e48c1a90cfb7fcff7e112fe69a054ae07.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro5194.exequ4465.exesi368509.exepid process 4992 pro5194.exe 4992 pro5194.exe 1248 qu4465.exe 1248 qu4465.exe 2596 si368509.exe 2596 si368509.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro5194.exequ4465.exesi368509.exedescription pid process Token: SeDebugPrivilege 4992 pro5194.exe Token: SeDebugPrivilege 1248 qu4465.exe Token: SeDebugPrivilege 2596 si368509.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
abf6b48b010b1cf2a3609beba0996d1e48c1a90cfb7fcff7e112fe69a054ae07.exeun300127.exedescription pid process target process PID 1008 wrote to memory of 4292 1008 abf6b48b010b1cf2a3609beba0996d1e48c1a90cfb7fcff7e112fe69a054ae07.exe un300127.exe PID 1008 wrote to memory of 4292 1008 abf6b48b010b1cf2a3609beba0996d1e48c1a90cfb7fcff7e112fe69a054ae07.exe un300127.exe PID 1008 wrote to memory of 4292 1008 abf6b48b010b1cf2a3609beba0996d1e48c1a90cfb7fcff7e112fe69a054ae07.exe un300127.exe PID 4292 wrote to memory of 4992 4292 un300127.exe pro5194.exe PID 4292 wrote to memory of 4992 4292 un300127.exe pro5194.exe PID 4292 wrote to memory of 4992 4292 un300127.exe pro5194.exe PID 4292 wrote to memory of 1248 4292 un300127.exe qu4465.exe PID 4292 wrote to memory of 1248 4292 un300127.exe qu4465.exe PID 4292 wrote to memory of 1248 4292 un300127.exe qu4465.exe PID 1008 wrote to memory of 2596 1008 abf6b48b010b1cf2a3609beba0996d1e48c1a90cfb7fcff7e112fe69a054ae07.exe si368509.exe PID 1008 wrote to memory of 2596 1008 abf6b48b010b1cf2a3609beba0996d1e48c1a90cfb7fcff7e112fe69a054ae07.exe si368509.exe PID 1008 wrote to memory of 2596 1008 abf6b48b010b1cf2a3609beba0996d1e48c1a90cfb7fcff7e112fe69a054ae07.exe si368509.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\abf6b48b010b1cf2a3609beba0996d1e48c1a90cfb7fcff7e112fe69a054ae07.exe"C:\Users\Admin\AppData\Local\Temp\abf6b48b010b1cf2a3609beba0996d1e48c1a90cfb7fcff7e112fe69a054ae07.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un300127.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un300127.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5194.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5194.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4465.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4465.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si368509.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si368509.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si368509.exeFilesize
175KB
MD55a0a1195e54e1af4461abf3cdb0d98b6
SHA122dde57289daaf4c42264f5607a1edbf7596c977
SHA256690c13f8c7623fba17f9dd6ae1ed8fbd1f82bce7411a0eb14bddd20fa95439fe
SHA512efdb32fec28633a25bb9241558a69c1cf65d618ab90f6436312b75dcdb82afc02d214b98635ab8ffcab481394eb2b465aee5c29767e7b20a32fb70ef2068a855
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si368509.exeFilesize
175KB
MD55a0a1195e54e1af4461abf3cdb0d98b6
SHA122dde57289daaf4c42264f5607a1edbf7596c977
SHA256690c13f8c7623fba17f9dd6ae1ed8fbd1f82bce7411a0eb14bddd20fa95439fe
SHA512efdb32fec28633a25bb9241558a69c1cf65d618ab90f6436312b75dcdb82afc02d214b98635ab8ffcab481394eb2b465aee5c29767e7b20a32fb70ef2068a855
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un300127.exeFilesize
547KB
MD585e5926fbdd29194934c17f599fbad88
SHA1432469c9fa62f00d6c0f86ca633103741b2bef82
SHA256a58d93165ed5884861d291880ffc9df29ca0f541256379074fbaff6b18ab9c9d
SHA51246330061851bd0a928b0dd74716bba8bf3a12c56761ddb82e1a2abb90b1411c15b28e86e393bf16d3359af47a2d372dfefeeb65ee05f44cebfa2fd9dc71ac903
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un300127.exeFilesize
547KB
MD585e5926fbdd29194934c17f599fbad88
SHA1432469c9fa62f00d6c0f86ca633103741b2bef82
SHA256a58d93165ed5884861d291880ffc9df29ca0f541256379074fbaff6b18ab9c9d
SHA51246330061851bd0a928b0dd74716bba8bf3a12c56761ddb82e1a2abb90b1411c15b28e86e393bf16d3359af47a2d372dfefeeb65ee05f44cebfa2fd9dc71ac903
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5194.exeFilesize
291KB
MD57d8978d620ca2d8f17be5f1d07f36808
SHA1c2729d1c1d74f21cd4d909ff675d332ec37bfba7
SHA256076939db2f9ada5744bb7c99a9f66df811805b922f7d6cf61cb84642a1375c01
SHA5120bd03bdb27fdf7ccd0d6222250561fd1f31c796d4269bc667580188bce638f9e7da3b14a68d3ce847f3e8111c142fb4f7e8759c1dc00f8924b574e5a797bbb9b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5194.exeFilesize
291KB
MD57d8978d620ca2d8f17be5f1d07f36808
SHA1c2729d1c1d74f21cd4d909ff675d332ec37bfba7
SHA256076939db2f9ada5744bb7c99a9f66df811805b922f7d6cf61cb84642a1375c01
SHA5120bd03bdb27fdf7ccd0d6222250561fd1f31c796d4269bc667580188bce638f9e7da3b14a68d3ce847f3e8111c142fb4f7e8759c1dc00f8924b574e5a797bbb9b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4465.exeFilesize
345KB
MD5195edd0834f8b85e55250cf568239939
SHA1b06aa4f6012718bfb4188438f13076c335daf0ff
SHA2565cd564be02289d04d923eeaab55e254eb8a136d5fffa6db6ac3ed3859bb8cff7
SHA51275e83e09a126a41e4aac98e356e376d70dfa9882ee689922776bbad3f2878473e1e037bb61e9ed82bd5b25eb0600a536a74b0f008d93c344b85a21207523ea05
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4465.exeFilesize
345KB
MD5195edd0834f8b85e55250cf568239939
SHA1b06aa4f6012718bfb4188438f13076c335daf0ff
SHA2565cd564be02289d04d923eeaab55e254eb8a136d5fffa6db6ac3ed3859bb8cff7
SHA51275e83e09a126a41e4aac98e356e376d70dfa9882ee689922776bbad3f2878473e1e037bb61e9ed82bd5b25eb0600a536a74b0f008d93c344b85a21207523ea05
-
memory/1248-1086-0x0000000006BB0000-0x00000000071B6000-memory.dmpFilesize
6.0MB
-
memory/1248-1088-0x0000000006700000-0x0000000006712000-memory.dmpFilesize
72KB
-
memory/1248-219-0x0000000006090000-0x00000000060A0000-memory.dmpFilesize
64KB
-
memory/1248-209-0x0000000005FC0000-0x0000000005FFF000-memory.dmpFilesize
252KB
-
memory/1248-207-0x0000000005FC0000-0x0000000005FFF000-memory.dmpFilesize
252KB
-
memory/1248-1102-0x0000000006090000-0x00000000060A0000-memory.dmpFilesize
64KB
-
memory/1248-1101-0x0000000008070000-0x00000000080C0000-memory.dmpFilesize
320KB
-
memory/1248-191-0x0000000005FC0000-0x0000000005FFF000-memory.dmpFilesize
252KB
-
memory/1248-1100-0x0000000007FF0000-0x0000000008066000-memory.dmpFilesize
472KB
-
memory/1248-1099-0x0000000006090000-0x00000000060A0000-memory.dmpFilesize
64KB
-
memory/1248-1098-0x0000000006090000-0x00000000060A0000-memory.dmpFilesize
64KB
-
memory/1248-1097-0x0000000006090000-0x00000000060A0000-memory.dmpFilesize
64KB
-
memory/1248-1096-0x0000000007990000-0x0000000007EBC000-memory.dmpFilesize
5.2MB
-
memory/1248-193-0x0000000005FC0000-0x0000000005FFF000-memory.dmpFilesize
252KB
-
memory/1248-1095-0x00000000077B0000-0x0000000007972000-memory.dmpFilesize
1.8MB
-
memory/1248-1093-0x00000000076D0000-0x0000000007762000-memory.dmpFilesize
584KB
-
memory/1248-1092-0x0000000006A00000-0x0000000006A66000-memory.dmpFilesize
408KB
-
memory/1248-195-0x0000000005FC0000-0x0000000005FFF000-memory.dmpFilesize
252KB
-
memory/1248-1091-0x0000000006090000-0x00000000060A0000-memory.dmpFilesize
64KB
-
memory/1248-1090-0x0000000006870000-0x00000000068BB000-memory.dmpFilesize
300KB
-
memory/1248-1089-0x0000000006720000-0x000000000675E000-memory.dmpFilesize
248KB
-
memory/1248-217-0x0000000001B00000-0x0000000001B4B000-memory.dmpFilesize
300KB
-
memory/1248-174-0x0000000003A30000-0x0000000003A76000-memory.dmpFilesize
280KB
-
memory/1248-175-0x0000000005FC0000-0x0000000006004000-memory.dmpFilesize
272KB
-
memory/1248-176-0x0000000005FC0000-0x0000000005FFF000-memory.dmpFilesize
252KB
-
memory/1248-179-0x0000000005FC0000-0x0000000005FFF000-memory.dmpFilesize
252KB
-
memory/1248-177-0x0000000005FC0000-0x0000000005FFF000-memory.dmpFilesize
252KB
-
memory/1248-181-0x0000000005FC0000-0x0000000005FFF000-memory.dmpFilesize
252KB
-
memory/1248-183-0x0000000005FC0000-0x0000000005FFF000-memory.dmpFilesize
252KB
-
memory/1248-185-0x0000000005FC0000-0x0000000005FFF000-memory.dmpFilesize
252KB
-
memory/1248-187-0x0000000005FC0000-0x0000000005FFF000-memory.dmpFilesize
252KB
-
memory/1248-189-0x0000000005FC0000-0x0000000005FFF000-memory.dmpFilesize
252KB
-
memory/1248-1087-0x00000000065C0000-0x00000000066CA000-memory.dmpFilesize
1.0MB
-
memory/1248-223-0x0000000006090000-0x00000000060A0000-memory.dmpFilesize
64KB
-
memory/1248-221-0x0000000006090000-0x00000000060A0000-memory.dmpFilesize
64KB
-
memory/1248-197-0x0000000005FC0000-0x0000000005FFF000-memory.dmpFilesize
252KB
-
memory/1248-199-0x0000000005FC0000-0x0000000005FFF000-memory.dmpFilesize
252KB
-
memory/1248-201-0x0000000005FC0000-0x0000000005FFF000-memory.dmpFilesize
252KB
-
memory/1248-203-0x0000000005FC0000-0x0000000005FFF000-memory.dmpFilesize
252KB
-
memory/1248-205-0x0000000005FC0000-0x0000000005FFF000-memory.dmpFilesize
252KB
-
memory/2596-1108-0x0000000000CB0000-0x0000000000CE2000-memory.dmpFilesize
200KB
-
memory/2596-1109-0x00000000056F0000-0x000000000573B000-memory.dmpFilesize
300KB
-
memory/2596-1110-0x00000000058C0000-0x00000000058D0000-memory.dmpFilesize
64KB
-
memory/4992-165-0x0000000004DA0000-0x0000000004DB0000-memory.dmpFilesize
64KB
-
memory/4992-166-0x0000000004DA0000-0x0000000004DB0000-memory.dmpFilesize
64KB
-
memory/4992-161-0x0000000004C30000-0x0000000004C42000-memory.dmpFilesize
72KB
-
memory/4992-134-0x0000000004DB0000-0x00000000052AE000-memory.dmpFilesize
5.0MB
-
memory/4992-149-0x0000000004C30000-0x0000000004C42000-memory.dmpFilesize
72KB
-
memory/4992-135-0x0000000004C30000-0x0000000004C48000-memory.dmpFilesize
96KB
-
memory/4992-136-0x0000000004C30000-0x0000000004C42000-memory.dmpFilesize
72KB
-
memory/4992-169-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/4992-167-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/4992-137-0x0000000004C30000-0x0000000004C42000-memory.dmpFilesize
72KB
-
memory/4992-164-0x0000000004DA0000-0x0000000004DB0000-memory.dmpFilesize
64KB
-
memory/4992-163-0x0000000004C30000-0x0000000004C42000-memory.dmpFilesize
72KB
-
memory/4992-159-0x0000000004C30000-0x0000000004C42000-memory.dmpFilesize
72KB
-
memory/4992-157-0x0000000004C30000-0x0000000004C42000-memory.dmpFilesize
72KB
-
memory/4992-155-0x0000000004C30000-0x0000000004C42000-memory.dmpFilesize
72KB
-
memory/4992-153-0x0000000004C30000-0x0000000004C42000-memory.dmpFilesize
72KB
-
memory/4992-151-0x0000000004C30000-0x0000000004C42000-memory.dmpFilesize
72KB
-
memory/4992-147-0x0000000004C30000-0x0000000004C42000-memory.dmpFilesize
72KB
-
memory/4992-145-0x0000000004C30000-0x0000000004C42000-memory.dmpFilesize
72KB
-
memory/4992-133-0x00000000022E0000-0x00000000022FA000-memory.dmpFilesize
104KB
-
memory/4992-132-0x00000000001D0000-0x00000000001FD000-memory.dmpFilesize
180KB
-
memory/4992-143-0x0000000004C30000-0x0000000004C42000-memory.dmpFilesize
72KB
-
memory/4992-141-0x0000000004C30000-0x0000000004C42000-memory.dmpFilesize
72KB
-
memory/4992-139-0x0000000004C30000-0x0000000004C42000-memory.dmpFilesize
72KB