Analysis
-
max time kernel
138s -
max time network
142s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
28-03-2023 08:15
Static task
static1
Behavioral task
behavioral1
Sample
1433a01732a7b10f3509de9ae6cf3f6677b774d3322108785e6281f245c41e77.exe
Resource
win10-20230220-en
General
-
Target
1433a01732a7b10f3509de9ae6cf3f6677b774d3322108785e6281f245c41e77.exe
-
Size
687KB
-
MD5
4a9f9d16cc26f054329a5172550b2264
-
SHA1
00d5974c3abcc2c555fd395dc244a12068325bb0
-
SHA256
1433a01732a7b10f3509de9ae6cf3f6677b774d3322108785e6281f245c41e77
-
SHA512
28a98f651035ce3c62ab8d70355912df445aef7109a79c29fad101b10df210d56038e79d33d11f426a9458012b75904abb2c4beb221f3f09d6f7c3e10538e2e7
-
SSDEEP
12288:dMr/y90wHJU5Wh6yjguFA5KCLIMR9WUoTuXPk5nyQw6i:2yJJMejgr5NUO9WPuXmyQw6i
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Processes:
pro6210.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro6210.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro6210.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro6210.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro6210.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro6210.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/2848-180-0x0000000004800000-0x0000000004846000-memory.dmp family_redline behavioral1/memory/2848-181-0x0000000004890000-0x00000000048D4000-memory.dmp family_redline behavioral1/memory/2848-183-0x0000000004890000-0x00000000048CF000-memory.dmp family_redline behavioral1/memory/2848-184-0x0000000004890000-0x00000000048CF000-memory.dmp family_redline behavioral1/memory/2848-189-0x0000000004890000-0x00000000048CF000-memory.dmp family_redline behavioral1/memory/2848-191-0x0000000004890000-0x00000000048CF000-memory.dmp family_redline behavioral1/memory/2848-193-0x0000000004890000-0x00000000048CF000-memory.dmp family_redline behavioral1/memory/2848-195-0x0000000004890000-0x00000000048CF000-memory.dmp family_redline behavioral1/memory/2848-197-0x0000000004890000-0x00000000048CF000-memory.dmp family_redline behavioral1/memory/2848-201-0x0000000004890000-0x00000000048CF000-memory.dmp family_redline behavioral1/memory/2848-199-0x0000000004890000-0x00000000048CF000-memory.dmp family_redline behavioral1/memory/2848-203-0x0000000004890000-0x00000000048CF000-memory.dmp family_redline behavioral1/memory/2848-205-0x0000000004890000-0x00000000048CF000-memory.dmp family_redline behavioral1/memory/2848-207-0x0000000004890000-0x00000000048CF000-memory.dmp family_redline behavioral1/memory/2848-209-0x0000000004890000-0x00000000048CF000-memory.dmp family_redline behavioral1/memory/2848-211-0x0000000004890000-0x00000000048CF000-memory.dmp family_redline behavioral1/memory/2848-213-0x0000000004890000-0x00000000048CF000-memory.dmp family_redline behavioral1/memory/2848-215-0x0000000004890000-0x00000000048CF000-memory.dmp family_redline behavioral1/memory/2848-217-0x0000000004890000-0x00000000048CF000-memory.dmp family_redline behavioral1/memory/2848-219-0x0000000004890000-0x00000000048CF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un208415.exepro6210.exequ8256.exesi958778.exepid process 4648 un208415.exe 4264 pro6210.exe 2848 qu8256.exe 3508 si958778.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro6210.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro6210.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro6210.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un208415.exe1433a01732a7b10f3509de9ae6cf3f6677b774d3322108785e6281f245c41e77.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un208415.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 1433a01732a7b10f3509de9ae6cf3f6677b774d3322108785e6281f245c41e77.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1433a01732a7b10f3509de9ae6cf3f6677b774d3322108785e6281f245c41e77.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un208415.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro6210.exequ8256.exesi958778.exepid process 4264 pro6210.exe 4264 pro6210.exe 2848 qu8256.exe 2848 qu8256.exe 3508 si958778.exe 3508 si958778.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro6210.exequ8256.exesi958778.exedescription pid process Token: SeDebugPrivilege 4264 pro6210.exe Token: SeDebugPrivilege 2848 qu8256.exe Token: SeDebugPrivilege 3508 si958778.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
1433a01732a7b10f3509de9ae6cf3f6677b774d3322108785e6281f245c41e77.exeun208415.exedescription pid process target process PID 3012 wrote to memory of 4648 3012 1433a01732a7b10f3509de9ae6cf3f6677b774d3322108785e6281f245c41e77.exe un208415.exe PID 3012 wrote to memory of 4648 3012 1433a01732a7b10f3509de9ae6cf3f6677b774d3322108785e6281f245c41e77.exe un208415.exe PID 3012 wrote to memory of 4648 3012 1433a01732a7b10f3509de9ae6cf3f6677b774d3322108785e6281f245c41e77.exe un208415.exe PID 4648 wrote to memory of 4264 4648 un208415.exe pro6210.exe PID 4648 wrote to memory of 4264 4648 un208415.exe pro6210.exe PID 4648 wrote to memory of 4264 4648 un208415.exe pro6210.exe PID 4648 wrote to memory of 2848 4648 un208415.exe qu8256.exe PID 4648 wrote to memory of 2848 4648 un208415.exe qu8256.exe PID 4648 wrote to memory of 2848 4648 un208415.exe qu8256.exe PID 3012 wrote to memory of 3508 3012 1433a01732a7b10f3509de9ae6cf3f6677b774d3322108785e6281f245c41e77.exe si958778.exe PID 3012 wrote to memory of 3508 3012 1433a01732a7b10f3509de9ae6cf3f6677b774d3322108785e6281f245c41e77.exe si958778.exe PID 3012 wrote to memory of 3508 3012 1433a01732a7b10f3509de9ae6cf3f6677b774d3322108785e6281f245c41e77.exe si958778.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1433a01732a7b10f3509de9ae6cf3f6677b774d3322108785e6281f245c41e77.exe"C:\Users\Admin\AppData\Local\Temp\1433a01732a7b10f3509de9ae6cf3f6677b774d3322108785e6281f245c41e77.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un208415.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un208415.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6210.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6210.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8256.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8256.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si958778.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si958778.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si958778.exeFilesize
175KB
MD5be8af7e0484ddc398ec0bd8dbb44b327
SHA17dc9b6efcc8eed235869c46540a7d4f2ff6a51af
SHA256d3aa15c4329eeafd8f407050b971af0b386babae62b067edce00c04b4d8bfc94
SHA512c96e14309ba6293819220c90fa3167132c5e7e7fc6de7110d255058e49e4c8ed172dd651093c3a11ff8223fd081462a3210ced9d9b75467a6fabf88660076ed0
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si958778.exeFilesize
175KB
MD5be8af7e0484ddc398ec0bd8dbb44b327
SHA17dc9b6efcc8eed235869c46540a7d4f2ff6a51af
SHA256d3aa15c4329eeafd8f407050b971af0b386babae62b067edce00c04b4d8bfc94
SHA512c96e14309ba6293819220c90fa3167132c5e7e7fc6de7110d255058e49e4c8ed172dd651093c3a11ff8223fd081462a3210ced9d9b75467a6fabf88660076ed0
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un208415.exeFilesize
545KB
MD591c04fce61b4e76f547350721f02c84c
SHA141603fa727539fc3c43b5edd1f19065640d65fb3
SHA256dbbcfe0908e4551d961d06e419adb40bf9f2d0e9ff0f5495f3e106f67e58ded9
SHA512149f5573f347bbc0baef67c42a54a80dc912754b6312ee113adffc907fd8051beee5f4fcbd1d18e5d030d44c059ce602109d839430757863ea12d263f4720458
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un208415.exeFilesize
545KB
MD591c04fce61b4e76f547350721f02c84c
SHA141603fa727539fc3c43b5edd1f19065640d65fb3
SHA256dbbcfe0908e4551d961d06e419adb40bf9f2d0e9ff0f5495f3e106f67e58ded9
SHA512149f5573f347bbc0baef67c42a54a80dc912754b6312ee113adffc907fd8051beee5f4fcbd1d18e5d030d44c059ce602109d839430757863ea12d263f4720458
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6210.exeFilesize
321KB
MD58c8f8ccd1d2dff2e8f37ae0272a2e877
SHA1fa59ea5915632da3369f00b925bbf940c951f363
SHA256d769c3341fb7fa7ce7f043d839077888d3fd1fff003e34e68c23f6f90a140792
SHA5127c8a15057a3fe8df6433b6bb461c6e02ee28d7b034942a0dc5944861169eb20409b499ebb9bff0a8c8d08efa395fbfb9185b7f12573c880c53aa738f2818923c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6210.exeFilesize
321KB
MD58c8f8ccd1d2dff2e8f37ae0272a2e877
SHA1fa59ea5915632da3369f00b925bbf940c951f363
SHA256d769c3341fb7fa7ce7f043d839077888d3fd1fff003e34e68c23f6f90a140792
SHA5127c8a15057a3fe8df6433b6bb461c6e02ee28d7b034942a0dc5944861169eb20409b499ebb9bff0a8c8d08efa395fbfb9185b7f12573c880c53aa738f2818923c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8256.exeFilesize
380KB
MD583c948ca0df8f3c28a3e71f9cd1cd510
SHA193585f9a2f63e47f4f0d65704e19b80e76e1b9ce
SHA256d444f39e455a330f7c1a8dd29c1cd8b66b0a337e067407a5bd6ca56f0c9941ef
SHA5128be79411c784c6fe3a57c1eee8eb67b2d78fb5d5c3d93fc7a035bf9a0e1553ccc3999e13f54de3970b899e365d53d2b38b3f05d768ed95747a8bb82a4512968b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8256.exeFilesize
380KB
MD583c948ca0df8f3c28a3e71f9cd1cd510
SHA193585f9a2f63e47f4f0d65704e19b80e76e1b9ce
SHA256d444f39e455a330f7c1a8dd29c1cd8b66b0a337e067407a5bd6ca56f0c9941ef
SHA5128be79411c784c6fe3a57c1eee8eb67b2d78fb5d5c3d93fc7a035bf9a0e1553ccc3999e13f54de3970b899e365d53d2b38b3f05d768ed95747a8bb82a4512968b
-
memory/2848-1093-0x0000000007820000-0x000000000792A000-memory.dmpFilesize
1.0MB
-
memory/2848-1094-0x0000000004CF0000-0x0000000004D02000-memory.dmpFilesize
72KB
-
memory/2848-1107-0x0000000009570000-0x00000000095C0000-memory.dmpFilesize
320KB
-
memory/2848-1106-0x00000000094F0000-0x0000000009566000-memory.dmpFilesize
472KB
-
memory/2848-1105-0x0000000008D40000-0x000000000926C000-memory.dmpFilesize
5.2MB
-
memory/2848-1104-0x0000000008B50000-0x0000000008D12000-memory.dmpFilesize
1.8MB
-
memory/2848-1103-0x0000000008830000-0x00000000088C2000-memory.dmpFilesize
584KB
-
memory/2848-1102-0x0000000007B60000-0x0000000007BC6000-memory.dmpFilesize
408KB
-
memory/2848-1101-0x0000000004840000-0x0000000004850000-memory.dmpFilesize
64KB
-
memory/2848-1100-0x0000000004840000-0x0000000004850000-memory.dmpFilesize
64KB
-
memory/2848-1099-0x0000000004840000-0x0000000004850000-memory.dmpFilesize
64KB
-
memory/2848-1097-0x0000000004840000-0x0000000004850000-memory.dmpFilesize
64KB
-
memory/2848-1096-0x0000000004D60000-0x0000000004DAB000-memory.dmpFilesize
300KB
-
memory/2848-191-0x0000000004890000-0x00000000048CF000-memory.dmpFilesize
252KB
-
memory/2848-1095-0x0000000004D10000-0x0000000004D4E000-memory.dmpFilesize
248KB
-
memory/2848-1092-0x0000000007E30000-0x0000000008436000-memory.dmpFilesize
6.0MB
-
memory/2848-219-0x0000000004890000-0x00000000048CF000-memory.dmpFilesize
252KB
-
memory/2848-217-0x0000000004890000-0x00000000048CF000-memory.dmpFilesize
252KB
-
memory/2848-215-0x0000000004890000-0x00000000048CF000-memory.dmpFilesize
252KB
-
memory/2848-213-0x0000000004890000-0x00000000048CF000-memory.dmpFilesize
252KB
-
memory/2848-211-0x0000000004890000-0x00000000048CF000-memory.dmpFilesize
252KB
-
memory/2848-209-0x0000000004890000-0x00000000048CF000-memory.dmpFilesize
252KB
-
memory/2848-207-0x0000000004890000-0x00000000048CF000-memory.dmpFilesize
252KB
-
memory/2848-188-0x0000000004840000-0x0000000004850000-memory.dmpFilesize
64KB
-
memory/2848-193-0x0000000004890000-0x00000000048CF000-memory.dmpFilesize
252KB
-
memory/2848-181-0x0000000004890000-0x00000000048D4000-memory.dmpFilesize
272KB
-
memory/2848-182-0x0000000002B90000-0x0000000002BDB000-memory.dmpFilesize
300KB
-
memory/2848-183-0x0000000004890000-0x00000000048CF000-memory.dmpFilesize
252KB
-
memory/2848-185-0x0000000004840000-0x0000000004850000-memory.dmpFilesize
64KB
-
memory/2848-184-0x0000000004890000-0x00000000048CF000-memory.dmpFilesize
252KB
-
memory/2848-186-0x0000000004840000-0x0000000004850000-memory.dmpFilesize
64KB
-
memory/2848-189-0x0000000004890000-0x00000000048CF000-memory.dmpFilesize
252KB
-
memory/2848-205-0x0000000004890000-0x00000000048CF000-memory.dmpFilesize
252KB
-
memory/2848-203-0x0000000004890000-0x00000000048CF000-memory.dmpFilesize
252KB
-
memory/2848-180-0x0000000004800000-0x0000000004846000-memory.dmpFilesize
280KB
-
memory/2848-195-0x0000000004890000-0x00000000048CF000-memory.dmpFilesize
252KB
-
memory/2848-197-0x0000000004890000-0x00000000048CF000-memory.dmpFilesize
252KB
-
memory/2848-201-0x0000000004890000-0x00000000048CF000-memory.dmpFilesize
252KB
-
memory/2848-199-0x0000000004890000-0x00000000048CF000-memory.dmpFilesize
252KB
-
memory/3508-1115-0x00000000052F0000-0x0000000005300000-memory.dmpFilesize
64KB
-
memory/3508-1114-0x0000000005410000-0x000000000545B000-memory.dmpFilesize
300KB
-
memory/3508-1113-0x00000000009D0000-0x0000000000A02000-memory.dmpFilesize
200KB
-
memory/4264-139-0x00000000072F0000-0x00000000077EE000-memory.dmpFilesize
5.0MB
-
memory/4264-157-0x00000000072E0000-0x00000000072F0000-memory.dmpFilesize
64KB
-
memory/4264-172-0x00000000072E0000-0x00000000072F0000-memory.dmpFilesize
64KB
-
memory/4264-171-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/4264-170-0x0000000004880000-0x0000000004892000-memory.dmpFilesize
72KB
-
memory/4264-168-0x0000000004880000-0x0000000004892000-memory.dmpFilesize
72KB
-
memory/4264-166-0x0000000004880000-0x0000000004892000-memory.dmpFilesize
72KB
-
memory/4264-138-0x00000000046C0000-0x00000000046DA000-memory.dmpFilesize
104KB
-
memory/4264-141-0x0000000004880000-0x0000000004892000-memory.dmpFilesize
72KB
-
memory/4264-164-0x0000000004880000-0x0000000004892000-memory.dmpFilesize
72KB
-
memory/4264-174-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/4264-162-0x0000000004880000-0x0000000004892000-memory.dmpFilesize
72KB
-
memory/4264-156-0x0000000004880000-0x0000000004892000-memory.dmpFilesize
72KB
-
memory/4264-175-0x00000000072E0000-0x00000000072F0000-memory.dmpFilesize
64KB
-
memory/4264-154-0x0000000004880000-0x0000000004892000-memory.dmpFilesize
72KB
-
memory/4264-152-0x0000000004880000-0x0000000004892000-memory.dmpFilesize
72KB
-
memory/4264-150-0x0000000004880000-0x0000000004892000-memory.dmpFilesize
72KB
-
memory/4264-148-0x0000000004880000-0x0000000004892000-memory.dmpFilesize
72KB
-
memory/4264-146-0x0000000004880000-0x0000000004892000-memory.dmpFilesize
72KB
-
memory/4264-144-0x0000000004880000-0x0000000004892000-memory.dmpFilesize
72KB
-
memory/4264-142-0x0000000004880000-0x0000000004892000-memory.dmpFilesize
72KB
-
memory/4264-137-0x00000000072E0000-0x00000000072F0000-memory.dmpFilesize
64KB
-
memory/4264-136-0x0000000002C50000-0x0000000002C7D000-memory.dmpFilesize
180KB
-
memory/4264-140-0x0000000004880000-0x0000000004898000-memory.dmpFilesize
96KB
-
memory/4264-158-0x00000000072E0000-0x00000000072F0000-memory.dmpFilesize
64KB
-
memory/4264-160-0x0000000004880000-0x0000000004892000-memory.dmpFilesize
72KB