Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
28-03-2023 07:58
Static task
static1
Behavioral task
behavioral1
Sample
aa2d0bf27af8f739ea07aae197baf4cbd4f66b88780f4e1f5f79fead3098bf68.exe
Resource
win10-20230220-en
General
-
Target
aa2d0bf27af8f739ea07aae197baf4cbd4f66b88780f4e1f5f79fead3098bf68.exe
-
Size
687KB
-
MD5
3b429b6fe1464f0cf3514e892696c321
-
SHA1
94721384f464520ffbcbeba1c4a21529bb7a1e49
-
SHA256
aa2d0bf27af8f739ea07aae197baf4cbd4f66b88780f4e1f5f79fead3098bf68
-
SHA512
6f8eb374a3226ae3b8fd4855aee26de0c1c16395b82bb3a09ce1cc12a2d4342bcc148dffd65d7111bef3a3ab1c70ba712df22a9083f64b807d1befc6182cbbfc
-
SSDEEP
12288:PMrSy90aBE1oWkTnMAKGy01pzmuO6Du+OU6DT3fr5iD+BfgoZJy:9ytW1FIvKGyQpzmmq33froory
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Processes:
pro5884.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro5884.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro5884.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro5884.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro5884.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro5884.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/2680-181-0x0000000002E90000-0x0000000002ED6000-memory.dmp family_redline behavioral1/memory/2680-182-0x0000000004BB0000-0x0000000004BF4000-memory.dmp family_redline behavioral1/memory/2680-187-0x0000000004BB0000-0x0000000004BEF000-memory.dmp family_redline behavioral1/memory/2680-188-0x0000000004BB0000-0x0000000004BEF000-memory.dmp family_redline behavioral1/memory/2680-190-0x0000000004BB0000-0x0000000004BEF000-memory.dmp family_redline behavioral1/memory/2680-192-0x0000000004BB0000-0x0000000004BEF000-memory.dmp family_redline behavioral1/memory/2680-194-0x0000000004BB0000-0x0000000004BEF000-memory.dmp family_redline behavioral1/memory/2680-196-0x0000000004BB0000-0x0000000004BEF000-memory.dmp family_redline behavioral1/memory/2680-198-0x0000000004BB0000-0x0000000004BEF000-memory.dmp family_redline behavioral1/memory/2680-200-0x0000000004BB0000-0x0000000004BEF000-memory.dmp family_redline behavioral1/memory/2680-202-0x0000000004BB0000-0x0000000004BEF000-memory.dmp family_redline behavioral1/memory/2680-204-0x0000000004BB0000-0x0000000004BEF000-memory.dmp family_redline behavioral1/memory/2680-206-0x0000000004BB0000-0x0000000004BEF000-memory.dmp family_redline behavioral1/memory/2680-208-0x0000000004BB0000-0x0000000004BEF000-memory.dmp family_redline behavioral1/memory/2680-210-0x0000000004BB0000-0x0000000004BEF000-memory.dmp family_redline behavioral1/memory/2680-212-0x0000000004BB0000-0x0000000004BEF000-memory.dmp family_redline behavioral1/memory/2680-214-0x0000000004BB0000-0x0000000004BEF000-memory.dmp family_redline behavioral1/memory/2680-216-0x0000000004BB0000-0x0000000004BEF000-memory.dmp family_redline behavioral1/memory/2680-218-0x0000000004BB0000-0x0000000004BEF000-memory.dmp family_redline behavioral1/memory/2680-220-0x0000000004BB0000-0x0000000004BEF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un275500.exepro5884.exequ8815.exesi373930.exepid process 4056 un275500.exe 3588 pro5884.exe 2680 qu8815.exe 4184 si373930.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro5884.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro5884.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro5884.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
aa2d0bf27af8f739ea07aae197baf4cbd4f66b88780f4e1f5f79fead3098bf68.exeun275500.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce aa2d0bf27af8f739ea07aae197baf4cbd4f66b88780f4e1f5f79fead3098bf68.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" aa2d0bf27af8f739ea07aae197baf4cbd4f66b88780f4e1f5f79fead3098bf68.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un275500.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un275500.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro5884.exequ8815.exesi373930.exepid process 3588 pro5884.exe 3588 pro5884.exe 2680 qu8815.exe 2680 qu8815.exe 4184 si373930.exe 4184 si373930.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro5884.exequ8815.exesi373930.exedescription pid process Token: SeDebugPrivilege 3588 pro5884.exe Token: SeDebugPrivilege 2680 qu8815.exe Token: SeDebugPrivilege 4184 si373930.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
aa2d0bf27af8f739ea07aae197baf4cbd4f66b88780f4e1f5f79fead3098bf68.exeun275500.exedescription pid process target process PID 3452 wrote to memory of 4056 3452 aa2d0bf27af8f739ea07aae197baf4cbd4f66b88780f4e1f5f79fead3098bf68.exe un275500.exe PID 3452 wrote to memory of 4056 3452 aa2d0bf27af8f739ea07aae197baf4cbd4f66b88780f4e1f5f79fead3098bf68.exe un275500.exe PID 3452 wrote to memory of 4056 3452 aa2d0bf27af8f739ea07aae197baf4cbd4f66b88780f4e1f5f79fead3098bf68.exe un275500.exe PID 4056 wrote to memory of 3588 4056 un275500.exe pro5884.exe PID 4056 wrote to memory of 3588 4056 un275500.exe pro5884.exe PID 4056 wrote to memory of 3588 4056 un275500.exe pro5884.exe PID 4056 wrote to memory of 2680 4056 un275500.exe qu8815.exe PID 4056 wrote to memory of 2680 4056 un275500.exe qu8815.exe PID 4056 wrote to memory of 2680 4056 un275500.exe qu8815.exe PID 3452 wrote to memory of 4184 3452 aa2d0bf27af8f739ea07aae197baf4cbd4f66b88780f4e1f5f79fead3098bf68.exe si373930.exe PID 3452 wrote to memory of 4184 3452 aa2d0bf27af8f739ea07aae197baf4cbd4f66b88780f4e1f5f79fead3098bf68.exe si373930.exe PID 3452 wrote to memory of 4184 3452 aa2d0bf27af8f739ea07aae197baf4cbd4f66b88780f4e1f5f79fead3098bf68.exe si373930.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa2d0bf27af8f739ea07aae197baf4cbd4f66b88780f4e1f5f79fead3098bf68.exe"C:\Users\Admin\AppData\Local\Temp\aa2d0bf27af8f739ea07aae197baf4cbd4f66b88780f4e1f5f79fead3098bf68.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un275500.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un275500.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5884.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5884.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8815.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8815.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si373930.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si373930.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si373930.exeFilesize
175KB
MD5d8bf886fcb63e71cab507497e3818dff
SHA1cc360d64734bc87ec327e010c020be8174a36186
SHA2560f7ba31cd6be785eb100ed7d8775eb46e90993ccf9365ed446b2bc1967cc61f3
SHA512bfd9e70f2a07db2df1c3cd3e92aafcac12b7fdd44abfb18950ec55157cfc579255067d1738599ff301a6962f73a09986621d4e23248d4d5103fdb1da1b4d0c89
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si373930.exeFilesize
175KB
MD5d8bf886fcb63e71cab507497e3818dff
SHA1cc360d64734bc87ec327e010c020be8174a36186
SHA2560f7ba31cd6be785eb100ed7d8775eb46e90993ccf9365ed446b2bc1967cc61f3
SHA512bfd9e70f2a07db2df1c3cd3e92aafcac12b7fdd44abfb18950ec55157cfc579255067d1738599ff301a6962f73a09986621d4e23248d4d5103fdb1da1b4d0c89
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un275500.exeFilesize
545KB
MD5131828e4707858652452e36f3a91b9b2
SHA1bb6a309e319496ce63a2cb84bb6f30066e518dfe
SHA256c40512cfd1551b265b4837b68904248b5af7d6c58ce23eda7f200e56ab4dfdd1
SHA512d4d24009ed729c19ff51d5e68ca51391c0e1d60675202aa71b78e2cb887b4375fd623a11c0d2f1dcb7d3260e52c16a8aadc1b56f939acdefdb98dcc5a223d851
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un275500.exeFilesize
545KB
MD5131828e4707858652452e36f3a91b9b2
SHA1bb6a309e319496ce63a2cb84bb6f30066e518dfe
SHA256c40512cfd1551b265b4837b68904248b5af7d6c58ce23eda7f200e56ab4dfdd1
SHA512d4d24009ed729c19ff51d5e68ca51391c0e1d60675202aa71b78e2cb887b4375fd623a11c0d2f1dcb7d3260e52c16a8aadc1b56f939acdefdb98dcc5a223d851
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5884.exeFilesize
321KB
MD5eb34ec078eb153c341d4691500a8b1fb
SHA14b9d1adf675a66353df477928a7426714558ad10
SHA256a33b1ee4b6c06d3c725f4be8118ca3a315ad7c6a3751637870e848e943bcec27
SHA5124bf062998f037d009075a53defabcfda0010f31b6405c57f6d59967be2ac31bc91e7d123868fadfd1c5ed712eb379ba48b5a49b7f37b8e98a8df84b2d22c5d1a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5884.exeFilesize
321KB
MD5eb34ec078eb153c341d4691500a8b1fb
SHA14b9d1adf675a66353df477928a7426714558ad10
SHA256a33b1ee4b6c06d3c725f4be8118ca3a315ad7c6a3751637870e848e943bcec27
SHA5124bf062998f037d009075a53defabcfda0010f31b6405c57f6d59967be2ac31bc91e7d123868fadfd1c5ed712eb379ba48b5a49b7f37b8e98a8df84b2d22c5d1a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8815.exeFilesize
380KB
MD597a80ba02f48bf41358785dbc01bf82b
SHA187f3e310e4a29efff3f128ccd66a25b31737af60
SHA25616531648b49683e7b08f5e3ba38859cd9d32447816e7c4884992a37ae15657a5
SHA512c3834c7546b735f8cbd651b654fe206f3d545ba18a57122e95673c93196eb6190eb594d231f953e4d7e4cb7851751e5a94e7a4a8da2318fda8d29cac77fb7a98
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8815.exeFilesize
380KB
MD597a80ba02f48bf41358785dbc01bf82b
SHA187f3e310e4a29efff3f128ccd66a25b31737af60
SHA25616531648b49683e7b08f5e3ba38859cd9d32447816e7c4884992a37ae15657a5
SHA512c3834c7546b735f8cbd651b654fe206f3d545ba18a57122e95673c93196eb6190eb594d231f953e4d7e4cb7851751e5a94e7a4a8da2318fda8d29cac77fb7a98
-
memory/2680-1093-0x0000000007920000-0x0000000007F26000-memory.dmpFilesize
6.0MB
-
memory/2680-220-0x0000000004BB0000-0x0000000004BEF000-memory.dmpFilesize
252KB
-
memory/2680-1109-0x0000000007410000-0x0000000007420000-memory.dmpFilesize
64KB
-
memory/2680-1108-0x0000000008D20000-0x000000000924C000-memory.dmpFilesize
5.2MB
-
memory/2680-1107-0x0000000008B40000-0x0000000008D02000-memory.dmpFilesize
1.8MB
-
memory/2680-194-0x0000000004BB0000-0x0000000004BEF000-memory.dmpFilesize
252KB
-
memory/2680-1106-0x0000000008970000-0x00000000089C0000-memory.dmpFilesize
320KB
-
memory/2680-1105-0x00000000088D0000-0x0000000008946000-memory.dmpFilesize
472KB
-
memory/2680-1104-0x0000000007410000-0x0000000007420000-memory.dmpFilesize
64KB
-
memory/2680-1103-0x0000000007410000-0x0000000007420000-memory.dmpFilesize
64KB
-
memory/2680-196-0x0000000004BB0000-0x0000000004BEF000-memory.dmpFilesize
252KB
-
memory/2680-1102-0x0000000008210000-0x0000000008276000-memory.dmpFilesize
408KB
-
memory/2680-1101-0x0000000007410000-0x0000000007420000-memory.dmpFilesize
64KB
-
memory/2680-1100-0x0000000008170000-0x0000000008202000-memory.dmpFilesize
584KB
-
memory/2680-1098-0x00000000073C0000-0x000000000740B000-memory.dmpFilesize
300KB
-
memory/2680-1097-0x0000000007410000-0x0000000007420000-memory.dmpFilesize
64KB
-
memory/2680-1096-0x0000000007380000-0x00000000073BE000-memory.dmpFilesize
248KB
-
memory/2680-1095-0x0000000004DF0000-0x0000000004E02000-memory.dmpFilesize
72KB
-
memory/2680-1094-0x0000000007270000-0x000000000737A000-memory.dmpFilesize
1.0MB
-
memory/2680-204-0x0000000004BB0000-0x0000000004BEF000-memory.dmpFilesize
252KB
-
memory/2680-218-0x0000000004BB0000-0x0000000004BEF000-memory.dmpFilesize
252KB
-
memory/2680-216-0x0000000004BB0000-0x0000000004BEF000-memory.dmpFilesize
252KB
-
memory/2680-214-0x0000000004BB0000-0x0000000004BEF000-memory.dmpFilesize
252KB
-
memory/2680-212-0x0000000004BB0000-0x0000000004BEF000-memory.dmpFilesize
252KB
-
memory/2680-210-0x0000000004BB0000-0x0000000004BEF000-memory.dmpFilesize
252KB
-
memory/2680-181-0x0000000002E90000-0x0000000002ED6000-memory.dmpFilesize
280KB
-
memory/2680-182-0x0000000004BB0000-0x0000000004BF4000-memory.dmpFilesize
272KB
-
memory/2680-184-0x0000000007410000-0x0000000007420000-memory.dmpFilesize
64KB
-
memory/2680-183-0x0000000002C60000-0x0000000002CAB000-memory.dmpFilesize
300KB
-
memory/2680-192-0x0000000004BB0000-0x0000000004BEF000-memory.dmpFilesize
252KB
-
memory/2680-187-0x0000000004BB0000-0x0000000004BEF000-memory.dmpFilesize
252KB
-
memory/2680-186-0x0000000007410000-0x0000000007420000-memory.dmpFilesize
64KB
-
memory/2680-188-0x0000000004BB0000-0x0000000004BEF000-memory.dmpFilesize
252KB
-
memory/2680-190-0x0000000004BB0000-0x0000000004BEF000-memory.dmpFilesize
252KB
-
memory/2680-185-0x0000000007410000-0x0000000007420000-memory.dmpFilesize
64KB
-
memory/2680-208-0x0000000004BB0000-0x0000000004BEF000-memory.dmpFilesize
252KB
-
memory/2680-206-0x0000000004BB0000-0x0000000004BEF000-memory.dmpFilesize
252KB
-
memory/2680-198-0x0000000004BB0000-0x0000000004BEF000-memory.dmpFilesize
252KB
-
memory/2680-200-0x0000000004BB0000-0x0000000004BEF000-memory.dmpFilesize
252KB
-
memory/2680-202-0x0000000004BB0000-0x0000000004BEF000-memory.dmpFilesize
252KB
-
memory/3588-171-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/3588-162-0x00000000071A0000-0x00000000071B0000-memory.dmpFilesize
64KB
-
memory/3588-151-0x0000000004AB0000-0x0000000004AC2000-memory.dmpFilesize
72KB
-
memory/3588-139-0x0000000004AB0000-0x0000000004AC8000-memory.dmpFilesize
96KB
-
memory/3588-140-0x0000000004AB0000-0x0000000004AC2000-memory.dmpFilesize
72KB
-
memory/3588-173-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/3588-176-0x00000000071A0000-0x00000000071B0000-memory.dmpFilesize
64KB
-
memory/3588-175-0x00000000071A0000-0x00000000071B0000-memory.dmpFilesize
64KB
-
memory/3588-174-0x00000000071A0000-0x00000000071B0000-memory.dmpFilesize
64KB
-
memory/3588-138-0x00000000071B0000-0x00000000076AE000-memory.dmpFilesize
5.0MB
-
memory/3588-141-0x0000000004AB0000-0x0000000004AC2000-memory.dmpFilesize
72KB
-
memory/3588-155-0x0000000004AB0000-0x0000000004AC2000-memory.dmpFilesize
72KB
-
memory/3588-163-0x0000000004AB0000-0x0000000004AC2000-memory.dmpFilesize
72KB
-
memory/3588-168-0x0000000004AB0000-0x0000000004AC2000-memory.dmpFilesize
72KB
-
memory/3588-170-0x0000000004AB0000-0x0000000004AC2000-memory.dmpFilesize
72KB
-
memory/3588-166-0x0000000004AB0000-0x0000000004AC2000-memory.dmpFilesize
72KB
-
memory/3588-164-0x00000000071A0000-0x00000000071B0000-memory.dmpFilesize
64KB
-
memory/3588-160-0x00000000071A0000-0x00000000071B0000-memory.dmpFilesize
64KB
-
memory/3588-159-0x0000000004AB0000-0x0000000004AC2000-memory.dmpFilesize
72KB
-
memory/3588-157-0x0000000004AB0000-0x0000000004AC2000-memory.dmpFilesize
72KB
-
memory/3588-153-0x0000000004AB0000-0x0000000004AC2000-memory.dmpFilesize
72KB
-
memory/3588-147-0x0000000004AB0000-0x0000000004AC2000-memory.dmpFilesize
72KB
-
memory/3588-149-0x0000000004AB0000-0x0000000004AC2000-memory.dmpFilesize
72KB
-
memory/3588-145-0x0000000004AB0000-0x0000000004AC2000-memory.dmpFilesize
72KB
-
memory/3588-143-0x0000000004AB0000-0x0000000004AC2000-memory.dmpFilesize
72KB
-
memory/3588-137-0x0000000002DB0000-0x0000000002DCA000-memory.dmpFilesize
104KB
-
memory/3588-136-0x00000000001D0000-0x00000000001FD000-memory.dmpFilesize
180KB
-
memory/4184-1115-0x0000000000410000-0x0000000000442000-memory.dmpFilesize
200KB
-
memory/4184-1116-0x0000000004E50000-0x0000000004E9B000-memory.dmpFilesize
300KB
-
memory/4184-1117-0x0000000004FE0000-0x0000000004FF0000-memory.dmpFilesize
64KB