Analysis
-
max time kernel
56s -
max time network
58s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
28-03-2023 09:15
Static task
static1
Behavioral task
behavioral1
Sample
c2f62a9f631226e3b963ffa5001d4e16d4b7fd9fb0726b6b39786ac32dcba78b.exe
Resource
win10-20230220-en
General
-
Target
c2f62a9f631226e3b963ffa5001d4e16d4b7fd9fb0726b6b39786ac32dcba78b.exe
-
Size
682KB
-
MD5
be2b4d1dd8d09c1f097faefd1b14a63f
-
SHA1
eb950e4cd9aef825bbaac4ffea61d9c95f906ec2
-
SHA256
c2f62a9f631226e3b963ffa5001d4e16d4b7fd9fb0726b6b39786ac32dcba78b
-
SHA512
c90215501e0af63146e3ba332d5dd918359dc167d093668a45d8a484916dd67a481c97f5fd751bd984127a9e75bc047b6e6fc1ae2d06431aa4cc610f05ec4937
-
SSDEEP
12288:8Mrzy90gVcmDqcgHlUguhAYrZMPBOPqB0oI86rNIkU/umtL39/:Xy4K+gSYqUPe0cc1mtLd
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Processes:
pro2696.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro2696.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro2696.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro2696.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro2696.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro2696.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/4748-181-0x0000000004710000-0x0000000004756000-memory.dmp family_redline behavioral1/memory/4748-185-0x0000000007630000-0x0000000007674000-memory.dmp family_redline behavioral1/memory/4748-186-0x0000000007630000-0x000000000766F000-memory.dmp family_redline behavioral1/memory/4748-187-0x0000000007630000-0x000000000766F000-memory.dmp family_redline behavioral1/memory/4748-189-0x0000000007630000-0x000000000766F000-memory.dmp family_redline behavioral1/memory/4748-191-0x0000000007630000-0x000000000766F000-memory.dmp family_redline behavioral1/memory/4748-193-0x0000000007630000-0x000000000766F000-memory.dmp family_redline behavioral1/memory/4748-195-0x0000000007630000-0x000000000766F000-memory.dmp family_redline behavioral1/memory/4748-197-0x0000000007630000-0x000000000766F000-memory.dmp family_redline behavioral1/memory/4748-199-0x0000000007630000-0x000000000766F000-memory.dmp family_redline behavioral1/memory/4748-201-0x0000000007630000-0x000000000766F000-memory.dmp family_redline behavioral1/memory/4748-204-0x0000000007630000-0x000000000766F000-memory.dmp family_redline behavioral1/memory/4748-206-0x0000000007630000-0x000000000766F000-memory.dmp family_redline behavioral1/memory/4748-208-0x0000000007630000-0x000000000766F000-memory.dmp family_redline behavioral1/memory/4748-210-0x0000000007630000-0x000000000766F000-memory.dmp family_redline behavioral1/memory/4748-212-0x0000000007630000-0x000000000766F000-memory.dmp family_redline behavioral1/memory/4748-214-0x0000000007630000-0x000000000766F000-memory.dmp family_redline behavioral1/memory/4748-216-0x0000000007630000-0x000000000766F000-memory.dmp family_redline behavioral1/memory/4748-218-0x0000000007630000-0x000000000766F000-memory.dmp family_redline behavioral1/memory/4748-220-0x0000000007630000-0x000000000766F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un490959.exepro2696.exequ4835.exesi846255.exepid process 4228 un490959.exe 3652 pro2696.exe 4748 qu4835.exe 3820 si846255.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro2696.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro2696.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro2696.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
c2f62a9f631226e3b963ffa5001d4e16d4b7fd9fb0726b6b39786ac32dcba78b.exeun490959.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce c2f62a9f631226e3b963ffa5001d4e16d4b7fd9fb0726b6b39786ac32dcba78b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c2f62a9f631226e3b963ffa5001d4e16d4b7fd9fb0726b6b39786ac32dcba78b.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un490959.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un490959.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro2696.exequ4835.exesi846255.exepid process 3652 pro2696.exe 3652 pro2696.exe 4748 qu4835.exe 4748 qu4835.exe 3820 si846255.exe 3820 si846255.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro2696.exequ4835.exesi846255.exedescription pid process Token: SeDebugPrivilege 3652 pro2696.exe Token: SeDebugPrivilege 4748 qu4835.exe Token: SeDebugPrivilege 3820 si846255.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
c2f62a9f631226e3b963ffa5001d4e16d4b7fd9fb0726b6b39786ac32dcba78b.exeun490959.exedescription pid process target process PID 4032 wrote to memory of 4228 4032 c2f62a9f631226e3b963ffa5001d4e16d4b7fd9fb0726b6b39786ac32dcba78b.exe un490959.exe PID 4032 wrote to memory of 4228 4032 c2f62a9f631226e3b963ffa5001d4e16d4b7fd9fb0726b6b39786ac32dcba78b.exe un490959.exe PID 4032 wrote to memory of 4228 4032 c2f62a9f631226e3b963ffa5001d4e16d4b7fd9fb0726b6b39786ac32dcba78b.exe un490959.exe PID 4228 wrote to memory of 3652 4228 un490959.exe pro2696.exe PID 4228 wrote to memory of 3652 4228 un490959.exe pro2696.exe PID 4228 wrote to memory of 3652 4228 un490959.exe pro2696.exe PID 4228 wrote to memory of 4748 4228 un490959.exe qu4835.exe PID 4228 wrote to memory of 4748 4228 un490959.exe qu4835.exe PID 4228 wrote to memory of 4748 4228 un490959.exe qu4835.exe PID 4032 wrote to memory of 3820 4032 c2f62a9f631226e3b963ffa5001d4e16d4b7fd9fb0726b6b39786ac32dcba78b.exe si846255.exe PID 4032 wrote to memory of 3820 4032 c2f62a9f631226e3b963ffa5001d4e16d4b7fd9fb0726b6b39786ac32dcba78b.exe si846255.exe PID 4032 wrote to memory of 3820 4032 c2f62a9f631226e3b963ffa5001d4e16d4b7fd9fb0726b6b39786ac32dcba78b.exe si846255.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2f62a9f631226e3b963ffa5001d4e16d4b7fd9fb0726b6b39786ac32dcba78b.exe"C:\Users\Admin\AppData\Local\Temp\c2f62a9f631226e3b963ffa5001d4e16d4b7fd9fb0726b6b39786ac32dcba78b.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un490959.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un490959.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2696.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2696.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4835.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4835.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si846255.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si846255.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si846255.exeFilesize
175KB
MD58ae4ec72ebb0e987edb459a01e5aae4e
SHA1b814828eba1548ba04adaf4a73d6a6dcaa14e7d0
SHA25666bf531465c044b9712bf3f220150bf978c84ef2b02103d997d55edb0780a6e6
SHA51273be1df36b3fee24730101c52df7e677da313ad9c2c361b603f3d39cd715086a18bbf629b2b615f7a0464b9b108f74cf2d9e2fa62ec74af2915936730ff2b160
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si846255.exeFilesize
175KB
MD58ae4ec72ebb0e987edb459a01e5aae4e
SHA1b814828eba1548ba04adaf4a73d6a6dcaa14e7d0
SHA25666bf531465c044b9712bf3f220150bf978c84ef2b02103d997d55edb0780a6e6
SHA51273be1df36b3fee24730101c52df7e677da313ad9c2c361b603f3d39cd715086a18bbf629b2b615f7a0464b9b108f74cf2d9e2fa62ec74af2915936730ff2b160
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un490959.exeFilesize
540KB
MD5939642df2c22af32272ae0b88487f8a1
SHA1604bd5a7dc6141bf29bdcb7bbcf82504ea74b2e2
SHA256c8f64ad22f59202453fbeb85f6ad8fdf2e3198c232d8e18113df9cf5e1176c35
SHA5123d6d86aeb149cd4c551843070ed5fe03287b7d764911634d9865baf7c6fb517f3230bd381d26664839b56c12857b7c40b7ab744ca721f5020ab3f8b6841bfa3a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un490959.exeFilesize
540KB
MD5939642df2c22af32272ae0b88487f8a1
SHA1604bd5a7dc6141bf29bdcb7bbcf82504ea74b2e2
SHA256c8f64ad22f59202453fbeb85f6ad8fdf2e3198c232d8e18113df9cf5e1176c35
SHA5123d6d86aeb149cd4c551843070ed5fe03287b7d764911634d9865baf7c6fb517f3230bd381d26664839b56c12857b7c40b7ab744ca721f5020ab3f8b6841bfa3a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2696.exeFilesize
321KB
MD519fbe7907e5e01081a3eaf9df4d3bc3b
SHA1dd3b6fef13cd7fa7d541a086d9bdb10b154a2029
SHA25631336bc4c090879e39e01a5b66c1db3ef52666bc5b64f83e6072c418fe464d65
SHA51235e67208a9ab2e1948bcb20e6c97f81f8a26ca805d212199667af5fb2de45f53e55ada1e14f09ca5883f39d85c671cb78afc26349437cfe81a1300dba57aca66
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2696.exeFilesize
321KB
MD519fbe7907e5e01081a3eaf9df4d3bc3b
SHA1dd3b6fef13cd7fa7d541a086d9bdb10b154a2029
SHA25631336bc4c090879e39e01a5b66c1db3ef52666bc5b64f83e6072c418fe464d65
SHA51235e67208a9ab2e1948bcb20e6c97f81f8a26ca805d212199667af5fb2de45f53e55ada1e14f09ca5883f39d85c671cb78afc26349437cfe81a1300dba57aca66
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4835.exeFilesize
380KB
MD5a377544bd4f85a5645e4098b8599f16f
SHA10eef5d35edcea359fd9060e39ad286165ab6b328
SHA256b741616273571da661986c5d8c337d2b2849678bf793520aadb9e2239814b8cd
SHA51206b57a1878323521a471eaad8b6844b428c860e69bf9312daab430a98290319b3b9269f631c73516b7c52b2a6ecaf2a2cf70419373121a247aee46a20c49f9c5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4835.exeFilesize
380KB
MD5a377544bd4f85a5645e4098b8599f16f
SHA10eef5d35edcea359fd9060e39ad286165ab6b328
SHA256b741616273571da661986c5d8c337d2b2849678bf793520aadb9e2239814b8cd
SHA51206b57a1878323521a471eaad8b6844b428c860e69bf9312daab430a98290319b3b9269f631c73516b7c52b2a6ecaf2a2cf70419373121a247aee46a20c49f9c5
-
memory/3652-148-0x0000000004830000-0x0000000004842000-memory.dmpFilesize
72KB
-
memory/3652-158-0x0000000004830000-0x0000000004842000-memory.dmpFilesize
72KB
-
memory/3652-138-0x0000000007310000-0x000000000780E000-memory.dmpFilesize
5.0MB
-
memory/3652-139-0x0000000004830000-0x0000000004848000-memory.dmpFilesize
96KB
-
memory/3652-141-0x0000000007300000-0x0000000007310000-memory.dmpFilesize
64KB
-
memory/3652-140-0x0000000007300000-0x0000000007310000-memory.dmpFilesize
64KB
-
memory/3652-142-0x0000000007300000-0x0000000007310000-memory.dmpFilesize
64KB
-
memory/3652-143-0x0000000004830000-0x0000000004842000-memory.dmpFilesize
72KB
-
memory/3652-144-0x0000000004830000-0x0000000004842000-memory.dmpFilesize
72KB
-
memory/3652-146-0x0000000004830000-0x0000000004842000-memory.dmpFilesize
72KB
-
memory/3652-136-0x00000000001D0000-0x00000000001FD000-memory.dmpFilesize
180KB
-
memory/3652-150-0x0000000004830000-0x0000000004842000-memory.dmpFilesize
72KB
-
memory/3652-152-0x0000000004830000-0x0000000004842000-memory.dmpFilesize
72KB
-
memory/3652-154-0x0000000004830000-0x0000000004842000-memory.dmpFilesize
72KB
-
memory/3652-156-0x0000000004830000-0x0000000004842000-memory.dmpFilesize
72KB
-
memory/3652-137-0x0000000002EE0000-0x0000000002EFA000-memory.dmpFilesize
104KB
-
memory/3652-160-0x0000000004830000-0x0000000004842000-memory.dmpFilesize
72KB
-
memory/3652-162-0x0000000004830000-0x0000000004842000-memory.dmpFilesize
72KB
-
memory/3652-164-0x0000000004830000-0x0000000004842000-memory.dmpFilesize
72KB
-
memory/3652-166-0x0000000004830000-0x0000000004842000-memory.dmpFilesize
72KB
-
memory/3652-168-0x0000000004830000-0x0000000004842000-memory.dmpFilesize
72KB
-
memory/3652-170-0x0000000004830000-0x0000000004842000-memory.dmpFilesize
72KB
-
memory/3652-171-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/3652-172-0x0000000007300000-0x0000000007310000-memory.dmpFilesize
64KB
-
memory/3652-173-0x0000000007300000-0x0000000007310000-memory.dmpFilesize
64KB
-
memory/3652-174-0x0000000007300000-0x0000000007310000-memory.dmpFilesize
64KB
-
memory/3652-176-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/3820-1114-0x0000000000010000-0x0000000000042000-memory.dmpFilesize
200KB
-
memory/3820-1116-0x0000000004BE0000-0x0000000004BF0000-memory.dmpFilesize
64KB
-
memory/3820-1115-0x0000000004A50000-0x0000000004A9B000-memory.dmpFilesize
300KB
-
memory/4748-183-0x0000000007120000-0x0000000007130000-memory.dmpFilesize
64KB
-
memory/4748-185-0x0000000007630000-0x0000000007674000-memory.dmpFilesize
272KB
-
memory/4748-184-0x0000000007120000-0x0000000007130000-memory.dmpFilesize
64KB
-
memory/4748-186-0x0000000007630000-0x000000000766F000-memory.dmpFilesize
252KB
-
memory/4748-187-0x0000000007630000-0x000000000766F000-memory.dmpFilesize
252KB
-
memory/4748-189-0x0000000007630000-0x000000000766F000-memory.dmpFilesize
252KB
-
memory/4748-191-0x0000000007630000-0x000000000766F000-memory.dmpFilesize
252KB
-
memory/4748-193-0x0000000007630000-0x000000000766F000-memory.dmpFilesize
252KB
-
memory/4748-195-0x0000000007630000-0x000000000766F000-memory.dmpFilesize
252KB
-
memory/4748-197-0x0000000007630000-0x000000000766F000-memory.dmpFilesize
252KB
-
memory/4748-199-0x0000000007630000-0x000000000766F000-memory.dmpFilesize
252KB
-
memory/4748-201-0x0000000007630000-0x000000000766F000-memory.dmpFilesize
252KB
-
memory/4748-204-0x0000000007630000-0x000000000766F000-memory.dmpFilesize
252KB
-
memory/4748-203-0x0000000007120000-0x0000000007130000-memory.dmpFilesize
64KB
-
memory/4748-206-0x0000000007630000-0x000000000766F000-memory.dmpFilesize
252KB
-
memory/4748-208-0x0000000007630000-0x000000000766F000-memory.dmpFilesize
252KB
-
memory/4748-210-0x0000000007630000-0x000000000766F000-memory.dmpFilesize
252KB
-
memory/4748-212-0x0000000007630000-0x000000000766F000-memory.dmpFilesize
252KB
-
memory/4748-214-0x0000000007630000-0x000000000766F000-memory.dmpFilesize
252KB
-
memory/4748-216-0x0000000007630000-0x000000000766F000-memory.dmpFilesize
252KB
-
memory/4748-218-0x0000000007630000-0x000000000766F000-memory.dmpFilesize
252KB
-
memory/4748-220-0x0000000007630000-0x000000000766F000-memory.dmpFilesize
252KB
-
memory/4748-1093-0x00000000076A0000-0x0000000007CA6000-memory.dmpFilesize
6.0MB
-
memory/4748-1094-0x0000000007D30000-0x0000000007E3A000-memory.dmpFilesize
1.0MB
-
memory/4748-1095-0x0000000007E70000-0x0000000007E82000-memory.dmpFilesize
72KB
-
memory/4748-1096-0x0000000007120000-0x0000000007130000-memory.dmpFilesize
64KB
-
memory/4748-1097-0x0000000007E90000-0x0000000007ECE000-memory.dmpFilesize
248KB
-
memory/4748-1098-0x0000000008020000-0x000000000806B000-memory.dmpFilesize
300KB
-
memory/4748-1100-0x0000000007120000-0x0000000007130000-memory.dmpFilesize
64KB
-
memory/4748-1101-0x0000000008170000-0x0000000008202000-memory.dmpFilesize
584KB
-
memory/4748-1102-0x0000000008210000-0x0000000008276000-memory.dmpFilesize
408KB
-
memory/4748-1103-0x00000000088D0000-0x0000000008946000-memory.dmpFilesize
472KB
-
memory/4748-1104-0x0000000008970000-0x00000000089C0000-memory.dmpFilesize
320KB
-
memory/4748-182-0x0000000002CE0000-0x0000000002D2B000-memory.dmpFilesize
300KB
-
memory/4748-181-0x0000000004710000-0x0000000004756000-memory.dmpFilesize
280KB
-
memory/4748-1105-0x0000000007120000-0x0000000007130000-memory.dmpFilesize
64KB
-
memory/4748-1107-0x0000000008B10000-0x0000000008CD2000-memory.dmpFilesize
1.8MB
-
memory/4748-1108-0x0000000008CE0000-0x000000000920C000-memory.dmpFilesize
5.2MB