Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
28-03-2023 08:33
Static task
static1
Behavioral task
behavioral1
Sample
0606116a3b53ccbc0dc7df0da378121a1a798ea72520382ba12e3d73df358474.exe
Resource
win10-20230220-en
General
-
Target
0606116a3b53ccbc0dc7df0da378121a1a798ea72520382ba12e3d73df358474.exe
-
Size
684KB
-
MD5
0d81006a4f108abb17afaa4956a6a3f4
-
SHA1
8d16fbb4f2a8cdc08a098bec57b9a5c96b2ad97f
-
SHA256
0606116a3b53ccbc0dc7df0da378121a1a798ea72520382ba12e3d73df358474
-
SHA512
0ad06585d72a886efcc7a005ee1a90c7e944b41b4d469b26b4707092576fb4cf5e189e542f9407df47c0e3102ad3ff9f5b9e054dea0f795900f4b1ec257c2075
-
SSDEEP
12288:iMrJy90DW38OP2EyqHLzMns49lpT1p2KKmUBzmyL3e0pZgKJ+:PyB38ONJn4/pTz280myLp2K4
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Processes:
pro7756.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro7756.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro7756.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro7756.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro7756.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro7756.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/2204-181-0x0000000004760000-0x00000000047A6000-memory.dmp family_redline behavioral1/memory/2204-182-0x00000000070F0000-0x0000000007134000-memory.dmp family_redline behavioral1/memory/2204-184-0x00000000070F0000-0x000000000712F000-memory.dmp family_redline behavioral1/memory/2204-183-0x00000000070F0000-0x000000000712F000-memory.dmp family_redline behavioral1/memory/2204-186-0x00000000070F0000-0x000000000712F000-memory.dmp family_redline behavioral1/memory/2204-188-0x00000000070F0000-0x000000000712F000-memory.dmp family_redline behavioral1/memory/2204-190-0x00000000070F0000-0x000000000712F000-memory.dmp family_redline behavioral1/memory/2204-192-0x00000000070F0000-0x000000000712F000-memory.dmp family_redline behavioral1/memory/2204-194-0x00000000070F0000-0x000000000712F000-memory.dmp family_redline behavioral1/memory/2204-196-0x00000000070F0000-0x000000000712F000-memory.dmp family_redline behavioral1/memory/2204-198-0x00000000070F0000-0x000000000712F000-memory.dmp family_redline behavioral1/memory/2204-200-0x00000000070F0000-0x000000000712F000-memory.dmp family_redline behavioral1/memory/2204-206-0x00000000070F0000-0x000000000712F000-memory.dmp family_redline behavioral1/memory/2204-202-0x00000000070F0000-0x000000000712F000-memory.dmp family_redline behavioral1/memory/2204-210-0x00000000070F0000-0x000000000712F000-memory.dmp family_redline behavioral1/memory/2204-212-0x00000000070F0000-0x000000000712F000-memory.dmp family_redline behavioral1/memory/2204-216-0x00000000070F0000-0x000000000712F000-memory.dmp family_redline behavioral1/memory/2204-214-0x00000000070F0000-0x000000000712F000-memory.dmp family_redline behavioral1/memory/2204-218-0x00000000070F0000-0x000000000712F000-memory.dmp family_redline behavioral1/memory/2204-220-0x00000000070F0000-0x000000000712F000-memory.dmp family_redline behavioral1/memory/2204-1100-0x0000000007160000-0x0000000007170000-memory.dmp family_redline behavioral1/memory/2204-1101-0x0000000007160000-0x0000000007170000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un848236.exepro7756.exequ0212.exesi502441.exepid process 2412 un848236.exe 2680 pro7756.exe 2204 qu0212.exe 1284 si502441.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro7756.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro7756.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro7756.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
0606116a3b53ccbc0dc7df0da378121a1a798ea72520382ba12e3d73df358474.exeun848236.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 0606116a3b53ccbc0dc7df0da378121a1a798ea72520382ba12e3d73df358474.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 0606116a3b53ccbc0dc7df0da378121a1a798ea72520382ba12e3d73df358474.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un848236.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un848236.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro7756.exequ0212.exesi502441.exepid process 2680 pro7756.exe 2680 pro7756.exe 2204 qu0212.exe 2204 qu0212.exe 1284 si502441.exe 1284 si502441.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro7756.exequ0212.exesi502441.exedescription pid process Token: SeDebugPrivilege 2680 pro7756.exe Token: SeDebugPrivilege 2204 qu0212.exe Token: SeDebugPrivilege 1284 si502441.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
0606116a3b53ccbc0dc7df0da378121a1a798ea72520382ba12e3d73df358474.exeun848236.exedescription pid process target process PID 2140 wrote to memory of 2412 2140 0606116a3b53ccbc0dc7df0da378121a1a798ea72520382ba12e3d73df358474.exe un848236.exe PID 2140 wrote to memory of 2412 2140 0606116a3b53ccbc0dc7df0da378121a1a798ea72520382ba12e3d73df358474.exe un848236.exe PID 2140 wrote to memory of 2412 2140 0606116a3b53ccbc0dc7df0da378121a1a798ea72520382ba12e3d73df358474.exe un848236.exe PID 2412 wrote to memory of 2680 2412 un848236.exe pro7756.exe PID 2412 wrote to memory of 2680 2412 un848236.exe pro7756.exe PID 2412 wrote to memory of 2680 2412 un848236.exe pro7756.exe PID 2412 wrote to memory of 2204 2412 un848236.exe qu0212.exe PID 2412 wrote to memory of 2204 2412 un848236.exe qu0212.exe PID 2412 wrote to memory of 2204 2412 un848236.exe qu0212.exe PID 2140 wrote to memory of 1284 2140 0606116a3b53ccbc0dc7df0da378121a1a798ea72520382ba12e3d73df358474.exe si502441.exe PID 2140 wrote to memory of 1284 2140 0606116a3b53ccbc0dc7df0da378121a1a798ea72520382ba12e3d73df358474.exe si502441.exe PID 2140 wrote to memory of 1284 2140 0606116a3b53ccbc0dc7df0da378121a1a798ea72520382ba12e3d73df358474.exe si502441.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0606116a3b53ccbc0dc7df0da378121a1a798ea72520382ba12e3d73df358474.exe"C:\Users\Admin\AppData\Local\Temp\0606116a3b53ccbc0dc7df0da378121a1a798ea72520382ba12e3d73df358474.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un848236.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un848236.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7756.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7756.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0212.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0212.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si502441.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si502441.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si502441.exeFilesize
175KB
MD58c774ae8f9b3a4fcb225a01524916253
SHA1631968d815f95d1e40398ae7573881d53e8b0f4e
SHA256edcc87c4dc534a428ba307158c0bb43b7d39fb552cfe3cec0b61beae22d88d56
SHA51216bec66e5bde1c988b622405bf5a166a40f7ee1211ce9b91f61d8d5c7b7eab354282e0b042d07acf05bdfe01f0d9ab593d5407071189f7726176e44543ef8cec
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si502441.exeFilesize
175KB
MD58c774ae8f9b3a4fcb225a01524916253
SHA1631968d815f95d1e40398ae7573881d53e8b0f4e
SHA256edcc87c4dc534a428ba307158c0bb43b7d39fb552cfe3cec0b61beae22d88d56
SHA51216bec66e5bde1c988b622405bf5a166a40f7ee1211ce9b91f61d8d5c7b7eab354282e0b042d07acf05bdfe01f0d9ab593d5407071189f7726176e44543ef8cec
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un848236.exeFilesize
542KB
MD5d61c06bdc857ff7c6f2b83f265135b1d
SHA171b550f385953b3d6f1cdd77a2e8b704f40055fe
SHA256ecc4e3f93dd220cca9e451787282d23f7c612bcd84fddff45d3e9ac6f4c86446
SHA5127ba5c449bfcb26b18c2ef46aa300b894326a9bd546fa31f760f5a8721b65165ad4b048aa7a89e49ff72b9ae64d3cf3d72f35451cbed3a73f5ca6e7bdca8e6126
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un848236.exeFilesize
542KB
MD5d61c06bdc857ff7c6f2b83f265135b1d
SHA171b550f385953b3d6f1cdd77a2e8b704f40055fe
SHA256ecc4e3f93dd220cca9e451787282d23f7c612bcd84fddff45d3e9ac6f4c86446
SHA5127ba5c449bfcb26b18c2ef46aa300b894326a9bd546fa31f760f5a8721b65165ad4b048aa7a89e49ff72b9ae64d3cf3d72f35451cbed3a73f5ca6e7bdca8e6126
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7756.exeFilesize
321KB
MD5d383e21c398e84d15551d7dd66a001aa
SHA19254470f6eab3a83048bbd4891a881c8ae7218b5
SHA256bc5a4b2a9a5fa36c93e099825046d34e258b832819629aed44683145729b62ab
SHA5122f0d0cdf1bdeb9d54237dba075fad60c0773238ba988bd1c4afde727e7326296e293af2ed7e1270df778df33c6851770dce20e6b5e4eaa913a0abe8dd78fa8c5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7756.exeFilesize
321KB
MD5d383e21c398e84d15551d7dd66a001aa
SHA19254470f6eab3a83048bbd4891a881c8ae7218b5
SHA256bc5a4b2a9a5fa36c93e099825046d34e258b832819629aed44683145729b62ab
SHA5122f0d0cdf1bdeb9d54237dba075fad60c0773238ba988bd1c4afde727e7326296e293af2ed7e1270df778df33c6851770dce20e6b5e4eaa913a0abe8dd78fa8c5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0212.exeFilesize
380KB
MD556d7a66655a68cbaccf8247abbc252cd
SHA18625965e5cbd3d021bf5318fcaf58ab61d083b13
SHA2563366e548c120b3d3660e67675d08b0372f4cb9256f58de403b92cafb846a7755
SHA5125d0fc82adf89cb0b72ec7a9c11c023cf3b0e94751b386d6b8912de9ce0eadc035c788cc0e1190309c6cb261a91ae48eee3ab66f1464d3eadba4b8435619543e6
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0212.exeFilesize
380KB
MD556d7a66655a68cbaccf8247abbc252cd
SHA18625965e5cbd3d021bf5318fcaf58ab61d083b13
SHA2563366e548c120b3d3660e67675d08b0372f4cb9256f58de403b92cafb846a7755
SHA5125d0fc82adf89cb0b72ec7a9c11c023cf3b0e94751b386d6b8912de9ce0eadc035c788cc0e1190309c6cb261a91ae48eee3ab66f1464d3eadba4b8435619543e6
-
memory/1284-1116-0x00000000056A0000-0x00000000056B0000-memory.dmpFilesize
64KB
-
memory/1284-1115-0x0000000005360000-0x00000000053AB000-memory.dmpFilesize
300KB
-
memory/1284-1114-0x0000000000A60000-0x0000000000A92000-memory.dmpFilesize
200KB
-
memory/2204-1093-0x0000000007CB0000-0x00000000082B6000-memory.dmpFilesize
6.0MB
-
memory/2204-1096-0x0000000007880000-0x00000000078BE000-memory.dmpFilesize
248KB
-
memory/2204-1108-0x00000000092E0000-0x0000000009330000-memory.dmpFilesize
320KB
-
memory/2204-1107-0x0000000009240000-0x00000000092B6000-memory.dmpFilesize
472KB
-
memory/2204-1106-0x0000000008C00000-0x000000000912C000-memory.dmpFilesize
5.2MB
-
memory/2204-1105-0x0000000008A10000-0x0000000008BD2000-memory.dmpFilesize
1.8MB
-
memory/2204-1104-0x0000000008840000-0x00000000088D2000-memory.dmpFilesize
584KB
-
memory/2204-1103-0x0000000007B60000-0x0000000007BC6000-memory.dmpFilesize
408KB
-
memory/2204-1102-0x0000000007160000-0x0000000007170000-memory.dmpFilesize
64KB
-
memory/2204-1101-0x0000000007160000-0x0000000007170000-memory.dmpFilesize
64KB
-
memory/2204-1100-0x0000000007160000-0x0000000007170000-memory.dmpFilesize
64KB
-
memory/2204-1098-0x0000000007160000-0x0000000007170000-memory.dmpFilesize
64KB
-
memory/2204-1097-0x0000000007A10000-0x0000000007A5B000-memory.dmpFilesize
300KB
-
memory/2204-1095-0x0000000007860000-0x0000000007872000-memory.dmpFilesize
72KB
-
memory/2204-1094-0x0000000007720000-0x000000000782A000-memory.dmpFilesize
1.0MB
-
memory/2204-220-0x00000000070F0000-0x000000000712F000-memory.dmpFilesize
252KB
-
memory/2204-218-0x00000000070F0000-0x000000000712F000-memory.dmpFilesize
252KB
-
memory/2204-214-0x00000000070F0000-0x000000000712F000-memory.dmpFilesize
252KB
-
memory/2204-216-0x00000000070F0000-0x000000000712F000-memory.dmpFilesize
252KB
-
memory/2204-212-0x00000000070F0000-0x000000000712F000-memory.dmpFilesize
252KB
-
memory/2204-210-0x00000000070F0000-0x000000000712F000-memory.dmpFilesize
252KB
-
memory/2204-202-0x00000000070F0000-0x000000000712F000-memory.dmpFilesize
252KB
-
memory/2204-181-0x0000000004760000-0x00000000047A6000-memory.dmpFilesize
280KB
-
memory/2204-182-0x00000000070F0000-0x0000000007134000-memory.dmpFilesize
272KB
-
memory/2204-184-0x00000000070F0000-0x000000000712F000-memory.dmpFilesize
252KB
-
memory/2204-183-0x00000000070F0000-0x000000000712F000-memory.dmpFilesize
252KB
-
memory/2204-186-0x00000000070F0000-0x000000000712F000-memory.dmpFilesize
252KB
-
memory/2204-188-0x00000000070F0000-0x000000000712F000-memory.dmpFilesize
252KB
-
memory/2204-190-0x00000000070F0000-0x000000000712F000-memory.dmpFilesize
252KB
-
memory/2204-192-0x00000000070F0000-0x000000000712F000-memory.dmpFilesize
252KB
-
memory/2204-194-0x00000000070F0000-0x000000000712F000-memory.dmpFilesize
252KB
-
memory/2204-196-0x00000000070F0000-0x000000000712F000-memory.dmpFilesize
252KB
-
memory/2204-198-0x00000000070F0000-0x000000000712F000-memory.dmpFilesize
252KB
-
memory/2204-200-0x00000000070F0000-0x000000000712F000-memory.dmpFilesize
252KB
-
memory/2204-203-0x0000000002CB0000-0x0000000002CFB000-memory.dmpFilesize
300KB
-
memory/2204-205-0x0000000007160000-0x0000000007170000-memory.dmpFilesize
64KB
-
memory/2204-207-0x0000000007160000-0x0000000007170000-memory.dmpFilesize
64KB
-
memory/2204-209-0x0000000007160000-0x0000000007170000-memory.dmpFilesize
64KB
-
memory/2204-206-0x00000000070F0000-0x000000000712F000-memory.dmpFilesize
252KB
-
memory/2680-164-0x00000000075B0000-0x00000000075C2000-memory.dmpFilesize
72KB
-
memory/2680-136-0x00000000001D0000-0x00000000001FD000-memory.dmpFilesize
180KB
-
memory/2680-142-0x00000000046B0000-0x00000000046C0000-memory.dmpFilesize
64KB
-
memory/2680-175-0x00000000046B0000-0x00000000046C0000-memory.dmpFilesize
64KB
-
memory/2680-173-0x00000000046B0000-0x00000000046C0000-memory.dmpFilesize
64KB
-
memory/2680-172-0x00000000046B0000-0x00000000046C0000-memory.dmpFilesize
64KB
-
memory/2680-171-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/2680-141-0x00000000046B0000-0x00000000046C0000-memory.dmpFilesize
64KB
-
memory/2680-170-0x00000000075B0000-0x00000000075C2000-memory.dmpFilesize
72KB
-
memory/2680-168-0x00000000075B0000-0x00000000075C2000-memory.dmpFilesize
72KB
-
memory/2680-144-0x00000000075B0000-0x00000000075C2000-memory.dmpFilesize
72KB
-
memory/2680-166-0x00000000075B0000-0x00000000075C2000-memory.dmpFilesize
72KB
-
memory/2680-176-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/2680-143-0x00000000075B0000-0x00000000075C2000-memory.dmpFilesize
72KB
-
memory/2680-146-0x00000000075B0000-0x00000000075C2000-memory.dmpFilesize
72KB
-
memory/2680-158-0x00000000075B0000-0x00000000075C2000-memory.dmpFilesize
72KB
-
memory/2680-156-0x00000000075B0000-0x00000000075C2000-memory.dmpFilesize
72KB
-
memory/2680-154-0x00000000075B0000-0x00000000075C2000-memory.dmpFilesize
72KB
-
memory/2680-152-0x00000000075B0000-0x00000000075C2000-memory.dmpFilesize
72KB
-
memory/2680-150-0x00000000075B0000-0x00000000075C2000-memory.dmpFilesize
72KB
-
memory/2680-148-0x00000000075B0000-0x00000000075C2000-memory.dmpFilesize
72KB
-
memory/2680-160-0x00000000075B0000-0x00000000075C2000-memory.dmpFilesize
72KB
-
memory/2680-140-0x00000000046B0000-0x00000000046C0000-memory.dmpFilesize
64KB
-
memory/2680-139-0x00000000075B0000-0x00000000075C8000-memory.dmpFilesize
96KB
-
memory/2680-138-0x0000000007070000-0x000000000756E000-memory.dmpFilesize
5.0MB
-
memory/2680-137-0x0000000004950000-0x000000000496A000-memory.dmpFilesize
104KB
-
memory/2680-162-0x00000000075B0000-0x00000000075C2000-memory.dmpFilesize
72KB