Analysis
-
max time kernel
52s -
max time network
70s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
28-03-2023 10:25
Static task
static1
Behavioral task
behavioral1
Sample
d9ce6d90b42601c031b8ae52be2aa9e7ba7591fee56e7a40c2048f83d66cc23e.exe
Resource
win10-20230220-en
General
-
Target
d9ce6d90b42601c031b8ae52be2aa9e7ba7591fee56e7a40c2048f83d66cc23e.exe
-
Size
698KB
-
MD5
cdf5aa66228a9a24b3cd69d3dfe70e6b
-
SHA1
19cf08085bbd21dab55a7dec0787c77ff6ea8fdb
-
SHA256
d9ce6d90b42601c031b8ae52be2aa9e7ba7591fee56e7a40c2048f83d66cc23e
-
SHA512
40e82cda5b55526d4345f0dc473db778c5b0fdda455a91562f2bd468559e311cb550c9d26c687e1c3500c8579cc94bdadff30ccccbf4076286c73868f0bf2ebd
-
SSDEEP
12288:LMrJy90GEElBl5K4/A2BMz/E04RIfL6rfGjoAxI9gxcqwio:qyN1jjY2uryKUGj5I9ADwio
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
muse
176.113.115.145:4125
-
auth_value
b91988a63a24940038d9262827a5320c
Signatures
-
Processes:
pro8830.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro8830.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro8830.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro8830.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro8830.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro8830.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/3652-177-0x00000000049C0000-0x0000000004A06000-memory.dmp family_redline behavioral1/memory/3652-178-0x0000000004BA0000-0x0000000004BE4000-memory.dmp family_redline behavioral1/memory/3652-183-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/3652-186-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/3652-181-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/3652-188-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/3652-190-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/3652-192-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/3652-194-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/3652-196-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/3652-198-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/3652-200-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/3652-202-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/3652-204-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/3652-206-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/3652-208-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/3652-210-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/3652-212-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/3652-214-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline behavioral1/memory/3652-216-0x0000000004BA0000-0x0000000004BDF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un121125.exepro8830.exequ5992.exesi730620.exepid process 4576 un121125.exe 4656 pro8830.exe 3652 qu5992.exe 4148 si730620.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro8830.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro8830.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro8830.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
d9ce6d90b42601c031b8ae52be2aa9e7ba7591fee56e7a40c2048f83d66cc23e.exeun121125.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce d9ce6d90b42601c031b8ae52be2aa9e7ba7591fee56e7a40c2048f83d66cc23e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" d9ce6d90b42601c031b8ae52be2aa9e7ba7591fee56e7a40c2048f83d66cc23e.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un121125.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un121125.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro8830.exequ5992.exesi730620.exepid process 4656 pro8830.exe 4656 pro8830.exe 3652 qu5992.exe 3652 qu5992.exe 4148 si730620.exe 4148 si730620.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro8830.exequ5992.exesi730620.exedescription pid process Token: SeDebugPrivilege 4656 pro8830.exe Token: SeDebugPrivilege 3652 qu5992.exe Token: SeDebugPrivilege 4148 si730620.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
d9ce6d90b42601c031b8ae52be2aa9e7ba7591fee56e7a40c2048f83d66cc23e.exeun121125.exedescription pid process target process PID 4460 wrote to memory of 4576 4460 d9ce6d90b42601c031b8ae52be2aa9e7ba7591fee56e7a40c2048f83d66cc23e.exe un121125.exe PID 4460 wrote to memory of 4576 4460 d9ce6d90b42601c031b8ae52be2aa9e7ba7591fee56e7a40c2048f83d66cc23e.exe un121125.exe PID 4460 wrote to memory of 4576 4460 d9ce6d90b42601c031b8ae52be2aa9e7ba7591fee56e7a40c2048f83d66cc23e.exe un121125.exe PID 4576 wrote to memory of 4656 4576 un121125.exe pro8830.exe PID 4576 wrote to memory of 4656 4576 un121125.exe pro8830.exe PID 4576 wrote to memory of 4656 4576 un121125.exe pro8830.exe PID 4576 wrote to memory of 3652 4576 un121125.exe qu5992.exe PID 4576 wrote to memory of 3652 4576 un121125.exe qu5992.exe PID 4576 wrote to memory of 3652 4576 un121125.exe qu5992.exe PID 4460 wrote to memory of 4148 4460 d9ce6d90b42601c031b8ae52be2aa9e7ba7591fee56e7a40c2048f83d66cc23e.exe si730620.exe PID 4460 wrote to memory of 4148 4460 d9ce6d90b42601c031b8ae52be2aa9e7ba7591fee56e7a40c2048f83d66cc23e.exe si730620.exe PID 4460 wrote to memory of 4148 4460 d9ce6d90b42601c031b8ae52be2aa9e7ba7591fee56e7a40c2048f83d66cc23e.exe si730620.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9ce6d90b42601c031b8ae52be2aa9e7ba7591fee56e7a40c2048f83d66cc23e.exe"C:\Users\Admin\AppData\Local\Temp\d9ce6d90b42601c031b8ae52be2aa9e7ba7591fee56e7a40c2048f83d66cc23e.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un121125.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un121125.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8830.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8830.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5992.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5992.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si730620.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si730620.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4148
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si730620.exeFilesize
175KB
MD5d2f40967fe0f5fbe8701323c85a3b7af
SHA15f5ab79d701c8f6eb985b1664ab5d1a2d6354b5e
SHA256a00a676940a9eeb82c79c3202f618f14e2cb3b4a761048919d9ad216b3887510
SHA5120e2d5e4d97aabcc299690d6277c74eca1a56d1a009dbd713d53a751cf5c797e424ee8c320053269afde54c99b22cd0c2fd9aa4ab3ddfa3ada076f24312e86850
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si730620.exeFilesize
175KB
MD5d2f40967fe0f5fbe8701323c85a3b7af
SHA15f5ab79d701c8f6eb985b1664ab5d1a2d6354b5e
SHA256a00a676940a9eeb82c79c3202f618f14e2cb3b4a761048919d9ad216b3887510
SHA5120e2d5e4d97aabcc299690d6277c74eca1a56d1a009dbd713d53a751cf5c797e424ee8c320053269afde54c99b22cd0c2fd9aa4ab3ddfa3ada076f24312e86850
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un121125.exeFilesize
556KB
MD5d926f00f00f7012ac020dec6e1988f21
SHA1d55c0721a651fea22b202ee2c9a36b929a21339d
SHA2569b727368275ebb59f3d8c8cdd3c5c79fce8f54201578bfb08917f8a68a3b0555
SHA51285be9a7e5a1f73c8eb856bf1492836cea2c9968f2b7a86b92713b157f3801f0ba88120637a9e4f99bf80f59c262af04369645c719489ef643344709a3aca21c0
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un121125.exeFilesize
556KB
MD5d926f00f00f7012ac020dec6e1988f21
SHA1d55c0721a651fea22b202ee2c9a36b929a21339d
SHA2569b727368275ebb59f3d8c8cdd3c5c79fce8f54201578bfb08917f8a68a3b0555
SHA51285be9a7e5a1f73c8eb856bf1492836cea2c9968f2b7a86b92713b157f3801f0ba88120637a9e4f99bf80f59c262af04369645c719489ef643344709a3aca21c0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8830.exeFilesize
347KB
MD5b0792d7c8648248b6b77a5d8433f944b
SHA1930da085dcdc547f517741238a04f46c223cc29c
SHA2561e0d907799bebaea9c32fe2a105cd89a7041b3cf0e12974e413ac58f4bf4060f
SHA512c8001a21092621637355e1b57a847b805a664258b92f9e731fe336e7a7ab3f3af46870c0bc289cd1e7ae5a151b0eeb705f21c8cdc1a81c04959dac414b596b40
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8830.exeFilesize
347KB
MD5b0792d7c8648248b6b77a5d8433f944b
SHA1930da085dcdc547f517741238a04f46c223cc29c
SHA2561e0d907799bebaea9c32fe2a105cd89a7041b3cf0e12974e413ac58f4bf4060f
SHA512c8001a21092621637355e1b57a847b805a664258b92f9e731fe336e7a7ab3f3af46870c0bc289cd1e7ae5a151b0eeb705f21c8cdc1a81c04959dac414b596b40
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5992.exeFilesize
406KB
MD52e12cba27a727aae4652720f881c8f11
SHA1662b9961a97cb5729acdc21b7548e01f7bd90f29
SHA256b00857e887d4f81b1392af8b1344ff4f79ce09870962ad269cd757a24e3e9fd4
SHA51263678f2091bff30ea2c529d56aa8f95d42c516746cdee156a86a005944f08de95c938b88ce51d415b20f580befa70ba0d8f7e318926f2caecf8eac6851182758
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5992.exeFilesize
406KB
MD52e12cba27a727aae4652720f881c8f11
SHA1662b9961a97cb5729acdc21b7548e01f7bd90f29
SHA256b00857e887d4f81b1392af8b1344ff4f79ce09870962ad269cd757a24e3e9fd4
SHA51263678f2091bff30ea2c529d56aa8f95d42c516746cdee156a86a005944f08de95c938b88ce51d415b20f580befa70ba0d8f7e318926f2caecf8eac6851182758
-
memory/3652-1089-0x0000000007EB0000-0x00000000084B6000-memory.dmpFilesize
6.0MB
-
memory/3652-1090-0x00000000078A0000-0x00000000079AA000-memory.dmpFilesize
1.0MB
-
memory/3652-204-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/3652-202-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/3652-200-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/3652-190-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/3652-1105-0x0000000009580000-0x00000000095D0000-memory.dmpFilesize
320KB
-
memory/3652-1104-0x00000000094F0000-0x0000000009566000-memory.dmpFilesize
472KB
-
memory/3652-1103-0x0000000007290000-0x00000000072A0000-memory.dmpFilesize
64KB
-
memory/3652-1102-0x0000000008D50000-0x000000000927C000-memory.dmpFilesize
5.2MB
-
memory/3652-192-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/3652-1101-0x0000000008B60000-0x0000000008D22000-memory.dmpFilesize
1.8MB
-
memory/3652-1100-0x0000000008980000-0x0000000008A12000-memory.dmpFilesize
584KB
-
memory/3652-1099-0x0000000007290000-0x00000000072A0000-memory.dmpFilesize
64KB
-
memory/3652-1098-0x0000000007290000-0x00000000072A0000-memory.dmpFilesize
64KB
-
memory/3652-1097-0x0000000007290000-0x00000000072A0000-memory.dmpFilesize
64KB
-
memory/3652-1096-0x0000000007CB0000-0x0000000007D16000-memory.dmpFilesize
408KB
-
memory/3652-1094-0x0000000007B20000-0x0000000007B6B000-memory.dmpFilesize
300KB
-
memory/3652-1093-0x0000000007290000-0x00000000072A0000-memory.dmpFilesize
64KB
-
memory/3652-1092-0x00000000079D0000-0x0000000007A0E000-memory.dmpFilesize
248KB
-
memory/3652-1091-0x00000000079B0000-0x00000000079C2000-memory.dmpFilesize
72KB
-
memory/3652-206-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/3652-216-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/3652-214-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/3652-212-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/3652-177-0x00000000049C0000-0x0000000004A06000-memory.dmpFilesize
280KB
-
memory/3652-178-0x0000000004BA0000-0x0000000004BE4000-memory.dmpFilesize
272KB
-
memory/3652-179-0x0000000002CC0000-0x0000000002D0B000-memory.dmpFilesize
300KB
-
memory/3652-182-0x0000000007290000-0x00000000072A0000-memory.dmpFilesize
64KB
-
memory/3652-188-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/3652-186-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/3652-185-0x0000000007290000-0x00000000072A0000-memory.dmpFilesize
64KB
-
memory/3652-181-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/3652-180-0x0000000007290000-0x00000000072A0000-memory.dmpFilesize
64KB
-
memory/3652-183-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/3652-210-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/3652-208-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/3652-194-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/3652-196-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/3652-198-0x0000000004BA0000-0x0000000004BDF000-memory.dmpFilesize
252KB
-
memory/4148-1111-0x0000000000730000-0x0000000000762000-memory.dmpFilesize
200KB
-
memory/4148-1112-0x0000000005170000-0x00000000051BB000-memory.dmpFilesize
300KB
-
memory/4148-1113-0x0000000005270000-0x0000000005280000-memory.dmpFilesize
64KB
-
memory/4656-167-0x0000000000400000-0x0000000002B84000-memory.dmpFilesize
39.5MB
-
memory/4656-152-0x00000000070B0000-0x00000000070C2000-memory.dmpFilesize
72KB
-
memory/4656-142-0x00000000070B0000-0x00000000070C2000-memory.dmpFilesize
72KB
-
memory/4656-136-0x00000000070B0000-0x00000000070C8000-memory.dmpFilesize
96KB
-
memory/4656-135-0x0000000007180000-0x0000000007190000-memory.dmpFilesize
64KB
-
memory/4656-172-0x0000000000400000-0x0000000002B84000-memory.dmpFilesize
39.5MB
-
memory/4656-134-0x00000000001D0000-0x00000000001FD000-memory.dmpFilesize
180KB
-
memory/4656-170-0x0000000007180000-0x0000000007190000-memory.dmpFilesize
64KB
-
memory/4656-169-0x0000000007180000-0x0000000007190000-memory.dmpFilesize
64KB
-
memory/4656-168-0x0000000007180000-0x0000000007190000-memory.dmpFilesize
64KB
-
memory/4656-138-0x0000000007180000-0x0000000007190000-memory.dmpFilesize
64KB
-
memory/4656-166-0x00000000070B0000-0x00000000070C2000-memory.dmpFilesize
72KB
-
memory/4656-164-0x00000000070B0000-0x00000000070C2000-memory.dmpFilesize
72KB
-
memory/4656-162-0x00000000070B0000-0x00000000070C2000-memory.dmpFilesize
72KB
-
memory/4656-160-0x00000000070B0000-0x00000000070C2000-memory.dmpFilesize
72KB
-
memory/4656-158-0x00000000070B0000-0x00000000070C2000-memory.dmpFilesize
72KB
-
memory/4656-156-0x00000000070B0000-0x00000000070C2000-memory.dmpFilesize
72KB
-
memory/4656-154-0x00000000070B0000-0x00000000070C2000-memory.dmpFilesize
72KB
-
memory/4656-150-0x00000000070B0000-0x00000000070C2000-memory.dmpFilesize
72KB
-
memory/4656-148-0x00000000070B0000-0x00000000070C2000-memory.dmpFilesize
72KB
-
memory/4656-146-0x00000000070B0000-0x00000000070C2000-memory.dmpFilesize
72KB
-
memory/4656-144-0x00000000070B0000-0x00000000070C2000-memory.dmpFilesize
72KB
-
memory/4656-133-0x0000000007190000-0x000000000768E000-memory.dmpFilesize
5.0MB
-
memory/4656-132-0x0000000002D00000-0x0000000002D1A000-memory.dmpFilesize
104KB
-
memory/4656-140-0x00000000070B0000-0x00000000070C2000-memory.dmpFilesize
72KB
-
memory/4656-139-0x00000000070B0000-0x00000000070C2000-memory.dmpFilesize
72KB
-
memory/4656-137-0x0000000007180000-0x0000000007190000-memory.dmpFilesize
64KB