Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
09-02-2023 13:44
Static task
static1
Behavioral task
behavioral1
Sample
ba5984c03d8825ad47bb01a1646fc8cf8114c341c20af57a6207e095171d9c7b.exe
Resource
win10-20220901-en
General
-
Target
ba5984c03d8825ad47bb01a1646fc8cf8114c341c20af57a6207e095171d9c7b.exe
-
Size
519KB
-
MD5
266279d1ac76e447736c7a3e2de46482
-
SHA1
d534b302dcb7bb6c4a7b5656cef7b871f05fc1d8
-
SHA256
ba5984c03d8825ad47bb01a1646fc8cf8114c341c20af57a6207e095171d9c7b
-
SHA512
14d7e6443e55f4ed415557a45314bbc92d86e6f3e0e001b47dd9c3888fab6c6b7cc2b69fe11da558af4dd4b1361a11578f2bba8e29ef71c9a904a8901b548b56
-
SSDEEP
12288:aMrKy90xarJUF6sxWhEt1S/Fo4aZ4iq/NQcKFr:YyDrJUFx89FLaZK4r
Malware Config
Extracted
redline
romka
193.233.20.11:4131
-
auth_value
fcbb3247051f5290e8ac5b1a841af67b
Extracted
redline
crypt
176.113.115.17:4132
-
auth_value
407e05c9b3a74d99a20f90b091547bd6
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3732-223-0x0000000002270000-0x00000000022B6000-memory.dmp family_redline behavioral1/memory/3732-229-0x0000000004B60000-0x0000000004BA4000-memory.dmp family_redline -
Executes dropped EXE 2 IoCs
Processes:
baRf.execaRaRa.exepid process 3732 baRf.exe 4724 caRaRa.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
ba5984c03d8825ad47bb01a1646fc8cf8114c341c20af57a6207e095171d9c7b.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ba5984c03d8825ad47bb01a1646fc8cf8114c341c20af57a6207e095171d9c7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" ba5984c03d8825ad47bb01a1646fc8cf8114c341c20af57a6207e095171d9c7b.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
caRaRa.exedescription pid process target process PID 4724 set thread context of 668 4724 caRaRa.exe AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
baRf.exeAppLaunch.exepid process 3732 baRf.exe 3732 baRf.exe 668 AppLaunch.exe 668 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
baRf.exeAppLaunch.exedescription pid process Token: SeDebugPrivilege 3732 baRf.exe Token: SeDebugPrivilege 668 AppLaunch.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
ba5984c03d8825ad47bb01a1646fc8cf8114c341c20af57a6207e095171d9c7b.execaRaRa.exedescription pid process target process PID 5112 wrote to memory of 3732 5112 ba5984c03d8825ad47bb01a1646fc8cf8114c341c20af57a6207e095171d9c7b.exe baRf.exe PID 5112 wrote to memory of 3732 5112 ba5984c03d8825ad47bb01a1646fc8cf8114c341c20af57a6207e095171d9c7b.exe baRf.exe PID 5112 wrote to memory of 3732 5112 ba5984c03d8825ad47bb01a1646fc8cf8114c341c20af57a6207e095171d9c7b.exe baRf.exe PID 5112 wrote to memory of 4724 5112 ba5984c03d8825ad47bb01a1646fc8cf8114c341c20af57a6207e095171d9c7b.exe caRaRa.exe PID 5112 wrote to memory of 4724 5112 ba5984c03d8825ad47bb01a1646fc8cf8114c341c20af57a6207e095171d9c7b.exe caRaRa.exe PID 5112 wrote to memory of 4724 5112 ba5984c03d8825ad47bb01a1646fc8cf8114c341c20af57a6207e095171d9c7b.exe caRaRa.exe PID 4724 wrote to memory of 668 4724 caRaRa.exe AppLaunch.exe PID 4724 wrote to memory of 668 4724 caRaRa.exe AppLaunch.exe PID 4724 wrote to memory of 668 4724 caRaRa.exe AppLaunch.exe PID 4724 wrote to memory of 668 4724 caRaRa.exe AppLaunch.exe PID 4724 wrote to memory of 668 4724 caRaRa.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba5984c03d8825ad47bb01a1646fc8cf8114c341c20af57a6207e095171d9c7b.exe"C:\Users\Admin\AppData\Local\Temp\ba5984c03d8825ad47bb01a1646fc8cf8114c341c20af57a6207e095171d9c7b.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\baRf.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\baRf.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\caRaRa.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\caRaRa.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\baRf.exeFilesize
306KB
MD5ad2cb5628a66d002566ed06f3f39a142
SHA16d21e0971925a320ff90a0ee0a8ebb7e862fb7c3
SHA256f296e28cbd22fb5220bb1097931066d9572d0c07849ec237ceb116634bb9a493
SHA5121502c9feec15bc0da21a8415a453a3b3d33908db1011ec37c436f18d1569a6ab3248efcb8e183ae0f1bd2447aaa82e06be896fbd0b77cb2e0b5f62c982b99073
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\baRf.exeFilesize
306KB
MD5ad2cb5628a66d002566ed06f3f39a142
SHA16d21e0971925a320ff90a0ee0a8ebb7e862fb7c3
SHA256f296e28cbd22fb5220bb1097931066d9572d0c07849ec237ceb116634bb9a493
SHA5121502c9feec15bc0da21a8415a453a3b3d33908db1011ec37c436f18d1569a6ab3248efcb8e183ae0f1bd2447aaa82e06be896fbd0b77cb2e0b5f62c982b99073
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\caRaRa.exeFilesize
283KB
MD5457dcca2cfa8e1592521e4bc580d2097
SHA1de855fa7934126fd1cde834b752999ebe79e367f
SHA25654ce28a037eea87448e65bc25f8d3a38ddd4b4679516cc59899b77150aa46fcc
SHA512d15709dd44e184612a86e7201c78887771e7cc062e8b4daf83c5bbf1d6dd74320e8c5058cde295d412d8e5b135f8686f8ed56aa9aa2a439b022319e6723bb752
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\caRaRa.exeFilesize
283KB
MD5457dcca2cfa8e1592521e4bc580d2097
SHA1de855fa7934126fd1cde834b752999ebe79e367f
SHA25654ce28a037eea87448e65bc25f8d3a38ddd4b4679516cc59899b77150aa46fcc
SHA512d15709dd44e184612a86e7201c78887771e7cc062e8b4daf83c5bbf1d6dd74320e8c5058cde295d412d8e5b135f8686f8ed56aa9aa2a439b022319e6723bb752
-
memory/668-391-0x0000000008CE0000-0x0000000008D2B000-memory.dmpFilesize
300KB
-
memory/668-375-0x0000000000770000-0x00000000007A2000-memory.dmpFilesize
200KB
-
memory/668-323-0x000000000078B592-mapping.dmp
-
memory/3732-229-0x0000000004B60000-0x0000000004BA4000-memory.dmpFilesize
272KB
-
memory/3732-233-0x0000000000400000-0x000000000057E000-memory.dmpFilesize
1.5MB
-
memory/3732-169-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/3732-168-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/3732-276-0x0000000000400000-0x000000000057E000-memory.dmpFilesize
1.5MB
-
memory/3732-271-0x00000000063B0000-0x0000000006400000-memory.dmpFilesize
320KB
-
memory/3732-270-0x0000000006320000-0x0000000006396000-memory.dmpFilesize
472KB
-
memory/3732-269-0x0000000000670000-0x00000000007BA000-memory.dmpFilesize
1.3MB
-
memory/3732-268-0x0000000000670000-0x00000000007BA000-memory.dmpFilesize
1.3MB
-
memory/3732-265-0x0000000007840000-0x0000000007D6C000-memory.dmpFilesize
5.2MB
-
memory/3732-264-0x0000000007670000-0x0000000007832000-memory.dmpFilesize
1.8MB
-
memory/3732-171-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/3732-256-0x0000000005C00000-0x0000000005C66000-memory.dmpFilesize
408KB
-
memory/3732-254-0x0000000005B60000-0x0000000005BF2000-memory.dmpFilesize
584KB
-
memory/3732-250-0x0000000004CA0000-0x0000000004CEB000-memory.dmpFilesize
300KB
-
memory/3732-248-0x0000000004C50000-0x0000000004C8E000-memory.dmpFilesize
248KB
-
memory/3732-246-0x0000000004C30000-0x0000000004C42000-memory.dmpFilesize
72KB
-
memory/3732-244-0x0000000005820000-0x000000000592A000-memory.dmpFilesize
1.0MB
-
memory/3732-243-0x0000000005210000-0x0000000005816000-memory.dmpFilesize
6.0MB
-
memory/3732-166-0x0000000000000000-mapping.dmp
-
memory/3732-231-0x0000000000670000-0x00000000007BA000-memory.dmpFilesize
1.3MB
-
memory/3732-230-0x0000000000670000-0x00000000007BA000-memory.dmpFilesize
1.3MB
-
memory/3732-227-0x0000000004D10000-0x000000000520E000-memory.dmpFilesize
5.0MB
-
memory/3732-223-0x0000000002270000-0x00000000022B6000-memory.dmpFilesize
280KB
-
memory/3732-186-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/3732-185-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/3732-184-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/3732-170-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/3732-183-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/3732-182-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/3732-181-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/3732-180-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/3732-179-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/3732-176-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/3732-178-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/3732-177-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/3732-174-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/3732-173-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/3732-172-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/4724-277-0x0000000000000000-mapping.dmp
-
memory/5112-149-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-148-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-125-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-154-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-138-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-165-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-164-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-163-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-126-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-162-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-161-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-160-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-158-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-159-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-157-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-156-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-155-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-153-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-152-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-151-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-150-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-128-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-120-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-127-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-147-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-146-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-145-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-144-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-143-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-142-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-141-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-140-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-139-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-137-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-136-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-135-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-134-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-133-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-132-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-131-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-130-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-129-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-124-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-122-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-123-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB
-
memory/5112-121-0x0000000077AA0000-0x0000000077C2E000-memory.dmpFilesize
1.6MB