Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2023 21:50
Static task
static1
Behavioral task
behavioral1
Sample
b850adc15323e2f0aba72c0c576d98d34dddc9d38dd31ab90d8afa8227539847.exe
Resource
win10v2004-20230220-en
General
-
Target
b850adc15323e2f0aba72c0c576d98d34dddc9d38dd31ab90d8afa8227539847.exe
-
Size
700KB
-
MD5
92b45563d499965952595cb97465d1e9
-
SHA1
4c571d9dc9a99899f4bea9233a30f427c7f2fb8f
-
SHA256
b850adc15323e2f0aba72c0c576d98d34dddc9d38dd31ab90d8afa8227539847
-
SHA512
b829ee2df0d6f7af57f43df48b534b459268b6dd8530d0a61e758245d39a8b6ef30079ee5bbe159b8eca3c3563c4b02fd18ddb8ecba4f5c83e9f0c77124e29c0
-
SSDEEP
12288:YMrDy90EhFSFQDr+Eg9DSlcAXeuBG8F3lTEjByGquY2JIt7:rythDHzXeuBG8V2Vy7uY2Js
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro2054.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro2054.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro2054.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro2054.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro2054.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro2054.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
resource yara_rule behavioral1/memory/4912-187-0x00000000027C0000-0x00000000027FF000-memory.dmp family_redline behavioral1/memory/4912-188-0x00000000027C0000-0x00000000027FF000-memory.dmp family_redline behavioral1/memory/4912-192-0x00000000027C0000-0x00000000027FF000-memory.dmp family_redline behavioral1/memory/4912-194-0x00000000027C0000-0x00000000027FF000-memory.dmp family_redline behavioral1/memory/4912-190-0x00000000027C0000-0x00000000027FF000-memory.dmp family_redline behavioral1/memory/4912-196-0x00000000027C0000-0x00000000027FF000-memory.dmp family_redline behavioral1/memory/4912-198-0x00000000027C0000-0x00000000027FF000-memory.dmp family_redline behavioral1/memory/4912-200-0x00000000027C0000-0x00000000027FF000-memory.dmp family_redline behavioral1/memory/4912-202-0x00000000027C0000-0x00000000027FF000-memory.dmp family_redline behavioral1/memory/4912-204-0x00000000027C0000-0x00000000027FF000-memory.dmp family_redline behavioral1/memory/4912-206-0x00000000027C0000-0x00000000027FF000-memory.dmp family_redline behavioral1/memory/4912-208-0x00000000027C0000-0x00000000027FF000-memory.dmp family_redline behavioral1/memory/4912-210-0x00000000027C0000-0x00000000027FF000-memory.dmp family_redline behavioral1/memory/4912-212-0x00000000027C0000-0x00000000027FF000-memory.dmp family_redline behavioral1/memory/4912-214-0x00000000027C0000-0x00000000027FF000-memory.dmp family_redline behavioral1/memory/4912-216-0x00000000027C0000-0x00000000027FF000-memory.dmp family_redline behavioral1/memory/4912-218-0x00000000027C0000-0x00000000027FF000-memory.dmp family_redline behavioral1/memory/4912-220-0x00000000027C0000-0x00000000027FF000-memory.dmp family_redline behavioral1/memory/4912-279-0x00000000022A0000-0x00000000022B0000-memory.dmp family_redline behavioral1/memory/4912-1106-0x00000000022A0000-0x00000000022B0000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
pid Process 4216 un315603.exe 4540 pro2054.exe 4912 qu9409.exe 4828 si044880.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro2054.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro2054.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un315603.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un315603.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce b850adc15323e2f0aba72c0c576d98d34dddc9d38dd31ab90d8afa8227539847.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" b850adc15323e2f0aba72c0c576d98d34dddc9d38dd31ab90d8afa8227539847.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
pid pid_target Process procid_target 2324 4540 WerFault.exe 86 3164 4912 WerFault.exe 91 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4540 pro2054.exe 4540 pro2054.exe 4912 qu9409.exe 4912 qu9409.exe 4828 si044880.exe 4828 si044880.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4540 pro2054.exe Token: SeDebugPrivilege 4912 qu9409.exe Token: SeDebugPrivilege 4828 si044880.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3968 wrote to memory of 4216 3968 b850adc15323e2f0aba72c0c576d98d34dddc9d38dd31ab90d8afa8227539847.exe 85 PID 3968 wrote to memory of 4216 3968 b850adc15323e2f0aba72c0c576d98d34dddc9d38dd31ab90d8afa8227539847.exe 85 PID 3968 wrote to memory of 4216 3968 b850adc15323e2f0aba72c0c576d98d34dddc9d38dd31ab90d8afa8227539847.exe 85 PID 4216 wrote to memory of 4540 4216 un315603.exe 86 PID 4216 wrote to memory of 4540 4216 un315603.exe 86 PID 4216 wrote to memory of 4540 4216 un315603.exe 86 PID 4216 wrote to memory of 4912 4216 un315603.exe 91 PID 4216 wrote to memory of 4912 4216 un315603.exe 91 PID 4216 wrote to memory of 4912 4216 un315603.exe 91 PID 3968 wrote to memory of 4828 3968 b850adc15323e2f0aba72c0c576d98d34dddc9d38dd31ab90d8afa8227539847.exe 95 PID 3968 wrote to memory of 4828 3968 b850adc15323e2f0aba72c0c576d98d34dddc9d38dd31ab90d8afa8227539847.exe 95 PID 3968 wrote to memory of 4828 3968 b850adc15323e2f0aba72c0c576d98d34dddc9d38dd31ab90d8afa8227539847.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\b850adc15323e2f0aba72c0c576d98d34dddc9d38dd31ab90d8afa8227539847.exe"C:\Users\Admin\AppData\Local\Temp\b850adc15323e2f0aba72c0c576d98d34dddc9d38dd31ab90d8afa8227539847.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un315603.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un315603.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2054.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2054.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4540 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 10804⤵
- Program crash
PID:2324
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9409.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9409.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4912 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 13564⤵
- Program crash
PID:3164
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si044880.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si044880.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4828
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4540 -ip 45401⤵PID:1828
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4912 -ip 49121⤵PID:2908
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD56a1a080bf7f081b4a95e1518f666189a
SHA1790cd7ada9324abbe3765f878e31a6cc7b5d72de
SHA2569efaad4d6598f701b71e37f3c3a73f46ee8d12e6873efb5ef18c4d9d54285bc1
SHA5122070e437ccf45c14fec6197c7e6aa87cc79df3854a2dd186bec99091481401bea576ce2aab9b0149fff5165ef51b8d2076352eb2b1bb5724498de25d6864d0b7
-
Filesize
175KB
MD56a1a080bf7f081b4a95e1518f666189a
SHA1790cd7ada9324abbe3765f878e31a6cc7b5d72de
SHA2569efaad4d6598f701b71e37f3c3a73f46ee8d12e6873efb5ef18c4d9d54285bc1
SHA5122070e437ccf45c14fec6197c7e6aa87cc79df3854a2dd186bec99091481401bea576ce2aab9b0149fff5165ef51b8d2076352eb2b1bb5724498de25d6864d0b7
-
Filesize
558KB
MD5d47569f9fbe7663303fa25a482b09c11
SHA128d5d1ee9b19b906a6249f2466dc76bfb40b3d9e
SHA25654d46f25fdd881623fd7fafc93beb707f2142b44e51a9d9b77f42ba01c3fef3a
SHA512610ff5a0ce9b4077384be698741e18bd47cd93d68e51892a83d5b69b6febaa44aac2631c52bba0aa8f34054a5e437327097489c0289f628df11408026cf6c471
-
Filesize
558KB
MD5d47569f9fbe7663303fa25a482b09c11
SHA128d5d1ee9b19b906a6249f2466dc76bfb40b3d9e
SHA25654d46f25fdd881623fd7fafc93beb707f2142b44e51a9d9b77f42ba01c3fef3a
SHA512610ff5a0ce9b4077384be698741e18bd47cd93d68e51892a83d5b69b6febaa44aac2631c52bba0aa8f34054a5e437327097489c0289f628df11408026cf6c471
-
Filesize
307KB
MD5cab16996c80b7fcca4c31fb644877d42
SHA19feb782fcbb80b9aeda0887422579d00bda543fa
SHA256a35d42544db1c1cc4567f64c208fb239c25429b259340e5bfb89035616664c0c
SHA5121dd3de093b7b3dd167d70463206d6f53e6a1f40cde8fcd4d3c8c7710073fa4f5c2f14bd0f66932c873288caff82709961c28ea23c5d2a57105a7af7149aff211
-
Filesize
307KB
MD5cab16996c80b7fcca4c31fb644877d42
SHA19feb782fcbb80b9aeda0887422579d00bda543fa
SHA256a35d42544db1c1cc4567f64c208fb239c25429b259340e5bfb89035616664c0c
SHA5121dd3de093b7b3dd167d70463206d6f53e6a1f40cde8fcd4d3c8c7710073fa4f5c2f14bd0f66932c873288caff82709961c28ea23c5d2a57105a7af7149aff211
-
Filesize
365KB
MD5fc5e230798c885b86956f56b4285f9f3
SHA1e2f60bcd6c06e0360b86ac0020dbcd63d5c04dd7
SHA256dd247b1772646bb6c44dc597d728bdd49dc1aef02afc56fbfd2b87c2cebd2e58
SHA51278880e4a777c89598584be3af0dfe80fc092beb3ab09e2a48167058ddf4b6e62a7d7864fbcaab405e2bcd73fab7a2baffa3fccdfcfe51089cf34c23b052dae5f
-
Filesize
365KB
MD5fc5e230798c885b86956f56b4285f9f3
SHA1e2f60bcd6c06e0360b86ac0020dbcd63d5c04dd7
SHA256dd247b1772646bb6c44dc597d728bdd49dc1aef02afc56fbfd2b87c2cebd2e58
SHA51278880e4a777c89598584be3af0dfe80fc092beb3ab09e2a48167058ddf4b6e62a7d7864fbcaab405e2bcd73fab7a2baffa3fccdfcfe51089cf34c23b052dae5f