Analysis
-
max time kernel
54s -
max time network
59s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
27-03-2023 23:49
Static task
static1
Behavioral task
behavioral1
Sample
a7078c3f66cdf1f42a59e3c44224928308db979145e0ab4e8c3e0229417dc939.exe
Resource
win10-20230220-en
General
-
Target
a7078c3f66cdf1f42a59e3c44224928308db979145e0ab4e8c3e0229417dc939.exe
-
Size
701KB
-
MD5
e77499d722fa8c2c6caf993a2712d995
-
SHA1
53e802d5ed95135d9385913e63b44bcbf5729569
-
SHA256
a7078c3f66cdf1f42a59e3c44224928308db979145e0ab4e8c3e0229417dc939
-
SHA512
c4a58df8a1e055f7f4bdb17ab30e4f89dc2bb9c861e8a420d8e54f0e54a816fd097606231daf8d6c5ca91431a18582d681471b26d71e8117740b49533f96defd
-
SSDEEP
12288:4Mrzy90Qloymvh4e00aJ20yiRl1ebhS0UqNZkCfSvmTX7Be/UajekuEC/5/aKqsg:7yfmyEVxA4izAb/kCfSKXo/Uoe1EC/A9
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Processes:
pro2723.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro2723.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro2723.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro2723.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro2723.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro2723.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/3152-176-0x00000000025A0000-0x00000000025E6000-memory.dmp family_redline behavioral1/memory/3152-177-0x0000000004CB0000-0x0000000004CF4000-memory.dmp family_redline behavioral1/memory/3152-179-0x0000000004CB0000-0x0000000004CEF000-memory.dmp family_redline behavioral1/memory/3152-178-0x0000000004CB0000-0x0000000004CEF000-memory.dmp family_redline behavioral1/memory/3152-181-0x0000000004CB0000-0x0000000004CEF000-memory.dmp family_redline behavioral1/memory/3152-183-0x0000000004CB0000-0x0000000004CEF000-memory.dmp family_redline behavioral1/memory/3152-185-0x0000000004CB0000-0x0000000004CEF000-memory.dmp family_redline behavioral1/memory/3152-187-0x0000000004CB0000-0x0000000004CEF000-memory.dmp family_redline behavioral1/memory/3152-189-0x0000000004CB0000-0x0000000004CEF000-memory.dmp family_redline behavioral1/memory/3152-191-0x0000000004CB0000-0x0000000004CEF000-memory.dmp family_redline behavioral1/memory/3152-193-0x0000000004CB0000-0x0000000004CEF000-memory.dmp family_redline behavioral1/memory/3152-195-0x0000000004CB0000-0x0000000004CEF000-memory.dmp family_redline behavioral1/memory/3152-197-0x0000000004CB0000-0x0000000004CEF000-memory.dmp family_redline behavioral1/memory/3152-199-0x0000000004CB0000-0x0000000004CEF000-memory.dmp family_redline behavioral1/memory/3152-201-0x0000000004CB0000-0x0000000004CEF000-memory.dmp family_redline behavioral1/memory/3152-203-0x0000000004CB0000-0x0000000004CEF000-memory.dmp family_redline behavioral1/memory/3152-205-0x0000000004CB0000-0x0000000004CEF000-memory.dmp family_redline behavioral1/memory/3152-207-0x0000000004CB0000-0x0000000004CEF000-memory.dmp family_redline behavioral1/memory/3152-209-0x0000000004CB0000-0x0000000004CEF000-memory.dmp family_redline behavioral1/memory/3152-211-0x0000000004CB0000-0x0000000004CEF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un323283.exepro2723.exequ7045.exesi537173.exepid process 3720 un323283.exe 4736 pro2723.exe 3152 qu7045.exe 4588 si537173.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro2723.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro2723.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro2723.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un323283.exea7078c3f66cdf1f42a59e3c44224928308db979145e0ab4e8c3e0229417dc939.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un323283.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un323283.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce a7078c3f66cdf1f42a59e3c44224928308db979145e0ab4e8c3e0229417dc939.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a7078c3f66cdf1f42a59e3c44224928308db979145e0ab4e8c3e0229417dc939.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro2723.exequ7045.exesi537173.exepid process 4736 pro2723.exe 4736 pro2723.exe 3152 qu7045.exe 3152 qu7045.exe 4588 si537173.exe 4588 si537173.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro2723.exequ7045.exesi537173.exedescription pid process Token: SeDebugPrivilege 4736 pro2723.exe Token: SeDebugPrivilege 3152 qu7045.exe Token: SeDebugPrivilege 4588 si537173.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
a7078c3f66cdf1f42a59e3c44224928308db979145e0ab4e8c3e0229417dc939.exeun323283.exedescription pid process target process PID 3096 wrote to memory of 3720 3096 a7078c3f66cdf1f42a59e3c44224928308db979145e0ab4e8c3e0229417dc939.exe un323283.exe PID 3096 wrote to memory of 3720 3096 a7078c3f66cdf1f42a59e3c44224928308db979145e0ab4e8c3e0229417dc939.exe un323283.exe PID 3096 wrote to memory of 3720 3096 a7078c3f66cdf1f42a59e3c44224928308db979145e0ab4e8c3e0229417dc939.exe un323283.exe PID 3720 wrote to memory of 4736 3720 un323283.exe pro2723.exe PID 3720 wrote to memory of 4736 3720 un323283.exe pro2723.exe PID 3720 wrote to memory of 4736 3720 un323283.exe pro2723.exe PID 3720 wrote to memory of 3152 3720 un323283.exe qu7045.exe PID 3720 wrote to memory of 3152 3720 un323283.exe qu7045.exe PID 3720 wrote to memory of 3152 3720 un323283.exe qu7045.exe PID 3096 wrote to memory of 4588 3096 a7078c3f66cdf1f42a59e3c44224928308db979145e0ab4e8c3e0229417dc939.exe si537173.exe PID 3096 wrote to memory of 4588 3096 a7078c3f66cdf1f42a59e3c44224928308db979145e0ab4e8c3e0229417dc939.exe si537173.exe PID 3096 wrote to memory of 4588 3096 a7078c3f66cdf1f42a59e3c44224928308db979145e0ab4e8c3e0229417dc939.exe si537173.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7078c3f66cdf1f42a59e3c44224928308db979145e0ab4e8c3e0229417dc939.exe"C:\Users\Admin\AppData\Local\Temp\a7078c3f66cdf1f42a59e3c44224928308db979145e0ab4e8c3e0229417dc939.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un323283.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un323283.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2723.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2723.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7045.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7045.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si537173.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si537173.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4588
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si537173.exeFilesize
175KB
MD518cde445a427cff64c9dbb5c8ff909b1
SHA151fb61e0b1c130c5cda434b95d3eb2d0d91cd59f
SHA25661b99467014f572c9b2b3f7b6c638ec2c1fa7677ea9626bdaf0fb8eacc8b1b42
SHA512fbe801731666cab894bb33754b08dccdaaccdc2cda421e7bb3bc85bb9243861ba82569e4cc3979751acdc99f47b6d101603c913d3b9f0bfc938c40ba4eb4084b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si537173.exeFilesize
175KB
MD518cde445a427cff64c9dbb5c8ff909b1
SHA151fb61e0b1c130c5cda434b95d3eb2d0d91cd59f
SHA25661b99467014f572c9b2b3f7b6c638ec2c1fa7677ea9626bdaf0fb8eacc8b1b42
SHA512fbe801731666cab894bb33754b08dccdaaccdc2cda421e7bb3bc85bb9243861ba82569e4cc3979751acdc99f47b6d101603c913d3b9f0bfc938c40ba4eb4084b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un323283.exeFilesize
558KB
MD53c27ecb483a57c16d4f19df60d87a851
SHA13192eff357068e0a4c73eca4ae4da8e6c059e3f4
SHA25620412fb205f112672f3093f823f8e9d9022d39e72fc19f8a1e9c48345543989f
SHA512946882df4d3b39c5f1d782b80e59b9692e7d899cc052d81b5af277614eb26b18ded50c6bcb33270f08ffe464889d1e45a870153b638aafde753d317ff72977b1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un323283.exeFilesize
558KB
MD53c27ecb483a57c16d4f19df60d87a851
SHA13192eff357068e0a4c73eca4ae4da8e6c059e3f4
SHA25620412fb205f112672f3093f823f8e9d9022d39e72fc19f8a1e9c48345543989f
SHA512946882df4d3b39c5f1d782b80e59b9692e7d899cc052d81b5af277614eb26b18ded50c6bcb33270f08ffe464889d1e45a870153b638aafde753d317ff72977b1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2723.exeFilesize
307KB
MD5c9c5ed2dfaebd88793cd37d0dd412a43
SHA14111e11273dce8583b2c261c7cbd610b58ac25b6
SHA256e4805199a1d3601bfa373c598b4ff9e171bd7a645cba8ccd88b839a98217a015
SHA512dcccdf017fe9fed982cdeaff3fa62850e1a93b3d23f960bd94e3d16a1873367e2c54a3fe25c3b456c7e555aa59159cfe748f257a5df3d356ad404839afc16b6f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2723.exeFilesize
307KB
MD5c9c5ed2dfaebd88793cd37d0dd412a43
SHA14111e11273dce8583b2c261c7cbd610b58ac25b6
SHA256e4805199a1d3601bfa373c598b4ff9e171bd7a645cba8ccd88b839a98217a015
SHA512dcccdf017fe9fed982cdeaff3fa62850e1a93b3d23f960bd94e3d16a1873367e2c54a3fe25c3b456c7e555aa59159cfe748f257a5df3d356ad404839afc16b6f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7045.exeFilesize
365KB
MD5386b4370095c969cda991b22d3e385de
SHA162646c592a459daf31a17017b4cdb1a49377b27d
SHA2569334422cc0cf4449c28f9f1737dbc193d2adb000ba5fac1ce0cc4378ea2f6491
SHA512a85275f3eff2e0a69f91098a094f3aea0b34ee5cc8c9d9b6e954907f3b8b6e08e5586bfb5652668fe158a59063631105c5fd6d738e55f3cb2851003715d348db
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7045.exeFilesize
365KB
MD5386b4370095c969cda991b22d3e385de
SHA162646c592a459daf31a17017b4cdb1a49377b27d
SHA2569334422cc0cf4449c28f9f1737dbc193d2adb000ba5fac1ce0cc4378ea2f6491
SHA512a85275f3eff2e0a69f91098a094f3aea0b34ee5cc8c9d9b6e954907f3b8b6e08e5586bfb5652668fe158a59063631105c5fd6d738e55f3cb2851003715d348db
-
memory/3152-1088-0x0000000005980000-0x0000000005F86000-memory.dmpFilesize
6.0MB
-
memory/3152-1091-0x0000000005550000-0x000000000558E000-memory.dmpFilesize
248KB
-
memory/3152-209-0x0000000004CB0000-0x0000000004CEF000-memory.dmpFilesize
252KB
-
memory/3152-191-0x0000000004CB0000-0x0000000004CEF000-memory.dmpFilesize
252KB
-
memory/3152-207-0x0000000004CB0000-0x0000000004CEF000-memory.dmpFilesize
252KB
-
memory/3152-193-0x0000000004CB0000-0x0000000004CEF000-memory.dmpFilesize
252KB
-
memory/3152-205-0x0000000004CB0000-0x0000000004CEF000-memory.dmpFilesize
252KB
-
memory/3152-203-0x0000000004CB0000-0x0000000004CEF000-memory.dmpFilesize
252KB
-
memory/3152-1104-0x0000000004D20000-0x0000000004D30000-memory.dmpFilesize
64KB
-
memory/3152-1102-0x0000000007050000-0x00000000070C6000-memory.dmpFilesize
472KB
-
memory/3152-1103-0x00000000070E0000-0x0000000007130000-memory.dmpFilesize
320KB
-
memory/3152-1101-0x0000000004D20000-0x0000000004D30000-memory.dmpFilesize
64KB
-
memory/3152-1100-0x0000000004D20000-0x0000000004D30000-memory.dmpFilesize
64KB
-
memory/3152-1099-0x0000000004D20000-0x0000000004D30000-memory.dmpFilesize
64KB
-
memory/3152-1098-0x00000000069F0000-0x0000000006F1C000-memory.dmpFilesize
5.2MB
-
memory/3152-1097-0x0000000006820000-0x00000000069E2000-memory.dmpFilesize
1.8MB
-
memory/3152-1095-0x00000000058D0000-0x0000000005936000-memory.dmpFilesize
408KB
-
memory/3152-1094-0x0000000005830000-0x00000000058C2000-memory.dmpFilesize
584KB
-
memory/3152-195-0x0000000004CB0000-0x0000000004CEF000-memory.dmpFilesize
252KB
-
memory/3152-1093-0x0000000004D20000-0x0000000004D30000-memory.dmpFilesize
64KB
-
memory/3152-1092-0x00000000056A0000-0x00000000056EB000-memory.dmpFilesize
300KB
-
memory/3152-211-0x0000000004CB0000-0x0000000004CEF000-memory.dmpFilesize
252KB
-
memory/3152-1090-0x0000000005530000-0x0000000005542000-memory.dmpFilesize
72KB
-
memory/3152-1089-0x00000000053F0000-0x00000000054FA000-memory.dmpFilesize
1.0MB
-
memory/3152-219-0x0000000004D20000-0x0000000004D30000-memory.dmpFilesize
64KB
-
memory/3152-176-0x00000000025A0000-0x00000000025E6000-memory.dmpFilesize
280KB
-
memory/3152-177-0x0000000004CB0000-0x0000000004CF4000-memory.dmpFilesize
272KB
-
memory/3152-179-0x0000000004CB0000-0x0000000004CEF000-memory.dmpFilesize
252KB
-
memory/3152-178-0x0000000004CB0000-0x0000000004CEF000-memory.dmpFilesize
252KB
-
memory/3152-181-0x0000000004CB0000-0x0000000004CEF000-memory.dmpFilesize
252KB
-
memory/3152-183-0x0000000004CB0000-0x0000000004CEF000-memory.dmpFilesize
252KB
-
memory/3152-185-0x0000000004CB0000-0x0000000004CEF000-memory.dmpFilesize
252KB
-
memory/3152-187-0x0000000004CB0000-0x0000000004CEF000-memory.dmpFilesize
252KB
-
memory/3152-189-0x0000000004CB0000-0x0000000004CEF000-memory.dmpFilesize
252KB
-
memory/3152-217-0x0000000004D20000-0x0000000004D30000-memory.dmpFilesize
64KB
-
memory/3152-215-0x0000000004D20000-0x0000000004D30000-memory.dmpFilesize
64KB
-
memory/3152-214-0x0000000000770000-0x00000000007BB000-memory.dmpFilesize
300KB
-
memory/3152-197-0x0000000004CB0000-0x0000000004CEF000-memory.dmpFilesize
252KB
-
memory/3152-199-0x0000000004CB0000-0x0000000004CEF000-memory.dmpFilesize
252KB
-
memory/3152-201-0x0000000004CB0000-0x0000000004CEF000-memory.dmpFilesize
252KB
-
memory/4588-1110-0x0000000000960000-0x0000000000992000-memory.dmpFilesize
200KB
-
memory/4588-1111-0x00000000053A0000-0x00000000053EB000-memory.dmpFilesize
300KB
-
memory/4588-1112-0x00000000054A0000-0x00000000054B0000-memory.dmpFilesize
64KB
-
memory/4588-1113-0x00000000054A0000-0x00000000054B0000-memory.dmpFilesize
64KB
-
memory/4736-166-0x0000000000400000-0x000000000070F000-memory.dmpFilesize
3.1MB
-
memory/4736-137-0x0000000004FA0000-0x0000000004FB0000-memory.dmpFilesize
64KB
-
memory/4736-135-0x0000000004FA0000-0x0000000004FB0000-memory.dmpFilesize
64KB
-
memory/4736-141-0x0000000004FA0000-0x0000000004FB0000-memory.dmpFilesize
64KB
-
memory/4736-134-0x00000000001D0000-0x00000000001FD000-memory.dmpFilesize
180KB
-
memory/4736-133-0x00000000024C0000-0x00000000024D8000-memory.dmpFilesize
96KB
-
memory/4736-138-0x00000000024C0000-0x00000000024D2000-memory.dmpFilesize
72KB
-
memory/4736-171-0x0000000000400000-0x000000000070F000-memory.dmpFilesize
3.1MB
-
memory/4736-169-0x0000000004FA0000-0x0000000004FB0000-memory.dmpFilesize
64KB
-
memory/4736-168-0x0000000004FA0000-0x0000000004FB0000-memory.dmpFilesize
64KB
-
memory/4736-167-0x0000000004FA0000-0x0000000004FB0000-memory.dmpFilesize
64KB
-
memory/4736-165-0x00000000024C0000-0x00000000024D2000-memory.dmpFilesize
72KB
-
memory/4736-163-0x00000000024C0000-0x00000000024D2000-memory.dmpFilesize
72KB
-
memory/4736-161-0x00000000024C0000-0x00000000024D2000-memory.dmpFilesize
72KB
-
memory/4736-159-0x00000000024C0000-0x00000000024D2000-memory.dmpFilesize
72KB
-
memory/4736-157-0x00000000024C0000-0x00000000024D2000-memory.dmpFilesize
72KB
-
memory/4736-155-0x00000000024C0000-0x00000000024D2000-memory.dmpFilesize
72KB
-
memory/4736-153-0x00000000024C0000-0x00000000024D2000-memory.dmpFilesize
72KB
-
memory/4736-151-0x00000000024C0000-0x00000000024D2000-memory.dmpFilesize
72KB
-
memory/4736-149-0x00000000024C0000-0x00000000024D2000-memory.dmpFilesize
72KB
-
memory/4736-147-0x00000000024C0000-0x00000000024D2000-memory.dmpFilesize
72KB
-
memory/4736-132-0x0000000004FB0000-0x00000000054AE000-memory.dmpFilesize
5.0MB
-
memory/4736-131-0x0000000002340000-0x000000000235A000-memory.dmpFilesize
104KB
-
memory/4736-145-0x00000000024C0000-0x00000000024D2000-memory.dmpFilesize
72KB
-
memory/4736-143-0x00000000024C0000-0x00000000024D2000-memory.dmpFilesize
72KB
-
memory/4736-140-0x00000000024C0000-0x00000000024D2000-memory.dmpFilesize
72KB
-
memory/4736-136-0x00000000024C0000-0x00000000024D2000-memory.dmpFilesize
72KB