Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2023 17:25
Static task
static1
Behavioral task
behavioral1
Sample
dbd1e7a1e5fad11f5bba9735f2cd41abc066bf10a8e0b6b3aad4289ad7971ca2.exe
Resource
win10v2004-20230221-en
General
-
Target
dbd1e7a1e5fad11f5bba9735f2cd41abc066bf10a8e0b6b3aad4289ad7971ca2.exe
-
Size
696KB
-
MD5
12672ae719c8c5f4bf671c3ebee9cb80
-
SHA1
404df6f4eb2f549619a47273e87171d418d66c68
-
SHA256
dbd1e7a1e5fad11f5bba9735f2cd41abc066bf10a8e0b6b3aad4289ad7971ca2
-
SHA512
222b9278048761c0ec65c61f09acaf9c33561f7621c4dd73a43e3c4357e98fe92a85f6352927ef41ea09313fc2bb3c3f89f7efc7e4866ce7708a45e911bc4301
-
SSDEEP
12288:3ldKvPdNzHuqabPOfG4XRZm/3wjgbhgIRPIKBC3eVe8w:VAt9HuXPYhc/g6hgIZRaeVe8
Malware Config
Extracted
redline
sony
193.233.20.33:4125
-
auth_value
1d93d1744381eeb4fcfd7c23ffe0f0b4
Signatures
-
Processes:
jr247149.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr247149.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr247149.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr247149.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr247149.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr247149.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr247149.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 32 IoCs
Processes:
resource yara_rule behavioral1/memory/4244-160-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4244-161-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4244-163-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4244-165-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4244-167-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4244-169-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4244-171-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4244-173-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4244-175-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4244-177-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4244-181-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4244-179-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4244-183-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4244-185-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4244-187-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4244-189-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4244-191-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4244-193-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4244-195-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4244-197-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4244-199-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4244-201-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4244-203-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4244-205-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4244-207-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4244-209-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4244-211-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4244-213-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4244-215-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4244-217-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4244-219-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline behavioral1/memory/4244-221-0x00000000027F0000-0x000000000282E000-memory.dmp family_redline -
Executes dropped EXE 3 IoCs
Processes:
ziPV5636.exejr247149.exeku493232.exepid process 1708 ziPV5636.exe 3464 jr247149.exe 4244 ku493232.exe -
Processes:
jr247149.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr247149.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
ziPV5636.exedbd1e7a1e5fad11f5bba9735f2cd41abc066bf10a8e0b6b3aad4289ad7971ca2.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziPV5636.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce dbd1e7a1e5fad11f5bba9735f2cd41abc066bf10a8e0b6b3aad4289ad7971ca2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" dbd1e7a1e5fad11f5bba9735f2cd41abc066bf10a8e0b6b3aad4289ad7971ca2.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziPV5636.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
jr247149.exepid process 3464 jr247149.exe 3464 jr247149.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
jr247149.exeku493232.exedescription pid process Token: SeDebugPrivilege 3464 jr247149.exe Token: SeDebugPrivilege 4244 ku493232.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
dbd1e7a1e5fad11f5bba9735f2cd41abc066bf10a8e0b6b3aad4289ad7971ca2.exeziPV5636.exedescription pid process target process PID 4836 wrote to memory of 1708 4836 dbd1e7a1e5fad11f5bba9735f2cd41abc066bf10a8e0b6b3aad4289ad7971ca2.exe ziPV5636.exe PID 4836 wrote to memory of 1708 4836 dbd1e7a1e5fad11f5bba9735f2cd41abc066bf10a8e0b6b3aad4289ad7971ca2.exe ziPV5636.exe PID 4836 wrote to memory of 1708 4836 dbd1e7a1e5fad11f5bba9735f2cd41abc066bf10a8e0b6b3aad4289ad7971ca2.exe ziPV5636.exe PID 1708 wrote to memory of 3464 1708 ziPV5636.exe jr247149.exe PID 1708 wrote to memory of 3464 1708 ziPV5636.exe jr247149.exe PID 1708 wrote to memory of 4244 1708 ziPV5636.exe ku493232.exe PID 1708 wrote to memory of 4244 1708 ziPV5636.exe ku493232.exe PID 1708 wrote to memory of 4244 1708 ziPV5636.exe ku493232.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbd1e7a1e5fad11f5bba9735f2cd41abc066bf10a8e0b6b3aad4289ad7971ca2.exe"C:\Users\Admin\AppData\Local\Temp\dbd1e7a1e5fad11f5bba9735f2cd41abc066bf10a8e0b6b3aad4289ad7971ca2.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPV5636.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPV5636.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr247149.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr247149.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku493232.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku493232.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPV5636.exeFilesize
403KB
MD5b25155268ddf34f55b5e0a8d1c92de52
SHA15579f1cbc8298290de2a3fc0f9edfb72a7df824b
SHA256e20f4e60e7b8d90552cde344ecb9b034264fb6a212403b56088ec4052afa1d2b
SHA5122ad238414b68286599ec8e040bc43992c11b33299810aab4dc3a1a438def650c4cbe338ae55e1f3f025358f84bf9f6d672ce5b08e44599a4524692dc577afa63
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPV5636.exeFilesize
403KB
MD5b25155268ddf34f55b5e0a8d1c92de52
SHA15579f1cbc8298290de2a3fc0f9edfb72a7df824b
SHA256e20f4e60e7b8d90552cde344ecb9b034264fb6a212403b56088ec4052afa1d2b
SHA5122ad238414b68286599ec8e040bc43992c11b33299810aab4dc3a1a438def650c4cbe338ae55e1f3f025358f84bf9f6d672ce5b08e44599a4524692dc577afa63
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr247149.exeFilesize
12KB
MD5d81abf887301bc1fd97cc7593348a5bf
SHA14e6d98dd66f1fd734ff958a2ca088cff709f9c74
SHA25691560e84e8e0257ab12db2669eed8c5a5ba3bbaa537be93005aaaaff206bacbe
SHA512d7b5b67ff81c6c9ebaeacac4434fb530933fc5765f32610372d7a15c2a0e137c204065a3ceb1ffd5aa6afc34802b79ad636e98f5660d3b6a3f97bb0a302d2cb2
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr247149.exeFilesize
12KB
MD5d81abf887301bc1fd97cc7593348a5bf
SHA14e6d98dd66f1fd734ff958a2ca088cff709f9c74
SHA25691560e84e8e0257ab12db2669eed8c5a5ba3bbaa537be93005aaaaff206bacbe
SHA512d7b5b67ff81c6c9ebaeacac4434fb530933fc5765f32610372d7a15c2a0e137c204065a3ceb1ffd5aa6afc34802b79ad636e98f5660d3b6a3f97bb0a302d2cb2
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku493232.exeFilesize
350KB
MD57a7c172bc39da6195b009137d7074025
SHA1adede58202ac295ceab6cc1e76a8cb9f00236b17
SHA256a77e9383f964ca874c2c5769fa458342bfc9e8586e9f3d7af88bb8c06f793f44
SHA512cf874ad3212d1d6c2d11a0b90677842f65e3c2283a2e7711318b6e13c7473b81c9e83496a4871a5349798d8a1d74d36885907326435aeb578e7ec7ca600898f7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku493232.exeFilesize
350KB
MD57a7c172bc39da6195b009137d7074025
SHA1adede58202ac295ceab6cc1e76a8cb9f00236b17
SHA256a77e9383f964ca874c2c5769fa458342bfc9e8586e9f3d7af88bb8c06f793f44
SHA512cf874ad3212d1d6c2d11a0b90677842f65e3c2283a2e7711318b6e13c7473b81c9e83496a4871a5349798d8a1d74d36885907326435aeb578e7ec7ca600898f7
-
memory/3464-149-0x00000000006F0000-0x00000000006FA000-memory.dmpFilesize
40KB
-
memory/4244-156-0x0000000004DE0000-0x0000000005384000-memory.dmpFilesize
5.6MB
-
memory/4244-157-0x00000000007F0000-0x000000000083B000-memory.dmpFilesize
300KB
-
memory/4244-158-0x0000000004DD0000-0x0000000004DE0000-memory.dmpFilesize
64KB
-
memory/4244-159-0x0000000004DD0000-0x0000000004DE0000-memory.dmpFilesize
64KB
-
memory/4244-160-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4244-161-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4244-163-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4244-165-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4244-167-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4244-169-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4244-171-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4244-173-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4244-175-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4244-177-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4244-181-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4244-179-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4244-183-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4244-185-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4244-187-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4244-189-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4244-191-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4244-193-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4244-195-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4244-197-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4244-199-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4244-201-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4244-203-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4244-205-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4244-207-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4244-209-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4244-211-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4244-213-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4244-215-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4244-217-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4244-219-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4244-221-0x00000000027F0000-0x000000000282E000-memory.dmpFilesize
248KB
-
memory/4244-1066-0x0000000005490000-0x0000000005AA8000-memory.dmpFilesize
6.1MB
-
memory/4244-1067-0x0000000005B00000-0x0000000005C0A000-memory.dmpFilesize
1.0MB
-
memory/4244-1068-0x0000000005C40000-0x0000000005C52000-memory.dmpFilesize
72KB
-
memory/4244-1069-0x0000000005C60000-0x0000000005C9C000-memory.dmpFilesize
240KB
-
memory/4244-1070-0x0000000004DD0000-0x0000000004DE0000-memory.dmpFilesize
64KB
-
memory/4244-1073-0x0000000004DD0000-0x0000000004DE0000-memory.dmpFilesize
64KB
-
memory/4244-1074-0x0000000004DD0000-0x0000000004DE0000-memory.dmpFilesize
64KB
-
memory/4244-1075-0x0000000004DD0000-0x0000000004DE0000-memory.dmpFilesize
64KB
-
memory/4244-1076-0x0000000004DD0000-0x0000000004DE0000-memory.dmpFilesize
64KB
-
memory/4836-141-0x00000000024E0000-0x000000000256A000-memory.dmpFilesize
552KB
-
memory/4836-150-0x0000000000400000-0x0000000000771000-memory.dmpFilesize
3.4MB