Analysis
-
max time kernel
46s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
28-03-2023 00:21
Static task
static1
Behavioral task
behavioral1
Sample
51cf01a1b30d1835442e273ad768b7ff.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
51cf01a1b30d1835442e273ad768b7ff.exe
Resource
win10v2004-20230220-en
General
-
Target
51cf01a1b30d1835442e273ad768b7ff.exe
-
Size
700KB
-
MD5
51cf01a1b30d1835442e273ad768b7ff
-
SHA1
24b6271e5a77d6ea10b7d98598ecf61b69408638
-
SHA256
e7ab05b31c06d3b408344aca29a87032eea3b77e7734e4b8c30e593dbef095cb
-
SHA512
6c201e09d64f5eb54bc143cad3fd0c5af210adb27cad042ddf581dcd9a20ec0095db706ddcff00ce5d5de0612a11eebe9292101c137216c127106bfd8cbc97a8
-
SSDEEP
12288:+Mrny90T5X+h+NhIQSXu9DukcAoMiKwwpT7ZXv1SJjCAERzU:Ry5+4QSXkoMdww1jKj8RzU
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Processes:
pro6077.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro6077.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro6077.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection pro6077.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro6077.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro6077.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro6077.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/1872-123-0x0000000004CA0000-0x0000000004CE6000-memory.dmp family_redline behavioral1/memory/1872-124-0x0000000004D40000-0x0000000004D84000-memory.dmp family_redline behavioral1/memory/1872-125-0x0000000004D40000-0x0000000004D7F000-memory.dmp family_redline behavioral1/memory/1872-126-0x0000000004D40000-0x0000000004D7F000-memory.dmp family_redline behavioral1/memory/1872-128-0x0000000004D40000-0x0000000004D7F000-memory.dmp family_redline behavioral1/memory/1872-130-0x0000000004D40000-0x0000000004D7F000-memory.dmp family_redline behavioral1/memory/1872-132-0x0000000004D40000-0x0000000004D7F000-memory.dmp family_redline behavioral1/memory/1872-134-0x0000000004D40000-0x0000000004D7F000-memory.dmp family_redline behavioral1/memory/1872-138-0x0000000004D40000-0x0000000004D7F000-memory.dmp family_redline behavioral1/memory/1872-141-0x0000000004D40000-0x0000000004D7F000-memory.dmp family_redline behavioral1/memory/1872-143-0x0000000004D40000-0x0000000004D7F000-memory.dmp family_redline behavioral1/memory/1872-145-0x0000000004D40000-0x0000000004D7F000-memory.dmp family_redline behavioral1/memory/1872-147-0x0000000004D40000-0x0000000004D7F000-memory.dmp family_redline behavioral1/memory/1872-149-0x0000000004D40000-0x0000000004D7F000-memory.dmp family_redline behavioral1/memory/1872-151-0x0000000004D40000-0x0000000004D7F000-memory.dmp family_redline behavioral1/memory/1872-153-0x0000000004D40000-0x0000000004D7F000-memory.dmp family_redline behavioral1/memory/1872-155-0x0000000004D40000-0x0000000004D7F000-memory.dmp family_redline behavioral1/memory/1872-157-0x0000000004D40000-0x0000000004D7F000-memory.dmp family_redline behavioral1/memory/1872-159-0x0000000004D40000-0x0000000004D7F000-memory.dmp family_redline behavioral1/memory/1872-161-0x0000000004D40000-0x0000000004D7F000-memory.dmp family_redline behavioral1/memory/1872-1034-0x0000000004D00000-0x0000000004D40000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un730014.exepro6077.exequ7597.exesi880483.exepid process 1064 un730014.exe 1248 pro6077.exe 1872 qu7597.exe 1456 si880483.exe -
Loads dropped DLL 10 IoCs
Processes:
51cf01a1b30d1835442e273ad768b7ff.exeun730014.exepro6077.exequ7597.exesi880483.exepid process 1724 51cf01a1b30d1835442e273ad768b7ff.exe 1064 un730014.exe 1064 un730014.exe 1064 un730014.exe 1248 pro6077.exe 1064 un730014.exe 1064 un730014.exe 1872 qu7597.exe 1724 51cf01a1b30d1835442e273ad768b7ff.exe 1456 si880483.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro6077.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features pro6077.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro6077.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
51cf01a1b30d1835442e273ad768b7ff.exeun730014.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce 51cf01a1b30d1835442e273ad768b7ff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 51cf01a1b30d1835442e273ad768b7ff.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce un730014.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un730014.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro6077.exequ7597.exesi880483.exepid process 1248 pro6077.exe 1248 pro6077.exe 1872 qu7597.exe 1872 qu7597.exe 1456 si880483.exe 1456 si880483.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro6077.exequ7597.exesi880483.exedescription pid process Token: SeDebugPrivilege 1248 pro6077.exe Token: SeDebugPrivilege 1872 qu7597.exe Token: SeDebugPrivilege 1456 si880483.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
51cf01a1b30d1835442e273ad768b7ff.exeun730014.exedescription pid process target process PID 1724 wrote to memory of 1064 1724 51cf01a1b30d1835442e273ad768b7ff.exe un730014.exe PID 1724 wrote to memory of 1064 1724 51cf01a1b30d1835442e273ad768b7ff.exe un730014.exe PID 1724 wrote to memory of 1064 1724 51cf01a1b30d1835442e273ad768b7ff.exe un730014.exe PID 1724 wrote to memory of 1064 1724 51cf01a1b30d1835442e273ad768b7ff.exe un730014.exe PID 1724 wrote to memory of 1064 1724 51cf01a1b30d1835442e273ad768b7ff.exe un730014.exe PID 1724 wrote to memory of 1064 1724 51cf01a1b30d1835442e273ad768b7ff.exe un730014.exe PID 1724 wrote to memory of 1064 1724 51cf01a1b30d1835442e273ad768b7ff.exe un730014.exe PID 1064 wrote to memory of 1248 1064 un730014.exe pro6077.exe PID 1064 wrote to memory of 1248 1064 un730014.exe pro6077.exe PID 1064 wrote to memory of 1248 1064 un730014.exe pro6077.exe PID 1064 wrote to memory of 1248 1064 un730014.exe pro6077.exe PID 1064 wrote to memory of 1248 1064 un730014.exe pro6077.exe PID 1064 wrote to memory of 1248 1064 un730014.exe pro6077.exe PID 1064 wrote to memory of 1248 1064 un730014.exe pro6077.exe PID 1064 wrote to memory of 1872 1064 un730014.exe qu7597.exe PID 1064 wrote to memory of 1872 1064 un730014.exe qu7597.exe PID 1064 wrote to memory of 1872 1064 un730014.exe qu7597.exe PID 1064 wrote to memory of 1872 1064 un730014.exe qu7597.exe PID 1064 wrote to memory of 1872 1064 un730014.exe qu7597.exe PID 1064 wrote to memory of 1872 1064 un730014.exe qu7597.exe PID 1064 wrote to memory of 1872 1064 un730014.exe qu7597.exe PID 1724 wrote to memory of 1456 1724 51cf01a1b30d1835442e273ad768b7ff.exe si880483.exe PID 1724 wrote to memory of 1456 1724 51cf01a1b30d1835442e273ad768b7ff.exe si880483.exe PID 1724 wrote to memory of 1456 1724 51cf01a1b30d1835442e273ad768b7ff.exe si880483.exe PID 1724 wrote to memory of 1456 1724 51cf01a1b30d1835442e273ad768b7ff.exe si880483.exe PID 1724 wrote to memory of 1456 1724 51cf01a1b30d1835442e273ad768b7ff.exe si880483.exe PID 1724 wrote to memory of 1456 1724 51cf01a1b30d1835442e273ad768b7ff.exe si880483.exe PID 1724 wrote to memory of 1456 1724 51cf01a1b30d1835442e273ad768b7ff.exe si880483.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\51cf01a1b30d1835442e273ad768b7ff.exe"C:\Users\Admin\AppData\Local\Temp\51cf01a1b30d1835442e273ad768b7ff.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un730014.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un730014.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6077.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6077.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1248
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7597.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7597.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1872
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si880483.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si880483.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1456
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD50d5e4c45ee0d8f38b9bef529923c62d8
SHA1ae52fb0a557f6b2a0bcebca35712ed7e8f88cd38
SHA2564d728d888d172a52f4525249287178b1754affe474f607f019b4957186ca6b8a
SHA5124be62a90eedd0cd3dbb8ad29446909f2af188310059fe5191e0c48e3eedaec21e8b0ab0d2827ab37cc1df200f7607d566c1f02693acc3070fa6f6a3ec2388d2e
-
Filesize
175KB
MD50d5e4c45ee0d8f38b9bef529923c62d8
SHA1ae52fb0a557f6b2a0bcebca35712ed7e8f88cd38
SHA2564d728d888d172a52f4525249287178b1754affe474f607f019b4957186ca6b8a
SHA5124be62a90eedd0cd3dbb8ad29446909f2af188310059fe5191e0c48e3eedaec21e8b0ab0d2827ab37cc1df200f7607d566c1f02693acc3070fa6f6a3ec2388d2e
-
Filesize
558KB
MD55db3924e6aac342a5d6bde6527871e86
SHA10fdac73db5532b40212c1a37718ed8f3de031128
SHA25603b83f84e5077b76bc6d71b7056df8ebd14e3cc16bbd8bfac29dd1db46a7b7e8
SHA5128e6a3a294539f7299e5dae37359919c60e07b9ea34a1fcc235dbee3d1a67b78e5e499c9e75536bb3f1b04aba4f8223cf41fec681786cb633e3e0b57ff6536e6e
-
Filesize
558KB
MD55db3924e6aac342a5d6bde6527871e86
SHA10fdac73db5532b40212c1a37718ed8f3de031128
SHA25603b83f84e5077b76bc6d71b7056df8ebd14e3cc16bbd8bfac29dd1db46a7b7e8
SHA5128e6a3a294539f7299e5dae37359919c60e07b9ea34a1fcc235dbee3d1a67b78e5e499c9e75536bb3f1b04aba4f8223cf41fec681786cb633e3e0b57ff6536e6e
-
Filesize
307KB
MD59a91cd22e62655b9a228ec17edf0a1da
SHA11d2188fd90c061bb7edc6694d0724a155f424a26
SHA256b3fa333f4c69d12726d4192910261e4e5fa175a21e0c4f6eb8863eed1e7ae04f
SHA512fa35876587944d6d67f8928f2800c9b8db92e073993a027a1d27daeaab6b2e0515aa266108be2f4cdb45c5b4f33338c004bb6570eebf1def1a19e3422a06bdc2
-
Filesize
307KB
MD59a91cd22e62655b9a228ec17edf0a1da
SHA11d2188fd90c061bb7edc6694d0724a155f424a26
SHA256b3fa333f4c69d12726d4192910261e4e5fa175a21e0c4f6eb8863eed1e7ae04f
SHA512fa35876587944d6d67f8928f2800c9b8db92e073993a027a1d27daeaab6b2e0515aa266108be2f4cdb45c5b4f33338c004bb6570eebf1def1a19e3422a06bdc2
-
Filesize
307KB
MD59a91cd22e62655b9a228ec17edf0a1da
SHA11d2188fd90c061bb7edc6694d0724a155f424a26
SHA256b3fa333f4c69d12726d4192910261e4e5fa175a21e0c4f6eb8863eed1e7ae04f
SHA512fa35876587944d6d67f8928f2800c9b8db92e073993a027a1d27daeaab6b2e0515aa266108be2f4cdb45c5b4f33338c004bb6570eebf1def1a19e3422a06bdc2
-
Filesize
365KB
MD57078a79ec92c748cd458ae8386abf0a7
SHA189b086f9b3bc2b1fa4b5cb75013acb3d89febac1
SHA25619ef0da4f14858991e181bd446609a197423ff7bc70e8a9ae99d683f6197843d
SHA5121b8154020389fceb5a42e90253fd6975eed4e0581a7bcf1b8cd571efb22fa7cb854790bb07957705920f49bb1ecf42cdada5c250f0ab2ed831f9477c84c464c0
-
Filesize
365KB
MD57078a79ec92c748cd458ae8386abf0a7
SHA189b086f9b3bc2b1fa4b5cb75013acb3d89febac1
SHA25619ef0da4f14858991e181bd446609a197423ff7bc70e8a9ae99d683f6197843d
SHA5121b8154020389fceb5a42e90253fd6975eed4e0581a7bcf1b8cd571efb22fa7cb854790bb07957705920f49bb1ecf42cdada5c250f0ab2ed831f9477c84c464c0
-
Filesize
365KB
MD57078a79ec92c748cd458ae8386abf0a7
SHA189b086f9b3bc2b1fa4b5cb75013acb3d89febac1
SHA25619ef0da4f14858991e181bd446609a197423ff7bc70e8a9ae99d683f6197843d
SHA5121b8154020389fceb5a42e90253fd6975eed4e0581a7bcf1b8cd571efb22fa7cb854790bb07957705920f49bb1ecf42cdada5c250f0ab2ed831f9477c84c464c0
-
Filesize
175KB
MD50d5e4c45ee0d8f38b9bef529923c62d8
SHA1ae52fb0a557f6b2a0bcebca35712ed7e8f88cd38
SHA2564d728d888d172a52f4525249287178b1754affe474f607f019b4957186ca6b8a
SHA5124be62a90eedd0cd3dbb8ad29446909f2af188310059fe5191e0c48e3eedaec21e8b0ab0d2827ab37cc1df200f7607d566c1f02693acc3070fa6f6a3ec2388d2e
-
Filesize
175KB
MD50d5e4c45ee0d8f38b9bef529923c62d8
SHA1ae52fb0a557f6b2a0bcebca35712ed7e8f88cd38
SHA2564d728d888d172a52f4525249287178b1754affe474f607f019b4957186ca6b8a
SHA5124be62a90eedd0cd3dbb8ad29446909f2af188310059fe5191e0c48e3eedaec21e8b0ab0d2827ab37cc1df200f7607d566c1f02693acc3070fa6f6a3ec2388d2e
-
Filesize
558KB
MD55db3924e6aac342a5d6bde6527871e86
SHA10fdac73db5532b40212c1a37718ed8f3de031128
SHA25603b83f84e5077b76bc6d71b7056df8ebd14e3cc16bbd8bfac29dd1db46a7b7e8
SHA5128e6a3a294539f7299e5dae37359919c60e07b9ea34a1fcc235dbee3d1a67b78e5e499c9e75536bb3f1b04aba4f8223cf41fec681786cb633e3e0b57ff6536e6e
-
Filesize
558KB
MD55db3924e6aac342a5d6bde6527871e86
SHA10fdac73db5532b40212c1a37718ed8f3de031128
SHA25603b83f84e5077b76bc6d71b7056df8ebd14e3cc16bbd8bfac29dd1db46a7b7e8
SHA5128e6a3a294539f7299e5dae37359919c60e07b9ea34a1fcc235dbee3d1a67b78e5e499c9e75536bb3f1b04aba4f8223cf41fec681786cb633e3e0b57ff6536e6e
-
Filesize
307KB
MD59a91cd22e62655b9a228ec17edf0a1da
SHA11d2188fd90c061bb7edc6694d0724a155f424a26
SHA256b3fa333f4c69d12726d4192910261e4e5fa175a21e0c4f6eb8863eed1e7ae04f
SHA512fa35876587944d6d67f8928f2800c9b8db92e073993a027a1d27daeaab6b2e0515aa266108be2f4cdb45c5b4f33338c004bb6570eebf1def1a19e3422a06bdc2
-
Filesize
307KB
MD59a91cd22e62655b9a228ec17edf0a1da
SHA11d2188fd90c061bb7edc6694d0724a155f424a26
SHA256b3fa333f4c69d12726d4192910261e4e5fa175a21e0c4f6eb8863eed1e7ae04f
SHA512fa35876587944d6d67f8928f2800c9b8db92e073993a027a1d27daeaab6b2e0515aa266108be2f4cdb45c5b4f33338c004bb6570eebf1def1a19e3422a06bdc2
-
Filesize
307KB
MD59a91cd22e62655b9a228ec17edf0a1da
SHA11d2188fd90c061bb7edc6694d0724a155f424a26
SHA256b3fa333f4c69d12726d4192910261e4e5fa175a21e0c4f6eb8863eed1e7ae04f
SHA512fa35876587944d6d67f8928f2800c9b8db92e073993a027a1d27daeaab6b2e0515aa266108be2f4cdb45c5b4f33338c004bb6570eebf1def1a19e3422a06bdc2
-
Filesize
365KB
MD57078a79ec92c748cd458ae8386abf0a7
SHA189b086f9b3bc2b1fa4b5cb75013acb3d89febac1
SHA25619ef0da4f14858991e181bd446609a197423ff7bc70e8a9ae99d683f6197843d
SHA5121b8154020389fceb5a42e90253fd6975eed4e0581a7bcf1b8cd571efb22fa7cb854790bb07957705920f49bb1ecf42cdada5c250f0ab2ed831f9477c84c464c0
-
Filesize
365KB
MD57078a79ec92c748cd458ae8386abf0a7
SHA189b086f9b3bc2b1fa4b5cb75013acb3d89febac1
SHA25619ef0da4f14858991e181bd446609a197423ff7bc70e8a9ae99d683f6197843d
SHA5121b8154020389fceb5a42e90253fd6975eed4e0581a7bcf1b8cd571efb22fa7cb854790bb07957705920f49bb1ecf42cdada5c250f0ab2ed831f9477c84c464c0
-
Filesize
365KB
MD57078a79ec92c748cd458ae8386abf0a7
SHA189b086f9b3bc2b1fa4b5cb75013acb3d89febac1
SHA25619ef0da4f14858991e181bd446609a197423ff7bc70e8a9ae99d683f6197843d
SHA5121b8154020389fceb5a42e90253fd6975eed4e0581a7bcf1b8cd571efb22fa7cb854790bb07957705920f49bb1ecf42cdada5c250f0ab2ed831f9477c84c464c0