Analysis
-
max time kernel
102s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 00:56
Static task
static1
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10v2004-20230220-en
General
-
Target
setup.exe
-
Size
700KB
-
MD5
3ba8e5a66e46b2d296c0c10e4562c0ae
-
SHA1
57d7f1e72edfd573928bf6ba137315d121e4016f
-
SHA256
077a94a553b463f27857dfe6bd3cd19092c286c385c94ea8cb64c9890f757897
-
SHA512
093d9075b18afeef6192f5fa9653c41dfcb4704ff7a8e0eeaf818a9ca97a077f66d066d8172492c6b604def967234437d52f23efa784610c0dbc3c26b0101d5e
-
SSDEEP
12288:dMrLy907Q13mUT9NhflO39D/acAS8F5dABIcTJW3yDDzCK2:6yG0nhxOmS8zdAB5U3yr2
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro0670.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro0670.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro0670.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro0670.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro0670.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro0670.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
resource yara_rule behavioral2/memory/4132-190-0x0000000004D10000-0x0000000004D4F000-memory.dmp family_redline behavioral2/memory/4132-191-0x0000000004D10000-0x0000000004D4F000-memory.dmp family_redline behavioral2/memory/4132-193-0x0000000004D10000-0x0000000004D4F000-memory.dmp family_redline behavioral2/memory/4132-195-0x0000000004D10000-0x0000000004D4F000-memory.dmp family_redline behavioral2/memory/4132-197-0x0000000004D10000-0x0000000004D4F000-memory.dmp family_redline behavioral2/memory/4132-199-0x0000000004D10000-0x0000000004D4F000-memory.dmp family_redline behavioral2/memory/4132-201-0x0000000004D10000-0x0000000004D4F000-memory.dmp family_redline behavioral2/memory/4132-204-0x0000000004D10000-0x0000000004D4F000-memory.dmp family_redline behavioral2/memory/4132-209-0x0000000004E50000-0x0000000004E60000-memory.dmp family_redline behavioral2/memory/4132-208-0x0000000004D10000-0x0000000004D4F000-memory.dmp family_redline behavioral2/memory/4132-211-0x0000000004D10000-0x0000000004D4F000-memory.dmp family_redline behavioral2/memory/4132-213-0x0000000004D10000-0x0000000004D4F000-memory.dmp family_redline behavioral2/memory/4132-215-0x0000000004D10000-0x0000000004D4F000-memory.dmp family_redline behavioral2/memory/4132-217-0x0000000004D10000-0x0000000004D4F000-memory.dmp family_redline behavioral2/memory/4132-219-0x0000000004D10000-0x0000000004D4F000-memory.dmp family_redline behavioral2/memory/4132-221-0x0000000004D10000-0x0000000004D4F000-memory.dmp family_redline behavioral2/memory/4132-223-0x0000000004D10000-0x0000000004D4F000-memory.dmp family_redline behavioral2/memory/4132-225-0x0000000004D10000-0x0000000004D4F000-memory.dmp family_redline behavioral2/memory/4132-227-0x0000000004D10000-0x0000000004D4F000-memory.dmp family_redline behavioral2/memory/4132-1110-0x0000000004E50000-0x0000000004E60000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
pid Process 2728 un881713.exe 4808 pro0670.exe 4132 qu2114.exe 3416 si966985.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro0670.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro0670.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" setup.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un881713.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un881713.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
pid pid_target Process procid_target 4460 4808 WerFault.exe 84 376 4132 WerFault.exe 90 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4808 pro0670.exe 4808 pro0670.exe 4132 qu2114.exe 4132 qu2114.exe 3416 si966985.exe 3416 si966985.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4808 pro0670.exe Token: SeDebugPrivilege 4132 qu2114.exe Token: SeDebugPrivilege 3416 si966985.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1500 wrote to memory of 2728 1500 setup.exe 83 PID 1500 wrote to memory of 2728 1500 setup.exe 83 PID 1500 wrote to memory of 2728 1500 setup.exe 83 PID 2728 wrote to memory of 4808 2728 un881713.exe 84 PID 2728 wrote to memory of 4808 2728 un881713.exe 84 PID 2728 wrote to memory of 4808 2728 un881713.exe 84 PID 2728 wrote to memory of 4132 2728 un881713.exe 90 PID 2728 wrote to memory of 4132 2728 un881713.exe 90 PID 2728 wrote to memory of 4132 2728 un881713.exe 90 PID 1500 wrote to memory of 3416 1500 setup.exe 94 PID 1500 wrote to memory of 3416 1500 setup.exe 94 PID 1500 wrote to memory of 3416 1500 setup.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un881713.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un881713.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0670.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0670.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4808 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 10844⤵
- Program crash
PID:4460
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2114.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2114.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4132 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 16804⤵
- Program crash
PID:376
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si966985.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si966985.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3416
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4808 -ip 48081⤵PID:4484
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4132 -ip 41321⤵PID:5092
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD513099f5fabd280d4381d12910cf18553
SHA195e9692b98e4c6ca60bbdfbdd212540390407091
SHA25600a4aaa0ad4fad6156b9857fe284abc32e3c9f1a9302a725a8a07573afddf9ff
SHA5125af1f0153c69e625c62f46d658b00a7322ad823dfd6667211ca35968d534023b9022c2c0ea9b13174fcefb92ecf104452c6183680331f514d0360ccb21013150
-
Filesize
175KB
MD513099f5fabd280d4381d12910cf18553
SHA195e9692b98e4c6ca60bbdfbdd212540390407091
SHA25600a4aaa0ad4fad6156b9857fe284abc32e3c9f1a9302a725a8a07573afddf9ff
SHA5125af1f0153c69e625c62f46d658b00a7322ad823dfd6667211ca35968d534023b9022c2c0ea9b13174fcefb92ecf104452c6183680331f514d0360ccb21013150
-
Filesize
558KB
MD592586ab2eddf36244d69faba4ebc33c5
SHA1315c8c17a880061e19de95fe4b3cd7ccecef70c1
SHA256d61fc74643c788696a38940fdab6df2c9507f1652c40d2a676260b567012527f
SHA51269800a97cc1f62d535ed8aa5ea1d1cf3262bab14e3186a3c63475b019b11f7a1a206b912e07ee4125c7892ef6cb3a07251bd5d4c05d85fbda917995e5d079157
-
Filesize
558KB
MD592586ab2eddf36244d69faba4ebc33c5
SHA1315c8c17a880061e19de95fe4b3cd7ccecef70c1
SHA256d61fc74643c788696a38940fdab6df2c9507f1652c40d2a676260b567012527f
SHA51269800a97cc1f62d535ed8aa5ea1d1cf3262bab14e3186a3c63475b019b11f7a1a206b912e07ee4125c7892ef6cb3a07251bd5d4c05d85fbda917995e5d079157
-
Filesize
307KB
MD5b632a71f76b5f2b67fd6c237160b9cf0
SHA19fe9b5c79714ec2b598d0879540b97e78234e62b
SHA2564e5fa0ef2ee6340cc25612768ac3f2d42b96b62a5f274cb6197f67dbbaea749c
SHA512240ddf14c0d3610fb63eae8c4a05a00e7d66e03fe52596af377c60ffadf5608b4250a23860b4cc51e5695d384c671ad9b4e229bb6489b90c92d16ab7ae4fec21
-
Filesize
307KB
MD5b632a71f76b5f2b67fd6c237160b9cf0
SHA19fe9b5c79714ec2b598d0879540b97e78234e62b
SHA2564e5fa0ef2ee6340cc25612768ac3f2d42b96b62a5f274cb6197f67dbbaea749c
SHA512240ddf14c0d3610fb63eae8c4a05a00e7d66e03fe52596af377c60ffadf5608b4250a23860b4cc51e5695d384c671ad9b4e229bb6489b90c92d16ab7ae4fec21
-
Filesize
365KB
MD545dc41608596d4d987ddf88ffdf08c2f
SHA15abc931107c368bcfaf75041a2749961c4bc8d76
SHA25669667a3700f5b0c4974257d210e3e78b78858fafc5f38c6955b46c596064b988
SHA512b615ded9fc61b0265111538e7fb60063827f2989cd74fc01f966ce0ea0c2d241941d5e2ae8e52e055b384f2e2b620def7b0632e6bebb5a606f64534b0baf492d
-
Filesize
365KB
MD545dc41608596d4d987ddf88ffdf08c2f
SHA15abc931107c368bcfaf75041a2749961c4bc8d76
SHA25669667a3700f5b0c4974257d210e3e78b78858fafc5f38c6955b46c596064b988
SHA512b615ded9fc61b0265111538e7fb60063827f2989cd74fc01f966ce0ea0c2d241941d5e2ae8e52e055b384f2e2b620def7b0632e6bebb5a606f64534b0baf492d