Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 03:07
Static task
static1
Behavioral task
behavioral1
Sample
1ac9bb7f41e5592ec151b9424dfb2095d5390112296d844f7edc61e211a30864.exe
Resource
win10v2004-20230220-en
General
-
Target
1ac9bb7f41e5592ec151b9424dfb2095d5390112296d844f7edc61e211a30864.exe
-
Size
664KB
-
MD5
db1a0508eda9e96f4cd2626383cee844
-
SHA1
e579a2830c2ddb2985acd1585c965aefb8c41b13
-
SHA256
1ac9bb7f41e5592ec151b9424dfb2095d5390112296d844f7edc61e211a30864
-
SHA512
472ce2fa9b65e021d6e02b102f3bec0775177dfa0ff029ec9743d23ef9403e96c266008cbe1313e375d81d1f1f49cad98d8d7d18a7e245fca871cd1c1f6733a0
-
SSDEEP
12288:FVaVtadukTDcT7VqrPl/eo2E+4YoOOvpv0V7f40cKkyRluPsyM06u44CexnI:FVCiIfMr9/12EbYo9xUf40cKkyn9yM0a
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Processes:
jr510069.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr510069.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr510069.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr510069.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr510069.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr510069.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr510069.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 32 IoCs
Processes:
resource yara_rule behavioral1/memory/3472-160-0x0000000005FD0000-0x000000000600F000-memory.dmp family_redline behavioral1/memory/3472-161-0x0000000005FD0000-0x000000000600F000-memory.dmp family_redline behavioral1/memory/3472-163-0x0000000005FD0000-0x000000000600F000-memory.dmp family_redline behavioral1/memory/3472-165-0x0000000005FD0000-0x000000000600F000-memory.dmp family_redline behavioral1/memory/3472-167-0x0000000005FD0000-0x000000000600F000-memory.dmp family_redline behavioral1/memory/3472-169-0x0000000005FD0000-0x000000000600F000-memory.dmp family_redline behavioral1/memory/3472-171-0x0000000005FD0000-0x000000000600F000-memory.dmp family_redline behavioral1/memory/3472-173-0x0000000005FD0000-0x000000000600F000-memory.dmp family_redline behavioral1/memory/3472-175-0x0000000005FD0000-0x000000000600F000-memory.dmp family_redline behavioral1/memory/3472-177-0x0000000005FD0000-0x000000000600F000-memory.dmp family_redline behavioral1/memory/3472-179-0x0000000005FD0000-0x000000000600F000-memory.dmp family_redline behavioral1/memory/3472-181-0x0000000005FD0000-0x000000000600F000-memory.dmp family_redline behavioral1/memory/3472-183-0x0000000005FD0000-0x000000000600F000-memory.dmp family_redline behavioral1/memory/3472-185-0x0000000005FD0000-0x000000000600F000-memory.dmp family_redline behavioral1/memory/3472-187-0x0000000005FD0000-0x000000000600F000-memory.dmp family_redline behavioral1/memory/3472-189-0x0000000005FD0000-0x000000000600F000-memory.dmp family_redline behavioral1/memory/3472-191-0x0000000005FD0000-0x000000000600F000-memory.dmp family_redline behavioral1/memory/3472-193-0x0000000005FD0000-0x000000000600F000-memory.dmp family_redline behavioral1/memory/3472-197-0x0000000005FD0000-0x000000000600F000-memory.dmp family_redline behavioral1/memory/3472-199-0x0000000005FD0000-0x000000000600F000-memory.dmp family_redline behavioral1/memory/3472-201-0x0000000005FD0000-0x000000000600F000-memory.dmp family_redline behavioral1/memory/3472-203-0x0000000005FD0000-0x000000000600F000-memory.dmp family_redline behavioral1/memory/3472-205-0x0000000005FD0000-0x000000000600F000-memory.dmp family_redline behavioral1/memory/3472-207-0x0000000005FD0000-0x000000000600F000-memory.dmp family_redline behavioral1/memory/3472-209-0x0000000005FD0000-0x000000000600F000-memory.dmp family_redline behavioral1/memory/3472-211-0x0000000005FD0000-0x000000000600F000-memory.dmp family_redline behavioral1/memory/3472-213-0x0000000005FD0000-0x000000000600F000-memory.dmp family_redline behavioral1/memory/3472-215-0x0000000005FD0000-0x000000000600F000-memory.dmp family_redline behavioral1/memory/3472-217-0x0000000005FD0000-0x000000000600F000-memory.dmp family_redline behavioral1/memory/3472-219-0x0000000005FD0000-0x000000000600F000-memory.dmp family_redline behavioral1/memory/3472-221-0x0000000005FD0000-0x000000000600F000-memory.dmp family_redline behavioral1/memory/3472-223-0x0000000005FD0000-0x000000000600F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
ziQC9687.exejr510069.exeku260293.exelr097905.exepid process 1988 ziQC9687.exe 1808 jr510069.exe 3472 ku260293.exe 2300 lr097905.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr510069.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr510069.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
1ac9bb7f41e5592ec151b9424dfb2095d5390112296d844f7edc61e211a30864.exeziQC9687.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 1ac9bb7f41e5592ec151b9424dfb2095d5390112296d844f7edc61e211a30864.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1ac9bb7f41e5592ec151b9424dfb2095d5390112296d844f7edc61e211a30864.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziQC9687.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziQC9687.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4208 3472 WerFault.exe ku260293.exe 1532 2056 WerFault.exe 1ac9bb7f41e5592ec151b9424dfb2095d5390112296d844f7edc61e211a30864.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr510069.exeku260293.exelr097905.exepid process 1808 jr510069.exe 1808 jr510069.exe 3472 ku260293.exe 3472 ku260293.exe 2300 lr097905.exe 2300 lr097905.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr510069.exeku260293.exelr097905.exedescription pid process Token: SeDebugPrivilege 1808 jr510069.exe Token: SeDebugPrivilege 3472 ku260293.exe Token: SeDebugPrivilege 2300 lr097905.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
1ac9bb7f41e5592ec151b9424dfb2095d5390112296d844f7edc61e211a30864.exeziQC9687.exedescription pid process target process PID 2056 wrote to memory of 1988 2056 1ac9bb7f41e5592ec151b9424dfb2095d5390112296d844f7edc61e211a30864.exe ziQC9687.exe PID 2056 wrote to memory of 1988 2056 1ac9bb7f41e5592ec151b9424dfb2095d5390112296d844f7edc61e211a30864.exe ziQC9687.exe PID 2056 wrote to memory of 1988 2056 1ac9bb7f41e5592ec151b9424dfb2095d5390112296d844f7edc61e211a30864.exe ziQC9687.exe PID 1988 wrote to memory of 1808 1988 ziQC9687.exe jr510069.exe PID 1988 wrote to memory of 1808 1988 ziQC9687.exe jr510069.exe PID 1988 wrote to memory of 3472 1988 ziQC9687.exe ku260293.exe PID 1988 wrote to memory of 3472 1988 ziQC9687.exe ku260293.exe PID 1988 wrote to memory of 3472 1988 ziQC9687.exe ku260293.exe PID 2056 wrote to memory of 2300 2056 1ac9bb7f41e5592ec151b9424dfb2095d5390112296d844f7edc61e211a30864.exe lr097905.exe PID 2056 wrote to memory of 2300 2056 1ac9bb7f41e5592ec151b9424dfb2095d5390112296d844f7edc61e211a30864.exe lr097905.exe PID 2056 wrote to memory of 2300 2056 1ac9bb7f41e5592ec151b9424dfb2095d5390112296d844f7edc61e211a30864.exe lr097905.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ac9bb7f41e5592ec151b9424dfb2095d5390112296d844f7edc61e211a30864.exe"C:\Users\Admin\AppData\Local\Temp\1ac9bb7f41e5592ec151b9424dfb2095d5390112296d844f7edc61e211a30864.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziQC9687.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziQC9687.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr510069.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr510069.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku260293.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku260293.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 13564⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr097905.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr097905.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 4842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3472 -ip 34721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2056 -ip 20561⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr097905.exeFilesize
175KB
MD55f975b4331673c30c9ac4d5489f3cd63
SHA1bbb4c7f8fcbe773d2998c301a0e4c1d5f802baff
SHA2560a72e4acc80b7c72d377d96bc308c972f6aac8bbf180570a52152f71f9f3f5a9
SHA5120d6db9c03d06ece44fb3780bd25ffc5ef975ad14347bcce1349b006c1db266f82e5b18e33f75152c1127ec935067e330e363b045543fbcd8801bdab9d878975c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr097905.exeFilesize
175KB
MD55f975b4331673c30c9ac4d5489f3cd63
SHA1bbb4c7f8fcbe773d2998c301a0e4c1d5f802baff
SHA2560a72e4acc80b7c72d377d96bc308c972f6aac8bbf180570a52152f71f9f3f5a9
SHA5120d6db9c03d06ece44fb3780bd25ffc5ef975ad14347bcce1349b006c1db266f82e5b18e33f75152c1127ec935067e330e363b045543fbcd8801bdab9d878975c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziQC9687.exeFilesize
387KB
MD553caf17adc839a4667992c6c0ea06d36
SHA1733ef02662f6384bc3a76e8bbc6064793315030c
SHA256be6e81f0b16af02d9133ddf034057fd31fa315165517125f1c348d676001527f
SHA512eb8c2b9ada459f27163a234c84efad7ee04b8ddede5f28e58ff500b190eba4a14467843e546d644e04fc460049a59bbce0e1843474fdcfd48f7d411e05c326b7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziQC9687.exeFilesize
387KB
MD553caf17adc839a4667992c6c0ea06d36
SHA1733ef02662f6384bc3a76e8bbc6064793315030c
SHA256be6e81f0b16af02d9133ddf034057fd31fa315165517125f1c348d676001527f
SHA512eb8c2b9ada459f27163a234c84efad7ee04b8ddede5f28e58ff500b190eba4a14467843e546d644e04fc460049a59bbce0e1843474fdcfd48f7d411e05c326b7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr510069.exeFilesize
11KB
MD5c9c3eb9eabfde6272d553187852e20d1
SHA1ca3e3be1439463bda64a3d248e9203e310625691
SHA256c1b3bfd5b1c3d5d13640d753e45a63c6df8856cbe52733a84be60b0ba9942542
SHA51242bbbc7f0c2822610c74ce732f9bb231fe8b947d1b3115adfab0e86a478f42f309311d6c61d4c48b52f9ca47acd03fcd729f755243ab89651ec7198f4583efed
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr510069.exeFilesize
11KB
MD5c9c3eb9eabfde6272d553187852e20d1
SHA1ca3e3be1439463bda64a3d248e9203e310625691
SHA256c1b3bfd5b1c3d5d13640d753e45a63c6df8856cbe52733a84be60b0ba9942542
SHA51242bbbc7f0c2822610c74ce732f9bb231fe8b947d1b3115adfab0e86a478f42f309311d6c61d4c48b52f9ca47acd03fcd729f755243ab89651ec7198f4583efed
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku260293.exeFilesize
345KB
MD5c2b4517fec935d1bb36b3e9ada66a492
SHA18a35e3edae871bef9042f063dd2c1808e21d1033
SHA2562dae1f45f8df7cd6879329e22c470f539402fdda4e430e10a1f3801ef240ee0b
SHA512ad5dc41d34f74d0c687765b9418441f6299d7d75d2e642e8a462220123e073fa8239eed66ee7168768bd183ace5570cec6dc7a38a32332a2cb0e8a754997c000
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku260293.exeFilesize
345KB
MD5c2b4517fec935d1bb36b3e9ada66a492
SHA18a35e3edae871bef9042f063dd2c1808e21d1033
SHA2562dae1f45f8df7cd6879329e22c470f539402fdda4e430e10a1f3801ef240ee0b
SHA512ad5dc41d34f74d0c687765b9418441f6299d7d75d2e642e8a462220123e073fa8239eed66ee7168768bd183ace5570cec6dc7a38a32332a2cb0e8a754997c000
-
memory/1808-152-0x000000001B340000-0x000000001B48E000-memory.dmpFilesize
1.3MB
-
memory/1808-149-0x0000000000830000-0x000000000083A000-memory.dmpFilesize
40KB
-
memory/2056-134-0x00000000023C0000-0x0000000002446000-memory.dmpFilesize
536KB
-
memory/2056-150-0x0000000000400000-0x0000000000769000-memory.dmpFilesize
3.4MB
-
memory/2300-1094-0x0000000005120000-0x0000000005130000-memory.dmpFilesize
64KB
-
memory/2300-1092-0x0000000005120000-0x0000000005130000-memory.dmpFilesize
64KB
-
memory/2300-1091-0x0000000000850000-0x0000000000882000-memory.dmpFilesize
200KB
-
memory/3472-194-0x0000000006160000-0x0000000006170000-memory.dmpFilesize
64KB
-
memory/3472-209-0x0000000005FD0000-0x000000000600F000-memory.dmpFilesize
252KB
-
memory/3472-165-0x0000000005FD0000-0x000000000600F000-memory.dmpFilesize
252KB
-
memory/3472-167-0x0000000005FD0000-0x000000000600F000-memory.dmpFilesize
252KB
-
memory/3472-169-0x0000000005FD0000-0x000000000600F000-memory.dmpFilesize
252KB
-
memory/3472-171-0x0000000005FD0000-0x000000000600F000-memory.dmpFilesize
252KB
-
memory/3472-173-0x0000000005FD0000-0x000000000600F000-memory.dmpFilesize
252KB
-
memory/3472-175-0x0000000005FD0000-0x000000000600F000-memory.dmpFilesize
252KB
-
memory/3472-177-0x0000000005FD0000-0x000000000600F000-memory.dmpFilesize
252KB
-
memory/3472-179-0x0000000005FD0000-0x000000000600F000-memory.dmpFilesize
252KB
-
memory/3472-181-0x0000000005FD0000-0x000000000600F000-memory.dmpFilesize
252KB
-
memory/3472-183-0x0000000005FD0000-0x000000000600F000-memory.dmpFilesize
252KB
-
memory/3472-185-0x0000000005FD0000-0x000000000600F000-memory.dmpFilesize
252KB
-
memory/3472-187-0x0000000005FD0000-0x000000000600F000-memory.dmpFilesize
252KB
-
memory/3472-189-0x0000000005FD0000-0x000000000600F000-memory.dmpFilesize
252KB
-
memory/3472-191-0x0000000005FD0000-0x000000000600F000-memory.dmpFilesize
252KB
-
memory/3472-193-0x0000000005FD0000-0x000000000600F000-memory.dmpFilesize
252KB
-
memory/3472-161-0x0000000005FD0000-0x000000000600F000-memory.dmpFilesize
252KB
-
memory/3472-196-0x0000000006160000-0x0000000006170000-memory.dmpFilesize
64KB
-
memory/3472-197-0x0000000005FD0000-0x000000000600F000-memory.dmpFilesize
252KB
-
memory/3472-199-0x0000000005FD0000-0x000000000600F000-memory.dmpFilesize
252KB
-
memory/3472-201-0x0000000005FD0000-0x000000000600F000-memory.dmpFilesize
252KB
-
memory/3472-203-0x0000000005FD0000-0x000000000600F000-memory.dmpFilesize
252KB
-
memory/3472-205-0x0000000005FD0000-0x000000000600F000-memory.dmpFilesize
252KB
-
memory/3472-207-0x0000000005FD0000-0x000000000600F000-memory.dmpFilesize
252KB
-
memory/3472-163-0x0000000005FD0000-0x000000000600F000-memory.dmpFilesize
252KB
-
memory/3472-211-0x0000000005FD0000-0x000000000600F000-memory.dmpFilesize
252KB
-
memory/3472-213-0x0000000005FD0000-0x000000000600F000-memory.dmpFilesize
252KB
-
memory/3472-215-0x0000000005FD0000-0x000000000600F000-memory.dmpFilesize
252KB
-
memory/3472-217-0x0000000005FD0000-0x000000000600F000-memory.dmpFilesize
252KB
-
memory/3472-219-0x0000000005FD0000-0x000000000600F000-memory.dmpFilesize
252KB
-
memory/3472-221-0x0000000005FD0000-0x000000000600F000-memory.dmpFilesize
252KB
-
memory/3472-223-0x0000000005FD0000-0x000000000600F000-memory.dmpFilesize
252KB
-
memory/3472-1068-0x0000000006720000-0x0000000006D38000-memory.dmpFilesize
6.1MB
-
memory/3472-1069-0x0000000006D40000-0x0000000006E4A000-memory.dmpFilesize
1.0MB
-
memory/3472-1070-0x0000000006120000-0x0000000006132000-memory.dmpFilesize
72KB
-
memory/3472-1071-0x0000000006160000-0x0000000006170000-memory.dmpFilesize
64KB
-
memory/3472-1072-0x0000000006E50000-0x0000000006E8C000-memory.dmpFilesize
240KB
-
memory/3472-1075-0x0000000007120000-0x00000000071B2000-memory.dmpFilesize
584KB
-
memory/3472-1076-0x00000000071C0000-0x0000000007226000-memory.dmpFilesize
408KB
-
memory/3472-1077-0x0000000006160000-0x0000000006170000-memory.dmpFilesize
64KB
-
memory/3472-1078-0x0000000006160000-0x0000000006170000-memory.dmpFilesize
64KB
-
memory/3472-1079-0x00000000079C0000-0x0000000007A36000-memory.dmpFilesize
472KB
-
memory/3472-1080-0x0000000007A50000-0x0000000007AA0000-memory.dmpFilesize
320KB
-
memory/3472-1081-0x0000000006160000-0x0000000006170000-memory.dmpFilesize
64KB
-
memory/3472-1082-0x0000000007C20000-0x0000000007DE2000-memory.dmpFilesize
1.8MB
-
memory/3472-160-0x0000000005FD0000-0x000000000600F000-memory.dmpFilesize
252KB
-
memory/3472-159-0x0000000006170000-0x0000000006714000-memory.dmpFilesize
5.6MB
-
memory/3472-158-0x0000000006160000-0x0000000006170000-memory.dmpFilesize
64KB
-
memory/3472-157-0x0000000001B50000-0x0000000001B9B000-memory.dmpFilesize
300KB
-
memory/3472-1083-0x0000000007DF0000-0x000000000831C000-memory.dmpFilesize
5.2MB