Analysis
-
max time kernel
83s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 04:27
Static task
static1
Behavioral task
behavioral1
Sample
b8159fa35d9bc51373e278fa8d87afbc6ef9d2b761b695b0abaa1db788f66ec1.exe
Resource
win10v2004-20230220-en
General
-
Target
b8159fa35d9bc51373e278fa8d87afbc6ef9d2b761b695b0abaa1db788f66ec1.exe
-
Size
689KB
-
MD5
3cdf3c09a99786fe9a697742bde2429e
-
SHA1
b267d02fc000791c08071118721202a2199e618d
-
SHA256
b8159fa35d9bc51373e278fa8d87afbc6ef9d2b761b695b0abaa1db788f66ec1
-
SHA512
8b57b6b3622fba3a9a54d338a3ec2a76b7526139b3c2af27eac2aff4ef8d3c22343e304c19196c88c1dce673a153b39e549461cace3470911400c544a64c7b26
-
SSDEEP
12288:/MrKy90HLp8klAtpFagyR65hLu1GMSKI3VPoK6LbucvmFpIfig8V0gf1SAONCvHE:py0L6t28fa1GLZ3VPoDLKcSpIag+x4Z
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Processes:
pro0791.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro0791.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro0791.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro0791.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro0791.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro0791.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro0791.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/4564-188-0x0000000003BB0000-0x0000000003BEF000-memory.dmp family_redline behavioral1/memory/4564-189-0x0000000003BB0000-0x0000000003BEF000-memory.dmp family_redline behavioral1/memory/4564-191-0x0000000003BB0000-0x0000000003BEF000-memory.dmp family_redline behavioral1/memory/4564-193-0x0000000003BB0000-0x0000000003BEF000-memory.dmp family_redline behavioral1/memory/4564-195-0x0000000003BB0000-0x0000000003BEF000-memory.dmp family_redline behavioral1/memory/4564-197-0x0000000003BB0000-0x0000000003BEF000-memory.dmp family_redline behavioral1/memory/4564-199-0x0000000003BB0000-0x0000000003BEF000-memory.dmp family_redline behavioral1/memory/4564-201-0x0000000003BB0000-0x0000000003BEF000-memory.dmp family_redline behavioral1/memory/4564-203-0x0000000003BB0000-0x0000000003BEF000-memory.dmp family_redline behavioral1/memory/4564-205-0x0000000003BB0000-0x0000000003BEF000-memory.dmp family_redline behavioral1/memory/4564-207-0x0000000003BB0000-0x0000000003BEF000-memory.dmp family_redline behavioral1/memory/4564-209-0x0000000003BB0000-0x0000000003BEF000-memory.dmp family_redline behavioral1/memory/4564-211-0x0000000003BB0000-0x0000000003BEF000-memory.dmp family_redline behavioral1/memory/4564-213-0x0000000003BB0000-0x0000000003BEF000-memory.dmp family_redline behavioral1/memory/4564-215-0x0000000003BB0000-0x0000000003BEF000-memory.dmp family_redline behavioral1/memory/4564-217-0x0000000003BB0000-0x0000000003BEF000-memory.dmp family_redline behavioral1/memory/4564-219-0x0000000003BB0000-0x0000000003BEF000-memory.dmp family_redline behavioral1/memory/4564-221-0x0000000003BB0000-0x0000000003BEF000-memory.dmp family_redline behavioral1/memory/4564-1108-0x0000000006200000-0x0000000006210000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un382379.exepro0791.exequ2499.exesi319403.exepid process 1240 un382379.exe 376 pro0791.exe 4564 qu2499.exe 5012 si319403.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro0791.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro0791.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro0791.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
b8159fa35d9bc51373e278fa8d87afbc6ef9d2b761b695b0abaa1db788f66ec1.exeun382379.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce b8159fa35d9bc51373e278fa8d87afbc6ef9d2b761b695b0abaa1db788f66ec1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" b8159fa35d9bc51373e278fa8d87afbc6ef9d2b761b695b0abaa1db788f66ec1.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un382379.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un382379.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2900 376 WerFault.exe pro0791.exe 4052 4564 WerFault.exe qu2499.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro0791.exequ2499.exesi319403.exepid process 376 pro0791.exe 376 pro0791.exe 4564 qu2499.exe 4564 qu2499.exe 5012 si319403.exe 5012 si319403.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro0791.exequ2499.exesi319403.exedescription pid process Token: SeDebugPrivilege 376 pro0791.exe Token: SeDebugPrivilege 4564 qu2499.exe Token: SeDebugPrivilege 5012 si319403.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
b8159fa35d9bc51373e278fa8d87afbc6ef9d2b761b695b0abaa1db788f66ec1.exeun382379.exedescription pid process target process PID 4896 wrote to memory of 1240 4896 b8159fa35d9bc51373e278fa8d87afbc6ef9d2b761b695b0abaa1db788f66ec1.exe un382379.exe PID 4896 wrote to memory of 1240 4896 b8159fa35d9bc51373e278fa8d87afbc6ef9d2b761b695b0abaa1db788f66ec1.exe un382379.exe PID 4896 wrote to memory of 1240 4896 b8159fa35d9bc51373e278fa8d87afbc6ef9d2b761b695b0abaa1db788f66ec1.exe un382379.exe PID 1240 wrote to memory of 376 1240 un382379.exe pro0791.exe PID 1240 wrote to memory of 376 1240 un382379.exe pro0791.exe PID 1240 wrote to memory of 376 1240 un382379.exe pro0791.exe PID 1240 wrote to memory of 4564 1240 un382379.exe qu2499.exe PID 1240 wrote to memory of 4564 1240 un382379.exe qu2499.exe PID 1240 wrote to memory of 4564 1240 un382379.exe qu2499.exe PID 4896 wrote to memory of 5012 4896 b8159fa35d9bc51373e278fa8d87afbc6ef9d2b761b695b0abaa1db788f66ec1.exe si319403.exe PID 4896 wrote to memory of 5012 4896 b8159fa35d9bc51373e278fa8d87afbc6ef9d2b761b695b0abaa1db788f66ec1.exe si319403.exe PID 4896 wrote to memory of 5012 4896 b8159fa35d9bc51373e278fa8d87afbc6ef9d2b761b695b0abaa1db788f66ec1.exe si319403.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8159fa35d9bc51373e278fa8d87afbc6ef9d2b761b695b0abaa1db788f66ec1.exe"C:\Users\Admin\AppData\Local\Temp\b8159fa35d9bc51373e278fa8d87afbc6ef9d2b761b695b0abaa1db788f66ec1.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un382379.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un382379.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0791.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0791.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 10844⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2499.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2499.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 13524⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si319403.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si319403.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 376 -ip 3761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4564 -ip 45641⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si319403.exeFilesize
175KB
MD51b371a1a5d81d7fa1ba186eb25f409e6
SHA1217b89040f19a3178806607cc7381742b840ec63
SHA256dcbbe233ceccff5ae19a4624c19bafe26bff3a7e4d1761515dc370efc521dc97
SHA5123da3c667a5d902869cd2fd1b338bfc53943d2f9e7cf0ef2b256e6893316c97ab1f8f56349d9be262e46ddc32467af215c8f69b7d138ae6bb44e5fcb253e19690
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si319403.exeFilesize
175KB
MD51b371a1a5d81d7fa1ba186eb25f409e6
SHA1217b89040f19a3178806607cc7381742b840ec63
SHA256dcbbe233ceccff5ae19a4624c19bafe26bff3a7e4d1761515dc370efc521dc97
SHA5123da3c667a5d902869cd2fd1b338bfc53943d2f9e7cf0ef2b256e6893316c97ab1f8f56349d9be262e46ddc32467af215c8f69b7d138ae6bb44e5fcb253e19690
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un382379.exeFilesize
547KB
MD52d17739d02fac503f07416456b30fa3f
SHA1c53248cf64bd037e58ac3e5fd8bd7faa1867371c
SHA256b970328e0d740c7262e6087d4abb70e19432e7e6e95700e564a9b56e50f4544c
SHA512e23138baaae6913c1aec02aa12f428a7c72cd242597629767e2ccaa49935d3d8fdccb6e67d3e3e7ff6d4fc9e60658eccef1557537122cdf7c4cf36892065dd5b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un382379.exeFilesize
547KB
MD52d17739d02fac503f07416456b30fa3f
SHA1c53248cf64bd037e58ac3e5fd8bd7faa1867371c
SHA256b970328e0d740c7262e6087d4abb70e19432e7e6e95700e564a9b56e50f4544c
SHA512e23138baaae6913c1aec02aa12f428a7c72cd242597629767e2ccaa49935d3d8fdccb6e67d3e3e7ff6d4fc9e60658eccef1557537122cdf7c4cf36892065dd5b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0791.exeFilesize
291KB
MD53a112af5ddb2713db09b9c01399841e1
SHA13774df9e5e9d8d6ce097f68bc6172bc878ea2bd0
SHA2565afe9dd350a60bf57abc13b3cb9d7e2567c062903f7ea4c61885c93ebd056aa0
SHA512481cf15a9bed1d14a1f7e93420f2b7adbc8cf66a5d8b4aa964338cef8a8e92a656df5d69c19bf7081cdc02e0be708d65f2387bdc26b6526eec0074ec0b350657
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0791.exeFilesize
291KB
MD53a112af5ddb2713db09b9c01399841e1
SHA13774df9e5e9d8d6ce097f68bc6172bc878ea2bd0
SHA2565afe9dd350a60bf57abc13b3cb9d7e2567c062903f7ea4c61885c93ebd056aa0
SHA512481cf15a9bed1d14a1f7e93420f2b7adbc8cf66a5d8b4aa964338cef8a8e92a656df5d69c19bf7081cdc02e0be708d65f2387bdc26b6526eec0074ec0b350657
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2499.exeFilesize
345KB
MD5764a326cf8898cc3bfe7cabad07fafa8
SHA175534b2225889f70cd47abe0745910225be24a6f
SHA256960e5c67b55d186f066a1f68ad4ddd72d1e46b84acc4089419cd8dad9ae110ed
SHA512dd4d7001116b70a80bf4601a217f74326f34bdb850e4371353a7cba901dba03afb1318fb29916cdf2e7fb01ff5f66ffc49022f5f567b88b37d4d4935e51cac9f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2499.exeFilesize
345KB
MD5764a326cf8898cc3bfe7cabad07fafa8
SHA175534b2225889f70cd47abe0745910225be24a6f
SHA256960e5c67b55d186f066a1f68ad4ddd72d1e46b84acc4089419cd8dad9ae110ed
SHA512dd4d7001116b70a80bf4601a217f74326f34bdb850e4371353a7cba901dba03afb1318fb29916cdf2e7fb01ff5f66ffc49022f5f567b88b37d4d4935e51cac9f
-
memory/376-148-0x00000000007E0000-0x000000000080D000-memory.dmpFilesize
180KB
-
memory/376-149-0x0000000004E30000-0x0000000004E40000-memory.dmpFilesize
64KB
-
memory/376-150-0x0000000004E30000-0x0000000004E40000-memory.dmpFilesize
64KB
-
memory/376-151-0x0000000004E40000-0x00000000053E4000-memory.dmpFilesize
5.6MB
-
memory/376-152-0x0000000002680000-0x0000000002692000-memory.dmpFilesize
72KB
-
memory/376-155-0x0000000002680000-0x0000000002692000-memory.dmpFilesize
72KB
-
memory/376-153-0x0000000002680000-0x0000000002692000-memory.dmpFilesize
72KB
-
memory/376-157-0x0000000002680000-0x0000000002692000-memory.dmpFilesize
72KB
-
memory/376-159-0x0000000002680000-0x0000000002692000-memory.dmpFilesize
72KB
-
memory/376-161-0x0000000002680000-0x0000000002692000-memory.dmpFilesize
72KB
-
memory/376-163-0x0000000002680000-0x0000000002692000-memory.dmpFilesize
72KB
-
memory/376-165-0x0000000002680000-0x0000000002692000-memory.dmpFilesize
72KB
-
memory/376-167-0x0000000002680000-0x0000000002692000-memory.dmpFilesize
72KB
-
memory/376-169-0x0000000002680000-0x0000000002692000-memory.dmpFilesize
72KB
-
memory/376-171-0x0000000002680000-0x0000000002692000-memory.dmpFilesize
72KB
-
memory/376-173-0x0000000002680000-0x0000000002692000-memory.dmpFilesize
72KB
-
memory/376-175-0x0000000002680000-0x0000000002692000-memory.dmpFilesize
72KB
-
memory/376-177-0x0000000002680000-0x0000000002692000-memory.dmpFilesize
72KB
-
memory/376-179-0x0000000002680000-0x0000000002692000-memory.dmpFilesize
72KB
-
memory/376-180-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/376-181-0x0000000004E30000-0x0000000004E40000-memory.dmpFilesize
64KB
-
memory/376-183-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/4564-188-0x0000000003BB0000-0x0000000003BEF000-memory.dmpFilesize
252KB
-
memory/4564-189-0x0000000003BB0000-0x0000000003BEF000-memory.dmpFilesize
252KB
-
memory/4564-191-0x0000000003BB0000-0x0000000003BEF000-memory.dmpFilesize
252KB
-
memory/4564-193-0x0000000003BB0000-0x0000000003BEF000-memory.dmpFilesize
252KB
-
memory/4564-195-0x0000000003BB0000-0x0000000003BEF000-memory.dmpFilesize
252KB
-
memory/4564-197-0x0000000003BB0000-0x0000000003BEF000-memory.dmpFilesize
252KB
-
memory/4564-199-0x0000000003BB0000-0x0000000003BEF000-memory.dmpFilesize
252KB
-
memory/4564-201-0x0000000003BB0000-0x0000000003BEF000-memory.dmpFilesize
252KB
-
memory/4564-203-0x0000000003BB0000-0x0000000003BEF000-memory.dmpFilesize
252KB
-
memory/4564-205-0x0000000003BB0000-0x0000000003BEF000-memory.dmpFilesize
252KB
-
memory/4564-207-0x0000000003BB0000-0x0000000003BEF000-memory.dmpFilesize
252KB
-
memory/4564-209-0x0000000003BB0000-0x0000000003BEF000-memory.dmpFilesize
252KB
-
memory/4564-211-0x0000000003BB0000-0x0000000003BEF000-memory.dmpFilesize
252KB
-
memory/4564-213-0x0000000003BB0000-0x0000000003BEF000-memory.dmpFilesize
252KB
-
memory/4564-215-0x0000000003BB0000-0x0000000003BEF000-memory.dmpFilesize
252KB
-
memory/4564-217-0x0000000003BB0000-0x0000000003BEF000-memory.dmpFilesize
252KB
-
memory/4564-219-0x0000000003BB0000-0x0000000003BEF000-memory.dmpFilesize
252KB
-
memory/4564-221-0x0000000003BB0000-0x0000000003BEF000-memory.dmpFilesize
252KB
-
memory/4564-341-0x0000000001B00000-0x0000000001B4B000-memory.dmpFilesize
300KB
-
memory/4564-342-0x0000000006200000-0x0000000006210000-memory.dmpFilesize
64KB
-
memory/4564-344-0x0000000006200000-0x0000000006210000-memory.dmpFilesize
64KB
-
memory/4564-345-0x0000000006200000-0x0000000006210000-memory.dmpFilesize
64KB
-
memory/4564-1098-0x00000000067C0000-0x0000000006DD8000-memory.dmpFilesize
6.1MB
-
memory/4564-1099-0x0000000006E10000-0x0000000006F1A000-memory.dmpFilesize
1.0MB
-
memory/4564-1100-0x0000000006F50000-0x0000000006F62000-memory.dmpFilesize
72KB
-
memory/4564-1101-0x0000000006F70000-0x0000000006FAC000-memory.dmpFilesize
240KB
-
memory/4564-1102-0x0000000006200000-0x0000000006210000-memory.dmpFilesize
64KB
-
memory/4564-1103-0x0000000007260000-0x00000000072F2000-memory.dmpFilesize
584KB
-
memory/4564-1104-0x0000000007300000-0x0000000007366000-memory.dmpFilesize
408KB
-
memory/4564-1106-0x0000000007A30000-0x0000000007BF2000-memory.dmpFilesize
1.8MB
-
memory/4564-1107-0x0000000007C00000-0x000000000812C000-memory.dmpFilesize
5.2MB
-
memory/4564-1108-0x0000000006200000-0x0000000006210000-memory.dmpFilesize
64KB
-
memory/4564-1110-0x0000000006200000-0x0000000006210000-memory.dmpFilesize
64KB
-
memory/4564-1109-0x0000000006200000-0x0000000006210000-memory.dmpFilesize
64KB
-
memory/4564-1111-0x0000000006200000-0x0000000006210000-memory.dmpFilesize
64KB
-
memory/4564-1112-0x0000000008350000-0x00000000083C6000-memory.dmpFilesize
472KB
-
memory/4564-1113-0x00000000083E0000-0x0000000008430000-memory.dmpFilesize
320KB
-
memory/5012-1119-0x0000000000D40000-0x0000000000D72000-memory.dmpFilesize
200KB
-
memory/5012-1120-0x00000000059B0000-0x00000000059C0000-memory.dmpFilesize
64KB