Analysis
-
max time kernel
83s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 04:28
Static task
static1
Behavioral task
behavioral1
Sample
0910ace8bd777840f9b753dc22432f29c182bf77ee80388b407cc332ca0c053b.exe
Resource
win10v2004-20230220-en
General
-
Target
0910ace8bd777840f9b753dc22432f29c182bf77ee80388b407cc332ca0c053b.exe
-
Size
689KB
-
MD5
4f410274a7f415332071328f83f8a063
-
SHA1
f4e832cb5b3f7804f84d33585a5ba04374a41deb
-
SHA256
0910ace8bd777840f9b753dc22432f29c182bf77ee80388b407cc332ca0c053b
-
SHA512
9ca12695c1209d4e962c239fe534aa2d159808b24611cb941ae0b8dc69ff516382db709bac0b62180c228b5bf09abd6d7cea0c576f90ee5eb47f0d0d9660dbd3
-
SSDEEP
12288:IMrcy90AhIZUpWBkkiG1zyW65hLuyK3/uSBRwUw3fOcAJmJ6vNFyEfigDMAz/Ntg:Ey/eGkVw9fayKvuoRwUw2cQmJ6vyEag0
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Processes:
pro0883.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro0883.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro0883.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro0883.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro0883.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro0883.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro0883.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/4788-190-0x00000000065E0000-0x000000000661F000-memory.dmp family_redline behavioral1/memory/4788-191-0x00000000065E0000-0x000000000661F000-memory.dmp family_redline behavioral1/memory/4788-193-0x00000000065E0000-0x000000000661F000-memory.dmp family_redline behavioral1/memory/4788-195-0x00000000065E0000-0x000000000661F000-memory.dmp family_redline behavioral1/memory/4788-197-0x00000000065E0000-0x000000000661F000-memory.dmp family_redline behavioral1/memory/4788-199-0x00000000065E0000-0x000000000661F000-memory.dmp family_redline behavioral1/memory/4788-201-0x00000000065E0000-0x000000000661F000-memory.dmp family_redline behavioral1/memory/4788-205-0x00000000065E0000-0x000000000661F000-memory.dmp family_redline behavioral1/memory/4788-209-0x00000000065E0000-0x000000000661F000-memory.dmp family_redline behavioral1/memory/4788-211-0x00000000065E0000-0x000000000661F000-memory.dmp family_redline behavioral1/memory/4788-213-0x00000000065E0000-0x000000000661F000-memory.dmp family_redline behavioral1/memory/4788-215-0x00000000065E0000-0x000000000661F000-memory.dmp family_redline behavioral1/memory/4788-217-0x00000000065E0000-0x000000000661F000-memory.dmp family_redline behavioral1/memory/4788-219-0x00000000065E0000-0x000000000661F000-memory.dmp family_redline behavioral1/memory/4788-221-0x00000000065E0000-0x000000000661F000-memory.dmp family_redline behavioral1/memory/4788-223-0x00000000065E0000-0x000000000661F000-memory.dmp family_redline behavioral1/memory/4788-225-0x00000000065E0000-0x000000000661F000-memory.dmp family_redline behavioral1/memory/4788-227-0x00000000065E0000-0x000000000661F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un567252.exepro0883.exequ3608.exesi108919.exepid process 4540 un567252.exe 2604 pro0883.exe 4788 qu3608.exe 3364 si108919.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro0883.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro0883.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro0883.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un567252.exe0910ace8bd777840f9b753dc22432f29c182bf77ee80388b407cc332ca0c053b.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un567252.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un567252.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 0910ace8bd777840f9b753dc22432f29c182bf77ee80388b407cc332ca0c053b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 0910ace8bd777840f9b753dc22432f29c182bf77ee80388b407cc332ca0c053b.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4112 2604 WerFault.exe pro0883.exe 3840 4788 WerFault.exe qu3608.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro0883.exequ3608.exesi108919.exepid process 2604 pro0883.exe 2604 pro0883.exe 4788 qu3608.exe 4788 qu3608.exe 3364 si108919.exe 3364 si108919.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro0883.exequ3608.exesi108919.exedescription pid process Token: SeDebugPrivilege 2604 pro0883.exe Token: SeDebugPrivilege 4788 qu3608.exe Token: SeDebugPrivilege 3364 si108919.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
0910ace8bd777840f9b753dc22432f29c182bf77ee80388b407cc332ca0c053b.exeun567252.exedescription pid process target process PID 932 wrote to memory of 4540 932 0910ace8bd777840f9b753dc22432f29c182bf77ee80388b407cc332ca0c053b.exe un567252.exe PID 932 wrote to memory of 4540 932 0910ace8bd777840f9b753dc22432f29c182bf77ee80388b407cc332ca0c053b.exe un567252.exe PID 932 wrote to memory of 4540 932 0910ace8bd777840f9b753dc22432f29c182bf77ee80388b407cc332ca0c053b.exe un567252.exe PID 4540 wrote to memory of 2604 4540 un567252.exe pro0883.exe PID 4540 wrote to memory of 2604 4540 un567252.exe pro0883.exe PID 4540 wrote to memory of 2604 4540 un567252.exe pro0883.exe PID 4540 wrote to memory of 4788 4540 un567252.exe qu3608.exe PID 4540 wrote to memory of 4788 4540 un567252.exe qu3608.exe PID 4540 wrote to memory of 4788 4540 un567252.exe qu3608.exe PID 932 wrote to memory of 3364 932 0910ace8bd777840f9b753dc22432f29c182bf77ee80388b407cc332ca0c053b.exe si108919.exe PID 932 wrote to memory of 3364 932 0910ace8bd777840f9b753dc22432f29c182bf77ee80388b407cc332ca0c053b.exe si108919.exe PID 932 wrote to memory of 3364 932 0910ace8bd777840f9b753dc22432f29c182bf77ee80388b407cc332ca0c053b.exe si108919.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0910ace8bd777840f9b753dc22432f29c182bf77ee80388b407cc332ca0c053b.exe"C:\Users\Admin\AppData\Local\Temp\0910ace8bd777840f9b753dc22432f29c182bf77ee80388b407cc332ca0c053b.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un567252.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un567252.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0883.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0883.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 10044⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3608.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3608.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 13324⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si108919.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si108919.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2604 -ip 26041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4788 -ip 47881⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si108919.exeFilesize
175KB
MD503d60939e8f1ddc9c07a800169b09eab
SHA10672ab72e6b2ffcc0cfd9de4fb60e5b6a9fcdb9c
SHA25696fbe5ce52497d58113681e6f31ea85b79fd3ae731a2f525eaef2e664ae85702
SHA512383559b3d5bec388bb762352c6123d2abc656664df56966326b46f5b2ef5dc2d73ed04f0cf42aabae5ad29ce0c49139d40a44159433280b0d0d4092297133d7a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si108919.exeFilesize
175KB
MD503d60939e8f1ddc9c07a800169b09eab
SHA10672ab72e6b2ffcc0cfd9de4fb60e5b6a9fcdb9c
SHA25696fbe5ce52497d58113681e6f31ea85b79fd3ae731a2f525eaef2e664ae85702
SHA512383559b3d5bec388bb762352c6123d2abc656664df56966326b46f5b2ef5dc2d73ed04f0cf42aabae5ad29ce0c49139d40a44159433280b0d0d4092297133d7a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un567252.exeFilesize
547KB
MD5fd5f6b06c43988a8b1589c97d2c0a5e0
SHA12ae922276debaf85bf955710e98340549c8ecd51
SHA256f1190203ed5a0e13c69e2fe46d0377e483ea1513c177326fe191dab8a3386390
SHA512a1c854b69ee4a5e9397d5a804b704d074ae71f721224d444517092f914e06863d8c49f1f053b3c8193531b8bdc77edf6d5518e28b31cbecdc718d9ab6022ace8
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un567252.exeFilesize
547KB
MD5fd5f6b06c43988a8b1589c97d2c0a5e0
SHA12ae922276debaf85bf955710e98340549c8ecd51
SHA256f1190203ed5a0e13c69e2fe46d0377e483ea1513c177326fe191dab8a3386390
SHA512a1c854b69ee4a5e9397d5a804b704d074ae71f721224d444517092f914e06863d8c49f1f053b3c8193531b8bdc77edf6d5518e28b31cbecdc718d9ab6022ace8
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0883.exeFilesize
291KB
MD5ef9c322d21e0ca5a4b276bd74fed832d
SHA16b8bf4dfd28ac134c9ba506076d879bfc2a0cd9f
SHA25643e99006618334d0504a943b53a242230be780c99f83438e481c654841f88de6
SHA51291325ceb716c9d65eaea1b9336c0bb0c690a31edb46c6b43313bfdcc91dbbb0cec285c64687d0388899fb7ace6a2b925c194af396574e7defb25654a825526fc
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0883.exeFilesize
291KB
MD5ef9c322d21e0ca5a4b276bd74fed832d
SHA16b8bf4dfd28ac134c9ba506076d879bfc2a0cd9f
SHA25643e99006618334d0504a943b53a242230be780c99f83438e481c654841f88de6
SHA51291325ceb716c9d65eaea1b9336c0bb0c690a31edb46c6b43313bfdcc91dbbb0cec285c64687d0388899fb7ace6a2b925c194af396574e7defb25654a825526fc
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3608.exeFilesize
345KB
MD565d42d84ae79082872571e8cbb53a107
SHA1718eb5a0ec918c5460b646fa5f559339c9a7b435
SHA2568047376bae472a20b04255ed8be77842b3460bddf229654165cd31b4b78b0778
SHA512acf081eab49e222706db5276235ccfefdbbe6558200b2c3b85a76178d4012039e618b604c30791832052776c3dbeb328629a453ab9ac05e5d3df0ad439a6f4f1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3608.exeFilesize
345KB
MD565d42d84ae79082872571e8cbb53a107
SHA1718eb5a0ec918c5460b646fa5f559339c9a7b435
SHA2568047376bae472a20b04255ed8be77842b3460bddf229654165cd31b4b78b0778
SHA512acf081eab49e222706db5276235ccfefdbbe6558200b2c3b85a76178d4012039e618b604c30791832052776c3dbeb328629a453ab9ac05e5d3df0ad439a6f4f1
-
memory/2604-148-0x00000000007E0000-0x000000000080D000-memory.dmpFilesize
180KB
-
memory/2604-149-0x0000000004D60000-0x0000000005304000-memory.dmpFilesize
5.6MB
-
memory/2604-150-0x0000000002710000-0x0000000002722000-memory.dmpFilesize
72KB
-
memory/2604-151-0x0000000002710000-0x0000000002722000-memory.dmpFilesize
72KB
-
memory/2604-153-0x0000000002710000-0x0000000002722000-memory.dmpFilesize
72KB
-
memory/2604-155-0x0000000002710000-0x0000000002722000-memory.dmpFilesize
72KB
-
memory/2604-157-0x0000000002710000-0x0000000002722000-memory.dmpFilesize
72KB
-
memory/2604-159-0x0000000002710000-0x0000000002722000-memory.dmpFilesize
72KB
-
memory/2604-161-0x0000000002710000-0x0000000002722000-memory.dmpFilesize
72KB
-
memory/2604-163-0x0000000002710000-0x0000000002722000-memory.dmpFilesize
72KB
-
memory/2604-165-0x0000000002710000-0x0000000002722000-memory.dmpFilesize
72KB
-
memory/2604-167-0x0000000002710000-0x0000000002722000-memory.dmpFilesize
72KB
-
memory/2604-169-0x0000000002710000-0x0000000002722000-memory.dmpFilesize
72KB
-
memory/2604-171-0x0000000002710000-0x0000000002722000-memory.dmpFilesize
72KB
-
memory/2604-173-0x0000000002710000-0x0000000002722000-memory.dmpFilesize
72KB
-
memory/2604-175-0x0000000002710000-0x0000000002722000-memory.dmpFilesize
72KB
-
memory/2604-178-0x00000000023A0000-0x00000000023B0000-memory.dmpFilesize
64KB
-
memory/2604-179-0x00000000023A0000-0x00000000023B0000-memory.dmpFilesize
64KB
-
memory/2604-177-0x0000000002710000-0x0000000002722000-memory.dmpFilesize
72KB
-
memory/2604-180-0x00000000023A0000-0x00000000023B0000-memory.dmpFilesize
64KB
-
memory/2604-181-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/2604-183-0x00000000023A0000-0x00000000023B0000-memory.dmpFilesize
64KB
-
memory/2604-184-0x00000000023A0000-0x00000000023B0000-memory.dmpFilesize
64KB
-
memory/2604-185-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/3364-1121-0x00000000009A0000-0x00000000009D2000-memory.dmpFilesize
200KB
-
memory/3364-1122-0x00000000052B0000-0x00000000052C0000-memory.dmpFilesize
64KB
-
memory/4788-191-0x00000000065E0000-0x000000000661F000-memory.dmpFilesize
252KB
-
memory/4788-225-0x00000000065E0000-0x000000000661F000-memory.dmpFilesize
252KB
-
memory/4788-195-0x00000000065E0000-0x000000000661F000-memory.dmpFilesize
252KB
-
memory/4788-197-0x00000000065E0000-0x000000000661F000-memory.dmpFilesize
252KB
-
memory/4788-199-0x00000000065E0000-0x000000000661F000-memory.dmpFilesize
252KB
-
memory/4788-202-0x0000000001A30000-0x0000000001A7B000-memory.dmpFilesize
300KB
-
memory/4788-201-0x00000000065E0000-0x000000000661F000-memory.dmpFilesize
252KB
-
memory/4788-204-0x0000000003950000-0x0000000003960000-memory.dmpFilesize
64KB
-
memory/4788-206-0x0000000003950000-0x0000000003960000-memory.dmpFilesize
64KB
-
memory/4788-205-0x00000000065E0000-0x000000000661F000-memory.dmpFilesize
252KB
-
memory/4788-209-0x00000000065E0000-0x000000000661F000-memory.dmpFilesize
252KB
-
memory/4788-211-0x00000000065E0000-0x000000000661F000-memory.dmpFilesize
252KB
-
memory/4788-207-0x0000000003950000-0x0000000003960000-memory.dmpFilesize
64KB
-
memory/4788-213-0x00000000065E0000-0x000000000661F000-memory.dmpFilesize
252KB
-
memory/4788-215-0x00000000065E0000-0x000000000661F000-memory.dmpFilesize
252KB
-
memory/4788-217-0x00000000065E0000-0x000000000661F000-memory.dmpFilesize
252KB
-
memory/4788-219-0x00000000065E0000-0x000000000661F000-memory.dmpFilesize
252KB
-
memory/4788-221-0x00000000065E0000-0x000000000661F000-memory.dmpFilesize
252KB
-
memory/4788-223-0x00000000065E0000-0x000000000661F000-memory.dmpFilesize
252KB
-
memory/4788-193-0x00000000065E0000-0x000000000661F000-memory.dmpFilesize
252KB
-
memory/4788-227-0x00000000065E0000-0x000000000661F000-memory.dmpFilesize
252KB
-
memory/4788-1100-0x0000000006770000-0x0000000006D88000-memory.dmpFilesize
6.1MB
-
memory/4788-1101-0x0000000006E10000-0x0000000006F1A000-memory.dmpFilesize
1.0MB
-
memory/4788-1102-0x0000000006F50000-0x0000000006F62000-memory.dmpFilesize
72KB
-
memory/4788-1103-0x0000000006F70000-0x0000000006FAC000-memory.dmpFilesize
240KB
-
memory/4788-1104-0x0000000003950000-0x0000000003960000-memory.dmpFilesize
64KB
-
memory/4788-1106-0x0000000007260000-0x00000000072C6000-memory.dmpFilesize
408KB
-
memory/4788-1107-0x0000000003950000-0x0000000003960000-memory.dmpFilesize
64KB
-
memory/4788-1108-0x0000000003950000-0x0000000003960000-memory.dmpFilesize
64KB
-
memory/4788-1109-0x0000000003950000-0x0000000003960000-memory.dmpFilesize
64KB
-
memory/4788-1110-0x0000000007920000-0x00000000079B2000-memory.dmpFilesize
584KB
-
memory/4788-1111-0x0000000007C40000-0x0000000007CB6000-memory.dmpFilesize
472KB
-
memory/4788-1112-0x0000000007CD0000-0x0000000007D20000-memory.dmpFilesize
320KB
-
memory/4788-190-0x00000000065E0000-0x000000000661F000-memory.dmpFilesize
252KB
-
memory/4788-1113-0x0000000007D50000-0x0000000007F12000-memory.dmpFilesize
1.8MB
-
memory/4788-1114-0x0000000007F20000-0x000000000844C000-memory.dmpFilesize
5.2MB
-
memory/4788-1115-0x0000000003950000-0x0000000003960000-memory.dmpFilesize
64KB