Analysis
-
max time kernel
66s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 04:32
Static task
static1
Behavioral task
behavioral1
Sample
1cc062ff1b88537f43de25543764f6341ab1461d8721ec95beda61471d4a8ff6.exe
Resource
win10v2004-20230220-en
General
-
Target
1cc062ff1b88537f43de25543764f6341ab1461d8721ec95beda61471d4a8ff6.exe
-
Size
689KB
-
MD5
b702735735ddd2a1c1aefab37e5acb0f
-
SHA1
f171c321d4ac6fa1192d2cd5248622da6549b694
-
SHA256
1cc062ff1b88537f43de25543764f6341ab1461d8721ec95beda61471d4a8ff6
-
SHA512
59865424df8092b5baeb5ad78adf2cfae7e5e455fb91486ff3d2135491709b97df56b1fe3c6717bf340d57d0896102f3213f4c67a5c94de8b873502f794199a6
-
SSDEEP
12288:6MrOy90Gp3lWXWgyr65hLuCzZ9o+DT4Tcd2/tiZYB9nJmJuvCFI9figu9cxkpg5U:oy9t2faCzs+DTy/pJmJuuI9agkcf2/D
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Processes:
pro4463.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro4463.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro4463.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro4463.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro4463.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro4463.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro4463.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/4932-191-0x0000000003B90000-0x0000000003BCF000-memory.dmp family_redline behavioral1/memory/4932-192-0x0000000003B90000-0x0000000003BCF000-memory.dmp family_redline behavioral1/memory/4932-194-0x0000000003B90000-0x0000000003BCF000-memory.dmp family_redline behavioral1/memory/4932-196-0x0000000003B90000-0x0000000003BCF000-memory.dmp family_redline behavioral1/memory/4932-198-0x0000000003B90000-0x0000000003BCF000-memory.dmp family_redline behavioral1/memory/4932-200-0x0000000003B90000-0x0000000003BCF000-memory.dmp family_redline behavioral1/memory/4932-202-0x0000000003B90000-0x0000000003BCF000-memory.dmp family_redline behavioral1/memory/4932-206-0x0000000003B90000-0x0000000003BCF000-memory.dmp family_redline behavioral1/memory/4932-209-0x0000000003B90000-0x0000000003BCF000-memory.dmp family_redline behavioral1/memory/4932-211-0x0000000003B90000-0x0000000003BCF000-memory.dmp family_redline behavioral1/memory/4932-213-0x0000000003B90000-0x0000000003BCF000-memory.dmp family_redline behavioral1/memory/4932-215-0x0000000003B90000-0x0000000003BCF000-memory.dmp family_redline behavioral1/memory/4932-217-0x0000000003B90000-0x0000000003BCF000-memory.dmp family_redline behavioral1/memory/4932-221-0x0000000003B90000-0x0000000003BCF000-memory.dmp family_redline behavioral1/memory/4932-219-0x0000000003B90000-0x0000000003BCF000-memory.dmp family_redline behavioral1/memory/4932-223-0x0000000003B90000-0x0000000003BCF000-memory.dmp family_redline behavioral1/memory/4932-225-0x0000000003B90000-0x0000000003BCF000-memory.dmp family_redline behavioral1/memory/4932-227-0x0000000003B90000-0x0000000003BCF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un757889.exepro4463.exequ5691.exesi937158.exepid process 4756 un757889.exe 2812 pro4463.exe 4932 qu5691.exe 648 si937158.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro4463.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro4463.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro4463.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un757889.exe1cc062ff1b88537f43de25543764f6341ab1461d8721ec95beda61471d4a8ff6.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un757889.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un757889.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 1cc062ff1b88537f43de25543764f6341ab1461d8721ec95beda61471d4a8ff6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1cc062ff1b88537f43de25543764f6341ab1461d8721ec95beda61471d4a8ff6.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3156 2812 WerFault.exe pro4463.exe 4140 4932 WerFault.exe qu5691.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro4463.exequ5691.exesi937158.exepid process 2812 pro4463.exe 2812 pro4463.exe 4932 qu5691.exe 4932 qu5691.exe 648 si937158.exe 648 si937158.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro4463.exequ5691.exesi937158.exedescription pid process Token: SeDebugPrivilege 2812 pro4463.exe Token: SeDebugPrivilege 4932 qu5691.exe Token: SeDebugPrivilege 648 si937158.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
1cc062ff1b88537f43de25543764f6341ab1461d8721ec95beda61471d4a8ff6.exeun757889.exedescription pid process target process PID 3252 wrote to memory of 4756 3252 1cc062ff1b88537f43de25543764f6341ab1461d8721ec95beda61471d4a8ff6.exe un757889.exe PID 3252 wrote to memory of 4756 3252 1cc062ff1b88537f43de25543764f6341ab1461d8721ec95beda61471d4a8ff6.exe un757889.exe PID 3252 wrote to memory of 4756 3252 1cc062ff1b88537f43de25543764f6341ab1461d8721ec95beda61471d4a8ff6.exe un757889.exe PID 4756 wrote to memory of 2812 4756 un757889.exe pro4463.exe PID 4756 wrote to memory of 2812 4756 un757889.exe pro4463.exe PID 4756 wrote to memory of 2812 4756 un757889.exe pro4463.exe PID 4756 wrote to memory of 4932 4756 un757889.exe qu5691.exe PID 4756 wrote to memory of 4932 4756 un757889.exe qu5691.exe PID 4756 wrote to memory of 4932 4756 un757889.exe qu5691.exe PID 3252 wrote to memory of 648 3252 1cc062ff1b88537f43de25543764f6341ab1461d8721ec95beda61471d4a8ff6.exe si937158.exe PID 3252 wrote to memory of 648 3252 1cc062ff1b88537f43de25543764f6341ab1461d8721ec95beda61471d4a8ff6.exe si937158.exe PID 3252 wrote to memory of 648 3252 1cc062ff1b88537f43de25543764f6341ab1461d8721ec95beda61471d4a8ff6.exe si937158.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1cc062ff1b88537f43de25543764f6341ab1461d8721ec95beda61471d4a8ff6.exe"C:\Users\Admin\AppData\Local\Temp\1cc062ff1b88537f43de25543764f6341ab1461d8721ec95beda61471d4a8ff6.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un757889.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un757889.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4463.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4463.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 10804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5691.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5691.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 13244⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si937158.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si937158.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2812 -ip 28121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4932 -ip 49321⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si937158.exeFilesize
175KB
MD53a9162caff551b1bfb3fe1021f63a241
SHA11f43bb244e9400dee1c2f52951d8168ebf0de19b
SHA25694b5b3685416b509ce4802455afa0c342c92d6d3584c6ed9324f3de1cd14e05a
SHA512feb03c9db12ee4432f3d8c2f70babe251d688139cba13ca9311140b3111968dea49a17d468b5b4353b1754b741ffffc4b7ecceb2152d744c0d7ca89e9c885ea1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si937158.exeFilesize
175KB
MD53a9162caff551b1bfb3fe1021f63a241
SHA11f43bb244e9400dee1c2f52951d8168ebf0de19b
SHA25694b5b3685416b509ce4802455afa0c342c92d6d3584c6ed9324f3de1cd14e05a
SHA512feb03c9db12ee4432f3d8c2f70babe251d688139cba13ca9311140b3111968dea49a17d468b5b4353b1754b741ffffc4b7ecceb2152d744c0d7ca89e9c885ea1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un757889.exeFilesize
547KB
MD565772db2ac8357423542d007790cc92b
SHA1ee241e75cf082e60fba35de07943dee1625e662c
SHA2568eb0e5f809184a375c7347f07d6658d1d76d366083dac293d61ff88aad5798e7
SHA512946d0bfc18b2cff4467808ced0199ae705c5bc297073a942334da7ad304e9b35403da2f189e7d787ea6874835b14864ad8715aa7d191a613fbbdaeab01aa5cbc
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un757889.exeFilesize
547KB
MD565772db2ac8357423542d007790cc92b
SHA1ee241e75cf082e60fba35de07943dee1625e662c
SHA2568eb0e5f809184a375c7347f07d6658d1d76d366083dac293d61ff88aad5798e7
SHA512946d0bfc18b2cff4467808ced0199ae705c5bc297073a942334da7ad304e9b35403da2f189e7d787ea6874835b14864ad8715aa7d191a613fbbdaeab01aa5cbc
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4463.exeFilesize
291KB
MD5724f066e09715463fa9faca6d9dcc550
SHA146781ef36f0493412aba0b1ecf30068335561cf9
SHA256d44573c7916e668deef0add2e073051faa8fed27f4ac0be1fe28e9aa25cc1827
SHA512f07b587b9f6b98ca67cfeda3cc6f0a8f6c38d8067993aebba19cb115541c836654598f8afa998e941d020ba1af9312fc5445e5ccd7173de334ebe6d11471ee64
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4463.exeFilesize
291KB
MD5724f066e09715463fa9faca6d9dcc550
SHA146781ef36f0493412aba0b1ecf30068335561cf9
SHA256d44573c7916e668deef0add2e073051faa8fed27f4ac0be1fe28e9aa25cc1827
SHA512f07b587b9f6b98ca67cfeda3cc6f0a8f6c38d8067993aebba19cb115541c836654598f8afa998e941d020ba1af9312fc5445e5ccd7173de334ebe6d11471ee64
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5691.exeFilesize
345KB
MD5987e0c64412ca96cc2f673d6f4342154
SHA1918f9ca8cda002817137a4d237bd124c7067eb19
SHA2565aa0a24990e4da43b7b992177a5ff6f020ae8a5301554d1595c6ba41a2d8a4d8
SHA51252e1e0c0ae36b58abf1991fa64c8ba215342d146abfe60232801b84d92d88caad88b8d792688aa48645fd682fd725f650ed9fbc3d1f37e8dfe8daf1bb74458e9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5691.exeFilesize
345KB
MD5987e0c64412ca96cc2f673d6f4342154
SHA1918f9ca8cda002817137a4d237bd124c7067eb19
SHA2565aa0a24990e4da43b7b992177a5ff6f020ae8a5301554d1595c6ba41a2d8a4d8
SHA51252e1e0c0ae36b58abf1991fa64c8ba215342d146abfe60232801b84d92d88caad88b8d792688aa48645fd682fd725f650ed9fbc3d1f37e8dfe8daf1bb74458e9
-
memory/648-1122-0x0000000004F10000-0x0000000004F20000-memory.dmpFilesize
64KB
-
memory/648-1121-0x0000000000370000-0x00000000003A2000-memory.dmpFilesize
200KB
-
memory/2812-157-0x0000000002350000-0x0000000002360000-memory.dmpFilesize
64KB
-
memory/2812-170-0x0000000005240000-0x0000000005252000-memory.dmpFilesize
72KB
-
memory/2812-151-0x0000000005240000-0x0000000005252000-memory.dmpFilesize
72KB
-
memory/2812-152-0x0000000005240000-0x0000000005252000-memory.dmpFilesize
72KB
-
memory/2812-154-0x0000000005240000-0x0000000005252000-memory.dmpFilesize
72KB
-
memory/2812-156-0x0000000002350000-0x0000000002360000-memory.dmpFilesize
64KB
-
memory/2812-149-0x0000000002350000-0x0000000002360000-memory.dmpFilesize
64KB
-
memory/2812-158-0x0000000005240000-0x0000000005252000-memory.dmpFilesize
72KB
-
memory/2812-160-0x0000000005240000-0x0000000005252000-memory.dmpFilesize
72KB
-
memory/2812-162-0x0000000005240000-0x0000000005252000-memory.dmpFilesize
72KB
-
memory/2812-164-0x0000000005240000-0x0000000005252000-memory.dmpFilesize
72KB
-
memory/2812-168-0x0000000005240000-0x0000000005252000-memory.dmpFilesize
72KB
-
memory/2812-166-0x0000000005240000-0x0000000005252000-memory.dmpFilesize
72KB
-
memory/2812-150-0x0000000004C50000-0x00000000051F4000-memory.dmpFilesize
5.6MB
-
memory/2812-172-0x0000000005240000-0x0000000005252000-memory.dmpFilesize
72KB
-
memory/2812-174-0x0000000005240000-0x0000000005252000-memory.dmpFilesize
72KB
-
memory/2812-176-0x0000000005240000-0x0000000005252000-memory.dmpFilesize
72KB
-
memory/2812-178-0x0000000005240000-0x0000000005252000-memory.dmpFilesize
72KB
-
memory/2812-180-0x0000000005240000-0x0000000005252000-memory.dmpFilesize
72KB
-
memory/2812-181-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/2812-182-0x0000000002350000-0x0000000002360000-memory.dmpFilesize
64KB
-
memory/2812-183-0x0000000002350000-0x0000000002360000-memory.dmpFilesize
64KB
-
memory/2812-184-0x0000000002350000-0x0000000002360000-memory.dmpFilesize
64KB
-
memory/2812-186-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/2812-148-0x00000000007E0000-0x000000000080D000-memory.dmpFilesize
180KB
-
memory/4932-191-0x0000000003B90000-0x0000000003BCF000-memory.dmpFilesize
252KB
-
memory/4932-223-0x0000000003B90000-0x0000000003BCF000-memory.dmpFilesize
252KB
-
memory/4932-196-0x0000000003B90000-0x0000000003BCF000-memory.dmpFilesize
252KB
-
memory/4932-198-0x0000000003B90000-0x0000000003BCF000-memory.dmpFilesize
252KB
-
memory/4932-200-0x0000000003B90000-0x0000000003BCF000-memory.dmpFilesize
252KB
-
memory/4932-202-0x0000000003B90000-0x0000000003BCF000-memory.dmpFilesize
252KB
-
memory/4932-204-0x0000000001B20000-0x0000000001B6B000-memory.dmpFilesize
300KB
-
memory/4932-206-0x0000000003B90000-0x0000000003BCF000-memory.dmpFilesize
252KB
-
memory/4932-205-0x0000000006270000-0x0000000006280000-memory.dmpFilesize
64KB
-
memory/4932-208-0x0000000006270000-0x0000000006280000-memory.dmpFilesize
64KB
-
memory/4932-209-0x0000000003B90000-0x0000000003BCF000-memory.dmpFilesize
252KB
-
memory/4932-211-0x0000000003B90000-0x0000000003BCF000-memory.dmpFilesize
252KB
-
memory/4932-213-0x0000000003B90000-0x0000000003BCF000-memory.dmpFilesize
252KB
-
memory/4932-215-0x0000000003B90000-0x0000000003BCF000-memory.dmpFilesize
252KB
-
memory/4932-217-0x0000000003B90000-0x0000000003BCF000-memory.dmpFilesize
252KB
-
memory/4932-221-0x0000000003B90000-0x0000000003BCF000-memory.dmpFilesize
252KB
-
memory/4932-219-0x0000000003B90000-0x0000000003BCF000-memory.dmpFilesize
252KB
-
memory/4932-194-0x0000000003B90000-0x0000000003BCF000-memory.dmpFilesize
252KB
-
memory/4932-225-0x0000000003B90000-0x0000000003BCF000-memory.dmpFilesize
252KB
-
memory/4932-227-0x0000000003B90000-0x0000000003BCF000-memory.dmpFilesize
252KB
-
memory/4932-1100-0x0000000006830000-0x0000000006E48000-memory.dmpFilesize
6.1MB
-
memory/4932-1101-0x0000000006E50000-0x0000000006F5A000-memory.dmpFilesize
1.0MB
-
memory/4932-1102-0x0000000006F60000-0x0000000006F72000-memory.dmpFilesize
72KB
-
memory/4932-1103-0x0000000006F80000-0x0000000006FBC000-memory.dmpFilesize
240KB
-
memory/4932-1104-0x0000000006270000-0x0000000006280000-memory.dmpFilesize
64KB
-
memory/4932-1106-0x0000000006270000-0x0000000006280000-memory.dmpFilesize
64KB
-
memory/4932-1107-0x0000000006270000-0x0000000006280000-memory.dmpFilesize
64KB
-
memory/4932-1108-0x0000000006270000-0x0000000006280000-memory.dmpFilesize
64KB
-
memory/4932-1109-0x0000000007260000-0x00000000072C6000-memory.dmpFilesize
408KB
-
memory/4932-1110-0x0000000007920000-0x00000000079B2000-memory.dmpFilesize
584KB
-
memory/4932-1111-0x0000000006270000-0x0000000006280000-memory.dmpFilesize
64KB
-
memory/4932-1112-0x0000000003880000-0x00000000038F6000-memory.dmpFilesize
472KB
-
memory/4932-192-0x0000000003B90000-0x0000000003BCF000-memory.dmpFilesize
252KB
-
memory/4932-1113-0x0000000007C60000-0x0000000007CB0000-memory.dmpFilesize
320KB
-
memory/4932-1114-0x0000000007CE0000-0x0000000007EA2000-memory.dmpFilesize
1.8MB
-
memory/4932-1115-0x0000000007EB0000-0x00000000083DC000-memory.dmpFilesize
5.2MB