Analysis
-
max time kernel
55s -
max time network
146s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
28-03-2023 04:37
Static task
static1
Behavioral task
behavioral1
Sample
6cf9393f3d19a02ed5864db9541f674f5c2d158573034d176e4a2a5129848b66.exe
Resource
win10-20230220-en
General
-
Target
6cf9393f3d19a02ed5864db9541f674f5c2d158573034d176e4a2a5129848b66.exe
-
Size
688KB
-
MD5
c8c0e97815118f2b53cc9bcd7f3bbbd1
-
SHA1
14203f3899a710610c1112484e64cb8fcfb94e53
-
SHA256
6cf9393f3d19a02ed5864db9541f674f5c2d158573034d176e4a2a5129848b66
-
SHA512
e2ffda35f90d2575cb7104ea82168bdcbe5698b028ef0439dc08a3596531153e71337b73d4e4d65c4eac0b0b7e5647859230525dac127e68c695db40df82455f
-
SSDEEP
12288:9MrUy90VptLAw+VVYyx65hLu4StKTsceLURbdmJmvxFwjfigPiI3z8jSt:xyS1+7Zcfa4dZ8U3mJmDwjagqI3z2M
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Processes:
pro2545.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro2545.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro2545.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro2545.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro2545.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro2545.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/3880-179-0x0000000003580000-0x00000000035C6000-memory.dmp family_redline behavioral1/memory/3880-180-0x0000000003A60000-0x0000000003AA4000-memory.dmp family_redline behavioral1/memory/3880-182-0x0000000003A60000-0x0000000003A9F000-memory.dmp family_redline behavioral1/memory/3880-181-0x0000000003A60000-0x0000000003A9F000-memory.dmp family_redline behavioral1/memory/3880-184-0x0000000003A60000-0x0000000003A9F000-memory.dmp family_redline behavioral1/memory/3880-186-0x0000000003A60000-0x0000000003A9F000-memory.dmp family_redline behavioral1/memory/3880-188-0x0000000003A60000-0x0000000003A9F000-memory.dmp family_redline behavioral1/memory/3880-190-0x0000000003A60000-0x0000000003A9F000-memory.dmp family_redline behavioral1/memory/3880-192-0x0000000003A60000-0x0000000003A9F000-memory.dmp family_redline behavioral1/memory/3880-194-0x0000000003A60000-0x0000000003A9F000-memory.dmp family_redline behavioral1/memory/3880-196-0x0000000003A60000-0x0000000003A9F000-memory.dmp family_redline behavioral1/memory/3880-198-0x0000000003A60000-0x0000000003A9F000-memory.dmp family_redline behavioral1/memory/3880-200-0x0000000003A60000-0x0000000003A9F000-memory.dmp family_redline behavioral1/memory/3880-202-0x0000000003A60000-0x0000000003A9F000-memory.dmp family_redline behavioral1/memory/3880-204-0x0000000003A60000-0x0000000003A9F000-memory.dmp family_redline behavioral1/memory/3880-206-0x0000000003A60000-0x0000000003A9F000-memory.dmp family_redline behavioral1/memory/3880-208-0x0000000003A60000-0x0000000003A9F000-memory.dmp family_redline behavioral1/memory/3880-210-0x0000000003A60000-0x0000000003A9F000-memory.dmp family_redline behavioral1/memory/3880-212-0x0000000003A60000-0x0000000003A9F000-memory.dmp family_redline behavioral1/memory/3880-214-0x0000000003A60000-0x0000000003A9F000-memory.dmp family_redline behavioral1/memory/3880-320-0x0000000006050000-0x0000000006060000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un818357.exepro2545.exequ8505.exesi780302.exepid process 4108 un818357.exe 4124 pro2545.exe 3880 qu8505.exe 4144 si780302.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro2545.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro2545.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro2545.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
6cf9393f3d19a02ed5864db9541f674f5c2d158573034d176e4a2a5129848b66.exeun818357.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 6cf9393f3d19a02ed5864db9541f674f5c2d158573034d176e4a2a5129848b66.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 6cf9393f3d19a02ed5864db9541f674f5c2d158573034d176e4a2a5129848b66.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un818357.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un818357.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro2545.exequ8505.exesi780302.exepid process 4124 pro2545.exe 4124 pro2545.exe 3880 qu8505.exe 3880 qu8505.exe 4144 si780302.exe 4144 si780302.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro2545.exequ8505.exesi780302.exedescription pid process Token: SeDebugPrivilege 4124 pro2545.exe Token: SeDebugPrivilege 3880 qu8505.exe Token: SeDebugPrivilege 4144 si780302.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
6cf9393f3d19a02ed5864db9541f674f5c2d158573034d176e4a2a5129848b66.exeun818357.exedescription pid process target process PID 5096 wrote to memory of 4108 5096 6cf9393f3d19a02ed5864db9541f674f5c2d158573034d176e4a2a5129848b66.exe un818357.exe PID 5096 wrote to memory of 4108 5096 6cf9393f3d19a02ed5864db9541f674f5c2d158573034d176e4a2a5129848b66.exe un818357.exe PID 5096 wrote to memory of 4108 5096 6cf9393f3d19a02ed5864db9541f674f5c2d158573034d176e4a2a5129848b66.exe un818357.exe PID 4108 wrote to memory of 4124 4108 un818357.exe pro2545.exe PID 4108 wrote to memory of 4124 4108 un818357.exe pro2545.exe PID 4108 wrote to memory of 4124 4108 un818357.exe pro2545.exe PID 4108 wrote to memory of 3880 4108 un818357.exe qu8505.exe PID 4108 wrote to memory of 3880 4108 un818357.exe qu8505.exe PID 4108 wrote to memory of 3880 4108 un818357.exe qu8505.exe PID 5096 wrote to memory of 4144 5096 6cf9393f3d19a02ed5864db9541f674f5c2d158573034d176e4a2a5129848b66.exe si780302.exe PID 5096 wrote to memory of 4144 5096 6cf9393f3d19a02ed5864db9541f674f5c2d158573034d176e4a2a5129848b66.exe si780302.exe PID 5096 wrote to memory of 4144 5096 6cf9393f3d19a02ed5864db9541f674f5c2d158573034d176e4a2a5129848b66.exe si780302.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6cf9393f3d19a02ed5864db9541f674f5c2d158573034d176e4a2a5129848b66.exe"C:\Users\Admin\AppData\Local\Temp\6cf9393f3d19a02ed5864db9541f674f5c2d158573034d176e4a2a5129848b66.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un818357.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un818357.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2545.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2545.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8505.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8505.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si780302.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si780302.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si780302.exeFilesize
175KB
MD5506589c39e807d4d91662261bc1c1414
SHA155a6952452fddac70af71ef478a4ba3cd4ad37fe
SHA256ddd2970bcb98a9a11760502ea52b37c96c0c9487554f9ea947f20b8112b8e5ea
SHA5124575acac56afaeeb2c34cb239d930db62e8f708e3e69016a88af7b310b4d17260338ba5363b812c2af456f8154b9dc28bf772ef3ce68500410e679c069c9d368
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si780302.exeFilesize
175KB
MD5506589c39e807d4d91662261bc1c1414
SHA155a6952452fddac70af71ef478a4ba3cd4ad37fe
SHA256ddd2970bcb98a9a11760502ea52b37c96c0c9487554f9ea947f20b8112b8e5ea
SHA5124575acac56afaeeb2c34cb239d930db62e8f708e3e69016a88af7b310b4d17260338ba5363b812c2af456f8154b9dc28bf772ef3ce68500410e679c069c9d368
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un818357.exeFilesize
547KB
MD5f03a51fbc7f7cdbfc90629f5372b7b80
SHA1e71a4c9a7f60ecfa33e5365e30ac52666413fcdd
SHA256951a2629123f3e91f3251875d47aa8af1c8ecdd05812438cf99ccf9f65879db8
SHA5127378e5a4d248bc98bb7c17f99c9f477ba76096a3ec6355c97a4457b2b6db484de9e24f054fa784a81624872fcaddf71121bf24bb9dd733ae07856292e05ba62c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un818357.exeFilesize
547KB
MD5f03a51fbc7f7cdbfc90629f5372b7b80
SHA1e71a4c9a7f60ecfa33e5365e30ac52666413fcdd
SHA256951a2629123f3e91f3251875d47aa8af1c8ecdd05812438cf99ccf9f65879db8
SHA5127378e5a4d248bc98bb7c17f99c9f477ba76096a3ec6355c97a4457b2b6db484de9e24f054fa784a81624872fcaddf71121bf24bb9dd733ae07856292e05ba62c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2545.exeFilesize
291KB
MD55fcd7f9e34dc1ebe3c26b148c2dbaaac
SHA184758667203fa62fbb6527db702535066011c174
SHA256ca972159aa1d5e056f8cb6c9952f7bddce8a8bcf85c2273888e537b8fbd4b091
SHA512fbb063ef3d6739c1f679c83469945b1bf1718244b49b469f99b790efb2cbac40de52c38531d3df70ad6e3d454b94e42790f396ea36d9bd91025987cb5cd27f79
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2545.exeFilesize
291KB
MD55fcd7f9e34dc1ebe3c26b148c2dbaaac
SHA184758667203fa62fbb6527db702535066011c174
SHA256ca972159aa1d5e056f8cb6c9952f7bddce8a8bcf85c2273888e537b8fbd4b091
SHA512fbb063ef3d6739c1f679c83469945b1bf1718244b49b469f99b790efb2cbac40de52c38531d3df70ad6e3d454b94e42790f396ea36d9bd91025987cb5cd27f79
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8505.exeFilesize
345KB
MD58977b875531199e9e6fb11ec08eee27d
SHA1c965864418b2319971268568e7961d15be830295
SHA256c3c258dea0440b3155a59ce8ab6419057ea67037f7e3df544cd02732cf2a1589
SHA512d9debf4e4dc82c615527241f67d4028031da4b673173b01f1e8ca07a87ddf93371c7862b2305d247c008c2243b2502960037ffd2cd9009624391b6099a1eebe5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8505.exeFilesize
345KB
MD58977b875531199e9e6fb11ec08eee27d
SHA1c965864418b2319971268568e7961d15be830295
SHA256c3c258dea0440b3155a59ce8ab6419057ea67037f7e3df544cd02732cf2a1589
SHA512d9debf4e4dc82c615527241f67d4028031da4b673173b01f1e8ca07a87ddf93371c7862b2305d247c008c2243b2502960037ffd2cd9009624391b6099a1eebe5
-
memory/3880-1091-0x0000000006CB0000-0x00000000072B6000-memory.dmpFilesize
6.0MB
-
memory/3880-1092-0x0000000006700000-0x000000000680A000-memory.dmpFilesize
1.0MB
-
memory/3880-1107-0x00000000090B0000-0x00000000095DC000-memory.dmpFilesize
5.2MB
-
memory/3880-194-0x0000000003A60000-0x0000000003A9F000-memory.dmpFilesize
252KB
-
memory/3880-1106-0x0000000008EE0000-0x00000000090A2000-memory.dmpFilesize
1.8MB
-
memory/3880-196-0x0000000003A60000-0x0000000003A9F000-memory.dmpFilesize
252KB
-
memory/3880-1105-0x0000000008E80000-0x0000000008ED0000-memory.dmpFilesize
320KB
-
memory/3880-1104-0x0000000008E00000-0x0000000008E76000-memory.dmpFilesize
472KB
-
memory/3880-1103-0x0000000006050000-0x0000000006060000-memory.dmpFilesize
64KB
-
memory/3880-1102-0x0000000006050000-0x0000000006060000-memory.dmpFilesize
64KB
-
memory/3880-1101-0x0000000006050000-0x0000000006060000-memory.dmpFilesize
64KB
-
memory/3880-1100-0x0000000006050000-0x0000000006060000-memory.dmpFilesize
64KB
-
memory/3880-1098-0x0000000007810000-0x00000000078A2000-memory.dmpFilesize
584KB
-
memory/3880-1097-0x0000000006B40000-0x0000000006BA6000-memory.dmpFilesize
408KB
-
memory/3880-1096-0x00000000069B0000-0x00000000069FB000-memory.dmpFilesize
300KB
-
memory/3880-1095-0x0000000006860000-0x000000000689E000-memory.dmpFilesize
248KB
-
memory/3880-1094-0x0000000006050000-0x0000000006060000-memory.dmpFilesize
64KB
-
memory/3880-1093-0x0000000006840000-0x0000000006852000-memory.dmpFilesize
72KB
-
memory/3880-198-0x0000000003A60000-0x0000000003A9F000-memory.dmpFilesize
252KB
-
memory/3880-206-0x0000000003A60000-0x0000000003A9F000-memory.dmpFilesize
252KB
-
memory/3880-322-0x0000000006050000-0x0000000006060000-memory.dmpFilesize
64KB
-
memory/3880-320-0x0000000006050000-0x0000000006060000-memory.dmpFilesize
64KB
-
memory/3880-317-0x0000000001B00000-0x0000000001B4B000-memory.dmpFilesize
300KB
-
memory/3880-319-0x0000000006050000-0x0000000006060000-memory.dmpFilesize
64KB
-
memory/3880-214-0x0000000003A60000-0x0000000003A9F000-memory.dmpFilesize
252KB
-
memory/3880-179-0x0000000003580000-0x00000000035C6000-memory.dmpFilesize
280KB
-
memory/3880-180-0x0000000003A60000-0x0000000003AA4000-memory.dmpFilesize
272KB
-
memory/3880-182-0x0000000003A60000-0x0000000003A9F000-memory.dmpFilesize
252KB
-
memory/3880-181-0x0000000003A60000-0x0000000003A9F000-memory.dmpFilesize
252KB
-
memory/3880-184-0x0000000003A60000-0x0000000003A9F000-memory.dmpFilesize
252KB
-
memory/3880-186-0x0000000003A60000-0x0000000003A9F000-memory.dmpFilesize
252KB
-
memory/3880-188-0x0000000003A60000-0x0000000003A9F000-memory.dmpFilesize
252KB
-
memory/3880-190-0x0000000003A60000-0x0000000003A9F000-memory.dmpFilesize
252KB
-
memory/3880-192-0x0000000003A60000-0x0000000003A9F000-memory.dmpFilesize
252KB
-
memory/3880-212-0x0000000003A60000-0x0000000003A9F000-memory.dmpFilesize
252KB
-
memory/3880-210-0x0000000003A60000-0x0000000003A9F000-memory.dmpFilesize
252KB
-
memory/3880-208-0x0000000003A60000-0x0000000003A9F000-memory.dmpFilesize
252KB
-
memory/3880-200-0x0000000003A60000-0x0000000003A9F000-memory.dmpFilesize
252KB
-
memory/3880-202-0x0000000003A60000-0x0000000003A9F000-memory.dmpFilesize
252KB
-
memory/3880-204-0x0000000003A60000-0x0000000003A9F000-memory.dmpFilesize
252KB
-
memory/4124-169-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/4124-139-0x0000000002640000-0x0000000002650000-memory.dmpFilesize
64KB
-
memory/4124-144-0x0000000005140000-0x0000000005152000-memory.dmpFilesize
72KB
-
memory/4124-141-0x0000000005140000-0x0000000005152000-memory.dmpFilesize
72KB
-
memory/4124-137-0x00000000001D0000-0x00000000001FD000-memory.dmpFilesize
180KB
-
memory/4124-138-0x0000000002640000-0x0000000002650000-memory.dmpFilesize
64KB
-
memory/4124-174-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/4124-173-0x0000000002640000-0x0000000002650000-memory.dmpFilesize
64KB
-
memory/4124-172-0x0000000002640000-0x0000000002650000-memory.dmpFilesize
64KB
-
memory/4124-136-0x0000000005140000-0x0000000005158000-memory.dmpFilesize
96KB
-
memory/4124-170-0x0000000002640000-0x0000000002650000-memory.dmpFilesize
64KB
-
memory/4124-168-0x0000000005140000-0x0000000005152000-memory.dmpFilesize
72KB
-
memory/4124-166-0x0000000005140000-0x0000000005152000-memory.dmpFilesize
72KB
-
memory/4124-164-0x0000000005140000-0x0000000005152000-memory.dmpFilesize
72KB
-
memory/4124-162-0x0000000005140000-0x0000000005152000-memory.dmpFilesize
72KB
-
memory/4124-160-0x0000000005140000-0x0000000005152000-memory.dmpFilesize
72KB
-
memory/4124-158-0x0000000005140000-0x0000000005152000-memory.dmpFilesize
72KB
-
memory/4124-156-0x0000000005140000-0x0000000005152000-memory.dmpFilesize
72KB
-
memory/4124-154-0x0000000005140000-0x0000000005152000-memory.dmpFilesize
72KB
-
memory/4124-152-0x0000000005140000-0x0000000005152000-memory.dmpFilesize
72KB
-
memory/4124-150-0x0000000005140000-0x0000000005152000-memory.dmpFilesize
72KB
-
memory/4124-148-0x0000000005140000-0x0000000005152000-memory.dmpFilesize
72KB
-
memory/4124-146-0x0000000005140000-0x0000000005152000-memory.dmpFilesize
72KB
-
memory/4124-142-0x0000000005140000-0x0000000005152000-memory.dmpFilesize
72KB
-
memory/4124-140-0x0000000002640000-0x0000000002650000-memory.dmpFilesize
64KB
-
memory/4124-135-0x0000000004C40000-0x000000000513E000-memory.dmpFilesize
5.0MB
-
memory/4124-134-0x0000000002590000-0x00000000025AA000-memory.dmpFilesize
104KB
-
memory/4144-1113-0x00000000003A0000-0x00000000003D2000-memory.dmpFilesize
200KB
-
memory/4144-1114-0x0000000004DE0000-0x0000000004E2B000-memory.dmpFilesize
300KB
-
memory/4144-1115-0x0000000004FC0000-0x0000000004FD0000-memory.dmpFilesize
64KB
-
memory/4144-1116-0x0000000004FC0000-0x0000000004FD0000-memory.dmpFilesize
64KB