Analysis
-
max time kernel
49s -
max time network
56s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
28-03-2023 03:54
Static task
static1
Behavioral task
behavioral1
Sample
5ff9bd850f2b89df9819b48f823a375ae2969c080fa7dc07102c29f2f2587c94.exe
Resource
win10-20230220-en
General
-
Target
5ff9bd850f2b89df9819b48f823a375ae2969c080fa7dc07102c29f2f2587c94.exe
-
Size
688KB
-
MD5
50b90aea52ee7ba4a6fdbbecaff0f9fb
-
SHA1
8e75e7be82dc60bd152baee3bb7e777b3eafb40e
-
SHA256
5ff9bd850f2b89df9819b48f823a375ae2969c080fa7dc07102c29f2f2587c94
-
SHA512
f0733cdecababec0bfd1673b3eb038638154cc8a683142cf69e35b089a7f209823a5132652e6b64e13d191201f8c811d26cd0e76940559a79616de285010e67f
-
SSDEEP
12288:JMrwy90QCJSZwojGaecvYoVyW65hLuXwqJQK3DuS9NJ6QhmJ6vSF+Sfigcp3/aQb:FyRlwoCAvc9faX7QKzuYNJnmJ6u+Sagg
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Processes:
pro9876.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro9876.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro9876.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro9876.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro9876.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro9876.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/1448-181-0x00000000037E0000-0x0000000003826000-memory.dmp family_redline behavioral1/memory/1448-182-0x00000000064F0000-0x0000000006534000-memory.dmp family_redline behavioral1/memory/1448-183-0x00000000064F0000-0x000000000652F000-memory.dmp family_redline behavioral1/memory/1448-184-0x00000000064F0000-0x000000000652F000-memory.dmp family_redline behavioral1/memory/1448-186-0x00000000064F0000-0x000000000652F000-memory.dmp family_redline behavioral1/memory/1448-188-0x00000000064F0000-0x000000000652F000-memory.dmp family_redline behavioral1/memory/1448-190-0x00000000064F0000-0x000000000652F000-memory.dmp family_redline behavioral1/memory/1448-192-0x00000000064F0000-0x000000000652F000-memory.dmp family_redline behavioral1/memory/1448-194-0x00000000064F0000-0x000000000652F000-memory.dmp family_redline behavioral1/memory/1448-196-0x00000000064F0000-0x000000000652F000-memory.dmp family_redline behavioral1/memory/1448-198-0x00000000064F0000-0x000000000652F000-memory.dmp family_redline behavioral1/memory/1448-200-0x00000000064F0000-0x000000000652F000-memory.dmp family_redline behavioral1/memory/1448-202-0x00000000064F0000-0x000000000652F000-memory.dmp family_redline behavioral1/memory/1448-204-0x00000000064F0000-0x000000000652F000-memory.dmp family_redline behavioral1/memory/1448-206-0x00000000064F0000-0x000000000652F000-memory.dmp family_redline behavioral1/memory/1448-208-0x00000000064F0000-0x000000000652F000-memory.dmp family_redline behavioral1/memory/1448-210-0x00000000064F0000-0x000000000652F000-memory.dmp family_redline behavioral1/memory/1448-212-0x00000000064F0000-0x000000000652F000-memory.dmp family_redline behavioral1/memory/1448-214-0x00000000064F0000-0x000000000652F000-memory.dmp family_redline behavioral1/memory/1448-216-0x00000000064F0000-0x000000000652F000-memory.dmp family_redline behavioral1/memory/1448-396-0x0000000003820000-0x0000000003830000-memory.dmp family_redline behavioral1/memory/1448-397-0x0000000003820000-0x0000000003830000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un265621.exepro9876.exequ4499.exesi054362.exepid process 2324 un265621.exe 2576 pro9876.exe 1448 qu4499.exe 1416 si054362.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro9876.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro9876.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro9876.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
5ff9bd850f2b89df9819b48f823a375ae2969c080fa7dc07102c29f2f2587c94.exeun265621.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 5ff9bd850f2b89df9819b48f823a375ae2969c080fa7dc07102c29f2f2587c94.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5ff9bd850f2b89df9819b48f823a375ae2969c080fa7dc07102c29f2f2587c94.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un265621.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un265621.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro9876.exequ4499.exesi054362.exepid process 2576 pro9876.exe 2576 pro9876.exe 1448 qu4499.exe 1448 qu4499.exe 1416 si054362.exe 1416 si054362.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro9876.exequ4499.exesi054362.exedescription pid process Token: SeDebugPrivilege 2576 pro9876.exe Token: SeDebugPrivilege 1448 qu4499.exe Token: SeDebugPrivilege 1416 si054362.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
5ff9bd850f2b89df9819b48f823a375ae2969c080fa7dc07102c29f2f2587c94.exeun265621.exedescription pid process target process PID 380 wrote to memory of 2324 380 5ff9bd850f2b89df9819b48f823a375ae2969c080fa7dc07102c29f2f2587c94.exe un265621.exe PID 380 wrote to memory of 2324 380 5ff9bd850f2b89df9819b48f823a375ae2969c080fa7dc07102c29f2f2587c94.exe un265621.exe PID 380 wrote to memory of 2324 380 5ff9bd850f2b89df9819b48f823a375ae2969c080fa7dc07102c29f2f2587c94.exe un265621.exe PID 2324 wrote to memory of 2576 2324 un265621.exe pro9876.exe PID 2324 wrote to memory of 2576 2324 un265621.exe pro9876.exe PID 2324 wrote to memory of 2576 2324 un265621.exe pro9876.exe PID 2324 wrote to memory of 1448 2324 un265621.exe qu4499.exe PID 2324 wrote to memory of 1448 2324 un265621.exe qu4499.exe PID 2324 wrote to memory of 1448 2324 un265621.exe qu4499.exe PID 380 wrote to memory of 1416 380 5ff9bd850f2b89df9819b48f823a375ae2969c080fa7dc07102c29f2f2587c94.exe si054362.exe PID 380 wrote to memory of 1416 380 5ff9bd850f2b89df9819b48f823a375ae2969c080fa7dc07102c29f2f2587c94.exe si054362.exe PID 380 wrote to memory of 1416 380 5ff9bd850f2b89df9819b48f823a375ae2969c080fa7dc07102c29f2f2587c94.exe si054362.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ff9bd850f2b89df9819b48f823a375ae2969c080fa7dc07102c29f2f2587c94.exe"C:\Users\Admin\AppData\Local\Temp\5ff9bd850f2b89df9819b48f823a375ae2969c080fa7dc07102c29f2f2587c94.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un265621.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un265621.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9876.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9876.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4499.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4499.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si054362.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si054362.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si054362.exeFilesize
175KB
MD550106298beeb328e64eff987c471bac9
SHA135170a5db79f12e4b4ebc64ea184873247fe2541
SHA256e998c746077d22b55d447b78b06d82f10a2d9fdfa4fd95a155b750b634fb979c
SHA512fe74919b6b62d1b20aface7db6e6203ce2590d140c7d7bbb53dff9a65e16568349f4a2c094a4c0671ab9913f1378b6ec1a3a66bcb2cca2a62b58ae851e209577
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si054362.exeFilesize
175KB
MD550106298beeb328e64eff987c471bac9
SHA135170a5db79f12e4b4ebc64ea184873247fe2541
SHA256e998c746077d22b55d447b78b06d82f10a2d9fdfa4fd95a155b750b634fb979c
SHA512fe74919b6b62d1b20aface7db6e6203ce2590d140c7d7bbb53dff9a65e16568349f4a2c094a4c0671ab9913f1378b6ec1a3a66bcb2cca2a62b58ae851e209577
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un265621.exeFilesize
547KB
MD5f4cfbf359d39a50b8152a68df0a16023
SHA103024fa41b69172b9d04d858b64b8869e09f9ef5
SHA2563171ef8b06d5ce360b21b429e711c8f7e565a42025a8a75b47c9b1de256ee02a
SHA5128c05b9cbd2abd67a5dea7e0fe0a396cd7c2263c11046a600f205a2ab52260ba6d960edde69430ea673bac7624844a651cc34d085b78cb2b9a5fbb597831b166a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un265621.exeFilesize
547KB
MD5f4cfbf359d39a50b8152a68df0a16023
SHA103024fa41b69172b9d04d858b64b8869e09f9ef5
SHA2563171ef8b06d5ce360b21b429e711c8f7e565a42025a8a75b47c9b1de256ee02a
SHA5128c05b9cbd2abd67a5dea7e0fe0a396cd7c2263c11046a600f205a2ab52260ba6d960edde69430ea673bac7624844a651cc34d085b78cb2b9a5fbb597831b166a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9876.exeFilesize
291KB
MD50cdb43ccb714b39553d473b0d01229dc
SHA16725354fa256bbab2da8f1c1aa39be20f2cecc5b
SHA256b9a1e9761c0f654dddef2efec5fe3c83c84ed9cf6f1f82cdba497ce6915543dc
SHA512bafc83e04c0f9b770289138576c460c0ae823cb6838144d81dd8f78f010d70ee1be7408ed6a9db7a440a14f7fdda811c6a3de699c40da58ba2764c3e09fa19e0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9876.exeFilesize
291KB
MD50cdb43ccb714b39553d473b0d01229dc
SHA16725354fa256bbab2da8f1c1aa39be20f2cecc5b
SHA256b9a1e9761c0f654dddef2efec5fe3c83c84ed9cf6f1f82cdba497ce6915543dc
SHA512bafc83e04c0f9b770289138576c460c0ae823cb6838144d81dd8f78f010d70ee1be7408ed6a9db7a440a14f7fdda811c6a3de699c40da58ba2764c3e09fa19e0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4499.exeFilesize
345KB
MD5a08ecead1e969ef6c97e78b0bfe22770
SHA198d1c4aa25e730413cfe6b2f134645fa8bfdcc49
SHA256530371011ff7d6895e026c6be7ba325233d1099908446aaeaaad75a254dfc99e
SHA5125121369036801dc6c6f7b473e09773584cb20f5288dbe683f8e602b5e28dbb0e1a2069300c1cd9c1f106d07f3246c356e4774d75c153eaab38832d680daf80ad
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4499.exeFilesize
345KB
MD5a08ecead1e969ef6c97e78b0bfe22770
SHA198d1c4aa25e730413cfe6b2f134645fa8bfdcc49
SHA256530371011ff7d6895e026c6be7ba325233d1099908446aaeaaad75a254dfc99e
SHA5125121369036801dc6c6f7b473e09773584cb20f5288dbe683f8e602b5e28dbb0e1a2069300c1cd9c1f106d07f3246c356e4774d75c153eaab38832d680daf80ad
-
memory/1416-1116-0x0000000005650000-0x0000000005660000-memory.dmpFilesize
64KB
-
memory/1416-1115-0x0000000005780000-0x00000000057CB000-memory.dmpFilesize
300KB
-
memory/1416-1114-0x0000000000D20000-0x0000000000D52000-memory.dmpFilesize
200KB
-
memory/1448-1093-0x0000000006BD0000-0x0000000006CDA000-memory.dmpFilesize
1.0MB
-
memory/1448-1096-0x0000000006E80000-0x0000000006ECB000-memory.dmpFilesize
300KB
-
memory/1448-1108-0x0000000003820000-0x0000000003830000-memory.dmpFilesize
64KB
-
memory/1448-1107-0x0000000008190000-0x00000000081E0000-memory.dmpFilesize
320KB
-
memory/1448-1106-0x0000000008110000-0x0000000008186000-memory.dmpFilesize
472KB
-
memory/1448-1105-0x0000000007AA0000-0x0000000007FCC000-memory.dmpFilesize
5.2MB
-
memory/1448-1104-0x00000000078C0000-0x0000000007A82000-memory.dmpFilesize
1.8MB
-
memory/1448-1103-0x0000000003820000-0x0000000003830000-memory.dmpFilesize
64KB
-
memory/1448-1102-0x0000000003820000-0x0000000003830000-memory.dmpFilesize
64KB
-
memory/1448-1101-0x0000000003820000-0x0000000003830000-memory.dmpFilesize
64KB
-
memory/1448-1100-0x00000000075B0000-0x0000000007642000-memory.dmpFilesize
584KB
-
memory/1448-1099-0x0000000007010000-0x0000000007076000-memory.dmpFilesize
408KB
-
memory/1448-1097-0x0000000003820000-0x0000000003830000-memory.dmpFilesize
64KB
-
memory/1448-1095-0x0000000006D30000-0x0000000006D6E000-memory.dmpFilesize
248KB
-
memory/1448-1094-0x0000000006D10000-0x0000000006D22000-memory.dmpFilesize
72KB
-
memory/1448-1092-0x0000000006540000-0x0000000006B46000-memory.dmpFilesize
6.0MB
-
memory/1448-400-0x0000000003820000-0x0000000003830000-memory.dmpFilesize
64KB
-
memory/1448-397-0x0000000003820000-0x0000000003830000-memory.dmpFilesize
64KB
-
memory/1448-396-0x0000000003820000-0x0000000003830000-memory.dmpFilesize
64KB
-
memory/1448-216-0x00000000064F0000-0x000000000652F000-memory.dmpFilesize
252KB
-
memory/1448-214-0x00000000064F0000-0x000000000652F000-memory.dmpFilesize
252KB
-
memory/1448-181-0x00000000037E0000-0x0000000003826000-memory.dmpFilesize
280KB
-
memory/1448-180-0x0000000001B00000-0x0000000001B4B000-memory.dmpFilesize
300KB
-
memory/1448-182-0x00000000064F0000-0x0000000006534000-memory.dmpFilesize
272KB
-
memory/1448-183-0x00000000064F0000-0x000000000652F000-memory.dmpFilesize
252KB
-
memory/1448-184-0x00000000064F0000-0x000000000652F000-memory.dmpFilesize
252KB
-
memory/1448-186-0x00000000064F0000-0x000000000652F000-memory.dmpFilesize
252KB
-
memory/1448-188-0x00000000064F0000-0x000000000652F000-memory.dmpFilesize
252KB
-
memory/1448-190-0x00000000064F0000-0x000000000652F000-memory.dmpFilesize
252KB
-
memory/1448-192-0x00000000064F0000-0x000000000652F000-memory.dmpFilesize
252KB
-
memory/1448-194-0x00000000064F0000-0x000000000652F000-memory.dmpFilesize
252KB
-
memory/1448-196-0x00000000064F0000-0x000000000652F000-memory.dmpFilesize
252KB
-
memory/1448-198-0x00000000064F0000-0x000000000652F000-memory.dmpFilesize
252KB
-
memory/1448-200-0x00000000064F0000-0x000000000652F000-memory.dmpFilesize
252KB
-
memory/1448-202-0x00000000064F0000-0x000000000652F000-memory.dmpFilesize
252KB
-
memory/1448-204-0x00000000064F0000-0x000000000652F000-memory.dmpFilesize
252KB
-
memory/1448-206-0x00000000064F0000-0x000000000652F000-memory.dmpFilesize
252KB
-
memory/1448-208-0x00000000064F0000-0x000000000652F000-memory.dmpFilesize
252KB
-
memory/1448-210-0x00000000064F0000-0x000000000652F000-memory.dmpFilesize
252KB
-
memory/1448-212-0x00000000064F0000-0x000000000652F000-memory.dmpFilesize
252KB
-
memory/2576-162-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/2576-175-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/2576-160-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/2576-158-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/2576-172-0x0000000004DE0000-0x0000000004DF0000-memory.dmpFilesize
64KB
-
memory/2576-171-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/2576-142-0x0000000004DE0000-0x0000000004DF0000-memory.dmpFilesize
64KB
-
memory/2576-168-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/2576-170-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/2576-144-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/2576-166-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/2576-164-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/2576-136-0x0000000002280000-0x000000000229A000-memory.dmpFilesize
104KB
-
memory/2576-143-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/2576-173-0x0000000004DE0000-0x0000000004DF0000-memory.dmpFilesize
64KB
-
memory/2576-156-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/2576-154-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/2576-152-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/2576-150-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/2576-148-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/2576-146-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/2576-140-0x0000000004DE0000-0x0000000004DF0000-memory.dmpFilesize
64KB
-
memory/2576-138-0x00000000001D0000-0x00000000001FD000-memory.dmpFilesize
180KB
-
memory/2576-139-0x0000000002420000-0x0000000002438000-memory.dmpFilesize
96KB
-
memory/2576-137-0x0000000004DF0000-0x00000000052EE000-memory.dmpFilesize
5.0MB
-
memory/2576-141-0x0000000004DE0000-0x0000000004DF0000-memory.dmpFilesize
64KB