Analysis
-
max time kernel
135s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 04:42
Static task
static1
Behavioral task
behavioral1
Sample
e1f83c921eac900ffa1a3533a3e8450a187d1065e36a636a543b735dec08a617.exe
Resource
win10v2004-20230220-en
General
-
Target
e1f83c921eac900ffa1a3533a3e8450a187d1065e36a636a543b735dec08a617.exe
-
Size
690KB
-
MD5
42d79e83b06f985da7d1620186df5339
-
SHA1
32ff7f02b2a5255945b28a15ae49942e7d0e7761
-
SHA256
e1f83c921eac900ffa1a3533a3e8450a187d1065e36a636a543b735dec08a617
-
SHA512
61b8552f4088262629250746fa523f0f9de5b146441a4ba128a2c82322d80393705bf6681fff312c04b1f1fd12fd068532afc13a51b4ea8eddcc1457b28c567e
-
SSDEEP
12288:wMrwy90D1OJVUNM1kAS6fB2ohc1fKZ7p8H6RZAh+NvmFhgfigC4wqqtJ945:Qyu1O7sASwzV5LVNChgagCz/tJa5
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Processes:
pro3399.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro3399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro3399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro3399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro3399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro3399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro3399.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/4964-192-0x0000000005FE0000-0x000000000601F000-memory.dmp family_redline behavioral1/memory/4964-194-0x0000000005FE0000-0x000000000601F000-memory.dmp family_redline behavioral1/memory/4964-191-0x0000000005FE0000-0x000000000601F000-memory.dmp family_redline behavioral1/memory/4964-196-0x0000000005FE0000-0x000000000601F000-memory.dmp family_redline behavioral1/memory/4964-198-0x0000000005FE0000-0x000000000601F000-memory.dmp family_redline behavioral1/memory/4964-200-0x0000000005FE0000-0x000000000601F000-memory.dmp family_redline behavioral1/memory/4964-202-0x0000000005FE0000-0x000000000601F000-memory.dmp family_redline behavioral1/memory/4964-204-0x0000000005FE0000-0x000000000601F000-memory.dmp family_redline behavioral1/memory/4964-206-0x0000000005FE0000-0x000000000601F000-memory.dmp family_redline behavioral1/memory/4964-208-0x0000000005FE0000-0x000000000601F000-memory.dmp family_redline behavioral1/memory/4964-210-0x0000000005FE0000-0x000000000601F000-memory.dmp family_redline behavioral1/memory/4964-212-0x0000000005FE0000-0x000000000601F000-memory.dmp family_redline behavioral1/memory/4964-214-0x0000000005FE0000-0x000000000601F000-memory.dmp family_redline behavioral1/memory/4964-216-0x0000000005FE0000-0x000000000601F000-memory.dmp family_redline behavioral1/memory/4964-218-0x0000000005FE0000-0x000000000601F000-memory.dmp family_redline behavioral1/memory/4964-220-0x0000000005FE0000-0x000000000601F000-memory.dmp family_redline behavioral1/memory/4964-222-0x0000000005FE0000-0x000000000601F000-memory.dmp family_redline behavioral1/memory/4964-225-0x0000000005FE0000-0x000000000601F000-memory.dmp family_redline behavioral1/memory/4964-1109-0x0000000006030000-0x0000000006040000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un792791.exepro3399.exequ6644.exesi834271.exepid process 4244 un792791.exe 4600 pro3399.exe 4964 qu6644.exe 1980 si834271.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro3399.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro3399.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro3399.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
e1f83c921eac900ffa1a3533a3e8450a187d1065e36a636a543b735dec08a617.exeun792791.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce e1f83c921eac900ffa1a3533a3e8450a187d1065e36a636a543b735dec08a617.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" e1f83c921eac900ffa1a3533a3e8450a187d1065e36a636a543b735dec08a617.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un792791.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un792791.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3820 4600 WerFault.exe pro3399.exe 2700 4964 WerFault.exe qu6644.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro3399.exequ6644.exesi834271.exepid process 4600 pro3399.exe 4600 pro3399.exe 4964 qu6644.exe 4964 qu6644.exe 1980 si834271.exe 1980 si834271.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro3399.exequ6644.exesi834271.exedescription pid process Token: SeDebugPrivilege 4600 pro3399.exe Token: SeDebugPrivilege 4964 qu6644.exe Token: SeDebugPrivilege 1980 si834271.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
e1f83c921eac900ffa1a3533a3e8450a187d1065e36a636a543b735dec08a617.exeun792791.exedescription pid process target process PID 1520 wrote to memory of 4244 1520 e1f83c921eac900ffa1a3533a3e8450a187d1065e36a636a543b735dec08a617.exe un792791.exe PID 1520 wrote to memory of 4244 1520 e1f83c921eac900ffa1a3533a3e8450a187d1065e36a636a543b735dec08a617.exe un792791.exe PID 1520 wrote to memory of 4244 1520 e1f83c921eac900ffa1a3533a3e8450a187d1065e36a636a543b735dec08a617.exe un792791.exe PID 4244 wrote to memory of 4600 4244 un792791.exe pro3399.exe PID 4244 wrote to memory of 4600 4244 un792791.exe pro3399.exe PID 4244 wrote to memory of 4600 4244 un792791.exe pro3399.exe PID 4244 wrote to memory of 4964 4244 un792791.exe qu6644.exe PID 4244 wrote to memory of 4964 4244 un792791.exe qu6644.exe PID 4244 wrote to memory of 4964 4244 un792791.exe qu6644.exe PID 1520 wrote to memory of 1980 1520 e1f83c921eac900ffa1a3533a3e8450a187d1065e36a636a543b735dec08a617.exe si834271.exe PID 1520 wrote to memory of 1980 1520 e1f83c921eac900ffa1a3533a3e8450a187d1065e36a636a543b735dec08a617.exe si834271.exe PID 1520 wrote to memory of 1980 1520 e1f83c921eac900ffa1a3533a3e8450a187d1065e36a636a543b735dec08a617.exe si834271.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1f83c921eac900ffa1a3533a3e8450a187d1065e36a636a543b735dec08a617.exe"C:\Users\Admin\AppData\Local\Temp\e1f83c921eac900ffa1a3533a3e8450a187d1065e36a636a543b735dec08a617.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un792791.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un792791.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3399.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3399.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 10804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6644.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6644.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 13484⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si834271.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si834271.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4600 -ip 46001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4964 -ip 49641⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si834271.exeFilesize
175KB
MD5741d23bbe724276c0f7d274c600018dc
SHA18e43282b7a9a97b86cb687d42b712b18aa4a8757
SHA256f21566b5fe0d403c584c848be0317dcf1613f3d051a89f6ca31fd474c01ffdc0
SHA5121b87768ef126887f3bb5be545d8c82ddf6fb8a33f247399f1be2a16a4351cdd7ee8dd3cd3ab722e0f66d98e26deee168eb234390e9ceea12a4889a98fa287f60
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si834271.exeFilesize
175KB
MD5741d23bbe724276c0f7d274c600018dc
SHA18e43282b7a9a97b86cb687d42b712b18aa4a8757
SHA256f21566b5fe0d403c584c848be0317dcf1613f3d051a89f6ca31fd474c01ffdc0
SHA5121b87768ef126887f3bb5be545d8c82ddf6fb8a33f247399f1be2a16a4351cdd7ee8dd3cd3ab722e0f66d98e26deee168eb234390e9ceea12a4889a98fa287f60
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un792791.exeFilesize
548KB
MD58b461e2f43499ce0033e6f56926eb0ad
SHA133c034a5e2c68fd8c656f1f2b7e37119488681e3
SHA256bb843d0d32b6c34c80bd526d3c795a8cb90b27868d186bffc52986fbf495d4bd
SHA512b7f8ff001b0cd0ec0de7a035e0699e3134250a395c66549fb64d8fb58ea455b935c30f85033f1ecee1e66450409069ce7efbee1229636f82d1beceb98309020b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un792791.exeFilesize
548KB
MD58b461e2f43499ce0033e6f56926eb0ad
SHA133c034a5e2c68fd8c656f1f2b7e37119488681e3
SHA256bb843d0d32b6c34c80bd526d3c795a8cb90b27868d186bffc52986fbf495d4bd
SHA512b7f8ff001b0cd0ec0de7a035e0699e3134250a395c66549fb64d8fb58ea455b935c30f85033f1ecee1e66450409069ce7efbee1229636f82d1beceb98309020b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3399.exeFilesize
291KB
MD58ecaac96cc545bd32ad18c22de731ada
SHA1dc53753b504bcf353f09d6b572bc1cb5e98d48f9
SHA2566cec7773e3cf0c2bcb11e32e25b7fbe422f6985de4af8295464e865b53726785
SHA5124ee5c1f3453bfbc7a92375b091b704bd7dc3cc2a98a706283da9cd657b5ef4e8aeb13f0cd069f7df7e49ef1fbb8853c6c0a404b967cf0e8329e511b5c5f7a4e4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3399.exeFilesize
291KB
MD58ecaac96cc545bd32ad18c22de731ada
SHA1dc53753b504bcf353f09d6b572bc1cb5e98d48f9
SHA2566cec7773e3cf0c2bcb11e32e25b7fbe422f6985de4af8295464e865b53726785
SHA5124ee5c1f3453bfbc7a92375b091b704bd7dc3cc2a98a706283da9cd657b5ef4e8aeb13f0cd069f7df7e49ef1fbb8853c6c0a404b967cf0e8329e511b5c5f7a4e4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6644.exeFilesize
345KB
MD5390d8703fe73d69349c27863dcbb2156
SHA11426575f3274ef5c45e2faba112cd386e6a15e10
SHA2568a0bdc4567588defb185bed004aab7d4184fc6f9be2ab4221b8990ab5bb73134
SHA51269b1e233c6c3fd23c22838edf20b0e5226b44866e541047b07a146646ac0b6aa614bafdb8b88fd7578cd2c330919c9e25811c62b3cb6d437d0bbec544d8d308c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6644.exeFilesize
345KB
MD5390d8703fe73d69349c27863dcbb2156
SHA11426575f3274ef5c45e2faba112cd386e6a15e10
SHA2568a0bdc4567588defb185bed004aab7d4184fc6f9be2ab4221b8990ab5bb73134
SHA51269b1e233c6c3fd23c22838edf20b0e5226b44866e541047b07a146646ac0b6aa614bafdb8b88fd7578cd2c330919c9e25811c62b3cb6d437d0bbec544d8d308c
-
memory/1980-1122-0x00000000000D0000-0x0000000000102000-memory.dmpFilesize
200KB
-
memory/1980-1123-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/4600-159-0x0000000004DC0000-0x0000000004DD2000-memory.dmpFilesize
72KB
-
memory/4600-176-0x0000000004F10000-0x0000000004F20000-memory.dmpFilesize
64KB
-
memory/4600-151-0x0000000004DC0000-0x0000000004DD2000-memory.dmpFilesize
72KB
-
memory/4600-153-0x0000000004DC0000-0x0000000004DD2000-memory.dmpFilesize
72KB
-
memory/4600-155-0x0000000004DC0000-0x0000000004DD2000-memory.dmpFilesize
72KB
-
memory/4600-157-0x0000000004DC0000-0x0000000004DD2000-memory.dmpFilesize
72KB
-
memory/4600-149-0x0000000004F20000-0x00000000054C4000-memory.dmpFilesize
5.6MB
-
memory/4600-161-0x0000000004DC0000-0x0000000004DD2000-memory.dmpFilesize
72KB
-
memory/4600-163-0x0000000004DC0000-0x0000000004DD2000-memory.dmpFilesize
72KB
-
memory/4600-165-0x0000000004DC0000-0x0000000004DD2000-memory.dmpFilesize
72KB
-
memory/4600-167-0x0000000004DC0000-0x0000000004DD2000-memory.dmpFilesize
72KB
-
memory/4600-169-0x0000000004DC0000-0x0000000004DD2000-memory.dmpFilesize
72KB
-
memory/4600-171-0x0000000004DC0000-0x0000000004DD2000-memory.dmpFilesize
72KB
-
memory/4600-150-0x0000000004DC0000-0x0000000004DD2000-memory.dmpFilesize
72KB
-
memory/4600-174-0x0000000004DC0000-0x0000000004DD2000-memory.dmpFilesize
72KB
-
memory/4600-173-0x0000000004F10000-0x0000000004F20000-memory.dmpFilesize
64KB
-
memory/4600-178-0x0000000004F10000-0x0000000004F20000-memory.dmpFilesize
64KB
-
memory/4600-177-0x0000000004DC0000-0x0000000004DD2000-memory.dmpFilesize
72KB
-
memory/4600-180-0x0000000004DC0000-0x0000000004DD2000-memory.dmpFilesize
72KB
-
memory/4600-181-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/4600-183-0x0000000004F10000-0x0000000004F20000-memory.dmpFilesize
64KB
-
memory/4600-184-0x0000000004F10000-0x0000000004F20000-memory.dmpFilesize
64KB
-
memory/4600-185-0x0000000004F10000-0x0000000004F20000-memory.dmpFilesize
64KB
-
memory/4600-186-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/4600-148-0x00000000007E0000-0x000000000080D000-memory.dmpFilesize
180KB
-
memory/4964-191-0x0000000005FE0000-0x000000000601F000-memory.dmpFilesize
252KB
-
memory/4964-228-0x0000000006030000-0x0000000006040000-memory.dmpFilesize
64KB
-
memory/4964-196-0x0000000005FE0000-0x000000000601F000-memory.dmpFilesize
252KB
-
memory/4964-198-0x0000000005FE0000-0x000000000601F000-memory.dmpFilesize
252KB
-
memory/4964-200-0x0000000005FE0000-0x000000000601F000-memory.dmpFilesize
252KB
-
memory/4964-202-0x0000000005FE0000-0x000000000601F000-memory.dmpFilesize
252KB
-
memory/4964-204-0x0000000005FE0000-0x000000000601F000-memory.dmpFilesize
252KB
-
memory/4964-206-0x0000000005FE0000-0x000000000601F000-memory.dmpFilesize
252KB
-
memory/4964-208-0x0000000005FE0000-0x000000000601F000-memory.dmpFilesize
252KB
-
memory/4964-210-0x0000000005FE0000-0x000000000601F000-memory.dmpFilesize
252KB
-
memory/4964-212-0x0000000005FE0000-0x000000000601F000-memory.dmpFilesize
252KB
-
memory/4964-214-0x0000000005FE0000-0x000000000601F000-memory.dmpFilesize
252KB
-
memory/4964-216-0x0000000005FE0000-0x000000000601F000-memory.dmpFilesize
252KB
-
memory/4964-218-0x0000000005FE0000-0x000000000601F000-memory.dmpFilesize
252KB
-
memory/4964-220-0x0000000005FE0000-0x000000000601F000-memory.dmpFilesize
252KB
-
memory/4964-222-0x0000000005FE0000-0x000000000601F000-memory.dmpFilesize
252KB
-
memory/4964-225-0x0000000005FE0000-0x000000000601F000-memory.dmpFilesize
252KB
-
memory/4964-226-0x0000000006030000-0x0000000006040000-memory.dmpFilesize
64KB
-
memory/4964-223-0x0000000001A50000-0x0000000001A9B000-memory.dmpFilesize
300KB
-
memory/4964-194-0x0000000005FE0000-0x000000000601F000-memory.dmpFilesize
252KB
-
memory/4964-230-0x0000000006030000-0x0000000006040000-memory.dmpFilesize
64KB
-
memory/4964-1101-0x0000000006630000-0x0000000006C48000-memory.dmpFilesize
6.1MB
-
memory/4964-1102-0x0000000006CD0000-0x0000000006DDA000-memory.dmpFilesize
1.0MB
-
memory/4964-1103-0x0000000006E10000-0x0000000006E22000-memory.dmpFilesize
72KB
-
memory/4964-1104-0x0000000006E30000-0x0000000006E6C000-memory.dmpFilesize
240KB
-
memory/4964-1105-0x0000000006030000-0x0000000006040000-memory.dmpFilesize
64KB
-
memory/4964-1106-0x0000000007120000-0x00000000071B2000-memory.dmpFilesize
584KB
-
memory/4964-1108-0x00000000071C0000-0x0000000007226000-memory.dmpFilesize
408KB
-
memory/4964-1109-0x0000000006030000-0x0000000006040000-memory.dmpFilesize
64KB
-
memory/4964-1110-0x0000000006030000-0x0000000006040000-memory.dmpFilesize
64KB
-
memory/4964-1111-0x0000000006030000-0x0000000006040000-memory.dmpFilesize
64KB
-
memory/4964-1112-0x0000000007B20000-0x0000000007CE2000-memory.dmpFilesize
1.8MB
-
memory/4964-1113-0x0000000007D00000-0x000000000822C000-memory.dmpFilesize
5.2MB
-
memory/4964-192-0x0000000005FE0000-0x000000000601F000-memory.dmpFilesize
252KB
-
memory/4964-1114-0x0000000008360000-0x00000000083D6000-memory.dmpFilesize
472KB
-
memory/4964-1115-0x00000000083F0000-0x0000000008440000-memory.dmpFilesize
320KB
-
memory/4964-1116-0x0000000006030000-0x0000000006040000-memory.dmpFilesize
64KB