Analysis
-
max time kernel
87s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 04:44
Static task
static1
Behavioral task
behavioral1
Sample
cfb6958cb06d7328a61011fd936ef292b481050a396bbff4fdbd6742798d7934.exe
Resource
win10v2004-20230220-en
General
-
Target
cfb6958cb06d7328a61011fd936ef292b481050a396bbff4fdbd6742798d7934.exe
-
Size
690KB
-
MD5
bc7168c157ad33f29f651f5c250f6eb5
-
SHA1
6ce4900150e73bfa89d7ef823e6ea992cb957ddb
-
SHA256
cfb6958cb06d7328a61011fd936ef292b481050a396bbff4fdbd6742798d7934
-
SHA512
5752cbc64d7b5a3772d71bec793c15d1d8a428cae8c5649df16481ab625cce2f7985e2feab002c405f013cf481d52f296eabd8474ca27c277c9e9166cccba196
-
SSDEEP
12288:bMroy90GAR+ayEqOt0vSzJF1OLQLvrBWvoFI8fighDIzn2Lj+aU:vyl1ayo0vSrnBWQI8aghDAnQj+j
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Processes:
pro9593.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro9593.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro9593.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro9593.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro9593.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro9593.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro9593.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/4488-190-0x00000000065C0000-0x00000000065FF000-memory.dmp family_redline behavioral1/memory/4488-193-0x00000000065C0000-0x00000000065FF000-memory.dmp family_redline behavioral1/memory/4488-191-0x00000000065C0000-0x00000000065FF000-memory.dmp family_redline behavioral1/memory/4488-195-0x00000000065C0000-0x00000000065FF000-memory.dmp family_redline behavioral1/memory/4488-197-0x00000000065C0000-0x00000000065FF000-memory.dmp family_redline behavioral1/memory/4488-199-0x00000000065C0000-0x00000000065FF000-memory.dmp family_redline behavioral1/memory/4488-201-0x00000000065C0000-0x00000000065FF000-memory.dmp family_redline behavioral1/memory/4488-203-0x00000000065C0000-0x00000000065FF000-memory.dmp family_redline behavioral1/memory/4488-205-0x00000000065C0000-0x00000000065FF000-memory.dmp family_redline behavioral1/memory/4488-207-0x00000000065C0000-0x00000000065FF000-memory.dmp family_redline behavioral1/memory/4488-209-0x00000000065C0000-0x00000000065FF000-memory.dmp family_redline behavioral1/memory/4488-211-0x00000000065C0000-0x00000000065FF000-memory.dmp family_redline behavioral1/memory/4488-219-0x00000000065C0000-0x00000000065FF000-memory.dmp family_redline behavioral1/memory/4488-217-0x00000000065C0000-0x00000000065FF000-memory.dmp family_redline behavioral1/memory/4488-221-0x00000000065C0000-0x00000000065FF000-memory.dmp family_redline behavioral1/memory/4488-223-0x00000000065C0000-0x00000000065FF000-memory.dmp family_redline behavioral1/memory/4488-225-0x00000000065C0000-0x00000000065FF000-memory.dmp family_redline behavioral1/memory/4488-227-0x00000000065C0000-0x00000000065FF000-memory.dmp family_redline behavioral1/memory/4488-1108-0x0000000003C60000-0x0000000003C70000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un050221.exepro9593.exequ1888.exesi567064.exepid process 4624 un050221.exe 1488 pro9593.exe 4488 qu1888.exe 2996 si567064.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro9593.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro9593.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro9593.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un050221.execfb6958cb06d7328a61011fd936ef292b481050a396bbff4fdbd6742798d7934.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un050221.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un050221.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce cfb6958cb06d7328a61011fd936ef292b481050a396bbff4fdbd6742798d7934.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" cfb6958cb06d7328a61011fd936ef292b481050a396bbff4fdbd6742798d7934.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1832 1488 WerFault.exe pro9593.exe 1172 4488 WerFault.exe qu1888.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro9593.exequ1888.exesi567064.exepid process 1488 pro9593.exe 1488 pro9593.exe 4488 qu1888.exe 4488 qu1888.exe 2996 si567064.exe 2996 si567064.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro9593.exequ1888.exesi567064.exedescription pid process Token: SeDebugPrivilege 1488 pro9593.exe Token: SeDebugPrivilege 4488 qu1888.exe Token: SeDebugPrivilege 2996 si567064.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
cfb6958cb06d7328a61011fd936ef292b481050a396bbff4fdbd6742798d7934.exeun050221.exedescription pid process target process PID 3216 wrote to memory of 4624 3216 cfb6958cb06d7328a61011fd936ef292b481050a396bbff4fdbd6742798d7934.exe un050221.exe PID 3216 wrote to memory of 4624 3216 cfb6958cb06d7328a61011fd936ef292b481050a396bbff4fdbd6742798d7934.exe un050221.exe PID 3216 wrote to memory of 4624 3216 cfb6958cb06d7328a61011fd936ef292b481050a396bbff4fdbd6742798d7934.exe un050221.exe PID 4624 wrote to memory of 1488 4624 un050221.exe pro9593.exe PID 4624 wrote to memory of 1488 4624 un050221.exe pro9593.exe PID 4624 wrote to memory of 1488 4624 un050221.exe pro9593.exe PID 4624 wrote to memory of 4488 4624 un050221.exe qu1888.exe PID 4624 wrote to memory of 4488 4624 un050221.exe qu1888.exe PID 4624 wrote to memory of 4488 4624 un050221.exe qu1888.exe PID 3216 wrote to memory of 2996 3216 cfb6958cb06d7328a61011fd936ef292b481050a396bbff4fdbd6742798d7934.exe si567064.exe PID 3216 wrote to memory of 2996 3216 cfb6958cb06d7328a61011fd936ef292b481050a396bbff4fdbd6742798d7934.exe si567064.exe PID 3216 wrote to memory of 2996 3216 cfb6958cb06d7328a61011fd936ef292b481050a396bbff4fdbd6742798d7934.exe si567064.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfb6958cb06d7328a61011fd936ef292b481050a396bbff4fdbd6742798d7934.exe"C:\Users\Admin\AppData\Local\Temp\cfb6958cb06d7328a61011fd936ef292b481050a396bbff4fdbd6742798d7934.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un050221.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un050221.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9593.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9593.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 10284⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1888.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1888.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 13284⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si567064.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si567064.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1488 -ip 14881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4488 -ip 44881⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si567064.exeFilesize
175KB
MD5ffef3969d309909a977cd933bb5ec8bf
SHA106a0d95d7edbedca27166fdf8e9c29f6fadba769
SHA2561a9073c5fbd8a8a6b50329944797ebbe8acfd63af8306cb0a6744b91f26c0fab
SHA512d731488c9d5a86c1b4264d9c29e8e061d41c49170aa7dac2aa735c1e9b95b5326c5297722091ac3167dc40cb09c3d7cb5ac968d244dd6498907f388576da1b52
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si567064.exeFilesize
175KB
MD5ffef3969d309909a977cd933bb5ec8bf
SHA106a0d95d7edbedca27166fdf8e9c29f6fadba769
SHA2561a9073c5fbd8a8a6b50329944797ebbe8acfd63af8306cb0a6744b91f26c0fab
SHA512d731488c9d5a86c1b4264d9c29e8e061d41c49170aa7dac2aa735c1e9b95b5326c5297722091ac3167dc40cb09c3d7cb5ac968d244dd6498907f388576da1b52
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un050221.exeFilesize
548KB
MD5aea0cf4206274ecb4df76f762b590f49
SHA136fdf208071968eb1744af2494bc8e306a03865d
SHA2567ee75c0721edf6b4484eb636120bf4384e6ffdd5a2faa59a8febe82390786f58
SHA51287f680460819dcfc3c8e07391984983a502c4bb835e8a1c1119dac1fb4ac41de81fd2fbceb270fb8dcc337110e07e8034036ae7555800b8d84fb3493aea4184d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un050221.exeFilesize
548KB
MD5aea0cf4206274ecb4df76f762b590f49
SHA136fdf208071968eb1744af2494bc8e306a03865d
SHA2567ee75c0721edf6b4484eb636120bf4384e6ffdd5a2faa59a8febe82390786f58
SHA51287f680460819dcfc3c8e07391984983a502c4bb835e8a1c1119dac1fb4ac41de81fd2fbceb270fb8dcc337110e07e8034036ae7555800b8d84fb3493aea4184d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9593.exeFilesize
291KB
MD53b515836694661de126372ad191cb59f
SHA171cef8cc36301e7ea7530236d8f66eed9e8f9d72
SHA256b9ea87defd9d043d9a2aba30724a7f041484545b804ad556335fe748e1130095
SHA5121683a9185289459477a3f84145b67578d46e222aec431b6ddc7a46b0142a79c8a3abc96eb0788a5d54788e9aad2ed5509d7b93329650810e7aee345dc9900444
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9593.exeFilesize
291KB
MD53b515836694661de126372ad191cb59f
SHA171cef8cc36301e7ea7530236d8f66eed9e8f9d72
SHA256b9ea87defd9d043d9a2aba30724a7f041484545b804ad556335fe748e1130095
SHA5121683a9185289459477a3f84145b67578d46e222aec431b6ddc7a46b0142a79c8a3abc96eb0788a5d54788e9aad2ed5509d7b93329650810e7aee345dc9900444
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1888.exeFilesize
345KB
MD5369b28e2196ec866ebeccd239e23113f
SHA13e0a0b343ec0ceeb4668f1b6833f441e7ea9545d
SHA25618ed7009b41241974db0073373f76b67031ba2b379442df8713201cdd4e3916c
SHA5128f87c4265db2bc2c6e89bc2f337498733c83d6c9bd25d5c096de08402be44a96b835620d9896d9c5b2964a4cc08ef19fcfbde28c1d1605a70debb548aa344915
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1888.exeFilesize
345KB
MD5369b28e2196ec866ebeccd239e23113f
SHA13e0a0b343ec0ceeb4668f1b6833f441e7ea9545d
SHA25618ed7009b41241974db0073373f76b67031ba2b379442df8713201cdd4e3916c
SHA5128f87c4265db2bc2c6e89bc2f337498733c83d6c9bd25d5c096de08402be44a96b835620d9896d9c5b2964a4cc08ef19fcfbde28c1d1605a70debb548aa344915
-
memory/1488-148-0x0000000005050000-0x00000000055F4000-memory.dmpFilesize
5.6MB
-
memory/1488-149-0x0000000000710000-0x000000000073D000-memory.dmpFilesize
180KB
-
memory/1488-150-0x0000000005040000-0x0000000005050000-memory.dmpFilesize
64KB
-
memory/1488-151-0x0000000005040000-0x0000000005050000-memory.dmpFilesize
64KB
-
memory/1488-152-0x0000000002490000-0x00000000024A2000-memory.dmpFilesize
72KB
-
memory/1488-155-0x0000000002490000-0x00000000024A2000-memory.dmpFilesize
72KB
-
memory/1488-157-0x0000000002490000-0x00000000024A2000-memory.dmpFilesize
72KB
-
memory/1488-153-0x0000000002490000-0x00000000024A2000-memory.dmpFilesize
72KB
-
memory/1488-159-0x0000000002490000-0x00000000024A2000-memory.dmpFilesize
72KB
-
memory/1488-161-0x0000000002490000-0x00000000024A2000-memory.dmpFilesize
72KB
-
memory/1488-163-0x0000000002490000-0x00000000024A2000-memory.dmpFilesize
72KB
-
memory/1488-165-0x0000000002490000-0x00000000024A2000-memory.dmpFilesize
72KB
-
memory/1488-167-0x0000000002490000-0x00000000024A2000-memory.dmpFilesize
72KB
-
memory/1488-169-0x0000000002490000-0x00000000024A2000-memory.dmpFilesize
72KB
-
memory/1488-171-0x0000000002490000-0x00000000024A2000-memory.dmpFilesize
72KB
-
memory/1488-173-0x0000000002490000-0x00000000024A2000-memory.dmpFilesize
72KB
-
memory/1488-175-0x0000000002490000-0x00000000024A2000-memory.dmpFilesize
72KB
-
memory/1488-177-0x0000000002490000-0x00000000024A2000-memory.dmpFilesize
72KB
-
memory/1488-179-0x0000000002490000-0x00000000024A2000-memory.dmpFilesize
72KB
-
memory/1488-180-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/1488-181-0x0000000005040000-0x0000000005050000-memory.dmpFilesize
64KB
-
memory/1488-182-0x0000000005040000-0x0000000005050000-memory.dmpFilesize
64KB
-
memory/1488-183-0x0000000005040000-0x0000000005050000-memory.dmpFilesize
64KB
-
memory/1488-185-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/2996-1121-0x0000000000CD0000-0x0000000000D02000-memory.dmpFilesize
200KB
-
memory/2996-1123-0x0000000005630000-0x0000000005640000-memory.dmpFilesize
64KB
-
memory/2996-1122-0x0000000005630000-0x0000000005640000-memory.dmpFilesize
64KB
-
memory/4488-195-0x00000000065C0000-0x00000000065FF000-memory.dmpFilesize
252KB
-
memory/4488-227-0x00000000065C0000-0x00000000065FF000-memory.dmpFilesize
252KB
-
memory/4488-197-0x00000000065C0000-0x00000000065FF000-memory.dmpFilesize
252KB
-
memory/4488-199-0x00000000065C0000-0x00000000065FF000-memory.dmpFilesize
252KB
-
memory/4488-201-0x00000000065C0000-0x00000000065FF000-memory.dmpFilesize
252KB
-
memory/4488-203-0x00000000065C0000-0x00000000065FF000-memory.dmpFilesize
252KB
-
memory/4488-205-0x00000000065C0000-0x00000000065FF000-memory.dmpFilesize
252KB
-
memory/4488-207-0x00000000065C0000-0x00000000065FF000-memory.dmpFilesize
252KB
-
memory/4488-209-0x00000000065C0000-0x00000000065FF000-memory.dmpFilesize
252KB
-
memory/4488-211-0x00000000065C0000-0x00000000065FF000-memory.dmpFilesize
252KB
-
memory/4488-212-0x0000000001B00000-0x0000000001B4B000-memory.dmpFilesize
300KB
-
memory/4488-215-0x0000000003C60000-0x0000000003C70000-memory.dmpFilesize
64KB
-
memory/4488-213-0x0000000003C60000-0x0000000003C70000-memory.dmpFilesize
64KB
-
memory/4488-216-0x0000000003C60000-0x0000000003C70000-memory.dmpFilesize
64KB
-
memory/4488-219-0x00000000065C0000-0x00000000065FF000-memory.dmpFilesize
252KB
-
memory/4488-217-0x00000000065C0000-0x00000000065FF000-memory.dmpFilesize
252KB
-
memory/4488-221-0x00000000065C0000-0x00000000065FF000-memory.dmpFilesize
252KB
-
memory/4488-223-0x00000000065C0000-0x00000000065FF000-memory.dmpFilesize
252KB
-
memory/4488-225-0x00000000065C0000-0x00000000065FF000-memory.dmpFilesize
252KB
-
memory/4488-191-0x00000000065C0000-0x00000000065FF000-memory.dmpFilesize
252KB
-
memory/4488-1100-0x0000000006630000-0x0000000006C48000-memory.dmpFilesize
6.1MB
-
memory/4488-1101-0x0000000006CD0000-0x0000000006DDA000-memory.dmpFilesize
1.0MB
-
memory/4488-1102-0x0000000006E10000-0x0000000006E22000-memory.dmpFilesize
72KB
-
memory/4488-1103-0x0000000006E30000-0x0000000006E6C000-memory.dmpFilesize
240KB
-
memory/4488-1104-0x0000000003C60000-0x0000000003C70000-memory.dmpFilesize
64KB
-
memory/4488-1105-0x0000000007120000-0x0000000007186000-memory.dmpFilesize
408KB
-
memory/4488-1107-0x0000000007920000-0x00000000079B2000-memory.dmpFilesize
584KB
-
memory/4488-1108-0x0000000003C60000-0x0000000003C70000-memory.dmpFilesize
64KB
-
memory/4488-1109-0x0000000003C60000-0x0000000003C70000-memory.dmpFilesize
64KB
-
memory/4488-1110-0x0000000003C60000-0x0000000003C70000-memory.dmpFilesize
64KB
-
memory/4488-1111-0x0000000003C60000-0x0000000003C70000-memory.dmpFilesize
64KB
-
memory/4488-1112-0x0000000008DE0000-0x0000000008FA2000-memory.dmpFilesize
1.8MB
-
memory/4488-193-0x00000000065C0000-0x00000000065FF000-memory.dmpFilesize
252KB
-
memory/4488-190-0x00000000065C0000-0x00000000065FF000-memory.dmpFilesize
252KB
-
memory/4488-1113-0x0000000008FB0000-0x00000000094DC000-memory.dmpFilesize
5.2MB
-
memory/4488-1114-0x0000000003830000-0x00000000038A6000-memory.dmpFilesize
472KB
-
memory/4488-1115-0x0000000009620000-0x0000000009670000-memory.dmpFilesize
320KB