Analysis
-
max time kernel
61s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 04:45
Static task
static1
Behavioral task
behavioral1
Sample
642a66db7c24fcb32ae7e471b5fd55db4c65d24a6e2743ce32ff6727cef796ee.exe
Resource
win10v2004-20230220-en
General
-
Target
642a66db7c24fcb32ae7e471b5fd55db4c65d24a6e2743ce32ff6727cef796ee.exe
-
Size
690KB
-
MD5
c3f8ca24fffbfe98cd961fcec2528e5b
-
SHA1
b09fb86c3b5a90d307f3de488a03cd4c6338b01d
-
SHA256
642a66db7c24fcb32ae7e471b5fd55db4c65d24a6e2743ce32ff6727cef796ee
-
SHA512
600d8dab75da3e94119541e0f1f3d8098371e1218253fe68e47dce5306a32eb49751e57c65532b963719a6915fd6ec881d15a233f07a00d00a6926b486071fcc
-
SSDEEP
12288:RMrTy90G82zt5pJbuJckAy465hLuHwrodDHLL8vzFGBfigunbGIp1x:2y023r6R3fajDn8pGBagvo1x
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Processes:
pro9383.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro9383.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro9383.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro9383.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro9383.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro9383.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro9383.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/4076-192-0x0000000003B80000-0x0000000003BBF000-memory.dmp family_redline behavioral1/memory/4076-195-0x0000000003B80000-0x0000000003BBF000-memory.dmp family_redline behavioral1/memory/4076-193-0x0000000003B80000-0x0000000003BBF000-memory.dmp family_redline behavioral1/memory/4076-197-0x0000000003B80000-0x0000000003BBF000-memory.dmp family_redline behavioral1/memory/4076-199-0x0000000003B80000-0x0000000003BBF000-memory.dmp family_redline behavioral1/memory/4076-201-0x0000000003B80000-0x0000000003BBF000-memory.dmp family_redline behavioral1/memory/4076-203-0x0000000003B80000-0x0000000003BBF000-memory.dmp family_redline behavioral1/memory/4076-205-0x0000000003B80000-0x0000000003BBF000-memory.dmp family_redline behavioral1/memory/4076-207-0x0000000003B80000-0x0000000003BBF000-memory.dmp family_redline behavioral1/memory/4076-209-0x0000000003B80000-0x0000000003BBF000-memory.dmp family_redline behavioral1/memory/4076-211-0x0000000003B80000-0x0000000003BBF000-memory.dmp family_redline behavioral1/memory/4076-213-0x0000000003B80000-0x0000000003BBF000-memory.dmp family_redline behavioral1/memory/4076-215-0x0000000003B80000-0x0000000003BBF000-memory.dmp family_redline behavioral1/memory/4076-217-0x0000000003B80000-0x0000000003BBF000-memory.dmp family_redline behavioral1/memory/4076-219-0x0000000003B80000-0x0000000003BBF000-memory.dmp family_redline behavioral1/memory/4076-221-0x0000000003B80000-0x0000000003BBF000-memory.dmp family_redline behavioral1/memory/4076-223-0x0000000003B80000-0x0000000003BBF000-memory.dmp family_redline behavioral1/memory/4076-225-0x0000000003B80000-0x0000000003BBF000-memory.dmp family_redline behavioral1/memory/4076-407-0x0000000006150000-0x0000000006160000-memory.dmp family_redline behavioral1/memory/4076-1109-0x0000000006150000-0x0000000006160000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un284578.exepro9383.exequ7263.exesi115077.exepid process 3540 un284578.exe 4956 pro9383.exe 4076 qu7263.exe 1816 si115077.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro9383.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro9383.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro9383.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
642a66db7c24fcb32ae7e471b5fd55db4c65d24a6e2743ce32ff6727cef796ee.exeun284578.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 642a66db7c24fcb32ae7e471b5fd55db4c65d24a6e2743ce32ff6727cef796ee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 642a66db7c24fcb32ae7e471b5fd55db4c65d24a6e2743ce32ff6727cef796ee.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un284578.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un284578.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 724 4956 WerFault.exe pro9383.exe 4068 4076 WerFault.exe qu7263.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro9383.exequ7263.exesi115077.exepid process 4956 pro9383.exe 4956 pro9383.exe 4076 qu7263.exe 4076 qu7263.exe 1816 si115077.exe 1816 si115077.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro9383.exequ7263.exesi115077.exedescription pid process Token: SeDebugPrivilege 4956 pro9383.exe Token: SeDebugPrivilege 4076 qu7263.exe Token: SeDebugPrivilege 1816 si115077.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
642a66db7c24fcb32ae7e471b5fd55db4c65d24a6e2743ce32ff6727cef796ee.exeun284578.exedescription pid process target process PID 628 wrote to memory of 3540 628 642a66db7c24fcb32ae7e471b5fd55db4c65d24a6e2743ce32ff6727cef796ee.exe un284578.exe PID 628 wrote to memory of 3540 628 642a66db7c24fcb32ae7e471b5fd55db4c65d24a6e2743ce32ff6727cef796ee.exe un284578.exe PID 628 wrote to memory of 3540 628 642a66db7c24fcb32ae7e471b5fd55db4c65d24a6e2743ce32ff6727cef796ee.exe un284578.exe PID 3540 wrote to memory of 4956 3540 un284578.exe pro9383.exe PID 3540 wrote to memory of 4956 3540 un284578.exe pro9383.exe PID 3540 wrote to memory of 4956 3540 un284578.exe pro9383.exe PID 3540 wrote to memory of 4076 3540 un284578.exe qu7263.exe PID 3540 wrote to memory of 4076 3540 un284578.exe qu7263.exe PID 3540 wrote to memory of 4076 3540 un284578.exe qu7263.exe PID 628 wrote to memory of 1816 628 642a66db7c24fcb32ae7e471b5fd55db4c65d24a6e2743ce32ff6727cef796ee.exe si115077.exe PID 628 wrote to memory of 1816 628 642a66db7c24fcb32ae7e471b5fd55db4c65d24a6e2743ce32ff6727cef796ee.exe si115077.exe PID 628 wrote to memory of 1816 628 642a66db7c24fcb32ae7e471b5fd55db4c65d24a6e2743ce32ff6727cef796ee.exe si115077.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\642a66db7c24fcb32ae7e471b5fd55db4c65d24a6e2743ce32ff6727cef796ee.exe"C:\Users\Admin\AppData\Local\Temp\642a66db7c24fcb32ae7e471b5fd55db4c65d24a6e2743ce32ff6727cef796ee.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un284578.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un284578.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9383.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9383.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 10804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7263.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7263.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 13324⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si115077.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si115077.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4956 -ip 49561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4076 -ip 40761⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si115077.exeFilesize
175KB
MD5a4f3f3f913de3bd4a3d8ad4dded8aafc
SHA1fa6c913321125667b3262315ae63d392a3dea6d7
SHA2560e304a00f3d3454edcc2861045a62379bd967f2f6308bdf51e7ed6139dda141a
SHA512caf5a72a9fc828a8f48fe159f5abcd52ce21e187f0280c7f700caf92226b1dadf313a25d4297f6285946b798edff012abdbad145cf0c19b524768c3c814babe1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si115077.exeFilesize
175KB
MD5a4f3f3f913de3bd4a3d8ad4dded8aafc
SHA1fa6c913321125667b3262315ae63d392a3dea6d7
SHA2560e304a00f3d3454edcc2861045a62379bd967f2f6308bdf51e7ed6139dda141a
SHA512caf5a72a9fc828a8f48fe159f5abcd52ce21e187f0280c7f700caf92226b1dadf313a25d4297f6285946b798edff012abdbad145cf0c19b524768c3c814babe1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un284578.exeFilesize
548KB
MD510790a82079d0bcb90d30c09fddccc8a
SHA1c382fbc9ac0476f7812f11c69f43dec35d343081
SHA2565ea2b7c472e22b93b46538b0db220eea843694b27535c44634aaac39f1ab1e06
SHA5129b62b845dd8c2bcab090430a4405a3ac210b273d4e563be201bfedc155ff2e77d9afd38ee2930926a75067539f356b7cd988f2e830fd192659b58c98c58d7e75
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un284578.exeFilesize
548KB
MD510790a82079d0bcb90d30c09fddccc8a
SHA1c382fbc9ac0476f7812f11c69f43dec35d343081
SHA2565ea2b7c472e22b93b46538b0db220eea843694b27535c44634aaac39f1ab1e06
SHA5129b62b845dd8c2bcab090430a4405a3ac210b273d4e563be201bfedc155ff2e77d9afd38ee2930926a75067539f356b7cd988f2e830fd192659b58c98c58d7e75
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9383.exeFilesize
291KB
MD504f9d3db46945770358677a7adba3191
SHA1bea0edee14524a8706a4070ab2ccf93f49e1db77
SHA256fd62c32798e792e894a2dc98f40626cc28222efc3ca6617429805e9db9871c42
SHA5123edc89056ada14eed5acc5cab4157710088b22f0bd89a14246bc8862ad6b50db1207b75e6b10aaa00414273fec736b857fb01cfd001bd2e021fae96ba2e5980f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9383.exeFilesize
291KB
MD504f9d3db46945770358677a7adba3191
SHA1bea0edee14524a8706a4070ab2ccf93f49e1db77
SHA256fd62c32798e792e894a2dc98f40626cc28222efc3ca6617429805e9db9871c42
SHA5123edc89056ada14eed5acc5cab4157710088b22f0bd89a14246bc8862ad6b50db1207b75e6b10aaa00414273fec736b857fb01cfd001bd2e021fae96ba2e5980f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7263.exeFilesize
345KB
MD54065e91a1de72495f872b43f9aac149d
SHA1df363cd6a1d34557882739c583f2363b8041383f
SHA2566875e61dc62825bf5cd9303291987d4dd4cca27f91fe1ea1f0439560170b5732
SHA51264a4069b7f1c5ef5dcc1060a91e4c1da6d00181dfa8970b053f7447712b6fdc8546404506ac852aa13474b3a913bf7f0f25ec455233a6792f9cfad002ec8e73a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7263.exeFilesize
345KB
MD54065e91a1de72495f872b43f9aac149d
SHA1df363cd6a1d34557882739c583f2363b8041383f
SHA2566875e61dc62825bf5cd9303291987d4dd4cca27f91fe1ea1f0439560170b5732
SHA51264a4069b7f1c5ef5dcc1060a91e4c1da6d00181dfa8970b053f7447712b6fdc8546404506ac852aa13474b3a913bf7f0f25ec455233a6792f9cfad002ec8e73a
-
memory/1816-1123-0x0000000005010000-0x0000000005020000-memory.dmpFilesize
64KB
-
memory/1816-1122-0x0000000000750000-0x0000000000782000-memory.dmpFilesize
200KB
-
memory/4076-1102-0x0000000006D30000-0x0000000006E3A000-memory.dmpFilesize
1.0MB
-
memory/4076-1104-0x0000000006E40000-0x0000000006E7C000-memory.dmpFilesize
240KB
-
memory/4076-1116-0x0000000006150000-0x0000000006160000-memory.dmpFilesize
64KB
-
memory/4076-1115-0x00000000082A0000-0x00000000082F0000-memory.dmpFilesize
320KB
-
memory/4076-1114-0x0000000008210000-0x0000000008286000-memory.dmpFilesize
472KB
-
memory/4076-1113-0x0000000007AB0000-0x0000000007FDC000-memory.dmpFilesize
5.2MB
-
memory/4076-1112-0x00000000078E0000-0x0000000007AA2000-memory.dmpFilesize
1.8MB
-
memory/4076-1111-0x0000000006150000-0x0000000006160000-memory.dmpFilesize
64KB
-
memory/4076-1110-0x0000000006150000-0x0000000006160000-memory.dmpFilesize
64KB
-
memory/4076-1109-0x0000000006150000-0x0000000006160000-memory.dmpFilesize
64KB
-
memory/4076-1108-0x00000000077D0000-0x0000000007862000-memory.dmpFilesize
584KB
-
memory/4076-1107-0x0000000007120000-0x0000000007186000-memory.dmpFilesize
408KB
-
memory/4076-1105-0x0000000006150000-0x0000000006160000-memory.dmpFilesize
64KB
-
memory/4076-1103-0x0000000006120000-0x0000000006132000-memory.dmpFilesize
72KB
-
memory/4076-1101-0x0000000006710000-0x0000000006D28000-memory.dmpFilesize
6.1MB
-
memory/4076-407-0x0000000006150000-0x0000000006160000-memory.dmpFilesize
64KB
-
memory/4076-409-0x0000000006150000-0x0000000006160000-memory.dmpFilesize
64KB
-
memory/4076-405-0x0000000006150000-0x0000000006160000-memory.dmpFilesize
64KB
-
memory/4076-225-0x0000000003B80000-0x0000000003BBF000-memory.dmpFilesize
252KB
-
memory/4076-223-0x0000000003B80000-0x0000000003BBF000-memory.dmpFilesize
252KB
-
memory/4076-221-0x0000000003B80000-0x0000000003BBF000-memory.dmpFilesize
252KB
-
memory/4076-191-0x0000000001A30000-0x0000000001A7B000-memory.dmpFilesize
300KB
-
memory/4076-192-0x0000000003B80000-0x0000000003BBF000-memory.dmpFilesize
252KB
-
memory/4076-195-0x0000000003B80000-0x0000000003BBF000-memory.dmpFilesize
252KB
-
memory/4076-193-0x0000000003B80000-0x0000000003BBF000-memory.dmpFilesize
252KB
-
memory/4076-197-0x0000000003B80000-0x0000000003BBF000-memory.dmpFilesize
252KB
-
memory/4076-199-0x0000000003B80000-0x0000000003BBF000-memory.dmpFilesize
252KB
-
memory/4076-201-0x0000000003B80000-0x0000000003BBF000-memory.dmpFilesize
252KB
-
memory/4076-203-0x0000000003B80000-0x0000000003BBF000-memory.dmpFilesize
252KB
-
memory/4076-205-0x0000000003B80000-0x0000000003BBF000-memory.dmpFilesize
252KB
-
memory/4076-207-0x0000000003B80000-0x0000000003BBF000-memory.dmpFilesize
252KB
-
memory/4076-209-0x0000000003B80000-0x0000000003BBF000-memory.dmpFilesize
252KB
-
memory/4076-211-0x0000000003B80000-0x0000000003BBF000-memory.dmpFilesize
252KB
-
memory/4076-213-0x0000000003B80000-0x0000000003BBF000-memory.dmpFilesize
252KB
-
memory/4076-215-0x0000000003B80000-0x0000000003BBF000-memory.dmpFilesize
252KB
-
memory/4076-217-0x0000000003B80000-0x0000000003BBF000-memory.dmpFilesize
252KB
-
memory/4076-219-0x0000000003B80000-0x0000000003BBF000-memory.dmpFilesize
252KB
-
memory/4956-172-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/4956-183-0x0000000004E20000-0x0000000004E30000-memory.dmpFilesize
64KB
-
memory/4956-156-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/4956-185-0x0000000004E20000-0x0000000004E30000-memory.dmpFilesize
64KB
-
memory/4956-174-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/4956-184-0x0000000004E20000-0x0000000004E30000-memory.dmpFilesize
64KB
-
memory/4956-181-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/4956-177-0x00000000007E0000-0x000000000080D000-memory.dmpFilesize
180KB
-
memory/4956-154-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/4956-164-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/4956-160-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/4956-166-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/4956-186-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/4956-162-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/4956-158-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/4956-178-0x0000000004E20000-0x0000000004E30000-memory.dmpFilesize
64KB
-
memory/4956-179-0x0000000004E20000-0x0000000004E30000-memory.dmpFilesize
64KB
-
memory/4956-180-0x0000000004E20000-0x0000000004E30000-memory.dmpFilesize
64KB
-
memory/4956-176-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/4956-170-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/4956-168-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/4956-152-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/4956-150-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/4956-149-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/4956-148-0x0000000004E30000-0x00000000053D4000-memory.dmpFilesize
5.6MB