Analysis
-
max time kernel
146s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 04:46
Static task
static1
Behavioral task
behavioral1
Sample
16db77f8a1d54f5969fb9947ec3935edb3fa00addbb2cb12b94ccc6c9558ec17.exe
Resource
win10v2004-20230220-en
General
-
Target
16db77f8a1d54f5969fb9947ec3935edb3fa00addbb2cb12b94ccc6c9558ec17.exe
-
Size
690KB
-
MD5
988dc6419a5dff92474702da7cbdb583
-
SHA1
e1897100f73662c1a18dd56dbc3f319a8cab31f8
-
SHA256
16db77f8a1d54f5969fb9947ec3935edb3fa00addbb2cb12b94ccc6c9558ec17
-
SHA512
ffd418f6e0f787fd97f4b43d8c301bae5eb29fff68b6c226ce353bc600b0d233ff2c6993c3b67c9c56a1b3277389a0276f38cfcbfbcd3f85092279ab125c7b9f
-
SSDEEP
12288:xMrMy90Coem+Mu+/9kAThumdYfEfK1hil490PezWk1vWFFffigjBt3IJf5QUMh:pyTt5MjvhBdiYSilyt1yFfagjjYLM
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Processes:
pro7682.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro7682.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro7682.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro7682.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro7682.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro7682.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro7682.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/536-191-0x0000000003B90000-0x0000000003BCF000-memory.dmp family_redline behavioral1/memory/536-192-0x0000000003B90000-0x0000000003BCF000-memory.dmp family_redline behavioral1/memory/536-194-0x0000000003B90000-0x0000000003BCF000-memory.dmp family_redline behavioral1/memory/536-196-0x0000000003B90000-0x0000000003BCF000-memory.dmp family_redline behavioral1/memory/536-198-0x0000000003B90000-0x0000000003BCF000-memory.dmp family_redline behavioral1/memory/536-200-0x0000000003B90000-0x0000000003BCF000-memory.dmp family_redline behavioral1/memory/536-202-0x0000000003B90000-0x0000000003BCF000-memory.dmp family_redline behavioral1/memory/536-204-0x0000000003B90000-0x0000000003BCF000-memory.dmp family_redline behavioral1/memory/536-206-0x0000000003B90000-0x0000000003BCF000-memory.dmp family_redline behavioral1/memory/536-208-0x0000000003B90000-0x0000000003BCF000-memory.dmp family_redline behavioral1/memory/536-210-0x0000000003B90000-0x0000000003BCF000-memory.dmp family_redline behavioral1/memory/536-214-0x0000000003B90000-0x0000000003BCF000-memory.dmp family_redline behavioral1/memory/536-212-0x0000000003B90000-0x0000000003BCF000-memory.dmp family_redline behavioral1/memory/536-216-0x0000000003B90000-0x0000000003BCF000-memory.dmp family_redline behavioral1/memory/536-218-0x0000000003B90000-0x0000000003BCF000-memory.dmp family_redline behavioral1/memory/536-220-0x0000000003B90000-0x0000000003BCF000-memory.dmp family_redline behavioral1/memory/536-222-0x0000000003B90000-0x0000000003BCF000-memory.dmp family_redline behavioral1/memory/536-224-0x0000000003B90000-0x0000000003BCF000-memory.dmp family_redline behavioral1/memory/536-1113-0x0000000006150000-0x0000000006160000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un166658.exepro7682.exequ5462.exesi129957.exepid process 3932 un166658.exe 3344 pro7682.exe 536 qu5462.exe 3196 si129957.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro7682.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro7682.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro7682.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
16db77f8a1d54f5969fb9947ec3935edb3fa00addbb2cb12b94ccc6c9558ec17.exeun166658.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 16db77f8a1d54f5969fb9947ec3935edb3fa00addbb2cb12b94ccc6c9558ec17.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 16db77f8a1d54f5969fb9947ec3935edb3fa00addbb2cb12b94ccc6c9558ec17.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un166658.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un166658.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 116 sc.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4544 3344 WerFault.exe pro7682.exe 540 536 WerFault.exe qu5462.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro7682.exequ5462.exesi129957.exepid process 3344 pro7682.exe 3344 pro7682.exe 536 qu5462.exe 536 qu5462.exe 3196 si129957.exe 3196 si129957.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro7682.exequ5462.exesi129957.exedescription pid process Token: SeDebugPrivilege 3344 pro7682.exe Token: SeDebugPrivilege 536 qu5462.exe Token: SeDebugPrivilege 3196 si129957.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
16db77f8a1d54f5969fb9947ec3935edb3fa00addbb2cb12b94ccc6c9558ec17.exeun166658.exedescription pid process target process PID 2028 wrote to memory of 3932 2028 16db77f8a1d54f5969fb9947ec3935edb3fa00addbb2cb12b94ccc6c9558ec17.exe un166658.exe PID 2028 wrote to memory of 3932 2028 16db77f8a1d54f5969fb9947ec3935edb3fa00addbb2cb12b94ccc6c9558ec17.exe un166658.exe PID 2028 wrote to memory of 3932 2028 16db77f8a1d54f5969fb9947ec3935edb3fa00addbb2cb12b94ccc6c9558ec17.exe un166658.exe PID 3932 wrote to memory of 3344 3932 un166658.exe pro7682.exe PID 3932 wrote to memory of 3344 3932 un166658.exe pro7682.exe PID 3932 wrote to memory of 3344 3932 un166658.exe pro7682.exe PID 3932 wrote to memory of 536 3932 un166658.exe qu5462.exe PID 3932 wrote to memory of 536 3932 un166658.exe qu5462.exe PID 3932 wrote to memory of 536 3932 un166658.exe qu5462.exe PID 2028 wrote to memory of 3196 2028 16db77f8a1d54f5969fb9947ec3935edb3fa00addbb2cb12b94ccc6c9558ec17.exe si129957.exe PID 2028 wrote to memory of 3196 2028 16db77f8a1d54f5969fb9947ec3935edb3fa00addbb2cb12b94ccc6c9558ec17.exe si129957.exe PID 2028 wrote to memory of 3196 2028 16db77f8a1d54f5969fb9947ec3935edb3fa00addbb2cb12b94ccc6c9558ec17.exe si129957.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\16db77f8a1d54f5969fb9947ec3935edb3fa00addbb2cb12b94ccc6c9558ec17.exe"C:\Users\Admin\AppData\Local\Temp\16db77f8a1d54f5969fb9947ec3935edb3fa00addbb2cb12b94ccc6c9558ec17.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un166658.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un166658.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7682.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7682.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 10844⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5462.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5462.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 18684⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si129957.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si129957.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3344 -ip 33441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 536 -ip 5361⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si129957.exeFilesize
175KB
MD597b2541170dc81e09639c60dca27be52
SHA164d95e1dfb3f73ff521e03e256ea6cb2462a93da
SHA256f744755df69a3929b7c25c3851a029ffe61990bb36c6e52d2095865481f44752
SHA512bb5df8ca04721c9e29301e1f8da0eeb16fbfe3218a6eccf8cafb0645a001000069961ec636c900ce8670864793f97a8885cfc08b70f63eb41f26bf91cf4c3510
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si129957.exeFilesize
175KB
MD597b2541170dc81e09639c60dca27be52
SHA164d95e1dfb3f73ff521e03e256ea6cb2462a93da
SHA256f744755df69a3929b7c25c3851a029ffe61990bb36c6e52d2095865481f44752
SHA512bb5df8ca04721c9e29301e1f8da0eeb16fbfe3218a6eccf8cafb0645a001000069961ec636c900ce8670864793f97a8885cfc08b70f63eb41f26bf91cf4c3510
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un166658.exeFilesize
548KB
MD582963cc56a16c0663adc947c907d9191
SHA13e066147cedb92322f1828efa9595c69a9836b92
SHA256155797a0362a19599af17caab0fc4bf5caf5a95824bd5486df8d8ed7148d41fd
SHA512b8c1fed1cb78948bf532a9f4bd352299177b4d6a7da6a9e6e2989300a12c4890e670469a473ac4cc7f363c52b008a9b2624e1e3441654657c31f313baa6d202f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un166658.exeFilesize
548KB
MD582963cc56a16c0663adc947c907d9191
SHA13e066147cedb92322f1828efa9595c69a9836b92
SHA256155797a0362a19599af17caab0fc4bf5caf5a95824bd5486df8d8ed7148d41fd
SHA512b8c1fed1cb78948bf532a9f4bd352299177b4d6a7da6a9e6e2989300a12c4890e670469a473ac4cc7f363c52b008a9b2624e1e3441654657c31f313baa6d202f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7682.exeFilesize
291KB
MD5949acc00ba0539cf8c559ab4805778c7
SHA151da9461304b43fca1e34f9cca71a272d7ffa913
SHA25626e7c5ccc781a23b93d2ce5de7f6aeab9031f4f433a51e9d63fbc057ff5959ad
SHA51214e93ebd523915efd1cbf9dccad09150c41d89c7a229bc046cd07e71f728b0be34014f6a5d5d2b7746f810fbd295c763335f92e2d41b465a1bb85522ec63b2a3
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7682.exeFilesize
291KB
MD5949acc00ba0539cf8c559ab4805778c7
SHA151da9461304b43fca1e34f9cca71a272d7ffa913
SHA25626e7c5ccc781a23b93d2ce5de7f6aeab9031f4f433a51e9d63fbc057ff5959ad
SHA51214e93ebd523915efd1cbf9dccad09150c41d89c7a229bc046cd07e71f728b0be34014f6a5d5d2b7746f810fbd295c763335f92e2d41b465a1bb85522ec63b2a3
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5462.exeFilesize
345KB
MD56b2fe02507aeb07c18e1e1fbc729213d
SHA1b9b6115a657869346897eb6312f7e77d998413f6
SHA256f8953a6459a1cedf68a813e565cfa4652ca909927241a77e7101da6abc156463
SHA5122f8e6b8d96a0b6ff429870d782dfc1b326c7f5ecb2c81b5fd993ccdea441a1fe4252a783dd3da901525b29fdee6bedda19b048e341b1cbe51c9aba9ade1c30e8
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5462.exeFilesize
345KB
MD56b2fe02507aeb07c18e1e1fbc729213d
SHA1b9b6115a657869346897eb6312f7e77d998413f6
SHA256f8953a6459a1cedf68a813e565cfa4652ca909927241a77e7101da6abc156463
SHA5122f8e6b8d96a0b6ff429870d782dfc1b326c7f5ecb2c81b5fd993ccdea441a1fe4252a783dd3da901525b29fdee6bedda19b048e341b1cbe51c9aba9ade1c30e8
-
memory/536-1102-0x0000000006E30000-0x0000000006F3A000-memory.dmpFilesize
1.0MB
-
memory/536-1101-0x0000000006810000-0x0000000006E28000-memory.dmpFilesize
6.1MB
-
memory/536-220-0x0000000003B90000-0x0000000003BCF000-memory.dmpFilesize
252KB
-
memory/536-218-0x0000000003B90000-0x0000000003BCF000-memory.dmpFilesize
252KB
-
memory/536-204-0x0000000003B90000-0x0000000003BCF000-memory.dmpFilesize
252KB
-
memory/536-206-0x0000000003B90000-0x0000000003BCF000-memory.dmpFilesize
252KB
-
memory/536-1115-0x0000000007D50000-0x0000000007F12000-memory.dmpFilesize
1.8MB
-
memory/536-1114-0x0000000006150000-0x0000000006160000-memory.dmpFilesize
64KB
-
memory/536-1113-0x0000000006150000-0x0000000006160000-memory.dmpFilesize
64KB
-
memory/536-1112-0x0000000006150000-0x0000000006160000-memory.dmpFilesize
64KB
-
memory/536-208-0x0000000003B90000-0x0000000003BCF000-memory.dmpFilesize
252KB
-
memory/536-1111-0x0000000006150000-0x0000000006160000-memory.dmpFilesize
64KB
-
memory/536-1109-0x0000000007A90000-0x0000000007AE0000-memory.dmpFilesize
320KB
-
memory/536-1108-0x0000000007A00000-0x0000000007A76000-memory.dmpFilesize
472KB
-
memory/536-1107-0x0000000007910000-0x00000000079A2000-memory.dmpFilesize
584KB
-
memory/536-1106-0x0000000007260000-0x00000000072C6000-memory.dmpFilesize
408KB
-
memory/536-1105-0x0000000006150000-0x0000000006160000-memory.dmpFilesize
64KB
-
memory/536-1104-0x0000000006FB0000-0x0000000006FEC000-memory.dmpFilesize
240KB
-
memory/536-1103-0x0000000006F50000-0x0000000006F62000-memory.dmpFilesize
72KB
-
memory/536-222-0x0000000003B90000-0x0000000003BCF000-memory.dmpFilesize
252KB
-
memory/536-485-0x0000000006150000-0x0000000006160000-memory.dmpFilesize
64KB
-
memory/536-487-0x0000000006150000-0x0000000006160000-memory.dmpFilesize
64KB
-
memory/536-482-0x0000000001B00000-0x0000000001B4B000-memory.dmpFilesize
300KB
-
memory/536-191-0x0000000003B90000-0x0000000003BCF000-memory.dmpFilesize
252KB
-
memory/536-192-0x0000000003B90000-0x0000000003BCF000-memory.dmpFilesize
252KB
-
memory/536-194-0x0000000003B90000-0x0000000003BCF000-memory.dmpFilesize
252KB
-
memory/536-196-0x0000000003B90000-0x0000000003BCF000-memory.dmpFilesize
252KB
-
memory/536-198-0x0000000003B90000-0x0000000003BCF000-memory.dmpFilesize
252KB
-
memory/536-200-0x0000000003B90000-0x0000000003BCF000-memory.dmpFilesize
252KB
-
memory/536-202-0x0000000003B90000-0x0000000003BCF000-memory.dmpFilesize
252KB
-
memory/536-483-0x0000000006150000-0x0000000006160000-memory.dmpFilesize
64KB
-
memory/536-1116-0x0000000007F30000-0x000000000845C000-memory.dmpFilesize
5.2MB
-
memory/536-224-0x0000000003B90000-0x0000000003BCF000-memory.dmpFilesize
252KB
-
memory/536-210-0x0000000003B90000-0x0000000003BCF000-memory.dmpFilesize
252KB
-
memory/536-214-0x0000000003B90000-0x0000000003BCF000-memory.dmpFilesize
252KB
-
memory/536-212-0x0000000003B90000-0x0000000003BCF000-memory.dmpFilesize
252KB
-
memory/536-216-0x0000000003B90000-0x0000000003BCF000-memory.dmpFilesize
252KB
-
memory/3196-1122-0x0000000000F20000-0x0000000000F52000-memory.dmpFilesize
200KB
-
memory/3196-1123-0x00000000057E0000-0x00000000057F0000-memory.dmpFilesize
64KB
-
memory/3344-181-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/3344-170-0x0000000002550000-0x0000000002562000-memory.dmpFilesize
72KB
-
memory/3344-148-0x00000000009A0000-0x00000000009CD000-memory.dmpFilesize
180KB
-
memory/3344-151-0x0000000002530000-0x0000000002540000-memory.dmpFilesize
64KB
-
memory/3344-152-0x0000000004EA0000-0x0000000005444000-memory.dmpFilesize
5.6MB
-
memory/3344-186-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/3344-184-0x0000000002530000-0x0000000002540000-memory.dmpFilesize
64KB
-
memory/3344-150-0x0000000002530000-0x0000000002540000-memory.dmpFilesize
64KB
-
memory/3344-183-0x0000000002530000-0x0000000002540000-memory.dmpFilesize
64KB
-
memory/3344-182-0x0000000002530000-0x0000000002540000-memory.dmpFilesize
64KB
-
memory/3344-153-0x0000000002550000-0x0000000002562000-memory.dmpFilesize
72KB
-
memory/3344-180-0x0000000002550000-0x0000000002562000-memory.dmpFilesize
72KB
-
memory/3344-178-0x0000000002550000-0x0000000002562000-memory.dmpFilesize
72KB
-
memory/3344-176-0x0000000002550000-0x0000000002562000-memory.dmpFilesize
72KB
-
memory/3344-174-0x0000000002550000-0x0000000002562000-memory.dmpFilesize
72KB
-
memory/3344-172-0x0000000002550000-0x0000000002562000-memory.dmpFilesize
72KB
-
memory/3344-168-0x0000000002550000-0x0000000002562000-memory.dmpFilesize
72KB
-
memory/3344-166-0x0000000002550000-0x0000000002562000-memory.dmpFilesize
72KB
-
memory/3344-164-0x0000000002550000-0x0000000002562000-memory.dmpFilesize
72KB
-
memory/3344-162-0x0000000002550000-0x0000000002562000-memory.dmpFilesize
72KB
-
memory/3344-160-0x0000000002550000-0x0000000002562000-memory.dmpFilesize
72KB
-
memory/3344-149-0x0000000002530000-0x0000000002540000-memory.dmpFilesize
64KB
-
memory/3344-158-0x0000000002550000-0x0000000002562000-memory.dmpFilesize
72KB
-
memory/3344-156-0x0000000002550000-0x0000000002562000-memory.dmpFilesize
72KB
-
memory/3344-154-0x0000000002550000-0x0000000002562000-memory.dmpFilesize
72KB