Analysis
-
max time kernel
61s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 05:09
Static task
static1
Behavioral task
behavioral1
Sample
9efccc5a1b51119545f86773f8b1a2c7e8a62ba1a99382956d9fa140b44d7029.exe
Resource
win10v2004-20230221-en
General
-
Target
9efccc5a1b51119545f86773f8b1a2c7e8a62ba1a99382956d9fa140b44d7029.exe
-
Size
688KB
-
MD5
4851ac3cf7c5d5c81e5ba1a9afe910fb
-
SHA1
db23fd859737d11768fd21c59a5372ebea17da33
-
SHA256
9efccc5a1b51119545f86773f8b1a2c7e8a62ba1a99382956d9fa140b44d7029
-
SHA512
7cc28b18ecb9ed0b272b903e91b8ab27e742d941b1af655511836a6303d27901e4e3291f4496bd9cb57eeefb6beb2fdb3fff475c94471d65294aca8133f83794
-
SSDEEP
12288:5Mr9y90gCViu9ARRczfIk8oHCCym65hLuf/K3vuSYrf2onqmJ4vpF6Lfiggjqa3/:0y2+RcriPtfaf/K/udrfdqmJ4r6LagRS
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Processes:
pro6768.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro6768.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro6768.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro6768.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro6768.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro6768.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro6768.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/2968-191-0x0000000006610000-0x000000000664F000-memory.dmp family_redline behavioral1/memory/2968-190-0x0000000006610000-0x000000000664F000-memory.dmp family_redline behavioral1/memory/2968-195-0x0000000006610000-0x000000000664F000-memory.dmp family_redline behavioral1/memory/2968-193-0x0000000006610000-0x000000000664F000-memory.dmp family_redline behavioral1/memory/2968-198-0x0000000006610000-0x000000000664F000-memory.dmp family_redline behavioral1/memory/2968-203-0x0000000006610000-0x000000000664F000-memory.dmp family_redline behavioral1/memory/2968-205-0x0000000006610000-0x000000000664F000-memory.dmp family_redline behavioral1/memory/2968-207-0x0000000006610000-0x000000000664F000-memory.dmp family_redline behavioral1/memory/2968-209-0x0000000006610000-0x000000000664F000-memory.dmp family_redline behavioral1/memory/2968-211-0x0000000006610000-0x000000000664F000-memory.dmp family_redline behavioral1/memory/2968-213-0x0000000006610000-0x000000000664F000-memory.dmp family_redline behavioral1/memory/2968-215-0x0000000006610000-0x000000000664F000-memory.dmp family_redline behavioral1/memory/2968-217-0x0000000006610000-0x000000000664F000-memory.dmp family_redline behavioral1/memory/2968-219-0x0000000006610000-0x000000000664F000-memory.dmp family_redline behavioral1/memory/2968-221-0x0000000006610000-0x000000000664F000-memory.dmp family_redline behavioral1/memory/2968-223-0x0000000006610000-0x000000000664F000-memory.dmp family_redline behavioral1/memory/2968-225-0x0000000006610000-0x000000000664F000-memory.dmp family_redline behavioral1/memory/2968-227-0x0000000006610000-0x000000000664F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un004323.exepro6768.exequ2654.exesi592415.exepid process 2008 un004323.exe 3968 pro6768.exe 2968 qu2654.exe 3596 si592415.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro6768.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro6768.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro6768.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
9efccc5a1b51119545f86773f8b1a2c7e8a62ba1a99382956d9fa140b44d7029.exeun004323.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 9efccc5a1b51119545f86773f8b1a2c7e8a62ba1a99382956d9fa140b44d7029.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un004323.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un004323.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 9efccc5a1b51119545f86773f8b1a2c7e8a62ba1a99382956d9fa140b44d7029.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3212 3968 WerFault.exe pro6768.exe 2308 2968 WerFault.exe qu2654.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro6768.exequ2654.exesi592415.exepid process 3968 pro6768.exe 3968 pro6768.exe 2968 qu2654.exe 2968 qu2654.exe 3596 si592415.exe 3596 si592415.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro6768.exequ2654.exesi592415.exedescription pid process Token: SeDebugPrivilege 3968 pro6768.exe Token: SeDebugPrivilege 2968 qu2654.exe Token: SeDebugPrivilege 3596 si592415.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
9efccc5a1b51119545f86773f8b1a2c7e8a62ba1a99382956d9fa140b44d7029.exeun004323.exedescription pid process target process PID 4488 wrote to memory of 2008 4488 9efccc5a1b51119545f86773f8b1a2c7e8a62ba1a99382956d9fa140b44d7029.exe un004323.exe PID 4488 wrote to memory of 2008 4488 9efccc5a1b51119545f86773f8b1a2c7e8a62ba1a99382956d9fa140b44d7029.exe un004323.exe PID 4488 wrote to memory of 2008 4488 9efccc5a1b51119545f86773f8b1a2c7e8a62ba1a99382956d9fa140b44d7029.exe un004323.exe PID 2008 wrote to memory of 3968 2008 un004323.exe pro6768.exe PID 2008 wrote to memory of 3968 2008 un004323.exe pro6768.exe PID 2008 wrote to memory of 3968 2008 un004323.exe pro6768.exe PID 2008 wrote to memory of 2968 2008 un004323.exe qu2654.exe PID 2008 wrote to memory of 2968 2008 un004323.exe qu2654.exe PID 2008 wrote to memory of 2968 2008 un004323.exe qu2654.exe PID 4488 wrote to memory of 3596 4488 9efccc5a1b51119545f86773f8b1a2c7e8a62ba1a99382956d9fa140b44d7029.exe si592415.exe PID 4488 wrote to memory of 3596 4488 9efccc5a1b51119545f86773f8b1a2c7e8a62ba1a99382956d9fa140b44d7029.exe si592415.exe PID 4488 wrote to memory of 3596 4488 9efccc5a1b51119545f86773f8b1a2c7e8a62ba1a99382956d9fa140b44d7029.exe si592415.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9efccc5a1b51119545f86773f8b1a2c7e8a62ba1a99382956d9fa140b44d7029.exe"C:\Users\Admin\AppData\Local\Temp\9efccc5a1b51119545f86773f8b1a2c7e8a62ba1a99382956d9fa140b44d7029.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un004323.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un004323.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6768.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6768.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 10844⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2654.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2654.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 13484⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si592415.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si592415.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3968 -ip 39681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2968 -ip 29681⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si592415.exeFilesize
175KB
MD58c0d81ff37fadfabee82ea41752d4f2e
SHA17e7b8e5d336a10cae8bff8f4c4836159179fd197
SHA2564576d4289adb017474474a5eb2da7efb027ae275a7dab91bc6529f2f8cd0acc5
SHA5124b98f44b8bbbdf7d45ad45ad9498fe0918df48f004a1b4dbfbe764037267d0f7651cb05eb5ad00c571dc7d7f6d8476303ede649e2446c84811aa3753e61fb664
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si592415.exeFilesize
175KB
MD58c0d81ff37fadfabee82ea41752d4f2e
SHA17e7b8e5d336a10cae8bff8f4c4836159179fd197
SHA2564576d4289adb017474474a5eb2da7efb027ae275a7dab91bc6529f2f8cd0acc5
SHA5124b98f44b8bbbdf7d45ad45ad9498fe0918df48f004a1b4dbfbe764037267d0f7651cb05eb5ad00c571dc7d7f6d8476303ede649e2446c84811aa3753e61fb664
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un004323.exeFilesize
547KB
MD5daa4bf9c064355aac4df36131ca4b341
SHA125242d26a65620ab18b52c5979638830f42b00fa
SHA2561308d84972cc4744760aaf9e44716ad06ad69dc0568e189d3601ce3800fb226a
SHA5124b756fd4e0f6c852cb210286984c9c6324d3e874f21a086fcce5b8630b746135936cd69e8d586c71ea761a6640167b74f4dc10fd2c78e88b755a8867989bf1a1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un004323.exeFilesize
547KB
MD5daa4bf9c064355aac4df36131ca4b341
SHA125242d26a65620ab18b52c5979638830f42b00fa
SHA2561308d84972cc4744760aaf9e44716ad06ad69dc0568e189d3601ce3800fb226a
SHA5124b756fd4e0f6c852cb210286984c9c6324d3e874f21a086fcce5b8630b746135936cd69e8d586c71ea761a6640167b74f4dc10fd2c78e88b755a8867989bf1a1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6768.exeFilesize
291KB
MD50e90fa4345d5a06a631ac0eddca5e0e4
SHA16bc1e2307258231e9c70c1790b846c896c34d954
SHA25610eb67193f3664b6df7cd8318e2d2981e1f42a122fbfe5e16149d9b5254674fc
SHA5120723110abb4af1b4c4eb3909ecb7af3bfcf215f19a380ad9e150b753ee97454df77a7f8b782d9da5c4dce1153d27112242fc86963c346a02e26156dbd7f22821
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6768.exeFilesize
291KB
MD50e90fa4345d5a06a631ac0eddca5e0e4
SHA16bc1e2307258231e9c70c1790b846c896c34d954
SHA25610eb67193f3664b6df7cd8318e2d2981e1f42a122fbfe5e16149d9b5254674fc
SHA5120723110abb4af1b4c4eb3909ecb7af3bfcf215f19a380ad9e150b753ee97454df77a7f8b782d9da5c4dce1153d27112242fc86963c346a02e26156dbd7f22821
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2654.exeFilesize
345KB
MD55a41715ac3e8d83d206adec99cf0abf7
SHA10f8424215ec72ee6cb88e6c8fcc004c257a102f5
SHA256c715f41d08c9666cab1670088dba705427ad86ad39a4c181fac43f974778bb7a
SHA512c79ede79b9243dda9f928b8223f6dc5114aaef2d95c97981539572d8ba7e3968ec4bf00f3b1887e12128a4ccf62d672607b3f6953db5061b02a3c02da4ec374f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2654.exeFilesize
345KB
MD55a41715ac3e8d83d206adec99cf0abf7
SHA10f8424215ec72ee6cb88e6c8fcc004c257a102f5
SHA256c715f41d08c9666cab1670088dba705427ad86ad39a4c181fac43f974778bb7a
SHA512c79ede79b9243dda9f928b8223f6dc5114aaef2d95c97981539572d8ba7e3968ec4bf00f3b1887e12128a4ccf62d672607b3f6953db5061b02a3c02da4ec374f
-
memory/2968-227-0x0000000006610000-0x000000000664F000-memory.dmpFilesize
252KB
-
memory/2968-1102-0x0000000006E10000-0x0000000006E22000-memory.dmpFilesize
72KB
-
memory/2968-1114-0x0000000007F50000-0x000000000847C000-memory.dmpFilesize
5.2MB
-
memory/2968-1113-0x0000000007D80000-0x0000000007F42000-memory.dmpFilesize
1.8MB
-
memory/2968-1112-0x0000000007A70000-0x0000000007AC0000-memory.dmpFilesize
320KB
-
memory/2968-1111-0x00000000079E0000-0x0000000007A56000-memory.dmpFilesize
472KB
-
memory/2968-1110-0x00000000038E0000-0x00000000038F0000-memory.dmpFilesize
64KB
-
memory/2968-1109-0x00000000038E0000-0x00000000038F0000-memory.dmpFilesize
64KB
-
memory/2968-1108-0x00000000038E0000-0x00000000038F0000-memory.dmpFilesize
64KB
-
memory/2968-1106-0x00000000071C0000-0x0000000007226000-memory.dmpFilesize
408KB
-
memory/2968-1105-0x0000000007120000-0x00000000071B2000-memory.dmpFilesize
584KB
-
memory/2968-1104-0x00000000038E0000-0x00000000038F0000-memory.dmpFilesize
64KB
-
memory/2968-1103-0x0000000006E30000-0x0000000006E6C000-memory.dmpFilesize
240KB
-
memory/2968-1101-0x0000000006CD0000-0x0000000006DDA000-memory.dmpFilesize
1.0MB
-
memory/2968-1100-0x0000000006650000-0x0000000006C68000-memory.dmpFilesize
6.1MB
-
memory/2968-225-0x0000000006610000-0x000000000664F000-memory.dmpFilesize
252KB
-
memory/2968-223-0x0000000006610000-0x000000000664F000-memory.dmpFilesize
252KB
-
memory/2968-221-0x0000000006610000-0x000000000664F000-memory.dmpFilesize
252KB
-
memory/2968-219-0x0000000006610000-0x000000000664F000-memory.dmpFilesize
252KB
-
memory/2968-217-0x0000000006610000-0x000000000664F000-memory.dmpFilesize
252KB
-
memory/2968-215-0x0000000006610000-0x000000000664F000-memory.dmpFilesize
252KB
-
memory/2968-213-0x0000000006610000-0x000000000664F000-memory.dmpFilesize
252KB
-
memory/2968-191-0x0000000006610000-0x000000000664F000-memory.dmpFilesize
252KB
-
memory/2968-190-0x0000000006610000-0x000000000664F000-memory.dmpFilesize
252KB
-
memory/2968-195-0x0000000006610000-0x000000000664F000-memory.dmpFilesize
252KB
-
memory/2968-193-0x0000000006610000-0x000000000664F000-memory.dmpFilesize
252KB
-
memory/2968-197-0x0000000001B00000-0x0000000001B4B000-memory.dmpFilesize
300KB
-
memory/2968-199-0x00000000038E0000-0x00000000038F0000-memory.dmpFilesize
64KB
-
memory/2968-200-0x00000000038E0000-0x00000000038F0000-memory.dmpFilesize
64KB
-
memory/2968-202-0x00000000038E0000-0x00000000038F0000-memory.dmpFilesize
64KB
-
memory/2968-198-0x0000000006610000-0x000000000664F000-memory.dmpFilesize
252KB
-
memory/2968-203-0x0000000006610000-0x000000000664F000-memory.dmpFilesize
252KB
-
memory/2968-205-0x0000000006610000-0x000000000664F000-memory.dmpFilesize
252KB
-
memory/2968-207-0x0000000006610000-0x000000000664F000-memory.dmpFilesize
252KB
-
memory/2968-209-0x0000000006610000-0x000000000664F000-memory.dmpFilesize
252KB
-
memory/2968-211-0x0000000006610000-0x000000000664F000-memory.dmpFilesize
252KB
-
memory/3596-1120-0x0000000000390000-0x00000000003C2000-memory.dmpFilesize
200KB
-
memory/3596-1121-0x0000000004F40000-0x0000000004F50000-memory.dmpFilesize
64KB
-
memory/3968-170-0x00000000026D0000-0x00000000026E2000-memory.dmpFilesize
72KB
-
memory/3968-148-0x0000000004D10000-0x00000000052B4000-memory.dmpFilesize
5.6MB
-
memory/3968-182-0x0000000002770000-0x0000000002780000-memory.dmpFilesize
64KB
-
memory/3968-181-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/3968-180-0x00000000026D0000-0x00000000026E2000-memory.dmpFilesize
72KB
-
memory/3968-151-0x0000000002770000-0x0000000002780000-memory.dmpFilesize
64KB
-
memory/3968-178-0x00000000026D0000-0x00000000026E2000-memory.dmpFilesize
72KB
-
memory/3968-176-0x00000000026D0000-0x00000000026E2000-memory.dmpFilesize
72KB
-
memory/3968-153-0x00000000026D0000-0x00000000026E2000-memory.dmpFilesize
72KB
-
memory/3968-174-0x00000000026D0000-0x00000000026E2000-memory.dmpFilesize
72KB
-
memory/3968-152-0x0000000002770000-0x0000000002780000-memory.dmpFilesize
64KB
-
memory/3968-183-0x0000000002770000-0x0000000002780000-memory.dmpFilesize
64KB
-
memory/3968-164-0x00000000026D0000-0x00000000026E2000-memory.dmpFilesize
72KB
-
memory/3968-166-0x00000000026D0000-0x00000000026E2000-memory.dmpFilesize
72KB
-
memory/3968-168-0x00000000026D0000-0x00000000026E2000-memory.dmpFilesize
72KB
-
memory/3968-162-0x00000000026D0000-0x00000000026E2000-memory.dmpFilesize
72KB
-
memory/3968-160-0x00000000026D0000-0x00000000026E2000-memory.dmpFilesize
72KB
-
memory/3968-158-0x00000000026D0000-0x00000000026E2000-memory.dmpFilesize
72KB
-
memory/3968-154-0x00000000026D0000-0x00000000026E2000-memory.dmpFilesize
72KB
-
memory/3968-156-0x00000000026D0000-0x00000000026E2000-memory.dmpFilesize
72KB
-
memory/3968-149-0x0000000000710000-0x000000000073D000-memory.dmpFilesize
180KB
-
memory/3968-172-0x00000000026D0000-0x00000000026E2000-memory.dmpFilesize
72KB
-
memory/3968-185-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/3968-150-0x0000000002770000-0x0000000002780000-memory.dmpFilesize
64KB