Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
28-03-2023 06:03
Static task
static1
Behavioral task
behavioral1
Sample
7d4fa844155e60239786e2c477c6c2277393480def52b1ebe9a4688bb8c73053.exe
Resource
win10-20230220-en
General
-
Target
7d4fa844155e60239786e2c477c6c2277393480def52b1ebe9a4688bb8c73053.exe
-
Size
683KB
-
MD5
14a07da4fdfcda28bf04c32e27e40999
-
SHA1
c962b01c7ec653969b14942b2290a998036065b7
-
SHA256
7d4fa844155e60239786e2c477c6c2277393480def52b1ebe9a4688bb8c73053
-
SHA512
78a00b207ce8a1703e8dfbe8f2b782fc5fd73d61436f35ad8c6ef9b6e84d4fa5837e713e84d945accfdc53830768eeaeaf8b01914f8fdcc4dd99bdd4293e7ed0
-
SSDEEP
12288:IMriy9013hfcyXMYXqN5Ub56KldrB0zNEAfykk858VF4AWIhAqc+05:qyqwNaUKLrBDAfyi58VuAAc05
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Processes:
pro2387.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro2387.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro2387.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro2387.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro2387.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro2387.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/5064-181-0x00000000048F0000-0x0000000004936000-memory.dmp family_redline behavioral1/memory/5064-182-0x0000000004C10000-0x0000000004C54000-memory.dmp family_redline behavioral1/memory/5064-183-0x0000000004C10000-0x0000000004C4F000-memory.dmp family_redline behavioral1/memory/5064-185-0x0000000004C10000-0x0000000004C4F000-memory.dmp family_redline behavioral1/memory/5064-188-0x0000000004C10000-0x0000000004C4F000-memory.dmp family_redline behavioral1/memory/5064-192-0x0000000004C10000-0x0000000004C4F000-memory.dmp family_redline behavioral1/memory/5064-194-0x0000000004C10000-0x0000000004C4F000-memory.dmp family_redline behavioral1/memory/5064-196-0x0000000004C10000-0x0000000004C4F000-memory.dmp family_redline behavioral1/memory/5064-198-0x0000000004C10000-0x0000000004C4F000-memory.dmp family_redline behavioral1/memory/5064-200-0x0000000004C10000-0x0000000004C4F000-memory.dmp family_redline behavioral1/memory/5064-202-0x0000000004C10000-0x0000000004C4F000-memory.dmp family_redline behavioral1/memory/5064-204-0x0000000004C10000-0x0000000004C4F000-memory.dmp family_redline behavioral1/memory/5064-206-0x0000000004C10000-0x0000000004C4F000-memory.dmp family_redline behavioral1/memory/5064-208-0x0000000004C10000-0x0000000004C4F000-memory.dmp family_redline behavioral1/memory/5064-212-0x0000000004C10000-0x0000000004C4F000-memory.dmp family_redline behavioral1/memory/5064-210-0x0000000004C10000-0x0000000004C4F000-memory.dmp family_redline behavioral1/memory/5064-214-0x0000000004C10000-0x0000000004C4F000-memory.dmp family_redline behavioral1/memory/5064-216-0x0000000004C10000-0x0000000004C4F000-memory.dmp family_redline behavioral1/memory/5064-218-0x0000000004C10000-0x0000000004C4F000-memory.dmp family_redline behavioral1/memory/5064-220-0x0000000004C10000-0x0000000004C4F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un899522.exepro2387.exequ6484.exesi020865.exepid process 1868 un899522.exe 2088 pro2387.exe 5064 qu6484.exe 1212 si020865.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro2387.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro2387.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro2387.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un899522.exe7d4fa844155e60239786e2c477c6c2277393480def52b1ebe9a4688bb8c73053.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un899522.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 7d4fa844155e60239786e2c477c6c2277393480def52b1ebe9a4688bb8c73053.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 7d4fa844155e60239786e2c477c6c2277393480def52b1ebe9a4688bb8c73053.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un899522.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro2387.exequ6484.exesi020865.exepid process 2088 pro2387.exe 2088 pro2387.exe 5064 qu6484.exe 5064 qu6484.exe 1212 si020865.exe 1212 si020865.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro2387.exequ6484.exesi020865.exedescription pid process Token: SeDebugPrivilege 2088 pro2387.exe Token: SeDebugPrivilege 5064 qu6484.exe Token: SeDebugPrivilege 1212 si020865.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
7d4fa844155e60239786e2c477c6c2277393480def52b1ebe9a4688bb8c73053.exeun899522.exedescription pid process target process PID 1680 wrote to memory of 1868 1680 7d4fa844155e60239786e2c477c6c2277393480def52b1ebe9a4688bb8c73053.exe un899522.exe PID 1680 wrote to memory of 1868 1680 7d4fa844155e60239786e2c477c6c2277393480def52b1ebe9a4688bb8c73053.exe un899522.exe PID 1680 wrote to memory of 1868 1680 7d4fa844155e60239786e2c477c6c2277393480def52b1ebe9a4688bb8c73053.exe un899522.exe PID 1868 wrote to memory of 2088 1868 un899522.exe pro2387.exe PID 1868 wrote to memory of 2088 1868 un899522.exe pro2387.exe PID 1868 wrote to memory of 2088 1868 un899522.exe pro2387.exe PID 1868 wrote to memory of 5064 1868 un899522.exe qu6484.exe PID 1868 wrote to memory of 5064 1868 un899522.exe qu6484.exe PID 1868 wrote to memory of 5064 1868 un899522.exe qu6484.exe PID 1680 wrote to memory of 1212 1680 7d4fa844155e60239786e2c477c6c2277393480def52b1ebe9a4688bb8c73053.exe si020865.exe PID 1680 wrote to memory of 1212 1680 7d4fa844155e60239786e2c477c6c2277393480def52b1ebe9a4688bb8c73053.exe si020865.exe PID 1680 wrote to memory of 1212 1680 7d4fa844155e60239786e2c477c6c2277393480def52b1ebe9a4688bb8c73053.exe si020865.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d4fa844155e60239786e2c477c6c2277393480def52b1ebe9a4688bb8c73053.exe"C:\Users\Admin\AppData\Local\Temp\7d4fa844155e60239786e2c477c6c2277393480def52b1ebe9a4688bb8c73053.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un899522.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un899522.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2387.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2387.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6484.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6484.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si020865.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si020865.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si020865.exeFilesize
175KB
MD5b704ff53a1823dad9ff67c268c7d109f
SHA12a7b16f943866691b428ec10e29f537261ac222c
SHA256ae140662353cf65f4548938f0ffc4bd9c83d86056f10724b4c6c0b6ff52b8645
SHA512857b9777d5a6068bf0760f387843b6ae998770be77d09c4c663d7b8309ac1944c744d0119069811787cb8101d3a9a794252ca9fae53f63057ebe1083909f5fee
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si020865.exeFilesize
175KB
MD5b704ff53a1823dad9ff67c268c7d109f
SHA12a7b16f943866691b428ec10e29f537261ac222c
SHA256ae140662353cf65f4548938f0ffc4bd9c83d86056f10724b4c6c0b6ff52b8645
SHA512857b9777d5a6068bf0760f387843b6ae998770be77d09c4c663d7b8309ac1944c744d0119069811787cb8101d3a9a794252ca9fae53f63057ebe1083909f5fee
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un899522.exeFilesize
541KB
MD5f061179255544b997bad91983ed7769e
SHA164988c1dac1d37b0f72446e519a51e9ed192a13a
SHA256cf2f8a4986b76be8e9334745c1b17d14c90d9af24c3d07fb685ebfff026768e5
SHA5129345fb550556ab0535af37dacb395c3a22dc9e896a67729654c90d8ab680ba284f10e6b4c6f1a3a4e627b52ec7776794b07e13cb55652d7d1d926336e0270ffc
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un899522.exeFilesize
541KB
MD5f061179255544b997bad91983ed7769e
SHA164988c1dac1d37b0f72446e519a51e9ed192a13a
SHA256cf2f8a4986b76be8e9334745c1b17d14c90d9af24c3d07fb685ebfff026768e5
SHA5129345fb550556ab0535af37dacb395c3a22dc9e896a67729654c90d8ab680ba284f10e6b4c6f1a3a4e627b52ec7776794b07e13cb55652d7d1d926336e0270ffc
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2387.exeFilesize
322KB
MD549548077906b5c8ef9b698a20db5e411
SHA1e3ca1cbb7fe4f63466a931cdf9cd17e21a586b8a
SHA256473ceafc469c9dbdaf6896d2f3d4be7a1a17915c52683cc465daa9ca1e753cc8
SHA512a2cc31958fe98f141b117d037a0979f838938a5288c44b6a2b2ed71e365319c7963f97b132cf1d9d6aedc38e59a1d527bf0c76e19796d6b765fc905e60429350
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2387.exeFilesize
322KB
MD549548077906b5c8ef9b698a20db5e411
SHA1e3ca1cbb7fe4f63466a931cdf9cd17e21a586b8a
SHA256473ceafc469c9dbdaf6896d2f3d4be7a1a17915c52683cc465daa9ca1e753cc8
SHA512a2cc31958fe98f141b117d037a0979f838938a5288c44b6a2b2ed71e365319c7963f97b132cf1d9d6aedc38e59a1d527bf0c76e19796d6b765fc905e60429350
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6484.exeFilesize
379KB
MD5e96f45fb0825953260e6da4af7aac9d5
SHA1541950d2fefccc6f73937f43c74c908bb638f1b6
SHA25699b77bc1f852d46c920b80a61795e68211b292888e8e915b237486ccd40cf36b
SHA51230c39ad78ce06cb046fa4b7ca36bad4958aeb595b19ab060db7898948e24c0dedf040dc65d06f5e7dcc3931350e8cb01ca82c9594659b2d0e2bf9c812a2b854c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6484.exeFilesize
379KB
MD5e96f45fb0825953260e6da4af7aac9d5
SHA1541950d2fefccc6f73937f43c74c908bb638f1b6
SHA25699b77bc1f852d46c920b80a61795e68211b292888e8e915b237486ccd40cf36b
SHA51230c39ad78ce06cb046fa4b7ca36bad4958aeb595b19ab060db7898948e24c0dedf040dc65d06f5e7dcc3931350e8cb01ca82c9594659b2d0e2bf9c812a2b854c
-
memory/1212-1115-0x0000000000970000-0x00000000009A2000-memory.dmpFilesize
200KB
-
memory/1212-1116-0x0000000005520000-0x0000000005530000-memory.dmpFilesize
64KB
-
memory/1212-1117-0x00000000053B0000-0x00000000053FB000-memory.dmpFilesize
300KB
-
memory/2088-149-0x00000000070C0000-0x00000000070D2000-memory.dmpFilesize
72KB
-
memory/2088-161-0x00000000070C0000-0x00000000070D2000-memory.dmpFilesize
72KB
-
memory/2088-140-0x00000000070C0000-0x00000000070D2000-memory.dmpFilesize
72KB
-
memory/2088-141-0x00000000070C0000-0x00000000070D2000-memory.dmpFilesize
72KB
-
memory/2088-143-0x00000000070C0000-0x00000000070D2000-memory.dmpFilesize
72KB
-
memory/2088-145-0x00000000070C0000-0x00000000070D2000-memory.dmpFilesize
72KB
-
memory/2088-147-0x00000000070C0000-0x00000000070D2000-memory.dmpFilesize
72KB
-
memory/2088-138-0x0000000007170000-0x000000000766E000-memory.dmpFilesize
5.0MB
-
memory/2088-151-0x00000000070C0000-0x00000000070D2000-memory.dmpFilesize
72KB
-
memory/2088-153-0x00000000070C0000-0x00000000070D2000-memory.dmpFilesize
72KB
-
memory/2088-155-0x00000000070C0000-0x00000000070D2000-memory.dmpFilesize
72KB
-
memory/2088-157-0x00000000070C0000-0x00000000070D2000-memory.dmpFilesize
72KB
-
memory/2088-159-0x00000000070C0000-0x00000000070D2000-memory.dmpFilesize
72KB
-
memory/2088-139-0x00000000070C0000-0x00000000070D8000-memory.dmpFilesize
96KB
-
memory/2088-163-0x00000000070C0000-0x00000000070D2000-memory.dmpFilesize
72KB
-
memory/2088-165-0x00000000070C0000-0x00000000070D2000-memory.dmpFilesize
72KB
-
memory/2088-167-0x00000000070C0000-0x00000000070D2000-memory.dmpFilesize
72KB
-
memory/2088-168-0x0000000007160000-0x0000000007170000-memory.dmpFilesize
64KB
-
memory/2088-169-0x0000000007160000-0x0000000007170000-memory.dmpFilesize
64KB
-
memory/2088-170-0x0000000007160000-0x0000000007170000-memory.dmpFilesize
64KB
-
memory/2088-171-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/2088-174-0x0000000007160000-0x0000000007170000-memory.dmpFilesize
64KB
-
memory/2088-176-0x0000000007160000-0x0000000007170000-memory.dmpFilesize
64KB
-
memory/2088-175-0x0000000007160000-0x0000000007170000-memory.dmpFilesize
64KB
-
memory/2088-173-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/2088-137-0x0000000004800000-0x000000000481A000-memory.dmpFilesize
104KB
-
memory/2088-136-0x00000000001D0000-0x00000000001FD000-memory.dmpFilesize
180KB
-
memory/5064-183-0x0000000004C10000-0x0000000004C4F000-memory.dmpFilesize
252KB
-
memory/5064-216-0x0000000004C10000-0x0000000004C4F000-memory.dmpFilesize
252KB
-
memory/5064-187-0x0000000004960000-0x0000000004970000-memory.dmpFilesize
64KB
-
memory/5064-189-0x0000000004960000-0x0000000004970000-memory.dmpFilesize
64KB
-
memory/5064-188-0x0000000004C10000-0x0000000004C4F000-memory.dmpFilesize
252KB
-
memory/5064-184-0x0000000002CB0000-0x0000000002CFB000-memory.dmpFilesize
300KB
-
memory/5064-191-0x0000000004960000-0x0000000004970000-memory.dmpFilesize
64KB
-
memory/5064-192-0x0000000004C10000-0x0000000004C4F000-memory.dmpFilesize
252KB
-
memory/5064-194-0x0000000004C10000-0x0000000004C4F000-memory.dmpFilesize
252KB
-
memory/5064-196-0x0000000004C10000-0x0000000004C4F000-memory.dmpFilesize
252KB
-
memory/5064-198-0x0000000004C10000-0x0000000004C4F000-memory.dmpFilesize
252KB
-
memory/5064-200-0x0000000004C10000-0x0000000004C4F000-memory.dmpFilesize
252KB
-
memory/5064-202-0x0000000004C10000-0x0000000004C4F000-memory.dmpFilesize
252KB
-
memory/5064-204-0x0000000004C10000-0x0000000004C4F000-memory.dmpFilesize
252KB
-
memory/5064-206-0x0000000004C10000-0x0000000004C4F000-memory.dmpFilesize
252KB
-
memory/5064-208-0x0000000004C10000-0x0000000004C4F000-memory.dmpFilesize
252KB
-
memory/5064-212-0x0000000004C10000-0x0000000004C4F000-memory.dmpFilesize
252KB
-
memory/5064-210-0x0000000004C10000-0x0000000004C4F000-memory.dmpFilesize
252KB
-
memory/5064-214-0x0000000004C10000-0x0000000004C4F000-memory.dmpFilesize
252KB
-
memory/5064-185-0x0000000004C10000-0x0000000004C4F000-memory.dmpFilesize
252KB
-
memory/5064-218-0x0000000004C10000-0x0000000004C4F000-memory.dmpFilesize
252KB
-
memory/5064-220-0x0000000004C10000-0x0000000004C4F000-memory.dmpFilesize
252KB
-
memory/5064-1093-0x0000000007710000-0x0000000007D16000-memory.dmpFilesize
6.0MB
-
memory/5064-1094-0x0000000007D30000-0x0000000007E3A000-memory.dmpFilesize
1.0MB
-
memory/5064-1095-0x0000000007E70000-0x0000000007E82000-memory.dmpFilesize
72KB
-
memory/5064-1096-0x0000000007E90000-0x0000000007ECE000-memory.dmpFilesize
248KB
-
memory/5064-1097-0x0000000004960000-0x0000000004970000-memory.dmpFilesize
64KB
-
memory/5064-1098-0x0000000007FE0000-0x000000000802B000-memory.dmpFilesize
300KB
-
memory/5064-1100-0x0000000004960000-0x0000000004970000-memory.dmpFilesize
64KB
-
memory/5064-1101-0x0000000004960000-0x0000000004970000-memory.dmpFilesize
64KB
-
memory/5064-1102-0x0000000004960000-0x0000000004970000-memory.dmpFilesize
64KB
-
memory/5064-1103-0x0000000008170000-0x0000000008202000-memory.dmpFilesize
584KB
-
memory/5064-1104-0x0000000008210000-0x0000000008276000-memory.dmpFilesize
408KB
-
memory/5064-1105-0x0000000008910000-0x0000000008AD2000-memory.dmpFilesize
1.8MB
-
memory/5064-1106-0x0000000008AE0000-0x000000000900C000-memory.dmpFilesize
5.2MB
-
memory/5064-182-0x0000000004C10000-0x0000000004C54000-memory.dmpFilesize
272KB
-
memory/5064-181-0x00000000048F0000-0x0000000004936000-memory.dmpFilesize
280KB
-
memory/5064-1107-0x00000000093A0000-0x0000000009416000-memory.dmpFilesize
472KB
-
memory/5064-1108-0x0000000009420000-0x0000000009470000-memory.dmpFilesize
320KB
-
memory/5064-1109-0x0000000004960000-0x0000000004970000-memory.dmpFilesize
64KB