Analysis
-
max time kernel
51s -
max time network
74s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
28-03-2023 06:10
Static task
static1
Behavioral task
behavioral1
Sample
dfc1362fe9f410d949b0d7bcec6e79d672ddcabd4270f99db4a9fc6d0b08117b.exe
Resource
win10-20230220-en
General
-
Target
dfc1362fe9f410d949b0d7bcec6e79d672ddcabd4270f99db4a9fc6d0b08117b.exe
-
Size
683KB
-
MD5
3ff341c4839870b9171345ef6e0bb989
-
SHA1
6a6dfcd50ab4b05d9ef5a35934457af6dc113145
-
SHA256
dfc1362fe9f410d949b0d7bcec6e79d672ddcabd4270f99db4a9fc6d0b08117b
-
SHA512
6759b4868faec537cd1782009dcdc17145b92cecbeef0214cb47dbd607fd43078f6f1d216f324a27fe44a5ecf41346ab487bfa01ff359a3eff68280d66773bda
-
SSDEEP
12288:HMrYy90MS1ntAxW/PwO8QmxvkJwd7r01NlcsoUMC54NWJOvyfFm3:/yTlxqPwJQmxv2E7rqxozCKnyfE3
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Processes:
pro1451.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro1451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro1451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro1451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro1451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro1451.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/3728-180-0x0000000004990000-0x00000000049D6000-memory.dmp family_redline behavioral1/memory/3728-181-0x0000000007630000-0x0000000007674000-memory.dmp family_redline behavioral1/memory/3728-182-0x0000000007630000-0x000000000766F000-memory.dmp family_redline behavioral1/memory/3728-183-0x0000000007630000-0x000000000766F000-memory.dmp family_redline behavioral1/memory/3728-185-0x0000000007630000-0x000000000766F000-memory.dmp family_redline behavioral1/memory/3728-188-0x0000000007630000-0x000000000766F000-memory.dmp family_redline behavioral1/memory/3728-193-0x0000000002EB0000-0x0000000002EC0000-memory.dmp family_redline behavioral1/memory/3728-192-0x0000000007630000-0x000000000766F000-memory.dmp family_redline behavioral1/memory/3728-195-0x0000000007630000-0x000000000766F000-memory.dmp family_redline behavioral1/memory/3728-197-0x0000000007630000-0x000000000766F000-memory.dmp family_redline behavioral1/memory/3728-199-0x0000000007630000-0x000000000766F000-memory.dmp family_redline behavioral1/memory/3728-201-0x0000000007630000-0x000000000766F000-memory.dmp family_redline behavioral1/memory/3728-203-0x0000000007630000-0x000000000766F000-memory.dmp family_redline behavioral1/memory/3728-205-0x0000000007630000-0x000000000766F000-memory.dmp family_redline behavioral1/memory/3728-207-0x0000000007630000-0x000000000766F000-memory.dmp family_redline behavioral1/memory/3728-209-0x0000000007630000-0x000000000766F000-memory.dmp family_redline behavioral1/memory/3728-211-0x0000000007630000-0x000000000766F000-memory.dmp family_redline behavioral1/memory/3728-213-0x0000000007630000-0x000000000766F000-memory.dmp family_redline behavioral1/memory/3728-215-0x0000000007630000-0x000000000766F000-memory.dmp family_redline behavioral1/memory/3728-217-0x0000000007630000-0x000000000766F000-memory.dmp family_redline behavioral1/memory/3728-219-0x0000000007630000-0x000000000766F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un426954.exepro1451.exequ8640.exesi816248.exepid process 4168 un426954.exe 4516 pro1451.exe 3728 qu8640.exe 5004 si816248.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro1451.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro1451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro1451.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un426954.exedfc1362fe9f410d949b0d7bcec6e79d672ddcabd4270f99db4a9fc6d0b08117b.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un426954.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce dfc1362fe9f410d949b0d7bcec6e79d672ddcabd4270f99db4a9fc6d0b08117b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" dfc1362fe9f410d949b0d7bcec6e79d672ddcabd4270f99db4a9fc6d0b08117b.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un426954.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro1451.exequ8640.exesi816248.exepid process 4516 pro1451.exe 4516 pro1451.exe 3728 qu8640.exe 3728 qu8640.exe 5004 si816248.exe 5004 si816248.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro1451.exequ8640.exesi816248.exedescription pid process Token: SeDebugPrivilege 4516 pro1451.exe Token: SeDebugPrivilege 3728 qu8640.exe Token: SeDebugPrivilege 5004 si816248.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
dfc1362fe9f410d949b0d7bcec6e79d672ddcabd4270f99db4a9fc6d0b08117b.exeun426954.exedescription pid process target process PID 4452 wrote to memory of 4168 4452 dfc1362fe9f410d949b0d7bcec6e79d672ddcabd4270f99db4a9fc6d0b08117b.exe un426954.exe PID 4452 wrote to memory of 4168 4452 dfc1362fe9f410d949b0d7bcec6e79d672ddcabd4270f99db4a9fc6d0b08117b.exe un426954.exe PID 4452 wrote to memory of 4168 4452 dfc1362fe9f410d949b0d7bcec6e79d672ddcabd4270f99db4a9fc6d0b08117b.exe un426954.exe PID 4168 wrote to memory of 4516 4168 un426954.exe pro1451.exe PID 4168 wrote to memory of 4516 4168 un426954.exe pro1451.exe PID 4168 wrote to memory of 4516 4168 un426954.exe pro1451.exe PID 4168 wrote to memory of 3728 4168 un426954.exe qu8640.exe PID 4168 wrote to memory of 3728 4168 un426954.exe qu8640.exe PID 4168 wrote to memory of 3728 4168 un426954.exe qu8640.exe PID 4452 wrote to memory of 5004 4452 dfc1362fe9f410d949b0d7bcec6e79d672ddcabd4270f99db4a9fc6d0b08117b.exe si816248.exe PID 4452 wrote to memory of 5004 4452 dfc1362fe9f410d949b0d7bcec6e79d672ddcabd4270f99db4a9fc6d0b08117b.exe si816248.exe PID 4452 wrote to memory of 5004 4452 dfc1362fe9f410d949b0d7bcec6e79d672ddcabd4270f99db4a9fc6d0b08117b.exe si816248.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfc1362fe9f410d949b0d7bcec6e79d672ddcabd4270f99db4a9fc6d0b08117b.exe"C:\Users\Admin\AppData\Local\Temp\dfc1362fe9f410d949b0d7bcec6e79d672ddcabd4270f99db4a9fc6d0b08117b.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un426954.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un426954.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1451.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1451.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8640.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8640.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si816248.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si816248.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si816248.exeFilesize
175KB
MD591d5c5de77681cb01788a47cc425635a
SHA176d54f277c3f9772d9dfb3f8067f0a81d50a7a7f
SHA256301a928d9f5db4870822eaba4365cf5b0cec380431bdf4dcdb38ed0557ddd346
SHA512700a6500bb5ea12bcae3b6eed9e09ba89f208d80861d9b5a9885d98f78bba7d483a371763328a80215e35df4a54997ea2542f782b7d8cd61c83019871e45ea66
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si816248.exeFilesize
175KB
MD591d5c5de77681cb01788a47cc425635a
SHA176d54f277c3f9772d9dfb3f8067f0a81d50a7a7f
SHA256301a928d9f5db4870822eaba4365cf5b0cec380431bdf4dcdb38ed0557ddd346
SHA512700a6500bb5ea12bcae3b6eed9e09ba89f208d80861d9b5a9885d98f78bba7d483a371763328a80215e35df4a54997ea2542f782b7d8cd61c83019871e45ea66
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un426954.exeFilesize
541KB
MD5de5b72e9660eead7c90b0c6b6c8f1cce
SHA19667c57a96d2a005b5fdf2cfa66e794b4947b04b
SHA2567c1838e9f3204c28922541385f64bd15ec58ea1aa7ae0d9899bc788137aba4ff
SHA512aef3e0a4e23c7808b68e74ebe362127f04e7f52ae6b67dee3319c8e6dfc86f5ba9de62b3f72c50d09da2773ced9738ef6c3efe2d6747a9892a98f622ae32c866
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un426954.exeFilesize
541KB
MD5de5b72e9660eead7c90b0c6b6c8f1cce
SHA19667c57a96d2a005b5fdf2cfa66e794b4947b04b
SHA2567c1838e9f3204c28922541385f64bd15ec58ea1aa7ae0d9899bc788137aba4ff
SHA512aef3e0a4e23c7808b68e74ebe362127f04e7f52ae6b67dee3319c8e6dfc86f5ba9de62b3f72c50d09da2773ced9738ef6c3efe2d6747a9892a98f622ae32c866
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1451.exeFilesize
322KB
MD522d4fe82bdfe77fb41cdb3a3f3388133
SHA11b0818f3719a54a831247ac2f9e66449587ea465
SHA256594dbaacf59850508e0823acd7dacfc727aa4515f7410d3b6586b1a415f339b9
SHA51218a127866761bf2f8ab60a4f001f09b533ed1df23479a613f4433fe6d653030cf828ba41e6d3d36b5166637b4620086ea6194bccdb06f52865055d1fae7d60c9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1451.exeFilesize
322KB
MD522d4fe82bdfe77fb41cdb3a3f3388133
SHA11b0818f3719a54a831247ac2f9e66449587ea465
SHA256594dbaacf59850508e0823acd7dacfc727aa4515f7410d3b6586b1a415f339b9
SHA51218a127866761bf2f8ab60a4f001f09b533ed1df23479a613f4433fe6d653030cf828ba41e6d3d36b5166637b4620086ea6194bccdb06f52865055d1fae7d60c9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8640.exeFilesize
379KB
MD5022adc3ecb7215cb12be5c790a1a3505
SHA1f52885b27c50f6ecd20aaebb6c56b69fc3fdc5d9
SHA2569a07085dff7789246f697aafff73d3b14fe3c0c347930831d75ddcfc17399b24
SHA5125f66727e3484f5eba15955e5ba726c8f244c9e89554f0a9c1cc56f6bfa64c8f449bc10c02cc3874b2291461f25e9089b47e941e8f7bdb4b9cccf034959269863
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8640.exeFilesize
379KB
MD5022adc3ecb7215cb12be5c790a1a3505
SHA1f52885b27c50f6ecd20aaebb6c56b69fc3fdc5d9
SHA2569a07085dff7789246f697aafff73d3b14fe3c0c347930831d75ddcfc17399b24
SHA5125f66727e3484f5eba15955e5ba726c8f244c9e89554f0a9c1cc56f6bfa64c8f449bc10c02cc3874b2291461f25e9089b47e941e8f7bdb4b9cccf034959269863
-
memory/3728-1092-0x0000000007DF0000-0x00000000083F6000-memory.dmpFilesize
6.0MB
-
memory/3728-219-0x0000000007630000-0x000000000766F000-memory.dmpFilesize
252KB
-
memory/3728-1108-0x0000000002EB0000-0x0000000002EC0000-memory.dmpFilesize
64KB
-
memory/3728-1107-0x0000000009560000-0x00000000095B0000-memory.dmpFilesize
320KB
-
memory/3728-1106-0x00000000094E0000-0x0000000009556000-memory.dmpFilesize
472KB
-
memory/3728-192-0x0000000007630000-0x000000000766F000-memory.dmpFilesize
252KB
-
memory/3728-1105-0x0000000008E80000-0x00000000093AC000-memory.dmpFilesize
5.2MB
-
memory/3728-1104-0x0000000008C90000-0x0000000008E52000-memory.dmpFilesize
1.8MB
-
memory/3728-1103-0x0000000002EB0000-0x0000000002EC0000-memory.dmpFilesize
64KB
-
memory/3728-1102-0x0000000002EB0000-0x0000000002EC0000-memory.dmpFilesize
64KB
-
memory/3728-195-0x0000000007630000-0x000000000766F000-memory.dmpFilesize
252KB
-
memory/3728-1101-0x0000000002EB0000-0x0000000002EC0000-memory.dmpFilesize
64KB
-
memory/3728-1100-0x0000000008980000-0x0000000008A12000-memory.dmpFilesize
584KB
-
memory/3728-1099-0x0000000007CA0000-0x0000000007D06000-memory.dmpFilesize
408KB
-
memory/3728-1097-0x0000000002EB0000-0x0000000002EC0000-memory.dmpFilesize
64KB
-
memory/3728-1096-0x0000000007B10000-0x0000000007B5B000-memory.dmpFilesize
300KB
-
memory/3728-1095-0x00000000079C0000-0x00000000079FE000-memory.dmpFilesize
248KB
-
memory/3728-1094-0x00000000079A0000-0x00000000079B2000-memory.dmpFilesize
72KB
-
memory/3728-1093-0x0000000007860000-0x000000000796A000-memory.dmpFilesize
1.0MB
-
memory/3728-203-0x0000000007630000-0x000000000766F000-memory.dmpFilesize
252KB
-
memory/3728-217-0x0000000007630000-0x000000000766F000-memory.dmpFilesize
252KB
-
memory/3728-215-0x0000000007630000-0x000000000766F000-memory.dmpFilesize
252KB
-
memory/3728-213-0x0000000007630000-0x000000000766F000-memory.dmpFilesize
252KB
-
memory/3728-211-0x0000000007630000-0x000000000766F000-memory.dmpFilesize
252KB
-
memory/3728-209-0x0000000007630000-0x000000000766F000-memory.dmpFilesize
252KB
-
memory/3728-180-0x0000000004990000-0x00000000049D6000-memory.dmpFilesize
280KB
-
memory/3728-181-0x0000000007630000-0x0000000007674000-memory.dmpFilesize
272KB
-
memory/3728-182-0x0000000007630000-0x000000000766F000-memory.dmpFilesize
252KB
-
memory/3728-183-0x0000000007630000-0x000000000766F000-memory.dmpFilesize
252KB
-
memory/3728-193-0x0000000002EB0000-0x0000000002EC0000-memory.dmpFilesize
64KB
-
memory/3728-188-0x0000000007630000-0x000000000766F000-memory.dmpFilesize
252KB
-
memory/3728-187-0x0000000002C60000-0x0000000002CAB000-memory.dmpFilesize
300KB
-
memory/3728-189-0x0000000002EB0000-0x0000000002EC0000-memory.dmpFilesize
64KB
-
memory/3728-191-0x0000000002EB0000-0x0000000002EC0000-memory.dmpFilesize
64KB
-
memory/3728-185-0x0000000007630000-0x000000000766F000-memory.dmpFilesize
252KB
-
memory/3728-207-0x0000000007630000-0x000000000766F000-memory.dmpFilesize
252KB
-
memory/3728-205-0x0000000007630000-0x000000000766F000-memory.dmpFilesize
252KB
-
memory/3728-197-0x0000000007630000-0x000000000766F000-memory.dmpFilesize
252KB
-
memory/3728-199-0x0000000007630000-0x000000000766F000-memory.dmpFilesize
252KB
-
memory/3728-201-0x0000000007630000-0x000000000766F000-memory.dmpFilesize
252KB
-
memory/4516-170-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/4516-158-0x0000000004A60000-0x0000000004A72000-memory.dmpFilesize
72KB
-
memory/4516-148-0x0000000004A60000-0x0000000004A72000-memory.dmpFilesize
72KB
-
memory/4516-138-0x0000000004A60000-0x0000000004A78000-memory.dmpFilesize
96KB
-
memory/4516-139-0x0000000004A60000-0x0000000004A72000-memory.dmpFilesize
72KB
-
memory/4516-175-0x0000000004A50000-0x0000000004A60000-memory.dmpFilesize
64KB
-
memory/4516-172-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/4516-174-0x0000000004A50000-0x0000000004A60000-memory.dmpFilesize
64KB
-
memory/4516-173-0x0000000004A50000-0x0000000004A60000-memory.dmpFilesize
64KB
-
memory/4516-137-0x0000000007190000-0x000000000768E000-memory.dmpFilesize
5.0MB
-
memory/4516-140-0x0000000004A60000-0x0000000004A72000-memory.dmpFilesize
72KB
-
memory/4516-166-0x0000000004A50000-0x0000000004A60000-memory.dmpFilesize
64KB
-
memory/4516-169-0x0000000004A60000-0x0000000004A72000-memory.dmpFilesize
72KB
-
memory/4516-167-0x0000000004A60000-0x0000000004A72000-memory.dmpFilesize
72KB
-
memory/4516-163-0x0000000004A50000-0x0000000004A60000-memory.dmpFilesize
64KB
-
memory/4516-164-0x0000000004A50000-0x0000000004A60000-memory.dmpFilesize
64KB
-
memory/4516-162-0x0000000004A60000-0x0000000004A72000-memory.dmpFilesize
72KB
-
memory/4516-160-0x0000000004A60000-0x0000000004A72000-memory.dmpFilesize
72KB
-
memory/4516-156-0x0000000004A60000-0x0000000004A72000-memory.dmpFilesize
72KB
-
memory/4516-154-0x0000000004A60000-0x0000000004A72000-memory.dmpFilesize
72KB
-
memory/4516-152-0x0000000004A60000-0x0000000004A72000-memory.dmpFilesize
72KB
-
memory/4516-150-0x0000000004A60000-0x0000000004A72000-memory.dmpFilesize
72KB
-
memory/4516-146-0x0000000004A60000-0x0000000004A72000-memory.dmpFilesize
72KB
-
memory/4516-144-0x0000000004A60000-0x0000000004A72000-memory.dmpFilesize
72KB
-
memory/4516-142-0x0000000004A60000-0x0000000004A72000-memory.dmpFilesize
72KB
-
memory/4516-136-0x0000000002DC0000-0x0000000002DDA000-memory.dmpFilesize
104KB
-
memory/4516-135-0x00000000001D0000-0x00000000001FD000-memory.dmpFilesize
180KB
-
memory/5004-1114-0x0000000000420000-0x0000000000452000-memory.dmpFilesize
200KB
-
memory/5004-1115-0x0000000004E60000-0x0000000004EAB000-memory.dmpFilesize
300KB
-
memory/5004-1116-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB