Analysis
-
max time kernel
61s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 07:14
Static task
static1
Behavioral task
behavioral1
Sample
29982700b23482b378d6966449e650559a363b78dcc131d45e04133636d8a685.exe
Resource
win10v2004-20230221-en
General
-
Target
29982700b23482b378d6966449e650559a363b78dcc131d45e04133636d8a685.exe
-
Size
683KB
-
MD5
064552ad083df6de65ad9178298cb9ff
-
SHA1
162f67497fe0b999ee6ae407fbbf5ed738d680c1
-
SHA256
29982700b23482b378d6966449e650559a363b78dcc131d45e04133636d8a685
-
SHA512
6707e771f29c159ed5bb0b7382b909333e13bfc0dc928141c9823fa91fc16748a118d2bdb7aa45801bddda9364ee712386e27eb805543e92d2bd98682c1fae31
-
SSDEEP
12288:OMrLy90Z7jnWcUcOSwRRb7AgMLgyYdiPBrfhU+imLx3Z6Y:BygHW0OSwDELgYP/gmLxJd
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Processes:
pro9540.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro9540.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro9540.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro9540.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro9540.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro9540.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro9540.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/1092-191-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/1092-192-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/1092-194-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/1092-196-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/1092-198-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/1092-200-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/1092-202-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/1092-206-0x0000000007270000-0x0000000007280000-memory.dmp family_redline behavioral1/memory/1092-208-0x0000000007270000-0x0000000007280000-memory.dmp family_redline behavioral1/memory/1092-209-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/1092-204-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/1092-212-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/1092-218-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/1092-216-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/1092-214-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/1092-220-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/1092-222-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/1092-224-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/1092-226-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/1092-228-0x0000000007130000-0x000000000716F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un163060.exepro9540.exequ9526.exesi792779.exepid process 4808 un163060.exe 2816 pro9540.exe 1092 qu9526.exe 548 si792779.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro9540.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro9540.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro9540.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
29982700b23482b378d6966449e650559a363b78dcc131d45e04133636d8a685.exeun163060.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 29982700b23482b378d6966449e650559a363b78dcc131d45e04133636d8a685.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 29982700b23482b378d6966449e650559a363b78dcc131d45e04133636d8a685.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un163060.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un163060.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3756 2816 WerFault.exe pro9540.exe 3052 1092 WerFault.exe qu9526.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro9540.exequ9526.exesi792779.exepid process 2816 pro9540.exe 2816 pro9540.exe 1092 qu9526.exe 1092 qu9526.exe 548 si792779.exe 548 si792779.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro9540.exequ9526.exesi792779.exedescription pid process Token: SeDebugPrivilege 2816 pro9540.exe Token: SeDebugPrivilege 1092 qu9526.exe Token: SeDebugPrivilege 548 si792779.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
29982700b23482b378d6966449e650559a363b78dcc131d45e04133636d8a685.exeun163060.exedescription pid process target process PID 2436 wrote to memory of 4808 2436 29982700b23482b378d6966449e650559a363b78dcc131d45e04133636d8a685.exe un163060.exe PID 2436 wrote to memory of 4808 2436 29982700b23482b378d6966449e650559a363b78dcc131d45e04133636d8a685.exe un163060.exe PID 2436 wrote to memory of 4808 2436 29982700b23482b378d6966449e650559a363b78dcc131d45e04133636d8a685.exe un163060.exe PID 4808 wrote to memory of 2816 4808 un163060.exe pro9540.exe PID 4808 wrote to memory of 2816 4808 un163060.exe pro9540.exe PID 4808 wrote to memory of 2816 4808 un163060.exe pro9540.exe PID 4808 wrote to memory of 1092 4808 un163060.exe qu9526.exe PID 4808 wrote to memory of 1092 4808 un163060.exe qu9526.exe PID 4808 wrote to memory of 1092 4808 un163060.exe qu9526.exe PID 2436 wrote to memory of 548 2436 29982700b23482b378d6966449e650559a363b78dcc131d45e04133636d8a685.exe si792779.exe PID 2436 wrote to memory of 548 2436 29982700b23482b378d6966449e650559a363b78dcc131d45e04133636d8a685.exe si792779.exe PID 2436 wrote to memory of 548 2436 29982700b23482b378d6966449e650559a363b78dcc131d45e04133636d8a685.exe si792779.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\29982700b23482b378d6966449e650559a363b78dcc131d45e04133636d8a685.exe"C:\Users\Admin\AppData\Local\Temp\29982700b23482b378d6966449e650559a363b78dcc131d45e04133636d8a685.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un163060.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un163060.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9540.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9540.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 10804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9526.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9526.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 13484⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si792779.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si792779.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2816 -ip 28161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1092 -ip 10921⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si792779.exeFilesize
175KB
MD5601baaa791b568e95ce57357c38e2f75
SHA1b5d8715bbfc0d0e603bf2f8ed0fb56722c35bc87
SHA256e5d6d5a81a319664c5649c4a274393aac6100674dea834d0b71640913f22dcb6
SHA512bca9f22a7207500a98b51ebcef06254f19b419c264b7d6f5b8ecd495b33d238d935b7fe6040e79be0dca33ffda1ae678dba0254070bd7282fd39e7abc2f5ba1a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si792779.exeFilesize
175KB
MD5601baaa791b568e95ce57357c38e2f75
SHA1b5d8715bbfc0d0e603bf2f8ed0fb56722c35bc87
SHA256e5d6d5a81a319664c5649c4a274393aac6100674dea834d0b71640913f22dcb6
SHA512bca9f22a7207500a98b51ebcef06254f19b419c264b7d6f5b8ecd495b33d238d935b7fe6040e79be0dca33ffda1ae678dba0254070bd7282fd39e7abc2f5ba1a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un163060.exeFilesize
542KB
MD599b1d1f24ed265a487108640252cb7dd
SHA1b4d213b51992686f55dfecde91aa3cdfdb888b59
SHA25638cbfccafe592205192330a10711fb544f69e914be7f0f28630b43de47156546
SHA512abbc4e4c84b90ed64f106692554ab1dc80df9125e811a16032d959d7116fe998cd67d3d03836316ca448100ca2da3db75e190ee15af3ff58887b2e0876ba71d2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un163060.exeFilesize
542KB
MD599b1d1f24ed265a487108640252cb7dd
SHA1b4d213b51992686f55dfecde91aa3cdfdb888b59
SHA25638cbfccafe592205192330a10711fb544f69e914be7f0f28630b43de47156546
SHA512abbc4e4c84b90ed64f106692554ab1dc80df9125e811a16032d959d7116fe998cd67d3d03836316ca448100ca2da3db75e190ee15af3ff58887b2e0876ba71d2
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9540.exeFilesize
321KB
MD5d970be060353e402a530b5e7de686eeb
SHA12fb5c2df8057e17dee502cd84088a127e04c22dc
SHA256841a93c68b933ef082e173d313a79edac32f5cae22cbe18aa0c144416bd4eedb
SHA5127375c486dfb27ae0fb8168c35e8b91350491d2172df722198f299fb12d7e40f2072a8cb61a15cfa5910213943a8ed57d911f5c1cb5a39510d40f690ed24d22b0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9540.exeFilesize
321KB
MD5d970be060353e402a530b5e7de686eeb
SHA12fb5c2df8057e17dee502cd84088a127e04c22dc
SHA256841a93c68b933ef082e173d313a79edac32f5cae22cbe18aa0c144416bd4eedb
SHA5127375c486dfb27ae0fb8168c35e8b91350491d2172df722198f299fb12d7e40f2072a8cb61a15cfa5910213943a8ed57d911f5c1cb5a39510d40f690ed24d22b0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9526.exeFilesize
380KB
MD5e2bb525ed081ccc286a39d32d9b714a4
SHA18fbdc747838f96df08d96e39a6eb6dfe3d1f8c96
SHA256c109253219d9b547271021f67a5ccaa39c634e0824b3811a0bcf589b8d7d24b0
SHA512c1914800e729d1a6b92065e8dad6ba4efc60e761ed61466aba27defc12d57499e82b2948b6dae53a292d868ae9673978c175c52d2e25f440e8d09512cd12dd21
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9526.exeFilesize
380KB
MD5e2bb525ed081ccc286a39d32d9b714a4
SHA18fbdc747838f96df08d96e39a6eb6dfe3d1f8c96
SHA256c109253219d9b547271021f67a5ccaa39c634e0824b3811a0bcf589b8d7d24b0
SHA512c1914800e729d1a6b92065e8dad6ba4efc60e761ed61466aba27defc12d57499e82b2948b6dae53a292d868ae9673978c175c52d2e25f440e8d09512cd12dd21
-
memory/548-1123-0x0000000005B30000-0x0000000005B40000-memory.dmpFilesize
64KB
-
memory/548-1122-0x0000000000F70000-0x0000000000FA2000-memory.dmpFilesize
200KB
-
memory/1092-1102-0x0000000007E50000-0x0000000007F5A000-memory.dmpFilesize
1.0MB
-
memory/1092-1104-0x0000000007270000-0x0000000007280000-memory.dmpFilesize
64KB
-
memory/1092-1116-0x0000000007270000-0x0000000007280000-memory.dmpFilesize
64KB
-
memory/1092-1115-0x0000000009440000-0x0000000009490000-memory.dmpFilesize
320KB
-
memory/1092-1114-0x00000000093C0000-0x0000000009436000-memory.dmpFilesize
472KB
-
memory/1092-1113-0x0000000008C20000-0x000000000914C000-memory.dmpFilesize
5.2MB
-
memory/1092-1112-0x0000000007270000-0x0000000007280000-memory.dmpFilesize
64KB
-
memory/1092-1111-0x0000000007270000-0x0000000007280000-memory.dmpFilesize
64KB
-
memory/1092-1110-0x0000000007270000-0x0000000007280000-memory.dmpFilesize
64KB
-
memory/1092-1109-0x0000000008A50000-0x0000000008C12000-memory.dmpFilesize
1.8MB
-
memory/1092-1108-0x0000000008320000-0x0000000008386000-memory.dmpFilesize
408KB
-
memory/1092-1107-0x0000000008280000-0x0000000008312000-memory.dmpFilesize
584KB
-
memory/1092-1105-0x0000000007F90000-0x0000000007FCC000-memory.dmpFilesize
240KB
-
memory/1092-1103-0x0000000007F70000-0x0000000007F82000-memory.dmpFilesize
72KB
-
memory/1092-1101-0x0000000007830000-0x0000000007E48000-memory.dmpFilesize
6.1MB
-
memory/1092-228-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/1092-226-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/1092-224-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/1092-222-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/1092-220-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/1092-214-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/1092-191-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/1092-192-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/1092-194-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/1092-196-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/1092-198-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/1092-200-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/1092-202-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/1092-205-0x00000000045C0000-0x000000000460B000-memory.dmpFilesize
300KB
-
memory/1092-206-0x0000000007270000-0x0000000007280000-memory.dmpFilesize
64KB
-
memory/1092-208-0x0000000007270000-0x0000000007280000-memory.dmpFilesize
64KB
-
memory/1092-209-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/1092-210-0x0000000007270000-0x0000000007280000-memory.dmpFilesize
64KB
-
memory/1092-204-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/1092-212-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/1092-218-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/1092-216-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/2816-177-0x0000000007240000-0x0000000007252000-memory.dmpFilesize
72KB
-
memory/2816-184-0x0000000007340000-0x0000000007350000-memory.dmpFilesize
64KB
-
memory/2816-155-0x0000000007240000-0x0000000007252000-memory.dmpFilesize
72KB
-
memory/2816-185-0x0000000007340000-0x0000000007350000-memory.dmpFilesize
64KB
-
memory/2816-175-0x0000000007240000-0x0000000007252000-memory.dmpFilesize
72KB
-
memory/2816-183-0x0000000007340000-0x0000000007350000-memory.dmpFilesize
64KB
-
memory/2816-181-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/2816-173-0x0000000007240000-0x0000000007252000-memory.dmpFilesize
72KB
-
memory/2816-180-0x0000000007340000-0x0000000007350000-memory.dmpFilesize
64KB
-
memory/2816-159-0x0000000007240000-0x0000000007252000-memory.dmpFilesize
72KB
-
memory/2816-179-0x0000000007340000-0x0000000007350000-memory.dmpFilesize
64KB
-
memory/2816-178-0x0000000007340000-0x0000000007350000-memory.dmpFilesize
64KB
-
memory/2816-186-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/2816-157-0x0000000007240000-0x0000000007252000-memory.dmpFilesize
72KB
-
memory/2816-153-0x0000000007240000-0x0000000007252000-memory.dmpFilesize
72KB
-
memory/2816-171-0x0000000007240000-0x0000000007252000-memory.dmpFilesize
72KB
-
memory/2816-169-0x0000000007240000-0x0000000007252000-memory.dmpFilesize
72KB
-
memory/2816-167-0x0000000007240000-0x0000000007252000-memory.dmpFilesize
72KB
-
memory/2816-165-0x0000000007240000-0x0000000007252000-memory.dmpFilesize
72KB
-
memory/2816-163-0x0000000007240000-0x0000000007252000-memory.dmpFilesize
72KB
-
memory/2816-161-0x0000000007240000-0x0000000007252000-memory.dmpFilesize
72KB
-
memory/2816-150-0x0000000007240000-0x0000000007252000-memory.dmpFilesize
72KB
-
memory/2816-151-0x0000000007240000-0x0000000007252000-memory.dmpFilesize
72KB
-
memory/2816-149-0x0000000007350000-0x00000000078F4000-memory.dmpFilesize
5.6MB
-
memory/2816-148-0x0000000002C50000-0x0000000002C7D000-memory.dmpFilesize
180KB