Analysis
-
max time kernel
138s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 07:21
Static task
static1
Behavioral task
behavioral1
Sample
162323b2452af871715cff7b05cf7144ccdebc37f9441e0c205906faf67022c8.exe
Resource
win10v2004-20230220-en
General
-
Target
162323b2452af871715cff7b05cf7144ccdebc37f9441e0c205906faf67022c8.exe
-
Size
686KB
-
MD5
558ec322b065561f37d7552bc5b375ae
-
SHA1
d50fbf825414ff4bd73c7159e294af4635e8d6a0
-
SHA256
162323b2452af871715cff7b05cf7144ccdebc37f9441e0c205906faf67022c8
-
SHA512
aca9938ae1f31d491f58f0edb21327089d27cd96534ef45c3da2c5db6fbdc3224cb683cdb520f51b0e91379aaae02954864ef997e84b1eeb48f21fafba2dc114
-
SSDEEP
12288:uMrry90hB2AbUxMK4EnJou9FFYy1s49lob6wiZgP3fUiKAPHezZGB1UD:pyonjaJjM4/obdJfWUBW
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Processes:
pro4511.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro4511.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro4511.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro4511.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro4511.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro4511.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro4511.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/4904-191-0x0000000007730000-0x000000000776F000-memory.dmp family_redline behavioral1/memory/4904-192-0x0000000007730000-0x000000000776F000-memory.dmp family_redline behavioral1/memory/4904-194-0x0000000007730000-0x000000000776F000-memory.dmp family_redline behavioral1/memory/4904-196-0x0000000007730000-0x000000000776F000-memory.dmp family_redline behavioral1/memory/4904-198-0x0000000007730000-0x000000000776F000-memory.dmp family_redline behavioral1/memory/4904-200-0x0000000007730000-0x000000000776F000-memory.dmp family_redline behavioral1/memory/4904-202-0x0000000007730000-0x000000000776F000-memory.dmp family_redline behavioral1/memory/4904-204-0x0000000007730000-0x000000000776F000-memory.dmp family_redline behavioral1/memory/4904-207-0x0000000007730000-0x000000000776F000-memory.dmp family_redline behavioral1/memory/4904-211-0x0000000007730000-0x000000000776F000-memory.dmp family_redline behavioral1/memory/4904-214-0x0000000007730000-0x000000000776F000-memory.dmp family_redline behavioral1/memory/4904-216-0x0000000007730000-0x000000000776F000-memory.dmp family_redline behavioral1/memory/4904-218-0x0000000007730000-0x000000000776F000-memory.dmp family_redline behavioral1/memory/4904-220-0x0000000007730000-0x000000000776F000-memory.dmp family_redline behavioral1/memory/4904-222-0x0000000007730000-0x000000000776F000-memory.dmp family_redline behavioral1/memory/4904-224-0x0000000007730000-0x000000000776F000-memory.dmp family_redline behavioral1/memory/4904-226-0x0000000007730000-0x000000000776F000-memory.dmp family_redline behavioral1/memory/4904-228-0x0000000007730000-0x000000000776F000-memory.dmp family_redline behavioral1/memory/4904-1111-0x0000000007170000-0x0000000007180000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un086745.exepro4511.exequ2144.exesi644288.exepid process 1232 un086745.exe 4332 pro4511.exe 4904 qu2144.exe 1620 si644288.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro4511.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro4511.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro4511.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
162323b2452af871715cff7b05cf7144ccdebc37f9441e0c205906faf67022c8.exeun086745.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 162323b2452af871715cff7b05cf7144ccdebc37f9441e0c205906faf67022c8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 162323b2452af871715cff7b05cf7144ccdebc37f9441e0c205906faf67022c8.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un086745.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un086745.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 3380 sc.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1500 4332 WerFault.exe pro4511.exe 1972 4904 WerFault.exe qu2144.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro4511.exequ2144.exesi644288.exepid process 4332 pro4511.exe 4332 pro4511.exe 4904 qu2144.exe 4904 qu2144.exe 1620 si644288.exe 1620 si644288.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro4511.exequ2144.exesi644288.exedescription pid process Token: SeDebugPrivilege 4332 pro4511.exe Token: SeDebugPrivilege 4904 qu2144.exe Token: SeDebugPrivilege 1620 si644288.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
162323b2452af871715cff7b05cf7144ccdebc37f9441e0c205906faf67022c8.exeun086745.exedescription pid process target process PID 3516 wrote to memory of 1232 3516 162323b2452af871715cff7b05cf7144ccdebc37f9441e0c205906faf67022c8.exe un086745.exe PID 3516 wrote to memory of 1232 3516 162323b2452af871715cff7b05cf7144ccdebc37f9441e0c205906faf67022c8.exe un086745.exe PID 3516 wrote to memory of 1232 3516 162323b2452af871715cff7b05cf7144ccdebc37f9441e0c205906faf67022c8.exe un086745.exe PID 1232 wrote to memory of 4332 1232 un086745.exe pro4511.exe PID 1232 wrote to memory of 4332 1232 un086745.exe pro4511.exe PID 1232 wrote to memory of 4332 1232 un086745.exe pro4511.exe PID 1232 wrote to memory of 4904 1232 un086745.exe qu2144.exe PID 1232 wrote to memory of 4904 1232 un086745.exe qu2144.exe PID 1232 wrote to memory of 4904 1232 un086745.exe qu2144.exe PID 3516 wrote to memory of 1620 3516 162323b2452af871715cff7b05cf7144ccdebc37f9441e0c205906faf67022c8.exe si644288.exe PID 3516 wrote to memory of 1620 3516 162323b2452af871715cff7b05cf7144ccdebc37f9441e0c205906faf67022c8.exe si644288.exe PID 3516 wrote to memory of 1620 3516 162323b2452af871715cff7b05cf7144ccdebc37f9441e0c205906faf67022c8.exe si644288.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\162323b2452af871715cff7b05cf7144ccdebc37f9441e0c205906faf67022c8.exe"C:\Users\Admin\AppData\Local\Temp\162323b2452af871715cff7b05cf7144ccdebc37f9441e0c205906faf67022c8.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un086745.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un086745.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4511.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4511.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 10844⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2144.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2144.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 16924⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si644288.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si644288.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4332 -ip 43321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4904 -ip 49041⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si644288.exeFilesize
175KB
MD5adcad62a7aefdd892ff3d200fc341a8a
SHA1c69efd125d803e534460c557cea3cf7b0e111d75
SHA256fc28dfac0e8228634537da8b563791cc910fc51726d2a770f4b0f0a48959ae2d
SHA5125bf71bc4cd505f1c3b8b838e42a3b6156c57df381efa466a0429f0e9a8ef4d7bc63008dcc8656bbfbec3857b5ed66fc23ccbb17df6c9b779f6c3cfe4297acb95
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si644288.exeFilesize
175KB
MD5adcad62a7aefdd892ff3d200fc341a8a
SHA1c69efd125d803e534460c557cea3cf7b0e111d75
SHA256fc28dfac0e8228634537da8b563791cc910fc51726d2a770f4b0f0a48959ae2d
SHA5125bf71bc4cd505f1c3b8b838e42a3b6156c57df381efa466a0429f0e9a8ef4d7bc63008dcc8656bbfbec3857b5ed66fc23ccbb17df6c9b779f6c3cfe4297acb95
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un086745.exeFilesize
544KB
MD5f0a3415324faf9430f71986bc563f824
SHA12b06f6b1b022b74f0e98668ff73c1d578463106f
SHA256cb355c6a2539387f3c1fc577a5b5af760cc150f2c13401932f2b3550d5866381
SHA51220fb7b510c73d9ccd9af90f66f618795ffcf448d35e3d8fec50bc88bf17a1d1ce2842b4065446f06891bba39df3fb1a248d151d888578047ad757b0101c93924
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un086745.exeFilesize
544KB
MD5f0a3415324faf9430f71986bc563f824
SHA12b06f6b1b022b74f0e98668ff73c1d578463106f
SHA256cb355c6a2539387f3c1fc577a5b5af760cc150f2c13401932f2b3550d5866381
SHA51220fb7b510c73d9ccd9af90f66f618795ffcf448d35e3d8fec50bc88bf17a1d1ce2842b4065446f06891bba39df3fb1a248d151d888578047ad757b0101c93924
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4511.exeFilesize
321KB
MD55d1a989150eed05176577c5abcf1a9ed
SHA12b03bf0fffd8bf8350bb07cde5772b5d74be0d8d
SHA256a55b68cbdb7e53f5ba9a2ccfa6ac3592e72b1928cca879eb0b24f76314d4d50a
SHA5128123935cea5afea844b7434149e7b53b2fb8d5a4d0de6ff836a4ad8839479c30ebae6b626f6f41da59345111507540876e00e31e2fc73f9bb7d80f393d9c6d2f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4511.exeFilesize
321KB
MD55d1a989150eed05176577c5abcf1a9ed
SHA12b03bf0fffd8bf8350bb07cde5772b5d74be0d8d
SHA256a55b68cbdb7e53f5ba9a2ccfa6ac3592e72b1928cca879eb0b24f76314d4d50a
SHA5128123935cea5afea844b7434149e7b53b2fb8d5a4d0de6ff836a4ad8839479c30ebae6b626f6f41da59345111507540876e00e31e2fc73f9bb7d80f393d9c6d2f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2144.exeFilesize
380KB
MD50b766570b4ad28253e992410edc91cf8
SHA1753ab49b3a6eeba5d0e864302a536563f9b68646
SHA256568fe5360ec264c7739f84029407decca76b155526d22c706670945ef58de47f
SHA512b82172572efb76eaabdb7f209f567b27549adb0325a9b8bc66ec9188076175b83e769c2320de7dc786624ba72e6dd46ddfe3cdfe805d4e608399aaf3a525c2fc
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2144.exeFilesize
380KB
MD50b766570b4ad28253e992410edc91cf8
SHA1753ab49b3a6eeba5d0e864302a536563f9b68646
SHA256568fe5360ec264c7739f84029407decca76b155526d22c706670945ef58de47f
SHA512b82172572efb76eaabdb7f209f567b27549adb0325a9b8bc66ec9188076175b83e769c2320de7dc786624ba72e6dd46ddfe3cdfe805d4e608399aaf3a525c2fc
-
memory/1620-1122-0x0000000000C50000-0x0000000000C82000-memory.dmpFilesize
200KB
-
memory/1620-1123-0x0000000005560000-0x0000000005570000-memory.dmpFilesize
64KB
-
memory/1620-1124-0x0000000005560000-0x0000000005570000-memory.dmpFilesize
64KB
-
memory/4332-163-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4332-175-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4332-153-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4332-155-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4332-157-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4332-159-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4332-161-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4332-150-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4332-165-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4332-167-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4332-169-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4332-171-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4332-173-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4332-151-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4332-177-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4332-178-0x0000000007260000-0x0000000007270000-memory.dmpFilesize
64KB
-
memory/4332-179-0x0000000007260000-0x0000000007270000-memory.dmpFilesize
64KB
-
memory/4332-180-0x0000000007260000-0x0000000007270000-memory.dmpFilesize
64KB
-
memory/4332-181-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/4332-185-0x0000000007260000-0x0000000007270000-memory.dmpFilesize
64KB
-
memory/4332-184-0x0000000007260000-0x0000000007270000-memory.dmpFilesize
64KB
-
memory/4332-183-0x0000000007260000-0x0000000007270000-memory.dmpFilesize
64KB
-
memory/4332-186-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/4332-149-0x0000000007270000-0x0000000007814000-memory.dmpFilesize
5.6MB
-
memory/4332-148-0x0000000002C50000-0x0000000002C7D000-memory.dmpFilesize
180KB
-
memory/4904-194-0x0000000007730000-0x000000000776F000-memory.dmpFilesize
252KB
-
memory/4904-228-0x0000000007730000-0x000000000776F000-memory.dmpFilesize
252KB
-
memory/4904-198-0x0000000007730000-0x000000000776F000-memory.dmpFilesize
252KB
-
memory/4904-200-0x0000000007730000-0x000000000776F000-memory.dmpFilesize
252KB
-
memory/4904-202-0x0000000007730000-0x000000000776F000-memory.dmpFilesize
252KB
-
memory/4904-204-0x0000000007730000-0x000000000776F000-memory.dmpFilesize
252KB
-
memory/4904-208-0x0000000007170000-0x0000000007180000-memory.dmpFilesize
64KB
-
memory/4904-206-0x0000000002C80000-0x0000000002CCB000-memory.dmpFilesize
300KB
-
memory/4904-207-0x0000000007730000-0x000000000776F000-memory.dmpFilesize
252KB
-
memory/4904-211-0x0000000007730000-0x000000000776F000-memory.dmpFilesize
252KB
-
memory/4904-210-0x0000000007170000-0x0000000007180000-memory.dmpFilesize
64KB
-
memory/4904-213-0x0000000007170000-0x0000000007180000-memory.dmpFilesize
64KB
-
memory/4904-214-0x0000000007730000-0x000000000776F000-memory.dmpFilesize
252KB
-
memory/4904-216-0x0000000007730000-0x000000000776F000-memory.dmpFilesize
252KB
-
memory/4904-218-0x0000000007730000-0x000000000776F000-memory.dmpFilesize
252KB
-
memory/4904-220-0x0000000007730000-0x000000000776F000-memory.dmpFilesize
252KB
-
memory/4904-222-0x0000000007730000-0x000000000776F000-memory.dmpFilesize
252KB
-
memory/4904-224-0x0000000007730000-0x000000000776F000-memory.dmpFilesize
252KB
-
memory/4904-226-0x0000000007730000-0x000000000776F000-memory.dmpFilesize
252KB
-
memory/4904-196-0x0000000007730000-0x000000000776F000-memory.dmpFilesize
252KB
-
memory/4904-1101-0x0000000007790000-0x0000000007DA8000-memory.dmpFilesize
6.1MB
-
memory/4904-1102-0x0000000007E30000-0x0000000007F3A000-memory.dmpFilesize
1.0MB
-
memory/4904-1103-0x0000000007F70000-0x0000000007F82000-memory.dmpFilesize
72KB
-
memory/4904-1104-0x0000000007F90000-0x0000000007FCC000-memory.dmpFilesize
240KB
-
memory/4904-1105-0x0000000007170000-0x0000000007180000-memory.dmpFilesize
64KB
-
memory/4904-1107-0x0000000008280000-0x0000000008312000-memory.dmpFilesize
584KB
-
memory/4904-1108-0x0000000008320000-0x0000000008386000-memory.dmpFilesize
408KB
-
memory/4904-1109-0x0000000007170000-0x0000000007180000-memory.dmpFilesize
64KB
-
memory/4904-1110-0x0000000007170000-0x0000000007180000-memory.dmpFilesize
64KB
-
memory/4904-1111-0x0000000007170000-0x0000000007180000-memory.dmpFilesize
64KB
-
memory/4904-1112-0x0000000008A30000-0x0000000008AA6000-memory.dmpFilesize
472KB
-
memory/4904-1113-0x0000000008AB0000-0x0000000008B00000-memory.dmpFilesize
320KB
-
memory/4904-192-0x0000000007730000-0x000000000776F000-memory.dmpFilesize
252KB
-
memory/4904-191-0x0000000007730000-0x000000000776F000-memory.dmpFilesize
252KB
-
memory/4904-1114-0x0000000007170000-0x0000000007180000-memory.dmpFilesize
64KB
-
memory/4904-1115-0x000000000B1B0000-0x000000000B372000-memory.dmpFilesize
1.8MB
-
memory/4904-1116-0x000000000B3D0000-0x000000000B8FC000-memory.dmpFilesize
5.2MB