Analysis
-
max time kernel
60s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 08:18
Static task
static1
Behavioral task
behavioral1
Sample
eddd0ee70352f571c912b3565f7c5732607f5a4fe67cf29f4706c58c744e5cea.exe
Resource
win10v2004-20230220-en
General
-
Target
eddd0ee70352f571c912b3565f7c5732607f5a4fe67cf29f4706c58c744e5cea.exe
-
Size
684KB
-
MD5
a6450c48872a664839ba453bdf60fc5a
-
SHA1
5946a8b41e1aa6e39c89c8284d5f616606f46198
-
SHA256
eddd0ee70352f571c912b3565f7c5732607f5a4fe67cf29f4706c58c744e5cea
-
SHA512
851c74ea1b60ac51b632b5ed57163fcbf597ae08f91b7f56d48a271294c82cb92dcbb17fd4c55426954e90e3425e1e30542a1cf126659152fb16c8b32727c4d0
-
SSDEEP
12288:iMr2y90dpSc7vBjelNOVDtqls49lnIyRc5dFUBnmOLETeeWHgb:IyfcLBeOr4/nIyuPFkmOLand
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Processes:
pro2015.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro2015.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro2015.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro2015.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro2015.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro2015.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro2015.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/3972-190-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/3972-191-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/3972-193-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/3972-195-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/3972-197-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/3972-199-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/3972-201-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/3972-205-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/3972-209-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/3972-211-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/3972-213-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/3972-215-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/3972-217-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/3972-219-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/3972-221-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/3972-223-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/3972-225-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/3972-227-0x0000000007130000-0x000000000716F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un280673.exepro2015.exequ4721.exesi574605.exepid process 4596 un280673.exe 2240 pro2015.exe 3972 qu4721.exe 1676 si574605.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro2015.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro2015.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro2015.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
eddd0ee70352f571c912b3565f7c5732607f5a4fe67cf29f4706c58c744e5cea.exeun280673.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce eddd0ee70352f571c912b3565f7c5732607f5a4fe67cf29f4706c58c744e5cea.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" eddd0ee70352f571c912b3565f7c5732607f5a4fe67cf29f4706c58c744e5cea.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un280673.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un280673.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1740 2240 WerFault.exe pro2015.exe 620 3972 WerFault.exe qu4721.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro2015.exequ4721.exesi574605.exepid process 2240 pro2015.exe 2240 pro2015.exe 3972 qu4721.exe 3972 qu4721.exe 1676 si574605.exe 1676 si574605.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro2015.exequ4721.exesi574605.exedescription pid process Token: SeDebugPrivilege 2240 pro2015.exe Token: SeDebugPrivilege 3972 qu4721.exe Token: SeDebugPrivilege 1676 si574605.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
eddd0ee70352f571c912b3565f7c5732607f5a4fe67cf29f4706c58c744e5cea.exeun280673.exedescription pid process target process PID 4144 wrote to memory of 4596 4144 eddd0ee70352f571c912b3565f7c5732607f5a4fe67cf29f4706c58c744e5cea.exe un280673.exe PID 4144 wrote to memory of 4596 4144 eddd0ee70352f571c912b3565f7c5732607f5a4fe67cf29f4706c58c744e5cea.exe un280673.exe PID 4144 wrote to memory of 4596 4144 eddd0ee70352f571c912b3565f7c5732607f5a4fe67cf29f4706c58c744e5cea.exe un280673.exe PID 4596 wrote to memory of 2240 4596 un280673.exe pro2015.exe PID 4596 wrote to memory of 2240 4596 un280673.exe pro2015.exe PID 4596 wrote to memory of 2240 4596 un280673.exe pro2015.exe PID 4596 wrote to memory of 3972 4596 un280673.exe qu4721.exe PID 4596 wrote to memory of 3972 4596 un280673.exe qu4721.exe PID 4596 wrote to memory of 3972 4596 un280673.exe qu4721.exe PID 4144 wrote to memory of 1676 4144 eddd0ee70352f571c912b3565f7c5732607f5a4fe67cf29f4706c58c744e5cea.exe si574605.exe PID 4144 wrote to memory of 1676 4144 eddd0ee70352f571c912b3565f7c5732607f5a4fe67cf29f4706c58c744e5cea.exe si574605.exe PID 4144 wrote to memory of 1676 4144 eddd0ee70352f571c912b3565f7c5732607f5a4fe67cf29f4706c58c744e5cea.exe si574605.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eddd0ee70352f571c912b3565f7c5732607f5a4fe67cf29f4706c58c744e5cea.exe"C:\Users\Admin\AppData\Local\Temp\eddd0ee70352f571c912b3565f7c5732607f5a4fe67cf29f4706c58c744e5cea.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un280673.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un280673.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2015.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2015.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 10084⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4721.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4721.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3972 -s 11604⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si574605.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si574605.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2240 -ip 22401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3972 -ip 39721⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si574605.exeFilesize
175KB
MD5b4efe140629e27626c4cdeed6ab03a4d
SHA1a538707622a10ea53ed71d6577843451947bc5ed
SHA256afb66bb113d87944fe118fc9be31517c485ef9e27b2ecf08e56ea8d86db69166
SHA512c93679f6cee3afd4891f865e764c4aba63c79ebecdb0217ab90d7585567347665b20e23f7510b2e81b8da5bdc5154c9abc766cee50a31478ddae2508f13df906
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si574605.exeFilesize
175KB
MD5b4efe140629e27626c4cdeed6ab03a4d
SHA1a538707622a10ea53ed71d6577843451947bc5ed
SHA256afb66bb113d87944fe118fc9be31517c485ef9e27b2ecf08e56ea8d86db69166
SHA512c93679f6cee3afd4891f865e764c4aba63c79ebecdb0217ab90d7585567347665b20e23f7510b2e81b8da5bdc5154c9abc766cee50a31478ddae2508f13df906
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un280673.exeFilesize
542KB
MD5d815bdeffc900b1caf8b886d564a28e5
SHA11c28ac5f9611d13c0b67201c86a1833ab917c47e
SHA256051008c18a8ca7c1099f9ea89f5d6cef216f9034b79da1f3778188bbaef08b7e
SHA512f5e1e122aed5fbf09a9bd9f9b38d9f1b3ba80a425231ca557b2725c9001a799a7a4797ea99cb013cdf575ca9b91773224a5a8286834b06a86fd8cbc31aca0ede
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un280673.exeFilesize
542KB
MD5d815bdeffc900b1caf8b886d564a28e5
SHA11c28ac5f9611d13c0b67201c86a1833ab917c47e
SHA256051008c18a8ca7c1099f9ea89f5d6cef216f9034b79da1f3778188bbaef08b7e
SHA512f5e1e122aed5fbf09a9bd9f9b38d9f1b3ba80a425231ca557b2725c9001a799a7a4797ea99cb013cdf575ca9b91773224a5a8286834b06a86fd8cbc31aca0ede
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2015.exeFilesize
321KB
MD519e901bffbc11b234c9f1089dbd885a8
SHA1b794805b31fd32089563d0282696fabae21235f9
SHA256bae1138d4f441bdefb06c4feb34e2a0a7657b5366f2cf2e49a2283507df70ba9
SHA512d3bd31d6cca98a5e7627850423610a3375d735181fa6024d845c298c90158629a8b2b733aa275b103f5abc7b74b2bf0a5942ecfb98c8d1cd983b3ad12ba5e109
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2015.exeFilesize
321KB
MD519e901bffbc11b234c9f1089dbd885a8
SHA1b794805b31fd32089563d0282696fabae21235f9
SHA256bae1138d4f441bdefb06c4feb34e2a0a7657b5366f2cf2e49a2283507df70ba9
SHA512d3bd31d6cca98a5e7627850423610a3375d735181fa6024d845c298c90158629a8b2b733aa275b103f5abc7b74b2bf0a5942ecfb98c8d1cd983b3ad12ba5e109
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4721.exeFilesize
380KB
MD5b6365ce9e209a35b325f08a9f014c034
SHA187d1c7f50d087f031fdb746d578497814fa64a37
SHA256002819c37a72f6c8638eb41719b46f53d98044d76c78efde8321c857be1de601
SHA512f5ff0508ecd98e691552e2cd27a4aa730dcde9541c27ab427d23890d16a1a8fea552254b69519f98998332e140f441fbddb587dfad5298aab579251722b336c3
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4721.exeFilesize
380KB
MD5b6365ce9e209a35b325f08a9f014c034
SHA187d1c7f50d087f031fdb746d578497814fa64a37
SHA256002819c37a72f6c8638eb41719b46f53d98044d76c78efde8321c857be1de601
SHA512f5ff0508ecd98e691552e2cd27a4aa730dcde9541c27ab427d23890d16a1a8fea552254b69519f98998332e140f441fbddb587dfad5298aab579251722b336c3
-
memory/1676-1121-0x0000000000AE0000-0x0000000000B12000-memory.dmpFilesize
200KB
-
memory/1676-1122-0x0000000005410000-0x0000000005420000-memory.dmpFilesize
64KB
-
memory/1676-1123-0x0000000005410000-0x0000000005420000-memory.dmpFilesize
64KB
-
memory/2240-159-0x0000000004B90000-0x0000000004BA2000-memory.dmpFilesize
72KB
-
memory/2240-171-0x0000000004B90000-0x0000000004BA2000-memory.dmpFilesize
72KB
-
memory/2240-153-0x0000000004B90000-0x0000000004BA2000-memory.dmpFilesize
72KB
-
memory/2240-155-0x0000000004B90000-0x0000000004BA2000-memory.dmpFilesize
72KB
-
memory/2240-157-0x0000000004B90000-0x0000000004BA2000-memory.dmpFilesize
72KB
-
memory/2240-150-0x0000000004B90000-0x0000000004BA2000-memory.dmpFilesize
72KB
-
memory/2240-161-0x0000000004B90000-0x0000000004BA2000-memory.dmpFilesize
72KB
-
memory/2240-163-0x0000000004B90000-0x0000000004BA2000-memory.dmpFilesize
72KB
-
memory/2240-165-0x0000000004B90000-0x0000000004BA2000-memory.dmpFilesize
72KB
-
memory/2240-167-0x0000000004B90000-0x0000000004BA2000-memory.dmpFilesize
72KB
-
memory/2240-169-0x0000000004B90000-0x0000000004BA2000-memory.dmpFilesize
72KB
-
memory/2240-151-0x0000000004B90000-0x0000000004BA2000-memory.dmpFilesize
72KB
-
memory/2240-173-0x0000000004B90000-0x0000000004BA2000-memory.dmpFilesize
72KB
-
memory/2240-175-0x0000000004B90000-0x0000000004BA2000-memory.dmpFilesize
72KB
-
memory/2240-177-0x0000000004B90000-0x0000000004BA2000-memory.dmpFilesize
72KB
-
memory/2240-178-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/2240-179-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/2240-180-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/2240-182-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/2240-183-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/2240-184-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/2240-185-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/2240-149-0x00000000071E0000-0x0000000007784000-memory.dmpFilesize
5.6MB
-
memory/2240-148-0x0000000002C60000-0x0000000002C8D000-memory.dmpFilesize
180KB
-
memory/3972-195-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/3972-227-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/3972-197-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/3972-199-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/3972-202-0x0000000002CC0000-0x0000000002D0B000-memory.dmpFilesize
300KB
-
memory/3972-201-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/3972-204-0x00000000071E0000-0x00000000071F0000-memory.dmpFilesize
64KB
-
memory/3972-206-0x00000000071E0000-0x00000000071F0000-memory.dmpFilesize
64KB
-
memory/3972-205-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/3972-209-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/3972-211-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/3972-213-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/3972-207-0x00000000071E0000-0x00000000071F0000-memory.dmpFilesize
64KB
-
memory/3972-215-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/3972-217-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/3972-219-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/3972-221-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/3972-223-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/3972-225-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/3972-193-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/3972-1100-0x00000000078E0000-0x0000000007EF8000-memory.dmpFilesize
6.1MB
-
memory/3972-1101-0x0000000007F70000-0x000000000807A000-memory.dmpFilesize
1.0MB
-
memory/3972-1102-0x00000000080B0000-0x00000000080C2000-memory.dmpFilesize
72KB
-
memory/3972-1103-0x00000000080D0000-0x000000000810C000-memory.dmpFilesize
240KB
-
memory/3972-1104-0x00000000071E0000-0x00000000071F0000-memory.dmpFilesize
64KB
-
memory/3972-1106-0x00000000083C0000-0x0000000008452000-memory.dmpFilesize
584KB
-
memory/3972-1107-0x0000000008460000-0x00000000084C6000-memory.dmpFilesize
408KB
-
memory/3972-1108-0x00000000071E0000-0x00000000071F0000-memory.dmpFilesize
64KB
-
memory/3972-1109-0x00000000071E0000-0x00000000071F0000-memory.dmpFilesize
64KB
-
memory/3972-1110-0x00000000071E0000-0x00000000071F0000-memory.dmpFilesize
64KB
-
memory/3972-1111-0x0000000008B70000-0x0000000008BE6000-memory.dmpFilesize
472KB
-
memory/3972-1112-0x0000000008BF0000-0x0000000008C40000-memory.dmpFilesize
320KB
-
memory/3972-191-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/3972-190-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/3972-1113-0x00000000071E0000-0x00000000071F0000-memory.dmpFilesize
64KB
-
memory/3972-1114-0x0000000008EA0000-0x0000000009062000-memory.dmpFilesize
1.8MB
-
memory/3972-1115-0x00000000090C0000-0x00000000095EC000-memory.dmpFilesize
5.2MB