Analysis
-
max time kernel
63s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 07:31
Static task
static1
Behavioral task
behavioral1
Sample
4037fabf0384847849d394c3c5142eb5bc56f9da1c2549522a3ac63a025c483f.exe
Resource
win10v2004-20230221-en
General
-
Target
4037fabf0384847849d394c3c5142eb5bc56f9da1c2549522a3ac63a025c483f.exe
-
Size
682KB
-
MD5
db3bfe0ab32ee9449f1163cd1a5082d6
-
SHA1
3d21205569775e917db661121cbd9b26d57a6d34
-
SHA256
4037fabf0384847849d394c3c5142eb5bc56f9da1c2549522a3ac63a025c483f
-
SHA512
3473f19ca5c3539ba7fb392882ef3627da924bbb30d38c463d7a9c8db19feac1f2bb28ec1271e503084332df6a9497a638d675849837de4ebc4a3829d5f37bb1
-
SSDEEP
12288:oMrfy90ohyxFdHnxC1CXuXC7pLVKn5jOUjN6XAAUrwmKL3PNpHOHeP5m:nyvkfHuXKLVKpKJmKLlpHk
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Processes:
pro4286.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro4286.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro4286.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro4286.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro4286.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro4286.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro4286.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/3880-190-0x0000000007760000-0x000000000779F000-memory.dmp family_redline behavioral1/memory/3880-191-0x0000000007760000-0x000000000779F000-memory.dmp family_redline behavioral1/memory/3880-193-0x0000000007760000-0x000000000779F000-memory.dmp family_redline behavioral1/memory/3880-195-0x0000000007760000-0x000000000779F000-memory.dmp family_redline behavioral1/memory/3880-197-0x0000000007760000-0x000000000779F000-memory.dmp family_redline behavioral1/memory/3880-199-0x0000000007760000-0x000000000779F000-memory.dmp family_redline behavioral1/memory/3880-203-0x0000000007760000-0x000000000779F000-memory.dmp family_redline behavioral1/memory/3880-201-0x0000000007760000-0x000000000779F000-memory.dmp family_redline behavioral1/memory/3880-205-0x0000000007760000-0x000000000779F000-memory.dmp family_redline behavioral1/memory/3880-207-0x0000000007760000-0x000000000779F000-memory.dmp family_redline behavioral1/memory/3880-211-0x0000000007760000-0x000000000779F000-memory.dmp family_redline behavioral1/memory/3880-217-0x0000000007760000-0x000000000779F000-memory.dmp family_redline behavioral1/memory/3880-219-0x0000000007760000-0x000000000779F000-memory.dmp family_redline behavioral1/memory/3880-214-0x0000000007760000-0x000000000779F000-memory.dmp family_redline behavioral1/memory/3880-221-0x0000000007760000-0x000000000779F000-memory.dmp family_redline behavioral1/memory/3880-223-0x0000000007760000-0x000000000779F000-memory.dmp family_redline behavioral1/memory/3880-225-0x0000000007760000-0x000000000779F000-memory.dmp family_redline behavioral1/memory/3880-227-0x0000000007760000-0x000000000779F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un736984.exepro4286.exequ4158.exesi489331.exepid process 1204 un736984.exe 2196 pro4286.exe 3880 qu4158.exe 1868 si489331.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro4286.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro4286.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro4286.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
4037fabf0384847849d394c3c5142eb5bc56f9da1c2549522a3ac63a025c483f.exeun736984.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 4037fabf0384847849d394c3c5142eb5bc56f9da1c2549522a3ac63a025c483f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 4037fabf0384847849d394c3c5142eb5bc56f9da1c2549522a3ac63a025c483f.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un736984.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un736984.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4340 2196 WerFault.exe pro4286.exe 4380 3880 WerFault.exe qu4158.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro4286.exequ4158.exesi489331.exepid process 2196 pro4286.exe 2196 pro4286.exe 3880 qu4158.exe 3880 qu4158.exe 1868 si489331.exe 1868 si489331.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro4286.exequ4158.exesi489331.exedescription pid process Token: SeDebugPrivilege 2196 pro4286.exe Token: SeDebugPrivilege 3880 qu4158.exe Token: SeDebugPrivilege 1868 si489331.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
4037fabf0384847849d394c3c5142eb5bc56f9da1c2549522a3ac63a025c483f.exeun736984.exedescription pid process target process PID 1644 wrote to memory of 1204 1644 4037fabf0384847849d394c3c5142eb5bc56f9da1c2549522a3ac63a025c483f.exe un736984.exe PID 1644 wrote to memory of 1204 1644 4037fabf0384847849d394c3c5142eb5bc56f9da1c2549522a3ac63a025c483f.exe un736984.exe PID 1644 wrote to memory of 1204 1644 4037fabf0384847849d394c3c5142eb5bc56f9da1c2549522a3ac63a025c483f.exe un736984.exe PID 1204 wrote to memory of 2196 1204 un736984.exe pro4286.exe PID 1204 wrote to memory of 2196 1204 un736984.exe pro4286.exe PID 1204 wrote to memory of 2196 1204 un736984.exe pro4286.exe PID 1204 wrote to memory of 3880 1204 un736984.exe qu4158.exe PID 1204 wrote to memory of 3880 1204 un736984.exe qu4158.exe PID 1204 wrote to memory of 3880 1204 un736984.exe qu4158.exe PID 1644 wrote to memory of 1868 1644 4037fabf0384847849d394c3c5142eb5bc56f9da1c2549522a3ac63a025c483f.exe si489331.exe PID 1644 wrote to memory of 1868 1644 4037fabf0384847849d394c3c5142eb5bc56f9da1c2549522a3ac63a025c483f.exe si489331.exe PID 1644 wrote to memory of 1868 1644 4037fabf0384847849d394c3c5142eb5bc56f9da1c2549522a3ac63a025c483f.exe si489331.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4037fabf0384847849d394c3c5142eb5bc56f9da1c2549522a3ac63a025c483f.exe"C:\Users\Admin\AppData\Local\Temp\4037fabf0384847849d394c3c5142eb5bc56f9da1c2549522a3ac63a025c483f.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un736984.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un736984.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4286.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4286.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 10804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4158.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4158.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 13284⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si489331.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si489331.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2196 -ip 21961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3880 -ip 38801⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si489331.exeFilesize
175KB
MD5cea04bbe13a2689464a9ae7a086455bc
SHA19ab3812a70b8b4c19279bfad2933aad90ac6f364
SHA25676eb7f28672af1197e528a3f231f45432d263ae3f2a1dc49fa8809f9161aace5
SHA512cd63d8940b8c8eff9eac2d0a02c008f556a798cfd1b5e79b00498c1e3eac130bbad4aea13a9e327ee2741e902dc3f643d8df74a65c46b1960d52cd51ac1a6e93
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si489331.exeFilesize
175KB
MD5cea04bbe13a2689464a9ae7a086455bc
SHA19ab3812a70b8b4c19279bfad2933aad90ac6f364
SHA25676eb7f28672af1197e528a3f231f45432d263ae3f2a1dc49fa8809f9161aace5
SHA512cd63d8940b8c8eff9eac2d0a02c008f556a798cfd1b5e79b00498c1e3eac130bbad4aea13a9e327ee2741e902dc3f643d8df74a65c46b1960d52cd51ac1a6e93
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un736984.exeFilesize
541KB
MD55c59b7c9dc69537b3f746776b6729eb2
SHA1e76348fa1ffb5cdfc935543d894c31b2d326d55e
SHA2569199ce25206d94be0721f7b121d97e9069b1a1168cad4ff1eb7e05fb22241e1a
SHA512ef13ceed3a47e39f25b0fe596d9a3346ce4c12439479923182db7dac79ddc4ecb05ec082f99264e556717d1ccd0a3e830c3908101ef0886d5297a830a5c79330
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un736984.exeFilesize
541KB
MD55c59b7c9dc69537b3f746776b6729eb2
SHA1e76348fa1ffb5cdfc935543d894c31b2d326d55e
SHA2569199ce25206d94be0721f7b121d97e9069b1a1168cad4ff1eb7e05fb22241e1a
SHA512ef13ceed3a47e39f25b0fe596d9a3346ce4c12439479923182db7dac79ddc4ecb05ec082f99264e556717d1ccd0a3e830c3908101ef0886d5297a830a5c79330
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4286.exeFilesize
321KB
MD50bc31c5a607849de40575a4eb5c7a0a4
SHA1751e77ec578414ebb4e630f53bbc0d44f0934d8f
SHA25660bbdce2148061d77b13aae67aacf0daa4d1316fed046216a0ad6a94be63efde
SHA5128ba3fcb20a541396682f56afa27585fa33de33db68007f285e7b8b7d711aa2512e27cf97da6813201a331753a78ce9539737e320c25c26caeed88d7ecb42b824
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4286.exeFilesize
321KB
MD50bc31c5a607849de40575a4eb5c7a0a4
SHA1751e77ec578414ebb4e630f53bbc0d44f0934d8f
SHA25660bbdce2148061d77b13aae67aacf0daa4d1316fed046216a0ad6a94be63efde
SHA5128ba3fcb20a541396682f56afa27585fa33de33db68007f285e7b8b7d711aa2512e27cf97da6813201a331753a78ce9539737e320c25c26caeed88d7ecb42b824
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4158.exeFilesize
380KB
MD58fa043adf2f920b83c51d26febc8c3b4
SHA1798856fc59abb5591151f8e7336ae7b66901570b
SHA256592514720764fccd80b20dccb8f539fc58104d7e7a4939374dfdf6878fd5c8b7
SHA5126f1099791868565ef457b79273b3833aabebbcd82e73ecfd5d686bb46bc7a681375aba64eb548fe9fd309ce4d47c8c4ff0b7ec77e55402dcbd1223734974999a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4158.exeFilesize
380KB
MD58fa043adf2f920b83c51d26febc8c3b4
SHA1798856fc59abb5591151f8e7336ae7b66901570b
SHA256592514720764fccd80b20dccb8f539fc58104d7e7a4939374dfdf6878fd5c8b7
SHA5126f1099791868565ef457b79273b3833aabebbcd82e73ecfd5d686bb46bc7a681375aba64eb548fe9fd309ce4d47c8c4ff0b7ec77e55402dcbd1223734974999a
-
memory/1868-1121-0x0000000000760000-0x0000000000792000-memory.dmpFilesize
200KB
-
memory/1868-1122-0x0000000005360000-0x0000000005370000-memory.dmpFilesize
64KB
-
memory/2196-160-0x0000000004C80000-0x0000000004C92000-memory.dmpFilesize
72KB
-
memory/2196-166-0x0000000004C80000-0x0000000004C92000-memory.dmpFilesize
72KB
-
memory/2196-152-0x0000000004C80000-0x0000000004C92000-memory.dmpFilesize
72KB
-
memory/2196-154-0x0000000004C80000-0x0000000004C92000-memory.dmpFilesize
72KB
-
memory/2196-156-0x0000000004C80000-0x0000000004C92000-memory.dmpFilesize
72KB
-
memory/2196-158-0x0000000004C80000-0x0000000004C92000-memory.dmpFilesize
72KB
-
memory/2196-150-0x0000000004C80000-0x0000000004C92000-memory.dmpFilesize
72KB
-
memory/2196-163-0x0000000002BA0000-0x0000000002BCD000-memory.dmpFilesize
180KB
-
memory/2196-164-0x00000000072B0000-0x00000000072C0000-memory.dmpFilesize
64KB
-
memory/2196-162-0x0000000004C80000-0x0000000004C92000-memory.dmpFilesize
72KB
-
memory/2196-167-0x00000000072B0000-0x00000000072C0000-memory.dmpFilesize
64KB
-
memory/2196-149-0x0000000004C80000-0x0000000004C92000-memory.dmpFilesize
72KB
-
memory/2196-169-0x0000000004C80000-0x0000000004C92000-memory.dmpFilesize
72KB
-
memory/2196-171-0x0000000004C80000-0x0000000004C92000-memory.dmpFilesize
72KB
-
memory/2196-173-0x0000000004C80000-0x0000000004C92000-memory.dmpFilesize
72KB
-
memory/2196-175-0x0000000004C80000-0x0000000004C92000-memory.dmpFilesize
72KB
-
memory/2196-177-0x0000000004C80000-0x0000000004C92000-memory.dmpFilesize
72KB
-
memory/2196-179-0x0000000004C80000-0x0000000004C92000-memory.dmpFilesize
72KB
-
memory/2196-180-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/2196-182-0x00000000072B0000-0x00000000072C0000-memory.dmpFilesize
64KB
-
memory/2196-181-0x00000000072B0000-0x00000000072C0000-memory.dmpFilesize
64KB
-
memory/2196-183-0x00000000072B0000-0x00000000072C0000-memory.dmpFilesize
64KB
-
memory/2196-185-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/2196-148-0x00000000072C0000-0x0000000007864000-memory.dmpFilesize
5.6MB
-
memory/3880-191-0x0000000007760000-0x000000000779F000-memory.dmpFilesize
252KB
-
memory/3880-225-0x0000000007760000-0x000000000779F000-memory.dmpFilesize
252KB
-
memory/3880-195-0x0000000007760000-0x000000000779F000-memory.dmpFilesize
252KB
-
memory/3880-197-0x0000000007760000-0x000000000779F000-memory.dmpFilesize
252KB
-
memory/3880-199-0x0000000007760000-0x000000000779F000-memory.dmpFilesize
252KB
-
memory/3880-203-0x0000000007760000-0x000000000779F000-memory.dmpFilesize
252KB
-
memory/3880-201-0x0000000007760000-0x000000000779F000-memory.dmpFilesize
252KB
-
memory/3880-205-0x0000000007760000-0x000000000779F000-memory.dmpFilesize
252KB
-
memory/3880-208-0x0000000002C70000-0x0000000002CBB000-memory.dmpFilesize
300KB
-
memory/3880-207-0x0000000007760000-0x000000000779F000-memory.dmpFilesize
252KB
-
memory/3880-210-0x00000000071A0000-0x00000000071B0000-memory.dmpFilesize
64KB
-
memory/3880-212-0x00000000071A0000-0x00000000071B0000-memory.dmpFilesize
64KB
-
memory/3880-211-0x0000000007760000-0x000000000779F000-memory.dmpFilesize
252KB
-
memory/3880-215-0x00000000071A0000-0x00000000071B0000-memory.dmpFilesize
64KB
-
memory/3880-217-0x0000000007760000-0x000000000779F000-memory.dmpFilesize
252KB
-
memory/3880-219-0x0000000007760000-0x000000000779F000-memory.dmpFilesize
252KB
-
memory/3880-214-0x0000000007760000-0x000000000779F000-memory.dmpFilesize
252KB
-
memory/3880-221-0x0000000007760000-0x000000000779F000-memory.dmpFilesize
252KB
-
memory/3880-223-0x0000000007760000-0x000000000779F000-memory.dmpFilesize
252KB
-
memory/3880-193-0x0000000007760000-0x000000000779F000-memory.dmpFilesize
252KB
-
memory/3880-227-0x0000000007760000-0x000000000779F000-memory.dmpFilesize
252KB
-
memory/3880-1100-0x00000000078E0000-0x0000000007EF8000-memory.dmpFilesize
6.1MB
-
memory/3880-1101-0x0000000007F70000-0x000000000807A000-memory.dmpFilesize
1.0MB
-
memory/3880-1102-0x00000000080B0000-0x00000000080C2000-memory.dmpFilesize
72KB
-
memory/3880-1103-0x00000000080D0000-0x000000000810C000-memory.dmpFilesize
240KB
-
memory/3880-1104-0x00000000071A0000-0x00000000071B0000-memory.dmpFilesize
64KB
-
memory/3880-1106-0x00000000083C0000-0x0000000008426000-memory.dmpFilesize
408KB
-
memory/3880-1107-0x0000000008A90000-0x0000000008B22000-memory.dmpFilesize
584KB
-
memory/3880-1108-0x00000000071A0000-0x00000000071B0000-memory.dmpFilesize
64KB
-
memory/3880-1109-0x00000000071A0000-0x00000000071B0000-memory.dmpFilesize
64KB
-
memory/3880-1110-0x00000000071A0000-0x00000000071B0000-memory.dmpFilesize
64KB
-
memory/3880-1111-0x0000000008B60000-0x0000000008BD6000-memory.dmpFilesize
472KB
-
memory/3880-1112-0x0000000008BF0000-0x0000000008C40000-memory.dmpFilesize
320KB
-
memory/3880-190-0x0000000007760000-0x000000000779F000-memory.dmpFilesize
252KB
-
memory/3880-1113-0x0000000008C70000-0x0000000008E32000-memory.dmpFilesize
1.8MB
-
memory/3880-1114-0x0000000008E40000-0x000000000936C000-memory.dmpFilesize
5.2MB
-
memory/3880-1115-0x00000000071A0000-0x00000000071B0000-memory.dmpFilesize
64KB