Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 07:32
Static task
static1
Behavioral task
behavioral1
Sample
c6895f182c63cf690302f9bc481ce4ce2b3b7cfee19b6082e03d744762c3e261.exe
Resource
win10v2004-20230220-en
General
-
Target
c6895f182c63cf690302f9bc481ce4ce2b3b7cfee19b6082e03d744762c3e261.exe
-
Size
684KB
-
MD5
ad43447e5ab238c863c90b487b1706f1
-
SHA1
cdfbaf61e1fe1e4089db65177032330151b4a423
-
SHA256
c6895f182c63cf690302f9bc481ce4ce2b3b7cfee19b6082e03d744762c3e261
-
SHA512
bf2a86618db82da5e5eb9b53f57a1e61c860b918f47f2aa6c5d64ee246dbcad98a9856208ed9b02b28b3b0c83ecdeb3b2f3153ef0d38771e35660c1335e62385
-
SSDEEP
12288:RMrDy90bZYi/s4zD97kStes49ltFjoLTVggiRqUk9mjL36h9:uyWSG/7z4/tFclg5qxmjLq
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Processes:
pro5229.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro5229.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro5229.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro5229.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro5229.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro5229.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro5229.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/2724-193-0x0000000004BF0000-0x0000000004C2F000-memory.dmp family_redline behavioral1/memory/2724-194-0x0000000004BF0000-0x0000000004C2F000-memory.dmp family_redline behavioral1/memory/2724-196-0x0000000004BF0000-0x0000000004C2F000-memory.dmp family_redline behavioral1/memory/2724-198-0x0000000004BF0000-0x0000000004C2F000-memory.dmp family_redline behavioral1/memory/2724-200-0x0000000004BF0000-0x0000000004C2F000-memory.dmp family_redline behavioral1/memory/2724-202-0x0000000004BF0000-0x0000000004C2F000-memory.dmp family_redline behavioral1/memory/2724-205-0x0000000004BF0000-0x0000000004C2F000-memory.dmp family_redline behavioral1/memory/2724-207-0x0000000004BF0000-0x0000000004C2F000-memory.dmp family_redline behavioral1/memory/2724-209-0x0000000004BF0000-0x0000000004C2F000-memory.dmp family_redline behavioral1/memory/2724-211-0x0000000004BF0000-0x0000000004C2F000-memory.dmp family_redline behavioral1/memory/2724-213-0x0000000004BF0000-0x0000000004C2F000-memory.dmp family_redline behavioral1/memory/2724-215-0x0000000004BF0000-0x0000000004C2F000-memory.dmp family_redline behavioral1/memory/2724-217-0x0000000004BF0000-0x0000000004C2F000-memory.dmp family_redline behavioral1/memory/2724-219-0x0000000004BF0000-0x0000000004C2F000-memory.dmp family_redline behavioral1/memory/2724-221-0x0000000004BF0000-0x0000000004C2F000-memory.dmp family_redline behavioral1/memory/2724-223-0x0000000004BF0000-0x0000000004C2F000-memory.dmp family_redline behavioral1/memory/2724-225-0x0000000004BF0000-0x0000000004C2F000-memory.dmp family_redline behavioral1/memory/2724-227-0x0000000004BF0000-0x0000000004C2F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un251285.exepro5229.exequ1874.exesi978407.exepid process 3728 un251285.exe 812 pro5229.exe 2724 qu1874.exe 2536 si978407.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro5229.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro5229.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro5229.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un251285.exec6895f182c63cf690302f9bc481ce4ce2b3b7cfee19b6082e03d744762c3e261.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un251285.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce c6895f182c63cf690302f9bc481ce4ce2b3b7cfee19b6082e03d744762c3e261.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c6895f182c63cf690302f9bc481ce4ce2b3b7cfee19b6082e03d744762c3e261.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un251285.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3036 812 WerFault.exe pro5229.exe 4828 2724 WerFault.exe qu1874.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro5229.exequ1874.exesi978407.exepid process 812 pro5229.exe 812 pro5229.exe 2724 qu1874.exe 2724 qu1874.exe 2536 si978407.exe 2536 si978407.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro5229.exequ1874.exesi978407.exedescription pid process Token: SeDebugPrivilege 812 pro5229.exe Token: SeDebugPrivilege 2724 qu1874.exe Token: SeDebugPrivilege 2536 si978407.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
c6895f182c63cf690302f9bc481ce4ce2b3b7cfee19b6082e03d744762c3e261.exeun251285.exedescription pid process target process PID 5008 wrote to memory of 3728 5008 c6895f182c63cf690302f9bc481ce4ce2b3b7cfee19b6082e03d744762c3e261.exe un251285.exe PID 5008 wrote to memory of 3728 5008 c6895f182c63cf690302f9bc481ce4ce2b3b7cfee19b6082e03d744762c3e261.exe un251285.exe PID 5008 wrote to memory of 3728 5008 c6895f182c63cf690302f9bc481ce4ce2b3b7cfee19b6082e03d744762c3e261.exe un251285.exe PID 3728 wrote to memory of 812 3728 un251285.exe pro5229.exe PID 3728 wrote to memory of 812 3728 un251285.exe pro5229.exe PID 3728 wrote to memory of 812 3728 un251285.exe pro5229.exe PID 3728 wrote to memory of 2724 3728 un251285.exe qu1874.exe PID 3728 wrote to memory of 2724 3728 un251285.exe qu1874.exe PID 3728 wrote to memory of 2724 3728 un251285.exe qu1874.exe PID 5008 wrote to memory of 2536 5008 c6895f182c63cf690302f9bc481ce4ce2b3b7cfee19b6082e03d744762c3e261.exe si978407.exe PID 5008 wrote to memory of 2536 5008 c6895f182c63cf690302f9bc481ce4ce2b3b7cfee19b6082e03d744762c3e261.exe si978407.exe PID 5008 wrote to memory of 2536 5008 c6895f182c63cf690302f9bc481ce4ce2b3b7cfee19b6082e03d744762c3e261.exe si978407.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6895f182c63cf690302f9bc481ce4ce2b3b7cfee19b6082e03d744762c3e261.exe"C:\Users\Admin\AppData\Local\Temp\c6895f182c63cf690302f9bc481ce4ce2b3b7cfee19b6082e03d744762c3e261.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un251285.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un251285.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5229.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5229.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 812 -s 10804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1874.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1874.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 11324⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si978407.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si978407.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 812 -ip 8121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2724 -ip 27241⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si978407.exeFilesize
175KB
MD539be982a9a56730c68a781c14f59a95c
SHA1a5d20c945bbb03868193796c200b5775abafff05
SHA2567885bf95a0d8c5c7f63dc6b218b8b87949bb2e8421035d8e7724d3139ca4e07a
SHA512e967d54ea74e2e4c1e2ff247cbf93750e134e7d31f796d3e6b6646f828d69facbd90c5a31184ed3aecdcc60639ff31f34c3efcd1dcb114e0ca3ab9535e5acc95
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si978407.exeFilesize
175KB
MD539be982a9a56730c68a781c14f59a95c
SHA1a5d20c945bbb03868193796c200b5775abafff05
SHA2567885bf95a0d8c5c7f63dc6b218b8b87949bb2e8421035d8e7724d3139ca4e07a
SHA512e967d54ea74e2e4c1e2ff247cbf93750e134e7d31f796d3e6b6646f828d69facbd90c5a31184ed3aecdcc60639ff31f34c3efcd1dcb114e0ca3ab9535e5acc95
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un251285.exeFilesize
542KB
MD5ef01ff37263f8a35f3d64576d0deaf8f
SHA151bb21ed81dd153051e255fe57a907490ce84f08
SHA25628c1b23a1e2d14a45824ce15ea60a221f989160ed08b6c2edfafcf3fee2ddf26
SHA5121fb45950dde3433e701c9be4c80e3a528fd52d31b88635a391736f2e28ce0d5e8562d3f19b92a01b1ea1439b370d49a58907dfafa07dd1be36a137fb19d602af
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un251285.exeFilesize
542KB
MD5ef01ff37263f8a35f3d64576d0deaf8f
SHA151bb21ed81dd153051e255fe57a907490ce84f08
SHA25628c1b23a1e2d14a45824ce15ea60a221f989160ed08b6c2edfafcf3fee2ddf26
SHA5121fb45950dde3433e701c9be4c80e3a528fd52d31b88635a391736f2e28ce0d5e8562d3f19b92a01b1ea1439b370d49a58907dfafa07dd1be36a137fb19d602af
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5229.exeFilesize
321KB
MD53ef74f3d431f302c8ca51ed310d0900a
SHA1381ed413c070ae4a2ce56660a400c89686dd7908
SHA256b4bf9baae82d2a0c22eee15ce23916d134e6bb373ac0a2333ce3f045770e66fb
SHA5128eb12b75fbfa2365b83f9c6baae54564949d7d0fdc0f7e9c629a7eb10521a4f6d29bd7aae51de105ff7dbf506a5aef78fd355314d60978b49f9baf2a21a0b437
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5229.exeFilesize
321KB
MD53ef74f3d431f302c8ca51ed310d0900a
SHA1381ed413c070ae4a2ce56660a400c89686dd7908
SHA256b4bf9baae82d2a0c22eee15ce23916d134e6bb373ac0a2333ce3f045770e66fb
SHA5128eb12b75fbfa2365b83f9c6baae54564949d7d0fdc0f7e9c629a7eb10521a4f6d29bd7aae51de105ff7dbf506a5aef78fd355314d60978b49f9baf2a21a0b437
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1874.exeFilesize
380KB
MD5ee3677d16751534bbf2f63235988e562
SHA1a3ce72ba3c8317adb62073183ed11140dcf4f5c6
SHA256e45af10b5b4ee0bff9eb6f816ca3356324f2fbf0d8a3de2b5a2b0b2f6772a770
SHA512023953b9b2b1cd9588efb4f18a404fd35c3d87f2998c7c23d5d3e2ead71c2cbb489f52701a924d01b97322285b9769f407d869f89dc42baf7d1e42570747b866
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1874.exeFilesize
380KB
MD5ee3677d16751534bbf2f63235988e562
SHA1a3ce72ba3c8317adb62073183ed11140dcf4f5c6
SHA256e45af10b5b4ee0bff9eb6f816ca3356324f2fbf0d8a3de2b5a2b0b2f6772a770
SHA512023953b9b2b1cd9588efb4f18a404fd35c3d87f2998c7c23d5d3e2ead71c2cbb489f52701a924d01b97322285b9769f407d869f89dc42baf7d1e42570747b866
-
memory/812-148-0x0000000002B80000-0x0000000002BAD000-memory.dmpFilesize
180KB
-
memory/812-149-0x00000000070E0000-0x0000000007684000-memory.dmpFilesize
5.6MB
-
memory/812-150-0x0000000004650000-0x0000000004660000-memory.dmpFilesize
64KB
-
memory/812-151-0x0000000004650000-0x0000000004660000-memory.dmpFilesize
64KB
-
memory/812-152-0x0000000004650000-0x0000000004660000-memory.dmpFilesize
64KB
-
memory/812-153-0x0000000004AD0000-0x0000000004AE2000-memory.dmpFilesize
72KB
-
memory/812-154-0x0000000004AD0000-0x0000000004AE2000-memory.dmpFilesize
72KB
-
memory/812-156-0x0000000004AD0000-0x0000000004AE2000-memory.dmpFilesize
72KB
-
memory/812-158-0x0000000004AD0000-0x0000000004AE2000-memory.dmpFilesize
72KB
-
memory/812-160-0x0000000004AD0000-0x0000000004AE2000-memory.dmpFilesize
72KB
-
memory/812-162-0x0000000004AD0000-0x0000000004AE2000-memory.dmpFilesize
72KB
-
memory/812-164-0x0000000004AD0000-0x0000000004AE2000-memory.dmpFilesize
72KB
-
memory/812-166-0x0000000004AD0000-0x0000000004AE2000-memory.dmpFilesize
72KB
-
memory/812-168-0x0000000004AD0000-0x0000000004AE2000-memory.dmpFilesize
72KB
-
memory/812-170-0x0000000004AD0000-0x0000000004AE2000-memory.dmpFilesize
72KB
-
memory/812-172-0x0000000004AD0000-0x0000000004AE2000-memory.dmpFilesize
72KB
-
memory/812-174-0x0000000004AD0000-0x0000000004AE2000-memory.dmpFilesize
72KB
-
memory/812-176-0x0000000004AD0000-0x0000000004AE2000-memory.dmpFilesize
72KB
-
memory/812-178-0x0000000004AD0000-0x0000000004AE2000-memory.dmpFilesize
72KB
-
memory/812-180-0x0000000004AD0000-0x0000000004AE2000-memory.dmpFilesize
72KB
-
memory/812-181-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/812-182-0x0000000004650000-0x0000000004660000-memory.dmpFilesize
64KB
-
memory/812-183-0x0000000004650000-0x0000000004660000-memory.dmpFilesize
64KB
-
memory/812-185-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/2536-1120-0x00000000005A0000-0x00000000005D2000-memory.dmpFilesize
200KB
-
memory/2536-1121-0x0000000004E30000-0x0000000004E40000-memory.dmpFilesize
64KB
-
memory/2724-191-0x0000000002F30000-0x0000000002F40000-memory.dmpFilesize
64KB
-
memory/2724-221-0x0000000004BF0000-0x0000000004C2F000-memory.dmpFilesize
252KB
-
memory/2724-193-0x0000000004BF0000-0x0000000004C2F000-memory.dmpFilesize
252KB
-
memory/2724-194-0x0000000004BF0000-0x0000000004C2F000-memory.dmpFilesize
252KB
-
memory/2724-196-0x0000000004BF0000-0x0000000004C2F000-memory.dmpFilesize
252KB
-
memory/2724-198-0x0000000004BF0000-0x0000000004C2F000-memory.dmpFilesize
252KB
-
memory/2724-200-0x0000000004BF0000-0x0000000004C2F000-memory.dmpFilesize
252KB
-
memory/2724-202-0x0000000004BF0000-0x0000000004C2F000-memory.dmpFilesize
252KB
-
memory/2724-204-0x0000000002F30000-0x0000000002F40000-memory.dmpFilesize
64KB
-
memory/2724-205-0x0000000004BF0000-0x0000000004C2F000-memory.dmpFilesize
252KB
-
memory/2724-207-0x0000000004BF0000-0x0000000004C2F000-memory.dmpFilesize
252KB
-
memory/2724-209-0x0000000004BF0000-0x0000000004C2F000-memory.dmpFilesize
252KB
-
memory/2724-211-0x0000000004BF0000-0x0000000004C2F000-memory.dmpFilesize
252KB
-
memory/2724-213-0x0000000004BF0000-0x0000000004C2F000-memory.dmpFilesize
252KB
-
memory/2724-215-0x0000000004BF0000-0x0000000004C2F000-memory.dmpFilesize
252KB
-
memory/2724-217-0x0000000004BF0000-0x0000000004C2F000-memory.dmpFilesize
252KB
-
memory/2724-219-0x0000000004BF0000-0x0000000004C2F000-memory.dmpFilesize
252KB
-
memory/2724-192-0x0000000002F30000-0x0000000002F40000-memory.dmpFilesize
64KB
-
memory/2724-223-0x0000000004BF0000-0x0000000004C2F000-memory.dmpFilesize
252KB
-
memory/2724-225-0x0000000004BF0000-0x0000000004C2F000-memory.dmpFilesize
252KB
-
memory/2724-227-0x0000000004BF0000-0x0000000004C2F000-memory.dmpFilesize
252KB
-
memory/2724-1100-0x00000000078D0000-0x0000000007EE8000-memory.dmpFilesize
6.1MB
-
memory/2724-1101-0x0000000007F70000-0x000000000807A000-memory.dmpFilesize
1.0MB
-
memory/2724-1102-0x00000000080B0000-0x00000000080C2000-memory.dmpFilesize
72KB
-
memory/2724-1103-0x0000000002F30000-0x0000000002F40000-memory.dmpFilesize
64KB
-
memory/2724-1104-0x00000000080D0000-0x000000000810C000-memory.dmpFilesize
240KB
-
memory/2724-1106-0x00000000083C0000-0x0000000008452000-memory.dmpFilesize
584KB
-
memory/2724-1107-0x0000000008460000-0x00000000084C6000-memory.dmpFilesize
408KB
-
memory/2724-1108-0x0000000002F30000-0x0000000002F40000-memory.dmpFilesize
64KB
-
memory/2724-1109-0x0000000002F30000-0x0000000002F40000-memory.dmpFilesize
64KB
-
memory/2724-1110-0x0000000002F30000-0x0000000002F40000-memory.dmpFilesize
64KB
-
memory/2724-1111-0x0000000008DC0000-0x0000000008F82000-memory.dmpFilesize
1.8MB
-
memory/2724-190-0x0000000002B90000-0x0000000002BDB000-memory.dmpFilesize
300KB
-
memory/2724-1112-0x0000000008FB0000-0x00000000094DC000-memory.dmpFilesize
5.2MB
-
memory/2724-1113-0x0000000009800000-0x0000000009876000-memory.dmpFilesize
472KB
-
memory/2724-1114-0x00000000098A0000-0x00000000098F0000-memory.dmpFilesize
320KB