Analysis
-
max time kernel
55s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 07:40
Static task
static1
Behavioral task
behavioral1
Sample
ac6f78c77c1d1ffb78e51edd19f57487dd0b137feb5602449cf86696ef339048.exe
Resource
win10v2004-20230220-en
General
-
Target
ac6f78c77c1d1ffb78e51edd19f57487dd0b137feb5602449cf86696ef339048.exe
-
Size
684KB
-
MD5
836986cce54a048c8c29b41e2bc301a9
-
SHA1
89185b727de852f77b123ec96530c2305a9a0559
-
SHA256
ac6f78c77c1d1ffb78e51edd19f57487dd0b137feb5602449cf86696ef339048
-
SHA512
72095638a87aba092482b849629784808baf5218391fbc93fa88879a14d24e3915d344a0a321ba47670a5a1f61c5da32957c3d694305f7d312fe49b1b2ae488e
-
SSDEEP
12288:OMrGy90V+4Y9RQmtIV/yGX6yjCnqR59oM/UyVmvL3/P7dv:0yp3y6GRjCy59omrmvLt
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Processes:
pro1078.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro1078.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro1078.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro1078.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro1078.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro1078.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro1078.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/64-190-0x00000000071A0000-0x00000000071DF000-memory.dmp family_redline behavioral1/memory/64-191-0x00000000071A0000-0x00000000071DF000-memory.dmp family_redline behavioral1/memory/64-193-0x00000000071A0000-0x00000000071DF000-memory.dmp family_redline behavioral1/memory/64-195-0x00000000071A0000-0x00000000071DF000-memory.dmp family_redline behavioral1/memory/64-197-0x00000000071A0000-0x00000000071DF000-memory.dmp family_redline behavioral1/memory/64-199-0x00000000071A0000-0x00000000071DF000-memory.dmp family_redline behavioral1/memory/64-201-0x00000000071A0000-0x00000000071DF000-memory.dmp family_redline behavioral1/memory/64-203-0x00000000071A0000-0x00000000071DF000-memory.dmp family_redline behavioral1/memory/64-205-0x00000000071A0000-0x00000000071DF000-memory.dmp family_redline behavioral1/memory/64-207-0x00000000071A0000-0x00000000071DF000-memory.dmp family_redline behavioral1/memory/64-214-0x00000000071A0000-0x00000000071DF000-memory.dmp family_redline behavioral1/memory/64-210-0x00000000071A0000-0x00000000071DF000-memory.dmp family_redline behavioral1/memory/64-217-0x00000000071A0000-0x00000000071DF000-memory.dmp family_redline behavioral1/memory/64-219-0x00000000071A0000-0x00000000071DF000-memory.dmp family_redline behavioral1/memory/64-221-0x00000000071A0000-0x00000000071DF000-memory.dmp family_redline behavioral1/memory/64-223-0x00000000071A0000-0x00000000071DF000-memory.dmp family_redline behavioral1/memory/64-225-0x00000000071A0000-0x00000000071DF000-memory.dmp family_redline behavioral1/memory/64-227-0x00000000071A0000-0x00000000071DF000-memory.dmp family_redline behavioral1/memory/64-1108-0x00000000072F0000-0x0000000007300000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un421945.exepro1078.exequ6859.exesi189050.exepid process 3604 un421945.exe 3096 pro1078.exe 64 qu6859.exe 1704 si189050.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro1078.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro1078.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro1078.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
ac6f78c77c1d1ffb78e51edd19f57487dd0b137feb5602449cf86696ef339048.exeun421945.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ac6f78c77c1d1ffb78e51edd19f57487dd0b137feb5602449cf86696ef339048.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" ac6f78c77c1d1ffb78e51edd19f57487dd0b137feb5602449cf86696ef339048.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un421945.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un421945.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3080 3096 WerFault.exe pro1078.exe 2656 64 WerFault.exe qu6859.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro1078.exequ6859.exesi189050.exepid process 3096 pro1078.exe 3096 pro1078.exe 64 qu6859.exe 64 qu6859.exe 1704 si189050.exe 1704 si189050.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro1078.exequ6859.exesi189050.exedescription pid process Token: SeDebugPrivilege 3096 pro1078.exe Token: SeDebugPrivilege 64 qu6859.exe Token: SeDebugPrivilege 1704 si189050.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
ac6f78c77c1d1ffb78e51edd19f57487dd0b137feb5602449cf86696ef339048.exeun421945.exedescription pid process target process PID 4228 wrote to memory of 3604 4228 ac6f78c77c1d1ffb78e51edd19f57487dd0b137feb5602449cf86696ef339048.exe un421945.exe PID 4228 wrote to memory of 3604 4228 ac6f78c77c1d1ffb78e51edd19f57487dd0b137feb5602449cf86696ef339048.exe un421945.exe PID 4228 wrote to memory of 3604 4228 ac6f78c77c1d1ffb78e51edd19f57487dd0b137feb5602449cf86696ef339048.exe un421945.exe PID 3604 wrote to memory of 3096 3604 un421945.exe pro1078.exe PID 3604 wrote to memory of 3096 3604 un421945.exe pro1078.exe PID 3604 wrote to memory of 3096 3604 un421945.exe pro1078.exe PID 3604 wrote to memory of 64 3604 un421945.exe qu6859.exe PID 3604 wrote to memory of 64 3604 un421945.exe qu6859.exe PID 3604 wrote to memory of 64 3604 un421945.exe qu6859.exe PID 4228 wrote to memory of 1704 4228 ac6f78c77c1d1ffb78e51edd19f57487dd0b137feb5602449cf86696ef339048.exe si189050.exe PID 4228 wrote to memory of 1704 4228 ac6f78c77c1d1ffb78e51edd19f57487dd0b137feb5602449cf86696ef339048.exe si189050.exe PID 4228 wrote to memory of 1704 4228 ac6f78c77c1d1ffb78e51edd19f57487dd0b137feb5602449cf86696ef339048.exe si189050.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac6f78c77c1d1ffb78e51edd19f57487dd0b137feb5602449cf86696ef339048.exe"C:\Users\Admin\AppData\Local\Temp\ac6f78c77c1d1ffb78e51edd19f57487dd0b137feb5602449cf86696ef339048.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un421945.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un421945.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1078.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1078.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 10804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6859.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6859.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 64 -s 18164⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si189050.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si189050.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3096 -ip 30961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 64 -ip 641⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si189050.exeFilesize
175KB
MD522c8c28b8830cdae4ad3d378c4149624
SHA1e9c4ec7e95eaf731b8d393fc56086589e7807316
SHA256f13ac4828629e51efdbc1d7922c3a5c8f81c12fee80c5ba8c327ad86099dc8d4
SHA512e4c93b259c15db51fcb9d18349fa5d7d98aa9f6c4121e467f93581c754eeb7904f80b307cef8a586c83b9a45b78f9fa15ae6692a67fd59f6f491ec0818816435
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si189050.exeFilesize
175KB
MD522c8c28b8830cdae4ad3d378c4149624
SHA1e9c4ec7e95eaf731b8d393fc56086589e7807316
SHA256f13ac4828629e51efdbc1d7922c3a5c8f81c12fee80c5ba8c327ad86099dc8d4
SHA512e4c93b259c15db51fcb9d18349fa5d7d98aa9f6c4121e467f93581c754eeb7904f80b307cef8a586c83b9a45b78f9fa15ae6692a67fd59f6f491ec0818816435
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un421945.exeFilesize
542KB
MD571d3f9dadc1e53cfae6f891da6130854
SHA12ed1540ddeb0d3b16c76c6b1353de4ad465c6fc4
SHA25614fe40903c0bb900eeb2ee317851bf1cce0817f8893732195852fe1722e76b38
SHA512daeca226b031e702ede3f81bee9705aee8a9446badf92d84b2e47231d1046b731a1419a52dd3e503b51e3126d6a2c09f9f12249372f89b8f4c65ee3ea14621f6
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un421945.exeFilesize
542KB
MD571d3f9dadc1e53cfae6f891da6130854
SHA12ed1540ddeb0d3b16c76c6b1353de4ad465c6fc4
SHA25614fe40903c0bb900eeb2ee317851bf1cce0817f8893732195852fe1722e76b38
SHA512daeca226b031e702ede3f81bee9705aee8a9446badf92d84b2e47231d1046b731a1419a52dd3e503b51e3126d6a2c09f9f12249372f89b8f4c65ee3ea14621f6
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1078.exeFilesize
321KB
MD5d797cec9fe77a7786452fd845523e606
SHA19c587ad8def9dc140a1f509d0661756d5585458c
SHA256e449907440c154ee4a96f771c57402b0433e9b0587cdf8001d2071a372affdf8
SHA5120269fee4487bedf3c80943c35825de78bc2b66473345e7bcfb5dc6662905172cb006a527a985f7df3be21f657c6c50f683b4c8e72c81c5a09cff1944e1ecb9a2
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1078.exeFilesize
321KB
MD5d797cec9fe77a7786452fd845523e606
SHA19c587ad8def9dc140a1f509d0661756d5585458c
SHA256e449907440c154ee4a96f771c57402b0433e9b0587cdf8001d2071a372affdf8
SHA5120269fee4487bedf3c80943c35825de78bc2b66473345e7bcfb5dc6662905172cb006a527a985f7df3be21f657c6c50f683b4c8e72c81c5a09cff1944e1ecb9a2
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6859.exeFilesize
380KB
MD5f46cf52b7be8f6b31fd2de2eb37f5132
SHA187d126bdbaf86168d7ff2b3591a04df0d5770dbc
SHA25624cff4282fbfda8ed33f5d6d7ca3d38fe344e51647a0460b32ff4199f83d7113
SHA512fc8abc782084c85bbe7aa8e3452f928ed53c2a1a3e14908059c06df483d44e6ecd8b07f43eb74551e25242737c31b24765f69baadfed3d3a24a80700ebe98788
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6859.exeFilesize
380KB
MD5f46cf52b7be8f6b31fd2de2eb37f5132
SHA187d126bdbaf86168d7ff2b3591a04df0d5770dbc
SHA25624cff4282fbfda8ed33f5d6d7ca3d38fe344e51647a0460b32ff4199f83d7113
SHA512fc8abc782084c85bbe7aa8e3452f928ed53c2a1a3e14908059c06df483d44e6ecd8b07f43eb74551e25242737c31b24765f69baadfed3d3a24a80700ebe98788
-
memory/64-227-0x00000000071A0000-0x00000000071DF000-memory.dmpFilesize
252KB
-
memory/64-1102-0x00000000072C0000-0x00000000072D2000-memory.dmpFilesize
72KB
-
memory/64-1114-0x00000000072F0000-0x0000000007300000-memory.dmpFilesize
64KB
-
memory/64-1113-0x0000000008F40000-0x000000000946C000-memory.dmpFilesize
5.2MB
-
memory/64-1112-0x0000000008D70000-0x0000000008F32000-memory.dmpFilesize
1.8MB
-
memory/64-1111-0x0000000008CF0000-0x0000000008D40000-memory.dmpFilesize
320KB
-
memory/64-1110-0x0000000008C70000-0x0000000008CE6000-memory.dmpFilesize
472KB
-
memory/64-1109-0x00000000072F0000-0x0000000007300000-memory.dmpFilesize
64KB
-
memory/64-1108-0x00000000072F0000-0x0000000007300000-memory.dmpFilesize
64KB
-
memory/64-1107-0x0000000008460000-0x00000000084C6000-memory.dmpFilesize
408KB
-
memory/64-1106-0x00000000083C0000-0x0000000008452000-memory.dmpFilesize
584KB
-
memory/64-1104-0x00000000072F0000-0x0000000007300000-memory.dmpFilesize
64KB
-
memory/64-1103-0x00000000080E0000-0x000000000811C000-memory.dmpFilesize
240KB
-
memory/64-1101-0x0000000007FD0000-0x00000000080DA000-memory.dmpFilesize
1.0MB
-
memory/64-1100-0x00000000079B0000-0x0000000007FC8000-memory.dmpFilesize
6.1MB
-
memory/64-225-0x00000000071A0000-0x00000000071DF000-memory.dmpFilesize
252KB
-
memory/64-223-0x00000000071A0000-0x00000000071DF000-memory.dmpFilesize
252KB
-
memory/64-221-0x00000000071A0000-0x00000000071DF000-memory.dmpFilesize
252KB
-
memory/64-219-0x00000000071A0000-0x00000000071DF000-memory.dmpFilesize
252KB
-
memory/64-217-0x00000000071A0000-0x00000000071DF000-memory.dmpFilesize
252KB
-
memory/64-210-0x00000000071A0000-0x00000000071DF000-memory.dmpFilesize
252KB
-
memory/64-214-0x00000000071A0000-0x00000000071DF000-memory.dmpFilesize
252KB
-
memory/64-190-0x00000000071A0000-0x00000000071DF000-memory.dmpFilesize
252KB
-
memory/64-191-0x00000000071A0000-0x00000000071DF000-memory.dmpFilesize
252KB
-
memory/64-193-0x00000000071A0000-0x00000000071DF000-memory.dmpFilesize
252KB
-
memory/64-195-0x00000000071A0000-0x00000000071DF000-memory.dmpFilesize
252KB
-
memory/64-197-0x00000000071A0000-0x00000000071DF000-memory.dmpFilesize
252KB
-
memory/64-199-0x00000000071A0000-0x00000000071DF000-memory.dmpFilesize
252KB
-
memory/64-201-0x00000000071A0000-0x00000000071DF000-memory.dmpFilesize
252KB
-
memory/64-203-0x00000000071A0000-0x00000000071DF000-memory.dmpFilesize
252KB
-
memory/64-205-0x00000000071A0000-0x00000000071DF000-memory.dmpFilesize
252KB
-
memory/64-207-0x00000000071A0000-0x00000000071DF000-memory.dmpFilesize
252KB
-
memory/64-209-0x0000000002C60000-0x0000000002CAB000-memory.dmpFilesize
300KB
-
memory/64-211-0x00000000072F0000-0x0000000007300000-memory.dmpFilesize
64KB
-
memory/64-213-0x00000000072F0000-0x0000000007300000-memory.dmpFilesize
64KB
-
memory/64-215-0x00000000072F0000-0x0000000007300000-memory.dmpFilesize
64KB
-
memory/1704-1120-0x0000000000A50000-0x0000000000A82000-memory.dmpFilesize
200KB
-
memory/1704-1121-0x00000000055E0000-0x00000000055F0000-memory.dmpFilesize
64KB
-
memory/3096-172-0x0000000004920000-0x0000000004932000-memory.dmpFilesize
72KB
-
memory/3096-148-0x0000000002B80000-0x0000000002BAD000-memory.dmpFilesize
180KB
-
memory/3096-182-0x0000000007430000-0x0000000007440000-memory.dmpFilesize
64KB
-
memory/3096-181-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/3096-180-0x0000000004920000-0x0000000004932000-memory.dmpFilesize
72KB
-
memory/3096-151-0x0000000007440000-0x00000000079E4000-memory.dmpFilesize
5.6MB
-
memory/3096-178-0x0000000004920000-0x0000000004932000-memory.dmpFilesize
72KB
-
memory/3096-176-0x0000000004920000-0x0000000004932000-memory.dmpFilesize
72KB
-
memory/3096-153-0x0000000004920000-0x0000000004932000-memory.dmpFilesize
72KB
-
memory/3096-174-0x0000000004920000-0x0000000004932000-memory.dmpFilesize
72KB
-
memory/3096-150-0x0000000007430000-0x0000000007440000-memory.dmpFilesize
64KB
-
memory/3096-183-0x0000000007430000-0x0000000007440000-memory.dmpFilesize
64KB
-
memory/3096-164-0x0000000004920000-0x0000000004932000-memory.dmpFilesize
72KB
-
memory/3096-168-0x0000000004920000-0x0000000004932000-memory.dmpFilesize
72KB
-
memory/3096-166-0x0000000004920000-0x0000000004932000-memory.dmpFilesize
72KB
-
memory/3096-162-0x0000000004920000-0x0000000004932000-memory.dmpFilesize
72KB
-
memory/3096-160-0x0000000004920000-0x0000000004932000-memory.dmpFilesize
72KB
-
memory/3096-158-0x0000000004920000-0x0000000004932000-memory.dmpFilesize
72KB
-
memory/3096-156-0x0000000004920000-0x0000000004932000-memory.dmpFilesize
72KB
-
memory/3096-154-0x0000000004920000-0x0000000004932000-memory.dmpFilesize
72KB
-
memory/3096-149-0x0000000007430000-0x0000000007440000-memory.dmpFilesize
64KB
-
memory/3096-170-0x0000000004920000-0x0000000004932000-memory.dmpFilesize
72KB
-
memory/3096-185-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/3096-152-0x0000000007430000-0x0000000007440000-memory.dmpFilesize
64KB