Analysis
-
max time kernel
99s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 07:57
Static task
static1
Behavioral task
behavioral1
Sample
53b9364f21b89c57e6b26bb0ddd55bf3ba3441084492f503de5a5349a74cd6f0.exe
Resource
win10v2004-20230220-en
General
-
Target
53b9364f21b89c57e6b26bb0ddd55bf3ba3441084492f503de5a5349a74cd6f0.exe
-
Size
683KB
-
MD5
1378ed319603d96e8e7ba8cfcccb4ca7
-
SHA1
06bc0e4af9e86dda876449010440cccdb28e72a9
-
SHA256
53b9364f21b89c57e6b26bb0ddd55bf3ba3441084492f503de5a5349a74cd6f0
-
SHA512
a7f3756e5be59b7de5a8598e8e9389a8ea9d7a53e3726d33ee6fdb8905fa66ba62cd2126b2aef029bbbdf2b94a988c3469ac17442460a98cbe082e116f6d4e84
-
SSDEEP
12288:dMrYy90AsjqrJKaFitsKa+lmQ+vyxzDLy1qQJKjUGmqBULNmRL33Kq4Ga:hyhsjSE7a0J+wLyPJKVimRLi
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Processes:
pro7580.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro7580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro7580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro7580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro7580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro7580.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro7580.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/3612-191-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/3612-192-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/3612-194-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/3612-196-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/3612-200-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/3612-198-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/3612-202-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/3612-204-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/3612-206-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/3612-208-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/3612-210-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/3612-212-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/3612-214-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/3612-216-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/3612-218-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/3612-223-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/3612-226-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/3612-228-0x0000000007140000-0x000000000717F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un894207.exepro7580.exequ9417.exesi297303.exepid process 4632 un894207.exe 4320 pro7580.exe 3612 qu9417.exe 5072 si297303.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro7580.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro7580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro7580.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un894207.exe53b9364f21b89c57e6b26bb0ddd55bf3ba3441084492f503de5a5349a74cd6f0.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un894207.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 53b9364f21b89c57e6b26bb0ddd55bf3ba3441084492f503de5a5349a74cd6f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 53b9364f21b89c57e6b26bb0ddd55bf3ba3441084492f503de5a5349a74cd6f0.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un894207.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2660 4320 WerFault.exe pro7580.exe 4980 3612 WerFault.exe qu9417.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro7580.exequ9417.exesi297303.exepid process 4320 pro7580.exe 4320 pro7580.exe 3612 qu9417.exe 3612 qu9417.exe 5072 si297303.exe 5072 si297303.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro7580.exequ9417.exesi297303.exedescription pid process Token: SeDebugPrivilege 4320 pro7580.exe Token: SeDebugPrivilege 3612 qu9417.exe Token: SeDebugPrivilege 5072 si297303.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
53b9364f21b89c57e6b26bb0ddd55bf3ba3441084492f503de5a5349a74cd6f0.exeun894207.exedescription pid process target process PID 1520 wrote to memory of 4632 1520 53b9364f21b89c57e6b26bb0ddd55bf3ba3441084492f503de5a5349a74cd6f0.exe un894207.exe PID 1520 wrote to memory of 4632 1520 53b9364f21b89c57e6b26bb0ddd55bf3ba3441084492f503de5a5349a74cd6f0.exe un894207.exe PID 1520 wrote to memory of 4632 1520 53b9364f21b89c57e6b26bb0ddd55bf3ba3441084492f503de5a5349a74cd6f0.exe un894207.exe PID 4632 wrote to memory of 4320 4632 un894207.exe pro7580.exe PID 4632 wrote to memory of 4320 4632 un894207.exe pro7580.exe PID 4632 wrote to memory of 4320 4632 un894207.exe pro7580.exe PID 4632 wrote to memory of 3612 4632 un894207.exe qu9417.exe PID 4632 wrote to memory of 3612 4632 un894207.exe qu9417.exe PID 4632 wrote to memory of 3612 4632 un894207.exe qu9417.exe PID 1520 wrote to memory of 5072 1520 53b9364f21b89c57e6b26bb0ddd55bf3ba3441084492f503de5a5349a74cd6f0.exe si297303.exe PID 1520 wrote to memory of 5072 1520 53b9364f21b89c57e6b26bb0ddd55bf3ba3441084492f503de5a5349a74cd6f0.exe si297303.exe PID 1520 wrote to memory of 5072 1520 53b9364f21b89c57e6b26bb0ddd55bf3ba3441084492f503de5a5349a74cd6f0.exe si297303.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\53b9364f21b89c57e6b26bb0ddd55bf3ba3441084492f503de5a5349a74cd6f0.exe"C:\Users\Admin\AppData\Local\Temp\53b9364f21b89c57e6b26bb0ddd55bf3ba3441084492f503de5a5349a74cd6f0.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un894207.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un894207.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7580.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7580.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 10804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9417.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9417.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 13364⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si297303.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si297303.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4320 -ip 43201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3612 -ip 36121⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si297303.exeFilesize
175KB
MD508cdebe75e980ff3aa44c8be517b94e0
SHA11731fe334ea7abee90c2b459a58b7d6a5880604f
SHA256787508f77bacff11e0533f36b498da68504f75bb25aef6b228e5a63fee5c481a
SHA512d538a371b6d16bb872e5dda2a00f593b7a787d18d7ac6af283ff77a1485713fbb5e4b30b3415dfba7a9dd85e4fa30ebbcde6d4f55931bf456ead33a95fe0a358
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si297303.exeFilesize
175KB
MD508cdebe75e980ff3aa44c8be517b94e0
SHA11731fe334ea7abee90c2b459a58b7d6a5880604f
SHA256787508f77bacff11e0533f36b498da68504f75bb25aef6b228e5a63fee5c481a
SHA512d538a371b6d16bb872e5dda2a00f593b7a787d18d7ac6af283ff77a1485713fbb5e4b30b3415dfba7a9dd85e4fa30ebbcde6d4f55931bf456ead33a95fe0a358
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un894207.exeFilesize
542KB
MD595d78736ed8b78c410a9b09828046f96
SHA1e030a5f4cb89ed2ab4c73cc0044cbaccde299e9f
SHA256c10ad65d1841d1b3c3463b057199cbd155401fe764c2c7fbe7cc5f51b85bd206
SHA51272ac9ae34e1cd1460930e273194c42257e01fa390e3492a52888e4107cd14c9b4d264948313d5862e7c7cd67526e040743affdd0a3e2422dc539eb8206f89e2f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un894207.exeFilesize
542KB
MD595d78736ed8b78c410a9b09828046f96
SHA1e030a5f4cb89ed2ab4c73cc0044cbaccde299e9f
SHA256c10ad65d1841d1b3c3463b057199cbd155401fe764c2c7fbe7cc5f51b85bd206
SHA51272ac9ae34e1cd1460930e273194c42257e01fa390e3492a52888e4107cd14c9b4d264948313d5862e7c7cd67526e040743affdd0a3e2422dc539eb8206f89e2f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7580.exeFilesize
321KB
MD5fc183db67d63ae7461fdc524089cbffc
SHA1672b4f92077625d53571d6209fdc2d0f1b581703
SHA25683447b26d2e1d12b4136c3a335fad6641aba8ae839986e649202aedde0ce319e
SHA512f4c6088314ae548a6258242ec7ae0fd6975e92aa35cf73def466f3e15a9e518a7672c8f34d3c1a6cf6c7094d0257b4a727d95d1b650bb927fa1449c6d5e5a7bc
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7580.exeFilesize
321KB
MD5fc183db67d63ae7461fdc524089cbffc
SHA1672b4f92077625d53571d6209fdc2d0f1b581703
SHA25683447b26d2e1d12b4136c3a335fad6641aba8ae839986e649202aedde0ce319e
SHA512f4c6088314ae548a6258242ec7ae0fd6975e92aa35cf73def466f3e15a9e518a7672c8f34d3c1a6cf6c7094d0257b4a727d95d1b650bb927fa1449c6d5e5a7bc
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9417.exeFilesize
380KB
MD51fe6f7a0ec928dea8a8cfa924f5c6a67
SHA18a777738514c5113dc74e1881827b3a843cae3ab
SHA256bb21de192220c9a2510f4db883c66444b6bbeba0deec4d3e2e3e0a2799478f4f
SHA5127e19e1864813febb4cf13e124b5633fdc16c2c7cad34a2ad083a11d74e151d3156c6a0d66526bc8e315c92e8936d4b7c92d13f3c65ffc36ec33daa147170911f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9417.exeFilesize
380KB
MD51fe6f7a0ec928dea8a8cfa924f5c6a67
SHA18a777738514c5113dc74e1881827b3a843cae3ab
SHA256bb21de192220c9a2510f4db883c66444b6bbeba0deec4d3e2e3e0a2799478f4f
SHA5127e19e1864813febb4cf13e124b5633fdc16c2c7cad34a2ad083a11d74e151d3156c6a0d66526bc8e315c92e8936d4b7c92d13f3c65ffc36ec33daa147170911f
-
memory/3612-1102-0x0000000007F70000-0x000000000807A000-memory.dmpFilesize
1.0MB
-
memory/3612-226-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/3612-204-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/3612-206-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/3612-1115-0x0000000007260000-0x0000000007270000-memory.dmpFilesize
64KB
-
memory/3612-1114-0x0000000007260000-0x0000000007270000-memory.dmpFilesize
64KB
-
memory/3612-1113-0x0000000007260000-0x0000000007270000-memory.dmpFilesize
64KB
-
memory/3612-1112-0x0000000009460000-0x00000000094B0000-memory.dmpFilesize
320KB
-
memory/3612-1111-0x00000000093E0000-0x0000000009456000-memory.dmpFilesize
472KB
-
memory/3612-1110-0x0000000008D60000-0x000000000928C000-memory.dmpFilesize
5.2MB
-
memory/3612-208-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/3612-1109-0x0000000008B80000-0x0000000008D42000-memory.dmpFilesize
1.8MB
-
memory/3612-1108-0x0000000008460000-0x00000000084C6000-memory.dmpFilesize
408KB
-
memory/3612-1107-0x00000000083C0000-0x0000000008452000-memory.dmpFilesize
584KB
-
memory/3612-1105-0x0000000007260000-0x0000000007270000-memory.dmpFilesize
64KB
-
memory/3612-1104-0x00000000080D0000-0x000000000810C000-memory.dmpFilesize
240KB
-
memory/3612-1103-0x00000000080B0000-0x00000000080C2000-memory.dmpFilesize
72KB
-
memory/3612-1101-0x0000000007920000-0x0000000007F38000-memory.dmpFilesize
6.1MB
-
memory/3612-228-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/3612-218-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/3612-223-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/3612-224-0x0000000007260000-0x0000000007270000-memory.dmpFilesize
64KB
-
memory/3612-221-0x0000000007260000-0x0000000007270000-memory.dmpFilesize
64KB
-
memory/3612-191-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/3612-192-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/3612-194-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/3612-196-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/3612-200-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/3612-198-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/3612-202-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/3612-222-0x0000000007260000-0x0000000007270000-memory.dmpFilesize
64KB
-
memory/3612-1117-0x0000000007260000-0x0000000007270000-memory.dmpFilesize
64KB
-
memory/3612-219-0x0000000002D70000-0x0000000002DBB000-memory.dmpFilesize
300KB
-
memory/3612-210-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/3612-212-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/3612-214-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/3612-216-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/4320-181-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/4320-173-0x0000000007220000-0x0000000007232000-memory.dmpFilesize
72KB
-
memory/4320-148-0x0000000002B80000-0x0000000002BAD000-memory.dmpFilesize
180KB
-
memory/4320-151-0x0000000007220000-0x0000000007232000-memory.dmpFilesize
72KB
-
memory/4320-155-0x0000000007220000-0x0000000007232000-memory.dmpFilesize
72KB
-
memory/4320-186-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/4320-185-0x0000000007240000-0x0000000007250000-memory.dmpFilesize
64KB
-
memory/4320-184-0x0000000007240000-0x0000000007250000-memory.dmpFilesize
64KB
-
memory/4320-183-0x0000000007240000-0x0000000007250000-memory.dmpFilesize
64KB
-
memory/4320-150-0x0000000007220000-0x0000000007232000-memory.dmpFilesize
72KB
-
memory/4320-153-0x0000000007220000-0x0000000007232000-memory.dmpFilesize
72KB
-
memory/4320-180-0x0000000007240000-0x0000000007250000-memory.dmpFilesize
64KB
-
memory/4320-179-0x0000000007240000-0x0000000007250000-memory.dmpFilesize
64KB
-
memory/4320-178-0x0000000007240000-0x0000000007250000-memory.dmpFilesize
64KB
-
memory/4320-177-0x0000000007220000-0x0000000007232000-memory.dmpFilesize
72KB
-
memory/4320-175-0x0000000007220000-0x0000000007232000-memory.dmpFilesize
72KB
-
memory/4320-171-0x0000000007220000-0x0000000007232000-memory.dmpFilesize
72KB
-
memory/4320-161-0x0000000007220000-0x0000000007232000-memory.dmpFilesize
72KB
-
memory/4320-163-0x0000000007220000-0x0000000007232000-memory.dmpFilesize
72KB
-
memory/4320-165-0x0000000007220000-0x0000000007232000-memory.dmpFilesize
72KB
-
memory/4320-167-0x0000000007220000-0x0000000007232000-memory.dmpFilesize
72KB
-
memory/4320-169-0x0000000007220000-0x0000000007232000-memory.dmpFilesize
72KB
-
memory/4320-159-0x0000000007220000-0x0000000007232000-memory.dmpFilesize
72KB
-
memory/4320-149-0x0000000007250000-0x00000000077F4000-memory.dmpFilesize
5.6MB
-
memory/4320-157-0x0000000007220000-0x0000000007232000-memory.dmpFilesize
72KB
-
memory/5072-1122-0x0000000000F30000-0x0000000000F62000-memory.dmpFilesize
200KB
-
memory/5072-1123-0x0000000005900000-0x0000000005910000-memory.dmpFilesize
64KB