Analysis
-
max time kernel
109s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 08:03
Static task
static1
Behavioral task
behavioral1
Sample
a7ef07fbcaaa587b9d73d71df86f48cbad3893f986e57f065002b8da6597c801.exe
Resource
win10v2004-20230220-en
General
-
Target
a7ef07fbcaaa587b9d73d71df86f48cbad3893f986e57f065002b8da6597c801.exe
-
Size
684KB
-
MD5
eee094b48f5062a982295912e1623684
-
SHA1
716c4b897d65da56cec5b5d45b387c37b55325c6
-
SHA256
a7ef07fbcaaa587b9d73d71df86f48cbad3893f986e57f065002b8da6597c801
-
SHA512
35c3d8a82aaa738945127bab8fc5d57e88295ff77f6978e0363d3f7541548cf55c5192edef079d3951618a2028cf979720dfc6a1b7b12ac67f3398889e127e60
-
SSDEEP
12288:FMrIy90+FavPVHtME3haF6yjgLiA5fMWFlbyQpk5U2vmwL3J6/Vyd:1ybF6pmPPjgf5fhlnulmwL+yd
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Processes:
pro0393.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro0393.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro0393.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro0393.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro0393.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro0393.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro0393.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/4988-191-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/4988-192-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/4988-196-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/4988-200-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/4988-197-0x00000000071B0000-0x00000000071C0000-memory.dmp family_redline behavioral1/memory/4988-202-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/4988-204-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/4988-206-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/4988-208-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/4988-210-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/4988-212-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/4988-214-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/4988-216-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/4988-218-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/4988-220-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/4988-224-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/4988-226-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/4988-228-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/4988-222-0x0000000007130000-0x000000000716F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un712021.exepro0393.exequ0427.exesi730139.exepid process 1176 un712021.exe 2292 pro0393.exe 4988 qu0427.exe 4004 si730139.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro0393.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro0393.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro0393.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un712021.exea7ef07fbcaaa587b9d73d71df86f48cbad3893f986e57f065002b8da6597c801.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un712021.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un712021.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce a7ef07fbcaaa587b9d73d71df86f48cbad3893f986e57f065002b8da6597c801.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a7ef07fbcaaa587b9d73d71df86f48cbad3893f986e57f065002b8da6597c801.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1452 2292 WerFault.exe pro0393.exe 4276 4988 WerFault.exe qu0427.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro0393.exequ0427.exesi730139.exepid process 2292 pro0393.exe 2292 pro0393.exe 4988 qu0427.exe 4988 qu0427.exe 4004 si730139.exe 4004 si730139.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro0393.exequ0427.exesi730139.exedescription pid process Token: SeDebugPrivilege 2292 pro0393.exe Token: SeDebugPrivilege 4988 qu0427.exe Token: SeDebugPrivilege 4004 si730139.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
a7ef07fbcaaa587b9d73d71df86f48cbad3893f986e57f065002b8da6597c801.exeun712021.exedescription pid process target process PID 1504 wrote to memory of 1176 1504 a7ef07fbcaaa587b9d73d71df86f48cbad3893f986e57f065002b8da6597c801.exe un712021.exe PID 1504 wrote to memory of 1176 1504 a7ef07fbcaaa587b9d73d71df86f48cbad3893f986e57f065002b8da6597c801.exe un712021.exe PID 1504 wrote to memory of 1176 1504 a7ef07fbcaaa587b9d73d71df86f48cbad3893f986e57f065002b8da6597c801.exe un712021.exe PID 1176 wrote to memory of 2292 1176 un712021.exe pro0393.exe PID 1176 wrote to memory of 2292 1176 un712021.exe pro0393.exe PID 1176 wrote to memory of 2292 1176 un712021.exe pro0393.exe PID 1176 wrote to memory of 4988 1176 un712021.exe qu0427.exe PID 1176 wrote to memory of 4988 1176 un712021.exe qu0427.exe PID 1176 wrote to memory of 4988 1176 un712021.exe qu0427.exe PID 1504 wrote to memory of 4004 1504 a7ef07fbcaaa587b9d73d71df86f48cbad3893f986e57f065002b8da6597c801.exe si730139.exe PID 1504 wrote to memory of 4004 1504 a7ef07fbcaaa587b9d73d71df86f48cbad3893f986e57f065002b8da6597c801.exe si730139.exe PID 1504 wrote to memory of 4004 1504 a7ef07fbcaaa587b9d73d71df86f48cbad3893f986e57f065002b8da6597c801.exe si730139.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7ef07fbcaaa587b9d73d71df86f48cbad3893f986e57f065002b8da6597c801.exe"C:\Users\Admin\AppData\Local\Temp\a7ef07fbcaaa587b9d73d71df86f48cbad3893f986e57f065002b8da6597c801.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un712021.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un712021.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0393.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0393.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 10844⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0427.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0427.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 13284⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si730139.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si730139.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2292 -ip 22921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4988 -ip 49881⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si730139.exeFilesize
175KB
MD5c2654bcf1e083935fa014287dd0d316e
SHA1f07503271ce70cc6098a6d428704afaef9fde1c8
SHA256fd8b9c4f1c263396b62510cbe699326c0aeeaf0cbb8368f23a19314d6a3af063
SHA512a11a1bdbf323fc8d57b5fbc8706afbcd5629b06f1b342ced3a840a57ebc5e6547bd721bf2f8ed0b6c571732199f4c15309b9509c86666e1df7987284d0e8e694
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si730139.exeFilesize
175KB
MD5c2654bcf1e083935fa014287dd0d316e
SHA1f07503271ce70cc6098a6d428704afaef9fde1c8
SHA256fd8b9c4f1c263396b62510cbe699326c0aeeaf0cbb8368f23a19314d6a3af063
SHA512a11a1bdbf323fc8d57b5fbc8706afbcd5629b06f1b342ced3a840a57ebc5e6547bd721bf2f8ed0b6c571732199f4c15309b9509c86666e1df7987284d0e8e694
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un712021.exeFilesize
542KB
MD5fbff14e2eb93c1fe31b414bc932a4ef1
SHA1d615e0a1e748ae1b1b8d46720221bba06ac6bd2a
SHA25691b8deb8894bbc2b44431cc8fe24b33c3a54ab4c3e8b55d521da1882284e1f30
SHA51237b913a2b9a8bd1d377ad2737edf9eaf9aa2e23ce39b3803bef86657fe9c2ec2554aedc428161234494026ea48ba3686888c9a94a54e857475bf5225135372a6
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un712021.exeFilesize
542KB
MD5fbff14e2eb93c1fe31b414bc932a4ef1
SHA1d615e0a1e748ae1b1b8d46720221bba06ac6bd2a
SHA25691b8deb8894bbc2b44431cc8fe24b33c3a54ab4c3e8b55d521da1882284e1f30
SHA51237b913a2b9a8bd1d377ad2737edf9eaf9aa2e23ce39b3803bef86657fe9c2ec2554aedc428161234494026ea48ba3686888c9a94a54e857475bf5225135372a6
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0393.exeFilesize
321KB
MD5cc7743779ceeee5a090661f62ca71823
SHA17c5be0b7f50c8ce9952fa9ce8ec21a23f3fd2e47
SHA2568c3d9c4344b9ec51f988c5d297eca3f47ab8d19eb6e27a90458f94ef1a6307cd
SHA51263ac9da332555b5cb83005f4892a1975092614261adbb6d10692ff3c84857d63255163b732fce3b57a5be658b1be9031dc8cfeb7b4581c683dbed351d5b65b5b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0393.exeFilesize
321KB
MD5cc7743779ceeee5a090661f62ca71823
SHA17c5be0b7f50c8ce9952fa9ce8ec21a23f3fd2e47
SHA2568c3d9c4344b9ec51f988c5d297eca3f47ab8d19eb6e27a90458f94ef1a6307cd
SHA51263ac9da332555b5cb83005f4892a1975092614261adbb6d10692ff3c84857d63255163b732fce3b57a5be658b1be9031dc8cfeb7b4581c683dbed351d5b65b5b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0427.exeFilesize
380KB
MD52158c94aeab6edbdae45d2af9a2d2fc0
SHA1514063e3cd9d1f6c61bd038e230358a430b4f6b0
SHA25661d5624a9e4971e4092ffa18f9df179d3aa29c6804a592ed4119da14411b55a5
SHA512f0406306d07260e91332d8fbcfc54bb76631e75918cd5db2bfec064c2b000b32a86a6dd6b4f2e2acc07e3f24e0b5375084c64fe7124723c77d2024fe855ef0fa
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0427.exeFilesize
380KB
MD52158c94aeab6edbdae45d2af9a2d2fc0
SHA1514063e3cd9d1f6c61bd038e230358a430b4f6b0
SHA25661d5624a9e4971e4092ffa18f9df179d3aa29c6804a592ed4119da14411b55a5
SHA512f0406306d07260e91332d8fbcfc54bb76631e75918cd5db2bfec064c2b000b32a86a6dd6b4f2e2acc07e3f24e0b5375084c64fe7124723c77d2024fe855ef0fa
-
memory/2292-148-0x00000000074B0000-0x0000000007A54000-memory.dmpFilesize
5.6MB
-
memory/2292-149-0x0000000002C80000-0x0000000002CAD000-memory.dmpFilesize
180KB
-
memory/2292-150-0x00000000074A0000-0x00000000074B0000-memory.dmpFilesize
64KB
-
memory/2292-151-0x00000000074A0000-0x00000000074B0000-memory.dmpFilesize
64KB
-
memory/2292-152-0x00000000074A0000-0x00000000074B0000-memory.dmpFilesize
64KB
-
memory/2292-153-0x0000000004960000-0x0000000004972000-memory.dmpFilesize
72KB
-
memory/2292-154-0x0000000004960000-0x0000000004972000-memory.dmpFilesize
72KB
-
memory/2292-156-0x0000000004960000-0x0000000004972000-memory.dmpFilesize
72KB
-
memory/2292-158-0x0000000004960000-0x0000000004972000-memory.dmpFilesize
72KB
-
memory/2292-160-0x0000000004960000-0x0000000004972000-memory.dmpFilesize
72KB
-
memory/2292-162-0x0000000004960000-0x0000000004972000-memory.dmpFilesize
72KB
-
memory/2292-164-0x0000000004960000-0x0000000004972000-memory.dmpFilesize
72KB
-
memory/2292-166-0x0000000004960000-0x0000000004972000-memory.dmpFilesize
72KB
-
memory/2292-168-0x0000000004960000-0x0000000004972000-memory.dmpFilesize
72KB
-
memory/2292-170-0x0000000004960000-0x0000000004972000-memory.dmpFilesize
72KB
-
memory/2292-172-0x0000000004960000-0x0000000004972000-memory.dmpFilesize
72KB
-
memory/2292-174-0x0000000004960000-0x0000000004972000-memory.dmpFilesize
72KB
-
memory/2292-176-0x0000000004960000-0x0000000004972000-memory.dmpFilesize
72KB
-
memory/2292-178-0x0000000004960000-0x0000000004972000-memory.dmpFilesize
72KB
-
memory/2292-180-0x0000000004960000-0x0000000004972000-memory.dmpFilesize
72KB
-
memory/2292-181-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/2292-182-0x00000000074A0000-0x00000000074B0000-memory.dmpFilesize
64KB
-
memory/2292-183-0x00000000074A0000-0x00000000074B0000-memory.dmpFilesize
64KB
-
memory/2292-184-0x00000000074A0000-0x00000000074B0000-memory.dmpFilesize
64KB
-
memory/2292-186-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/4004-1122-0x0000000000200000-0x0000000000232000-memory.dmpFilesize
200KB
-
memory/4004-1125-0x0000000004AE0000-0x0000000004AF0000-memory.dmpFilesize
64KB
-
memory/4004-1123-0x0000000004AE0000-0x0000000004AF0000-memory.dmpFilesize
64KB
-
memory/4988-192-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/4988-222-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/4988-200-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/4988-199-0x00000000071B0000-0x00000000071C0000-memory.dmpFilesize
64KB
-
memory/4988-195-0x00000000071B0000-0x00000000071C0000-memory.dmpFilesize
64KB
-
memory/4988-197-0x00000000071B0000-0x00000000071C0000-memory.dmpFilesize
64KB
-
memory/4988-202-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/4988-204-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/4988-206-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/4988-208-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/4988-210-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/4988-212-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/4988-214-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/4988-216-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/4988-218-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/4988-220-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/4988-224-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/4988-226-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/4988-228-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/4988-196-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/4988-1101-0x0000000007790000-0x0000000007DA8000-memory.dmpFilesize
6.1MB
-
memory/4988-1102-0x0000000007E30000-0x0000000007F3A000-memory.dmpFilesize
1.0MB
-
memory/4988-1103-0x0000000007F70000-0x0000000007F82000-memory.dmpFilesize
72KB
-
memory/4988-1104-0x0000000007F90000-0x0000000007FCC000-memory.dmpFilesize
240KB
-
memory/4988-1105-0x00000000071B0000-0x00000000071C0000-memory.dmpFilesize
64KB
-
memory/4988-1107-0x00000000071B0000-0x00000000071C0000-memory.dmpFilesize
64KB
-
memory/4988-1108-0x00000000071B0000-0x00000000071C0000-memory.dmpFilesize
64KB
-
memory/4988-1109-0x00000000071B0000-0x00000000071C0000-memory.dmpFilesize
64KB
-
memory/4988-1110-0x0000000008280000-0x00000000082E6000-memory.dmpFilesize
408KB
-
memory/4988-1111-0x0000000008940000-0x00000000089D2000-memory.dmpFilesize
584KB
-
memory/4988-1112-0x0000000008A50000-0x0000000008C12000-memory.dmpFilesize
1.8MB
-
memory/4988-1113-0x0000000008C20000-0x000000000914C000-memory.dmpFilesize
5.2MB
-
memory/4988-193-0x0000000004570000-0x00000000045BB000-memory.dmpFilesize
300KB
-
memory/4988-191-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/4988-1114-0x0000000009290000-0x0000000009306000-memory.dmpFilesize
472KB
-
memory/4988-1115-0x0000000009310000-0x0000000009360000-memory.dmpFilesize
320KB
-
memory/4988-1116-0x00000000071B0000-0x00000000071C0000-memory.dmpFilesize
64KB