Analysis
-
max time kernel
135s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 09:04
Static task
static1
Behavioral task
behavioral1
Sample
7cab917b2a7b988582688e7ba02834b176ac8b2f15da3e6cc19ecc33c22e07b4.exe
Resource
win10v2004-20230220-en
General
-
Target
7cab917b2a7b988582688e7ba02834b176ac8b2f15da3e6cc19ecc33c22e07b4.exe
-
Size
683KB
-
MD5
cbc420afb49fe68118037457c4bab420
-
SHA1
5f0270b581f988c1337eb622255a9d34bb5e6ac4
-
SHA256
7cab917b2a7b988582688e7ba02834b176ac8b2f15da3e6cc19ecc33c22e07b4
-
SHA512
1741c88b0a8949a6c4d6e0dac98d6ceb102718b6ac7ff7cd67258c584e2e84ea5f6eecc0652a794669536a6460c8944f17145ee94559cc4b1b5d3dadcd34e793
-
SSDEEP
12288:EMrwy9032j3Z/WMS5laOe3qH9XG7OUyhmZL3donhiy:kyJLBS5TMqJnXmZLgR
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Processes:
pro6677.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro6677.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro6677.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro6677.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro6677.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro6677.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro6677.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/4572-194-0x0000000004D00000-0x0000000004D3F000-memory.dmp family_redline behavioral1/memory/4572-195-0x0000000004D00000-0x0000000004D3F000-memory.dmp family_redline behavioral1/memory/4572-198-0x0000000004D00000-0x0000000004D3F000-memory.dmp family_redline behavioral1/memory/4572-200-0x0000000004D00000-0x0000000004D3F000-memory.dmp family_redline behavioral1/memory/4572-202-0x0000000004D00000-0x0000000004D3F000-memory.dmp family_redline behavioral1/memory/4572-204-0x0000000004D00000-0x0000000004D3F000-memory.dmp family_redline behavioral1/memory/4572-206-0x0000000004D00000-0x0000000004D3F000-memory.dmp family_redline behavioral1/memory/4572-208-0x0000000004D00000-0x0000000004D3F000-memory.dmp family_redline behavioral1/memory/4572-210-0x0000000004D00000-0x0000000004D3F000-memory.dmp family_redline behavioral1/memory/4572-212-0x0000000004D00000-0x0000000004D3F000-memory.dmp family_redline behavioral1/memory/4572-218-0x0000000004D00000-0x0000000004D3F000-memory.dmp family_redline behavioral1/memory/4572-220-0x0000000004D00000-0x0000000004D3F000-memory.dmp family_redline behavioral1/memory/4572-216-0x0000000004D00000-0x0000000004D3F000-memory.dmp family_redline behavioral1/memory/4572-214-0x0000000004D00000-0x0000000004D3F000-memory.dmp family_redline behavioral1/memory/4572-222-0x0000000004D00000-0x0000000004D3F000-memory.dmp family_redline behavioral1/memory/4572-224-0x0000000004D00000-0x0000000004D3F000-memory.dmp family_redline behavioral1/memory/4572-226-0x0000000004D00000-0x0000000004D3F000-memory.dmp family_redline behavioral1/memory/4572-228-0x0000000004D00000-0x0000000004D3F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un954343.exepro6677.exequ9395.exesi538440.exepid process 3772 un954343.exe 1052 pro6677.exe 4572 qu9395.exe 2428 si538440.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro6677.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro6677.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro6677.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
7cab917b2a7b988582688e7ba02834b176ac8b2f15da3e6cc19ecc33c22e07b4.exeun954343.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 7cab917b2a7b988582688e7ba02834b176ac8b2f15da3e6cc19ecc33c22e07b4.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un954343.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un954343.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 7cab917b2a7b988582688e7ba02834b176ac8b2f15da3e6cc19ecc33c22e07b4.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4168 1052 WerFault.exe pro6677.exe 1468 4572 WerFault.exe qu9395.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro6677.exequ9395.exesi538440.exepid process 1052 pro6677.exe 1052 pro6677.exe 4572 qu9395.exe 4572 qu9395.exe 2428 si538440.exe 2428 si538440.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro6677.exequ9395.exesi538440.exedescription pid process Token: SeDebugPrivilege 1052 pro6677.exe Token: SeDebugPrivilege 4572 qu9395.exe Token: SeDebugPrivilege 2428 si538440.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
7cab917b2a7b988582688e7ba02834b176ac8b2f15da3e6cc19ecc33c22e07b4.exeun954343.exedescription pid process target process PID 3388 wrote to memory of 3772 3388 7cab917b2a7b988582688e7ba02834b176ac8b2f15da3e6cc19ecc33c22e07b4.exe un954343.exe PID 3388 wrote to memory of 3772 3388 7cab917b2a7b988582688e7ba02834b176ac8b2f15da3e6cc19ecc33c22e07b4.exe un954343.exe PID 3388 wrote to memory of 3772 3388 7cab917b2a7b988582688e7ba02834b176ac8b2f15da3e6cc19ecc33c22e07b4.exe un954343.exe PID 3772 wrote to memory of 1052 3772 un954343.exe pro6677.exe PID 3772 wrote to memory of 1052 3772 un954343.exe pro6677.exe PID 3772 wrote to memory of 1052 3772 un954343.exe pro6677.exe PID 3772 wrote to memory of 4572 3772 un954343.exe qu9395.exe PID 3772 wrote to memory of 4572 3772 un954343.exe qu9395.exe PID 3772 wrote to memory of 4572 3772 un954343.exe qu9395.exe PID 3388 wrote to memory of 2428 3388 7cab917b2a7b988582688e7ba02834b176ac8b2f15da3e6cc19ecc33c22e07b4.exe si538440.exe PID 3388 wrote to memory of 2428 3388 7cab917b2a7b988582688e7ba02834b176ac8b2f15da3e6cc19ecc33c22e07b4.exe si538440.exe PID 3388 wrote to memory of 2428 3388 7cab917b2a7b988582688e7ba02834b176ac8b2f15da3e6cc19ecc33c22e07b4.exe si538440.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7cab917b2a7b988582688e7ba02834b176ac8b2f15da3e6cc19ecc33c22e07b4.exe"C:\Users\Admin\AppData\Local\Temp\7cab917b2a7b988582688e7ba02834b176ac8b2f15da3e6cc19ecc33c22e07b4.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un954343.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un954343.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6677.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6677.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 10804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9395.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9395.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 13484⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si538440.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si538440.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1052 -ip 10521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4572 -ip 45721⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si538440.exeFilesize
175KB
MD521e81e3bd7768facda8f3ee81f9958b6
SHA177a9aed74f779663c325e1c8a6384123489b2d9a
SHA256ea86aadc2d1eea47c97cfe789a283f06945687950b49a86d1de3f82f71994ea7
SHA512babbff3a4c5505c94c38288763c6c30c78d7954a94a752b812cb0124702f2416d0ae40c3d788f12cbc3e7d571beee287b2ab811d778f3fe5340212e2efcb7512
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si538440.exeFilesize
175KB
MD521e81e3bd7768facda8f3ee81f9958b6
SHA177a9aed74f779663c325e1c8a6384123489b2d9a
SHA256ea86aadc2d1eea47c97cfe789a283f06945687950b49a86d1de3f82f71994ea7
SHA512babbff3a4c5505c94c38288763c6c30c78d7954a94a752b812cb0124702f2416d0ae40c3d788f12cbc3e7d571beee287b2ab811d778f3fe5340212e2efcb7512
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un954343.exeFilesize
541KB
MD538ae4095c8285b8f29b6a0f8c96d0193
SHA1055924e61b06dff3edb02549656240a86af29fea
SHA2569e0e813a3594bb0beadb27ec34acaf91560a6b425eb0b83e4ee9c03f78aaed2d
SHA5120ef43093a10a0f5706b52cb4bf05ac50a35f4bd26f9fef8d93c57a54003da00a83c32243750380e79cd2d14da0c76bd1cd557a1a96c9950cdc4f163e54ad02f5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un954343.exeFilesize
541KB
MD538ae4095c8285b8f29b6a0f8c96d0193
SHA1055924e61b06dff3edb02549656240a86af29fea
SHA2569e0e813a3594bb0beadb27ec34acaf91560a6b425eb0b83e4ee9c03f78aaed2d
SHA5120ef43093a10a0f5706b52cb4bf05ac50a35f4bd26f9fef8d93c57a54003da00a83c32243750380e79cd2d14da0c76bd1cd557a1a96c9950cdc4f163e54ad02f5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6677.exeFilesize
321KB
MD577ba075ceb54646e10bceb44c18b3673
SHA140319ec69792a1fbd5cb6740f77f9a57cbaedaa4
SHA256cba74279c090bb07d7b8e55d29edf152d609cee5808759fa5929e912f4b779fb
SHA51284987ff1c4e1a653aecadf9ce8c871dd22a8db8853dd6d25ee15469567e9d87d242f9cea32074c687a716132afe16c404af50f6972a139bc9791d1d53a9efb25
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6677.exeFilesize
321KB
MD577ba075ceb54646e10bceb44c18b3673
SHA140319ec69792a1fbd5cb6740f77f9a57cbaedaa4
SHA256cba74279c090bb07d7b8e55d29edf152d609cee5808759fa5929e912f4b779fb
SHA51284987ff1c4e1a653aecadf9ce8c871dd22a8db8853dd6d25ee15469567e9d87d242f9cea32074c687a716132afe16c404af50f6972a139bc9791d1d53a9efb25
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9395.exeFilesize
380KB
MD51f42c790f5d9bfd64e7211cc0a62a2d6
SHA1f4d7b327db39619481ec3ccadaf1f768a75aac3d
SHA256f8b19277008a70bff0ab1dc736851f3e3589eea4453d9f68a942407b8ca233dd
SHA512c6ef1ffdd98799ffa71dcad878d3c6a982aceef8273368ec5dbecb4f720532b9c7253aa95a06d1bafb8995be51d7e635ad1a89ae217d5903d1f49eaed692fc19
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9395.exeFilesize
380KB
MD51f42c790f5d9bfd64e7211cc0a62a2d6
SHA1f4d7b327db39619481ec3ccadaf1f768a75aac3d
SHA256f8b19277008a70bff0ab1dc736851f3e3589eea4453d9f68a942407b8ca233dd
SHA512c6ef1ffdd98799ffa71dcad878d3c6a982aceef8273368ec5dbecb4f720532b9c7253aa95a06d1bafb8995be51d7e635ad1a89ae217d5903d1f49eaed692fc19
-
memory/1052-148-0x0000000002B80000-0x0000000002BAD000-memory.dmpFilesize
180KB
-
memory/1052-149-0x0000000007460000-0x0000000007A04000-memory.dmpFilesize
5.6MB
-
memory/1052-150-0x0000000004ED0000-0x0000000004EE2000-memory.dmpFilesize
72KB
-
memory/1052-151-0x0000000004ED0000-0x0000000004EE2000-memory.dmpFilesize
72KB
-
memory/1052-153-0x0000000004ED0000-0x0000000004EE2000-memory.dmpFilesize
72KB
-
memory/1052-155-0x0000000004ED0000-0x0000000004EE2000-memory.dmpFilesize
72KB
-
memory/1052-157-0x0000000004ED0000-0x0000000004EE2000-memory.dmpFilesize
72KB
-
memory/1052-159-0x0000000004ED0000-0x0000000004EE2000-memory.dmpFilesize
72KB
-
memory/1052-161-0x0000000004ED0000-0x0000000004EE2000-memory.dmpFilesize
72KB
-
memory/1052-165-0x0000000004ED0000-0x0000000004EE2000-memory.dmpFilesize
72KB
-
memory/1052-163-0x0000000004ED0000-0x0000000004EE2000-memory.dmpFilesize
72KB
-
memory/1052-167-0x0000000004ED0000-0x0000000004EE2000-memory.dmpFilesize
72KB
-
memory/1052-169-0x0000000004ED0000-0x0000000004EE2000-memory.dmpFilesize
72KB
-
memory/1052-171-0x0000000004ED0000-0x0000000004EE2000-memory.dmpFilesize
72KB
-
memory/1052-173-0x0000000004ED0000-0x0000000004EE2000-memory.dmpFilesize
72KB
-
memory/1052-175-0x0000000004ED0000-0x0000000004EE2000-memory.dmpFilesize
72KB
-
memory/1052-177-0x0000000004ED0000-0x0000000004EE2000-memory.dmpFilesize
72KB
-
memory/1052-178-0x0000000007450000-0x0000000007460000-memory.dmpFilesize
64KB
-
memory/1052-179-0x0000000007450000-0x0000000007460000-memory.dmpFilesize
64KB
-
memory/1052-180-0x0000000007450000-0x0000000007460000-memory.dmpFilesize
64KB
-
memory/1052-181-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/1052-183-0x0000000007450000-0x0000000007460000-memory.dmpFilesize
64KB
-
memory/1052-184-0x0000000007450000-0x0000000007460000-memory.dmpFilesize
64KB
-
memory/1052-185-0x0000000007450000-0x0000000007460000-memory.dmpFilesize
64KB
-
memory/1052-186-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/2428-1122-0x0000000000550000-0x0000000000582000-memory.dmpFilesize
200KB
-
memory/2428-1123-0x0000000004EA0000-0x0000000004EB0000-memory.dmpFilesize
64KB
-
memory/4572-193-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB
-
memory/4572-226-0x0000000004D00000-0x0000000004D3F000-memory.dmpFilesize
252KB
-
memory/4572-194-0x0000000004D00000-0x0000000004D3F000-memory.dmpFilesize
252KB
-
memory/4572-196-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB
-
memory/4572-195-0x0000000004D00000-0x0000000004D3F000-memory.dmpFilesize
252KB
-
memory/4572-198-0x0000000004D00000-0x0000000004D3F000-memory.dmpFilesize
252KB
-
memory/4572-200-0x0000000004D00000-0x0000000004D3F000-memory.dmpFilesize
252KB
-
memory/4572-202-0x0000000004D00000-0x0000000004D3F000-memory.dmpFilesize
252KB
-
memory/4572-204-0x0000000004D00000-0x0000000004D3F000-memory.dmpFilesize
252KB
-
memory/4572-206-0x0000000004D00000-0x0000000004D3F000-memory.dmpFilesize
252KB
-
memory/4572-208-0x0000000004D00000-0x0000000004D3F000-memory.dmpFilesize
252KB
-
memory/4572-210-0x0000000004D00000-0x0000000004D3F000-memory.dmpFilesize
252KB
-
memory/4572-212-0x0000000004D00000-0x0000000004D3F000-memory.dmpFilesize
252KB
-
memory/4572-218-0x0000000004D00000-0x0000000004D3F000-memory.dmpFilesize
252KB
-
memory/4572-220-0x0000000004D00000-0x0000000004D3F000-memory.dmpFilesize
252KB
-
memory/4572-216-0x0000000004D00000-0x0000000004D3F000-memory.dmpFilesize
252KB
-
memory/4572-214-0x0000000004D00000-0x0000000004D3F000-memory.dmpFilesize
252KB
-
memory/4572-222-0x0000000004D00000-0x0000000004D3F000-memory.dmpFilesize
252KB
-
memory/4572-224-0x0000000004D00000-0x0000000004D3F000-memory.dmpFilesize
252KB
-
memory/4572-192-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB
-
memory/4572-228-0x0000000004D00000-0x0000000004D3F000-memory.dmpFilesize
252KB
-
memory/4572-1101-0x0000000007790000-0x0000000007DA8000-memory.dmpFilesize
6.1MB
-
memory/4572-1102-0x0000000007E30000-0x0000000007F3A000-memory.dmpFilesize
1.0MB
-
memory/4572-1103-0x0000000007F70000-0x0000000007F82000-memory.dmpFilesize
72KB
-
memory/4572-1104-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB
-
memory/4572-1105-0x0000000007F90000-0x0000000007FCC000-memory.dmpFilesize
240KB
-
memory/4572-1107-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB
-
memory/4572-1108-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB
-
memory/4572-1109-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB
-
memory/4572-1110-0x0000000008280000-0x0000000008312000-memory.dmpFilesize
584KB
-
memory/4572-1111-0x0000000008320000-0x0000000008386000-memory.dmpFilesize
408KB
-
memory/4572-1112-0x0000000008A40000-0x0000000008C02000-memory.dmpFilesize
1.8MB
-
memory/4572-1113-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB
-
memory/4572-191-0x0000000002B90000-0x0000000002BDB000-memory.dmpFilesize
300KB
-
memory/4572-1114-0x0000000008C20000-0x000000000914C000-memory.dmpFilesize
5.2MB
-
memory/4572-1115-0x00000000093C0000-0x0000000009436000-memory.dmpFilesize
472KB
-
memory/4572-1116-0x0000000009450000-0x00000000094A0000-memory.dmpFilesize
320KB