Analysis
-
max time kernel
60s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 09:05
Static task
static1
Behavioral task
behavioral1
Sample
e50ecc010d4d342de7a1979bc811ef50c14c9ead898575f7278c7c8281ed4b8a.exe
Resource
win10v2004-20230220-en
General
-
Target
e50ecc010d4d342de7a1979bc811ef50c14c9ead898575f7278c7c8281ed4b8a.exe
-
Size
685KB
-
MD5
143c3c8d3e8b8375ee97e676e500f186
-
SHA1
b3f726016d27024885adb05d798c5f9d03ff1c89
-
SHA256
e50ecc010d4d342de7a1979bc811ef50c14c9ead898575f7278c7c8281ed4b8a
-
SHA512
0deaabaebdba50cc05df428cc8dc5cbc397cbf8337459a5d4e7ae2e7e551a32f64475d290cc5e8439a1e5495255761ef1cadaced1fa986634003f46fba8e99b1
-
SSDEEP
12288:UMrsy90GAcNxR4a+Hk70aPricqF/1yro1pC82UXZmpL3Zu8FQpO9gD:gygFE70MPqzyK/22mpLpub2s
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Processes:
pro9667.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro9667.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro9667.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro9667.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro9667.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro9667.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro9667.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/2316-191-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/2316-192-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/2316-196-0x00000000071D0000-0x00000000071E0000-memory.dmp family_redline behavioral1/memory/2316-197-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/2316-200-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/2316-202-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/2316-204-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/2316-206-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/2316-208-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/2316-210-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/2316-212-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/2316-214-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/2316-216-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/2316-218-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/2316-220-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/2316-222-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/2316-224-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/2316-226-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/2316-228-0x0000000007130000-0x000000000716F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un882963.exepro9667.exequ8871.exesi253246.exepid process 3824 un882963.exe 2012 pro9667.exe 2316 qu8871.exe 1444 si253246.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro9667.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro9667.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro9667.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un882963.exee50ecc010d4d342de7a1979bc811ef50c14c9ead898575f7278c7c8281ed4b8a.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un882963.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un882963.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce e50ecc010d4d342de7a1979bc811ef50c14c9ead898575f7278c7c8281ed4b8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" e50ecc010d4d342de7a1979bc811ef50c14c9ead898575f7278c7c8281ed4b8a.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 724 2012 WerFault.exe pro9667.exe 4312 2316 WerFault.exe qu8871.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro9667.exequ8871.exesi253246.exepid process 2012 pro9667.exe 2012 pro9667.exe 2316 qu8871.exe 2316 qu8871.exe 1444 si253246.exe 1444 si253246.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro9667.exequ8871.exesi253246.exedescription pid process Token: SeDebugPrivilege 2012 pro9667.exe Token: SeDebugPrivilege 2316 qu8871.exe Token: SeDebugPrivilege 1444 si253246.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
e50ecc010d4d342de7a1979bc811ef50c14c9ead898575f7278c7c8281ed4b8a.exeun882963.exedescription pid process target process PID 1808 wrote to memory of 3824 1808 e50ecc010d4d342de7a1979bc811ef50c14c9ead898575f7278c7c8281ed4b8a.exe un882963.exe PID 1808 wrote to memory of 3824 1808 e50ecc010d4d342de7a1979bc811ef50c14c9ead898575f7278c7c8281ed4b8a.exe un882963.exe PID 1808 wrote to memory of 3824 1808 e50ecc010d4d342de7a1979bc811ef50c14c9ead898575f7278c7c8281ed4b8a.exe un882963.exe PID 3824 wrote to memory of 2012 3824 un882963.exe pro9667.exe PID 3824 wrote to memory of 2012 3824 un882963.exe pro9667.exe PID 3824 wrote to memory of 2012 3824 un882963.exe pro9667.exe PID 3824 wrote to memory of 2316 3824 un882963.exe qu8871.exe PID 3824 wrote to memory of 2316 3824 un882963.exe qu8871.exe PID 3824 wrote to memory of 2316 3824 un882963.exe qu8871.exe PID 1808 wrote to memory of 1444 1808 e50ecc010d4d342de7a1979bc811ef50c14c9ead898575f7278c7c8281ed4b8a.exe si253246.exe PID 1808 wrote to memory of 1444 1808 e50ecc010d4d342de7a1979bc811ef50c14c9ead898575f7278c7c8281ed4b8a.exe si253246.exe PID 1808 wrote to memory of 1444 1808 e50ecc010d4d342de7a1979bc811ef50c14c9ead898575f7278c7c8281ed4b8a.exe si253246.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e50ecc010d4d342de7a1979bc811ef50c14c9ead898575f7278c7c8281ed4b8a.exe"C:\Users\Admin\AppData\Local\Temp\e50ecc010d4d342de7a1979bc811ef50c14c9ead898575f7278c7c8281ed4b8a.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un882963.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un882963.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9667.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9667.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 10884⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8871.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8871.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 19644⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si253246.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si253246.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2012 -ip 20121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2316 -ip 23161⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si253246.exeFilesize
175KB
MD5423eb548eede0f0fbf79029fba5d9054
SHA194e1534aba9910f03f5caee7e4ca63606ce8e171
SHA256a37de675b8373142f2b2029ab24be0d789207167c985e56a77baa5f40ac5b2de
SHA512bc5c33ab63effb145d267726740fe166e67c0bdc4dca83a5eb5155bd78bc3c709fbc0b1a7e3a1d9ac8a87cc9d5824b00585de3d5cc6293a93c4fd3b9cf34668a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si253246.exeFilesize
175KB
MD5423eb548eede0f0fbf79029fba5d9054
SHA194e1534aba9910f03f5caee7e4ca63606ce8e171
SHA256a37de675b8373142f2b2029ab24be0d789207167c985e56a77baa5f40ac5b2de
SHA512bc5c33ab63effb145d267726740fe166e67c0bdc4dca83a5eb5155bd78bc3c709fbc0b1a7e3a1d9ac8a87cc9d5824b00585de3d5cc6293a93c4fd3b9cf34668a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un882963.exeFilesize
542KB
MD5b4d937322117e0614f671bec7821d0a7
SHA14213b74efdf441c69c01979eb52a681dabe3140f
SHA25695fb59b93d5395a482665ffd6f8447928390302323c0086b7a5b863107abc193
SHA51218e474b1f78b457b22206e4ac9e80090571c186e3f5ba805cf135574a42773f88b3d1375f14a07ff721b0d952e52c954d5a64fee3fd9c52a4240a2e39a081c1f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un882963.exeFilesize
542KB
MD5b4d937322117e0614f671bec7821d0a7
SHA14213b74efdf441c69c01979eb52a681dabe3140f
SHA25695fb59b93d5395a482665ffd6f8447928390302323c0086b7a5b863107abc193
SHA51218e474b1f78b457b22206e4ac9e80090571c186e3f5ba805cf135574a42773f88b3d1375f14a07ff721b0d952e52c954d5a64fee3fd9c52a4240a2e39a081c1f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9667.exeFilesize
321KB
MD5d59de53e3a38f08e2522160922016f67
SHA1bffba70c45adb3412d51a0d0b03814b461c0ac05
SHA2569cb52465646da970b4536315e5163f12083af05d4aca0c33f9c10e2d67841608
SHA5125ae57c7158cf7992b2505b77c9deb8a092b13073494870fb663dbf78143ea916ac0fa88a1656b87d45f4a60c59e7c283b315aa21f99bc2c6c409d115e608e36b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9667.exeFilesize
321KB
MD5d59de53e3a38f08e2522160922016f67
SHA1bffba70c45adb3412d51a0d0b03814b461c0ac05
SHA2569cb52465646da970b4536315e5163f12083af05d4aca0c33f9c10e2d67841608
SHA5125ae57c7158cf7992b2505b77c9deb8a092b13073494870fb663dbf78143ea916ac0fa88a1656b87d45f4a60c59e7c283b315aa21f99bc2c6c409d115e608e36b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8871.exeFilesize
380KB
MD543116b002672c101060f08c7b21f2036
SHA1e5a107798a0316a755c0c4bb0c1774f706fff5d3
SHA256410e7e9825bdc8a977eb6ba1d3d2c284aa22a9d2e51f2b3d87910d1715de03f0
SHA5124f702c1ac1baf800265da3095bd95b627c7c4015ac6724042ec69851784f13b01c4d290f7739950ace2150ebc2efc7cb324a9221a8f133541b920b10fddae3de
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8871.exeFilesize
380KB
MD543116b002672c101060f08c7b21f2036
SHA1e5a107798a0316a755c0c4bb0c1774f706fff5d3
SHA256410e7e9825bdc8a977eb6ba1d3d2c284aa22a9d2e51f2b3d87910d1715de03f0
SHA5124f702c1ac1baf800265da3095bd95b627c7c4015ac6724042ec69851784f13b01c4d290f7739950ace2150ebc2efc7cb324a9221a8f133541b920b10fddae3de
-
memory/1444-1122-0x0000000000C90000-0x0000000000CC2000-memory.dmpFilesize
200KB
-
memory/1444-1123-0x0000000005610000-0x0000000005620000-memory.dmpFilesize
64KB
-
memory/2012-153-0x0000000007100000-0x0000000007112000-memory.dmpFilesize
72KB
-
memory/2012-170-0x0000000007100000-0x0000000007112000-memory.dmpFilesize
72KB
-
memory/2012-151-0x0000000007260000-0x0000000007270000-memory.dmpFilesize
64KB
-
memory/2012-152-0x0000000007100000-0x0000000007112000-memory.dmpFilesize
72KB
-
memory/2012-156-0x0000000007100000-0x0000000007112000-memory.dmpFilesize
72KB
-
memory/2012-154-0x0000000007260000-0x0000000007270000-memory.dmpFilesize
64KB
-
memory/2012-149-0x0000000007270000-0x0000000007814000-memory.dmpFilesize
5.6MB
-
memory/2012-158-0x0000000007100000-0x0000000007112000-memory.dmpFilesize
72KB
-
memory/2012-160-0x0000000007100000-0x0000000007112000-memory.dmpFilesize
72KB
-
memory/2012-162-0x0000000007100000-0x0000000007112000-memory.dmpFilesize
72KB
-
memory/2012-164-0x0000000007100000-0x0000000007112000-memory.dmpFilesize
72KB
-
memory/2012-166-0x0000000007100000-0x0000000007112000-memory.dmpFilesize
72KB
-
memory/2012-168-0x0000000007100000-0x0000000007112000-memory.dmpFilesize
72KB
-
memory/2012-150-0x0000000007260000-0x0000000007270000-memory.dmpFilesize
64KB
-
memory/2012-172-0x0000000007100000-0x0000000007112000-memory.dmpFilesize
72KB
-
memory/2012-174-0x0000000007100000-0x0000000007112000-memory.dmpFilesize
72KB
-
memory/2012-176-0x0000000007100000-0x0000000007112000-memory.dmpFilesize
72KB
-
memory/2012-178-0x0000000007100000-0x0000000007112000-memory.dmpFilesize
72KB
-
memory/2012-180-0x0000000007100000-0x0000000007112000-memory.dmpFilesize
72KB
-
memory/2012-181-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/2012-183-0x0000000007260000-0x0000000007270000-memory.dmpFilesize
64KB
-
memory/2012-184-0x0000000007260000-0x0000000007270000-memory.dmpFilesize
64KB
-
memory/2012-185-0x0000000007260000-0x0000000007270000-memory.dmpFilesize
64KB
-
memory/2012-186-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/2012-148-0x0000000002D80000-0x0000000002DAD000-memory.dmpFilesize
180KB
-
memory/2316-193-0x0000000002C60000-0x0000000002CAB000-memory.dmpFilesize
300KB
-
memory/2316-226-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/2316-196-0x00000000071D0000-0x00000000071E0000-memory.dmpFilesize
64KB
-
memory/2316-198-0x00000000071D0000-0x00000000071E0000-memory.dmpFilesize
64KB
-
memory/2316-197-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/2316-195-0x00000000071D0000-0x00000000071E0000-memory.dmpFilesize
64KB
-
memory/2316-200-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/2316-202-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/2316-204-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/2316-206-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/2316-208-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/2316-210-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/2316-212-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/2316-214-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/2316-216-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/2316-218-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/2316-220-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/2316-222-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/2316-224-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/2316-192-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/2316-228-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/2316-1101-0x00000000078D0000-0x0000000007EE8000-memory.dmpFilesize
6.1MB
-
memory/2316-1102-0x0000000007F70000-0x000000000807A000-memory.dmpFilesize
1.0MB
-
memory/2316-1103-0x00000000080B0000-0x00000000080C2000-memory.dmpFilesize
72KB
-
memory/2316-1104-0x00000000071D0000-0x00000000071E0000-memory.dmpFilesize
64KB
-
memory/2316-1105-0x00000000080D0000-0x000000000810C000-memory.dmpFilesize
240KB
-
memory/2316-1107-0x00000000083C0000-0x0000000008452000-memory.dmpFilesize
584KB
-
memory/2316-1108-0x0000000008460000-0x00000000084C6000-memory.dmpFilesize
408KB
-
memory/2316-1109-0x00000000071D0000-0x00000000071E0000-memory.dmpFilesize
64KB
-
memory/2316-1111-0x00000000071D0000-0x00000000071E0000-memory.dmpFilesize
64KB
-
memory/2316-1110-0x00000000071D0000-0x00000000071E0000-memory.dmpFilesize
64KB
-
memory/2316-1112-0x0000000008C60000-0x0000000008CD6000-memory.dmpFilesize
472KB
-
memory/2316-1113-0x0000000008CF0000-0x0000000008D40000-memory.dmpFilesize
320KB
-
memory/2316-191-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/2316-1114-0x0000000008D70000-0x0000000008F32000-memory.dmpFilesize
1.8MB
-
memory/2316-1115-0x0000000008F40000-0x000000000946C000-memory.dmpFilesize
5.2MB
-
memory/2316-1116-0x00000000071D0000-0x00000000071E0000-memory.dmpFilesize
64KB