Analysis
-
max time kernel
59s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 08:28
Static task
static1
Behavioral task
behavioral1
Sample
56023227c8946e1b954c03a5f2f08915.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
56023227c8946e1b954c03a5f2f08915.exe
Resource
win10v2004-20230220-en
General
-
Target
56023227c8946e1b954c03a5f2f08915.exe
-
Size
694KB
-
MD5
56023227c8946e1b954c03a5f2f08915
-
SHA1
5763e0b9937a38c487890f1d8c194422239e9c9d
-
SHA256
a9a3d706b6613786203e321fd54fc9988843dcfdd823279657f811cdb80bfb66
-
SHA512
9d54f8fe2016263ab9e1f7facbd7e024eb26c13b0f3f0d447ff76cf292bf2cccaa9ab37432b9903eabf9c77a5113bb102f678c4f81da9866a6160db46321eca4
-
SSDEEP
12288:BoK7SPhtwSwKdNGHv+3jk5I00xBFQjwnS1PEqvMTsPpD6WdpB:ru5tjwKd0HWzk5NcKZEqldFH
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Processes:
jr307728.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr307728.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr307728.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr307728.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr307728.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr307728.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr307728.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 32 IoCs
Processes:
resource yara_rule behavioral2/memory/4376-159-0x0000000003DC0000-0x0000000003DFF000-memory.dmp family_redline behavioral2/memory/4376-160-0x0000000003DC0000-0x0000000003DFF000-memory.dmp family_redline behavioral2/memory/4376-162-0x0000000003DC0000-0x0000000003DFF000-memory.dmp family_redline behavioral2/memory/4376-164-0x0000000003DC0000-0x0000000003DFF000-memory.dmp family_redline behavioral2/memory/4376-166-0x0000000003DC0000-0x0000000003DFF000-memory.dmp family_redline behavioral2/memory/4376-168-0x0000000003DC0000-0x0000000003DFF000-memory.dmp family_redline behavioral2/memory/4376-170-0x0000000003DC0000-0x0000000003DFF000-memory.dmp family_redline behavioral2/memory/4376-172-0x0000000003DC0000-0x0000000003DFF000-memory.dmp family_redline behavioral2/memory/4376-176-0x0000000003DC0000-0x0000000003DFF000-memory.dmp family_redline behavioral2/memory/4376-178-0x0000000003DC0000-0x0000000003DFF000-memory.dmp family_redline behavioral2/memory/4376-174-0x0000000003DC0000-0x0000000003DFF000-memory.dmp family_redline behavioral2/memory/4376-180-0x0000000003DC0000-0x0000000003DFF000-memory.dmp family_redline behavioral2/memory/4376-182-0x0000000003DC0000-0x0000000003DFF000-memory.dmp family_redline behavioral2/memory/4376-184-0x0000000003DC0000-0x0000000003DFF000-memory.dmp family_redline behavioral2/memory/4376-186-0x0000000003DC0000-0x0000000003DFF000-memory.dmp family_redline behavioral2/memory/4376-188-0x0000000003DC0000-0x0000000003DFF000-memory.dmp family_redline behavioral2/memory/4376-194-0x0000000003DC0000-0x0000000003DFF000-memory.dmp family_redline behavioral2/memory/4376-190-0x0000000003DC0000-0x0000000003DFF000-memory.dmp family_redline behavioral2/memory/4376-196-0x0000000003DC0000-0x0000000003DFF000-memory.dmp family_redline behavioral2/memory/4376-198-0x0000000003DC0000-0x0000000003DFF000-memory.dmp family_redline behavioral2/memory/4376-200-0x0000000003DC0000-0x0000000003DFF000-memory.dmp family_redline behavioral2/memory/4376-202-0x0000000003DC0000-0x0000000003DFF000-memory.dmp family_redline behavioral2/memory/4376-204-0x0000000003DC0000-0x0000000003DFF000-memory.dmp family_redline behavioral2/memory/4376-206-0x0000000003DC0000-0x0000000003DFF000-memory.dmp family_redline behavioral2/memory/4376-208-0x0000000003DC0000-0x0000000003DFF000-memory.dmp family_redline behavioral2/memory/4376-210-0x0000000003DC0000-0x0000000003DFF000-memory.dmp family_redline behavioral2/memory/4376-212-0x0000000003DC0000-0x0000000003DFF000-memory.dmp family_redline behavioral2/memory/4376-214-0x0000000003DC0000-0x0000000003DFF000-memory.dmp family_redline behavioral2/memory/4376-216-0x0000000003DC0000-0x0000000003DFF000-memory.dmp family_redline behavioral2/memory/4376-218-0x0000000003DC0000-0x0000000003DFF000-memory.dmp family_redline behavioral2/memory/4376-220-0x0000000003DC0000-0x0000000003DFF000-memory.dmp family_redline behavioral2/memory/4376-222-0x0000000003DC0000-0x0000000003DFF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
zibm2610.exejr307728.exeku031366.exelr901123.exepid process 4340 zibm2610.exe 856 jr307728.exe 4376 ku031366.exe 888 lr901123.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr307728.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr307728.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
zibm2610.exe56023227c8946e1b954c03a5f2f08915.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zibm2610.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 56023227c8946e1b954c03a5f2f08915.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 56023227c8946e1b954c03a5f2f08915.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zibm2610.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4568 4376 WerFault.exe ku031366.exe 4728 1180 WerFault.exe 56023227c8946e1b954c03a5f2f08915.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr307728.exeku031366.exelr901123.exepid process 856 jr307728.exe 856 jr307728.exe 4376 ku031366.exe 4376 ku031366.exe 888 lr901123.exe 888 lr901123.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr307728.exeku031366.exelr901123.exedescription pid process Token: SeDebugPrivilege 856 jr307728.exe Token: SeDebugPrivilege 4376 ku031366.exe Token: SeDebugPrivilege 888 lr901123.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
56023227c8946e1b954c03a5f2f08915.exezibm2610.exedescription pid process target process PID 1180 wrote to memory of 4340 1180 56023227c8946e1b954c03a5f2f08915.exe zibm2610.exe PID 1180 wrote to memory of 4340 1180 56023227c8946e1b954c03a5f2f08915.exe zibm2610.exe PID 1180 wrote to memory of 4340 1180 56023227c8946e1b954c03a5f2f08915.exe zibm2610.exe PID 4340 wrote to memory of 856 4340 zibm2610.exe jr307728.exe PID 4340 wrote to memory of 856 4340 zibm2610.exe jr307728.exe PID 4340 wrote to memory of 4376 4340 zibm2610.exe ku031366.exe PID 4340 wrote to memory of 4376 4340 zibm2610.exe ku031366.exe PID 4340 wrote to memory of 4376 4340 zibm2610.exe ku031366.exe PID 1180 wrote to memory of 888 1180 56023227c8946e1b954c03a5f2f08915.exe lr901123.exe PID 1180 wrote to memory of 888 1180 56023227c8946e1b954c03a5f2f08915.exe lr901123.exe PID 1180 wrote to memory of 888 1180 56023227c8946e1b954c03a5f2f08915.exe lr901123.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\56023227c8946e1b954c03a5f2f08915.exe"C:\Users\Admin\AppData\Local\Temp\56023227c8946e1b954c03a5f2f08915.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zibm2610.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zibm2610.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr307728.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr307728.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku031366.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku031366.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 18764⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr901123.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr901123.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 1322⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4376 -ip 43761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1180 -ip 11801⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr901123.exeFilesize
175KB
MD5a3b183310744431c1ae8c6a9e5a8c00c
SHA1e14ba80f5a6c45928c2c1920d36aff461080361a
SHA25610f1c5840d50c1b7f270e354b6f28280a1f19336b37735dfe10069ca7990b9dc
SHA51248a2d4d43b4b4c71301a0feb33c6b4c702c6b4052b79b1b55790ada8dcf52850ad7746ee02d0b408e4390ac91e7f834fea4b03ad90324a03bcdf8df261fd95aa
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr901123.exeFilesize
175KB
MD5a3b183310744431c1ae8c6a9e5a8c00c
SHA1e14ba80f5a6c45928c2c1920d36aff461080361a
SHA25610f1c5840d50c1b7f270e354b6f28280a1f19336b37735dfe10069ca7990b9dc
SHA51248a2d4d43b4b4c71301a0feb33c6b4c702c6b4052b79b1b55790ada8dcf52850ad7746ee02d0b408e4390ac91e7f834fea4b03ad90324a03bcdf8df261fd95aa
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zibm2610.exeFilesize
388KB
MD57da91d63c271024c618c9988ce1f4604
SHA1f2173e9758baffce0ad82ce1b73523b803de1f99
SHA256403314199f08f27a5ddda772c8447ffc00b9034c49bd4e5d760a0446ae3ab3bc
SHA5123b78c1493e26375ba7f8561dd92f59c00b63c21a88a08473393c77951547774e2c9ebb63d4ddb467b320c44c35060726d81fdb3bf453d9e18d0c3ad51edde387
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zibm2610.exeFilesize
388KB
MD57da91d63c271024c618c9988ce1f4604
SHA1f2173e9758baffce0ad82ce1b73523b803de1f99
SHA256403314199f08f27a5ddda772c8447ffc00b9034c49bd4e5d760a0446ae3ab3bc
SHA5123b78c1493e26375ba7f8561dd92f59c00b63c21a88a08473393c77951547774e2c9ebb63d4ddb467b320c44c35060726d81fdb3bf453d9e18d0c3ad51edde387
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr307728.exeFilesize
11KB
MD55b143b7f6940e9de958b67626b1dbd87
SHA15ba04498673d2351a6be4139cb39f971a17fa3af
SHA2560e19dc7d29ce59c27cb95ee236362e67132028eef5142897003a78a0395297d2
SHA512bb35a3466ba62ab60d0861bf40be658dd2efbdd839aa4f4e7b3b631b2e39da4ab4674f583cd0319e143b4aa3c2bfd2b7988aaae790b7c3e7e6d4e2efcb04bcaa
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr307728.exeFilesize
11KB
MD55b143b7f6940e9de958b67626b1dbd87
SHA15ba04498673d2351a6be4139cb39f971a17fa3af
SHA2560e19dc7d29ce59c27cb95ee236362e67132028eef5142897003a78a0395297d2
SHA512bb35a3466ba62ab60d0861bf40be658dd2efbdd839aa4f4e7b3b631b2e39da4ab4674f583cd0319e143b4aa3c2bfd2b7988aaae790b7c3e7e6d4e2efcb04bcaa
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku031366.exeFilesize
345KB
MD58a012bcfba83ac9642a3556bbbb63d03
SHA149c2d3e80367abd491353781d6596dd5eeb76962
SHA256df403a44af2b45dcfdb80f7d89e8f186f41fce7fa4e819f8efa68b4e30b29613
SHA51222f59aa00e0748f84d575cb67cb1ff1bdb6d45c1cf6ea6e377dea9c8759540375dc89e572bd4f500deeb23981d4a79de89fb6213cb6225df07c5e2a6b9c00518
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku031366.exeFilesize
345KB
MD58a012bcfba83ac9642a3556bbbb63d03
SHA149c2d3e80367abd491353781d6596dd5eeb76962
SHA256df403a44af2b45dcfdb80f7d89e8f186f41fce7fa4e819f8efa68b4e30b29613
SHA51222f59aa00e0748f84d575cb67cb1ff1bdb6d45c1cf6ea6e377dea9c8759540375dc89e572bd4f500deeb23981d4a79de89fb6213cb6225df07c5e2a6b9c00518
-
memory/856-148-0x0000000000920000-0x000000000092A000-memory.dmpFilesize
40KB
-
memory/888-1090-0x00000000000F0000-0x0000000000122000-memory.dmpFilesize
200KB
-
memory/888-1093-0x0000000004CC0000-0x0000000004CD0000-memory.dmpFilesize
64KB
-
memory/888-1091-0x0000000004CC0000-0x0000000004CD0000-memory.dmpFilesize
64KB
-
memory/1180-149-0x0000000004980000-0x0000000004A06000-memory.dmpFilesize
536KB
-
memory/1180-150-0x0000000000400000-0x0000000002BDB000-memory.dmpFilesize
39.9MB
-
memory/4376-193-0x0000000006230000-0x0000000006240000-memory.dmpFilesize
64KB
-
memory/4376-204-0x0000000003DC0000-0x0000000003DFF000-memory.dmpFilesize
252KB
-
memory/4376-160-0x0000000003DC0000-0x0000000003DFF000-memory.dmpFilesize
252KB
-
memory/4376-162-0x0000000003DC0000-0x0000000003DFF000-memory.dmpFilesize
252KB
-
memory/4376-164-0x0000000003DC0000-0x0000000003DFF000-memory.dmpFilesize
252KB
-
memory/4376-166-0x0000000003DC0000-0x0000000003DFF000-memory.dmpFilesize
252KB
-
memory/4376-168-0x0000000003DC0000-0x0000000003DFF000-memory.dmpFilesize
252KB
-
memory/4376-170-0x0000000003DC0000-0x0000000003DFF000-memory.dmpFilesize
252KB
-
memory/4376-172-0x0000000003DC0000-0x0000000003DFF000-memory.dmpFilesize
252KB
-
memory/4376-176-0x0000000003DC0000-0x0000000003DFF000-memory.dmpFilesize
252KB
-
memory/4376-178-0x0000000003DC0000-0x0000000003DFF000-memory.dmpFilesize
252KB
-
memory/4376-174-0x0000000003DC0000-0x0000000003DFF000-memory.dmpFilesize
252KB
-
memory/4376-180-0x0000000003DC0000-0x0000000003DFF000-memory.dmpFilesize
252KB
-
memory/4376-182-0x0000000003DC0000-0x0000000003DFF000-memory.dmpFilesize
252KB
-
memory/4376-184-0x0000000003DC0000-0x0000000003DFF000-memory.dmpFilesize
252KB
-
memory/4376-186-0x0000000003DC0000-0x0000000003DFF000-memory.dmpFilesize
252KB
-
memory/4376-188-0x0000000003DC0000-0x0000000003DFF000-memory.dmpFilesize
252KB
-
memory/4376-191-0x0000000006230000-0x0000000006240000-memory.dmpFilesize
64KB
-
memory/4376-158-0x0000000006240000-0x00000000067E4000-memory.dmpFilesize
5.6MB
-
memory/4376-194-0x0000000003DC0000-0x0000000003DFF000-memory.dmpFilesize
252KB
-
memory/4376-190-0x0000000003DC0000-0x0000000003DFF000-memory.dmpFilesize
252KB
-
memory/4376-196-0x0000000003DC0000-0x0000000003DFF000-memory.dmpFilesize
252KB
-
memory/4376-198-0x0000000003DC0000-0x0000000003DFF000-memory.dmpFilesize
252KB
-
memory/4376-200-0x0000000003DC0000-0x0000000003DFF000-memory.dmpFilesize
252KB
-
memory/4376-202-0x0000000003DC0000-0x0000000003DFF000-memory.dmpFilesize
252KB
-
memory/4376-159-0x0000000003DC0000-0x0000000003DFF000-memory.dmpFilesize
252KB
-
memory/4376-206-0x0000000003DC0000-0x0000000003DFF000-memory.dmpFilesize
252KB
-
memory/4376-208-0x0000000003DC0000-0x0000000003DFF000-memory.dmpFilesize
252KB
-
memory/4376-210-0x0000000003DC0000-0x0000000003DFF000-memory.dmpFilesize
252KB
-
memory/4376-212-0x0000000003DC0000-0x0000000003DFF000-memory.dmpFilesize
252KB
-
memory/4376-214-0x0000000003DC0000-0x0000000003DFF000-memory.dmpFilesize
252KB
-
memory/4376-216-0x0000000003DC0000-0x0000000003DFF000-memory.dmpFilesize
252KB
-
memory/4376-218-0x0000000003DC0000-0x0000000003DFF000-memory.dmpFilesize
252KB
-
memory/4376-220-0x0000000003DC0000-0x0000000003DFF000-memory.dmpFilesize
252KB
-
memory/4376-222-0x0000000003DC0000-0x0000000003DFF000-memory.dmpFilesize
252KB
-
memory/4376-1067-0x00000000067F0000-0x0000000006E08000-memory.dmpFilesize
6.1MB
-
memory/4376-1068-0x0000000006E10000-0x0000000006F1A000-memory.dmpFilesize
1.0MB
-
memory/4376-1069-0x0000000006F50000-0x0000000006F62000-memory.dmpFilesize
72KB
-
memory/4376-1070-0x0000000006230000-0x0000000006240000-memory.dmpFilesize
64KB
-
memory/4376-1071-0x0000000006F70000-0x0000000006FAC000-memory.dmpFilesize
240KB
-
memory/4376-1074-0x0000000007260000-0x00000000072C6000-memory.dmpFilesize
408KB
-
memory/4376-1075-0x0000000007910000-0x00000000079A2000-memory.dmpFilesize
584KB
-
memory/4376-1076-0x0000000006230000-0x0000000006240000-memory.dmpFilesize
64KB
-
memory/4376-1077-0x0000000006230000-0x0000000006240000-memory.dmpFilesize
64KB
-
memory/4376-1078-0x0000000006230000-0x0000000006240000-memory.dmpFilesize
64KB
-
memory/4376-1079-0x0000000008F10000-0x0000000008F86000-memory.dmpFilesize
472KB
-
memory/4376-157-0x0000000006230000-0x0000000006240000-memory.dmpFilesize
64KB
-
memory/4376-156-0x0000000001B00000-0x0000000001B4B000-memory.dmpFilesize
300KB
-
memory/4376-1080-0x0000000008FA0000-0x0000000008FF0000-memory.dmpFilesize
320KB
-
memory/4376-1082-0x0000000009000000-0x00000000091C2000-memory.dmpFilesize
1.8MB
-
memory/4376-1083-0x00000000091E0000-0x000000000970C000-memory.dmpFilesize
5.2MB