Analysis
-
max time kernel
54s -
max time network
71s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
28-03-2023 08:36
Static task
static1
Behavioral task
behavioral1
Sample
7bcc83655765c1c625a27a60a0836958c5aaeeb34e6a325921dd467bac729eb7.exe
Resource
win10-20230220-en
General
-
Target
7bcc83655765c1c625a27a60a0836958c5aaeeb34e6a325921dd467bac729eb7.exe
-
Size
683KB
-
MD5
965a6de8bbfbd843b3c9288d7c42b190
-
SHA1
9144e85c8010c4ba3c8875ec25c4da19995825d8
-
SHA256
7bcc83655765c1c625a27a60a0836958c5aaeeb34e6a325921dd467bac729eb7
-
SHA512
ecae0bd6c531f2025d4bd36f3312a57c40c6f191dae32a3a19da2023c47c2b096be0a1ce6eba59cee3c058358198d6f5629858342cb5577d579c247ff49508f0
-
SSDEEP
12288:wMr/Ky90t6qQFiqknx38LAbpzeV0y2yUx3vUFEmcL+pp8q:fKyg67gF38oaay2yURv3mcLCmq
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Processes:
pro3808.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro3808.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro3808.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro3808.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro3808.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro3808.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/3612-177-0x0000000004800000-0x0000000004846000-memory.dmp family_redline behavioral1/memory/3612-181-0x0000000004880000-0x00000000048C4000-memory.dmp family_redline behavioral1/memory/3612-182-0x0000000004880000-0x00000000048BF000-memory.dmp family_redline behavioral1/memory/3612-183-0x0000000004880000-0x00000000048BF000-memory.dmp family_redline behavioral1/memory/3612-185-0x0000000004880000-0x00000000048BF000-memory.dmp family_redline behavioral1/memory/3612-189-0x0000000004880000-0x00000000048BF000-memory.dmp family_redline behavioral1/memory/3612-187-0x0000000004880000-0x00000000048BF000-memory.dmp family_redline behavioral1/memory/3612-191-0x0000000004880000-0x00000000048BF000-memory.dmp family_redline behavioral1/memory/3612-193-0x0000000004880000-0x00000000048BF000-memory.dmp family_redline behavioral1/memory/3612-195-0x0000000004880000-0x00000000048BF000-memory.dmp family_redline behavioral1/memory/3612-197-0x0000000004880000-0x00000000048BF000-memory.dmp family_redline behavioral1/memory/3612-199-0x0000000004880000-0x00000000048BF000-memory.dmp family_redline behavioral1/memory/3612-201-0x0000000004880000-0x00000000048BF000-memory.dmp family_redline behavioral1/memory/3612-203-0x0000000004880000-0x00000000048BF000-memory.dmp family_redline behavioral1/memory/3612-205-0x0000000004880000-0x00000000048BF000-memory.dmp family_redline behavioral1/memory/3612-207-0x0000000004880000-0x00000000048BF000-memory.dmp family_redline behavioral1/memory/3612-209-0x0000000004880000-0x00000000048BF000-memory.dmp family_redline behavioral1/memory/3612-211-0x0000000004880000-0x00000000048BF000-memory.dmp family_redline behavioral1/memory/3612-213-0x0000000004880000-0x00000000048BF000-memory.dmp family_redline behavioral1/memory/3612-215-0x0000000004880000-0x00000000048BF000-memory.dmp family_redline behavioral1/memory/3612-475-0x0000000007270000-0x0000000007280000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un204918.exepro3808.exequ0366.exesi235707.exepid process 4512 un204918.exe 4324 pro3808.exe 3612 qu0366.exe 4832 si235707.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro3808.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro3808.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro3808.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
7bcc83655765c1c625a27a60a0836958c5aaeeb34e6a325921dd467bac729eb7.exeun204918.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 7bcc83655765c1c625a27a60a0836958c5aaeeb34e6a325921dd467bac729eb7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 7bcc83655765c1c625a27a60a0836958c5aaeeb34e6a325921dd467bac729eb7.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un204918.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un204918.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro3808.exequ0366.exesi235707.exepid process 4324 pro3808.exe 4324 pro3808.exe 3612 qu0366.exe 3612 qu0366.exe 4832 si235707.exe 4832 si235707.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro3808.exequ0366.exesi235707.exedescription pid process Token: SeDebugPrivilege 4324 pro3808.exe Token: SeDebugPrivilege 3612 qu0366.exe Token: SeDebugPrivilege 4832 si235707.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
7bcc83655765c1c625a27a60a0836958c5aaeeb34e6a325921dd467bac729eb7.exeun204918.exedescription pid process target process PID 372 wrote to memory of 4512 372 7bcc83655765c1c625a27a60a0836958c5aaeeb34e6a325921dd467bac729eb7.exe un204918.exe PID 372 wrote to memory of 4512 372 7bcc83655765c1c625a27a60a0836958c5aaeeb34e6a325921dd467bac729eb7.exe un204918.exe PID 372 wrote to memory of 4512 372 7bcc83655765c1c625a27a60a0836958c5aaeeb34e6a325921dd467bac729eb7.exe un204918.exe PID 4512 wrote to memory of 4324 4512 un204918.exe pro3808.exe PID 4512 wrote to memory of 4324 4512 un204918.exe pro3808.exe PID 4512 wrote to memory of 4324 4512 un204918.exe pro3808.exe PID 4512 wrote to memory of 3612 4512 un204918.exe qu0366.exe PID 4512 wrote to memory of 3612 4512 un204918.exe qu0366.exe PID 4512 wrote to memory of 3612 4512 un204918.exe qu0366.exe PID 372 wrote to memory of 4832 372 7bcc83655765c1c625a27a60a0836958c5aaeeb34e6a325921dd467bac729eb7.exe si235707.exe PID 372 wrote to memory of 4832 372 7bcc83655765c1c625a27a60a0836958c5aaeeb34e6a325921dd467bac729eb7.exe si235707.exe PID 372 wrote to memory of 4832 372 7bcc83655765c1c625a27a60a0836958c5aaeeb34e6a325921dd467bac729eb7.exe si235707.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bcc83655765c1c625a27a60a0836958c5aaeeb34e6a325921dd467bac729eb7.exe"C:\Users\Admin\AppData\Local\Temp\7bcc83655765c1c625a27a60a0836958c5aaeeb34e6a325921dd467bac729eb7.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un204918.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un204918.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3808.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3808.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0366.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0366.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si235707.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si235707.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si235707.exeFilesize
175KB
MD54994e2c10a60889c3af174da2d806a22
SHA1a1de59f9bea344184f648d5a37170c991177f368
SHA256b51fb41e50ed63d8cce573168ffac77df662055565e529066318978f3f2adc5a
SHA5122f464f1dbdf4c6b7e2b9af4217b8b625b7b08c12b2f83ac138fed9894206f84be21caf62edebe44ee4b70224c2b9a3b2219319bb44dd17dbc4d34368c7e27c14
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si235707.exeFilesize
175KB
MD54994e2c10a60889c3af174da2d806a22
SHA1a1de59f9bea344184f648d5a37170c991177f368
SHA256b51fb41e50ed63d8cce573168ffac77df662055565e529066318978f3f2adc5a
SHA5122f464f1dbdf4c6b7e2b9af4217b8b625b7b08c12b2f83ac138fed9894206f84be21caf62edebe44ee4b70224c2b9a3b2219319bb44dd17dbc4d34368c7e27c14
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un204918.exeFilesize
541KB
MD5a8348c4fd556ca1c94855d70ba34807c
SHA1fe5fc3599dc5a95e441840c92c9562d61936f4aa
SHA256f6a6545c1d9a193be6d52a422f129e166e9c4747ff243480826f0ef08cf6852f
SHA512a177736c3ba310098a38044e4c23c35b611c490bdc648a148e6103a12fc0cab18b466dd8572ba09195ea516f80a065b73e525ab0a822794ddd598cfa41de90d3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un204918.exeFilesize
541KB
MD5a8348c4fd556ca1c94855d70ba34807c
SHA1fe5fc3599dc5a95e441840c92c9562d61936f4aa
SHA256f6a6545c1d9a193be6d52a422f129e166e9c4747ff243480826f0ef08cf6852f
SHA512a177736c3ba310098a38044e4c23c35b611c490bdc648a148e6103a12fc0cab18b466dd8572ba09195ea516f80a065b73e525ab0a822794ddd598cfa41de90d3
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3808.exeFilesize
321KB
MD5c30347b64f1ca9092c717d1065c85f39
SHA109340f68feef9563bec89e7e43fa2b89f035fcfd
SHA256c5c555ae74df0ab563c7f8de125230b383732572baaae26af1b3ee4b962b9a70
SHA512ff52edc1377102883b79a3c3f2491d2d21a0c496033394df426e2ab01a79b0d3d0bb1714cb1dbd03e90471811d0e5dfda3ab1337055ba313146b817773ec79c1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3808.exeFilesize
321KB
MD5c30347b64f1ca9092c717d1065c85f39
SHA109340f68feef9563bec89e7e43fa2b89f035fcfd
SHA256c5c555ae74df0ab563c7f8de125230b383732572baaae26af1b3ee4b962b9a70
SHA512ff52edc1377102883b79a3c3f2491d2d21a0c496033394df426e2ab01a79b0d3d0bb1714cb1dbd03e90471811d0e5dfda3ab1337055ba313146b817773ec79c1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0366.exeFilesize
380KB
MD51d7895d4594968ecc22d3098e5f37a3c
SHA12118fab5f4534591cf24c42a111e60745ff06a3c
SHA256cb8df466d55bb0480b464cefca52f88edf1da2ae88e3c0004667aac13de3fc5b
SHA5123300fdbd03343e9f8041a5c552ccf487532c608f2e90620cdd022ff998c6281ef3b8545e3c1dc95b6ce2fba155a93cb52f8244edc0174dc210262b0250cc2050
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0366.exeFilesize
380KB
MD51d7895d4594968ecc22d3098e5f37a3c
SHA12118fab5f4534591cf24c42a111e60745ff06a3c
SHA256cb8df466d55bb0480b464cefca52f88edf1da2ae88e3c0004667aac13de3fc5b
SHA5123300fdbd03343e9f8041a5c552ccf487532c608f2e90620cdd022ff998c6281ef3b8545e3c1dc95b6ce2fba155a93cb52f8244edc0174dc210262b0250cc2050
-
memory/3612-1089-0x0000000007D90000-0x0000000008396000-memory.dmpFilesize
6.0MB
-
memory/3612-215-0x0000000004880000-0x00000000048BF000-memory.dmpFilesize
252KB
-
memory/3612-1104-0x0000000009420000-0x0000000009470000-memory.dmpFilesize
320KB
-
memory/3612-1103-0x00000000093A0000-0x0000000009416000-memory.dmpFilesize
472KB
-
memory/3612-1102-0x0000000007270000-0x0000000007280000-memory.dmpFilesize
64KB
-
memory/3612-191-0x0000000004880000-0x00000000048BF000-memory.dmpFilesize
252KB
-
memory/3612-1101-0x0000000008C30000-0x000000000915C000-memory.dmpFilesize
5.2MB
-
memory/3612-1100-0x0000000008A50000-0x0000000008C12000-memory.dmpFilesize
1.8MB
-
memory/3612-1099-0x0000000007270000-0x0000000007280000-memory.dmpFilesize
64KB
-
memory/3612-1098-0x0000000008830000-0x00000000088C2000-memory.dmpFilesize
584KB
-
memory/3612-193-0x0000000004880000-0x00000000048BF000-memory.dmpFilesize
252KB
-
memory/3612-1097-0x0000000007270000-0x0000000007280000-memory.dmpFilesize
64KB
-
memory/3612-1096-0x0000000007B60000-0x0000000007BC6000-memory.dmpFilesize
408KB
-
memory/3612-1094-0x0000000007270000-0x0000000007280000-memory.dmpFilesize
64KB
-
memory/3612-1093-0x00000000079D0000-0x0000000007A1B000-memory.dmpFilesize
300KB
-
memory/3612-1092-0x0000000007890000-0x00000000078CE000-memory.dmpFilesize
248KB
-
memory/3612-1091-0x0000000007240000-0x0000000007252000-memory.dmpFilesize
72KB
-
memory/3612-1090-0x0000000007780000-0x000000000788A000-memory.dmpFilesize
1.0MB
-
memory/3612-475-0x0000000007270000-0x0000000007280000-memory.dmpFilesize
64KB
-
memory/3612-199-0x0000000004880000-0x00000000048BF000-memory.dmpFilesize
252KB
-
memory/3612-213-0x0000000004880000-0x00000000048BF000-memory.dmpFilesize
252KB
-
memory/3612-211-0x0000000004880000-0x00000000048BF000-memory.dmpFilesize
252KB
-
memory/3612-209-0x0000000004880000-0x00000000048BF000-memory.dmpFilesize
252KB
-
memory/3612-207-0x0000000004880000-0x00000000048BF000-memory.dmpFilesize
252KB
-
memory/3612-205-0x0000000004880000-0x00000000048BF000-memory.dmpFilesize
252KB
-
memory/3612-178-0x0000000002C60000-0x0000000002CAB000-memory.dmpFilesize
300KB
-
memory/3612-179-0x0000000007270000-0x0000000007280000-memory.dmpFilesize
64KB
-
memory/3612-177-0x0000000004800000-0x0000000004846000-memory.dmpFilesize
280KB
-
memory/3612-181-0x0000000004880000-0x00000000048C4000-memory.dmpFilesize
272KB
-
memory/3612-187-0x0000000004880000-0x00000000048BF000-memory.dmpFilesize
252KB
-
memory/3612-182-0x0000000004880000-0x00000000048BF000-memory.dmpFilesize
252KB
-
memory/3612-183-0x0000000004880000-0x00000000048BF000-memory.dmpFilesize
252KB
-
memory/3612-185-0x0000000004880000-0x00000000048BF000-memory.dmpFilesize
252KB
-
memory/3612-189-0x0000000004880000-0x00000000048BF000-memory.dmpFilesize
252KB
-
memory/3612-180-0x0000000007270000-0x0000000007280000-memory.dmpFilesize
64KB
-
memory/3612-203-0x0000000004880000-0x00000000048BF000-memory.dmpFilesize
252KB
-
memory/3612-201-0x0000000004880000-0x00000000048BF000-memory.dmpFilesize
252KB
-
memory/3612-195-0x0000000004880000-0x00000000048BF000-memory.dmpFilesize
252KB
-
memory/3612-197-0x0000000004880000-0x00000000048BF000-memory.dmpFilesize
252KB
-
memory/4324-167-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/4324-152-0x00000000049A0000-0x00000000049B2000-memory.dmpFilesize
72KB
-
memory/4324-135-0x00000000001D0000-0x00000000001FD000-memory.dmpFilesize
180KB
-
memory/4324-136-0x00000000049A0000-0x00000000049B2000-memory.dmpFilesize
72KB
-
memory/4324-140-0x0000000007240000-0x0000000007250000-memory.dmpFilesize
64KB
-
memory/4324-172-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/4324-171-0x0000000007240000-0x0000000007250000-memory.dmpFilesize
64KB
-
memory/4324-170-0x0000000007240000-0x0000000007250000-memory.dmpFilesize
64KB
-
memory/4324-169-0x0000000007240000-0x0000000007250000-memory.dmpFilesize
64KB
-
memory/4324-138-0x00000000049A0000-0x00000000049B2000-memory.dmpFilesize
72KB
-
memory/4324-134-0x00000000049A0000-0x00000000049B8000-memory.dmpFilesize
96KB
-
memory/4324-166-0x00000000049A0000-0x00000000049B2000-memory.dmpFilesize
72KB
-
memory/4324-164-0x00000000049A0000-0x00000000049B2000-memory.dmpFilesize
72KB
-
memory/4324-158-0x00000000049A0000-0x00000000049B2000-memory.dmpFilesize
72KB
-
memory/4324-160-0x00000000049A0000-0x00000000049B2000-memory.dmpFilesize
72KB
-
memory/4324-162-0x00000000049A0000-0x00000000049B2000-memory.dmpFilesize
72KB
-
memory/4324-156-0x00000000049A0000-0x00000000049B2000-memory.dmpFilesize
72KB
-
memory/4324-154-0x00000000049A0000-0x00000000049B2000-memory.dmpFilesize
72KB
-
memory/4324-150-0x00000000049A0000-0x00000000049B2000-memory.dmpFilesize
72KB
-
memory/4324-148-0x00000000049A0000-0x00000000049B2000-memory.dmpFilesize
72KB
-
memory/4324-146-0x00000000049A0000-0x00000000049B2000-memory.dmpFilesize
72KB
-
memory/4324-144-0x00000000049A0000-0x00000000049B2000-memory.dmpFilesize
72KB
-
memory/4324-137-0x0000000007240000-0x0000000007250000-memory.dmpFilesize
64KB
-
memory/4324-141-0x0000000007240000-0x0000000007250000-memory.dmpFilesize
64KB
-
memory/4324-142-0x00000000049A0000-0x00000000049B2000-memory.dmpFilesize
72KB
-
memory/4324-133-0x0000000007250000-0x000000000774E000-memory.dmpFilesize
5.0MB
-
memory/4324-132-0x0000000004820000-0x000000000483A000-memory.dmpFilesize
104KB
-
memory/4832-1110-0x0000000000500000-0x0000000000532000-memory.dmpFilesize
200KB
-
memory/4832-1111-0x0000000004F40000-0x0000000004F8B000-memory.dmpFilesize
300KB
-
memory/4832-1112-0x00000000050D0000-0x00000000050E0000-memory.dmpFilesize
64KB
-
memory/4832-1113-0x00000000050D0000-0x00000000050E0000-memory.dmpFilesize
64KB