Analysis
-
max time kernel
93s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 08:41
Static task
static1
Behavioral task
behavioral1
Sample
75e49d45230b7149f390f398488320270c8dbb4b74299170c58d93f5a641ddac.exe
Resource
win10v2004-20230221-en
General
-
Target
75e49d45230b7149f390f398488320270c8dbb4b74299170c58d93f5a641ddac.exe
-
Size
684KB
-
MD5
85d070014776942fc98269184aa908ea
-
SHA1
e5fa5025c624314c9faa4a3c612350f2b0262969
-
SHA256
75e49d45230b7149f390f398488320270c8dbb4b74299170c58d93f5a641ddac
-
SHA512
f49720eb441d5aa5f6e94972ff8c59bcfa1587877ca8e967f8bf14ed2c18d0a151187361e3415ca1c306c5854d88fa99e5e4b6d926f639b7e40aad8294837073
-
SSDEEP
12288:xMrOy90KHbuIruRlqqOGb6yjC4xR525nLMMSUlkmzL3eL:DybH/y2GtjCE525LcHmzLOL
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Processes:
pro1493.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro1493.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro1493.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro1493.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro1493.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro1493.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro1493.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/5020-191-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/5020-192-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/5020-194-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/5020-196-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/5020-198-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/5020-200-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/5020-202-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/5020-204-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/5020-206-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/5020-210-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/5020-208-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/5020-212-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/5020-214-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/5020-216-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/5020-218-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/5020-220-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/5020-222-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/5020-224-0x0000000007160000-0x000000000719F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un380516.exepro1493.exequ9801.exesi504041.exepid process 4784 un380516.exe 936 pro1493.exe 5020 qu9801.exe 936 si504041.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro1493.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro1493.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro1493.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
75e49d45230b7149f390f398488320270c8dbb4b74299170c58d93f5a641ddac.exeun380516.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 75e49d45230b7149f390f398488320270c8dbb4b74299170c58d93f5a641ddac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 75e49d45230b7149f390f398488320270c8dbb4b74299170c58d93f5a641ddac.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un380516.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un380516.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 5100 936 WerFault.exe pro1493.exe 5004 5020 WerFault.exe qu9801.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro1493.exequ9801.exesi504041.exepid process 936 pro1493.exe 936 pro1493.exe 5020 qu9801.exe 5020 qu9801.exe 936 si504041.exe 936 si504041.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro1493.exequ9801.exesi504041.exedescription pid process Token: SeDebugPrivilege 936 pro1493.exe Token: SeDebugPrivilege 5020 qu9801.exe Token: SeDebugPrivilege 936 si504041.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
75e49d45230b7149f390f398488320270c8dbb4b74299170c58d93f5a641ddac.exeun380516.exedescription pid process target process PID 2136 wrote to memory of 4784 2136 75e49d45230b7149f390f398488320270c8dbb4b74299170c58d93f5a641ddac.exe un380516.exe PID 2136 wrote to memory of 4784 2136 75e49d45230b7149f390f398488320270c8dbb4b74299170c58d93f5a641ddac.exe un380516.exe PID 2136 wrote to memory of 4784 2136 75e49d45230b7149f390f398488320270c8dbb4b74299170c58d93f5a641ddac.exe un380516.exe PID 4784 wrote to memory of 936 4784 un380516.exe pro1493.exe PID 4784 wrote to memory of 936 4784 un380516.exe pro1493.exe PID 4784 wrote to memory of 936 4784 un380516.exe pro1493.exe PID 4784 wrote to memory of 5020 4784 un380516.exe qu9801.exe PID 4784 wrote to memory of 5020 4784 un380516.exe qu9801.exe PID 4784 wrote to memory of 5020 4784 un380516.exe qu9801.exe PID 2136 wrote to memory of 936 2136 75e49d45230b7149f390f398488320270c8dbb4b74299170c58d93f5a641ddac.exe si504041.exe PID 2136 wrote to memory of 936 2136 75e49d45230b7149f390f398488320270c8dbb4b74299170c58d93f5a641ddac.exe si504041.exe PID 2136 wrote to memory of 936 2136 75e49d45230b7149f390f398488320270c8dbb4b74299170c58d93f5a641ddac.exe si504041.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\75e49d45230b7149f390f398488320270c8dbb4b74299170c58d93f5a641ddac.exe"C:\Users\Admin\AppData\Local\Temp\75e49d45230b7149f390f398488320270c8dbb4b74299170c58d93f5a641ddac.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un380516.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un380516.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1493.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1493.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 10804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9801.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9801.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 15684⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si504041.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si504041.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 936 -ip 9361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5020 -ip 50201⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si504041.exeFilesize
175KB
MD5c5c7a9be668931d7ba9c23efb1d02acd
SHA1754e7dcb676d55f1ef538672464b2d0a37b2c2e5
SHA2568f8c3e564e0a20c4b41a6dd8dd5d652550dfd5b3e7668b4fd767a4c2c3d798bc
SHA512523efbc3b4ec05e23c9c441963555fedd7fa295795346ff53ee04a3010f364649c58f0c9b266d1870c19661df5fc67f0456b86677948cfb6973d7ed82223c15a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si504041.exeFilesize
175KB
MD5c5c7a9be668931d7ba9c23efb1d02acd
SHA1754e7dcb676d55f1ef538672464b2d0a37b2c2e5
SHA2568f8c3e564e0a20c4b41a6dd8dd5d652550dfd5b3e7668b4fd767a4c2c3d798bc
SHA512523efbc3b4ec05e23c9c441963555fedd7fa295795346ff53ee04a3010f364649c58f0c9b266d1870c19661df5fc67f0456b86677948cfb6973d7ed82223c15a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un380516.exeFilesize
542KB
MD57d9245bfac0d41ef7cebdf6a249f59e1
SHA15898030f62ec383f963dfa1c5ca3241ab9b92d7b
SHA256e619748151dc257a5a0399b56061d6637272169d633fd164ccd9ac075fa903e6
SHA5122669ae67e3e50240af53980e558e27f74337674bcfca8f1333082883f5a99634d78fa89f6c37ed0fa12520854ff382a7e5c403bfd0a5dfb75fcf7310edb4cb69
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un380516.exeFilesize
542KB
MD57d9245bfac0d41ef7cebdf6a249f59e1
SHA15898030f62ec383f963dfa1c5ca3241ab9b92d7b
SHA256e619748151dc257a5a0399b56061d6637272169d633fd164ccd9ac075fa903e6
SHA5122669ae67e3e50240af53980e558e27f74337674bcfca8f1333082883f5a99634d78fa89f6c37ed0fa12520854ff382a7e5c403bfd0a5dfb75fcf7310edb4cb69
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1493.exeFilesize
321KB
MD5c07a36eea4cb8edb9497f5d71f5ea5b5
SHA18af24ebe6a1b54fa0a42a65278015cc2a1ef9fb3
SHA256f92f83387020f820c55d9f18da82d0d21b22acc3f1333b7c33f03cd675c5d6c0
SHA512060519b4edf161d32e35aa5bf6aaf67ddafec2e4be73acf4f3cb7e5b7af671b28b101592d37cf4e561a8b412e578f84308f0128ec23de685b6a5529f4db514b7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1493.exeFilesize
321KB
MD5c07a36eea4cb8edb9497f5d71f5ea5b5
SHA18af24ebe6a1b54fa0a42a65278015cc2a1ef9fb3
SHA256f92f83387020f820c55d9f18da82d0d21b22acc3f1333b7c33f03cd675c5d6c0
SHA512060519b4edf161d32e35aa5bf6aaf67ddafec2e4be73acf4f3cb7e5b7af671b28b101592d37cf4e561a8b412e578f84308f0128ec23de685b6a5529f4db514b7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9801.exeFilesize
380KB
MD595ce0c61e84f883fce55a7eecee68c67
SHA1520c4b4344042d52d2dc2c76ccea9b50080538e7
SHA256fb0aac5c41d1469ad8a90dd837cefa0999752a3687ac96152a822c72def19064
SHA512bf19fd74d2f066b2a4f50758055eecadc6ce050697c3497cbdd325cc3c5d4cc633faaf9b40a3900eb89a61e25fa0e141d31e070f1ac2944afc3499c58a22bce3
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9801.exeFilesize
380KB
MD595ce0c61e84f883fce55a7eecee68c67
SHA1520c4b4344042d52d2dc2c76ccea9b50080538e7
SHA256fb0aac5c41d1469ad8a90dd837cefa0999752a3687ac96152a822c72def19064
SHA512bf19fd74d2f066b2a4f50758055eecadc6ce050697c3497cbdd325cc3c5d4cc633faaf9b40a3900eb89a61e25fa0e141d31e070f1ac2944afc3499c58a22bce3
-
memory/936-1115-0x0000000000B00000-0x0000000000B32000-memory.dmpFilesize
200KB
-
memory/936-149-0x00000000049D0000-0x00000000049E0000-memory.dmpFilesize
64KB
-
memory/936-150-0x00000000049D0000-0x00000000049E0000-memory.dmpFilesize
64KB
-
memory/936-151-0x0000000007110000-0x00000000076B4000-memory.dmpFilesize
5.6MB
-
memory/936-152-0x00000000049D0000-0x00000000049E0000-memory.dmpFilesize
64KB
-
memory/936-153-0x0000000004C00000-0x0000000004C12000-memory.dmpFilesize
72KB
-
memory/936-154-0x0000000004C00000-0x0000000004C12000-memory.dmpFilesize
72KB
-
memory/936-156-0x0000000004C00000-0x0000000004C12000-memory.dmpFilesize
72KB
-
memory/936-158-0x0000000004C00000-0x0000000004C12000-memory.dmpFilesize
72KB
-
memory/936-160-0x0000000004C00000-0x0000000004C12000-memory.dmpFilesize
72KB
-
memory/936-162-0x0000000004C00000-0x0000000004C12000-memory.dmpFilesize
72KB
-
memory/936-166-0x0000000004C00000-0x0000000004C12000-memory.dmpFilesize
72KB
-
memory/936-164-0x0000000004C00000-0x0000000004C12000-memory.dmpFilesize
72KB
-
memory/936-168-0x0000000004C00000-0x0000000004C12000-memory.dmpFilesize
72KB
-
memory/936-170-0x0000000004C00000-0x0000000004C12000-memory.dmpFilesize
72KB
-
memory/936-172-0x0000000004C00000-0x0000000004C12000-memory.dmpFilesize
72KB
-
memory/936-174-0x0000000004C00000-0x0000000004C12000-memory.dmpFilesize
72KB
-
memory/936-176-0x0000000004C00000-0x0000000004C12000-memory.dmpFilesize
72KB
-
memory/936-178-0x0000000004C00000-0x0000000004C12000-memory.dmpFilesize
72KB
-
memory/936-180-0x0000000004C00000-0x0000000004C12000-memory.dmpFilesize
72KB
-
memory/936-181-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/936-182-0x00000000049D0000-0x00000000049E0000-memory.dmpFilesize
64KB
-
memory/936-183-0x00000000049D0000-0x00000000049E0000-memory.dmpFilesize
64KB
-
memory/936-185-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/936-148-0x0000000002B80000-0x0000000002BAD000-memory.dmpFilesize
180KB
-
memory/936-1117-0x0000000005380000-0x0000000005390000-memory.dmpFilesize
64KB
-
memory/936-1116-0x0000000005380000-0x0000000005390000-memory.dmpFilesize
64KB
-
memory/5020-196-0x0000000007160000-0x000000000719F000-memory.dmpFilesize
252KB
-
memory/5020-222-0x0000000007160000-0x000000000719F000-memory.dmpFilesize
252KB
-
memory/5020-192-0x0000000007160000-0x000000000719F000-memory.dmpFilesize
252KB
-
memory/5020-198-0x0000000007160000-0x000000000719F000-memory.dmpFilesize
252KB
-
memory/5020-200-0x0000000007160000-0x000000000719F000-memory.dmpFilesize
252KB
-
memory/5020-202-0x0000000007160000-0x000000000719F000-memory.dmpFilesize
252KB
-
memory/5020-204-0x0000000007160000-0x000000000719F000-memory.dmpFilesize
252KB
-
memory/5020-206-0x0000000007160000-0x000000000719F000-memory.dmpFilesize
252KB
-
memory/5020-210-0x0000000007160000-0x000000000719F000-memory.dmpFilesize
252KB
-
memory/5020-208-0x0000000007160000-0x000000000719F000-memory.dmpFilesize
252KB
-
memory/5020-212-0x0000000007160000-0x000000000719F000-memory.dmpFilesize
252KB
-
memory/5020-214-0x0000000007160000-0x000000000719F000-memory.dmpFilesize
252KB
-
memory/5020-216-0x0000000007160000-0x000000000719F000-memory.dmpFilesize
252KB
-
memory/5020-218-0x0000000007160000-0x000000000719F000-memory.dmpFilesize
252KB
-
memory/5020-220-0x0000000007160000-0x000000000719F000-memory.dmpFilesize
252KB
-
memory/5020-194-0x0000000007160000-0x000000000719F000-memory.dmpFilesize
252KB
-
memory/5020-224-0x0000000007160000-0x000000000719F000-memory.dmpFilesize
252KB
-
memory/5020-1097-0x0000000007910000-0x0000000007F28000-memory.dmpFilesize
6.1MB
-
memory/5020-1098-0x0000000007F30000-0x000000000803A000-memory.dmpFilesize
1.0MB
-
memory/5020-1099-0x0000000007350000-0x0000000007360000-memory.dmpFilesize
64KB
-
memory/5020-1100-0x0000000007280000-0x0000000007292000-memory.dmpFilesize
72KB
-
memory/5020-1101-0x00000000072A0000-0x00000000072DC000-memory.dmpFilesize
240KB
-
memory/5020-1103-0x0000000008280000-0x0000000008312000-memory.dmpFilesize
584KB
-
memory/5020-1104-0x0000000008320000-0x0000000008386000-memory.dmpFilesize
408KB
-
memory/5020-1105-0x0000000007350000-0x0000000007360000-memory.dmpFilesize
64KB
-
memory/5020-1106-0x0000000009E10000-0x0000000009FD2000-memory.dmpFilesize
1.8MB
-
memory/5020-191-0x0000000007160000-0x000000000719F000-memory.dmpFilesize
252KB
-
memory/5020-190-0x0000000002B90000-0x0000000002BDB000-memory.dmpFilesize
300KB
-
memory/5020-1107-0x0000000009FE0000-0x000000000A50C000-memory.dmpFilesize
5.2MB
-
memory/5020-1108-0x0000000006C90000-0x0000000006D06000-memory.dmpFilesize
472KB
-
memory/5020-1109-0x000000000A630000-0x000000000A680000-memory.dmpFilesize
320KB