Analysis
-
max time kernel
87s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 08:53
Static task
static1
Behavioral task
behavioral1
Sample
17cd5f8e8a11306b93d6ae3a188fa9f02679bdd8cd0b8c4b1c0e3ff39f07359f.exe
Resource
win10v2004-20230220-en
General
-
Target
17cd5f8e8a11306b93d6ae3a188fa9f02679bdd8cd0b8c4b1c0e3ff39f07359f.exe
-
Size
684KB
-
MD5
fae204a8b57f4466ef552296f1c19be2
-
SHA1
f404c5d445919e10cec6af71947fe823c56d1e0d
-
SHA256
17cd5f8e8a11306b93d6ae3a188fa9f02679bdd8cd0b8c4b1c0e3ff39f07359f
-
SHA512
bac91b5c9b9fe941de4d489f483d4798082fea0a4550d5eac2c0d771a1dc7132e6f36582aceadbd6ec95f79346ef02cb2d424a6c4c150500bd5d8435a65e0a5c
-
SSDEEP
12288:0MrGy90An6GDjDrCTi33DBDVftxmeUdjqESDetUV0c2O0MGqWUJimWL3sV828c:Syx7jCT4B5F+wESeaV0c2O0MGvZmWL8J
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Processes:
pro9957.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro9957.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro9957.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro9957.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro9957.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro9957.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro9957.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/388-190-0x0000000004BF0000-0x0000000004C2F000-memory.dmp family_redline behavioral1/memory/388-191-0x0000000004BF0000-0x0000000004C2F000-memory.dmp family_redline behavioral1/memory/388-193-0x0000000004BF0000-0x0000000004C2F000-memory.dmp family_redline behavioral1/memory/388-195-0x0000000004BF0000-0x0000000004C2F000-memory.dmp family_redline behavioral1/memory/388-197-0x0000000004BF0000-0x0000000004C2F000-memory.dmp family_redline behavioral1/memory/388-199-0x0000000004BF0000-0x0000000004C2F000-memory.dmp family_redline behavioral1/memory/388-201-0x0000000004BF0000-0x0000000004C2F000-memory.dmp family_redline behavioral1/memory/388-203-0x0000000004BF0000-0x0000000004C2F000-memory.dmp family_redline behavioral1/memory/388-205-0x0000000004BF0000-0x0000000004C2F000-memory.dmp family_redline behavioral1/memory/388-207-0x0000000004BF0000-0x0000000004C2F000-memory.dmp family_redline behavioral1/memory/388-212-0x0000000004BF0000-0x0000000004C2F000-memory.dmp family_redline behavioral1/memory/388-214-0x0000000004BF0000-0x0000000004C2F000-memory.dmp family_redline behavioral1/memory/388-216-0x0000000004BF0000-0x0000000004C2F000-memory.dmp family_redline behavioral1/memory/388-220-0x0000000004BF0000-0x0000000004C2F000-memory.dmp family_redline behavioral1/memory/388-218-0x0000000004BF0000-0x0000000004C2F000-memory.dmp family_redline behavioral1/memory/388-222-0x0000000004BF0000-0x0000000004C2F000-memory.dmp family_redline behavioral1/memory/388-226-0x0000000004BF0000-0x0000000004C2F000-memory.dmp family_redline behavioral1/memory/388-224-0x0000000004BF0000-0x0000000004C2F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un173551.exepro9957.exequ6262.exesi695970.exepid process 4624 un173551.exe 1948 pro9957.exe 388 qu6262.exe 3100 si695970.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro9957.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro9957.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro9957.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un173551.exe17cd5f8e8a11306b93d6ae3a188fa9f02679bdd8cd0b8c4b1c0e3ff39f07359f.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un173551.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 17cd5f8e8a11306b93d6ae3a188fa9f02679bdd8cd0b8c4b1c0e3ff39f07359f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 17cd5f8e8a11306b93d6ae3a188fa9f02679bdd8cd0b8c4b1c0e3ff39f07359f.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un173551.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4476 1948 WerFault.exe pro9957.exe 3572 388 WerFault.exe qu6262.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro9957.exequ6262.exesi695970.exepid process 1948 pro9957.exe 1948 pro9957.exe 388 qu6262.exe 388 qu6262.exe 3100 si695970.exe 3100 si695970.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro9957.exequ6262.exesi695970.exedescription pid process Token: SeDebugPrivilege 1948 pro9957.exe Token: SeDebugPrivilege 388 qu6262.exe Token: SeDebugPrivilege 3100 si695970.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
17cd5f8e8a11306b93d6ae3a188fa9f02679bdd8cd0b8c4b1c0e3ff39f07359f.exeun173551.exedescription pid process target process PID 1444 wrote to memory of 4624 1444 17cd5f8e8a11306b93d6ae3a188fa9f02679bdd8cd0b8c4b1c0e3ff39f07359f.exe un173551.exe PID 1444 wrote to memory of 4624 1444 17cd5f8e8a11306b93d6ae3a188fa9f02679bdd8cd0b8c4b1c0e3ff39f07359f.exe un173551.exe PID 1444 wrote to memory of 4624 1444 17cd5f8e8a11306b93d6ae3a188fa9f02679bdd8cd0b8c4b1c0e3ff39f07359f.exe un173551.exe PID 4624 wrote to memory of 1948 4624 un173551.exe pro9957.exe PID 4624 wrote to memory of 1948 4624 un173551.exe pro9957.exe PID 4624 wrote to memory of 1948 4624 un173551.exe pro9957.exe PID 4624 wrote to memory of 388 4624 un173551.exe qu6262.exe PID 4624 wrote to memory of 388 4624 un173551.exe qu6262.exe PID 4624 wrote to memory of 388 4624 un173551.exe qu6262.exe PID 1444 wrote to memory of 3100 1444 17cd5f8e8a11306b93d6ae3a188fa9f02679bdd8cd0b8c4b1c0e3ff39f07359f.exe si695970.exe PID 1444 wrote to memory of 3100 1444 17cd5f8e8a11306b93d6ae3a188fa9f02679bdd8cd0b8c4b1c0e3ff39f07359f.exe si695970.exe PID 1444 wrote to memory of 3100 1444 17cd5f8e8a11306b93d6ae3a188fa9f02679bdd8cd0b8c4b1c0e3ff39f07359f.exe si695970.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\17cd5f8e8a11306b93d6ae3a188fa9f02679bdd8cd0b8c4b1c0e3ff39f07359f.exe"C:\Users\Admin\AppData\Local\Temp\17cd5f8e8a11306b93d6ae3a188fa9f02679bdd8cd0b8c4b1c0e3ff39f07359f.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un173551.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un173551.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9957.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9957.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 10844⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6262.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6262.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 388 -s 16964⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si695970.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si695970.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1948 -ip 19481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 388 -ip 3881⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si695970.exeFilesize
175KB
MD54e6f08c3563cc3023a35678ecae26c93
SHA1559aaa5bb066911bb3a8c1edba97d9930bc1c97f
SHA25634df4457208bea639d2c84202e0b5924b3ef6d8c14af28b04329569d9fcab198
SHA5121be6540e0e5acabd6ab5883cda4277924711c322ed461d57c4adac363f0431918ce470dd822f78fa6ea34ac24d0d0621c7d6114cb12e9403d6ed00b4032389df
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si695970.exeFilesize
175KB
MD54e6f08c3563cc3023a35678ecae26c93
SHA1559aaa5bb066911bb3a8c1edba97d9930bc1c97f
SHA25634df4457208bea639d2c84202e0b5924b3ef6d8c14af28b04329569d9fcab198
SHA5121be6540e0e5acabd6ab5883cda4277924711c322ed461d57c4adac363f0431918ce470dd822f78fa6ea34ac24d0d0621c7d6114cb12e9403d6ed00b4032389df
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un173551.exeFilesize
542KB
MD5f6206f6fb64f1392e1a2e95030b4bc5d
SHA1126a615ee9e975f0a8a42b8b26c6a0b499d01c48
SHA256b7c1b21f60f511453774d286b8ad17f98a711eea96aee8c2b3b513d3d71d5a5b
SHA512d11e36d7fc0f40f67eb18dcfb056e0537f784991bbff663587540f8d462a48d7a232c07f332b092578cfc8555ec8754cfb1181d449cc32042ce15e8bc4cfe487
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un173551.exeFilesize
542KB
MD5f6206f6fb64f1392e1a2e95030b4bc5d
SHA1126a615ee9e975f0a8a42b8b26c6a0b499d01c48
SHA256b7c1b21f60f511453774d286b8ad17f98a711eea96aee8c2b3b513d3d71d5a5b
SHA512d11e36d7fc0f40f67eb18dcfb056e0537f784991bbff663587540f8d462a48d7a232c07f332b092578cfc8555ec8754cfb1181d449cc32042ce15e8bc4cfe487
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9957.exeFilesize
321KB
MD5c801a0194b130b6393ac2afe5ac9bce4
SHA189a0a93306d443ca2b82297cb9ec6a3d4499fdbe
SHA256e60a45a3650ec8b705c6ceb5c29f51af82bca5fb46534b5965e87db776fcafe4
SHA5120e6b4125475a520f43046c8553f8382877cf0831136e76e640dc857cc196d608c5ac1274e8d850928af3def7b320e5fdcd7efc946b125d72ebb9201a73fef18c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9957.exeFilesize
321KB
MD5c801a0194b130b6393ac2afe5ac9bce4
SHA189a0a93306d443ca2b82297cb9ec6a3d4499fdbe
SHA256e60a45a3650ec8b705c6ceb5c29f51af82bca5fb46534b5965e87db776fcafe4
SHA5120e6b4125475a520f43046c8553f8382877cf0831136e76e640dc857cc196d608c5ac1274e8d850928af3def7b320e5fdcd7efc946b125d72ebb9201a73fef18c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6262.exeFilesize
380KB
MD596620fe9d5bbc109683543ee4a4596e0
SHA17f5167090539bb7040c8011f1266288f52e92ec4
SHA256313c4008e959799a6a1763fbebb302bf3d0d51386bf7006e98927fbadbb85ae3
SHA5126065bcefde1b0de152aa5f6831d86420c7012fb349f675fa9ac93690a80f7459a58206ed30e6bc33179a35340e18c3343c81001d5b58d84cdc3ca0837b77771b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6262.exeFilesize
380KB
MD596620fe9d5bbc109683543ee4a4596e0
SHA17f5167090539bb7040c8011f1266288f52e92ec4
SHA256313c4008e959799a6a1763fbebb302bf3d0d51386bf7006e98927fbadbb85ae3
SHA5126065bcefde1b0de152aa5f6831d86420c7012fb349f675fa9ac93690a80f7459a58206ed30e6bc33179a35340e18c3343c81001d5b58d84cdc3ca0837b77771b
-
memory/388-1099-0x00000000078D0000-0x0000000007EE8000-memory.dmpFilesize
6.1MB
-
memory/388-1102-0x00000000080D0000-0x000000000810C000-memory.dmpFilesize
240KB
-
memory/388-1114-0x00000000090B0000-0x00000000095DC000-memory.dmpFilesize
5.2MB
-
memory/388-1113-0x0000000008EE0000-0x00000000090A2000-memory.dmpFilesize
1.8MB
-
memory/388-1112-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/388-1111-0x0000000008E50000-0x0000000008EA0000-memory.dmpFilesize
320KB
-
memory/388-1110-0x0000000008DC0000-0x0000000008E36000-memory.dmpFilesize
472KB
-
memory/388-1109-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/388-1108-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/388-1107-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/388-1106-0x0000000008A70000-0x0000000008B02000-memory.dmpFilesize
584KB
-
memory/388-1105-0x00000000083C0000-0x0000000008426000-memory.dmpFilesize
408KB
-
memory/388-1103-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/388-1101-0x00000000080B0000-0x00000000080C2000-memory.dmpFilesize
72KB
-
memory/388-1100-0x0000000007F70000-0x000000000807A000-memory.dmpFilesize
1.0MB
-
memory/388-224-0x0000000004BF0000-0x0000000004C2F000-memory.dmpFilesize
252KB
-
memory/388-226-0x0000000004BF0000-0x0000000004C2F000-memory.dmpFilesize
252KB
-
memory/388-222-0x0000000004BF0000-0x0000000004C2F000-memory.dmpFilesize
252KB
-
memory/388-218-0x0000000004BF0000-0x0000000004C2F000-memory.dmpFilesize
252KB
-
memory/388-220-0x0000000004BF0000-0x0000000004C2F000-memory.dmpFilesize
252KB
-
memory/388-216-0x0000000004BF0000-0x0000000004C2F000-memory.dmpFilesize
252KB
-
memory/388-214-0x0000000004BF0000-0x0000000004C2F000-memory.dmpFilesize
252KB
-
memory/388-190-0x0000000004BF0000-0x0000000004C2F000-memory.dmpFilesize
252KB
-
memory/388-191-0x0000000004BF0000-0x0000000004C2F000-memory.dmpFilesize
252KB
-
memory/388-193-0x0000000004BF0000-0x0000000004C2F000-memory.dmpFilesize
252KB
-
memory/388-195-0x0000000004BF0000-0x0000000004C2F000-memory.dmpFilesize
252KB
-
memory/388-197-0x0000000004BF0000-0x0000000004C2F000-memory.dmpFilesize
252KB
-
memory/388-199-0x0000000004BF0000-0x0000000004C2F000-memory.dmpFilesize
252KB
-
memory/388-201-0x0000000004BF0000-0x0000000004C2F000-memory.dmpFilesize
252KB
-
memory/388-203-0x0000000004BF0000-0x0000000004C2F000-memory.dmpFilesize
252KB
-
memory/388-205-0x0000000004BF0000-0x0000000004C2F000-memory.dmpFilesize
252KB
-
memory/388-208-0x0000000002C90000-0x0000000002CDB000-memory.dmpFilesize
300KB
-
memory/388-209-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/388-211-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/388-207-0x0000000004BF0000-0x0000000004C2F000-memory.dmpFilesize
252KB
-
memory/388-212-0x0000000004BF0000-0x0000000004C2F000-memory.dmpFilesize
252KB
-
memory/1948-176-0x0000000007440000-0x0000000007450000-memory.dmpFilesize
64KB
-
memory/1948-185-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/1948-173-0x0000000004AB0000-0x0000000004AC2000-memory.dmpFilesize
72KB
-
memory/1948-171-0x0000000004AB0000-0x0000000004AC2000-memory.dmpFilesize
72KB
-
memory/1948-183-0x0000000007440000-0x0000000007450000-memory.dmpFilesize
64KB
-
memory/1948-182-0x0000000007440000-0x0000000007450000-memory.dmpFilesize
64KB
-
memory/1948-180-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/1948-150-0x0000000004AB0000-0x0000000004AC2000-memory.dmpFilesize
72KB
-
memory/1948-178-0x0000000007440000-0x0000000007450000-memory.dmpFilesize
64KB
-
memory/1948-179-0x0000000004AB0000-0x0000000004AC2000-memory.dmpFilesize
72KB
-
memory/1948-155-0x0000000004AB0000-0x0000000004AC2000-memory.dmpFilesize
72KB
-
memory/1948-175-0x0000000004AB0000-0x0000000004AC2000-memory.dmpFilesize
72KB
-
memory/1948-151-0x0000000004AB0000-0x0000000004AC2000-memory.dmpFilesize
72KB
-
memory/1948-153-0x0000000004AB0000-0x0000000004AC2000-memory.dmpFilesize
72KB
-
memory/1948-184-0x0000000007440000-0x0000000007450000-memory.dmpFilesize
64KB
-
memory/1948-169-0x0000000004AB0000-0x0000000004AC2000-memory.dmpFilesize
72KB
-
memory/1948-167-0x0000000004AB0000-0x0000000004AC2000-memory.dmpFilesize
72KB
-
memory/1948-165-0x0000000004AB0000-0x0000000004AC2000-memory.dmpFilesize
72KB
-
memory/1948-161-0x0000000004AB0000-0x0000000004AC2000-memory.dmpFilesize
72KB
-
memory/1948-163-0x0000000004AB0000-0x0000000004AC2000-memory.dmpFilesize
72KB
-
memory/1948-159-0x0000000004AB0000-0x0000000004AC2000-memory.dmpFilesize
72KB
-
memory/1948-157-0x0000000004AB0000-0x0000000004AC2000-memory.dmpFilesize
72KB
-
memory/1948-149-0x0000000007450000-0x00000000079F4000-memory.dmpFilesize
5.6MB
-
memory/1948-148-0x0000000002C70000-0x0000000002C9D000-memory.dmpFilesize
180KB
-
memory/3100-1120-0x0000000000570000-0x00000000005A2000-memory.dmpFilesize
200KB
-
memory/3100-1121-0x0000000005010000-0x0000000005020000-memory.dmpFilesize
64KB