Analysis
-
max time kernel
60s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 08:57
Static task
static1
Behavioral task
behavioral1
Sample
8e2f75b00576804ff62a4d322bcf03e953b93956bc22cd24d6873ca886948f26.exe
Resource
win10v2004-20230220-en
General
-
Target
8e2f75b00576804ff62a4d322bcf03e953b93956bc22cd24d6873ca886948f26.exe
-
Size
683KB
-
MD5
9b6e07b461ce50726db911b46d41168b
-
SHA1
328c860fca089dcb237f388002aaced4b37e0162
-
SHA256
8e2f75b00576804ff62a4d322bcf03e953b93956bc22cd24d6873ca886948f26
-
SHA512
9d35dfbdf25b522fa3f8b26ef49c8fe7dac3c713105da4f18c5f4bdddc96939e0bb04edf9320fc775886e5f72d0941bdb15f0d516d7fadaf724f1b3160a25b55
-
SSDEEP
12288:jMr2y90ERhlodTjudsFE9BOwB6Qqkx8VQLdUr5mUL3GDGiP1:xyzRIRjcHuwB6QXPCmUL2DGC1
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Processes:
pro8249.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro8249.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro8249.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro8249.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro8249.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro8249.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro8249.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/3940-190-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3940-191-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3940-193-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3940-195-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3940-197-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3940-201-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3940-205-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3940-207-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3940-209-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3940-211-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3940-213-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3940-215-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3940-217-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3940-219-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3940-221-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3940-223-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3940-225-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3940-227-0x0000000007150000-0x000000000718F000-memory.dmp family_redline behavioral1/memory/3940-1108-0x0000000007320000-0x0000000007330000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un407682.exepro8249.exequ4300.exesi744923.exepid process 1444 un407682.exe 4208 pro8249.exe 3940 qu4300.exe 1868 si744923.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro8249.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro8249.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro8249.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
8e2f75b00576804ff62a4d322bcf03e953b93956bc22cd24d6873ca886948f26.exeun407682.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 8e2f75b00576804ff62a4d322bcf03e953b93956bc22cd24d6873ca886948f26.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 8e2f75b00576804ff62a4d322bcf03e953b93956bc22cd24d6873ca886948f26.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un407682.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un407682.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2612 4208 WerFault.exe pro8249.exe 624 3940 WerFault.exe qu4300.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro8249.exequ4300.exesi744923.exepid process 4208 pro8249.exe 4208 pro8249.exe 3940 qu4300.exe 3940 qu4300.exe 1868 si744923.exe 1868 si744923.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro8249.exequ4300.exesi744923.exedescription pid process Token: SeDebugPrivilege 4208 pro8249.exe Token: SeDebugPrivilege 3940 qu4300.exe Token: SeDebugPrivilege 1868 si744923.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
8e2f75b00576804ff62a4d322bcf03e953b93956bc22cd24d6873ca886948f26.exeun407682.exedescription pid process target process PID 448 wrote to memory of 1444 448 8e2f75b00576804ff62a4d322bcf03e953b93956bc22cd24d6873ca886948f26.exe un407682.exe PID 448 wrote to memory of 1444 448 8e2f75b00576804ff62a4d322bcf03e953b93956bc22cd24d6873ca886948f26.exe un407682.exe PID 448 wrote to memory of 1444 448 8e2f75b00576804ff62a4d322bcf03e953b93956bc22cd24d6873ca886948f26.exe un407682.exe PID 1444 wrote to memory of 4208 1444 un407682.exe pro8249.exe PID 1444 wrote to memory of 4208 1444 un407682.exe pro8249.exe PID 1444 wrote to memory of 4208 1444 un407682.exe pro8249.exe PID 1444 wrote to memory of 3940 1444 un407682.exe qu4300.exe PID 1444 wrote to memory of 3940 1444 un407682.exe qu4300.exe PID 1444 wrote to memory of 3940 1444 un407682.exe qu4300.exe PID 448 wrote to memory of 1868 448 8e2f75b00576804ff62a4d322bcf03e953b93956bc22cd24d6873ca886948f26.exe si744923.exe PID 448 wrote to memory of 1868 448 8e2f75b00576804ff62a4d322bcf03e953b93956bc22cd24d6873ca886948f26.exe si744923.exe PID 448 wrote to memory of 1868 448 8e2f75b00576804ff62a4d322bcf03e953b93956bc22cd24d6873ca886948f26.exe si744923.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e2f75b00576804ff62a4d322bcf03e953b93956bc22cd24d6873ca886948f26.exe"C:\Users\Admin\AppData\Local\Temp\8e2f75b00576804ff62a4d322bcf03e953b93956bc22cd24d6873ca886948f26.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un407682.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un407682.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8249.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8249.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4208 -s 10844⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4300.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4300.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 16444⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si744923.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si744923.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4208 -ip 42081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3940 -ip 39401⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si744923.exeFilesize
175KB
MD5810002830b632bf0c80abd96b4b022ed
SHA1b6fb8dbdba6e9d63da93cce7bf7a50d49ac89c29
SHA256d89546fffb2e195fafe28bb9dc61e0573606dc4496e64ebba157c9dee53a5358
SHA512d42c97c6e8f5476fa21780da3cbd1e6f8ad64785c78c2cc6930d046fb56f881040f3d825421a5c5303863ef0e0bed2eb2498badb747207756f40d7b8ccaf1292
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si744923.exeFilesize
175KB
MD5810002830b632bf0c80abd96b4b022ed
SHA1b6fb8dbdba6e9d63da93cce7bf7a50d49ac89c29
SHA256d89546fffb2e195fafe28bb9dc61e0573606dc4496e64ebba157c9dee53a5358
SHA512d42c97c6e8f5476fa21780da3cbd1e6f8ad64785c78c2cc6930d046fb56f881040f3d825421a5c5303863ef0e0bed2eb2498badb747207756f40d7b8ccaf1292
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un407682.exeFilesize
541KB
MD54bc16de41c2ecd55d0ca93494987c156
SHA19471cebb9a77f233055f953420f4dbee9dc5f22f
SHA2566fede4a1dd23ba038ab61a7a2bca9e53faa4dc8340a9fd3e4b4bee8e4df2cd96
SHA512d4c33e8efdb065d524f7549ebeeeeeb07a5bf87bd0dafa5acee6fe5a90dc5fee25ada21cc75886f4c313c97e1029fa5c6bcd89d48a4d0f8d95d3acf9d71a1832
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un407682.exeFilesize
541KB
MD54bc16de41c2ecd55d0ca93494987c156
SHA19471cebb9a77f233055f953420f4dbee9dc5f22f
SHA2566fede4a1dd23ba038ab61a7a2bca9e53faa4dc8340a9fd3e4b4bee8e4df2cd96
SHA512d4c33e8efdb065d524f7549ebeeeeeb07a5bf87bd0dafa5acee6fe5a90dc5fee25ada21cc75886f4c313c97e1029fa5c6bcd89d48a4d0f8d95d3acf9d71a1832
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8249.exeFilesize
321KB
MD5b9feaee8d9afbd3255a418fb83e58d24
SHA1baab5884907c795cded152496a8d6be672edf744
SHA256a34d63952164b602765df289a173b2fb44db37b4b1501d510a7713d339b3fd26
SHA5122cf6287f435d0295690e660758f82e44130cea5aa6cd8721bb20ff596792aa21807fca5e45d7e768c095a804fffc519f1712f53ac5fa8f8140657d93489a984a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8249.exeFilesize
321KB
MD5b9feaee8d9afbd3255a418fb83e58d24
SHA1baab5884907c795cded152496a8d6be672edf744
SHA256a34d63952164b602765df289a173b2fb44db37b4b1501d510a7713d339b3fd26
SHA5122cf6287f435d0295690e660758f82e44130cea5aa6cd8721bb20ff596792aa21807fca5e45d7e768c095a804fffc519f1712f53ac5fa8f8140657d93489a984a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4300.exeFilesize
380KB
MD57e542c49da25290b523dfc51db6f2c4c
SHA11876d9c687153241255980a633c8e6ebd44df849
SHA256409e35d1a08956a3b927251d1155f086fafb1bd57b66cb08b68b642a80942d49
SHA512005b0f87150ca4efcccefff17632715f0151caac87d7a898745512edcc460c869303614edadb557071fcaf9d16fa4666d5ae36b768106a711f427cb3b3a5fcb3
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4300.exeFilesize
380KB
MD57e542c49da25290b523dfc51db6f2c4c
SHA11876d9c687153241255980a633c8e6ebd44df849
SHA256409e35d1a08956a3b927251d1155f086fafb1bd57b66cb08b68b642a80942d49
SHA512005b0f87150ca4efcccefff17632715f0151caac87d7a898745512edcc460c869303614edadb557071fcaf9d16fa4666d5ae36b768106a711f427cb3b3a5fcb3
-
memory/1868-1122-0x0000000005120000-0x0000000005130000-memory.dmpFilesize
64KB
-
memory/1868-1121-0x00000000008B0000-0x00000000008E2000-memory.dmpFilesize
200KB
-
memory/3940-227-0x0000000007150000-0x000000000718F000-memory.dmpFilesize
252KB
-
memory/3940-1104-0x00000000072A0000-0x00000000072DC000-memory.dmpFilesize
240KB
-
memory/3940-1115-0x0000000007320000-0x0000000007330000-memory.dmpFilesize
64KB
-
memory/3940-1114-0x0000000009550000-0x00000000095A0000-memory.dmpFilesize
320KB
-
memory/3940-1113-0x00000000094D0000-0x0000000009546000-memory.dmpFilesize
472KB
-
memory/3940-1112-0x0000000008D10000-0x000000000923C000-memory.dmpFilesize
5.2MB
-
memory/3940-1111-0x0000000008B40000-0x0000000008D02000-memory.dmpFilesize
1.8MB
-
memory/3940-1110-0x0000000008940000-0x00000000089D2000-memory.dmpFilesize
584KB
-
memory/3940-1109-0x0000000008280000-0x00000000082E6000-memory.dmpFilesize
408KB
-
memory/3940-1108-0x0000000007320000-0x0000000007330000-memory.dmpFilesize
64KB
-
memory/3940-1107-0x0000000007320000-0x0000000007330000-memory.dmpFilesize
64KB
-
memory/3940-1106-0x0000000007320000-0x0000000007330000-memory.dmpFilesize
64KB
-
memory/3940-1103-0x0000000007280000-0x0000000007292000-memory.dmpFilesize
72KB
-
memory/3940-1102-0x0000000007320000-0x0000000007330000-memory.dmpFilesize
64KB
-
memory/3940-1101-0x0000000007F00000-0x000000000800A000-memory.dmpFilesize
1.0MB
-
memory/3940-1100-0x00000000078E0000-0x0000000007EF8000-memory.dmpFilesize
6.1MB
-
memory/3940-225-0x0000000007150000-0x000000000718F000-memory.dmpFilesize
252KB
-
memory/3940-223-0x0000000007150000-0x000000000718F000-memory.dmpFilesize
252KB
-
memory/3940-221-0x0000000007150000-0x000000000718F000-memory.dmpFilesize
252KB
-
memory/3940-219-0x0000000007150000-0x000000000718F000-memory.dmpFilesize
252KB
-
memory/3940-190-0x0000000007150000-0x000000000718F000-memory.dmpFilesize
252KB
-
memory/3940-191-0x0000000007150000-0x000000000718F000-memory.dmpFilesize
252KB
-
memory/3940-193-0x0000000007150000-0x000000000718F000-memory.dmpFilesize
252KB
-
memory/3940-195-0x0000000007150000-0x000000000718F000-memory.dmpFilesize
252KB
-
memory/3940-197-0x0000000007150000-0x000000000718F000-memory.dmpFilesize
252KB
-
memory/3940-200-0x0000000007320000-0x0000000007330000-memory.dmpFilesize
64KB
-
memory/3940-199-0x0000000002B90000-0x0000000002BDB000-memory.dmpFilesize
300KB
-
memory/3940-201-0x0000000007150000-0x000000000718F000-memory.dmpFilesize
252KB
-
memory/3940-202-0x0000000007320000-0x0000000007330000-memory.dmpFilesize
64KB
-
memory/3940-205-0x0000000007150000-0x000000000718F000-memory.dmpFilesize
252KB
-
memory/3940-207-0x0000000007150000-0x000000000718F000-memory.dmpFilesize
252KB
-
memory/3940-204-0x0000000007320000-0x0000000007330000-memory.dmpFilesize
64KB
-
memory/3940-209-0x0000000007150000-0x000000000718F000-memory.dmpFilesize
252KB
-
memory/3940-211-0x0000000007150000-0x000000000718F000-memory.dmpFilesize
252KB
-
memory/3940-213-0x0000000007150000-0x000000000718F000-memory.dmpFilesize
252KB
-
memory/3940-215-0x0000000007150000-0x000000000718F000-memory.dmpFilesize
252KB
-
memory/3940-217-0x0000000007150000-0x000000000718F000-memory.dmpFilesize
252KB
-
memory/4208-178-0x0000000004960000-0x0000000004970000-memory.dmpFilesize
64KB
-
memory/4208-150-0x0000000004AF0000-0x0000000004B02000-memory.dmpFilesize
72KB
-
memory/4208-185-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/4208-184-0x0000000004960000-0x0000000004970000-memory.dmpFilesize
64KB
-
memory/4208-153-0x0000000004AF0000-0x0000000004B02000-memory.dmpFilesize
72KB
-
memory/4208-183-0x0000000004960000-0x0000000004970000-memory.dmpFilesize
64KB
-
memory/4208-182-0x0000000004960000-0x0000000004970000-memory.dmpFilesize
64KB
-
memory/4208-180-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/4208-179-0x0000000004AF0000-0x0000000004B02000-memory.dmpFilesize
72KB
-
memory/4208-159-0x0000000004AF0000-0x0000000004B02000-memory.dmpFilesize
72KB
-
memory/4208-148-0x0000000002C50000-0x0000000002C7D000-memory.dmpFilesize
180KB
-
memory/4208-157-0x0000000004AF0000-0x0000000004B02000-memory.dmpFilesize
72KB
-
memory/4208-171-0x0000000004AF0000-0x0000000004B02000-memory.dmpFilesize
72KB
-
memory/4208-173-0x0000000004AF0000-0x0000000004B02000-memory.dmpFilesize
72KB
-
memory/4208-155-0x0000000004AF0000-0x0000000004B02000-memory.dmpFilesize
72KB
-
memory/4208-169-0x0000000004AF0000-0x0000000004B02000-memory.dmpFilesize
72KB
-
memory/4208-167-0x0000000004AF0000-0x0000000004B02000-memory.dmpFilesize
72KB
-
memory/4208-165-0x0000000004AF0000-0x0000000004B02000-memory.dmpFilesize
72KB
-
memory/4208-163-0x0000000004AF0000-0x0000000004B02000-memory.dmpFilesize
72KB
-
memory/4208-161-0x0000000004AF0000-0x0000000004B02000-memory.dmpFilesize
72KB
-
memory/4208-151-0x0000000004AF0000-0x0000000004B02000-memory.dmpFilesize
72KB
-
memory/4208-176-0x0000000004960000-0x0000000004970000-memory.dmpFilesize
64KB
-
memory/4208-149-0x0000000007130000-0x00000000076D4000-memory.dmpFilesize
5.6MB
-
memory/4208-175-0x0000000004AF0000-0x0000000004B02000-memory.dmpFilesize
72KB