Analysis
-
max time kernel
99s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 10:12
Static task
static1
Behavioral task
behavioral1
Sample
521d18a9fde485eb93c3352f44d6576c072f23560481e0d25f3ef89492ec4040.exe
Resource
win10v2004-20230220-en
General
-
Target
521d18a9fde485eb93c3352f44d6576c072f23560481e0d25f3ef89492ec4040.exe
-
Size
699KB
-
MD5
a4644fc5c5081d6c0466a2375557a375
-
SHA1
a74fed41b218d996e5622336b0fc12cd7cbedcba
-
SHA256
521d18a9fde485eb93c3352f44d6576c072f23560481e0d25f3ef89492ec4040
-
SHA512
0ecc4bfebda2809abfc46de8d28bb5f40a84b755526e5219d319c9c34b7712b8667f3ee37eb9188ede0f0c4cfe52a692dd06baf790f4c7dfbe7f4931be3a30f8
-
SSDEEP
12288:WMrvy90JBvE/4/QcpDbFc5eLhEuUnmijg/Qm6mBGjeyxv9gLSd4dIvoT:RybMLpDbFMeLmfs/jpGjxv9a7deW
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
muse
176.113.115.145:4125
-
auth_value
b91988a63a24940038d9262827a5320c
Signatures
-
Processes:
pro7765.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro7765.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro7765.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro7765.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro7765.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro7765.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro7765.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/1832-192-0x0000000007700000-0x000000000773F000-memory.dmp family_redline behavioral1/memory/1832-193-0x0000000007700000-0x000000000773F000-memory.dmp family_redline behavioral1/memory/1832-195-0x0000000007700000-0x000000000773F000-memory.dmp family_redline behavioral1/memory/1832-197-0x0000000007700000-0x000000000773F000-memory.dmp family_redline behavioral1/memory/1832-199-0x0000000007700000-0x000000000773F000-memory.dmp family_redline behavioral1/memory/1832-203-0x0000000007700000-0x000000000773F000-memory.dmp family_redline behavioral1/memory/1832-201-0x0000000007700000-0x000000000773F000-memory.dmp family_redline behavioral1/memory/1832-206-0x0000000007700000-0x000000000773F000-memory.dmp family_redline behavioral1/memory/1832-209-0x0000000004880000-0x0000000004890000-memory.dmp family_redline behavioral1/memory/1832-210-0x0000000007700000-0x000000000773F000-memory.dmp family_redline behavioral1/memory/1832-214-0x0000000007700000-0x000000000773F000-memory.dmp family_redline behavioral1/memory/1832-212-0x0000000007700000-0x000000000773F000-memory.dmp family_redline behavioral1/memory/1832-216-0x0000000007700000-0x000000000773F000-memory.dmp family_redline behavioral1/memory/1832-218-0x0000000007700000-0x000000000773F000-memory.dmp family_redline behavioral1/memory/1832-220-0x0000000007700000-0x000000000773F000-memory.dmp family_redline behavioral1/memory/1832-222-0x0000000007700000-0x000000000773F000-memory.dmp family_redline behavioral1/memory/1832-224-0x0000000007700000-0x000000000773F000-memory.dmp family_redline behavioral1/memory/1832-226-0x0000000007700000-0x000000000773F000-memory.dmp family_redline behavioral1/memory/1832-228-0x0000000007700000-0x000000000773F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un927675.exepro7765.exequ5648.exesi319124.exepid process 2352 un927675.exe 1796 pro7765.exe 1832 qu5648.exe 4780 si319124.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro7765.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro7765.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro7765.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un927675.exe521d18a9fde485eb93c3352f44d6576c072f23560481e0d25f3ef89492ec4040.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un927675.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 521d18a9fde485eb93c3352f44d6576c072f23560481e0d25f3ef89492ec4040.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 521d18a9fde485eb93c3352f44d6576c072f23560481e0d25f3ef89492ec4040.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un927675.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3080 1796 WerFault.exe pro7765.exe 3768 1832 WerFault.exe qu5648.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro7765.exequ5648.exesi319124.exepid process 1796 pro7765.exe 1796 pro7765.exe 1832 qu5648.exe 1832 qu5648.exe 4780 si319124.exe 4780 si319124.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro7765.exequ5648.exesi319124.exedescription pid process Token: SeDebugPrivilege 1796 pro7765.exe Token: SeDebugPrivilege 1832 qu5648.exe Token: SeDebugPrivilege 4780 si319124.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
521d18a9fde485eb93c3352f44d6576c072f23560481e0d25f3ef89492ec4040.exeun927675.exedescription pid process target process PID 1036 wrote to memory of 2352 1036 521d18a9fde485eb93c3352f44d6576c072f23560481e0d25f3ef89492ec4040.exe un927675.exe PID 1036 wrote to memory of 2352 1036 521d18a9fde485eb93c3352f44d6576c072f23560481e0d25f3ef89492ec4040.exe un927675.exe PID 1036 wrote to memory of 2352 1036 521d18a9fde485eb93c3352f44d6576c072f23560481e0d25f3ef89492ec4040.exe un927675.exe PID 2352 wrote to memory of 1796 2352 un927675.exe pro7765.exe PID 2352 wrote to memory of 1796 2352 un927675.exe pro7765.exe PID 2352 wrote to memory of 1796 2352 un927675.exe pro7765.exe PID 2352 wrote to memory of 1832 2352 un927675.exe qu5648.exe PID 2352 wrote to memory of 1832 2352 un927675.exe qu5648.exe PID 2352 wrote to memory of 1832 2352 un927675.exe qu5648.exe PID 1036 wrote to memory of 4780 1036 521d18a9fde485eb93c3352f44d6576c072f23560481e0d25f3ef89492ec4040.exe si319124.exe PID 1036 wrote to memory of 4780 1036 521d18a9fde485eb93c3352f44d6576c072f23560481e0d25f3ef89492ec4040.exe si319124.exe PID 1036 wrote to memory of 4780 1036 521d18a9fde485eb93c3352f44d6576c072f23560481e0d25f3ef89492ec4040.exe si319124.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\521d18a9fde485eb93c3352f44d6576c072f23560481e0d25f3ef89492ec4040.exe"C:\Users\Admin\AppData\Local\Temp\521d18a9fde485eb93c3352f44d6576c072f23560481e0d25f3ef89492ec4040.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un927675.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un927675.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7765.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7765.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 10844⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5648.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5648.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 17124⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si319124.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si319124.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1796 -ip 17961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1832 -ip 18321⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si319124.exeFilesize
175KB
MD5d024568a3508f659544a41e20b3463c9
SHA1a6bb2901c37a529f3b3c18a1b6dd46dbba89d3ce
SHA25684c960b2dd269d4162c2265478e3afaf3b6abf25eaa3926b5f96f6b280622fdc
SHA512d260a7df8cefe75b5a8b1e9904da1a59a25b37e431d69eb984393ef464d11c38cbf5a7c02f7dc071fdb9d0dfec3bb0b6d20d42ae5bf8a381f95c6040efb6b1a0
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si319124.exeFilesize
175KB
MD5d024568a3508f659544a41e20b3463c9
SHA1a6bb2901c37a529f3b3c18a1b6dd46dbba89d3ce
SHA25684c960b2dd269d4162c2265478e3afaf3b6abf25eaa3926b5f96f6b280622fdc
SHA512d260a7df8cefe75b5a8b1e9904da1a59a25b37e431d69eb984393ef464d11c38cbf5a7c02f7dc071fdb9d0dfec3bb0b6d20d42ae5bf8a381f95c6040efb6b1a0
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un927675.exeFilesize
557KB
MD5e1821e6909d2d5306608ede72452e7e1
SHA1944c92f2c73c55aa23e1ef7991a7a97ef1b9c111
SHA25628040024e9133e23ffa4572068f52f3a58a5ea3718b781a7fb60b07292298954
SHA512fbce05914c2d212edd3ebaaf6810c27b8387d03738528ba2a643a19c4016711e61c60d178336a1f9249e62570eecd806da02111d56f9756adf7d7150dcfd66c3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un927675.exeFilesize
557KB
MD5e1821e6909d2d5306608ede72452e7e1
SHA1944c92f2c73c55aa23e1ef7991a7a97ef1b9c111
SHA25628040024e9133e23ffa4572068f52f3a58a5ea3718b781a7fb60b07292298954
SHA512fbce05914c2d212edd3ebaaf6810c27b8387d03738528ba2a643a19c4016711e61c60d178336a1f9249e62570eecd806da02111d56f9756adf7d7150dcfd66c3
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7765.exeFilesize
322KB
MD54d5dc5158d8df35180e431f3530e8baf
SHA1a08568232a2ec52cfaa0f1620e60c5601c02bc17
SHA256c6e07cfbabe88f95e9314a0f7583170a42baaaf4aae9b3fd33ee4ea8e7fec427
SHA512870d6a57adb02336d6029f4fd24050017888b1729607e947e6b8d1fb0cb5b502d1a84c127cbb8e62c3cc54634afac2180511b4fd2e1508b74d10753bc5dc1d0a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7765.exeFilesize
322KB
MD54d5dc5158d8df35180e431f3530e8baf
SHA1a08568232a2ec52cfaa0f1620e60c5601c02bc17
SHA256c6e07cfbabe88f95e9314a0f7583170a42baaaf4aae9b3fd33ee4ea8e7fec427
SHA512870d6a57adb02336d6029f4fd24050017888b1729607e947e6b8d1fb0cb5b502d1a84c127cbb8e62c3cc54634afac2180511b4fd2e1508b74d10753bc5dc1d0a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5648.exeFilesize
406KB
MD518e2a4407b3d7f4860dbffc88088387a
SHA15d1e3f5d99f9b338694984248814d06cbe5e4339
SHA2568461bbe9201918c7ca950891914bcbb3eb943554f1913c7759a0de2fbdcdbb07
SHA5127dbd860cf2d4df100193b5edca187484981cfe371754f4b66a752a5c9a5f30f1bc5976e02d1a56555dd39afcad49703a302fa24a34b61b16137d1f1fab203591
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5648.exeFilesize
406KB
MD518e2a4407b3d7f4860dbffc88088387a
SHA15d1e3f5d99f9b338694984248814d06cbe5e4339
SHA2568461bbe9201918c7ca950891914bcbb3eb943554f1913c7759a0de2fbdcdbb07
SHA5127dbd860cf2d4df100193b5edca187484981cfe371754f4b66a752a5c9a5f30f1bc5976e02d1a56555dd39afcad49703a302fa24a34b61b16137d1f1fab203591
-
memory/1796-148-0x0000000002C60000-0x0000000002C8D000-memory.dmpFilesize
180KB
-
memory/1796-149-0x0000000007100000-0x00000000076A4000-memory.dmpFilesize
5.6MB
-
memory/1796-150-0x00000000076B0000-0x00000000076C2000-memory.dmpFilesize
72KB
-
memory/1796-151-0x00000000076B0000-0x00000000076C2000-memory.dmpFilesize
72KB
-
memory/1796-153-0x00000000076B0000-0x00000000076C2000-memory.dmpFilesize
72KB
-
memory/1796-155-0x00000000076B0000-0x00000000076C2000-memory.dmpFilesize
72KB
-
memory/1796-157-0x00000000076B0000-0x00000000076C2000-memory.dmpFilesize
72KB
-
memory/1796-159-0x00000000076B0000-0x00000000076C2000-memory.dmpFilesize
72KB
-
memory/1796-161-0x00000000076B0000-0x00000000076C2000-memory.dmpFilesize
72KB
-
memory/1796-163-0x00000000076B0000-0x00000000076C2000-memory.dmpFilesize
72KB
-
memory/1796-165-0x00000000076B0000-0x00000000076C2000-memory.dmpFilesize
72KB
-
memory/1796-167-0x00000000076B0000-0x00000000076C2000-memory.dmpFilesize
72KB
-
memory/1796-169-0x00000000076B0000-0x00000000076C2000-memory.dmpFilesize
72KB
-
memory/1796-171-0x00000000076B0000-0x00000000076C2000-memory.dmpFilesize
72KB
-
memory/1796-173-0x00000000076B0000-0x00000000076C2000-memory.dmpFilesize
72KB
-
memory/1796-175-0x00000000076B0000-0x00000000076C2000-memory.dmpFilesize
72KB
-
memory/1796-177-0x00000000076B0000-0x00000000076C2000-memory.dmpFilesize
72KB
-
memory/1796-178-0x00000000070F0000-0x0000000007100000-memory.dmpFilesize
64KB
-
memory/1796-179-0x00000000070F0000-0x0000000007100000-memory.dmpFilesize
64KB
-
memory/1796-180-0x00000000070F0000-0x0000000007100000-memory.dmpFilesize
64KB
-
memory/1796-181-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/1796-182-0x00000000070F0000-0x0000000007100000-memory.dmpFilesize
64KB
-
memory/1796-183-0x00000000070F0000-0x0000000007100000-memory.dmpFilesize
64KB
-
memory/1796-184-0x00000000070F0000-0x0000000007100000-memory.dmpFilesize
64KB
-
memory/1796-186-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/1832-191-0x0000000004570000-0x00000000045BB000-memory.dmpFilesize
300KB
-
memory/1832-192-0x0000000007700000-0x000000000773F000-memory.dmpFilesize
252KB
-
memory/1832-193-0x0000000007700000-0x000000000773F000-memory.dmpFilesize
252KB
-
memory/1832-195-0x0000000007700000-0x000000000773F000-memory.dmpFilesize
252KB
-
memory/1832-197-0x0000000007700000-0x000000000773F000-memory.dmpFilesize
252KB
-
memory/1832-199-0x0000000007700000-0x000000000773F000-memory.dmpFilesize
252KB
-
memory/1832-203-0x0000000007700000-0x000000000773F000-memory.dmpFilesize
252KB
-
memory/1832-201-0x0000000007700000-0x000000000773F000-memory.dmpFilesize
252KB
-
memory/1832-206-0x0000000007700000-0x000000000773F000-memory.dmpFilesize
252KB
-
memory/1832-207-0x0000000004880000-0x0000000004890000-memory.dmpFilesize
64KB
-
memory/1832-205-0x0000000004880000-0x0000000004890000-memory.dmpFilesize
64KB
-
memory/1832-209-0x0000000004880000-0x0000000004890000-memory.dmpFilesize
64KB
-
memory/1832-210-0x0000000007700000-0x000000000773F000-memory.dmpFilesize
252KB
-
memory/1832-214-0x0000000007700000-0x000000000773F000-memory.dmpFilesize
252KB
-
memory/1832-212-0x0000000007700000-0x000000000773F000-memory.dmpFilesize
252KB
-
memory/1832-216-0x0000000007700000-0x000000000773F000-memory.dmpFilesize
252KB
-
memory/1832-218-0x0000000007700000-0x000000000773F000-memory.dmpFilesize
252KB
-
memory/1832-220-0x0000000007700000-0x000000000773F000-memory.dmpFilesize
252KB
-
memory/1832-222-0x0000000007700000-0x000000000773F000-memory.dmpFilesize
252KB
-
memory/1832-224-0x0000000007700000-0x000000000773F000-memory.dmpFilesize
252KB
-
memory/1832-226-0x0000000007700000-0x000000000773F000-memory.dmpFilesize
252KB
-
memory/1832-228-0x0000000007700000-0x000000000773F000-memory.dmpFilesize
252KB
-
memory/1832-1101-0x00000000078E0000-0x0000000007EF8000-memory.dmpFilesize
6.1MB
-
memory/1832-1102-0x0000000007F80000-0x000000000808A000-memory.dmpFilesize
1.0MB
-
memory/1832-1103-0x00000000080C0000-0x00000000080D2000-memory.dmpFilesize
72KB
-
memory/1832-1104-0x00000000080E0000-0x000000000811C000-memory.dmpFilesize
240KB
-
memory/1832-1105-0x0000000004880000-0x0000000004890000-memory.dmpFilesize
64KB
-
memory/1832-1107-0x00000000083D0000-0x0000000008462000-memory.dmpFilesize
584KB
-
memory/1832-1108-0x0000000008470000-0x00000000084D6000-memory.dmpFilesize
408KB
-
memory/1832-1109-0x0000000004880000-0x0000000004890000-memory.dmpFilesize
64KB
-
memory/1832-1110-0x0000000004880000-0x0000000004890000-memory.dmpFilesize
64KB
-
memory/1832-1111-0x0000000004880000-0x0000000004890000-memory.dmpFilesize
64KB
-
memory/1832-1112-0x0000000008C70000-0x0000000008CE6000-memory.dmpFilesize
472KB
-
memory/1832-1113-0x0000000008D00000-0x0000000008D50000-memory.dmpFilesize
320KB
-
memory/1832-1114-0x0000000008D80000-0x0000000008F42000-memory.dmpFilesize
1.8MB
-
memory/1832-1115-0x0000000008F50000-0x000000000947C000-memory.dmpFilesize
5.2MB
-
memory/1832-1116-0x0000000004880000-0x0000000004890000-memory.dmpFilesize
64KB
-
memory/4780-1122-0x0000000000FA0000-0x0000000000FD2000-memory.dmpFilesize
200KB
-
memory/4780-1123-0x0000000005B90000-0x0000000005BA0000-memory.dmpFilesize
64KB
-
memory/4780-1124-0x0000000005B90000-0x0000000005BA0000-memory.dmpFilesize
64KB