Analysis
-
max time kernel
113s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 10:24
Static task
static1
Behavioral task
behavioral1
Sample
b60f37441c16a5b4a4af345792fe5fbfd6e87b1e562fd97ffd0241b7e8521fc1.exe
Resource
win10v2004-20230220-en
General
-
Target
b60f37441c16a5b4a4af345792fe5fbfd6e87b1e562fd97ffd0241b7e8521fc1.exe
-
Size
697KB
-
MD5
3485eb4c093eda61e3bc0dafce6a32d1
-
SHA1
8bcb25112747f0e36a8bb2078d4e7d508aebd47a
-
SHA256
b60f37441c16a5b4a4af345792fe5fbfd6e87b1e562fd97ffd0241b7e8521fc1
-
SHA512
42be35fb33a6fd3bcfd235164f148d869e3afeb37ad85c3a8737f94b5c70101db730c4636f119c1a4a15d9bf8bfb52dabc64d70531e5f10cae9592200bddabec
-
SSDEEP
12288:AMrvy90u1MIEbVkITC8/+e/Yuxy1SwXndyrL6PBGjkAxI9g3VcA4QxANB:/y0VkITCKLx1YyCGj9I9opRY
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
muse
176.113.115.145:4125
-
auth_value
b91988a63a24940038d9262827a5320c
Signatures
-
Processes:
pro9054.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro9054.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro9054.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro9054.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro9054.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro9054.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro9054.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/4796-190-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/4796-189-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/4796-192-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/4796-194-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/4796-196-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/4796-198-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/4796-200-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/4796-202-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/4796-204-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/4796-206-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/4796-208-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/4796-210-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/4796-212-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/4796-214-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/4796-216-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/4796-218-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/4796-220-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/4796-222-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/4796-251-0x00000000071A0000-0x00000000071B0000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un975193.exepro9054.exequ8344.exesi612694.exepid process 3692 un975193.exe 4920 pro9054.exe 4796 qu8344.exe 3008 si612694.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro9054.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro9054.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro9054.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
b60f37441c16a5b4a4af345792fe5fbfd6e87b1e562fd97ffd0241b7e8521fc1.exeun975193.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce b60f37441c16a5b4a4af345792fe5fbfd6e87b1e562fd97ffd0241b7e8521fc1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" b60f37441c16a5b4a4af345792fe5fbfd6e87b1e562fd97ffd0241b7e8521fc1.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un975193.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un975193.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1100 4920 WerFault.exe pro9054.exe 1100 4796 WerFault.exe qu8344.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro9054.exequ8344.exesi612694.exepid process 4920 pro9054.exe 4920 pro9054.exe 4796 qu8344.exe 4796 qu8344.exe 3008 si612694.exe 3008 si612694.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro9054.exequ8344.exesi612694.exedescription pid process Token: SeDebugPrivilege 4920 pro9054.exe Token: SeDebugPrivilege 4796 qu8344.exe Token: SeDebugPrivilege 3008 si612694.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
b60f37441c16a5b4a4af345792fe5fbfd6e87b1e562fd97ffd0241b7e8521fc1.exeun975193.exedescription pid process target process PID 1788 wrote to memory of 3692 1788 b60f37441c16a5b4a4af345792fe5fbfd6e87b1e562fd97ffd0241b7e8521fc1.exe un975193.exe PID 1788 wrote to memory of 3692 1788 b60f37441c16a5b4a4af345792fe5fbfd6e87b1e562fd97ffd0241b7e8521fc1.exe un975193.exe PID 1788 wrote to memory of 3692 1788 b60f37441c16a5b4a4af345792fe5fbfd6e87b1e562fd97ffd0241b7e8521fc1.exe un975193.exe PID 3692 wrote to memory of 4920 3692 un975193.exe pro9054.exe PID 3692 wrote to memory of 4920 3692 un975193.exe pro9054.exe PID 3692 wrote to memory of 4920 3692 un975193.exe pro9054.exe PID 3692 wrote to memory of 4796 3692 un975193.exe qu8344.exe PID 3692 wrote to memory of 4796 3692 un975193.exe qu8344.exe PID 3692 wrote to memory of 4796 3692 un975193.exe qu8344.exe PID 1788 wrote to memory of 3008 1788 b60f37441c16a5b4a4af345792fe5fbfd6e87b1e562fd97ffd0241b7e8521fc1.exe si612694.exe PID 1788 wrote to memory of 3008 1788 b60f37441c16a5b4a4af345792fe5fbfd6e87b1e562fd97ffd0241b7e8521fc1.exe si612694.exe PID 1788 wrote to memory of 3008 1788 b60f37441c16a5b4a4af345792fe5fbfd6e87b1e562fd97ffd0241b7e8521fc1.exe si612694.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b60f37441c16a5b4a4af345792fe5fbfd6e87b1e562fd97ffd0241b7e8521fc1.exe"C:\Users\Admin\AppData\Local\Temp\b60f37441c16a5b4a4af345792fe5fbfd6e87b1e562fd97ffd0241b7e8521fc1.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un975193.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un975193.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9054.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9054.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4920 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 10804⤵
- Program crash
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8344.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8344.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4796 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 13324⤵
- Program crash
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si612694.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si612694.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3008
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4920 -ip 49201⤵PID:1232
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4796 -ip 47961⤵PID:3392
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si612694.exeFilesize
175KB
MD5b8afb8f0076613b887264f9dc3b3deb4
SHA1793f0a13c2a9fb51c98967c5d345dc130d31f273
SHA25667fabca3736ce8a3de2f60bfccb152ad8b080bbea420cd86caa719118dca1021
SHA5128f1c734eecc9ef59923a39e0e76ac745f19c98a19b8b2d73e1ca4eb4638b6470cb75de51103604c74eeabbd79af965c090b7e7f19b5af99cc3499b22323a4cff
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si612694.exeFilesize
175KB
MD5b8afb8f0076613b887264f9dc3b3deb4
SHA1793f0a13c2a9fb51c98967c5d345dc130d31f273
SHA25667fabca3736ce8a3de2f60bfccb152ad8b080bbea420cd86caa719118dca1021
SHA5128f1c734eecc9ef59923a39e0e76ac745f19c98a19b8b2d73e1ca4eb4638b6470cb75de51103604c74eeabbd79af965c090b7e7f19b5af99cc3499b22323a4cff
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un975193.exeFilesize
555KB
MD524776e2eb8178af55911628c0e5e7077
SHA1540c352c6cdff5613109fbb26cbeab436ef6837c
SHA25633e6d7e3b8e1a31b205135d2c6eafd212883920ab104ede6ab70a6ad0fb77248
SHA51226875bf24262070db3e77223e034d319b351a4ffddf5beb9880cc46aaa59dc790033c029874a007cffc0dc645114b6beef8b61c90b20f1b22949b3332e9781d7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un975193.exeFilesize
555KB
MD524776e2eb8178af55911628c0e5e7077
SHA1540c352c6cdff5613109fbb26cbeab436ef6837c
SHA25633e6d7e3b8e1a31b205135d2c6eafd212883920ab104ede6ab70a6ad0fb77248
SHA51226875bf24262070db3e77223e034d319b351a4ffddf5beb9880cc46aaa59dc790033c029874a007cffc0dc645114b6beef8b61c90b20f1b22949b3332e9781d7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9054.exeFilesize
347KB
MD5b9960158dc4b7c7c8145b02657bfb7c7
SHA112a8794e7cef3dbe08ebb8e974dbfddaaa1e8cde
SHA256341cde1d13758d32fc7bbd1673d2db5270a7e4fc0bbff74377a78d815d7ca2fe
SHA512fe4861291ea7c9f40899b96767841d5bacc64f72a8e37332fa31b9f69602a22a704bac4f9f68e374a5a84042f6a364407431798ca0e394558610fc5f36340759
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9054.exeFilesize
347KB
MD5b9960158dc4b7c7c8145b02657bfb7c7
SHA112a8794e7cef3dbe08ebb8e974dbfddaaa1e8cde
SHA256341cde1d13758d32fc7bbd1673d2db5270a7e4fc0bbff74377a78d815d7ca2fe
SHA512fe4861291ea7c9f40899b96767841d5bacc64f72a8e37332fa31b9f69602a22a704bac4f9f68e374a5a84042f6a364407431798ca0e394558610fc5f36340759
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8344.exeFilesize
406KB
MD54f398c8e23bdefb97321c3c3bfebeb32
SHA17baaa642ab08398339e13c1093531c90d980c698
SHA256a0192f73b5866f54b54cc11e41c545e385976ebaebd3ed95ea49c4d24a2c4793
SHA5128250a8174efdab73a4c53b3abd6f715eef8eea1847403d8a949ae0d2b3c70d7254206728b714fa830f8c128944626e145f69dd4693d1993db3b59ba230377b0f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8344.exeFilesize
406KB
MD54f398c8e23bdefb97321c3c3bfebeb32
SHA17baaa642ab08398339e13c1093531c90d980c698
SHA256a0192f73b5866f54b54cc11e41c545e385976ebaebd3ed95ea49c4d24a2c4793
SHA5128250a8174efdab73a4c53b3abd6f715eef8eea1847403d8a949ae0d2b3c70d7254206728b714fa830f8c128944626e145f69dd4693d1993db3b59ba230377b0f
-
memory/3008-1121-0x0000000005940000-0x0000000005950000-memory.dmpFilesize
64KB
-
memory/3008-1120-0x0000000000D80000-0x0000000000DB2000-memory.dmpFilesize
200KB
-
memory/4796-1099-0x00000000078E0000-0x0000000007EF8000-memory.dmpFilesize
6.1MB
-
memory/4796-1101-0x00000000080C0000-0x00000000080D2000-memory.dmpFilesize
72KB
-
memory/4796-1114-0x00000000071A0000-0x00000000071B0000-memory.dmpFilesize
64KB
-
memory/4796-1113-0x000000000A350000-0x000000000A87C000-memory.dmpFilesize
5.2MB
-
memory/4796-1112-0x000000000A170000-0x000000000A332000-memory.dmpFilesize
1.8MB
-
memory/4796-1111-0x000000000A110000-0x000000000A160000-memory.dmpFilesize
320KB
-
memory/4796-1110-0x000000000A080000-0x000000000A0F6000-memory.dmpFilesize
472KB
-
memory/4796-1109-0x0000000008BD0000-0x0000000008C62000-memory.dmpFilesize
584KB
-
memory/4796-1108-0x00000000083D0000-0x0000000008436000-memory.dmpFilesize
408KB
-
memory/4796-1107-0x00000000071A0000-0x00000000071B0000-memory.dmpFilesize
64KB
-
memory/4796-1106-0x00000000071A0000-0x00000000071B0000-memory.dmpFilesize
64KB
-
memory/4796-1105-0x00000000071A0000-0x00000000071B0000-memory.dmpFilesize
64KB
-
memory/4796-1103-0x00000000080E0000-0x000000000811C000-memory.dmpFilesize
240KB
-
memory/4796-1102-0x00000000071A0000-0x00000000071B0000-memory.dmpFilesize
64KB
-
memory/4796-1100-0x0000000007F80000-0x000000000808A000-memory.dmpFilesize
1.0MB
-
memory/4796-251-0x00000000071A0000-0x00000000071B0000-memory.dmpFilesize
64KB
-
memory/4796-250-0x00000000071A0000-0x00000000071B0000-memory.dmpFilesize
64KB
-
memory/4796-248-0x00000000071A0000-0x00000000071B0000-memory.dmpFilesize
64KB
-
memory/4796-247-0x0000000002C70000-0x0000000002CBB000-memory.dmpFilesize
300KB
-
memory/4796-190-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/4796-189-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/4796-192-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/4796-194-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/4796-196-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/4796-198-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/4796-200-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/4796-202-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/4796-204-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/4796-206-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/4796-208-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/4796-210-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/4796-212-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/4796-214-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/4796-216-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/4796-218-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/4796-220-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/4796-222-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/4920-171-0x0000000007230000-0x0000000007242000-memory.dmpFilesize
72KB
-
memory/4920-148-0x0000000002C60000-0x0000000002C8D000-memory.dmpFilesize
180KB
-
memory/4920-153-0x0000000007230000-0x0000000007242000-memory.dmpFilesize
72KB
-
memory/4920-182-0x0000000007270000-0x0000000007280000-memory.dmpFilesize
64KB
-
memory/4920-152-0x0000000007230000-0x0000000007242000-memory.dmpFilesize
72KB
-
memory/4920-181-0x0000000007270000-0x0000000007280000-memory.dmpFilesize
64KB
-
memory/4920-157-0x0000000007230000-0x0000000007242000-memory.dmpFilesize
72KB
-
memory/4920-180-0x0000000000400000-0x0000000002B84000-memory.dmpFilesize
39.5MB
-
memory/4920-167-0x0000000007230000-0x0000000007242000-memory.dmpFilesize
72KB
-
memory/4920-175-0x0000000007230000-0x0000000007242000-memory.dmpFilesize
72KB
-
memory/4920-184-0x0000000000400000-0x0000000002B84000-memory.dmpFilesize
39.5MB
-
memory/4920-159-0x0000000007230000-0x0000000007242000-memory.dmpFilesize
72KB
-
memory/4920-169-0x0000000007230000-0x0000000007242000-memory.dmpFilesize
72KB
-
memory/4920-177-0x0000000007230000-0x0000000007242000-memory.dmpFilesize
72KB
-
memory/4920-179-0x0000000007230000-0x0000000007242000-memory.dmpFilesize
72KB
-
memory/4920-155-0x0000000007230000-0x0000000007242000-memory.dmpFilesize
72KB
-
memory/4920-161-0x0000000007230000-0x0000000007242000-memory.dmpFilesize
72KB
-
memory/4920-163-0x0000000007230000-0x0000000007242000-memory.dmpFilesize
72KB
-
memory/4920-165-0x0000000007230000-0x0000000007242000-memory.dmpFilesize
72KB
-
memory/4920-151-0x0000000007280000-0x0000000007824000-memory.dmpFilesize
5.6MB
-
memory/4920-150-0x0000000007270000-0x0000000007280000-memory.dmpFilesize
64KB
-
memory/4920-149-0x0000000007270000-0x0000000007280000-memory.dmpFilesize
64KB
-
memory/4920-173-0x0000000007230000-0x0000000007242000-memory.dmpFilesize
72KB