Analysis
-
max time kernel
56s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 10:27
Static task
static1
Behavioral task
behavioral1
Sample
d3b5fe68abdf72c8ef99abc9da869dbfeb4c4f0b768ef41a9b80b2f8d4886612.exe
Resource
win10v2004-20230221-en
General
-
Target
d3b5fe68abdf72c8ef99abc9da869dbfeb4c4f0b768ef41a9b80b2f8d4886612.exe
-
Size
697KB
-
MD5
47bc0b5f4dc2b06b6c84f85d10710772
-
SHA1
2135c3df072636d8e9c8bcf3cb85b3b4046ff806
-
SHA256
d3b5fe68abdf72c8ef99abc9da869dbfeb4c4f0b768ef41a9b80b2f8d4886612
-
SHA512
2c6ee8906bf970c1a2f126bca12446ea34aeaae9a8efb4b558d6487d8d39043f31c202ae38f4e9a1893029f6080852cce75852a1e8fe3ed9a7daeee24c001448
-
SSDEEP
12288:RMr4y90PmVTc5VJo428Biz135xztjIL6dWGjpAxI9gfsBcq54w/:hy7SVmXZJx8PGjiI9EkJ/
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
muse
176.113.115.145:4125
-
auth_value
b91988a63a24940038d9262827a5320c
Signatures
-
Processes:
pro6346.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro6346.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro6346.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro6346.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro6346.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro6346.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro6346.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/4848-195-0x0000000007180000-0x00000000071BF000-memory.dmp family_redline behavioral1/memory/4848-197-0x0000000007180000-0x00000000071BF000-memory.dmp family_redline behavioral1/memory/4848-194-0x0000000007180000-0x00000000071BF000-memory.dmp family_redline behavioral1/memory/4848-199-0x0000000007180000-0x00000000071BF000-memory.dmp family_redline behavioral1/memory/4848-201-0x0000000007180000-0x00000000071BF000-memory.dmp family_redline behavioral1/memory/4848-203-0x0000000007180000-0x00000000071BF000-memory.dmp family_redline behavioral1/memory/4848-205-0x0000000007180000-0x00000000071BF000-memory.dmp family_redline behavioral1/memory/4848-207-0x0000000007180000-0x00000000071BF000-memory.dmp family_redline behavioral1/memory/4848-209-0x0000000007180000-0x00000000071BF000-memory.dmp family_redline behavioral1/memory/4848-211-0x0000000007180000-0x00000000071BF000-memory.dmp family_redline behavioral1/memory/4848-213-0x0000000007180000-0x00000000071BF000-memory.dmp family_redline behavioral1/memory/4848-215-0x0000000007180000-0x00000000071BF000-memory.dmp family_redline behavioral1/memory/4848-217-0x0000000007180000-0x00000000071BF000-memory.dmp family_redline behavioral1/memory/4848-219-0x0000000007180000-0x00000000071BF000-memory.dmp family_redline behavioral1/memory/4848-221-0x0000000007180000-0x00000000071BF000-memory.dmp family_redline behavioral1/memory/4848-223-0x0000000007180000-0x00000000071BF000-memory.dmp family_redline behavioral1/memory/4848-225-0x0000000007180000-0x00000000071BF000-memory.dmp family_redline behavioral1/memory/4848-227-0x0000000007180000-0x00000000071BF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un316488.exepro6346.exequ8742.exesi570211.exepid process 1600 un316488.exe 4300 pro6346.exe 4848 qu8742.exe 2072 si570211.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro6346.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro6346.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro6346.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
d3b5fe68abdf72c8ef99abc9da869dbfeb4c4f0b768ef41a9b80b2f8d4886612.exeun316488.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce d3b5fe68abdf72c8ef99abc9da869dbfeb4c4f0b768ef41a9b80b2f8d4886612.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" d3b5fe68abdf72c8ef99abc9da869dbfeb4c4f0b768ef41a9b80b2f8d4886612.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un316488.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un316488.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 324 4300 WerFault.exe pro6346.exe 1132 4848 WerFault.exe qu8742.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro6346.exequ8742.exesi570211.exepid process 4300 pro6346.exe 4300 pro6346.exe 4848 qu8742.exe 4848 qu8742.exe 2072 si570211.exe 2072 si570211.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro6346.exequ8742.exesi570211.exedescription pid process Token: SeDebugPrivilege 4300 pro6346.exe Token: SeDebugPrivilege 4848 qu8742.exe Token: SeDebugPrivilege 2072 si570211.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
d3b5fe68abdf72c8ef99abc9da869dbfeb4c4f0b768ef41a9b80b2f8d4886612.exeun316488.exedescription pid process target process PID 1932 wrote to memory of 1600 1932 d3b5fe68abdf72c8ef99abc9da869dbfeb4c4f0b768ef41a9b80b2f8d4886612.exe un316488.exe PID 1932 wrote to memory of 1600 1932 d3b5fe68abdf72c8ef99abc9da869dbfeb4c4f0b768ef41a9b80b2f8d4886612.exe un316488.exe PID 1932 wrote to memory of 1600 1932 d3b5fe68abdf72c8ef99abc9da869dbfeb4c4f0b768ef41a9b80b2f8d4886612.exe un316488.exe PID 1600 wrote to memory of 4300 1600 un316488.exe pro6346.exe PID 1600 wrote to memory of 4300 1600 un316488.exe pro6346.exe PID 1600 wrote to memory of 4300 1600 un316488.exe pro6346.exe PID 1600 wrote to memory of 4848 1600 un316488.exe qu8742.exe PID 1600 wrote to memory of 4848 1600 un316488.exe qu8742.exe PID 1600 wrote to memory of 4848 1600 un316488.exe qu8742.exe PID 1932 wrote to memory of 2072 1932 d3b5fe68abdf72c8ef99abc9da869dbfeb4c4f0b768ef41a9b80b2f8d4886612.exe si570211.exe PID 1932 wrote to memory of 2072 1932 d3b5fe68abdf72c8ef99abc9da869dbfeb4c4f0b768ef41a9b80b2f8d4886612.exe si570211.exe PID 1932 wrote to memory of 2072 1932 d3b5fe68abdf72c8ef99abc9da869dbfeb4c4f0b768ef41a9b80b2f8d4886612.exe si570211.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d3b5fe68abdf72c8ef99abc9da869dbfeb4c4f0b768ef41a9b80b2f8d4886612.exe"C:\Users\Admin\AppData\Local\Temp\d3b5fe68abdf72c8ef99abc9da869dbfeb4c4f0b768ef41a9b80b2f8d4886612.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un316488.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un316488.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6346.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6346.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 11044⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8742.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8742.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 14524⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si570211.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si570211.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4300 -ip 43001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4848 -ip 48481⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si570211.exeFilesize
175KB
MD5fc648af39a67ab86fc122488e8821ff9
SHA110e12fe6c9c1a34d4c81bb4746a3e795c21481ef
SHA2568bc270f1b977981725048e5c60272ffcece64270ae30aa26e44787b40be95697
SHA5124d78069cc85eec5bf8160a83d7663726ef3556183b4f2101560d5451f9b2e7b862b0ac3f8cb2b0e7d7e8c8ae204f3cb9b1fa250d5c38359c9893cd0a28c2552b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si570211.exeFilesize
175KB
MD5fc648af39a67ab86fc122488e8821ff9
SHA110e12fe6c9c1a34d4c81bb4746a3e795c21481ef
SHA2568bc270f1b977981725048e5c60272ffcece64270ae30aa26e44787b40be95697
SHA5124d78069cc85eec5bf8160a83d7663726ef3556183b4f2101560d5451f9b2e7b862b0ac3f8cb2b0e7d7e8c8ae204f3cb9b1fa250d5c38359c9893cd0a28c2552b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un316488.exeFilesize
556KB
MD5c96fd14c478c40755f562ad9d049dee8
SHA12e2debe10f2f007878a23eda0accd4ca5247d742
SHA25648371f42867732b297f038013ffc1fb0f5403f68073ba0b523161f885f087e58
SHA512e76fffde751d9ad07b3ea738c88c4625e5eb797d1de71c525edef63601fbd8e1a6c009653b5c87d4068626ad8a86f9b93e04414ea496536e77e30be6e2f1685a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un316488.exeFilesize
556KB
MD5c96fd14c478c40755f562ad9d049dee8
SHA12e2debe10f2f007878a23eda0accd4ca5247d742
SHA25648371f42867732b297f038013ffc1fb0f5403f68073ba0b523161f885f087e58
SHA512e76fffde751d9ad07b3ea738c88c4625e5eb797d1de71c525edef63601fbd8e1a6c009653b5c87d4068626ad8a86f9b93e04414ea496536e77e30be6e2f1685a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6346.exeFilesize
347KB
MD58eb07633b1442ff0c05156cfcb8cc6c3
SHA1a3311047134df67903e99a8793e5d666f83daff7
SHA256f13f58883411e3aaabb39c472398b0a945015770f6cc452556013b853afdb24b
SHA512725bdaff6ab6f4fface2139c2700c2c73ce75f7bb6409d0caac21b2bd13b64147afa2190ec53f5646efd0e1509e78f6a2fb024fb094689e3290a607005e913cd
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6346.exeFilesize
347KB
MD58eb07633b1442ff0c05156cfcb8cc6c3
SHA1a3311047134df67903e99a8793e5d666f83daff7
SHA256f13f58883411e3aaabb39c472398b0a945015770f6cc452556013b853afdb24b
SHA512725bdaff6ab6f4fface2139c2700c2c73ce75f7bb6409d0caac21b2bd13b64147afa2190ec53f5646efd0e1509e78f6a2fb024fb094689e3290a607005e913cd
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8742.exeFilesize
406KB
MD56e6bae85690898508d9df1d1d68267fe
SHA1337d84facfc018e7c8cafac2fa2e316d01218ef4
SHA25618d03f892e928d6bb70ceb862880ace69aff40c2981059dac6cab67fc38be21a
SHA5120c01a1928f418d6b352a48ca1172dee6a4b047373f140ad04a27c008f0100d166b04a2ae04e9c18290a24687ae303595591a36349a0e6fd9633eb950e1466c27
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8742.exeFilesize
406KB
MD56e6bae85690898508d9df1d1d68267fe
SHA1337d84facfc018e7c8cafac2fa2e316d01218ef4
SHA25618d03f892e928d6bb70ceb862880ace69aff40c2981059dac6cab67fc38be21a
SHA5120c01a1928f418d6b352a48ca1172dee6a4b047373f140ad04a27c008f0100d166b04a2ae04e9c18290a24687ae303595591a36349a0e6fd9633eb950e1466c27
-
memory/2072-1121-0x0000000000300000-0x0000000000332000-memory.dmpFilesize
200KB
-
memory/2072-1122-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/4300-160-0x0000000004800000-0x0000000004812000-memory.dmpFilesize
72KB
-
memory/4300-170-0x0000000004800000-0x0000000004812000-memory.dmpFilesize
72KB
-
memory/4300-152-0x0000000004800000-0x0000000004812000-memory.dmpFilesize
72KB
-
memory/4300-154-0x0000000004800000-0x0000000004812000-memory.dmpFilesize
72KB
-
memory/4300-156-0x0000000004800000-0x0000000004812000-memory.dmpFilesize
72KB
-
memory/4300-158-0x0000000004800000-0x0000000004812000-memory.dmpFilesize
72KB
-
memory/4300-149-0x0000000004800000-0x0000000004812000-memory.dmpFilesize
72KB
-
memory/4300-162-0x0000000004800000-0x0000000004812000-memory.dmpFilesize
72KB
-
memory/4300-164-0x0000000004800000-0x0000000004812000-memory.dmpFilesize
72KB
-
memory/4300-166-0x0000000004800000-0x0000000004812000-memory.dmpFilesize
72KB
-
memory/4300-168-0x0000000004800000-0x0000000004812000-memory.dmpFilesize
72KB
-
memory/4300-150-0x0000000004800000-0x0000000004812000-memory.dmpFilesize
72KB
-
memory/4300-172-0x0000000004800000-0x0000000004812000-memory.dmpFilesize
72KB
-
memory/4300-174-0x0000000004800000-0x0000000004812000-memory.dmpFilesize
72KB
-
memory/4300-176-0x0000000004800000-0x0000000004812000-memory.dmpFilesize
72KB
-
memory/4300-177-0x0000000002C60000-0x0000000002C8D000-memory.dmpFilesize
180KB
-
memory/4300-178-0x0000000007250000-0x0000000007260000-memory.dmpFilesize
64KB
-
memory/4300-179-0x0000000007250000-0x0000000007260000-memory.dmpFilesize
64KB
-
memory/4300-180-0x0000000000400000-0x0000000002B84000-memory.dmpFilesize
39.5MB
-
memory/4300-182-0x0000000007250000-0x0000000007260000-memory.dmpFilesize
64KB
-
memory/4300-183-0x0000000007250000-0x0000000007260000-memory.dmpFilesize
64KB
-
memory/4300-184-0x0000000007250000-0x0000000007260000-memory.dmpFilesize
64KB
-
memory/4300-185-0x0000000000400000-0x0000000002B84000-memory.dmpFilesize
39.5MB
-
memory/4300-148-0x0000000007260000-0x0000000007804000-memory.dmpFilesize
5.6MB
-
memory/4848-193-0x0000000007330000-0x0000000007340000-memory.dmpFilesize
64KB
-
memory/4848-225-0x0000000007180000-0x00000000071BF000-memory.dmpFilesize
252KB
-
memory/4848-195-0x0000000007180000-0x00000000071BF000-memory.dmpFilesize
252KB
-
memory/4848-197-0x0000000007180000-0x00000000071BF000-memory.dmpFilesize
252KB
-
memory/4848-194-0x0000000007180000-0x00000000071BF000-memory.dmpFilesize
252KB
-
memory/4848-191-0x0000000007330000-0x0000000007340000-memory.dmpFilesize
64KB
-
memory/4848-199-0x0000000007180000-0x00000000071BF000-memory.dmpFilesize
252KB
-
memory/4848-201-0x0000000007180000-0x00000000071BF000-memory.dmpFilesize
252KB
-
memory/4848-203-0x0000000007180000-0x00000000071BF000-memory.dmpFilesize
252KB
-
memory/4848-205-0x0000000007180000-0x00000000071BF000-memory.dmpFilesize
252KB
-
memory/4848-207-0x0000000007180000-0x00000000071BF000-memory.dmpFilesize
252KB
-
memory/4848-209-0x0000000007180000-0x00000000071BF000-memory.dmpFilesize
252KB
-
memory/4848-211-0x0000000007180000-0x00000000071BF000-memory.dmpFilesize
252KB
-
memory/4848-213-0x0000000007180000-0x00000000071BF000-memory.dmpFilesize
252KB
-
memory/4848-215-0x0000000007180000-0x00000000071BF000-memory.dmpFilesize
252KB
-
memory/4848-217-0x0000000007180000-0x00000000071BF000-memory.dmpFilesize
252KB
-
memory/4848-219-0x0000000007180000-0x00000000071BF000-memory.dmpFilesize
252KB
-
memory/4848-221-0x0000000007180000-0x00000000071BF000-memory.dmpFilesize
252KB
-
memory/4848-223-0x0000000007180000-0x00000000071BF000-memory.dmpFilesize
252KB
-
memory/4848-192-0x0000000007330000-0x0000000007340000-memory.dmpFilesize
64KB
-
memory/4848-227-0x0000000007180000-0x00000000071BF000-memory.dmpFilesize
252KB
-
memory/4848-1100-0x00000000078F0000-0x0000000007F08000-memory.dmpFilesize
6.1MB
-
memory/4848-1101-0x0000000007F80000-0x000000000808A000-memory.dmpFilesize
1.0MB
-
memory/4848-1102-0x00000000080C0000-0x00000000080D2000-memory.dmpFilesize
72KB
-
memory/4848-1103-0x00000000080E0000-0x000000000811C000-memory.dmpFilesize
240KB
-
memory/4848-1104-0x0000000007330000-0x0000000007340000-memory.dmpFilesize
64KB
-
memory/4848-1106-0x00000000083D0000-0x0000000008462000-memory.dmpFilesize
584KB
-
memory/4848-1107-0x0000000008470000-0x00000000084D6000-memory.dmpFilesize
408KB
-
memory/4848-1108-0x0000000008B70000-0x0000000008BE6000-memory.dmpFilesize
472KB
-
memory/4848-1109-0x0000000008C00000-0x0000000008C50000-memory.dmpFilesize
320KB
-
memory/4848-1110-0x0000000007330000-0x0000000007340000-memory.dmpFilesize
64KB
-
memory/4848-1111-0x0000000007330000-0x0000000007340000-memory.dmpFilesize
64KB
-
memory/4848-1112-0x0000000007330000-0x0000000007340000-memory.dmpFilesize
64KB
-
memory/4848-190-0x0000000002BA0000-0x0000000002BEB000-memory.dmpFilesize
300KB
-
memory/4848-1113-0x0000000008EC0000-0x0000000009082000-memory.dmpFilesize
1.8MB
-
memory/4848-1114-0x00000000090A0000-0x00000000095CC000-memory.dmpFilesize
5.2MB
-
memory/4848-1115-0x0000000007330000-0x0000000007340000-memory.dmpFilesize
64KB