Analysis
-
max time kernel
135s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 10:31
Static task
static1
Behavioral task
behavioral1
Sample
d2ac0ea944e85fd10acd8b02cb9c4ffc8e0da7c2a9dfd3e02097328a35757602.exe
Resource
win10v2004-20230221-en
General
-
Target
d2ac0ea944e85fd10acd8b02cb9c4ffc8e0da7c2a9dfd3e02097328a35757602.exe
-
Size
698KB
-
MD5
b9660d6e471d63c6e92645eab7fb8d9d
-
SHA1
bf2b19a13c545ad9f987e4fb4c8346ba53f27d37
-
SHA256
d2ac0ea944e85fd10acd8b02cb9c4ffc8e0da7c2a9dfd3e02097328a35757602
-
SHA512
9a0b953f49d687c16be8ca89e6ce3412d2232b3babf14cf0fe246c7455ef6db68b70366035aabb9e7ea4e5ba8d07f0c9e027b8a7c1dcdcce581d0f148afa5026
-
SSDEEP
12288:FMrDy90DxA1R5LYkqdMXZZ27p/YjE0jucKAQGAL55L6DDGjEAxI9gqLj2sMVwUG:uysip0kI8ZcmE0jucKAQGAL5dIGjdI9z
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
muse
176.113.115.145:4125
-
auth_value
b91988a63a24940038d9262827a5320c
Signatures
-
Processes:
pro2588.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro2588.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro2588.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro2588.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro2588.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro2588.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro2588.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/2592-191-0x0000000004CE0000-0x0000000004D1F000-memory.dmp family_redline behavioral1/memory/2592-192-0x0000000004CE0000-0x0000000004D1F000-memory.dmp family_redline behavioral1/memory/2592-194-0x0000000004CE0000-0x0000000004D1F000-memory.dmp family_redline behavioral1/memory/2592-196-0x0000000004CE0000-0x0000000004D1F000-memory.dmp family_redline behavioral1/memory/2592-200-0x0000000004CE0000-0x0000000004D1F000-memory.dmp family_redline behavioral1/memory/2592-204-0x0000000004CE0000-0x0000000004D1F000-memory.dmp family_redline behavioral1/memory/2592-206-0x0000000004CE0000-0x0000000004D1F000-memory.dmp family_redline behavioral1/memory/2592-208-0x0000000004CE0000-0x0000000004D1F000-memory.dmp family_redline behavioral1/memory/2592-210-0x0000000004CE0000-0x0000000004D1F000-memory.dmp family_redline behavioral1/memory/2592-212-0x0000000004CE0000-0x0000000004D1F000-memory.dmp family_redline behavioral1/memory/2592-214-0x0000000004CE0000-0x0000000004D1F000-memory.dmp family_redline behavioral1/memory/2592-216-0x0000000004CE0000-0x0000000004D1F000-memory.dmp family_redline behavioral1/memory/2592-218-0x0000000004CE0000-0x0000000004D1F000-memory.dmp family_redline behavioral1/memory/2592-220-0x0000000004CE0000-0x0000000004D1F000-memory.dmp family_redline behavioral1/memory/2592-222-0x0000000004CE0000-0x0000000004D1F000-memory.dmp family_redline behavioral1/memory/2592-224-0x0000000004CE0000-0x0000000004D1F000-memory.dmp family_redline behavioral1/memory/2592-226-0x0000000004CE0000-0x0000000004D1F000-memory.dmp family_redline behavioral1/memory/2592-228-0x0000000004CE0000-0x0000000004D1F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un365592.exepro2588.exequ0637.exesi487939.exepid process 4652 un365592.exe 2348 pro2588.exe 2592 qu0637.exe 1668 si487939.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro2588.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro2588.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro2588.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
d2ac0ea944e85fd10acd8b02cb9c4ffc8e0da7c2a9dfd3e02097328a35757602.exeun365592.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce d2ac0ea944e85fd10acd8b02cb9c4ffc8e0da7c2a9dfd3e02097328a35757602.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" d2ac0ea944e85fd10acd8b02cb9c4ffc8e0da7c2a9dfd3e02097328a35757602.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un365592.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un365592.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4840 2348 WerFault.exe pro2588.exe 2040 2592 WerFault.exe qu0637.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro2588.exequ0637.exesi487939.exepid process 2348 pro2588.exe 2348 pro2588.exe 2592 qu0637.exe 2592 qu0637.exe 1668 si487939.exe 1668 si487939.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro2588.exequ0637.exesi487939.exedescription pid process Token: SeDebugPrivilege 2348 pro2588.exe Token: SeDebugPrivilege 2592 qu0637.exe Token: SeDebugPrivilege 1668 si487939.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
d2ac0ea944e85fd10acd8b02cb9c4ffc8e0da7c2a9dfd3e02097328a35757602.exeun365592.exedescription pid process target process PID 4640 wrote to memory of 4652 4640 d2ac0ea944e85fd10acd8b02cb9c4ffc8e0da7c2a9dfd3e02097328a35757602.exe un365592.exe PID 4640 wrote to memory of 4652 4640 d2ac0ea944e85fd10acd8b02cb9c4ffc8e0da7c2a9dfd3e02097328a35757602.exe un365592.exe PID 4640 wrote to memory of 4652 4640 d2ac0ea944e85fd10acd8b02cb9c4ffc8e0da7c2a9dfd3e02097328a35757602.exe un365592.exe PID 4652 wrote to memory of 2348 4652 un365592.exe pro2588.exe PID 4652 wrote to memory of 2348 4652 un365592.exe pro2588.exe PID 4652 wrote to memory of 2348 4652 un365592.exe pro2588.exe PID 4652 wrote to memory of 2592 4652 un365592.exe qu0637.exe PID 4652 wrote to memory of 2592 4652 un365592.exe qu0637.exe PID 4652 wrote to memory of 2592 4652 un365592.exe qu0637.exe PID 4640 wrote to memory of 1668 4640 d2ac0ea944e85fd10acd8b02cb9c4ffc8e0da7c2a9dfd3e02097328a35757602.exe si487939.exe PID 4640 wrote to memory of 1668 4640 d2ac0ea944e85fd10acd8b02cb9c4ffc8e0da7c2a9dfd3e02097328a35757602.exe si487939.exe PID 4640 wrote to memory of 1668 4640 d2ac0ea944e85fd10acd8b02cb9c4ffc8e0da7c2a9dfd3e02097328a35757602.exe si487939.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d2ac0ea944e85fd10acd8b02cb9c4ffc8e0da7c2a9dfd3e02097328a35757602.exe"C:\Users\Admin\AppData\Local\Temp\d2ac0ea944e85fd10acd8b02cb9c4ffc8e0da7c2a9dfd3e02097328a35757602.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un365592.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un365592.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2588.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2588.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2348 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 10844⤵
- Program crash
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0637.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0637.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2592 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 13524⤵
- Program crash
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si487939.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si487939.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1668
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2348 -ip 23481⤵PID:4564
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2592 -ip 25921⤵PID:2056
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si487939.exeFilesize
175KB
MD5455e97a8ec7dcaebebc91cf0a8efa395
SHA12eba160896aaa86dc759b71d63e7f874980f5e8c
SHA25628710426920fcd1daa3168c4e85f26d028c74c1e3e645b25f953a8a554802a8f
SHA5124446350e67ad226f5fcfb96ed54800a529b37fa7b4b10580b28626d2c4bcabcd684f99f67a142e62f20bbe937159e4bd307625f4d3b84338113eed04aa8ef4f4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si487939.exeFilesize
175KB
MD5455e97a8ec7dcaebebc91cf0a8efa395
SHA12eba160896aaa86dc759b71d63e7f874980f5e8c
SHA25628710426920fcd1daa3168c4e85f26d028c74c1e3e645b25f953a8a554802a8f
SHA5124446350e67ad226f5fcfb96ed54800a529b37fa7b4b10580b28626d2c4bcabcd684f99f67a142e62f20bbe937159e4bd307625f4d3b84338113eed04aa8ef4f4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un365592.exeFilesize
556KB
MD5416b6214e745b8a20785d826c3d65ea9
SHA162345545897372e72c8b98cb4e8234b37f73399e
SHA2566ace2804212329ef38d8c90a5a47531683b95d56f629ac67d80eac8e60c0aba7
SHA51297bd7e513dff8143156aab12c0a3f1fca4ffb718d35618198c89cace269e812665977ce08945ff2eaee5d076110f8bc44eb6b6e246577ed8474ae56bcabffd69
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un365592.exeFilesize
556KB
MD5416b6214e745b8a20785d826c3d65ea9
SHA162345545897372e72c8b98cb4e8234b37f73399e
SHA2566ace2804212329ef38d8c90a5a47531683b95d56f629ac67d80eac8e60c0aba7
SHA51297bd7e513dff8143156aab12c0a3f1fca4ffb718d35618198c89cace269e812665977ce08945ff2eaee5d076110f8bc44eb6b6e246577ed8474ae56bcabffd69
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2588.exeFilesize
347KB
MD530051669927c23e8ab82fb26533ed52e
SHA1195e29dbfc75fc6864649cb41bdde43a39a4623e
SHA2562c4bb7a055382c16fba3caeddd44133fa315a3a627e00ccffbd69f6e4132b8db
SHA51293f1d6930ce07299bd618e9d544d22f6b9be9b02fcc02351612a77b5b2a07b32f3ac052ed423974c9d46be3625d40385a10f408d5be3192dae0acfb022822495
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2588.exeFilesize
347KB
MD530051669927c23e8ab82fb26533ed52e
SHA1195e29dbfc75fc6864649cb41bdde43a39a4623e
SHA2562c4bb7a055382c16fba3caeddd44133fa315a3a627e00ccffbd69f6e4132b8db
SHA51293f1d6930ce07299bd618e9d544d22f6b9be9b02fcc02351612a77b5b2a07b32f3ac052ed423974c9d46be3625d40385a10f408d5be3192dae0acfb022822495
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0637.exeFilesize
406KB
MD582deda38d86fb615ccd6991e78532934
SHA1e01dcfa04217f0ddaaf323578854f03262a66150
SHA2561d5743b3a461c6741746b00dd5cd1be8521065fd3079e3b123083c5364b67c0e
SHA512cec26a62eff1b24d5335b832243bcfe42faccdef32adfd7481f185386e5f44c1ff172166fded3c2d10439f2fa9c8af2ce1919dea3b0100c4f9cffc94cc908d51
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0637.exeFilesize
406KB
MD582deda38d86fb615ccd6991e78532934
SHA1e01dcfa04217f0ddaaf323578854f03262a66150
SHA2561d5743b3a461c6741746b00dd5cd1be8521065fd3079e3b123083c5364b67c0e
SHA512cec26a62eff1b24d5335b832243bcfe42faccdef32adfd7481f185386e5f44c1ff172166fded3c2d10439f2fa9c8af2ce1919dea3b0100c4f9cffc94cc908d51
-
memory/1668-1121-0x0000000000FE0000-0x0000000001012000-memory.dmpFilesize
200KB
-
memory/1668-1122-0x0000000005940000-0x0000000005950000-memory.dmpFilesize
64KB
-
memory/1668-1123-0x0000000005940000-0x0000000005950000-memory.dmpFilesize
64KB
-
memory/2348-163-0x0000000004D90000-0x0000000004DA0000-memory.dmpFilesize
64KB
-
memory/2348-172-0x0000000004B90000-0x0000000004BA2000-memory.dmpFilesize
72KB
-
memory/2348-154-0x0000000004B90000-0x0000000004BA2000-memory.dmpFilesize
72KB
-
memory/2348-156-0x0000000004B90000-0x0000000004BA2000-memory.dmpFilesize
72KB
-
memory/2348-158-0x0000000004B90000-0x0000000004BA2000-memory.dmpFilesize
72KB
-
memory/2348-161-0x0000000002B90000-0x0000000002BBD000-memory.dmpFilesize
180KB
-
memory/2348-160-0x0000000004B90000-0x0000000004BA2000-memory.dmpFilesize
72KB
-
memory/2348-150-0x0000000004B90000-0x0000000004BA2000-memory.dmpFilesize
72KB
-
memory/2348-165-0x0000000004D90000-0x0000000004DA0000-memory.dmpFilesize
64KB
-
memory/2348-164-0x0000000004B90000-0x0000000004BA2000-memory.dmpFilesize
72KB
-
memory/2348-167-0x0000000004B90000-0x0000000004BA2000-memory.dmpFilesize
72KB
-
memory/2348-170-0x0000000004B90000-0x0000000004BA2000-memory.dmpFilesize
72KB
-
memory/2348-168-0x0000000004D90000-0x0000000004DA0000-memory.dmpFilesize
64KB
-
memory/2348-152-0x0000000004B90000-0x0000000004BA2000-memory.dmpFilesize
72KB
-
memory/2348-174-0x0000000004B90000-0x0000000004BA2000-memory.dmpFilesize
72KB
-
memory/2348-176-0x0000000004B90000-0x0000000004BA2000-memory.dmpFilesize
72KB
-
memory/2348-178-0x0000000004B90000-0x0000000004BA2000-memory.dmpFilesize
72KB
-
memory/2348-180-0x0000000004B90000-0x0000000004BA2000-memory.dmpFilesize
72KB
-
memory/2348-181-0x0000000000400000-0x0000000002B84000-memory.dmpFilesize
39.5MB
-
memory/2348-183-0x0000000004D90000-0x0000000004DA0000-memory.dmpFilesize
64KB
-
memory/2348-184-0x0000000004D90000-0x0000000004DA0000-memory.dmpFilesize
64KB
-
memory/2348-185-0x0000000004D90000-0x0000000004DA0000-memory.dmpFilesize
64KB
-
memory/2348-186-0x0000000000400000-0x0000000002B84000-memory.dmpFilesize
39.5MB
-
memory/2348-149-0x0000000004B90000-0x0000000004BA2000-memory.dmpFilesize
72KB
-
memory/2348-148-0x00000000071F0000-0x0000000007794000-memory.dmpFilesize
5.6MB
-
memory/2592-194-0x0000000004CE0000-0x0000000004D1F000-memory.dmpFilesize
252KB
-
memory/2592-197-0x0000000002BA0000-0x0000000002BEB000-memory.dmpFilesize
300KB
-
memory/2592-196-0x0000000004CE0000-0x0000000004D1F000-memory.dmpFilesize
252KB
-
memory/2592-200-0x0000000004CE0000-0x0000000004D1F000-memory.dmpFilesize
252KB
-
memory/2592-201-0x0000000004F20000-0x0000000004F30000-memory.dmpFilesize
64KB
-
memory/2592-203-0x0000000004F20000-0x0000000004F30000-memory.dmpFilesize
64KB
-
memory/2592-204-0x0000000004CE0000-0x0000000004D1F000-memory.dmpFilesize
252KB
-
memory/2592-199-0x0000000004F20000-0x0000000004F30000-memory.dmpFilesize
64KB
-
memory/2592-206-0x0000000004CE0000-0x0000000004D1F000-memory.dmpFilesize
252KB
-
memory/2592-208-0x0000000004CE0000-0x0000000004D1F000-memory.dmpFilesize
252KB
-
memory/2592-210-0x0000000004CE0000-0x0000000004D1F000-memory.dmpFilesize
252KB
-
memory/2592-212-0x0000000004CE0000-0x0000000004D1F000-memory.dmpFilesize
252KB
-
memory/2592-214-0x0000000004CE0000-0x0000000004D1F000-memory.dmpFilesize
252KB
-
memory/2592-216-0x0000000004CE0000-0x0000000004D1F000-memory.dmpFilesize
252KB
-
memory/2592-218-0x0000000004CE0000-0x0000000004D1F000-memory.dmpFilesize
252KB
-
memory/2592-220-0x0000000004CE0000-0x0000000004D1F000-memory.dmpFilesize
252KB
-
memory/2592-222-0x0000000004CE0000-0x0000000004D1F000-memory.dmpFilesize
252KB
-
memory/2592-224-0x0000000004CE0000-0x0000000004D1F000-memory.dmpFilesize
252KB
-
memory/2592-226-0x0000000004CE0000-0x0000000004D1F000-memory.dmpFilesize
252KB
-
memory/2592-228-0x0000000004CE0000-0x0000000004D1F000-memory.dmpFilesize
252KB
-
memory/2592-1101-0x0000000007930000-0x0000000007F48000-memory.dmpFilesize
6.1MB
-
memory/2592-1102-0x0000000007F80000-0x000000000808A000-memory.dmpFilesize
1.0MB
-
memory/2592-1103-0x00000000080C0000-0x00000000080D2000-memory.dmpFilesize
72KB
-
memory/2592-1104-0x00000000080E0000-0x000000000811C000-memory.dmpFilesize
240KB
-
memory/2592-1105-0x0000000004F20000-0x0000000004F30000-memory.dmpFilesize
64KB
-
memory/2592-1107-0x00000000083D0000-0x0000000008462000-memory.dmpFilesize
584KB
-
memory/2592-1108-0x0000000008470000-0x00000000084D6000-memory.dmpFilesize
408KB
-
memory/2592-1109-0x0000000004F20000-0x0000000004F30000-memory.dmpFilesize
64KB
-
memory/2592-1110-0x0000000004F20000-0x0000000004F30000-memory.dmpFilesize
64KB
-
memory/2592-1111-0x0000000008C80000-0x0000000008CF6000-memory.dmpFilesize
472KB
-
memory/2592-1112-0x0000000008D00000-0x0000000008D50000-memory.dmpFilesize
320KB
-
memory/2592-192-0x0000000004CE0000-0x0000000004D1F000-memory.dmpFilesize
252KB
-
memory/2592-191-0x0000000004CE0000-0x0000000004D1F000-memory.dmpFilesize
252KB
-
memory/2592-1113-0x0000000004F20000-0x0000000004F30000-memory.dmpFilesize
64KB
-
memory/2592-1114-0x0000000008DB0000-0x0000000008F72000-memory.dmpFilesize
1.8MB
-
memory/2592-1115-0x0000000008F80000-0x00000000094AC000-memory.dmpFilesize
5.2MB