Analysis
-
max time kernel
113s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 10:33
Static task
static1
Behavioral task
behavioral1
Sample
c2117105abafa7f12051d5056cec5136522949e7484361aabcc8214c32f79399.exe
Resource
win10v2004-20230220-en
General
-
Target
c2117105abafa7f12051d5056cec5136522949e7484361aabcc8214c32f79399.exe
-
Size
697KB
-
MD5
b795cee8daabd227e1e8875346679718
-
SHA1
cc7e78dbb0168a92b036f9c1ae0b6c6085c813dd
-
SHA256
c2117105abafa7f12051d5056cec5136522949e7484361aabcc8214c32f79399
-
SHA512
f1b28ab80d9f66dc0b7b271ab83ea9770ee7464d4f046221d5d877d2858fbbeca93ca2bb41687c4875787e2378d1ec77289c64bd41dfa8da5d8b00fd8e694383
-
SSDEEP
12288:ZMrdy901HApM3oMT42OBGOnbiGTHv8SCn1gkRQPP5/L6ziGjFAxI9gokIybTs:syMAO3EZBhbNLv8SC1gkRiP1jGjWI9d1
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
muse
176.113.115.145:4125
-
auth_value
b91988a63a24940038d9262827a5320c
Signatures
-
Processes:
pro1323.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro1323.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro1323.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro1323.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro1323.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro1323.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro1323.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/4648-191-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/4648-192-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/4648-194-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/4648-196-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/4648-198-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/4648-200-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/4648-202-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/4648-204-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/4648-206-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/4648-208-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/4648-210-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/4648-212-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/4648-215-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/4648-217-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/4648-219-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/4648-221-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/4648-223-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/4648-225-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un598806.exepro1323.exequ1904.exesi127229.exepid process 3240 un598806.exe 3692 pro1323.exe 4648 qu1904.exe 1952 si127229.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro1323.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro1323.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro1323.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
c2117105abafa7f12051d5056cec5136522949e7484361aabcc8214c32f79399.exeun598806.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce c2117105abafa7f12051d5056cec5136522949e7484361aabcc8214c32f79399.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c2117105abafa7f12051d5056cec5136522949e7484361aabcc8214c32f79399.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un598806.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un598806.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4168 3692 WerFault.exe pro1323.exe 112 4648 WerFault.exe qu1904.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro1323.exequ1904.exesi127229.exepid process 3692 pro1323.exe 3692 pro1323.exe 4648 qu1904.exe 4648 qu1904.exe 1952 si127229.exe 1952 si127229.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro1323.exequ1904.exesi127229.exedescription pid process Token: SeDebugPrivilege 3692 pro1323.exe Token: SeDebugPrivilege 4648 qu1904.exe Token: SeDebugPrivilege 1952 si127229.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
c2117105abafa7f12051d5056cec5136522949e7484361aabcc8214c32f79399.exeun598806.exedescription pid process target process PID 1788 wrote to memory of 3240 1788 c2117105abafa7f12051d5056cec5136522949e7484361aabcc8214c32f79399.exe un598806.exe PID 1788 wrote to memory of 3240 1788 c2117105abafa7f12051d5056cec5136522949e7484361aabcc8214c32f79399.exe un598806.exe PID 1788 wrote to memory of 3240 1788 c2117105abafa7f12051d5056cec5136522949e7484361aabcc8214c32f79399.exe un598806.exe PID 3240 wrote to memory of 3692 3240 un598806.exe pro1323.exe PID 3240 wrote to memory of 3692 3240 un598806.exe pro1323.exe PID 3240 wrote to memory of 3692 3240 un598806.exe pro1323.exe PID 3240 wrote to memory of 4648 3240 un598806.exe qu1904.exe PID 3240 wrote to memory of 4648 3240 un598806.exe qu1904.exe PID 3240 wrote to memory of 4648 3240 un598806.exe qu1904.exe PID 1788 wrote to memory of 1952 1788 c2117105abafa7f12051d5056cec5136522949e7484361aabcc8214c32f79399.exe si127229.exe PID 1788 wrote to memory of 1952 1788 c2117105abafa7f12051d5056cec5136522949e7484361aabcc8214c32f79399.exe si127229.exe PID 1788 wrote to memory of 1952 1788 c2117105abafa7f12051d5056cec5136522949e7484361aabcc8214c32f79399.exe si127229.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2117105abafa7f12051d5056cec5136522949e7484361aabcc8214c32f79399.exe"C:\Users\Admin\AppData\Local\Temp\c2117105abafa7f12051d5056cec5136522949e7484361aabcc8214c32f79399.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un598806.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un598806.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1323.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1323.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3692 -s 10804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1904.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1904.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 13404⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si127229.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si127229.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3692 -ip 36921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4648 -ip 46481⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si127229.exeFilesize
175KB
MD518e680afbb6784976f1ba2a835a3830f
SHA1dc62f384b2f6ece4d05111cd5d8ba8692ebc1d2b
SHA2567524eeb566b99d316768f4512f80534cac832a26fb3af29f648e9f692b125dd3
SHA512b3d948c7a6179fdf6faa8f425f6db5dc249ce952948f0f71567c5450b447ea705bc0f2a7d47e9bd4c5dea406857fcde9e9f3a446650a848f35de4862d54fd8cd
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si127229.exeFilesize
175KB
MD518e680afbb6784976f1ba2a835a3830f
SHA1dc62f384b2f6ece4d05111cd5d8ba8692ebc1d2b
SHA2567524eeb566b99d316768f4512f80534cac832a26fb3af29f648e9f692b125dd3
SHA512b3d948c7a6179fdf6faa8f425f6db5dc249ce952948f0f71567c5450b447ea705bc0f2a7d47e9bd4c5dea406857fcde9e9f3a446650a848f35de4862d54fd8cd
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un598806.exeFilesize
555KB
MD5de49a691eb24e24424d8a55a3689afbd
SHA1a4867795df755e441afac38c678756f90ee16e83
SHA2564aaef764032412026349f3fe93a86414784e574d615843ad9ff0de415981d4c7
SHA51240cb0740a800648300b710136dffdde55f6fb7060dba04c2d2e38a9b12ed9f48f9a1ccb2fa88953003feb228e165fce8f34a9349d54ad49a63577060258c38c7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un598806.exeFilesize
555KB
MD5de49a691eb24e24424d8a55a3689afbd
SHA1a4867795df755e441afac38c678756f90ee16e83
SHA2564aaef764032412026349f3fe93a86414784e574d615843ad9ff0de415981d4c7
SHA51240cb0740a800648300b710136dffdde55f6fb7060dba04c2d2e38a9b12ed9f48f9a1ccb2fa88953003feb228e165fce8f34a9349d54ad49a63577060258c38c7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1323.exeFilesize
347KB
MD5b4ace5d1b3d2ac064621095b75f0fd5b
SHA1c869013032c6e0c4da0071e49630103f82c00510
SHA256f569d39847b671e33de050752a5ea769b9dbfe158a7912c53a09b7de29b70631
SHA5125fd27958914b405dd1d4ac4cfc6cac21cb5e3038eceab13c6dbd5ace1449724d9de26436e2471120a6c2c2c54ee0c74de834c0b0ae17f6edbfc1d2ba73e71fd5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1323.exeFilesize
347KB
MD5b4ace5d1b3d2ac064621095b75f0fd5b
SHA1c869013032c6e0c4da0071e49630103f82c00510
SHA256f569d39847b671e33de050752a5ea769b9dbfe158a7912c53a09b7de29b70631
SHA5125fd27958914b405dd1d4ac4cfc6cac21cb5e3038eceab13c6dbd5ace1449724d9de26436e2471120a6c2c2c54ee0c74de834c0b0ae17f6edbfc1d2ba73e71fd5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1904.exeFilesize
406KB
MD50663461d5147fe43f8c6838cc75e0738
SHA1965fa31bc0e47e73e8a7c7f70810471a1a2d93e9
SHA256f2146235d57f88f4c6af71feb1265fc297c8e58ee702b9ef235b3163c97bbc9f
SHA512f140796cf1d64d3aa70b9e66cfcdb6a0db1d344d047f14a636a0aea63c490cecc0cd9783e3e7d6a5dc9c0123a78d8c851658c2bac941e56c356695c7154ac65f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1904.exeFilesize
406KB
MD50663461d5147fe43f8c6838cc75e0738
SHA1965fa31bc0e47e73e8a7c7f70810471a1a2d93e9
SHA256f2146235d57f88f4c6af71feb1265fc297c8e58ee702b9ef235b3163c97bbc9f
SHA512f140796cf1d64d3aa70b9e66cfcdb6a0db1d344d047f14a636a0aea63c490cecc0cd9783e3e7d6a5dc9c0123a78d8c851658c2bac941e56c356695c7154ac65f
-
memory/1952-1118-0x0000000000A30000-0x0000000000A62000-memory.dmpFilesize
200KB
-
memory/1952-1119-0x0000000005620000-0x0000000005630000-memory.dmpFilesize
64KB
-
memory/3692-185-0x0000000000400000-0x0000000002B84000-memory.dmpFilesize
39.5MB
-
memory/3692-150-0x0000000007290000-0x00000000072A0000-memory.dmpFilesize
64KB
-
memory/3692-151-0x0000000007290000-0x00000000072A0000-memory.dmpFilesize
64KB
-
memory/3692-152-0x0000000007290000-0x00000000072A0000-memory.dmpFilesize
64KB
-
memory/3692-153-0x0000000004CC0000-0x0000000004CD2000-memory.dmpFilesize
72KB
-
memory/3692-154-0x0000000004CC0000-0x0000000004CD2000-memory.dmpFilesize
72KB
-
memory/3692-156-0x0000000004CC0000-0x0000000004CD2000-memory.dmpFilesize
72KB
-
memory/3692-158-0x0000000004CC0000-0x0000000004CD2000-memory.dmpFilesize
72KB
-
memory/3692-160-0x0000000004CC0000-0x0000000004CD2000-memory.dmpFilesize
72KB
-
memory/3692-162-0x0000000004CC0000-0x0000000004CD2000-memory.dmpFilesize
72KB
-
memory/3692-164-0x0000000004CC0000-0x0000000004CD2000-memory.dmpFilesize
72KB
-
memory/3692-168-0x0000000004CC0000-0x0000000004CD2000-memory.dmpFilesize
72KB
-
memory/3692-170-0x0000000004CC0000-0x0000000004CD2000-memory.dmpFilesize
72KB
-
memory/3692-166-0x0000000004CC0000-0x0000000004CD2000-memory.dmpFilesize
72KB
-
memory/3692-174-0x0000000004CC0000-0x0000000004CD2000-memory.dmpFilesize
72KB
-
memory/3692-172-0x0000000004CC0000-0x0000000004CD2000-memory.dmpFilesize
72KB
-
memory/3692-180-0x0000000004CC0000-0x0000000004CD2000-memory.dmpFilesize
72KB
-
memory/3692-178-0x0000000004CC0000-0x0000000004CD2000-memory.dmpFilesize
72KB
-
memory/3692-176-0x0000000004CC0000-0x0000000004CD2000-memory.dmpFilesize
72KB
-
memory/3692-181-0x0000000000400000-0x0000000002B84000-memory.dmpFilesize
39.5MB
-
memory/3692-182-0x0000000007290000-0x00000000072A0000-memory.dmpFilesize
64KB
-
memory/3692-183-0x0000000007290000-0x00000000072A0000-memory.dmpFilesize
64KB
-
memory/3692-149-0x00000000072A0000-0x0000000007844000-memory.dmpFilesize
5.6MB
-
memory/3692-148-0x0000000002C60000-0x0000000002C8D000-memory.dmpFilesize
180KB
-
memory/4648-200-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/4648-223-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/4648-194-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/4648-196-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/4648-198-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/4648-191-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/4648-202-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/4648-204-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/4648-206-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/4648-208-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/4648-210-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/4648-212-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/4648-213-0x0000000007280000-0x0000000007290000-memory.dmpFilesize
64KB
-
memory/4648-215-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/4648-217-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/4648-219-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/4648-221-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/4648-192-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/4648-225-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/4648-1098-0x0000000007840000-0x0000000007E58000-memory.dmpFilesize
6.1MB
-
memory/4648-1099-0x0000000007E60000-0x0000000007F6A000-memory.dmpFilesize
1.0MB
-
memory/4648-1100-0x0000000007F80000-0x0000000007F92000-memory.dmpFilesize
72KB
-
memory/4648-1101-0x0000000007FA0000-0x0000000007FDC000-memory.dmpFilesize
240KB
-
memory/4648-1102-0x0000000007280000-0x0000000007290000-memory.dmpFilesize
64KB
-
memory/4648-1104-0x0000000007280000-0x0000000007290000-memory.dmpFilesize
64KB
-
memory/4648-1105-0x0000000008290000-0x0000000008322000-memory.dmpFilesize
584KB
-
memory/4648-1106-0x0000000008330000-0x0000000008396000-memory.dmpFilesize
408KB
-
memory/4648-1107-0x0000000008A50000-0x0000000008C12000-memory.dmpFilesize
1.8MB
-
memory/4648-1108-0x0000000008C30000-0x000000000915C000-memory.dmpFilesize
5.2MB
-
memory/4648-190-0x0000000002BA0000-0x0000000002BEB000-memory.dmpFilesize
300KB
-
memory/4648-1109-0x00000000094F0000-0x0000000009566000-memory.dmpFilesize
472KB
-
memory/4648-1110-0x0000000009570000-0x00000000095C0000-memory.dmpFilesize
320KB
-
memory/4648-1111-0x0000000007280000-0x0000000007290000-memory.dmpFilesize
64KB