Analysis
-
max time kernel
143s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 10:35
Static task
static1
Behavioral task
behavioral1
Sample
c016e628270d6b742daa760567c342832962177cb243a10eda1370d8ba827aaf.exe
Resource
win10v2004-20230220-en
General
-
Target
c016e628270d6b742daa760567c342832962177cb243a10eda1370d8ba827aaf.exe
-
Size
698KB
-
MD5
1317180aae8f24b62bd407f6dc74c574
-
SHA1
79ee2bb98f83f7da9516f4602b6907bcc9937c0b
-
SHA256
c016e628270d6b742daa760567c342832962177cb243a10eda1370d8ba827aaf
-
SHA512
a9645eb122a4e95c5b02eaeb42e4726dc1569150e8a6e37c09ea78c8253f61a189c8b7ca0f6a092690134f01aa41737dd5aab6e5315532739a8a1e60df4772e4
-
SSDEEP
12288:AMrQy906C83jfyFUvE8y/z1rgZeeqL65FGjDAxI9gypsjtEY8:Ay5R8UvEXZrMyuGjgI9l6iY8
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
muse
176.113.115.145:4125
-
auth_value
b91988a63a24940038d9262827a5320c
Signatures
-
Processes:
pro5768.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro5768.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro5768.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro5768.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro5768.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro5768.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro5768.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/64-194-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/64-195-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/64-197-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/64-199-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/64-201-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/64-203-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/64-205-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/64-207-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/64-209-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/64-211-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/64-213-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/64-215-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/64-217-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/64-219-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/64-221-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/64-223-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/64-225-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/64-227-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un183570.exepro5768.exequ2633.exesi159112.exepid process 1264 un183570.exe 1012 pro5768.exe 64 qu2633.exe 2656 si159112.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro5768.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro5768.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro5768.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
c016e628270d6b742daa760567c342832962177cb243a10eda1370d8ba827aaf.exeun183570.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c016e628270d6b742daa760567c342832962177cb243a10eda1370d8ba827aaf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un183570.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un183570.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce c016e628270d6b742daa760567c342832962177cb243a10eda1370d8ba827aaf.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 1952 sc.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4716 1012 WerFault.exe pro5768.exe 2684 64 WerFault.exe qu2633.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro5768.exequ2633.exesi159112.exepid process 1012 pro5768.exe 1012 pro5768.exe 64 qu2633.exe 64 qu2633.exe 2656 si159112.exe 2656 si159112.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro5768.exequ2633.exesi159112.exedescription pid process Token: SeDebugPrivilege 1012 pro5768.exe Token: SeDebugPrivilege 64 qu2633.exe Token: SeDebugPrivilege 2656 si159112.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
c016e628270d6b742daa760567c342832962177cb243a10eda1370d8ba827aaf.exeun183570.exedescription pid process target process PID 4228 wrote to memory of 1264 4228 c016e628270d6b742daa760567c342832962177cb243a10eda1370d8ba827aaf.exe un183570.exe PID 4228 wrote to memory of 1264 4228 c016e628270d6b742daa760567c342832962177cb243a10eda1370d8ba827aaf.exe un183570.exe PID 4228 wrote to memory of 1264 4228 c016e628270d6b742daa760567c342832962177cb243a10eda1370d8ba827aaf.exe un183570.exe PID 1264 wrote to memory of 1012 1264 un183570.exe pro5768.exe PID 1264 wrote to memory of 1012 1264 un183570.exe pro5768.exe PID 1264 wrote to memory of 1012 1264 un183570.exe pro5768.exe PID 1264 wrote to memory of 64 1264 un183570.exe qu2633.exe PID 1264 wrote to memory of 64 1264 un183570.exe qu2633.exe PID 1264 wrote to memory of 64 1264 un183570.exe qu2633.exe PID 4228 wrote to memory of 2656 4228 c016e628270d6b742daa760567c342832962177cb243a10eda1370d8ba827aaf.exe si159112.exe PID 4228 wrote to memory of 2656 4228 c016e628270d6b742daa760567c342832962177cb243a10eda1370d8ba827aaf.exe si159112.exe PID 4228 wrote to memory of 2656 4228 c016e628270d6b742daa760567c342832962177cb243a10eda1370d8ba827aaf.exe si159112.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c016e628270d6b742daa760567c342832962177cb243a10eda1370d8ba827aaf.exe"C:\Users\Admin\AppData\Local\Temp\c016e628270d6b742daa760567c342832962177cb243a10eda1370d8ba827aaf.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un183570.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un183570.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5768.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5768.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1012 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 10964⤵
- Program crash
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2633.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2633.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:64 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 64 -s 15524⤵
- Program crash
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si159112.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si159112.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2656
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1012 -ip 10121⤵PID:3472
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 64 -ip 641⤵PID:1336
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
PID:1952
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si159112.exeFilesize
175KB
MD5d6d2148ff82775faa3087d20a64d1276
SHA17c2d4fbda5f467cae8f48a487d70bec94c9983a2
SHA2567ab27b9d8e0f1c96b2fdb3d954432f564c44194ced01e59905473b6e949de0c8
SHA512d52d079d5a7d3dc7c15c060101fbe38565e6169ae5044ddb37a8bcdd10c53286d8d1372ed6d37410bf885927e602535f359db804ab9a7cc9cb2271f130605607
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si159112.exeFilesize
175KB
MD5d6d2148ff82775faa3087d20a64d1276
SHA17c2d4fbda5f467cae8f48a487d70bec94c9983a2
SHA2567ab27b9d8e0f1c96b2fdb3d954432f564c44194ced01e59905473b6e949de0c8
SHA512d52d079d5a7d3dc7c15c060101fbe38565e6169ae5044ddb37a8bcdd10c53286d8d1372ed6d37410bf885927e602535f359db804ab9a7cc9cb2271f130605607
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un183570.exeFilesize
556KB
MD5adc2ed745b6504ee7fbaab1bbd356be8
SHA195b981db69f41494daeaf0a92052116f032e75df
SHA256f4053108eabc827a6a789af11031576b47838b4c1b4bea8087b42e22e0365add
SHA512ed76d6f767bb8a4e6f3086ef490143cd29867870105c6a44cea2a336cd6e6786f9f6421c82a7ac37daab3b75461d0d202e229f152e883954a685ad4532b16373
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un183570.exeFilesize
556KB
MD5adc2ed745b6504ee7fbaab1bbd356be8
SHA195b981db69f41494daeaf0a92052116f032e75df
SHA256f4053108eabc827a6a789af11031576b47838b4c1b4bea8087b42e22e0365add
SHA512ed76d6f767bb8a4e6f3086ef490143cd29867870105c6a44cea2a336cd6e6786f9f6421c82a7ac37daab3b75461d0d202e229f152e883954a685ad4532b16373
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5768.exeFilesize
347KB
MD5b4efd9e89ac2f0f0100b34f57e48d150
SHA15a49c3a0c363cd9dd9648d82ef358233694a1da1
SHA2562d6ed3d8c96acb04e5441b0c3b4ae2838d66e1a069b5b28179c199c9d0fbf9d0
SHA512f05a3201df41ea9047d052182c8f67fc20938b2bb21bd4947bcf1a0e2757c007b9adb9ca635ab380597682d5d014de96a0bacd63ea35c8e1fbeda44dcabda155
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5768.exeFilesize
347KB
MD5b4efd9e89ac2f0f0100b34f57e48d150
SHA15a49c3a0c363cd9dd9648d82ef358233694a1da1
SHA2562d6ed3d8c96acb04e5441b0c3b4ae2838d66e1a069b5b28179c199c9d0fbf9d0
SHA512f05a3201df41ea9047d052182c8f67fc20938b2bb21bd4947bcf1a0e2757c007b9adb9ca635ab380597682d5d014de96a0bacd63ea35c8e1fbeda44dcabda155
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2633.exeFilesize
406KB
MD59839e1234242f0802e2a8d26a93999e5
SHA15c16c9907d7f6b96913caf95b8ce01b1b2877f06
SHA256df11edfe151e660751bec88088f225f1f641f28cb78a144889758d4ef50b7ffb
SHA5120184de6f8b306eedfbad55b0089fe1f6303ad9e82d5d7837efad500ae53c6ceb9b8612d644db3e271187d624caa6b595b569f224f50b2003d77cfbda0844e822
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2633.exeFilesize
406KB
MD59839e1234242f0802e2a8d26a93999e5
SHA15c16c9907d7f6b96913caf95b8ce01b1b2877f06
SHA256df11edfe151e660751bec88088f225f1f641f28cb78a144889758d4ef50b7ffb
SHA5120184de6f8b306eedfbad55b0089fe1f6303ad9e82d5d7837efad500ae53c6ceb9b8612d644db3e271187d624caa6b595b569f224f50b2003d77cfbda0844e822
-
memory/64-227-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/64-1102-0x0000000004E80000-0x0000000004E92000-memory.dmpFilesize
72KB
-
memory/64-1115-0x0000000009560000-0x00000000095B0000-memory.dmpFilesize
320KB
-
memory/64-1114-0x00000000094D0000-0x0000000009546000-memory.dmpFilesize
472KB
-
memory/64-1113-0x0000000007500000-0x0000000007510000-memory.dmpFilesize
64KB
-
memory/64-1112-0x0000000008D70000-0x000000000929C000-memory.dmpFilesize
5.2MB
-
memory/64-1111-0x0000000008BA0000-0x0000000008D62000-memory.dmpFilesize
1.8MB
-
memory/64-1110-0x0000000008470000-0x00000000084D6000-memory.dmpFilesize
408KB
-
memory/64-1108-0x0000000007500000-0x0000000007510000-memory.dmpFilesize
64KB
-
memory/64-1109-0x00000000083D0000-0x0000000008462000-memory.dmpFilesize
584KB
-
memory/64-1107-0x0000000007500000-0x0000000007510000-memory.dmpFilesize
64KB
-
memory/64-1106-0x0000000007500000-0x0000000007510000-memory.dmpFilesize
64KB
-
memory/64-1103-0x0000000007500000-0x0000000007510000-memory.dmpFilesize
64KB
-
memory/64-1104-0x0000000004EA0000-0x0000000004EDC000-memory.dmpFilesize
240KB
-
memory/64-1101-0x00000000080E0000-0x00000000081EA000-memory.dmpFilesize
1.0MB
-
memory/64-1100-0x0000000007AC0000-0x00000000080D8000-memory.dmpFilesize
6.1MB
-
memory/64-225-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/64-223-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/64-221-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/64-219-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/64-217-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/64-215-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/64-213-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/64-191-0x0000000002C70000-0x0000000002CBB000-memory.dmpFilesize
300KB
-
memory/64-192-0x0000000007500000-0x0000000007510000-memory.dmpFilesize
64KB
-
memory/64-193-0x0000000007500000-0x0000000007510000-memory.dmpFilesize
64KB
-
memory/64-194-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/64-195-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/64-197-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/64-199-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/64-201-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/64-203-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/64-205-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/64-207-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/64-209-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/64-211-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/1012-174-0x0000000007230000-0x0000000007242000-memory.dmpFilesize
72KB
-
memory/1012-160-0x0000000007230000-0x0000000007242000-memory.dmpFilesize
72KB
-
memory/1012-151-0x0000000007340000-0x0000000007350000-memory.dmpFilesize
64KB
-
memory/1012-184-0x0000000007340000-0x0000000007350000-memory.dmpFilesize
64KB
-
memory/1012-183-0x0000000007340000-0x0000000007350000-memory.dmpFilesize
64KB
-
memory/1012-182-0x0000000007340000-0x0000000007350000-memory.dmpFilesize
64KB
-
memory/1012-181-0x0000000000400000-0x0000000002B84000-memory.dmpFilesize
39.5MB
-
memory/1012-152-0x0000000007340000-0x0000000007350000-memory.dmpFilesize
64KB
-
memory/1012-180-0x0000000007230000-0x0000000007242000-memory.dmpFilesize
72KB
-
memory/1012-178-0x0000000007230000-0x0000000007242000-memory.dmpFilesize
72KB
-
memory/1012-153-0x0000000007230000-0x0000000007242000-memory.dmpFilesize
72KB
-
memory/1012-176-0x0000000007230000-0x0000000007242000-memory.dmpFilesize
72KB
-
memory/1012-186-0x0000000000400000-0x0000000002B84000-memory.dmpFilesize
39.5MB
-
memory/1012-172-0x0000000007230000-0x0000000007242000-memory.dmpFilesize
72KB
-
memory/1012-156-0x0000000007230000-0x0000000007242000-memory.dmpFilesize
72KB
-
memory/1012-168-0x0000000007230000-0x0000000007242000-memory.dmpFilesize
72KB
-
memory/1012-166-0x0000000007230000-0x0000000007242000-memory.dmpFilesize
72KB
-
memory/1012-164-0x0000000007230000-0x0000000007242000-memory.dmpFilesize
72KB
-
memory/1012-162-0x0000000007230000-0x0000000007242000-memory.dmpFilesize
72KB
-
memory/1012-150-0x0000000007340000-0x0000000007350000-memory.dmpFilesize
64KB
-
memory/1012-158-0x0000000007230000-0x0000000007242000-memory.dmpFilesize
72KB
-
memory/1012-170-0x0000000007230000-0x0000000007242000-memory.dmpFilesize
72KB
-
memory/1012-154-0x0000000007230000-0x0000000007242000-memory.dmpFilesize
72KB
-
memory/1012-149-0x0000000002B90000-0x0000000002BBD000-memory.dmpFilesize
180KB
-
memory/1012-148-0x0000000007350000-0x00000000078F4000-memory.dmpFilesize
5.6MB
-
memory/2656-1121-0x00000000000F0000-0x0000000000122000-memory.dmpFilesize
200KB
-
memory/2656-1122-0x0000000004E90000-0x0000000004EA0000-memory.dmpFilesize
64KB