Analysis
-
max time kernel
60s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 10:39
Static task
static1
Behavioral task
behavioral1
Sample
b45bc631884d0f169200a096b763d2eaaa88eef8c4a8b62b679eb8cdaca4aab9.exe
Resource
win10v2004-20230221-en
General
-
Target
b45bc631884d0f169200a096b763d2eaaa88eef8c4a8b62b679eb8cdaca4aab9.exe
-
Size
697KB
-
MD5
936e61edf1e7e2b1371c1b576a3b290d
-
SHA1
a46f5fb09b25950a4e8875abf5a390ed7e86cea6
-
SHA256
b45bc631884d0f169200a096b763d2eaaa88eef8c4a8b62b679eb8cdaca4aab9
-
SHA512
9036943aa53f0061fd0c76516cac8cd73cb44ad952c7595108fdb317e803bc81d1b23ef861989fa2c9cb994490e0b4ce11b22b3022b4f6c0d5f51ceed280e02e
-
SSDEEP
12288:/Mr7y90ytlnXMPOkLl+YlZZhrp/YPx8swPVLFL6LDGjAAxI9gJ8vL4o:cyBfu+YlZH8xdwr0GjRI900Lx
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
muse
176.113.115.145:4125
-
auth_value
b91988a63a24940038d9262827a5320c
Signatures
-
Processes:
pro8997.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro8997.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro8997.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro8997.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro8997.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro8997.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro8997.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/3848-192-0x0000000004C20000-0x0000000004C5F000-memory.dmp family_redline behavioral1/memory/3848-193-0x0000000004C20000-0x0000000004C5F000-memory.dmp family_redline behavioral1/memory/3848-195-0x0000000004C20000-0x0000000004C5F000-memory.dmp family_redline behavioral1/memory/3848-197-0x0000000004C20000-0x0000000004C5F000-memory.dmp family_redline behavioral1/memory/3848-199-0x0000000004C20000-0x0000000004C5F000-memory.dmp family_redline behavioral1/memory/3848-201-0x0000000004C20000-0x0000000004C5F000-memory.dmp family_redline behavioral1/memory/3848-204-0x0000000004C20000-0x0000000004C5F000-memory.dmp family_redline behavioral1/memory/3848-206-0x0000000004C20000-0x0000000004C5F000-memory.dmp family_redline behavioral1/memory/3848-208-0x0000000004C20000-0x0000000004C5F000-memory.dmp family_redline behavioral1/memory/3848-210-0x0000000004C20000-0x0000000004C5F000-memory.dmp family_redline behavioral1/memory/3848-212-0x0000000004C20000-0x0000000004C5F000-memory.dmp family_redline behavioral1/memory/3848-214-0x0000000004C20000-0x0000000004C5F000-memory.dmp family_redline behavioral1/memory/3848-216-0x0000000004C20000-0x0000000004C5F000-memory.dmp family_redline behavioral1/memory/3848-218-0x0000000004C20000-0x0000000004C5F000-memory.dmp family_redline behavioral1/memory/3848-220-0x0000000004C20000-0x0000000004C5F000-memory.dmp family_redline behavioral1/memory/3848-222-0x0000000004C20000-0x0000000004C5F000-memory.dmp family_redline behavioral1/memory/3848-224-0x0000000004C20000-0x0000000004C5F000-memory.dmp family_redline behavioral1/memory/3848-226-0x0000000004C20000-0x0000000004C5F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un404085.exepro8997.exequ7258.exesi581942.exepid process 2584 un404085.exe 2572 pro8997.exe 3848 qu7258.exe 4640 si581942.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro8997.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro8997.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro8997.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
b45bc631884d0f169200a096b763d2eaaa88eef8c4a8b62b679eb8cdaca4aab9.exeun404085.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce b45bc631884d0f169200a096b763d2eaaa88eef8c4a8b62b679eb8cdaca4aab9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" b45bc631884d0f169200a096b763d2eaaa88eef8c4a8b62b679eb8cdaca4aab9.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un404085.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un404085.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 740 2572 WerFault.exe pro8997.exe 2836 3848 WerFault.exe qu7258.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro8997.exequ7258.exesi581942.exepid process 2572 pro8997.exe 2572 pro8997.exe 3848 qu7258.exe 3848 qu7258.exe 4640 si581942.exe 4640 si581942.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro8997.exequ7258.exesi581942.exedescription pid process Token: SeDebugPrivilege 2572 pro8997.exe Token: SeDebugPrivilege 3848 qu7258.exe Token: SeDebugPrivilege 4640 si581942.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
b45bc631884d0f169200a096b763d2eaaa88eef8c4a8b62b679eb8cdaca4aab9.exeun404085.exedescription pid process target process PID 1836 wrote to memory of 2584 1836 b45bc631884d0f169200a096b763d2eaaa88eef8c4a8b62b679eb8cdaca4aab9.exe un404085.exe PID 1836 wrote to memory of 2584 1836 b45bc631884d0f169200a096b763d2eaaa88eef8c4a8b62b679eb8cdaca4aab9.exe un404085.exe PID 1836 wrote to memory of 2584 1836 b45bc631884d0f169200a096b763d2eaaa88eef8c4a8b62b679eb8cdaca4aab9.exe un404085.exe PID 2584 wrote to memory of 2572 2584 un404085.exe pro8997.exe PID 2584 wrote to memory of 2572 2584 un404085.exe pro8997.exe PID 2584 wrote to memory of 2572 2584 un404085.exe pro8997.exe PID 2584 wrote to memory of 3848 2584 un404085.exe qu7258.exe PID 2584 wrote to memory of 3848 2584 un404085.exe qu7258.exe PID 2584 wrote to memory of 3848 2584 un404085.exe qu7258.exe PID 1836 wrote to memory of 4640 1836 b45bc631884d0f169200a096b763d2eaaa88eef8c4a8b62b679eb8cdaca4aab9.exe si581942.exe PID 1836 wrote to memory of 4640 1836 b45bc631884d0f169200a096b763d2eaaa88eef8c4a8b62b679eb8cdaca4aab9.exe si581942.exe PID 1836 wrote to memory of 4640 1836 b45bc631884d0f169200a096b763d2eaaa88eef8c4a8b62b679eb8cdaca4aab9.exe si581942.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b45bc631884d0f169200a096b763d2eaaa88eef8c4a8b62b679eb8cdaca4aab9.exe"C:\Users\Admin\AppData\Local\Temp\b45bc631884d0f169200a096b763d2eaaa88eef8c4a8b62b679eb8cdaca4aab9.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un404085.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un404085.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8997.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8997.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2572 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 10804⤵
- Program crash
PID:740 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7258.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7258.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3848 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3848 -s 13644⤵
- Program crash
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si581942.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si581942.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4640
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 2572 -ip 25721⤵PID:2040
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3848 -ip 38481⤵PID:2764
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si581942.exeFilesize
175KB
MD52b10c3bc46f094ce9c7a3baf7c73b97b
SHA132161c5b3e0aa11d0a2e5fa373206dcfcf3db814
SHA2566b01395c9d97342893ad9afd7fab31f77ae27a6973111b3b6a2a1217cdcc26e8
SHA512e88ed91edf3611d463917302563e17cb092fdfe417cfd1088d371f4d0d425792b4f77162c861c8f0c81f92633e456873e9c15da0b56835310dfc7ecd540764da
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si581942.exeFilesize
175KB
MD52b10c3bc46f094ce9c7a3baf7c73b97b
SHA132161c5b3e0aa11d0a2e5fa373206dcfcf3db814
SHA2566b01395c9d97342893ad9afd7fab31f77ae27a6973111b3b6a2a1217cdcc26e8
SHA512e88ed91edf3611d463917302563e17cb092fdfe417cfd1088d371f4d0d425792b4f77162c861c8f0c81f92633e456873e9c15da0b56835310dfc7ecd540764da
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un404085.exeFilesize
555KB
MD5d1e50768b13c70c4afcb0f31dd997530
SHA1d16654c55adf4fe8738a9a8169249921da03af88
SHA2564e52198b897fd4309940f835b3af9733e457f14fe9d3ac9d25ee973bac395d38
SHA512193ea9a3491036a6aa173b40970c68daea81d706d9928c727d0a149ece7f5eaa1fa3668990a589e5812c2fd89806e90465f3b7fe4448618b8379d1c18a2845e2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un404085.exeFilesize
555KB
MD5d1e50768b13c70c4afcb0f31dd997530
SHA1d16654c55adf4fe8738a9a8169249921da03af88
SHA2564e52198b897fd4309940f835b3af9733e457f14fe9d3ac9d25ee973bac395d38
SHA512193ea9a3491036a6aa173b40970c68daea81d706d9928c727d0a149ece7f5eaa1fa3668990a589e5812c2fd89806e90465f3b7fe4448618b8379d1c18a2845e2
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8997.exeFilesize
347KB
MD50cbb1e87351662f8effe30d31ec715e4
SHA128e908278c7bf3bc8bfa00653e0db6bd7cacc1b5
SHA2568c874aa478aa7664e085c923f798c1a22f2a979c65d1126022fb88ff035ffe5b
SHA512793c9a5d6a516e482405a66d2b8e9be425fde45a22d4b9bf15959b4b4e4bf8c9875d80a167c31ebf8769065ba95c8fe35c8aabff7e004f03e51a46738baab26f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8997.exeFilesize
347KB
MD50cbb1e87351662f8effe30d31ec715e4
SHA128e908278c7bf3bc8bfa00653e0db6bd7cacc1b5
SHA2568c874aa478aa7664e085c923f798c1a22f2a979c65d1126022fb88ff035ffe5b
SHA512793c9a5d6a516e482405a66d2b8e9be425fde45a22d4b9bf15959b4b4e4bf8c9875d80a167c31ebf8769065ba95c8fe35c8aabff7e004f03e51a46738baab26f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7258.exeFilesize
406KB
MD5a381ae79320ac19a6e50701e173fe949
SHA1d912f5c5785505a6485ca4ad71dab25e95349e28
SHA2566326636662b77a0f9ad16859a1de27ce18ade67c8349f158c7b0ff2abcf0d6e3
SHA51247343a59bf46f14b93ef938cd3c550e4d49ab7669b0c87ac6f6d58c1d54e83928064748c7e387569f5dabb44a7ef5c0bd21a86b6f29a157f5ff8cc9246b45556
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7258.exeFilesize
406KB
MD5a381ae79320ac19a6e50701e173fe949
SHA1d912f5c5785505a6485ca4ad71dab25e95349e28
SHA2566326636662b77a0f9ad16859a1de27ce18ade67c8349f158c7b0ff2abcf0d6e3
SHA51247343a59bf46f14b93ef938cd3c550e4d49ab7669b0c87ac6f6d58c1d54e83928064748c7e387569f5dabb44a7ef5c0bd21a86b6f29a157f5ff8cc9246b45556
-
memory/2572-148-0x00000000071C0000-0x0000000007764000-memory.dmpFilesize
5.6MB
-
memory/2572-149-0x0000000007100000-0x0000000007112000-memory.dmpFilesize
72KB
-
memory/2572-150-0x0000000007100000-0x0000000007112000-memory.dmpFilesize
72KB
-
memory/2572-152-0x0000000007100000-0x0000000007112000-memory.dmpFilesize
72KB
-
memory/2572-154-0x0000000007100000-0x0000000007112000-memory.dmpFilesize
72KB
-
memory/2572-156-0x0000000007100000-0x0000000007112000-memory.dmpFilesize
72KB
-
memory/2572-158-0x0000000007100000-0x0000000007112000-memory.dmpFilesize
72KB
-
memory/2572-160-0x0000000007100000-0x0000000007112000-memory.dmpFilesize
72KB
-
memory/2572-162-0x0000000007100000-0x0000000007112000-memory.dmpFilesize
72KB
-
memory/2572-164-0x0000000007100000-0x0000000007112000-memory.dmpFilesize
72KB
-
memory/2572-166-0x0000000007100000-0x0000000007112000-memory.dmpFilesize
72KB
-
memory/2572-168-0x0000000007100000-0x0000000007112000-memory.dmpFilesize
72KB
-
memory/2572-170-0x0000000007100000-0x0000000007112000-memory.dmpFilesize
72KB
-
memory/2572-172-0x0000000007100000-0x0000000007112000-memory.dmpFilesize
72KB
-
memory/2572-174-0x0000000007100000-0x0000000007112000-memory.dmpFilesize
72KB
-
memory/2572-176-0x0000000007100000-0x0000000007112000-memory.dmpFilesize
72KB
-
memory/2572-177-0x0000000002B90000-0x0000000002BBD000-memory.dmpFilesize
180KB
-
memory/2572-178-0x00000000071B0000-0x00000000071C0000-memory.dmpFilesize
64KB
-
memory/2572-179-0x00000000071B0000-0x00000000071C0000-memory.dmpFilesize
64KB
-
memory/2572-180-0x0000000000400000-0x0000000002B84000-memory.dmpFilesize
39.5MB
-
memory/2572-181-0x00000000071B0000-0x00000000071C0000-memory.dmpFilesize
64KB
-
memory/2572-182-0x00000000071B0000-0x00000000071C0000-memory.dmpFilesize
64KB
-
memory/2572-183-0x00000000071B0000-0x00000000071C0000-memory.dmpFilesize
64KB
-
memory/2572-185-0x0000000000400000-0x0000000002B84000-memory.dmpFilesize
39.5MB
-
memory/3848-190-0x0000000002C70000-0x0000000002CBB000-memory.dmpFilesize
300KB
-
memory/3848-191-0x00000000072D0000-0x00000000072E0000-memory.dmpFilesize
64KB
-
memory/3848-192-0x0000000004C20000-0x0000000004C5F000-memory.dmpFilesize
252KB
-
memory/3848-193-0x0000000004C20000-0x0000000004C5F000-memory.dmpFilesize
252KB
-
memory/3848-195-0x0000000004C20000-0x0000000004C5F000-memory.dmpFilesize
252KB
-
memory/3848-197-0x0000000004C20000-0x0000000004C5F000-memory.dmpFilesize
252KB
-
memory/3848-199-0x0000000004C20000-0x0000000004C5F000-memory.dmpFilesize
252KB
-
memory/3848-203-0x00000000072D0000-0x00000000072E0000-memory.dmpFilesize
64KB
-
memory/3848-201-0x0000000004C20000-0x0000000004C5F000-memory.dmpFilesize
252KB
-
memory/3848-204-0x0000000004C20000-0x0000000004C5F000-memory.dmpFilesize
252KB
-
memory/3848-206-0x0000000004C20000-0x0000000004C5F000-memory.dmpFilesize
252KB
-
memory/3848-208-0x0000000004C20000-0x0000000004C5F000-memory.dmpFilesize
252KB
-
memory/3848-210-0x0000000004C20000-0x0000000004C5F000-memory.dmpFilesize
252KB
-
memory/3848-212-0x0000000004C20000-0x0000000004C5F000-memory.dmpFilesize
252KB
-
memory/3848-214-0x0000000004C20000-0x0000000004C5F000-memory.dmpFilesize
252KB
-
memory/3848-216-0x0000000004C20000-0x0000000004C5F000-memory.dmpFilesize
252KB
-
memory/3848-218-0x0000000004C20000-0x0000000004C5F000-memory.dmpFilesize
252KB
-
memory/3848-220-0x0000000004C20000-0x0000000004C5F000-memory.dmpFilesize
252KB
-
memory/3848-222-0x0000000004C20000-0x0000000004C5F000-memory.dmpFilesize
252KB
-
memory/3848-224-0x0000000004C20000-0x0000000004C5F000-memory.dmpFilesize
252KB
-
memory/3848-226-0x0000000004C20000-0x0000000004C5F000-memory.dmpFilesize
252KB
-
memory/3848-1099-0x0000000007990000-0x0000000007FA8000-memory.dmpFilesize
6.1MB
-
memory/3848-1100-0x0000000007FB0000-0x00000000080BA000-memory.dmpFilesize
1.0MB
-
memory/3848-1101-0x00000000080C0000-0x00000000080D2000-memory.dmpFilesize
72KB
-
memory/3848-1102-0x00000000080E0000-0x000000000811C000-memory.dmpFilesize
240KB
-
memory/3848-1103-0x00000000072D0000-0x00000000072E0000-memory.dmpFilesize
64KB
-
memory/3848-1105-0x00000000083D0000-0x0000000008462000-memory.dmpFilesize
584KB
-
memory/3848-1106-0x0000000008470000-0x00000000084D6000-memory.dmpFilesize
408KB
-
memory/3848-1107-0x0000000008B60000-0x0000000008BD6000-memory.dmpFilesize
472KB
-
memory/3848-1108-0x0000000008C00000-0x0000000008C50000-memory.dmpFilesize
320KB
-
memory/3848-1109-0x00000000072D0000-0x00000000072E0000-memory.dmpFilesize
64KB
-
memory/3848-1110-0x0000000008C70000-0x0000000008E32000-memory.dmpFilesize
1.8MB
-
memory/3848-1111-0x0000000008E50000-0x000000000937C000-memory.dmpFilesize
5.2MB
-
memory/3848-1112-0x00000000072D0000-0x00000000072E0000-memory.dmpFilesize
64KB
-
memory/4640-1118-0x0000000000AC0000-0x0000000000AF2000-memory.dmpFilesize
200KB
-
memory/4640-1119-0x0000000005730000-0x0000000005740000-memory.dmpFilesize
64KB