Analysis
-
max time kernel
54s -
max time network
139s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
28-03-2023 10:40
Static task
static1
Behavioral task
behavioral1
Sample
fec8a1f95a0dd2e8b010b44cf70fb570f5acd785c728b59620fedaf034c11dbc.exe
Resource
win10-20230220-en
General
-
Target
fec8a1f95a0dd2e8b010b44cf70fb570f5acd785c728b59620fedaf034c11dbc.exe
-
Size
696KB
-
MD5
38fb652bc8c7885523cee9c9591dcebe
-
SHA1
8a715d5d12d74103518e83e637521dfe64f8a194
-
SHA256
fec8a1f95a0dd2e8b010b44cf70fb570f5acd785c728b59620fedaf034c11dbc
-
SHA512
e36e035c392a516e7e03df4e33b355e6ad0eb4a7c70b46d5e1e7d66dea0a24d79e892ea60b6de1e0d13f04138c5b66fafb3e9006981253c167d4a8e10f80545f
-
SSDEEP
12288:fMr7y90KiAKurDgY9TopHZF8B/YOxyNtDmjrCjlL6dyGjcAxI9gfwLdgG:kyCXurUYRop5FCxctUIJGj1I9UUF
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
muse
176.113.115.145:4125
-
auth_value
b91988a63a24940038d9262827a5320c
Signatures
-
Processes:
pro3766.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro3766.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro3766.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro3766.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro3766.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro3766.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/4084-176-0x0000000004840000-0x0000000004886000-memory.dmp family_redline behavioral1/memory/4084-177-0x0000000007680000-0x00000000076C4000-memory.dmp family_redline behavioral1/memory/4084-178-0x0000000007680000-0x00000000076BF000-memory.dmp family_redline behavioral1/memory/4084-181-0x0000000007680000-0x00000000076BF000-memory.dmp family_redline behavioral1/memory/4084-179-0x0000000007680000-0x00000000076BF000-memory.dmp family_redline behavioral1/memory/4084-183-0x0000000007680000-0x00000000076BF000-memory.dmp family_redline behavioral1/memory/4084-185-0x0000000007680000-0x00000000076BF000-memory.dmp family_redline behavioral1/memory/4084-187-0x0000000007680000-0x00000000076BF000-memory.dmp family_redline behavioral1/memory/4084-189-0x0000000007680000-0x00000000076BF000-memory.dmp family_redline behavioral1/memory/4084-191-0x0000000007680000-0x00000000076BF000-memory.dmp family_redline behavioral1/memory/4084-197-0x0000000007680000-0x00000000076BF000-memory.dmp family_redline behavioral1/memory/4084-195-0x0000000007680000-0x00000000076BF000-memory.dmp family_redline behavioral1/memory/4084-193-0x0000000007680000-0x00000000076BF000-memory.dmp family_redline behavioral1/memory/4084-199-0x0000000007680000-0x00000000076BF000-memory.dmp family_redline behavioral1/memory/4084-201-0x0000000007680000-0x00000000076BF000-memory.dmp family_redline behavioral1/memory/4084-203-0x0000000007680000-0x00000000076BF000-memory.dmp family_redline behavioral1/memory/4084-205-0x0000000007680000-0x00000000076BF000-memory.dmp family_redline behavioral1/memory/4084-207-0x0000000007680000-0x00000000076BF000-memory.dmp family_redline behavioral1/memory/4084-209-0x0000000007680000-0x00000000076BF000-memory.dmp family_redline behavioral1/memory/4084-211-0x0000000007680000-0x00000000076BF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un666680.exepro3766.exequ8456.exesi302372.exepid process 3596 un666680.exe 2344 pro3766.exe 4084 qu8456.exe 1272 si302372.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro3766.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro3766.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro3766.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un666680.exefec8a1f95a0dd2e8b010b44cf70fb570f5acd785c728b59620fedaf034c11dbc.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un666680.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un666680.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce fec8a1f95a0dd2e8b010b44cf70fb570f5acd785c728b59620fedaf034c11dbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" fec8a1f95a0dd2e8b010b44cf70fb570f5acd785c728b59620fedaf034c11dbc.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro3766.exequ8456.exesi302372.exepid process 2344 pro3766.exe 2344 pro3766.exe 4084 qu8456.exe 4084 qu8456.exe 1272 si302372.exe 1272 si302372.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro3766.exequ8456.exesi302372.exedescription pid process Token: SeDebugPrivilege 2344 pro3766.exe Token: SeDebugPrivilege 4084 qu8456.exe Token: SeDebugPrivilege 1272 si302372.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
fec8a1f95a0dd2e8b010b44cf70fb570f5acd785c728b59620fedaf034c11dbc.exeun666680.exedescription pid process target process PID 4148 wrote to memory of 3596 4148 fec8a1f95a0dd2e8b010b44cf70fb570f5acd785c728b59620fedaf034c11dbc.exe un666680.exe PID 4148 wrote to memory of 3596 4148 fec8a1f95a0dd2e8b010b44cf70fb570f5acd785c728b59620fedaf034c11dbc.exe un666680.exe PID 4148 wrote to memory of 3596 4148 fec8a1f95a0dd2e8b010b44cf70fb570f5acd785c728b59620fedaf034c11dbc.exe un666680.exe PID 3596 wrote to memory of 2344 3596 un666680.exe pro3766.exe PID 3596 wrote to memory of 2344 3596 un666680.exe pro3766.exe PID 3596 wrote to memory of 2344 3596 un666680.exe pro3766.exe PID 3596 wrote to memory of 4084 3596 un666680.exe qu8456.exe PID 3596 wrote to memory of 4084 3596 un666680.exe qu8456.exe PID 3596 wrote to memory of 4084 3596 un666680.exe qu8456.exe PID 4148 wrote to memory of 1272 4148 fec8a1f95a0dd2e8b010b44cf70fb570f5acd785c728b59620fedaf034c11dbc.exe si302372.exe PID 4148 wrote to memory of 1272 4148 fec8a1f95a0dd2e8b010b44cf70fb570f5acd785c728b59620fedaf034c11dbc.exe si302372.exe PID 4148 wrote to memory of 1272 4148 fec8a1f95a0dd2e8b010b44cf70fb570f5acd785c728b59620fedaf034c11dbc.exe si302372.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fec8a1f95a0dd2e8b010b44cf70fb570f5acd785c728b59620fedaf034c11dbc.exe"C:\Users\Admin\AppData\Local\Temp\fec8a1f95a0dd2e8b010b44cf70fb570f5acd785c728b59620fedaf034c11dbc.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un666680.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un666680.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3766.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3766.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8456.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8456.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si302372.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si302372.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1272
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si302372.exeFilesize
175KB
MD56b3f56727ddbd3ed4d2578f28b861b95
SHA199eb63472da9eb74f333b16da963f862452f1dc7
SHA2567486e6b421014744e8c49dae34e12ae115e7dcdf21939f76cbbea66b74e905e1
SHA51250c25bcfa441da091e2bb3024f5adcdef43f0447a561c42aca6042000e35d1171b3de9bd276b864513077a91c322a0c5bdaa0408f90bbb777b5b3cc27d582f2b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si302372.exeFilesize
175KB
MD56b3f56727ddbd3ed4d2578f28b861b95
SHA199eb63472da9eb74f333b16da963f862452f1dc7
SHA2567486e6b421014744e8c49dae34e12ae115e7dcdf21939f76cbbea66b74e905e1
SHA51250c25bcfa441da091e2bb3024f5adcdef43f0447a561c42aca6042000e35d1171b3de9bd276b864513077a91c322a0c5bdaa0408f90bbb777b5b3cc27d582f2b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un666680.exeFilesize
555KB
MD5f27389684b602195896fc952848bca70
SHA1285548b4a8e50476fc3eb89faccc02f715e39a87
SHA256405496d6894e84d3019a425a10a243e107d75999fda06228a90814fc2497ae04
SHA5128096a70569e2b676a0648014ecd12a564166e8db393d789f98e3dad5b8f3c75b7da1871ab7fd2dd8ab471f2f588861d191f7ffe78005d8c7a7870b87f3478f9a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un666680.exeFilesize
555KB
MD5f27389684b602195896fc952848bca70
SHA1285548b4a8e50476fc3eb89faccc02f715e39a87
SHA256405496d6894e84d3019a425a10a243e107d75999fda06228a90814fc2497ae04
SHA5128096a70569e2b676a0648014ecd12a564166e8db393d789f98e3dad5b8f3c75b7da1871ab7fd2dd8ab471f2f588861d191f7ffe78005d8c7a7870b87f3478f9a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3766.exeFilesize
347KB
MD572625a9d973d5d1a23dde5568daaa761
SHA1c0c7a448206b657b52fa14fb60f8559510b8a883
SHA25674bf221e7d903dc1fff3e89b215f5459047c231deed24860d1492c1fb2b73878
SHA512bf2add9a6f3c7e04fa3537bcc599f4afd79270b7c685b66360fa3684ecef3068fc5387bd263a571c71e019eb1314d797f5a5459a6b9177f9ec8eac30e88a9db0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3766.exeFilesize
347KB
MD572625a9d973d5d1a23dde5568daaa761
SHA1c0c7a448206b657b52fa14fb60f8559510b8a883
SHA25674bf221e7d903dc1fff3e89b215f5459047c231deed24860d1492c1fb2b73878
SHA512bf2add9a6f3c7e04fa3537bcc599f4afd79270b7c685b66360fa3684ecef3068fc5387bd263a571c71e019eb1314d797f5a5459a6b9177f9ec8eac30e88a9db0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8456.exeFilesize
406KB
MD5f81c412b6921c117edee2e3b7b370650
SHA191f28c2e99f519fd668782a998dd4bb825f40f26
SHA256509eb978d3ea371ae0b7aa9b0a11134c591ab754b84efde8c8f6895eb0ec47e2
SHA51279b57e395103dcefbc89882f798ff11027926471f21323780669015f04343967bec2c9c2cb6f39739220401f10b239c69e8aade83eed96ee49e5c19bbac4f385
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8456.exeFilesize
406KB
MD5f81c412b6921c117edee2e3b7b370650
SHA191f28c2e99f519fd668782a998dd4bb825f40f26
SHA256509eb978d3ea371ae0b7aa9b0a11134c591ab754b84efde8c8f6895eb0ec47e2
SHA51279b57e395103dcefbc89882f798ff11027926471f21323780669015f04343967bec2c9c2cb6f39739220401f10b239c69e8aade83eed96ee49e5c19bbac4f385
-
memory/1272-1109-0x00000000006D0000-0x0000000000702000-memory.dmpFilesize
200KB
-
memory/1272-1110-0x0000000005110000-0x000000000515B000-memory.dmpFilesize
300KB
-
memory/1272-1111-0x00000000052C0000-0x00000000052D0000-memory.dmpFilesize
64KB
-
memory/2344-143-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/2344-155-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/2344-135-0x0000000004B50000-0x0000000004B68000-memory.dmpFilesize
96KB
-
memory/2344-136-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/2344-137-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/2344-139-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/2344-141-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/2344-133-0x00000000073D0000-0x00000000073E0000-memory.dmpFilesize
64KB
-
memory/2344-145-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/2344-147-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/2344-149-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/2344-151-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/2344-153-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/2344-134-0x00000000073E0000-0x00000000078DE000-memory.dmpFilesize
5.0MB
-
memory/2344-157-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/2344-159-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/2344-161-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/2344-163-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/2344-164-0x00000000073D0000-0x00000000073E0000-memory.dmpFilesize
64KB
-
memory/2344-165-0x00000000073D0000-0x00000000073E0000-memory.dmpFilesize
64KB
-
memory/2344-166-0x0000000000400000-0x0000000002B84000-memory.dmpFilesize
39.5MB
-
memory/2344-167-0x00000000073D0000-0x00000000073E0000-memory.dmpFilesize
64KB
-
memory/2344-169-0x00000000073D0000-0x00000000073E0000-memory.dmpFilesize
64KB
-
memory/2344-170-0x0000000000400000-0x0000000002B84000-memory.dmpFilesize
39.5MB
-
memory/2344-132-0x0000000002C60000-0x0000000002C8D000-memory.dmpFilesize
180KB
-
memory/2344-131-0x00000000047F0000-0x000000000480A000-memory.dmpFilesize
104KB
-
memory/4084-178-0x0000000007680000-0x00000000076BF000-memory.dmpFilesize
252KB
-
memory/4084-224-0x0000000007130000-0x0000000007140000-memory.dmpFilesize
64KB
-
memory/4084-181-0x0000000007680000-0x00000000076BF000-memory.dmpFilesize
252KB
-
memory/4084-179-0x0000000007680000-0x00000000076BF000-memory.dmpFilesize
252KB
-
memory/4084-183-0x0000000007680000-0x00000000076BF000-memory.dmpFilesize
252KB
-
memory/4084-185-0x0000000007680000-0x00000000076BF000-memory.dmpFilesize
252KB
-
memory/4084-187-0x0000000007680000-0x00000000076BF000-memory.dmpFilesize
252KB
-
memory/4084-189-0x0000000007680000-0x00000000076BF000-memory.dmpFilesize
252KB
-
memory/4084-191-0x0000000007680000-0x00000000076BF000-memory.dmpFilesize
252KB
-
memory/4084-197-0x0000000007680000-0x00000000076BF000-memory.dmpFilesize
252KB
-
memory/4084-195-0x0000000007680000-0x00000000076BF000-memory.dmpFilesize
252KB
-
memory/4084-193-0x0000000007680000-0x00000000076BF000-memory.dmpFilesize
252KB
-
memory/4084-199-0x0000000007680000-0x00000000076BF000-memory.dmpFilesize
252KB
-
memory/4084-201-0x0000000007680000-0x00000000076BF000-memory.dmpFilesize
252KB
-
memory/4084-203-0x0000000007680000-0x00000000076BF000-memory.dmpFilesize
252KB
-
memory/4084-205-0x0000000007680000-0x00000000076BF000-memory.dmpFilesize
252KB
-
memory/4084-207-0x0000000007680000-0x00000000076BF000-memory.dmpFilesize
252KB
-
memory/4084-209-0x0000000007680000-0x00000000076BF000-memory.dmpFilesize
252KB
-
memory/4084-211-0x0000000007680000-0x00000000076BF000-memory.dmpFilesize
252KB
-
memory/4084-177-0x0000000007680000-0x00000000076C4000-memory.dmpFilesize
272KB
-
memory/4084-226-0x0000000007130000-0x0000000007140000-memory.dmpFilesize
64KB
-
memory/4084-228-0x0000000007130000-0x0000000007140000-memory.dmpFilesize
64KB
-
memory/4084-1087-0x0000000007800000-0x0000000007E06000-memory.dmpFilesize
6.0MB
-
memory/4084-1088-0x0000000007E80000-0x0000000007F8A000-memory.dmpFilesize
1.0MB
-
memory/4084-1089-0x0000000007FC0000-0x0000000007FD2000-memory.dmpFilesize
72KB
-
memory/4084-1090-0x0000000007FE0000-0x000000000801E000-memory.dmpFilesize
248KB
-
memory/4084-1091-0x0000000008130000-0x000000000817B000-memory.dmpFilesize
300KB
-
memory/4084-1092-0x0000000007130000-0x0000000007140000-memory.dmpFilesize
64KB
-
memory/4084-1094-0x00000000082C0000-0x0000000008326000-memory.dmpFilesize
408KB
-
memory/4084-1095-0x0000000008860000-0x00000000088F2000-memory.dmpFilesize
584KB
-
memory/4084-1096-0x0000000008A70000-0x0000000008AE6000-memory.dmpFilesize
472KB
-
memory/4084-1097-0x0000000008AF0000-0x0000000008B40000-memory.dmpFilesize
320KB
-
memory/4084-1098-0x0000000007130000-0x0000000007140000-memory.dmpFilesize
64KB
-
memory/4084-1099-0x0000000007130000-0x0000000007140000-memory.dmpFilesize
64KB
-
memory/4084-1100-0x0000000007130000-0x0000000007140000-memory.dmpFilesize
64KB
-
memory/4084-176-0x0000000004840000-0x0000000004886000-memory.dmpFilesize
280KB
-
memory/4084-175-0x0000000002C70000-0x0000000002CBB000-memory.dmpFilesize
300KB
-
memory/4084-1101-0x0000000008EE0000-0x00000000090A2000-memory.dmpFilesize
1.8MB
-
memory/4084-1102-0x00000000090B0000-0x00000000095DC000-memory.dmpFilesize
5.2MB
-
memory/4084-1103-0x0000000007130000-0x0000000007140000-memory.dmpFilesize
64KB