Analysis
-
max time kernel
59s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 11:11
Static task
static1
Behavioral task
behavioral1
Sample
727023e134fb8538739b7475ea697e3fb8557701ab658d5a2bdae41fbaf84ca5.exe
Resource
win10v2004-20230220-en
General
-
Target
727023e134fb8538739b7475ea697e3fb8557701ab658d5a2bdae41fbaf84ca5.exe
-
Size
697KB
-
MD5
13a218d05e39a5319110d819aba0e221
-
SHA1
d26f2e24291174d3396a2eb12b573949b293ded9
-
SHA256
727023e134fb8538739b7475ea697e3fb8557701ab658d5a2bdae41fbaf84ca5
-
SHA512
34124a563530c626aa1e6fe1077d58b2085a63362fcc7233e9c8cd270f76352f53a307e8f654170e84aae9c850c0b4fc9a661d43c9b78c896dd79977617c4ca4
-
SSDEEP
12288:KMrsy90tMuDK+uN+Z8B/Y+xyXJVaZ0L6BGGjYAxI9gAVwCRSw/:eyO2kaxWcI9GjpI9l7Rf/
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
muse
176.113.115.145:4125
-
auth_value
b91988a63a24940038d9262827a5320c
Signatures
-
Processes:
pro2927.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro2927.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro2927.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro2927.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro2927.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro2927.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro2927.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/2604-192-0x0000000007270000-0x00000000072AF000-memory.dmp family_redline behavioral1/memory/2604-193-0x0000000007270000-0x00000000072AF000-memory.dmp family_redline behavioral1/memory/2604-195-0x0000000007270000-0x00000000072AF000-memory.dmp family_redline behavioral1/memory/2604-197-0x0000000007270000-0x00000000072AF000-memory.dmp family_redline behavioral1/memory/2604-199-0x0000000007270000-0x00000000072AF000-memory.dmp family_redline behavioral1/memory/2604-201-0x0000000007270000-0x00000000072AF000-memory.dmp family_redline behavioral1/memory/2604-203-0x0000000007270000-0x00000000072AF000-memory.dmp family_redline behavioral1/memory/2604-205-0x0000000007270000-0x00000000072AF000-memory.dmp family_redline behavioral1/memory/2604-207-0x0000000007270000-0x00000000072AF000-memory.dmp family_redline behavioral1/memory/2604-209-0x0000000007270000-0x00000000072AF000-memory.dmp family_redline behavioral1/memory/2604-211-0x0000000007270000-0x00000000072AF000-memory.dmp family_redline behavioral1/memory/2604-214-0x0000000007270000-0x00000000072AF000-memory.dmp family_redline behavioral1/memory/2604-213-0x00000000072E0000-0x00000000072F0000-memory.dmp family_redline behavioral1/memory/2604-217-0x0000000007270000-0x00000000072AF000-memory.dmp family_redline behavioral1/memory/2604-220-0x0000000007270000-0x00000000072AF000-memory.dmp family_redline behavioral1/memory/2604-222-0x0000000007270000-0x00000000072AF000-memory.dmp family_redline behavioral1/memory/2604-224-0x0000000007270000-0x00000000072AF000-memory.dmp family_redline behavioral1/memory/2604-226-0x0000000007270000-0x00000000072AF000-memory.dmp family_redline behavioral1/memory/2604-228-0x0000000007270000-0x00000000072AF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un000908.exepro2927.exequ9472.exesi344950.exepid process 224 un000908.exe 4704 pro2927.exe 2604 qu9472.exe 3332 si344950.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro2927.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro2927.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro2927.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
727023e134fb8538739b7475ea697e3fb8557701ab658d5a2bdae41fbaf84ca5.exeun000908.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 727023e134fb8538739b7475ea697e3fb8557701ab658d5a2bdae41fbaf84ca5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 727023e134fb8538739b7475ea697e3fb8557701ab658d5a2bdae41fbaf84ca5.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un000908.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un000908.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3172 4704 WerFault.exe pro2927.exe 4460 2604 WerFault.exe qu9472.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro2927.exequ9472.exesi344950.exepid process 4704 pro2927.exe 4704 pro2927.exe 2604 qu9472.exe 2604 qu9472.exe 3332 si344950.exe 3332 si344950.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro2927.exequ9472.exesi344950.exedescription pid process Token: SeDebugPrivilege 4704 pro2927.exe Token: SeDebugPrivilege 2604 qu9472.exe Token: SeDebugPrivilege 3332 si344950.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
727023e134fb8538739b7475ea697e3fb8557701ab658d5a2bdae41fbaf84ca5.exeun000908.exedescription pid process target process PID 3340 wrote to memory of 224 3340 727023e134fb8538739b7475ea697e3fb8557701ab658d5a2bdae41fbaf84ca5.exe un000908.exe PID 3340 wrote to memory of 224 3340 727023e134fb8538739b7475ea697e3fb8557701ab658d5a2bdae41fbaf84ca5.exe un000908.exe PID 3340 wrote to memory of 224 3340 727023e134fb8538739b7475ea697e3fb8557701ab658d5a2bdae41fbaf84ca5.exe un000908.exe PID 224 wrote to memory of 4704 224 un000908.exe pro2927.exe PID 224 wrote to memory of 4704 224 un000908.exe pro2927.exe PID 224 wrote to memory of 4704 224 un000908.exe pro2927.exe PID 224 wrote to memory of 2604 224 un000908.exe qu9472.exe PID 224 wrote to memory of 2604 224 un000908.exe qu9472.exe PID 224 wrote to memory of 2604 224 un000908.exe qu9472.exe PID 3340 wrote to memory of 3332 3340 727023e134fb8538739b7475ea697e3fb8557701ab658d5a2bdae41fbaf84ca5.exe si344950.exe PID 3340 wrote to memory of 3332 3340 727023e134fb8538739b7475ea697e3fb8557701ab658d5a2bdae41fbaf84ca5.exe si344950.exe PID 3340 wrote to memory of 3332 3340 727023e134fb8538739b7475ea697e3fb8557701ab658d5a2bdae41fbaf84ca5.exe si344950.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\727023e134fb8538739b7475ea697e3fb8557701ab658d5a2bdae41fbaf84ca5.exe"C:\Users\Admin\AppData\Local\Temp\727023e134fb8538739b7475ea697e3fb8557701ab658d5a2bdae41fbaf84ca5.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un000908.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un000908.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2927.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2927.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 10924⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9472.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9472.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 13524⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si344950.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si344950.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4704 -ip 47041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2604 -ip 26041⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si344950.exeFilesize
175KB
MD557ce040a6a7b2165937e34538b457cf3
SHA1266340a133964b9bc52dd49994e9f1ae996039bb
SHA2560dbd6cbe57eefb1936f3f71b01cab992b88bbd03a364e5cbcdc5864a9fe4e944
SHA5125745f443519818eef5a6729744af7b2f0e83da283f29d4f2c178fe3cdacbfac6c438190a0cd9a385e1602801c6bebec2ae525f628bb1d1c01e6db880370d821f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si344950.exeFilesize
175KB
MD557ce040a6a7b2165937e34538b457cf3
SHA1266340a133964b9bc52dd49994e9f1ae996039bb
SHA2560dbd6cbe57eefb1936f3f71b01cab992b88bbd03a364e5cbcdc5864a9fe4e944
SHA5125745f443519818eef5a6729744af7b2f0e83da283f29d4f2c178fe3cdacbfac6c438190a0cd9a385e1602801c6bebec2ae525f628bb1d1c01e6db880370d821f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un000908.exeFilesize
555KB
MD512382f61e8240498b9cda7f96ffd4836
SHA14a2f1fae85e9cf7af078b7aa83bf4ccc94a0cc2f
SHA2563dc36cc723adc62116de232f64d35b5d2772bcbf539d1d9ef8fcc84c8a41191d
SHA512c3c612be350e064b125fc80385bc3dfbe9dc32e3f1d816feaf0ddb1c7118e9d88434eaa78bd0c4f66b8626425e4b6ad738938b7fbe2b3abe7a137ec5b3032b73
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un000908.exeFilesize
555KB
MD512382f61e8240498b9cda7f96ffd4836
SHA14a2f1fae85e9cf7af078b7aa83bf4ccc94a0cc2f
SHA2563dc36cc723adc62116de232f64d35b5d2772bcbf539d1d9ef8fcc84c8a41191d
SHA512c3c612be350e064b125fc80385bc3dfbe9dc32e3f1d816feaf0ddb1c7118e9d88434eaa78bd0c4f66b8626425e4b6ad738938b7fbe2b3abe7a137ec5b3032b73
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2927.exeFilesize
347KB
MD506985e255ef054875dc958cf4e7021e1
SHA114c430ff7f962f9c23d74f0f4bbd698c0a8be2d5
SHA25675cd335eb25670779663b8f231d78535bc23bec02bf75a647fd9f95c0b9acb35
SHA5128c131be0d999b13b4def6d40805b3b14d63b2139fd56e5d05a7a546262a611d614190a9bb20644cbfb0db358018a100790095e8d641200960fcce35684379dde
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2927.exeFilesize
347KB
MD506985e255ef054875dc958cf4e7021e1
SHA114c430ff7f962f9c23d74f0f4bbd698c0a8be2d5
SHA25675cd335eb25670779663b8f231d78535bc23bec02bf75a647fd9f95c0b9acb35
SHA5128c131be0d999b13b4def6d40805b3b14d63b2139fd56e5d05a7a546262a611d614190a9bb20644cbfb0db358018a100790095e8d641200960fcce35684379dde
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9472.exeFilesize
406KB
MD56ba0c868cc649dd9761f970fd8d2a94d
SHA17cf94c86c1ac8a5077bfeafc4bc5f1e74ee2ab4b
SHA2561a26e75c7789d86798bd1ea25ef7a53d8b22cb31fd257c4f49f522aac41aa554
SHA512b030ba43d0148b903611edaf4ae801025742ed5c13a512a202aa12fce17cbfc779527c20dd1ff2125f41ce49fdd1b0d244c656cae5b4f8c24a701b47a0731842
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9472.exeFilesize
406KB
MD56ba0c868cc649dd9761f970fd8d2a94d
SHA17cf94c86c1ac8a5077bfeafc4bc5f1e74ee2ab4b
SHA2561a26e75c7789d86798bd1ea25ef7a53d8b22cb31fd257c4f49f522aac41aa554
SHA512b030ba43d0148b903611edaf4ae801025742ed5c13a512a202aa12fce17cbfc779527c20dd1ff2125f41ce49fdd1b0d244c656cae5b4f8c24a701b47a0731842
-
memory/2604-1102-0x0000000008080000-0x000000000818A000-memory.dmpFilesize
1.0MB
-
memory/2604-1101-0x00000000079E0000-0x0000000007FF8000-memory.dmpFilesize
6.1MB
-
memory/2604-217-0x0000000007270000-0x00000000072AF000-memory.dmpFilesize
252KB
-
memory/2604-215-0x00000000072E0000-0x00000000072F0000-memory.dmpFilesize
64KB
-
memory/2604-203-0x0000000007270000-0x00000000072AF000-memory.dmpFilesize
252KB
-
memory/2604-205-0x0000000007270000-0x00000000072AF000-memory.dmpFilesize
252KB
-
memory/2604-1116-0x00000000072E0000-0x00000000072F0000-memory.dmpFilesize
64KB
-
memory/2604-1114-0x0000000008DB0000-0x0000000008F72000-memory.dmpFilesize
1.8MB
-
memory/2604-1113-0x0000000008D00000-0x0000000008D50000-memory.dmpFilesize
320KB
-
memory/2604-1112-0x0000000008C70000-0x0000000008CE6000-memory.dmpFilesize
472KB
-
memory/2604-207-0x0000000007270000-0x00000000072AF000-memory.dmpFilesize
252KB
-
memory/2604-1111-0x00000000072E0000-0x00000000072F0000-memory.dmpFilesize
64KB
-
memory/2604-1110-0x00000000072E0000-0x00000000072F0000-memory.dmpFilesize
64KB
-
memory/2604-1109-0x0000000008570000-0x00000000085D6000-memory.dmpFilesize
408KB
-
memory/2604-1108-0x00000000084D0000-0x0000000008562000-memory.dmpFilesize
584KB
-
memory/2604-1107-0x0000000004570000-0x00000000045BB000-memory.dmpFilesize
300KB
-
memory/2604-1105-0x00000000072E0000-0x00000000072F0000-memory.dmpFilesize
64KB
-
memory/2604-1104-0x00000000081E0000-0x000000000821C000-memory.dmpFilesize
240KB
-
memory/2604-1103-0x00000000081C0000-0x00000000081D2000-memory.dmpFilesize
72KB
-
memory/2604-218-0x00000000072E0000-0x00000000072F0000-memory.dmpFilesize
64KB
-
memory/2604-228-0x0000000007270000-0x00000000072AF000-memory.dmpFilesize
252KB
-
memory/2604-226-0x0000000007270000-0x00000000072AF000-memory.dmpFilesize
252KB
-
memory/2604-224-0x0000000007270000-0x00000000072AF000-memory.dmpFilesize
252KB
-
memory/2604-191-0x0000000004570000-0x00000000045BB000-memory.dmpFilesize
300KB
-
memory/2604-192-0x0000000007270000-0x00000000072AF000-memory.dmpFilesize
252KB
-
memory/2604-193-0x0000000007270000-0x00000000072AF000-memory.dmpFilesize
252KB
-
memory/2604-195-0x0000000007270000-0x00000000072AF000-memory.dmpFilesize
252KB
-
memory/2604-197-0x0000000007270000-0x00000000072AF000-memory.dmpFilesize
252KB
-
memory/2604-199-0x0000000007270000-0x00000000072AF000-memory.dmpFilesize
252KB
-
memory/2604-201-0x0000000007270000-0x00000000072AF000-memory.dmpFilesize
252KB
-
memory/2604-222-0x0000000007270000-0x00000000072AF000-memory.dmpFilesize
252KB
-
memory/2604-1115-0x0000000008F80000-0x00000000094AC000-memory.dmpFilesize
5.2MB
-
memory/2604-220-0x0000000007270000-0x00000000072AF000-memory.dmpFilesize
252KB
-
memory/2604-209-0x0000000007270000-0x00000000072AF000-memory.dmpFilesize
252KB
-
memory/2604-211-0x0000000007270000-0x00000000072AF000-memory.dmpFilesize
252KB
-
memory/2604-214-0x0000000007270000-0x00000000072AF000-memory.dmpFilesize
252KB
-
memory/2604-213-0x00000000072E0000-0x00000000072F0000-memory.dmpFilesize
64KB
-
memory/3332-1122-0x0000000000A80000-0x0000000000AB2000-memory.dmpFilesize
200KB
-
memory/3332-1123-0x00000000053B0000-0x00000000053C0000-memory.dmpFilesize
64KB
-
memory/4704-181-0x0000000000400000-0x0000000002B84000-memory.dmpFilesize
39.5MB
-
memory/4704-173-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4704-148-0x0000000002B90000-0x0000000002BBD000-memory.dmpFilesize
180KB
-
memory/4704-151-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4704-153-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4704-186-0x0000000000400000-0x0000000002B84000-memory.dmpFilesize
39.5MB
-
memory/4704-185-0x0000000007390000-0x00000000073A0000-memory.dmpFilesize
64KB
-
memory/4704-150-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4704-184-0x0000000007390000-0x00000000073A0000-memory.dmpFilesize
64KB
-
memory/4704-183-0x0000000007390000-0x00000000073A0000-memory.dmpFilesize
64KB
-
memory/4704-155-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4704-180-0x0000000007390000-0x00000000073A0000-memory.dmpFilesize
64KB
-
memory/4704-179-0x0000000007390000-0x00000000073A0000-memory.dmpFilesize
64KB
-
memory/4704-178-0x0000000007390000-0x00000000073A0000-memory.dmpFilesize
64KB
-
memory/4704-177-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4704-175-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4704-171-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4704-169-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4704-167-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4704-165-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4704-163-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4704-149-0x00000000073A0000-0x0000000007944000-memory.dmpFilesize
5.6MB
-
memory/4704-161-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4704-159-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4704-157-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB