Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
28-03-2023 11:26
Static task
static1
Behavioral task
behavioral1
Sample
cd057d401ef1a70eb6ef1a98a78f96a052f98c1894c9cc463a01d2d447d0a12f.exe
Resource
win10-20230220-en
General
-
Target
cd057d401ef1a70eb6ef1a98a78f96a052f98c1894c9cc463a01d2d447d0a12f.exe
-
Size
698KB
-
MD5
c745c1392543570194d58d8421845352
-
SHA1
42133b73152fc41b61d81982139ae952bde01f92
-
SHA256
cd057d401ef1a70eb6ef1a98a78f96a052f98c1894c9cc463a01d2d447d0a12f
-
SHA512
db244e222baf768db2606e68b453f7945f52ba05f4524aada3fbc037a4cac4fa420ddad4585ed8e8299394b81df3019145b642a76c97458fe96fb55bdb64a8e2
-
SSDEEP
12288:LMr7y90rwwkMJcIlXkj8K8X/YWfjucwNV7L5dL6GWGjkAxI9gb/+96u:gyHMJcSvKofjucwj7L5BwGj9I9MW96u
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
muse
176.113.115.145:4125
-
auth_value
b91988a63a24940038d9262827a5320c
Signatures
-
Processes:
pro4036.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro4036.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro4036.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro4036.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro4036.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro4036.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/3348-181-0x0000000004700000-0x0000000004746000-memory.dmp family_redline behavioral1/memory/3348-182-0x0000000004A40000-0x0000000004A84000-memory.dmp family_redline behavioral1/memory/3348-183-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/3348-184-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/3348-186-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/3348-188-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/3348-190-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/3348-192-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/3348-197-0x0000000007240000-0x0000000007250000-memory.dmp family_redline behavioral1/memory/3348-196-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/3348-199-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/3348-201-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/3348-203-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/3348-205-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/3348-207-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/3348-209-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/3348-211-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/3348-213-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/3348-215-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/3348-217-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/3348-219-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un816139.exepro4036.exequ2689.exesi172041.exepid process 1876 un816139.exe 2112 pro4036.exe 3348 qu2689.exe 408 si172041.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro4036.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro4036.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro4036.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
cd057d401ef1a70eb6ef1a98a78f96a052f98c1894c9cc463a01d2d447d0a12f.exeun816139.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" cd057d401ef1a70eb6ef1a98a78f96a052f98c1894c9cc463a01d2d447d0a12f.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un816139.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un816139.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce cd057d401ef1a70eb6ef1a98a78f96a052f98c1894c9cc463a01d2d447d0a12f.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro4036.exequ2689.exesi172041.exepid process 2112 pro4036.exe 2112 pro4036.exe 3348 qu2689.exe 3348 qu2689.exe 408 si172041.exe 408 si172041.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro4036.exequ2689.exesi172041.exedescription pid process Token: SeDebugPrivilege 2112 pro4036.exe Token: SeDebugPrivilege 3348 qu2689.exe Token: SeDebugPrivilege 408 si172041.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
cd057d401ef1a70eb6ef1a98a78f96a052f98c1894c9cc463a01d2d447d0a12f.exeun816139.exedescription pid process target process PID 1604 wrote to memory of 1876 1604 cd057d401ef1a70eb6ef1a98a78f96a052f98c1894c9cc463a01d2d447d0a12f.exe un816139.exe PID 1604 wrote to memory of 1876 1604 cd057d401ef1a70eb6ef1a98a78f96a052f98c1894c9cc463a01d2d447d0a12f.exe un816139.exe PID 1604 wrote to memory of 1876 1604 cd057d401ef1a70eb6ef1a98a78f96a052f98c1894c9cc463a01d2d447d0a12f.exe un816139.exe PID 1876 wrote to memory of 2112 1876 un816139.exe pro4036.exe PID 1876 wrote to memory of 2112 1876 un816139.exe pro4036.exe PID 1876 wrote to memory of 2112 1876 un816139.exe pro4036.exe PID 1876 wrote to memory of 3348 1876 un816139.exe qu2689.exe PID 1876 wrote to memory of 3348 1876 un816139.exe qu2689.exe PID 1876 wrote to memory of 3348 1876 un816139.exe qu2689.exe PID 1604 wrote to memory of 408 1604 cd057d401ef1a70eb6ef1a98a78f96a052f98c1894c9cc463a01d2d447d0a12f.exe si172041.exe PID 1604 wrote to memory of 408 1604 cd057d401ef1a70eb6ef1a98a78f96a052f98c1894c9cc463a01d2d447d0a12f.exe si172041.exe PID 1604 wrote to memory of 408 1604 cd057d401ef1a70eb6ef1a98a78f96a052f98c1894c9cc463a01d2d447d0a12f.exe si172041.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd057d401ef1a70eb6ef1a98a78f96a052f98c1894c9cc463a01d2d447d0a12f.exe"C:\Users\Admin\AppData\Local\Temp\cd057d401ef1a70eb6ef1a98a78f96a052f98c1894c9cc463a01d2d447d0a12f.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un816139.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un816139.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4036.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4036.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2689.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2689.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si172041.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si172041.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si172041.exeFilesize
175KB
MD563819a8532b3ed5fb6988fa9af0aab54
SHA10a21aa45e6fe9ef08b010bfd6c9665bbf703fe8c
SHA2561509707c2bf903cde128fffed3180eca1bce21d384eadd21e38755830efa173f
SHA512686676b1d2d1a508dd8d81797f8414f9d775887de72acd4e35bf2290496ae7348ee88dae5bf90ecc4d71e14d58c196405120fc97368f910aecb73b3d3d57c7b8
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si172041.exeFilesize
175KB
MD563819a8532b3ed5fb6988fa9af0aab54
SHA10a21aa45e6fe9ef08b010bfd6c9665bbf703fe8c
SHA2561509707c2bf903cde128fffed3180eca1bce21d384eadd21e38755830efa173f
SHA512686676b1d2d1a508dd8d81797f8414f9d775887de72acd4e35bf2290496ae7348ee88dae5bf90ecc4d71e14d58c196405120fc97368f910aecb73b3d3d57c7b8
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un816139.exeFilesize
556KB
MD5ec88ca33cba7ce67d82ade0ed9250bc4
SHA1f5477871fce717ae04d6aea50e84c51bde6253e8
SHA2564c82bccf3fb9a2e2eb172f1fcad82d11e5a44809fc517b93a7ddd2b4967d7d29
SHA5127b4f7d948237f4c4b20f5ab152d671bc9513514926721fed94429d0ecbf5c8cfa15f6c66a82d393de771677ad2fbc986f7028476fac9e9bd2c8608f39fbee318
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un816139.exeFilesize
556KB
MD5ec88ca33cba7ce67d82ade0ed9250bc4
SHA1f5477871fce717ae04d6aea50e84c51bde6253e8
SHA2564c82bccf3fb9a2e2eb172f1fcad82d11e5a44809fc517b93a7ddd2b4967d7d29
SHA5127b4f7d948237f4c4b20f5ab152d671bc9513514926721fed94429d0ecbf5c8cfa15f6c66a82d393de771677ad2fbc986f7028476fac9e9bd2c8608f39fbee318
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4036.exeFilesize
347KB
MD5c1df10af6d4a95ab313453f52b351ace
SHA1fd3914b25156bf07f3d27c8f34235022b64e77a5
SHA25659b38f14f35e70a066a2f66ab321ccd591ac0bd422e89e2677608fbf45f52bdb
SHA5128442b2395f4d03f5c67ebb71c052b9b2484fb40f6244f98cecfba2714d015d0034a3ae676e91d450d03a6458b0bee1fc23a5f955f62aa103afed34e68f05d9f6
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4036.exeFilesize
347KB
MD5c1df10af6d4a95ab313453f52b351ace
SHA1fd3914b25156bf07f3d27c8f34235022b64e77a5
SHA25659b38f14f35e70a066a2f66ab321ccd591ac0bd422e89e2677608fbf45f52bdb
SHA5128442b2395f4d03f5c67ebb71c052b9b2484fb40f6244f98cecfba2714d015d0034a3ae676e91d450d03a6458b0bee1fc23a5f955f62aa103afed34e68f05d9f6
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2689.exeFilesize
406KB
MD544817b9873a5ee26853d4633852ad811
SHA193b1265dc3e351da5a5430026c7585996f5ca731
SHA256b7b9b79c532eea6ca381daa76ac2c0f2471bfa16bb9e9854a9448b7b8879a20a
SHA5125a1704a1a050b513ffc1df4de8318c89ab5439bc6da4b8ae2bf0ecef5e7633991536cda6f65c16b7f711cd9d1abd04b3de9b646f1be5971094e413f275b902a1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2689.exeFilesize
406KB
MD544817b9873a5ee26853d4633852ad811
SHA193b1265dc3e351da5a5430026c7585996f5ca731
SHA256b7b9b79c532eea6ca381daa76ac2c0f2471bfa16bb9e9854a9448b7b8879a20a
SHA5125a1704a1a050b513ffc1df4de8318c89ab5439bc6da4b8ae2bf0ecef5e7633991536cda6f65c16b7f711cd9d1abd04b3de9b646f1be5971094e413f275b902a1
-
memory/408-1114-0x0000000000720000-0x0000000000752000-memory.dmpFilesize
200KB
-
memory/408-1115-0x0000000004FA0000-0x0000000004FEB000-memory.dmpFilesize
300KB
-
memory/408-1116-0x0000000004FF0000-0x0000000005000000-memory.dmpFilesize
64KB
-
memory/2112-146-0x00000000070B0000-0x00000000070C2000-memory.dmpFilesize
72KB
-
memory/2112-158-0x00000000070B0000-0x00000000070C2000-memory.dmpFilesize
72KB
-
memory/2112-140-0x00000000071E0000-0x00000000071F0000-memory.dmpFilesize
64KB
-
memory/2112-141-0x00000000071E0000-0x00000000071F0000-memory.dmpFilesize
64KB
-
memory/2112-142-0x00000000071E0000-0x00000000071F0000-memory.dmpFilesize
64KB
-
memory/2112-143-0x00000000070B0000-0x00000000070C2000-memory.dmpFilesize
72KB
-
memory/2112-144-0x00000000070B0000-0x00000000070C2000-memory.dmpFilesize
72KB
-
memory/2112-138-0x00000000070B0000-0x00000000070C8000-memory.dmpFilesize
96KB
-
memory/2112-148-0x00000000070B0000-0x00000000070C2000-memory.dmpFilesize
72KB
-
memory/2112-150-0x00000000070B0000-0x00000000070C2000-memory.dmpFilesize
72KB
-
memory/2112-152-0x00000000070B0000-0x00000000070C2000-memory.dmpFilesize
72KB
-
memory/2112-154-0x00000000070B0000-0x00000000070C2000-memory.dmpFilesize
72KB
-
memory/2112-156-0x00000000070B0000-0x00000000070C2000-memory.dmpFilesize
72KB
-
memory/2112-139-0x0000000002C60000-0x0000000002C8D000-memory.dmpFilesize
180KB
-
memory/2112-160-0x00000000070B0000-0x00000000070C2000-memory.dmpFilesize
72KB
-
memory/2112-162-0x00000000070B0000-0x00000000070C2000-memory.dmpFilesize
72KB
-
memory/2112-164-0x00000000070B0000-0x00000000070C2000-memory.dmpFilesize
72KB
-
memory/2112-166-0x00000000070B0000-0x00000000070C2000-memory.dmpFilesize
72KB
-
memory/2112-168-0x00000000070B0000-0x00000000070C2000-memory.dmpFilesize
72KB
-
memory/2112-170-0x00000000070B0000-0x00000000070C2000-memory.dmpFilesize
72KB
-
memory/2112-171-0x0000000000400000-0x0000000002B84000-memory.dmpFilesize
39.5MB
-
memory/2112-173-0x00000000071E0000-0x00000000071F0000-memory.dmpFilesize
64KB
-
memory/2112-172-0x00000000071E0000-0x00000000071F0000-memory.dmpFilesize
64KB
-
memory/2112-175-0x0000000000400000-0x0000000002B84000-memory.dmpFilesize
39.5MB
-
memory/2112-137-0x00000000071F0000-0x00000000076EE000-memory.dmpFilesize
5.0MB
-
memory/2112-136-0x0000000004890000-0x00000000048AA000-memory.dmpFilesize
104KB
-
memory/3348-183-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/3348-215-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/3348-184-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/3348-186-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/3348-188-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/3348-190-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/3348-192-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/3348-194-0x0000000007240000-0x0000000007250000-memory.dmpFilesize
64KB
-
memory/3348-193-0x0000000007240000-0x0000000007250000-memory.dmpFilesize
64KB
-
memory/3348-197-0x0000000007240000-0x0000000007250000-memory.dmpFilesize
64KB
-
memory/3348-196-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/3348-199-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/3348-201-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/3348-203-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/3348-205-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/3348-207-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/3348-209-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/3348-211-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/3348-213-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/3348-182-0x0000000004A40000-0x0000000004A84000-memory.dmpFilesize
272KB
-
memory/3348-217-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/3348-219-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/3348-1092-0x0000000007750000-0x0000000007D56000-memory.dmpFilesize
6.0MB
-
memory/3348-1093-0x0000000007D60000-0x0000000007E6A000-memory.dmpFilesize
1.0MB
-
memory/3348-1094-0x0000000007E80000-0x0000000007E92000-memory.dmpFilesize
72KB
-
memory/3348-1095-0x0000000007240000-0x0000000007250000-memory.dmpFilesize
64KB
-
memory/3348-1096-0x0000000007EA0000-0x0000000007EDE000-memory.dmpFilesize
248KB
-
memory/3348-1097-0x0000000007FF0000-0x000000000803B000-memory.dmpFilesize
300KB
-
memory/3348-1099-0x0000000007240000-0x0000000007250000-memory.dmpFilesize
64KB
-
memory/3348-1100-0x0000000007240000-0x0000000007250000-memory.dmpFilesize
64KB
-
memory/3348-1101-0x0000000007240000-0x0000000007250000-memory.dmpFilesize
64KB
-
memory/3348-1102-0x0000000008180000-0x0000000008212000-memory.dmpFilesize
584KB
-
memory/3348-1103-0x0000000008220000-0x0000000008286000-memory.dmpFilesize
408KB
-
memory/3348-1104-0x0000000008A10000-0x0000000008A86000-memory.dmpFilesize
472KB
-
memory/3348-1105-0x0000000008A90000-0x0000000008AE0000-memory.dmpFilesize
320KB
-
memory/3348-181-0x0000000004700000-0x0000000004746000-memory.dmpFilesize
280KB
-
memory/3348-180-0x0000000002C70000-0x0000000002CBB000-memory.dmpFilesize
300KB
-
memory/3348-1106-0x0000000008B20000-0x0000000008CE2000-memory.dmpFilesize
1.8MB
-
memory/3348-1107-0x0000000008CF0000-0x000000000921C000-memory.dmpFilesize
5.2MB
-
memory/3348-1108-0x0000000007240000-0x0000000007250000-memory.dmpFilesize
64KB