Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 11:30
Static task
static1
Behavioral task
behavioral1
Sample
2a456bcc9ce28314498e8a0c89e10eeeaf8252ae5c4367cb3b7a0991e5209c8f.exe
Resource
win10v2004-20230220-en
General
-
Target
2a456bcc9ce28314498e8a0c89e10eeeaf8252ae5c4367cb3b7a0991e5209c8f.exe
-
Size
697KB
-
MD5
4a58899ebe230977a84fc23bb863c7a2
-
SHA1
fdd660d2c68f037532280a6deeea0191e7782290
-
SHA256
2a456bcc9ce28314498e8a0c89e10eeeaf8252ae5c4367cb3b7a0991e5209c8f
-
SHA512
d54f54213db87f4ef1949ce1490f2c1b99b6c262b68a5f8cf87e738c2256b83233593ff18038bf0af2bfa7c4f91a33b8d618ae858d9adb77f9cd1a8088a7e5e7
-
SSDEEP
12288:UMr3y907SWJMpheNwb9ZNreZZZhrp/Yvx8kHc3L678GjmAxI9gFGne4tSlB:bywvJ5QFCZZHGxcPGjbI9UF4tMB
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
muse
176.113.115.145:4125
-
auth_value
b91988a63a24940038d9262827a5320c
Signatures
-
Processes:
pro1524.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro1524.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro1524.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro1524.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro1524.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro1524.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro1524.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/4968-195-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/4968-196-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/4968-198-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/4968-200-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/4968-202-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/4968-204-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/4968-206-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/4968-208-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/4968-210-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/4968-212-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/4968-214-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/4968-216-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/4968-218-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/4968-220-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/4968-222-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/4968-224-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/4968-226-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/4968-228-0x0000000007140000-0x000000000717F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un439720.exepro1524.exequ2755.exesi688344.exepid process 3460 un439720.exe 3216 pro1524.exe 4968 qu2755.exe 4960 si688344.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro1524.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro1524.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro1524.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
2a456bcc9ce28314498e8a0c89e10eeeaf8252ae5c4367cb3b7a0991e5209c8f.exeun439720.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 2a456bcc9ce28314498e8a0c89e10eeeaf8252ae5c4367cb3b7a0991e5209c8f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 2a456bcc9ce28314498e8a0c89e10eeeaf8252ae5c4367cb3b7a0991e5209c8f.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un439720.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un439720.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 100 3216 WerFault.exe pro1524.exe 948 4968 WerFault.exe qu2755.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro1524.exequ2755.exesi688344.exepid process 3216 pro1524.exe 3216 pro1524.exe 4968 qu2755.exe 4968 qu2755.exe 4960 si688344.exe 4960 si688344.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro1524.exequ2755.exesi688344.exedescription pid process Token: SeDebugPrivilege 3216 pro1524.exe Token: SeDebugPrivilege 4968 qu2755.exe Token: SeDebugPrivilege 4960 si688344.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
2a456bcc9ce28314498e8a0c89e10eeeaf8252ae5c4367cb3b7a0991e5209c8f.exeun439720.exedescription pid process target process PID 1224 wrote to memory of 3460 1224 2a456bcc9ce28314498e8a0c89e10eeeaf8252ae5c4367cb3b7a0991e5209c8f.exe un439720.exe PID 1224 wrote to memory of 3460 1224 2a456bcc9ce28314498e8a0c89e10eeeaf8252ae5c4367cb3b7a0991e5209c8f.exe un439720.exe PID 1224 wrote to memory of 3460 1224 2a456bcc9ce28314498e8a0c89e10eeeaf8252ae5c4367cb3b7a0991e5209c8f.exe un439720.exe PID 3460 wrote to memory of 3216 3460 un439720.exe pro1524.exe PID 3460 wrote to memory of 3216 3460 un439720.exe pro1524.exe PID 3460 wrote to memory of 3216 3460 un439720.exe pro1524.exe PID 3460 wrote to memory of 4968 3460 un439720.exe qu2755.exe PID 3460 wrote to memory of 4968 3460 un439720.exe qu2755.exe PID 3460 wrote to memory of 4968 3460 un439720.exe qu2755.exe PID 1224 wrote to memory of 4960 1224 2a456bcc9ce28314498e8a0c89e10eeeaf8252ae5c4367cb3b7a0991e5209c8f.exe si688344.exe PID 1224 wrote to memory of 4960 1224 2a456bcc9ce28314498e8a0c89e10eeeaf8252ae5c4367cb3b7a0991e5209c8f.exe si688344.exe PID 1224 wrote to memory of 4960 1224 2a456bcc9ce28314498e8a0c89e10eeeaf8252ae5c4367cb3b7a0991e5209c8f.exe si688344.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a456bcc9ce28314498e8a0c89e10eeeaf8252ae5c4367cb3b7a0991e5209c8f.exe"C:\Users\Admin\AppData\Local\Temp\2a456bcc9ce28314498e8a0c89e10eeeaf8252ae5c4367cb3b7a0991e5209c8f.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un439720.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un439720.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1524.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1524.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3216 -s 10844⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2755.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2755.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 17524⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si688344.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si688344.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3216 -ip 32161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 4968 -ip 49681⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si688344.exeFilesize
175KB
MD55fe848c9a9ded2e3e96c33516506c78f
SHA1e68b1f41e23e755ed9e33295b39f6c0b305c6739
SHA256c3d546c3a5d1e553d219741b8b1de5f55ee6e470f7fd469839800f9c5394196f
SHA512ca72d691417f890767f7fb9fe4a6f7da0a824e65946015eaadbb9e4d519f7161c087efcd334c1409d25ba780c5bd9d9c40eda604568ac58131ee9899cf92cd82
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si688344.exeFilesize
175KB
MD55fe848c9a9ded2e3e96c33516506c78f
SHA1e68b1f41e23e755ed9e33295b39f6c0b305c6739
SHA256c3d546c3a5d1e553d219741b8b1de5f55ee6e470f7fd469839800f9c5394196f
SHA512ca72d691417f890767f7fb9fe4a6f7da0a824e65946015eaadbb9e4d519f7161c087efcd334c1409d25ba780c5bd9d9c40eda604568ac58131ee9899cf92cd82
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un439720.exeFilesize
555KB
MD5e90938baa299605967717827ed85b567
SHA101cd84c8c346bdb11d0bca685ae5dbf322a23ad6
SHA256bd8ff37f52e8b05b0e4e4682adcd9459342976a708de9129657c79a185ecd505
SHA512d2d71ee0af940fe724d203d99373210748530cf7c4fe5e3053f7b7c15baf6e5771cd9ecd9e3ba1ed111c42889e106a63e550ed2fd7740415db4848f7fc1c99d2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un439720.exeFilesize
555KB
MD5e90938baa299605967717827ed85b567
SHA101cd84c8c346bdb11d0bca685ae5dbf322a23ad6
SHA256bd8ff37f52e8b05b0e4e4682adcd9459342976a708de9129657c79a185ecd505
SHA512d2d71ee0af940fe724d203d99373210748530cf7c4fe5e3053f7b7c15baf6e5771cd9ecd9e3ba1ed111c42889e106a63e550ed2fd7740415db4848f7fc1c99d2
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1524.exeFilesize
347KB
MD56cac4218f927a4e51fa0d189e35fd026
SHA191ee48c2dd9eecb967bf0c39b6d5901f1dbe8f0d
SHA2566243a1351e7650d095fe653abe17297fd4aae583b0ad1a147e0e0f2ef99bf1cf
SHA5127b2848d7cfa6d85c4e1ad6d5c3b6fea6a413f28378ca13423f5156a6a87bb061d4e5a58b84bdbef2b0ca209ae25762731bf2d9f9e954f5909f12309f68669185
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1524.exeFilesize
347KB
MD56cac4218f927a4e51fa0d189e35fd026
SHA191ee48c2dd9eecb967bf0c39b6d5901f1dbe8f0d
SHA2566243a1351e7650d095fe653abe17297fd4aae583b0ad1a147e0e0f2ef99bf1cf
SHA5127b2848d7cfa6d85c4e1ad6d5c3b6fea6a413f28378ca13423f5156a6a87bb061d4e5a58b84bdbef2b0ca209ae25762731bf2d9f9e954f5909f12309f68669185
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2755.exeFilesize
406KB
MD5b178769fc851097d81e92a011ec9d3d2
SHA16c24aab16f22c9e05f79b1a7524fdda37a306b94
SHA2567c5a8f0af8c2bcf5a0e2e91a8e3b28767dbed49aecf41418e1de5adef3c5dccd
SHA512e6ec97c61b5b00242251363f15f69b059ae0ad19d9fc00633de2cb224f72dc2cdae581a58451f0ba969bc0421704c972efd3fd9a141e73899a93117673f19299
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2755.exeFilesize
406KB
MD5b178769fc851097d81e92a011ec9d3d2
SHA16c24aab16f22c9e05f79b1a7524fdda37a306b94
SHA2567c5a8f0af8c2bcf5a0e2e91a8e3b28767dbed49aecf41418e1de5adef3c5dccd
SHA512e6ec97c61b5b00242251363f15f69b059ae0ad19d9fc00633de2cb224f72dc2cdae581a58451f0ba969bc0421704c972efd3fd9a141e73899a93117673f19299
-
memory/3216-148-0x0000000002C90000-0x0000000002CBD000-memory.dmpFilesize
180KB
-
memory/3216-149-0x00000000073A0000-0x0000000007944000-memory.dmpFilesize
5.6MB
-
memory/3216-150-0x0000000007390000-0x00000000073A0000-memory.dmpFilesize
64KB
-
memory/3216-151-0x0000000007390000-0x00000000073A0000-memory.dmpFilesize
64KB
-
memory/3216-152-0x0000000007390000-0x00000000073A0000-memory.dmpFilesize
64KB
-
memory/3216-153-0x0000000004D90000-0x0000000004DA2000-memory.dmpFilesize
72KB
-
memory/3216-154-0x0000000004D90000-0x0000000004DA2000-memory.dmpFilesize
72KB
-
memory/3216-156-0x0000000004D90000-0x0000000004DA2000-memory.dmpFilesize
72KB
-
memory/3216-158-0x0000000004D90000-0x0000000004DA2000-memory.dmpFilesize
72KB
-
memory/3216-160-0x0000000004D90000-0x0000000004DA2000-memory.dmpFilesize
72KB
-
memory/3216-162-0x0000000004D90000-0x0000000004DA2000-memory.dmpFilesize
72KB
-
memory/3216-164-0x0000000004D90000-0x0000000004DA2000-memory.dmpFilesize
72KB
-
memory/3216-166-0x0000000004D90000-0x0000000004DA2000-memory.dmpFilesize
72KB
-
memory/3216-168-0x0000000004D90000-0x0000000004DA2000-memory.dmpFilesize
72KB
-
memory/3216-170-0x0000000004D90000-0x0000000004DA2000-memory.dmpFilesize
72KB
-
memory/3216-172-0x0000000004D90000-0x0000000004DA2000-memory.dmpFilesize
72KB
-
memory/3216-174-0x0000000004D90000-0x0000000004DA2000-memory.dmpFilesize
72KB
-
memory/3216-176-0x0000000004D90000-0x0000000004DA2000-memory.dmpFilesize
72KB
-
memory/3216-178-0x0000000004D90000-0x0000000004DA2000-memory.dmpFilesize
72KB
-
memory/3216-180-0x0000000004D90000-0x0000000004DA2000-memory.dmpFilesize
72KB
-
memory/3216-181-0x0000000000400000-0x0000000002B84000-memory.dmpFilesize
39.5MB
-
memory/3216-182-0x0000000007390000-0x00000000073A0000-memory.dmpFilesize
64KB
-
memory/3216-183-0x0000000007390000-0x00000000073A0000-memory.dmpFilesize
64KB
-
memory/3216-184-0x0000000007390000-0x00000000073A0000-memory.dmpFilesize
64KB
-
memory/3216-186-0x0000000000400000-0x0000000002B84000-memory.dmpFilesize
39.5MB
-
memory/4960-1122-0x0000000000AD0000-0x0000000000B02000-memory.dmpFilesize
200KB
-
memory/4960-1124-0x0000000005850000-0x0000000005860000-memory.dmpFilesize
64KB
-
memory/4960-1123-0x0000000005850000-0x0000000005860000-memory.dmpFilesize
64KB
-
memory/4968-193-0x0000000007270000-0x0000000007280000-memory.dmpFilesize
64KB
-
memory/4968-228-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/4968-195-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/4968-196-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/4968-198-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/4968-200-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/4968-202-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/4968-204-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/4968-206-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/4968-208-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/4968-210-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/4968-212-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/4968-214-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/4968-216-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/4968-218-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/4968-220-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/4968-222-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/4968-224-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/4968-226-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/4968-194-0x0000000007270000-0x0000000007280000-memory.dmpFilesize
64KB
-
memory/4968-1101-0x0000000007930000-0x0000000007F48000-memory.dmpFilesize
6.1MB
-
memory/4968-1102-0x0000000007F80000-0x000000000808A000-memory.dmpFilesize
1.0MB
-
memory/4968-1103-0x00000000080C0000-0x00000000080D2000-memory.dmpFilesize
72KB
-
memory/4968-1104-0x00000000080E0000-0x000000000811C000-memory.dmpFilesize
240KB
-
memory/4968-1105-0x0000000007270000-0x0000000007280000-memory.dmpFilesize
64KB
-
memory/4968-1107-0x00000000083D0000-0x0000000008436000-memory.dmpFilesize
408KB
-
memory/4968-1108-0x0000000008A90000-0x0000000008B22000-memory.dmpFilesize
584KB
-
memory/4968-1109-0x0000000008B80000-0x0000000008BF6000-memory.dmpFilesize
472KB
-
memory/4968-1110-0x0000000008C00000-0x0000000008C50000-memory.dmpFilesize
320KB
-
memory/4968-1111-0x0000000008C70000-0x0000000008E32000-memory.dmpFilesize
1.8MB
-
memory/4968-1112-0x0000000008E50000-0x000000000937C000-memory.dmpFilesize
5.2MB
-
memory/4968-1113-0x0000000007270000-0x0000000007280000-memory.dmpFilesize
64KB
-
memory/4968-192-0x0000000007270000-0x0000000007280000-memory.dmpFilesize
64KB
-
memory/4968-191-0x0000000002C70000-0x0000000002CBB000-memory.dmpFilesize
300KB
-
memory/4968-1115-0x0000000007270000-0x0000000007280000-memory.dmpFilesize
64KB
-
memory/4968-1114-0x0000000007270000-0x0000000007280000-memory.dmpFilesize
64KB
-
memory/4968-1116-0x0000000007270000-0x0000000007280000-memory.dmpFilesize
64KB