Analysis
-
max time kernel
57s -
max time network
58s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
28-03-2023 11:40
Static task
static1
Behavioral task
behavioral1
Sample
7e9c412c4cee37657af454e1d788575dea4544806cd875afc013f81c83ecb052.exe
Resource
win10-20230220-en
General
-
Target
7e9c412c4cee37657af454e1d788575dea4544806cd875afc013f81c83ecb052.exe
-
Size
697KB
-
MD5
26dd40047d5c069287efa9159a3e9e47
-
SHA1
ace0230f602de7510ebcf5ce29fdddffb1ce19a6
-
SHA256
7e9c412c4cee37657af454e1d788575dea4544806cd875afc013f81c83ecb052
-
SHA512
81244f59dbb88ccde25132fc47ddd5f265ca7b79748ed97ca54ab99b5a84a4478a262e1b2df7f9f55cd91f75684a990acf85ea92500198efe82b7c350173a6de
-
SSDEEP
12288:NMrDy90h7vYps5diYO4s8aUEZZhrp/YDx8BFtmsblXxL6NjGjJAxI9gXMKm:WyevYuUas8VEZH4xurUGjCI9s4
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
muse
176.113.115.145:4125
-
auth_value
b91988a63a24940038d9262827a5320c
Signatures
-
Processes:
pro4020.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro4020.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro4020.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro4020.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro4020.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro4020.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/2112-179-0x0000000007090000-0x00000000070D6000-memory.dmp family_redline behavioral1/memory/2112-180-0x0000000007640000-0x0000000007684000-memory.dmp family_redline behavioral1/memory/2112-181-0x0000000007640000-0x000000000767F000-memory.dmp family_redline behavioral1/memory/2112-182-0x0000000007640000-0x000000000767F000-memory.dmp family_redline behavioral1/memory/2112-184-0x0000000007640000-0x000000000767F000-memory.dmp family_redline behavioral1/memory/2112-187-0x0000000007640000-0x000000000767F000-memory.dmp family_redline behavioral1/memory/2112-193-0x0000000007640000-0x000000000767F000-memory.dmp family_redline behavioral1/memory/2112-190-0x0000000007640000-0x000000000767F000-memory.dmp family_redline behavioral1/memory/2112-195-0x0000000007640000-0x000000000767F000-memory.dmp family_redline behavioral1/memory/2112-197-0x0000000007640000-0x000000000767F000-memory.dmp family_redline behavioral1/memory/2112-199-0x0000000007640000-0x000000000767F000-memory.dmp family_redline behavioral1/memory/2112-201-0x0000000007640000-0x000000000767F000-memory.dmp family_redline behavioral1/memory/2112-203-0x0000000007640000-0x000000000767F000-memory.dmp family_redline behavioral1/memory/2112-205-0x0000000007640000-0x000000000767F000-memory.dmp family_redline behavioral1/memory/2112-207-0x0000000007640000-0x000000000767F000-memory.dmp family_redline behavioral1/memory/2112-209-0x0000000007640000-0x000000000767F000-memory.dmp family_redline behavioral1/memory/2112-211-0x0000000007640000-0x000000000767F000-memory.dmp family_redline behavioral1/memory/2112-213-0x0000000007640000-0x000000000767F000-memory.dmp family_redline behavioral1/memory/2112-215-0x0000000007640000-0x000000000767F000-memory.dmp family_redline behavioral1/memory/2112-217-0x0000000007640000-0x000000000767F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un593120.exepro4020.exequ8320.exesi449726.exepid process 3668 un593120.exe 4112 pro4020.exe 2112 qu8320.exe 4812 si449726.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro4020.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro4020.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro4020.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
7e9c412c4cee37657af454e1d788575dea4544806cd875afc013f81c83ecb052.exeun593120.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 7e9c412c4cee37657af454e1d788575dea4544806cd875afc013f81c83ecb052.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 7e9c412c4cee37657af454e1d788575dea4544806cd875afc013f81c83ecb052.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un593120.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un593120.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro4020.exequ8320.exesi449726.exepid process 4112 pro4020.exe 4112 pro4020.exe 2112 qu8320.exe 2112 qu8320.exe 4812 si449726.exe 4812 si449726.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro4020.exequ8320.exesi449726.exedescription pid process Token: SeDebugPrivilege 4112 pro4020.exe Token: SeDebugPrivilege 2112 qu8320.exe Token: SeDebugPrivilege 4812 si449726.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
7e9c412c4cee37657af454e1d788575dea4544806cd875afc013f81c83ecb052.exeun593120.exedescription pid process target process PID 4208 wrote to memory of 3668 4208 7e9c412c4cee37657af454e1d788575dea4544806cd875afc013f81c83ecb052.exe un593120.exe PID 4208 wrote to memory of 3668 4208 7e9c412c4cee37657af454e1d788575dea4544806cd875afc013f81c83ecb052.exe un593120.exe PID 4208 wrote to memory of 3668 4208 7e9c412c4cee37657af454e1d788575dea4544806cd875afc013f81c83ecb052.exe un593120.exe PID 3668 wrote to memory of 4112 3668 un593120.exe pro4020.exe PID 3668 wrote to memory of 4112 3668 un593120.exe pro4020.exe PID 3668 wrote to memory of 4112 3668 un593120.exe pro4020.exe PID 3668 wrote to memory of 2112 3668 un593120.exe qu8320.exe PID 3668 wrote to memory of 2112 3668 un593120.exe qu8320.exe PID 3668 wrote to memory of 2112 3668 un593120.exe qu8320.exe PID 4208 wrote to memory of 4812 4208 7e9c412c4cee37657af454e1d788575dea4544806cd875afc013f81c83ecb052.exe si449726.exe PID 4208 wrote to memory of 4812 4208 7e9c412c4cee37657af454e1d788575dea4544806cd875afc013f81c83ecb052.exe si449726.exe PID 4208 wrote to memory of 4812 4208 7e9c412c4cee37657af454e1d788575dea4544806cd875afc013f81c83ecb052.exe si449726.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e9c412c4cee37657af454e1d788575dea4544806cd875afc013f81c83ecb052.exe"C:\Users\Admin\AppData\Local\Temp\7e9c412c4cee37657af454e1d788575dea4544806cd875afc013f81c83ecb052.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un593120.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un593120.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4020.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4020.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8320.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8320.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si449726.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si449726.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si449726.exeFilesize
175KB
MD5ffddc1dfdb5ac319148c11de295be3c6
SHA1ef75c0458a91c67f34159868ed39a9c0beae34e6
SHA256f84995338f5b9b195ed581de4fdac19c4d931d016889bb074bf4d08d1c0ec666
SHA512a964814254c7c6cc2117a5e3e3e14e2f8b582090f30e4d70eebb9dabd3fb6c6fade2cd98a6875e05e57568e936b0aa0eab6f4e755e39b43c117676ca25d63dfb
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si449726.exeFilesize
175KB
MD5ffddc1dfdb5ac319148c11de295be3c6
SHA1ef75c0458a91c67f34159868ed39a9c0beae34e6
SHA256f84995338f5b9b195ed581de4fdac19c4d931d016889bb074bf4d08d1c0ec666
SHA512a964814254c7c6cc2117a5e3e3e14e2f8b582090f30e4d70eebb9dabd3fb6c6fade2cd98a6875e05e57568e936b0aa0eab6f4e755e39b43c117676ca25d63dfb
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un593120.exeFilesize
555KB
MD53549949daeedca7ffc10447e977e4f87
SHA119148150c4c337bccbcaec3d91aa483ced23e0bc
SHA2560144ca8670e218fd742ffd60e9b080e90db60007432190d06c7ace5bf9c0e7a4
SHA512b520002bf9bc371f31747f4c3c21ddda98877f9745953978ab9a2bfe32eb69a6675724dd07121f6a9427fe188afe637781b6e38caf9b41784a4aca98e80ee72c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un593120.exeFilesize
555KB
MD53549949daeedca7ffc10447e977e4f87
SHA119148150c4c337bccbcaec3d91aa483ced23e0bc
SHA2560144ca8670e218fd742ffd60e9b080e90db60007432190d06c7ace5bf9c0e7a4
SHA512b520002bf9bc371f31747f4c3c21ddda98877f9745953978ab9a2bfe32eb69a6675724dd07121f6a9427fe188afe637781b6e38caf9b41784a4aca98e80ee72c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4020.exeFilesize
347KB
MD56855f278d00429c17498a63e79ea7f99
SHA17baf683f7b4c90b9835fdff132037ffe2887269a
SHA2562fce4d4561569974f86a65fbf6565e679648a8f8f230e70f584457ac3336865e
SHA512c6d1b0913fecef9b2a47e5f8b57f22e06e6f52e9fe662983f182d514cb08ae65f7291b94f7fd9b0854c56daaf6d856b267ce82be0369c454544f1672d93a5237
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4020.exeFilesize
347KB
MD56855f278d00429c17498a63e79ea7f99
SHA17baf683f7b4c90b9835fdff132037ffe2887269a
SHA2562fce4d4561569974f86a65fbf6565e679648a8f8f230e70f584457ac3336865e
SHA512c6d1b0913fecef9b2a47e5f8b57f22e06e6f52e9fe662983f182d514cb08ae65f7291b94f7fd9b0854c56daaf6d856b267ce82be0369c454544f1672d93a5237
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8320.exeFilesize
406KB
MD5e3f767b2e218ce619e52b796642ed79d
SHA1bffc67c135bcb1b5273ad5cbb8b751a83fe0248e
SHA256e212e06e3d328b5c9e6113532d6b2deaca0f155b01b5785440e63575935c7861
SHA512316d999323b96a4cea8516d520b487f9b23a8b2c41ce669b41b156cab05b43542fdfc63ca88f7f691eea337b9cf7f1c79fb6d46e4a121eae08cf0776d73f7e0d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8320.exeFilesize
406KB
MD5e3f767b2e218ce619e52b796642ed79d
SHA1bffc67c135bcb1b5273ad5cbb8b751a83fe0248e
SHA256e212e06e3d328b5c9e6113532d6b2deaca0f155b01b5785440e63575935c7861
SHA512316d999323b96a4cea8516d520b487f9b23a8b2c41ce669b41b156cab05b43542fdfc63ca88f7f691eea337b9cf7f1c79fb6d46e4a121eae08cf0776d73f7e0d
-
memory/2112-1090-0x0000000007CC0000-0x00000000082C6000-memory.dmpFilesize
6.0MB
-
memory/2112-213-0x0000000007640000-0x000000000767F000-memory.dmpFilesize
252KB
-
memory/2112-1104-0x0000000007130000-0x0000000007140000-memory.dmpFilesize
64KB
-
memory/2112-1103-0x0000000009470000-0x00000000094C0000-memory.dmpFilesize
320KB
-
memory/2112-1102-0x00000000093F0000-0x0000000009466000-memory.dmpFilesize
472KB
-
memory/2112-193-0x0000000007640000-0x000000000767F000-memory.dmpFilesize
252KB
-
memory/2112-1101-0x0000000008CC0000-0x00000000091EC000-memory.dmpFilesize
5.2MB
-
memory/2112-1100-0x0000000008AF0000-0x0000000008CB2000-memory.dmpFilesize
1.8MB
-
memory/2112-1099-0x0000000008850000-0x00000000088E2000-memory.dmpFilesize
584KB
-
memory/2112-1098-0x0000000007B70000-0x0000000007BD6000-memory.dmpFilesize
408KB
-
memory/2112-1097-0x0000000007130000-0x0000000007140000-memory.dmpFilesize
64KB
-
memory/2112-1095-0x00000000079E0000-0x0000000007A2B000-memory.dmpFilesize
300KB
-
memory/2112-1094-0x0000000007890000-0x00000000078CE000-memory.dmpFilesize
248KB
-
memory/2112-190-0x0000000007640000-0x000000000767F000-memory.dmpFilesize
252KB
-
memory/2112-1093-0x0000000007130000-0x0000000007140000-memory.dmpFilesize
64KB
-
memory/2112-1092-0x0000000007870000-0x0000000007882000-memory.dmpFilesize
72KB
-
memory/2112-1091-0x0000000007730000-0x000000000783A000-memory.dmpFilesize
1.0MB
-
memory/2112-217-0x0000000007640000-0x000000000767F000-memory.dmpFilesize
252KB
-
memory/2112-215-0x0000000007640000-0x000000000767F000-memory.dmpFilesize
252KB
-
memory/2112-201-0x0000000007640000-0x000000000767F000-memory.dmpFilesize
252KB
-
memory/2112-211-0x0000000007640000-0x000000000767F000-memory.dmpFilesize
252KB
-
memory/2112-209-0x0000000007640000-0x000000000767F000-memory.dmpFilesize
252KB
-
memory/2112-207-0x0000000007640000-0x000000000767F000-memory.dmpFilesize
252KB
-
memory/2112-179-0x0000000007090000-0x00000000070D6000-memory.dmpFilesize
280KB
-
memory/2112-180-0x0000000007640000-0x0000000007684000-memory.dmpFilesize
272KB
-
memory/2112-195-0x0000000007640000-0x000000000767F000-memory.dmpFilesize
252KB
-
memory/2112-182-0x0000000007640000-0x000000000767F000-memory.dmpFilesize
252KB
-
memory/2112-184-0x0000000007640000-0x000000000767F000-memory.dmpFilesize
252KB
-
memory/2112-186-0x00000000045A0000-0x00000000045EB000-memory.dmpFilesize
300KB
-
memory/2112-187-0x0000000007640000-0x000000000767F000-memory.dmpFilesize
252KB
-
memory/2112-188-0x0000000007130000-0x0000000007140000-memory.dmpFilesize
64KB
-
memory/2112-191-0x0000000007130000-0x0000000007140000-memory.dmpFilesize
64KB
-
memory/2112-205-0x0000000007640000-0x000000000767F000-memory.dmpFilesize
252KB
-
memory/2112-203-0x0000000007640000-0x000000000767F000-memory.dmpFilesize
252KB
-
memory/2112-181-0x0000000007640000-0x000000000767F000-memory.dmpFilesize
252KB
-
memory/2112-197-0x0000000007640000-0x000000000767F000-memory.dmpFilesize
252KB
-
memory/2112-199-0x0000000007640000-0x000000000767F000-memory.dmpFilesize
252KB
-
memory/4112-170-0x0000000004C40000-0x0000000004C50000-memory.dmpFilesize
64KB
-
memory/4112-164-0x00000000047E0000-0x00000000047F2000-memory.dmpFilesize
72KB
-
memory/4112-148-0x00000000047E0000-0x00000000047F2000-memory.dmpFilesize
72KB
-
memory/4112-139-0x0000000007140000-0x000000000763E000-memory.dmpFilesize
5.0MB
-
memory/4112-140-0x00000000047E0000-0x00000000047F8000-memory.dmpFilesize
96KB
-
memory/4112-173-0x0000000000400000-0x0000000002B84000-memory.dmpFilesize
39.5MB
-
memory/4112-174-0x0000000004C40000-0x0000000004C50000-memory.dmpFilesize
64KB
-
memory/4112-171-0x0000000000400000-0x0000000002B84000-memory.dmpFilesize
39.5MB
-
memory/4112-141-0x00000000047E0000-0x00000000047F2000-memory.dmpFilesize
72KB
-
memory/4112-138-0x0000000002D70000-0x0000000002D8A000-memory.dmpFilesize
104KB
-
memory/4112-169-0x0000000004C40000-0x0000000004C50000-memory.dmpFilesize
64KB
-
memory/4112-168-0x00000000047E0000-0x00000000047F2000-memory.dmpFilesize
72KB
-
memory/4112-166-0x00000000047E0000-0x00000000047F2000-memory.dmpFilesize
72KB
-
memory/4112-162-0x00000000047E0000-0x00000000047F2000-memory.dmpFilesize
72KB
-
memory/4112-160-0x00000000047E0000-0x00000000047F2000-memory.dmpFilesize
72KB
-
memory/4112-158-0x00000000047E0000-0x00000000047F2000-memory.dmpFilesize
72KB
-
memory/4112-156-0x00000000047E0000-0x00000000047F2000-memory.dmpFilesize
72KB
-
memory/4112-154-0x00000000047E0000-0x00000000047F2000-memory.dmpFilesize
72KB
-
memory/4112-152-0x00000000047E0000-0x00000000047F2000-memory.dmpFilesize
72KB
-
memory/4112-150-0x00000000047E0000-0x00000000047F2000-memory.dmpFilesize
72KB
-
memory/4112-146-0x00000000047E0000-0x00000000047F2000-memory.dmpFilesize
72KB
-
memory/4112-144-0x00000000047E0000-0x00000000047F2000-memory.dmpFilesize
72KB
-
memory/4112-142-0x00000000047E0000-0x00000000047F2000-memory.dmpFilesize
72KB
-
memory/4112-137-0x0000000004C40000-0x0000000004C50000-memory.dmpFilesize
64KB
-
memory/4112-136-0x00000000001D0000-0x00000000001FD000-memory.dmpFilesize
180KB
-
memory/4812-1110-0x00000000002D0000-0x0000000000302000-memory.dmpFilesize
200KB
-
memory/4812-1111-0x0000000004D10000-0x0000000004D5B000-memory.dmpFilesize
300KB
-
memory/4812-1112-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB