Analysis
-
max time kernel
93s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 11:50
Static task
static1
Behavioral task
behavioral1
Sample
ec894cf6e3ec97dab64f5b9fc90c5748f84c6ee461aba662e958996af2f51399.exe
Resource
win10v2004-20230220-en
General
-
Target
ec894cf6e3ec97dab64f5b9fc90c5748f84c6ee461aba662e958996af2f51399.exe
-
Size
697KB
-
MD5
891beaad572e8cc95434bc4cd2512f02
-
SHA1
6d6a69476c0f6cf2060b6fe378abfca016b30fbe
-
SHA256
ec894cf6e3ec97dab64f5b9fc90c5748f84c6ee461aba662e958996af2f51399
-
SHA512
3caf6e9e2f0cef134b8fd3fc7d65bb59bac0d17fffe1a4c4bf2f4c9cf50f9b99ed4979874ffc6115cb47b130d3fbfc68c9e0e3bc8211d96eec80e91bdfdf059a
-
SSDEEP
12288:xMrqy90Zb45ljdYK9xqGnr8B/Y6xyXwieBBz9L6rQGjJAxI9gvSq7yaDHEY:ny6b4rjdrr2xQeBDlGjCI9011DkY
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
muse
176.113.115.145:4125
-
auth_value
b91988a63a24940038d9262827a5320c
Signatures
-
Processes:
pro7161.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro7161.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro7161.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro7161.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro7161.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro7161.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro7161.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/2084-192-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/2084-195-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/2084-193-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/2084-197-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/2084-199-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/2084-205-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/2084-203-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/2084-201-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/2084-207-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/2084-209-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/2084-211-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/2084-213-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/2084-219-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/2084-217-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/2084-221-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/2084-223-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/2084-225-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/2084-227-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/2084-1111-0x0000000007430000-0x0000000007440000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un563246.exepro7161.exequ4196.exesi007569.exepid process 3168 un563246.exe 1120 pro7161.exe 2084 qu4196.exe 4192 si007569.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro7161.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro7161.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro7161.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
ec894cf6e3ec97dab64f5b9fc90c5748f84c6ee461aba662e958996af2f51399.exeun563246.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ec894cf6e3ec97dab64f5b9fc90c5748f84c6ee461aba662e958996af2f51399.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" ec894cf6e3ec97dab64f5b9fc90c5748f84c6ee461aba662e958996af2f51399.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un563246.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un563246.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3400 1120 WerFault.exe pro7161.exe 2020 2084 WerFault.exe qu4196.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro7161.exequ4196.exesi007569.exepid process 1120 pro7161.exe 1120 pro7161.exe 2084 qu4196.exe 2084 qu4196.exe 4192 si007569.exe 4192 si007569.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro7161.exequ4196.exesi007569.exedescription pid process Token: SeDebugPrivilege 1120 pro7161.exe Token: SeDebugPrivilege 2084 qu4196.exe Token: SeDebugPrivilege 4192 si007569.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
ec894cf6e3ec97dab64f5b9fc90c5748f84c6ee461aba662e958996af2f51399.exeun563246.exedescription pid process target process PID 2000 wrote to memory of 3168 2000 ec894cf6e3ec97dab64f5b9fc90c5748f84c6ee461aba662e958996af2f51399.exe un563246.exe PID 2000 wrote to memory of 3168 2000 ec894cf6e3ec97dab64f5b9fc90c5748f84c6ee461aba662e958996af2f51399.exe un563246.exe PID 2000 wrote to memory of 3168 2000 ec894cf6e3ec97dab64f5b9fc90c5748f84c6ee461aba662e958996af2f51399.exe un563246.exe PID 3168 wrote to memory of 1120 3168 un563246.exe pro7161.exe PID 3168 wrote to memory of 1120 3168 un563246.exe pro7161.exe PID 3168 wrote to memory of 1120 3168 un563246.exe pro7161.exe PID 3168 wrote to memory of 2084 3168 un563246.exe qu4196.exe PID 3168 wrote to memory of 2084 3168 un563246.exe qu4196.exe PID 3168 wrote to memory of 2084 3168 un563246.exe qu4196.exe PID 2000 wrote to memory of 4192 2000 ec894cf6e3ec97dab64f5b9fc90c5748f84c6ee461aba662e958996af2f51399.exe si007569.exe PID 2000 wrote to memory of 4192 2000 ec894cf6e3ec97dab64f5b9fc90c5748f84c6ee461aba662e958996af2f51399.exe si007569.exe PID 2000 wrote to memory of 4192 2000 ec894cf6e3ec97dab64f5b9fc90c5748f84c6ee461aba662e958996af2f51399.exe si007569.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec894cf6e3ec97dab64f5b9fc90c5748f84c6ee461aba662e958996af2f51399.exe"C:\Users\Admin\AppData\Local\Temp\ec894cf6e3ec97dab64f5b9fc90c5748f84c6ee461aba662e958996af2f51399.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un563246.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un563246.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7161.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7161.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 10804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4196.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4196.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 13484⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si007569.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si007569.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1120 -ip 11201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2084 -ip 20841⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si007569.exeFilesize
175KB
MD550d1e251aab2e4b0ab8f45b2480d2957
SHA1d99d43bcd0f8813d7783c972b281002eb7c7f61e
SHA2565716692c5b4b9f12c74ea438f82966850f0a22a9aab8480c8d6d17b6aae79161
SHA51278ede0f0b35936f617e2d1618fe5a980ff72461e94e4acd52f5d3568aa3f6f9690e48356b70d11094be531d33be0b094ec942563906fecb45e66d52c6e9c9d22
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si007569.exeFilesize
175KB
MD550d1e251aab2e4b0ab8f45b2480d2957
SHA1d99d43bcd0f8813d7783c972b281002eb7c7f61e
SHA2565716692c5b4b9f12c74ea438f82966850f0a22a9aab8480c8d6d17b6aae79161
SHA51278ede0f0b35936f617e2d1618fe5a980ff72461e94e4acd52f5d3568aa3f6f9690e48356b70d11094be531d33be0b094ec942563906fecb45e66d52c6e9c9d22
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un563246.exeFilesize
555KB
MD5b1fc531074cdc372a638a74c4da91784
SHA104f78c1fa404e97bb4f959a9e04a2e2410639d9e
SHA256956a0c933471884d2c8edcadeed273dc193e027f5c09efd1af885137af9b6026
SHA5127a7a721cd86ed4e9f7c6d4ebfd517b3951dc90d7aa182c74b9215cc35a0186088ec7ed837539e974dc37dbb94d9ecfe366e0d33df8e09eb5c2888b8095a3152e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un563246.exeFilesize
555KB
MD5b1fc531074cdc372a638a74c4da91784
SHA104f78c1fa404e97bb4f959a9e04a2e2410639d9e
SHA256956a0c933471884d2c8edcadeed273dc193e027f5c09efd1af885137af9b6026
SHA5127a7a721cd86ed4e9f7c6d4ebfd517b3951dc90d7aa182c74b9215cc35a0186088ec7ed837539e974dc37dbb94d9ecfe366e0d33df8e09eb5c2888b8095a3152e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7161.exeFilesize
347KB
MD5764901426343fa5e2189c90fe6d13f1b
SHA1b3d06d341f121aa59d08b2d52f0bf83578cbf332
SHA256ce4bd8c93ee7a1e9e9fe392bb8754ff95d5a11fc60de763f12d9391b8f24d642
SHA512b0a1c6c6e2c1de12e14a259a74214ed40cb19a74641f5c19469462f6a467634bfbd26eae4e202b20a41f384b44daaf14a5c74c6d86be328bc3b8948c4738da78
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7161.exeFilesize
347KB
MD5764901426343fa5e2189c90fe6d13f1b
SHA1b3d06d341f121aa59d08b2d52f0bf83578cbf332
SHA256ce4bd8c93ee7a1e9e9fe392bb8754ff95d5a11fc60de763f12d9391b8f24d642
SHA512b0a1c6c6e2c1de12e14a259a74214ed40cb19a74641f5c19469462f6a467634bfbd26eae4e202b20a41f384b44daaf14a5c74c6d86be328bc3b8948c4738da78
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4196.exeFilesize
406KB
MD554c7dae59db0abdbd5f065a4c5ad707f
SHA1d6fc9953b6bdc13184f3c75e2c4a789cdb399ceb
SHA256bd192b9fcbd46c47bace2ede00ad980bed8b11ba2daceae5ae951e64894ea65c
SHA512e5282eabb865d56efe907c6087982f1c547ebec66c74379ee93faf258fb27d42e8376c90496d39c04b92900b4090b00fa8c85be2ca370ffcacb076ccc3d9b6d7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4196.exeFilesize
406KB
MD554c7dae59db0abdbd5f065a4c5ad707f
SHA1d6fc9953b6bdc13184f3c75e2c4a789cdb399ceb
SHA256bd192b9fcbd46c47bace2ede00ad980bed8b11ba2daceae5ae951e64894ea65c
SHA512e5282eabb865d56efe907c6087982f1c547ebec66c74379ee93faf258fb27d42e8376c90496d39c04b92900b4090b00fa8c85be2ca370ffcacb076ccc3d9b6d7
-
memory/1120-148-0x0000000007220000-0x00000000077C4000-memory.dmpFilesize
5.6MB
-
memory/1120-149-0x00000000049D0000-0x00000000049E2000-memory.dmpFilesize
72KB
-
memory/1120-150-0x00000000049D0000-0x00000000049E2000-memory.dmpFilesize
72KB
-
memory/1120-152-0x00000000049D0000-0x00000000049E2000-memory.dmpFilesize
72KB
-
memory/1120-154-0x00000000049D0000-0x00000000049E2000-memory.dmpFilesize
72KB
-
memory/1120-156-0x00000000049D0000-0x00000000049E2000-memory.dmpFilesize
72KB
-
memory/1120-157-0x0000000002C60000-0x0000000002C8D000-memory.dmpFilesize
180KB
-
memory/1120-158-0x0000000007210000-0x0000000007220000-memory.dmpFilesize
64KB
-
memory/1120-161-0x00000000049D0000-0x00000000049E2000-memory.dmpFilesize
72KB
-
memory/1120-162-0x0000000007210000-0x0000000007220000-memory.dmpFilesize
64KB
-
memory/1120-164-0x00000000049D0000-0x00000000049E2000-memory.dmpFilesize
72KB
-
memory/1120-160-0x0000000007210000-0x0000000007220000-memory.dmpFilesize
64KB
-
memory/1120-166-0x00000000049D0000-0x00000000049E2000-memory.dmpFilesize
72KB
-
memory/1120-168-0x00000000049D0000-0x00000000049E2000-memory.dmpFilesize
72KB
-
memory/1120-170-0x00000000049D0000-0x00000000049E2000-memory.dmpFilesize
72KB
-
memory/1120-172-0x00000000049D0000-0x00000000049E2000-memory.dmpFilesize
72KB
-
memory/1120-174-0x00000000049D0000-0x00000000049E2000-memory.dmpFilesize
72KB
-
memory/1120-176-0x00000000049D0000-0x00000000049E2000-memory.dmpFilesize
72KB
-
memory/1120-178-0x00000000049D0000-0x00000000049E2000-memory.dmpFilesize
72KB
-
memory/1120-180-0x00000000049D0000-0x00000000049E2000-memory.dmpFilesize
72KB
-
memory/1120-181-0x0000000000400000-0x0000000002B84000-memory.dmpFilesize
39.5MB
-
memory/1120-183-0x0000000007210000-0x0000000007220000-memory.dmpFilesize
64KB
-
memory/1120-184-0x0000000007210000-0x0000000007220000-memory.dmpFilesize
64KB
-
memory/1120-185-0x0000000007210000-0x0000000007220000-memory.dmpFilesize
64KB
-
memory/1120-186-0x0000000000400000-0x0000000002B84000-memory.dmpFilesize
39.5MB
-
memory/2084-191-0x0000000002C70000-0x0000000002CBB000-memory.dmpFilesize
300KB
-
memory/2084-192-0x0000000004BD0000-0x0000000004C0F000-memory.dmpFilesize
252KB
-
memory/2084-195-0x0000000004BD0000-0x0000000004C0F000-memory.dmpFilesize
252KB
-
memory/2084-193-0x0000000004BD0000-0x0000000004C0F000-memory.dmpFilesize
252KB
-
memory/2084-197-0x0000000004BD0000-0x0000000004C0F000-memory.dmpFilesize
252KB
-
memory/2084-199-0x0000000004BD0000-0x0000000004C0F000-memory.dmpFilesize
252KB
-
memory/2084-205-0x0000000004BD0000-0x0000000004C0F000-memory.dmpFilesize
252KB
-
memory/2084-203-0x0000000004BD0000-0x0000000004C0F000-memory.dmpFilesize
252KB
-
memory/2084-201-0x0000000004BD0000-0x0000000004C0F000-memory.dmpFilesize
252KB
-
memory/2084-207-0x0000000004BD0000-0x0000000004C0F000-memory.dmpFilesize
252KB
-
memory/2084-209-0x0000000004BD0000-0x0000000004C0F000-memory.dmpFilesize
252KB
-
memory/2084-211-0x0000000004BD0000-0x0000000004C0F000-memory.dmpFilesize
252KB
-
memory/2084-214-0x0000000007430000-0x0000000007440000-memory.dmpFilesize
64KB
-
memory/2084-213-0x0000000004BD0000-0x0000000004C0F000-memory.dmpFilesize
252KB
-
memory/2084-215-0x0000000007430000-0x0000000007440000-memory.dmpFilesize
64KB
-
memory/2084-219-0x0000000004BD0000-0x0000000004C0F000-memory.dmpFilesize
252KB
-
memory/2084-217-0x0000000004BD0000-0x0000000004C0F000-memory.dmpFilesize
252KB
-
memory/2084-221-0x0000000004BD0000-0x0000000004C0F000-memory.dmpFilesize
252KB
-
memory/2084-223-0x0000000004BD0000-0x0000000004C0F000-memory.dmpFilesize
252KB
-
memory/2084-225-0x0000000004BD0000-0x0000000004C0F000-memory.dmpFilesize
252KB
-
memory/2084-227-0x0000000004BD0000-0x0000000004C0F000-memory.dmpFilesize
252KB
-
memory/2084-1100-0x00000000079F0000-0x0000000008008000-memory.dmpFilesize
6.1MB
-
memory/2084-1101-0x0000000007270000-0x000000000737A000-memory.dmpFilesize
1.0MB
-
memory/2084-1102-0x00000000073A0000-0x00000000073B2000-memory.dmpFilesize
72KB
-
memory/2084-1103-0x0000000007430000-0x0000000007440000-memory.dmpFilesize
64KB
-
memory/2084-1104-0x00000000073C0000-0x00000000073FC000-memory.dmpFilesize
240KB
-
memory/2084-1106-0x0000000002C70000-0x0000000002CBB000-memory.dmpFilesize
300KB
-
memory/2084-1107-0x0000000008290000-0x0000000008322000-memory.dmpFilesize
584KB
-
memory/2084-1108-0x0000000008330000-0x0000000008396000-memory.dmpFilesize
408KB
-
memory/2084-1109-0x0000000007430000-0x0000000007440000-memory.dmpFilesize
64KB
-
memory/2084-1110-0x0000000007430000-0x0000000007440000-memory.dmpFilesize
64KB
-
memory/2084-1111-0x0000000007430000-0x0000000007440000-memory.dmpFilesize
64KB
-
memory/2084-1112-0x0000000008B50000-0x0000000008D12000-memory.dmpFilesize
1.8MB
-
memory/2084-1113-0x0000000008D30000-0x000000000925C000-memory.dmpFilesize
5.2MB
-
memory/2084-1114-0x0000000007430000-0x0000000007440000-memory.dmpFilesize
64KB
-
memory/2084-1115-0x00000000094E0000-0x0000000009556000-memory.dmpFilesize
472KB
-
memory/2084-1116-0x0000000009560000-0x00000000095B0000-memory.dmpFilesize
320KB
-
memory/4192-1122-0x0000000000FE0000-0x0000000001012000-memory.dmpFilesize
200KB
-
memory/4192-1123-0x0000000005B70000-0x0000000005B80000-memory.dmpFilesize
64KB
-
memory/4192-1125-0x0000000005B70000-0x0000000005B80000-memory.dmpFilesize
64KB