Analysis
-
max time kernel
86s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 12:09
Static task
static1
Behavioral task
behavioral1
Sample
68991a4c09e741d6358cb7f900afa4b1b6064b990ebc0111767d3a902d29f3b0.exe
Resource
win10v2004-20230220-en
General
-
Target
68991a4c09e741d6358cb7f900afa4b1b6064b990ebc0111767d3a902d29f3b0.exe
-
Size
697KB
-
MD5
ae2a5c1958ffb6cee2b028ed191d27d4
-
SHA1
6871d1c5be06d9f2b24a6bdfea9f1431c507f077
-
SHA256
68991a4c09e741d6358cb7f900afa4b1b6064b990ebc0111767d3a902d29f3b0
-
SHA512
0333ca5d9dc3f7cc3230843c90258df7d944e3cdd24b06871bc6211c9a2271eb59025d1fc29046f30f1e285634f2f357eee5ad843a102f5f4e37a00b6705230d
-
SSDEEP
12288:vMrNy90pH/jIAKc0RT1TuguUK4kw8/+e/YyxyykD9PI4/L6ONGjVAxI9gj+Obpp1:WyCfihZugtOwKxxpkD9PhvGjmI98tdkg
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
muse
176.113.115.145:4125
-
auth_value
b91988a63a24940038d9262827a5320c
Signatures
-
Processes:
pro4357.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro4357.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro4357.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro4357.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro4357.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro4357.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro4357.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/3820-192-0x0000000007760000-0x000000000779F000-memory.dmp family_redline behavioral1/memory/3820-193-0x0000000007760000-0x000000000779F000-memory.dmp family_redline behavioral1/memory/3820-195-0x0000000007760000-0x000000000779F000-memory.dmp family_redline behavioral1/memory/3820-200-0x0000000007760000-0x000000000779F000-memory.dmp family_redline behavioral1/memory/3820-202-0x0000000007760000-0x000000000779F000-memory.dmp family_redline behavioral1/memory/3820-204-0x0000000007760000-0x000000000779F000-memory.dmp family_redline behavioral1/memory/3820-206-0x0000000007760000-0x000000000779F000-memory.dmp family_redline behavioral1/memory/3820-208-0x0000000007760000-0x000000000779F000-memory.dmp family_redline behavioral1/memory/3820-210-0x0000000007760000-0x000000000779F000-memory.dmp family_redline behavioral1/memory/3820-212-0x0000000007760000-0x000000000779F000-memory.dmp family_redline behavioral1/memory/3820-214-0x0000000007760000-0x000000000779F000-memory.dmp family_redline behavioral1/memory/3820-216-0x0000000007760000-0x000000000779F000-memory.dmp family_redline behavioral1/memory/3820-218-0x0000000007760000-0x000000000779F000-memory.dmp family_redline behavioral1/memory/3820-220-0x0000000007760000-0x000000000779F000-memory.dmp family_redline behavioral1/memory/3820-222-0x0000000007760000-0x000000000779F000-memory.dmp family_redline behavioral1/memory/3820-224-0x0000000007760000-0x000000000779F000-memory.dmp family_redline behavioral1/memory/3820-226-0x0000000007760000-0x000000000779F000-memory.dmp family_redline behavioral1/memory/3820-228-0x0000000007760000-0x000000000779F000-memory.dmp family_redline behavioral1/memory/3820-1111-0x0000000002EA0000-0x0000000002EB0000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un818134.exepro4357.exequ1085.exesi133489.exepid process 1532 un818134.exe 452 pro4357.exe 3820 qu1085.exe 2748 si133489.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro4357.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro4357.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro4357.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
68991a4c09e741d6358cb7f900afa4b1b6064b990ebc0111767d3a902d29f3b0.exeun818134.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 68991a4c09e741d6358cb7f900afa4b1b6064b990ebc0111767d3a902d29f3b0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 68991a4c09e741d6358cb7f900afa4b1b6064b990ebc0111767d3a902d29f3b0.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un818134.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un818134.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 896 452 WerFault.exe pro4357.exe 3328 3820 WerFault.exe qu1085.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro4357.exequ1085.exesi133489.exepid process 452 pro4357.exe 452 pro4357.exe 3820 qu1085.exe 3820 qu1085.exe 2748 si133489.exe 2748 si133489.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro4357.exequ1085.exesi133489.exedescription pid process Token: SeDebugPrivilege 452 pro4357.exe Token: SeDebugPrivilege 3820 qu1085.exe Token: SeDebugPrivilege 2748 si133489.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
68991a4c09e741d6358cb7f900afa4b1b6064b990ebc0111767d3a902d29f3b0.exeun818134.exedescription pid process target process PID 4080 wrote to memory of 1532 4080 68991a4c09e741d6358cb7f900afa4b1b6064b990ebc0111767d3a902d29f3b0.exe un818134.exe PID 4080 wrote to memory of 1532 4080 68991a4c09e741d6358cb7f900afa4b1b6064b990ebc0111767d3a902d29f3b0.exe un818134.exe PID 4080 wrote to memory of 1532 4080 68991a4c09e741d6358cb7f900afa4b1b6064b990ebc0111767d3a902d29f3b0.exe un818134.exe PID 1532 wrote to memory of 452 1532 un818134.exe pro4357.exe PID 1532 wrote to memory of 452 1532 un818134.exe pro4357.exe PID 1532 wrote to memory of 452 1532 un818134.exe pro4357.exe PID 1532 wrote to memory of 3820 1532 un818134.exe qu1085.exe PID 1532 wrote to memory of 3820 1532 un818134.exe qu1085.exe PID 1532 wrote to memory of 3820 1532 un818134.exe qu1085.exe PID 4080 wrote to memory of 2748 4080 68991a4c09e741d6358cb7f900afa4b1b6064b990ebc0111767d3a902d29f3b0.exe si133489.exe PID 4080 wrote to memory of 2748 4080 68991a4c09e741d6358cb7f900afa4b1b6064b990ebc0111767d3a902d29f3b0.exe si133489.exe PID 4080 wrote to memory of 2748 4080 68991a4c09e741d6358cb7f900afa4b1b6064b990ebc0111767d3a902d29f3b0.exe si133489.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\68991a4c09e741d6358cb7f900afa4b1b6064b990ebc0111767d3a902d29f3b0.exe"C:\Users\Admin\AppData\Local\Temp\68991a4c09e741d6358cb7f900afa4b1b6064b990ebc0111767d3a902d29f3b0.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un818134.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un818134.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4357.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4357.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:452 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 452 -s 10804⤵
- Program crash
PID:896 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1085.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1085.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3820 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3820 -s 13524⤵
- Program crash
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si133489.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si133489.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2748
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 452 -ip 4521⤵PID:4732
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3820 -ip 38201⤵PID:4908
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si133489.exeFilesize
175KB
MD5d34cc76ab5ed87590b8cf8a4eec0d43c
SHA10977de4835dc6943214dfc40ef10378245cfe7c5
SHA256f439c87bffacc82b2eba14816f587e7bc33aff46fc3b45585e2ab4c7cf11ff8b
SHA5120f8356f3d02ee8f9c07206e4a6ec35e93bd5b2d02a8a2335941bd9d1f8fdb61bc712e9d0d24acbd36686d4e1dc30e0c027829744ca328d8aee525960f6c7dc76
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si133489.exeFilesize
175KB
MD5d34cc76ab5ed87590b8cf8a4eec0d43c
SHA10977de4835dc6943214dfc40ef10378245cfe7c5
SHA256f439c87bffacc82b2eba14816f587e7bc33aff46fc3b45585e2ab4c7cf11ff8b
SHA5120f8356f3d02ee8f9c07206e4a6ec35e93bd5b2d02a8a2335941bd9d1f8fdb61bc712e9d0d24acbd36686d4e1dc30e0c027829744ca328d8aee525960f6c7dc76
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un818134.exeFilesize
555KB
MD5b332600275a1cfe8fba26636652888c2
SHA10b4772b8ae5af003517e92fa85ffc3f479db3ad2
SHA2563d51eacd8daea16b935a3a828f61874db7d7044b87d3dafcd303e4d0074ec742
SHA512b3f0813595493226046c732b38a687edbb227f955420bd384fe9f8274d1fe0539c194e188777390e87f4000de698e3ba4f9adaee908e4c28083c93b057d3c78f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un818134.exeFilesize
555KB
MD5b332600275a1cfe8fba26636652888c2
SHA10b4772b8ae5af003517e92fa85ffc3f479db3ad2
SHA2563d51eacd8daea16b935a3a828f61874db7d7044b87d3dafcd303e4d0074ec742
SHA512b3f0813595493226046c732b38a687edbb227f955420bd384fe9f8274d1fe0539c194e188777390e87f4000de698e3ba4f9adaee908e4c28083c93b057d3c78f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4357.exeFilesize
347KB
MD52d001eddf0d8c4e5333d2c90da556130
SHA163c0525b1165776e839010fd4360191c67b665de
SHA2567cd9cccf558c3a183f66eeb03cca05eb3522f9e8f10f725e9107ad3fa9ccc7d7
SHA512b69764ab4e8bbc82e20dc164988121fc665d19399d49f37d05c6c73b5e632b4ed9aea2b2dc216e6ae9f4c50f4660246a4dcab86d2513eb1b0debb6e4d0c77fa7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4357.exeFilesize
347KB
MD52d001eddf0d8c4e5333d2c90da556130
SHA163c0525b1165776e839010fd4360191c67b665de
SHA2567cd9cccf558c3a183f66eeb03cca05eb3522f9e8f10f725e9107ad3fa9ccc7d7
SHA512b69764ab4e8bbc82e20dc164988121fc665d19399d49f37d05c6c73b5e632b4ed9aea2b2dc216e6ae9f4c50f4660246a4dcab86d2513eb1b0debb6e4d0c77fa7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1085.exeFilesize
406KB
MD5aa5546ce6d0775f7ef48c474ee8c4bca
SHA1a93c8fc5e9802b536d64ae8d42c9daed4ad59e25
SHA25686e852610d3a7a055f5b61ad9caf50f75cc341e608d9d547efe517e3314a270d
SHA5123eb55f75910c9c9cf8667b984f98b385abc83a678afcac05c31eacb46ccc0867a4d09c6d3f7f46c2a108acb502207338fd4b2b0309e669670495856bf4826d73
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1085.exeFilesize
406KB
MD5aa5546ce6d0775f7ef48c474ee8c4bca
SHA1a93c8fc5e9802b536d64ae8d42c9daed4ad59e25
SHA25686e852610d3a7a055f5b61ad9caf50f75cc341e608d9d547efe517e3314a270d
SHA5123eb55f75910c9c9cf8667b984f98b385abc83a678afcac05c31eacb46ccc0867a4d09c6d3f7f46c2a108acb502207338fd4b2b0309e669670495856bf4826d73
-
memory/452-148-0x0000000002C60000-0x0000000002C8D000-memory.dmpFilesize
180KB
-
memory/452-149-0x0000000007340000-0x00000000078E4000-memory.dmpFilesize
5.6MB
-
memory/452-159-0x0000000004EB0000-0x0000000004EC2000-memory.dmpFilesize
72KB
-
memory/452-177-0x0000000004EB0000-0x0000000004EC2000-memory.dmpFilesize
72KB
-
memory/452-175-0x0000000004EB0000-0x0000000004EC2000-memory.dmpFilesize
72KB
-
memory/452-173-0x0000000004EB0000-0x0000000004EC2000-memory.dmpFilesize
72KB
-
memory/452-171-0x0000000004EB0000-0x0000000004EC2000-memory.dmpFilesize
72KB
-
memory/452-169-0x0000000004EB0000-0x0000000004EC2000-memory.dmpFilesize
72KB
-
memory/452-167-0x0000000004EB0000-0x0000000004EC2000-memory.dmpFilesize
72KB
-
memory/452-165-0x0000000004EB0000-0x0000000004EC2000-memory.dmpFilesize
72KB
-
memory/452-163-0x0000000004EB0000-0x0000000004EC2000-memory.dmpFilesize
72KB
-
memory/452-161-0x0000000004EB0000-0x0000000004EC2000-memory.dmpFilesize
72KB
-
memory/452-157-0x0000000004EB0000-0x0000000004EC2000-memory.dmpFilesize
72KB
-
memory/452-155-0x0000000004EB0000-0x0000000004EC2000-memory.dmpFilesize
72KB
-
memory/452-153-0x0000000004EB0000-0x0000000004EC2000-memory.dmpFilesize
72KB
-
memory/452-151-0x0000000004EB0000-0x0000000004EC2000-memory.dmpFilesize
72KB
-
memory/452-150-0x0000000004EB0000-0x0000000004EC2000-memory.dmpFilesize
72KB
-
memory/452-178-0x0000000007330000-0x0000000007340000-memory.dmpFilesize
64KB
-
memory/452-180-0x0000000007330000-0x0000000007340000-memory.dmpFilesize
64KB
-
memory/452-179-0x0000000007330000-0x0000000007340000-memory.dmpFilesize
64KB
-
memory/452-181-0x0000000000400000-0x0000000002B84000-memory.dmpFilesize
39.5MB
-
memory/452-183-0x0000000007330000-0x0000000007340000-memory.dmpFilesize
64KB
-
memory/452-184-0x0000000007330000-0x0000000007340000-memory.dmpFilesize
64KB
-
memory/452-185-0x0000000007330000-0x0000000007340000-memory.dmpFilesize
64KB
-
memory/452-186-0x0000000000400000-0x0000000002B84000-memory.dmpFilesize
39.5MB
-
memory/2748-1123-0x0000000000520000-0x0000000000552000-memory.dmpFilesize
200KB
-
memory/2748-1124-0x0000000004DA0000-0x0000000004DB0000-memory.dmpFilesize
64KB
-
memory/3820-193-0x0000000007760000-0x000000000779F000-memory.dmpFilesize
252KB
-
memory/3820-226-0x0000000007760000-0x000000000779F000-memory.dmpFilesize
252KB
-
memory/3820-196-0x0000000002EA0000-0x0000000002EB0000-memory.dmpFilesize
64KB
-
memory/3820-195-0x0000000007760000-0x000000000779F000-memory.dmpFilesize
252KB
-
memory/3820-197-0x0000000002EA0000-0x0000000002EB0000-memory.dmpFilesize
64KB
-
memory/3820-200-0x0000000007760000-0x000000000779F000-memory.dmpFilesize
252KB
-
memory/3820-199-0x0000000002EA0000-0x0000000002EB0000-memory.dmpFilesize
64KB
-
memory/3820-202-0x0000000007760000-0x000000000779F000-memory.dmpFilesize
252KB
-
memory/3820-204-0x0000000007760000-0x000000000779F000-memory.dmpFilesize
252KB
-
memory/3820-206-0x0000000007760000-0x000000000779F000-memory.dmpFilesize
252KB
-
memory/3820-208-0x0000000007760000-0x000000000779F000-memory.dmpFilesize
252KB
-
memory/3820-210-0x0000000007760000-0x000000000779F000-memory.dmpFilesize
252KB
-
memory/3820-212-0x0000000007760000-0x000000000779F000-memory.dmpFilesize
252KB
-
memory/3820-214-0x0000000007760000-0x000000000779F000-memory.dmpFilesize
252KB
-
memory/3820-216-0x0000000007760000-0x000000000779F000-memory.dmpFilesize
252KB
-
memory/3820-218-0x0000000007760000-0x000000000779F000-memory.dmpFilesize
252KB
-
memory/3820-220-0x0000000007760000-0x000000000779F000-memory.dmpFilesize
252KB
-
memory/3820-222-0x0000000007760000-0x000000000779F000-memory.dmpFilesize
252KB
-
memory/3820-224-0x0000000007760000-0x000000000779F000-memory.dmpFilesize
252KB
-
memory/3820-192-0x0000000007760000-0x000000000779F000-memory.dmpFilesize
252KB
-
memory/3820-228-0x0000000007760000-0x000000000779F000-memory.dmpFilesize
252KB
-
memory/3820-1101-0x00000000077A0000-0x0000000007DB8000-memory.dmpFilesize
6.1MB
-
memory/3820-1102-0x0000000007E40000-0x0000000007F4A000-memory.dmpFilesize
1.0MB
-
memory/3820-1103-0x0000000007F80000-0x0000000007F92000-memory.dmpFilesize
72KB
-
memory/3820-1104-0x0000000002EA0000-0x0000000002EB0000-memory.dmpFilesize
64KB
-
memory/3820-1105-0x0000000007FA0000-0x0000000007FDC000-memory.dmpFilesize
240KB
-
memory/3820-1107-0x0000000002C70000-0x0000000002CBB000-memory.dmpFilesize
300KB
-
memory/3820-1108-0x0000000008290000-0x0000000008322000-memory.dmpFilesize
584KB
-
memory/3820-1109-0x0000000002EA0000-0x0000000002EB0000-memory.dmpFilesize
64KB
-
memory/3820-1110-0x0000000002EA0000-0x0000000002EB0000-memory.dmpFilesize
64KB
-
memory/3820-1111-0x0000000002EA0000-0x0000000002EB0000-memory.dmpFilesize
64KB
-
memory/3820-1112-0x0000000008330000-0x0000000008396000-memory.dmpFilesize
408KB
-
memory/3820-1113-0x0000000008B30000-0x0000000008BA6000-memory.dmpFilesize
472KB
-
memory/3820-1114-0x0000000008BC0000-0x0000000008C10000-memory.dmpFilesize
320KB
-
memory/3820-191-0x0000000002C70000-0x0000000002CBB000-memory.dmpFilesize
300KB
-
memory/3820-1115-0x0000000008C70000-0x0000000008E32000-memory.dmpFilesize
1.8MB
-
memory/3820-1116-0x0000000002EA0000-0x0000000002EB0000-memory.dmpFilesize
64KB
-
memory/3820-1117-0x0000000008E40000-0x000000000936C000-memory.dmpFilesize
5.2MB