Analysis
-
max time kernel
135s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 12:12
Static task
static1
Behavioral task
behavioral1
Sample
92f77f58e8f94199df95cc411dc8436b735dbe497fafb4a7e1c2284a39645d09.exe
Resource
win10v2004-20230220-en
General
-
Target
92f77f58e8f94199df95cc411dc8436b735dbe497fafb4a7e1c2284a39645d09.exe
-
Size
698KB
-
MD5
184ff033deccdc475e5ed0ab16bb1e2e
-
SHA1
8e73742a90de51da7564125c81076869ba694207
-
SHA256
92f77f58e8f94199df95cc411dc8436b735dbe497fafb4a7e1c2284a39645d09
-
SHA512
97a2a0c58bfb4ad1fa6f19d740037c8b3102d2df0b25210cd66b504287e1b2929579e69a7caa747e856f480b2e89aa252bcc7eeaf87e3324f9e25040bbaa6ae1
-
SSDEEP
12288:3MrXy90WqTJ4pphxomkhdFtkG8G/70XcRL6PmGjxAxI9gbFWBMNJf:0yxpT+vDYPoJGjKI96Td
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
muse
176.113.115.145:4125
-
auth_value
b91988a63a24940038d9262827a5320c
Signatures
-
Processes:
pro0280.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro0280.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro0280.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro0280.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro0280.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro0280.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro0280.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/1900-195-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/1900-198-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/1900-193-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/1900-200-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/1900-202-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/1900-204-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/1900-206-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/1900-208-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/1900-210-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/1900-212-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/1900-214-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/1900-216-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/1900-218-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/1900-220-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/1900-224-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/1900-222-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/1900-226-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/1900-228-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un703788.exepro0280.exequ3852.exesi252305.exepid process 644 un703788.exe 552 pro0280.exe 1900 qu3852.exe 2616 si252305.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro0280.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro0280.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro0280.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un703788.exe92f77f58e8f94199df95cc411dc8436b735dbe497fafb4a7e1c2284a39645d09.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un703788.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 92f77f58e8f94199df95cc411dc8436b735dbe497fafb4a7e1c2284a39645d09.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 92f77f58e8f94199df95cc411dc8436b735dbe497fafb4a7e1c2284a39645d09.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un703788.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 5112 552 WerFault.exe pro0280.exe 3836 1900 WerFault.exe qu3852.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro0280.exequ3852.exesi252305.exepid process 552 pro0280.exe 552 pro0280.exe 1900 qu3852.exe 1900 qu3852.exe 2616 si252305.exe 2616 si252305.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro0280.exequ3852.exesi252305.exedescription pid process Token: SeDebugPrivilege 552 pro0280.exe Token: SeDebugPrivilege 1900 qu3852.exe Token: SeDebugPrivilege 2616 si252305.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
92f77f58e8f94199df95cc411dc8436b735dbe497fafb4a7e1c2284a39645d09.exeun703788.exedescription pid process target process PID 1636 wrote to memory of 644 1636 92f77f58e8f94199df95cc411dc8436b735dbe497fafb4a7e1c2284a39645d09.exe un703788.exe PID 1636 wrote to memory of 644 1636 92f77f58e8f94199df95cc411dc8436b735dbe497fafb4a7e1c2284a39645d09.exe un703788.exe PID 1636 wrote to memory of 644 1636 92f77f58e8f94199df95cc411dc8436b735dbe497fafb4a7e1c2284a39645d09.exe un703788.exe PID 644 wrote to memory of 552 644 un703788.exe pro0280.exe PID 644 wrote to memory of 552 644 un703788.exe pro0280.exe PID 644 wrote to memory of 552 644 un703788.exe pro0280.exe PID 644 wrote to memory of 1900 644 un703788.exe qu3852.exe PID 644 wrote to memory of 1900 644 un703788.exe qu3852.exe PID 644 wrote to memory of 1900 644 un703788.exe qu3852.exe PID 1636 wrote to memory of 2616 1636 92f77f58e8f94199df95cc411dc8436b735dbe497fafb4a7e1c2284a39645d09.exe si252305.exe PID 1636 wrote to memory of 2616 1636 92f77f58e8f94199df95cc411dc8436b735dbe497fafb4a7e1c2284a39645d09.exe si252305.exe PID 1636 wrote to memory of 2616 1636 92f77f58e8f94199df95cc411dc8436b735dbe497fafb4a7e1c2284a39645d09.exe si252305.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\92f77f58e8f94199df95cc411dc8436b735dbe497fafb4a7e1c2284a39645d09.exe"C:\Users\Admin\AppData\Local\Temp\92f77f58e8f94199df95cc411dc8436b735dbe497fafb4a7e1c2284a39645d09.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un703788.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un703788.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0280.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0280.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:552 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 10644⤵
- Program crash
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3852.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3852.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1900 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 17644⤵
- Program crash
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si252305.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si252305.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2616
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 552 -ip 5521⤵PID:1372
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1900 -ip 19001⤵PID:2376
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si252305.exeFilesize
175KB
MD5306c77f690639a13225d53650ca6fb8b
SHA13998a0fc51545f6df55aa021be7a85c67eebf40d
SHA25691680c51da146409070091cf2e771fdc32be0684abf06762ccefb51cb3e9ec96
SHA51233e9b95e9024ab162a770cbea21b41ffdae0f75d1e73acc4e2dbb06c6eccbbbc97966e464e871bd8448511413f99172c3195a6015c7ebf7b94e9f9e5930055e3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si252305.exeFilesize
175KB
MD5306c77f690639a13225d53650ca6fb8b
SHA13998a0fc51545f6df55aa021be7a85c67eebf40d
SHA25691680c51da146409070091cf2e771fdc32be0684abf06762ccefb51cb3e9ec96
SHA51233e9b95e9024ab162a770cbea21b41ffdae0f75d1e73acc4e2dbb06c6eccbbbc97966e464e871bd8448511413f99172c3195a6015c7ebf7b94e9f9e5930055e3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un703788.exeFilesize
556KB
MD50019e805d3dd3922da6a33a71e37d5a0
SHA14b1a5f5f2b82354a6dc779b694f23b70589dfdd6
SHA256e4593a19d5b9990b6a03dee05bed3ab1c175c98f5fc01203bc6cea3dbbc1ec2d
SHA512f56771474742995d461079d2db867a7fa2676eb1315c42c39e3323cfc00097fe2f7cf2e6451a16d0790213ac5d562410d07bea90ad4dbf4d35a59a1de3e03da2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un703788.exeFilesize
556KB
MD50019e805d3dd3922da6a33a71e37d5a0
SHA14b1a5f5f2b82354a6dc779b694f23b70589dfdd6
SHA256e4593a19d5b9990b6a03dee05bed3ab1c175c98f5fc01203bc6cea3dbbc1ec2d
SHA512f56771474742995d461079d2db867a7fa2676eb1315c42c39e3323cfc00097fe2f7cf2e6451a16d0790213ac5d562410d07bea90ad4dbf4d35a59a1de3e03da2
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0280.exeFilesize
347KB
MD5479e0bfb5c4c570922402daeccf39c33
SHA12c05149e6bfc3866333c11a95d4630f1855e458c
SHA256297bc6e291b64ec2523e00831cc18137d9ab02a2e24e98d7b5eb1a3f326d5c62
SHA5126df72b1cad26b74280d4505a28e11831477d3a6cbf32ca73085a06720890f081f4fb8a40f255c0fdc2fec81da279568bf8fb1604e0c6188bf5bd8622dff3f919
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0280.exeFilesize
347KB
MD5479e0bfb5c4c570922402daeccf39c33
SHA12c05149e6bfc3866333c11a95d4630f1855e458c
SHA256297bc6e291b64ec2523e00831cc18137d9ab02a2e24e98d7b5eb1a3f326d5c62
SHA5126df72b1cad26b74280d4505a28e11831477d3a6cbf32ca73085a06720890f081f4fb8a40f255c0fdc2fec81da279568bf8fb1604e0c6188bf5bd8622dff3f919
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3852.exeFilesize
406KB
MD5e5fb4536271b9d59e35c5a2259cba094
SHA199e920b68d5a00474ee24ef441bca336426019e6
SHA256bb6487f3d274ec5e1dda933ac9821ee2270843aee341fa71405c004f06b125e1
SHA512ad100128b78d077e097941da2c072db1f4abe64450dec6f9fa774306ee2f8aa9789ac536eaa4724bf85a6b432c787508fab2747e3270ab128729a3ec1e369db9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3852.exeFilesize
406KB
MD5e5fb4536271b9d59e35c5a2259cba094
SHA199e920b68d5a00474ee24ef441bca336426019e6
SHA256bb6487f3d274ec5e1dda933ac9821ee2270843aee341fa71405c004f06b125e1
SHA512ad100128b78d077e097941da2c072db1f4abe64450dec6f9fa774306ee2f8aa9789ac536eaa4724bf85a6b432c787508fab2747e3270ab128729a3ec1e369db9
-
memory/552-148-0x0000000002C60000-0x0000000002C8D000-memory.dmpFilesize
180KB
-
memory/552-149-0x0000000007390000-0x0000000007934000-memory.dmpFilesize
5.6MB
-
memory/552-150-0x0000000004A70000-0x0000000004A82000-memory.dmpFilesize
72KB
-
memory/552-151-0x0000000004A70000-0x0000000004A82000-memory.dmpFilesize
72KB
-
memory/552-153-0x0000000004A70000-0x0000000004A82000-memory.dmpFilesize
72KB
-
memory/552-155-0x0000000004A70000-0x0000000004A82000-memory.dmpFilesize
72KB
-
memory/552-157-0x0000000004A70000-0x0000000004A82000-memory.dmpFilesize
72KB
-
memory/552-159-0x0000000004A70000-0x0000000004A82000-memory.dmpFilesize
72KB
-
memory/552-161-0x0000000004A70000-0x0000000004A82000-memory.dmpFilesize
72KB
-
memory/552-163-0x0000000004A70000-0x0000000004A82000-memory.dmpFilesize
72KB
-
memory/552-165-0x0000000004A70000-0x0000000004A82000-memory.dmpFilesize
72KB
-
memory/552-169-0x0000000004A70000-0x0000000004A82000-memory.dmpFilesize
72KB
-
memory/552-167-0x0000000004A70000-0x0000000004A82000-memory.dmpFilesize
72KB
-
memory/552-173-0x0000000004A70000-0x0000000004A82000-memory.dmpFilesize
72KB
-
memory/552-171-0x0000000004A70000-0x0000000004A82000-memory.dmpFilesize
72KB
-
memory/552-175-0x0000000004A70000-0x0000000004A82000-memory.dmpFilesize
72KB
-
memory/552-177-0x0000000004A70000-0x0000000004A82000-memory.dmpFilesize
72KB
-
memory/552-178-0x0000000007380000-0x0000000007390000-memory.dmpFilesize
64KB
-
memory/552-179-0x0000000007380000-0x0000000007390000-memory.dmpFilesize
64KB
-
memory/552-180-0x0000000007380000-0x0000000007390000-memory.dmpFilesize
64KB
-
memory/552-181-0x0000000000400000-0x0000000002B84000-memory.dmpFilesize
39.5MB
-
memory/552-183-0x0000000007380000-0x0000000007390000-memory.dmpFilesize
64KB
-
memory/552-184-0x0000000007380000-0x0000000007390000-memory.dmpFilesize
64KB
-
memory/552-185-0x0000000007380000-0x0000000007390000-memory.dmpFilesize
64KB
-
memory/552-186-0x0000000000400000-0x0000000002B84000-memory.dmpFilesize
39.5MB
-
memory/1900-191-0x0000000002DC0000-0x0000000002E0B000-memory.dmpFilesize
300KB
-
memory/1900-192-0x00000000071D0000-0x00000000071E0000-memory.dmpFilesize
64KB
-
memory/1900-195-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/1900-194-0x00000000071D0000-0x00000000071E0000-memory.dmpFilesize
64KB
-
memory/1900-198-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/1900-196-0x00000000071D0000-0x00000000071E0000-memory.dmpFilesize
64KB
-
memory/1900-193-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/1900-200-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/1900-202-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/1900-204-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/1900-206-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/1900-208-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/1900-210-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/1900-212-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/1900-214-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/1900-216-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/1900-218-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/1900-220-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/1900-224-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/1900-222-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/1900-226-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/1900-228-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/1900-1101-0x00000000078E0000-0x0000000007EF8000-memory.dmpFilesize
6.1MB
-
memory/1900-1102-0x0000000007F80000-0x000000000808A000-memory.dmpFilesize
1.0MB
-
memory/1900-1103-0x00000000080C0000-0x00000000080D2000-memory.dmpFilesize
72KB
-
memory/1900-1104-0x00000000080E0000-0x000000000811C000-memory.dmpFilesize
240KB
-
memory/1900-1105-0x00000000071D0000-0x00000000071E0000-memory.dmpFilesize
64KB
-
memory/1900-1107-0x00000000071D0000-0x00000000071E0000-memory.dmpFilesize
64KB
-
memory/1900-1108-0x00000000071D0000-0x00000000071E0000-memory.dmpFilesize
64KB
-
memory/1900-1109-0x00000000071D0000-0x00000000071E0000-memory.dmpFilesize
64KB
-
memory/1900-1110-0x00000000083D0000-0x0000000008462000-memory.dmpFilesize
584KB
-
memory/1900-1111-0x0000000008470000-0x00000000084D6000-memory.dmpFilesize
408KB
-
memory/1900-1112-0x0000000008CA0000-0x0000000008D16000-memory.dmpFilesize
472KB
-
memory/1900-1113-0x0000000008D20000-0x0000000008D70000-memory.dmpFilesize
320KB
-
memory/1900-1114-0x0000000008D80000-0x0000000008F42000-memory.dmpFilesize
1.8MB
-
memory/1900-1115-0x0000000008F50000-0x000000000947C000-memory.dmpFilesize
5.2MB
-
memory/1900-1116-0x00000000071D0000-0x00000000071E0000-memory.dmpFilesize
64KB
-
memory/2616-1122-0x00000000008A0000-0x00000000008D2000-memory.dmpFilesize
200KB
-
memory/2616-1123-0x0000000005500000-0x0000000005510000-memory.dmpFilesize
64KB
-
memory/2616-1124-0x0000000005500000-0x0000000005510000-memory.dmpFilesize
64KB