Analysis
-
max time kernel
97s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 12:30
Static task
static1
Behavioral task
behavioral1
Sample
d8cf5ce9f63ae505b3045a4578740edec4b0fa8a3599475b69bd6187ca4189aa.exe
Resource
win10v2004-20230220-en
General
-
Target
d8cf5ce9f63ae505b3045a4578740edec4b0fa8a3599475b69bd6187ca4189aa.exe
-
Size
697KB
-
MD5
54b2c38e5e6bf5aa6e840505bf0dae4b
-
SHA1
9d274bed3718630dfb198c369e67280c640c6b18
-
SHA256
d8cf5ce9f63ae505b3045a4578740edec4b0fa8a3599475b69bd6187ca4189aa
-
SHA512
61b04f8ae907a49c285a8f4f100dc87ca39c6bd17a88a25b1a9fa033118ef5bea4f9fe4dc3936af96fe9e1fb2c92d204372f9a68446bfc650bf278086eb5bffb
-
SSDEEP
12288:JMrpy90QTMFG8zKMSY7yzuIdD3T9a9N0+L6BWGjRAxI9gU4ZQhbg:AyxTn8mrY7yzHT9ad5GjqI9/AQhg
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
muse
176.113.115.145:4125
-
auth_value
b91988a63a24940038d9262827a5320c
Signatures
-
Processes:
pro8974.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro8974.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro8974.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro8974.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro8974.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro8974.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro8974.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/3668-193-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/3668-194-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/3668-196-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/3668-198-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/3668-200-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/3668-202-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/3668-204-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/3668-206-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/3668-208-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/3668-210-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/3668-212-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/3668-214-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/3668-216-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/3668-218-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/3668-220-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/3668-222-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/3668-224-0x0000000007140000-0x000000000717F000-memory.dmp family_redline behavioral1/memory/3668-226-0x0000000007140000-0x000000000717F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un100529.exepro8974.exequ1057.exesi506305.exepid process 1172 un100529.exe 380 pro8974.exe 3668 qu1057.exe 3876 si506305.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro8974.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro8974.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro8974.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
d8cf5ce9f63ae505b3045a4578740edec4b0fa8a3599475b69bd6187ca4189aa.exeun100529.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce d8cf5ce9f63ae505b3045a4578740edec4b0fa8a3599475b69bd6187ca4189aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" d8cf5ce9f63ae505b3045a4578740edec4b0fa8a3599475b69bd6187ca4189aa.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un100529.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un100529.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4868 380 WerFault.exe pro8974.exe 4296 3668 WerFault.exe qu1057.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro8974.exequ1057.exesi506305.exepid process 380 pro8974.exe 380 pro8974.exe 3668 qu1057.exe 3668 qu1057.exe 3876 si506305.exe 3876 si506305.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro8974.exequ1057.exesi506305.exedescription pid process Token: SeDebugPrivilege 380 pro8974.exe Token: SeDebugPrivilege 3668 qu1057.exe Token: SeDebugPrivilege 3876 si506305.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
d8cf5ce9f63ae505b3045a4578740edec4b0fa8a3599475b69bd6187ca4189aa.exeun100529.exedescription pid process target process PID 4480 wrote to memory of 1172 4480 d8cf5ce9f63ae505b3045a4578740edec4b0fa8a3599475b69bd6187ca4189aa.exe un100529.exe PID 4480 wrote to memory of 1172 4480 d8cf5ce9f63ae505b3045a4578740edec4b0fa8a3599475b69bd6187ca4189aa.exe un100529.exe PID 4480 wrote to memory of 1172 4480 d8cf5ce9f63ae505b3045a4578740edec4b0fa8a3599475b69bd6187ca4189aa.exe un100529.exe PID 1172 wrote to memory of 380 1172 un100529.exe pro8974.exe PID 1172 wrote to memory of 380 1172 un100529.exe pro8974.exe PID 1172 wrote to memory of 380 1172 un100529.exe pro8974.exe PID 1172 wrote to memory of 3668 1172 un100529.exe qu1057.exe PID 1172 wrote to memory of 3668 1172 un100529.exe qu1057.exe PID 1172 wrote to memory of 3668 1172 un100529.exe qu1057.exe PID 4480 wrote to memory of 3876 4480 d8cf5ce9f63ae505b3045a4578740edec4b0fa8a3599475b69bd6187ca4189aa.exe si506305.exe PID 4480 wrote to memory of 3876 4480 d8cf5ce9f63ae505b3045a4578740edec4b0fa8a3599475b69bd6187ca4189aa.exe si506305.exe PID 4480 wrote to memory of 3876 4480 d8cf5ce9f63ae505b3045a4578740edec4b0fa8a3599475b69bd6187ca4189aa.exe si506305.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8cf5ce9f63ae505b3045a4578740edec4b0fa8a3599475b69bd6187ca4189aa.exe"C:\Users\Admin\AppData\Local\Temp\d8cf5ce9f63ae505b3045a4578740edec4b0fa8a3599475b69bd6187ca4189aa.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un100529.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un100529.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8974.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8974.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:380 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 380 -s 10844⤵
- Program crash
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1057.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1057.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3668 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3668 -s 13484⤵
- Program crash
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si506305.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si506305.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3876
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 380 -ip 3801⤵PID:1692
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3668 -ip 36681⤵PID:1016
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si506305.exeFilesize
175KB
MD5ba499fea91516d9b7d0d06aef931f8d9
SHA175f56801965f46a6963805ab79288878247f3575
SHA256c00b63ab29b28b8c668a0e4787debb29a96db349bc42f53c866120b60a4acb25
SHA51249c662fda6c96d8d79c5492bb0380809e74cb5ded488c9baa3f19f94740ab942c06e23a3cb6f92284b6426916631e2242394e69ce50884cb15eb33d48bd7a0c0
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si506305.exeFilesize
175KB
MD5ba499fea91516d9b7d0d06aef931f8d9
SHA175f56801965f46a6963805ab79288878247f3575
SHA256c00b63ab29b28b8c668a0e4787debb29a96db349bc42f53c866120b60a4acb25
SHA51249c662fda6c96d8d79c5492bb0380809e74cb5ded488c9baa3f19f94740ab942c06e23a3cb6f92284b6426916631e2242394e69ce50884cb15eb33d48bd7a0c0
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un100529.exeFilesize
555KB
MD50c62cb9635d4fa9cd587b9b59f34d1cc
SHA10b3b867090e50cc04e841ad02c91a54df93e02dd
SHA2565679cd201b122171b91b7ff7bb842958195a9cc20d90009ba6ba8b0cd5f59920
SHA5123b155bfdb9bd74d140278d5baff5a6e66ccc591c346c01f8426d2095e9198c05e07e556b881d18ad10104756546272a6c2a80f3cc4c59d3e749e1dd647024c54
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un100529.exeFilesize
555KB
MD50c62cb9635d4fa9cd587b9b59f34d1cc
SHA10b3b867090e50cc04e841ad02c91a54df93e02dd
SHA2565679cd201b122171b91b7ff7bb842958195a9cc20d90009ba6ba8b0cd5f59920
SHA5123b155bfdb9bd74d140278d5baff5a6e66ccc591c346c01f8426d2095e9198c05e07e556b881d18ad10104756546272a6c2a80f3cc4c59d3e749e1dd647024c54
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8974.exeFilesize
347KB
MD52bf21cbd11fa78fc20c7adf63bc99352
SHA11333ab622ccfa8e64dc8efdae267645e42146386
SHA256efc59048cf8312f9655dc5d3ff33f4ab764e1ad20b98050b5fbc9898cb830b67
SHA51246c1c32780677b816a767ffbe5391ae5248416ba4100cf06b33bbe7f705f7514ca569296942dafa97669f20b4bf36ad27dcf6a3aef0e8ebe0cc35fdffb837f48
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8974.exeFilesize
347KB
MD52bf21cbd11fa78fc20c7adf63bc99352
SHA11333ab622ccfa8e64dc8efdae267645e42146386
SHA256efc59048cf8312f9655dc5d3ff33f4ab764e1ad20b98050b5fbc9898cb830b67
SHA51246c1c32780677b816a767ffbe5391ae5248416ba4100cf06b33bbe7f705f7514ca569296942dafa97669f20b4bf36ad27dcf6a3aef0e8ebe0cc35fdffb837f48
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1057.exeFilesize
406KB
MD5e3367bcb99b02e92574f3cb10bc426f2
SHA13f6f1b4c9ef14670c34ae2c9654bc7e21d762c34
SHA2567790023ccc7b6b5e01e170a183c3599fc8631c8d9116607d2ff7fb34e3934cf9
SHA5126164c0b9a8c7382a9eb1681c8cac754b3c1524a5baa1558a89f257a8c8c7ae31a0a57bd639d25b04bd04e1f16194ff42b542bbd27074d800703fd6dc7fd73ae6
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1057.exeFilesize
406KB
MD5e3367bcb99b02e92574f3cb10bc426f2
SHA13f6f1b4c9ef14670c34ae2c9654bc7e21d762c34
SHA2567790023ccc7b6b5e01e170a183c3599fc8631c8d9116607d2ff7fb34e3934cf9
SHA5126164c0b9a8c7382a9eb1681c8cac754b3c1524a5baa1558a89f257a8c8c7ae31a0a57bd639d25b04bd04e1f16194ff42b542bbd27074d800703fd6dc7fd73ae6
-
memory/380-148-0x0000000002C80000-0x0000000002CAD000-memory.dmpFilesize
180KB
-
memory/380-149-0x00000000072E0000-0x0000000007884000-memory.dmpFilesize
5.6MB
-
memory/380-150-0x00000000048F0000-0x0000000004902000-memory.dmpFilesize
72KB
-
memory/380-151-0x00000000048F0000-0x0000000004902000-memory.dmpFilesize
72KB
-
memory/380-153-0x00000000048F0000-0x0000000004902000-memory.dmpFilesize
72KB
-
memory/380-155-0x00000000048F0000-0x0000000004902000-memory.dmpFilesize
72KB
-
memory/380-157-0x00000000048F0000-0x0000000004902000-memory.dmpFilesize
72KB
-
memory/380-159-0x00000000048F0000-0x0000000004902000-memory.dmpFilesize
72KB
-
memory/380-161-0x00000000048F0000-0x0000000004902000-memory.dmpFilesize
72KB
-
memory/380-163-0x00000000048F0000-0x0000000004902000-memory.dmpFilesize
72KB
-
memory/380-165-0x00000000048F0000-0x0000000004902000-memory.dmpFilesize
72KB
-
memory/380-167-0x00000000048F0000-0x0000000004902000-memory.dmpFilesize
72KB
-
memory/380-169-0x00000000048F0000-0x0000000004902000-memory.dmpFilesize
72KB
-
memory/380-171-0x00000000048F0000-0x0000000004902000-memory.dmpFilesize
72KB
-
memory/380-174-0x00000000072D0000-0x00000000072E0000-memory.dmpFilesize
64KB
-
memory/380-175-0x00000000072D0000-0x00000000072E0000-memory.dmpFilesize
64KB
-
memory/380-173-0x00000000048F0000-0x0000000004902000-memory.dmpFilesize
72KB
-
memory/380-178-0x00000000072D0000-0x00000000072E0000-memory.dmpFilesize
64KB
-
memory/380-177-0x00000000048F0000-0x0000000004902000-memory.dmpFilesize
72KB
-
memory/380-180-0x00000000048F0000-0x0000000004902000-memory.dmpFilesize
72KB
-
memory/380-181-0x0000000000400000-0x0000000002B84000-memory.dmpFilesize
39.5MB
-
memory/380-183-0x00000000072D0000-0x00000000072E0000-memory.dmpFilesize
64KB
-
memory/380-184-0x00000000072D0000-0x00000000072E0000-memory.dmpFilesize
64KB
-
memory/380-185-0x0000000000400000-0x0000000002B84000-memory.dmpFilesize
39.5MB
-
memory/3668-190-0x0000000002BF0000-0x0000000002C3B000-memory.dmpFilesize
300KB
-
memory/3668-191-0x0000000007240000-0x0000000007250000-memory.dmpFilesize
64KB
-
memory/3668-193-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/3668-194-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/3668-196-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/3668-192-0x0000000007240000-0x0000000007250000-memory.dmpFilesize
64KB
-
memory/3668-198-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/3668-200-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/3668-202-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/3668-204-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/3668-206-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/3668-208-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/3668-210-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/3668-212-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/3668-214-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/3668-216-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/3668-218-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/3668-220-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/3668-222-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/3668-224-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/3668-226-0x0000000007140000-0x000000000717F000-memory.dmpFilesize
252KB
-
memory/3668-1099-0x0000000007900000-0x0000000007F18000-memory.dmpFilesize
6.1MB
-
memory/3668-1100-0x0000000007F80000-0x000000000808A000-memory.dmpFilesize
1.0MB
-
memory/3668-1101-0x00000000080C0000-0x00000000080D2000-memory.dmpFilesize
72KB
-
memory/3668-1102-0x00000000080E0000-0x000000000811C000-memory.dmpFilesize
240KB
-
memory/3668-1103-0x0000000007240000-0x0000000007250000-memory.dmpFilesize
64KB
-
memory/3668-1105-0x00000000083D0000-0x0000000008462000-memory.dmpFilesize
584KB
-
memory/3668-1106-0x0000000008470000-0x00000000084D6000-memory.dmpFilesize
408KB
-
memory/3668-1107-0x0000000007240000-0x0000000007250000-memory.dmpFilesize
64KB
-
memory/3668-1108-0x0000000007240000-0x0000000007250000-memory.dmpFilesize
64KB
-
memory/3668-1109-0x0000000007240000-0x0000000007250000-memory.dmpFilesize
64KB
-
memory/3668-1110-0x0000000008CA0000-0x0000000008E62000-memory.dmpFilesize
1.8MB
-
memory/3668-1111-0x0000000008E70000-0x000000000939C000-memory.dmpFilesize
5.2MB
-
memory/3668-1112-0x00000000094D0000-0x0000000009546000-memory.dmpFilesize
472KB
-
memory/3668-1113-0x0000000009560000-0x00000000095B0000-memory.dmpFilesize
320KB
-
memory/3668-1114-0x0000000007240000-0x0000000007250000-memory.dmpFilesize
64KB
-
memory/3876-1120-0x0000000000EA0000-0x0000000000ED2000-memory.dmpFilesize
200KB
-
memory/3876-1121-0x0000000005AB0000-0x0000000005AC0000-memory.dmpFilesize
64KB