Analysis
-
max time kernel
55s -
max time network
148s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
31-03-2023 21:36
Static task
static1
Behavioral task
behavioral1
Sample
f3a30a7248f11a5ba54c395fffa8d897623d5409f98cac0e917c4044f64a59b4.exe
Resource
win10-20230220-en
General
-
Target
f3a30a7248f11a5ba54c395fffa8d897623d5409f98cac0e917c4044f64a59b4.exe
-
Size
534KB
-
MD5
d40308efcf9e01d52a96bbef46811b9c
-
SHA1
2edc438834112780a2d8e3337831f5d4d848caea
-
SHA256
f3a30a7248f11a5ba54c395fffa8d897623d5409f98cac0e917c4044f64a59b4
-
SHA512
172d487c58198d1999b5361c21b74d7489c41102fbe53462ec0aa765369663d5ada9e8017a2554161cbd9147582c6218438abf7226787dbd79f30670f2ac2f45
-
SSDEEP
12288:TMr+y90zVBgws+PhfIDpR3Lq+Ac+7SopXG:RyZZ+POdR3GewSN
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr597721.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr597721.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr597721.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr597721.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr597721.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr597721.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
Processes:
resource yara_rule behavioral1/memory/1004-138-0x00000000037F0000-0x0000000003836000-memory.dmp family_redline behavioral1/memory/1004-140-0x00000000039B0000-0x00000000039F4000-memory.dmp family_redline behavioral1/memory/1004-141-0x00000000039B0000-0x00000000039EF000-memory.dmp family_redline behavioral1/memory/1004-144-0x00000000039B0000-0x00000000039EF000-memory.dmp family_redline behavioral1/memory/1004-142-0x00000000039B0000-0x00000000039EF000-memory.dmp family_redline behavioral1/memory/1004-147-0x00000000039B0000-0x00000000039EF000-memory.dmp family_redline behavioral1/memory/1004-151-0x00000000039B0000-0x00000000039EF000-memory.dmp family_redline behavioral1/memory/1004-155-0x00000000039B0000-0x00000000039EF000-memory.dmp family_redline behavioral1/memory/1004-157-0x00000000039B0000-0x00000000039EF000-memory.dmp family_redline behavioral1/memory/1004-159-0x00000000039B0000-0x00000000039EF000-memory.dmp family_redline behavioral1/memory/1004-153-0x00000000039B0000-0x00000000039EF000-memory.dmp family_redline behavioral1/memory/1004-161-0x00000000039B0000-0x00000000039EF000-memory.dmp family_redline behavioral1/memory/1004-163-0x00000000039B0000-0x00000000039EF000-memory.dmp family_redline behavioral1/memory/1004-165-0x00000000039B0000-0x00000000039EF000-memory.dmp family_redline behavioral1/memory/1004-167-0x00000000039B0000-0x00000000039EF000-memory.dmp family_redline behavioral1/memory/1004-169-0x00000000039B0000-0x00000000039EF000-memory.dmp family_redline behavioral1/memory/1004-171-0x00000000039B0000-0x00000000039EF000-memory.dmp family_redline behavioral1/memory/1004-173-0x00000000039B0000-0x00000000039EF000-memory.dmp family_redline behavioral1/memory/1004-175-0x00000000039B0000-0x00000000039EF000-memory.dmp family_redline behavioral1/memory/1004-177-0x00000000039B0000-0x00000000039EF000-memory.dmp family_redline behavioral1/memory/1004-179-0x00000000039B0000-0x00000000039EF000-memory.dmp family_redline behavioral1/memory/1004-181-0x00000000039B0000-0x00000000039EF000-memory.dmp family_redline behavioral1/memory/1004-183-0x00000000039B0000-0x00000000039EF000-memory.dmp family_redline behavioral1/memory/1004-185-0x00000000039B0000-0x00000000039EF000-memory.dmp family_redline behavioral1/memory/1004-187-0x00000000039B0000-0x00000000039EF000-memory.dmp family_redline behavioral1/memory/1004-189-0x00000000039B0000-0x00000000039EF000-memory.dmp family_redline behavioral1/memory/1004-191-0x00000000039B0000-0x00000000039EF000-memory.dmp family_redline behavioral1/memory/1004-193-0x00000000039B0000-0x00000000039EF000-memory.dmp family_redline behavioral1/memory/1004-195-0x00000000039B0000-0x00000000039EF000-memory.dmp family_redline behavioral1/memory/1004-203-0x00000000039B0000-0x00000000039EF000-memory.dmp family_redline behavioral1/memory/1004-201-0x00000000039B0000-0x00000000039EF000-memory.dmp family_redline behavioral1/memory/1004-199-0x00000000039B0000-0x00000000039EF000-memory.dmp family_redline behavioral1/memory/1004-197-0x00000000039B0000-0x00000000039EF000-memory.dmp family_redline behavioral1/memory/1004-205-0x00000000039B0000-0x00000000039EF000-memory.dmp family_redline behavioral1/memory/1004-207-0x00000000039B0000-0x00000000039EF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
zidJ2732.exejr597721.exeku910799.exelr666729.exepid process 3996 zidJ2732.exe 3508 jr597721.exe 1004 ku910799.exe 3604 lr666729.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr597721.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr597721.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
f3a30a7248f11a5ba54c395fffa8d897623d5409f98cac0e917c4044f64a59b4.exezidJ2732.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce f3a30a7248f11a5ba54c395fffa8d897623d5409f98cac0e917c4044f64a59b4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" f3a30a7248f11a5ba54c395fffa8d897623d5409f98cac0e917c4044f64a59b4.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zidJ2732.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zidJ2732.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr597721.exeku910799.exelr666729.exepid process 3508 jr597721.exe 3508 jr597721.exe 1004 ku910799.exe 1004 ku910799.exe 3604 lr666729.exe 3604 lr666729.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr597721.exeku910799.exelr666729.exedescription pid process Token: SeDebugPrivilege 3508 jr597721.exe Token: SeDebugPrivilege 1004 ku910799.exe Token: SeDebugPrivilege 3604 lr666729.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
f3a30a7248f11a5ba54c395fffa8d897623d5409f98cac0e917c4044f64a59b4.exezidJ2732.exedescription pid process target process PID 3480 wrote to memory of 3996 3480 f3a30a7248f11a5ba54c395fffa8d897623d5409f98cac0e917c4044f64a59b4.exe zidJ2732.exe PID 3480 wrote to memory of 3996 3480 f3a30a7248f11a5ba54c395fffa8d897623d5409f98cac0e917c4044f64a59b4.exe zidJ2732.exe PID 3480 wrote to memory of 3996 3480 f3a30a7248f11a5ba54c395fffa8d897623d5409f98cac0e917c4044f64a59b4.exe zidJ2732.exe PID 3996 wrote to memory of 3508 3996 zidJ2732.exe jr597721.exe PID 3996 wrote to memory of 3508 3996 zidJ2732.exe jr597721.exe PID 3996 wrote to memory of 1004 3996 zidJ2732.exe ku910799.exe PID 3996 wrote to memory of 1004 3996 zidJ2732.exe ku910799.exe PID 3996 wrote to memory of 1004 3996 zidJ2732.exe ku910799.exe PID 3480 wrote to memory of 3604 3480 f3a30a7248f11a5ba54c395fffa8d897623d5409f98cac0e917c4044f64a59b4.exe lr666729.exe PID 3480 wrote to memory of 3604 3480 f3a30a7248f11a5ba54c395fffa8d897623d5409f98cac0e917c4044f64a59b4.exe lr666729.exe PID 3480 wrote to memory of 3604 3480 f3a30a7248f11a5ba54c395fffa8d897623d5409f98cac0e917c4044f64a59b4.exe lr666729.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3a30a7248f11a5ba54c395fffa8d897623d5409f98cac0e917c4044f64a59b4.exe"C:\Users\Admin\AppData\Local\Temp\f3a30a7248f11a5ba54c395fffa8d897623d5409f98cac0e917c4044f64a59b4.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zidJ2732.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zidJ2732.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr597721.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr597721.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku910799.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku910799.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr666729.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr666729.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr666729.exeFilesize
175KB
MD5411170abc6892921018eb93903ebc854
SHA10a8d8dda7abf4f2e08ca03ebb52d2b3508060bc4
SHA256aa00bc98c1ac6663137534f06c3d041036ea485380d4a07269727e63d5994016
SHA5120b9e60627ce4e089ad90f6c640c2575f1dd2f9c8a07e524e7e758c6e3013c7cd084a07d1f019ad6f8d4ef8fc4517d6b91cf824bb37e19005d958a5bc71863863
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr666729.exeFilesize
175KB
MD5411170abc6892921018eb93903ebc854
SHA10a8d8dda7abf4f2e08ca03ebb52d2b3508060bc4
SHA256aa00bc98c1ac6663137534f06c3d041036ea485380d4a07269727e63d5994016
SHA5120b9e60627ce4e089ad90f6c640c2575f1dd2f9c8a07e524e7e758c6e3013c7cd084a07d1f019ad6f8d4ef8fc4517d6b91cf824bb37e19005d958a5bc71863863
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zidJ2732.exeFilesize
392KB
MD5074f74fd0aeba52bc0d97047ee3cedc4
SHA1ed27f134a1b9da593444e3625ee172e753ce70a0
SHA2567c42294810d551f3b382a589b12bf2bd6ae5397aef0a81f8f73451648363498d
SHA512dc9c153c29ce47da2cf406a91adb50b489480b0766cdb30ac3b22859348733ab0fe45c305fb363b9bad40fa049afa0ada79f982e29b3bb36aefe5df7f789cc70
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zidJ2732.exeFilesize
392KB
MD5074f74fd0aeba52bc0d97047ee3cedc4
SHA1ed27f134a1b9da593444e3625ee172e753ce70a0
SHA2567c42294810d551f3b382a589b12bf2bd6ae5397aef0a81f8f73451648363498d
SHA512dc9c153c29ce47da2cf406a91adb50b489480b0766cdb30ac3b22859348733ab0fe45c305fb363b9bad40fa049afa0ada79f982e29b3bb36aefe5df7f789cc70
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr597721.exeFilesize
11KB
MD571a0f2ad74e9f1e6b4d97d37b332421b
SHA19beac6ca08d9049647cc8c16a465f615766d5971
SHA256b03dc861feaef3aae851e0adc086fd19afaaf51255217652319d9abd77cb6662
SHA512b183496eb9402d08ba9a8a5913b6e1d24275acae041d7260472839f120c6bc8d13a1e53a4f8dceacf9288b608acc3e35b138c90ef9e34ecc91598dfd71d75ff1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr597721.exeFilesize
11KB
MD571a0f2ad74e9f1e6b4d97d37b332421b
SHA19beac6ca08d9049647cc8c16a465f615766d5971
SHA256b03dc861feaef3aae851e0adc086fd19afaaf51255217652319d9abd77cb6662
SHA512b183496eb9402d08ba9a8a5913b6e1d24275acae041d7260472839f120c6bc8d13a1e53a4f8dceacf9288b608acc3e35b138c90ef9e34ecc91598dfd71d75ff1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku910799.exeFilesize
359KB
MD5e3e5a7b46b8780031a150218414c0072
SHA1fc6ff33e9757cccc3e5a8d48cb9ac3c82f80469a
SHA256193571da0729e86eab4f200ef9252eca51984eec55ceaa381de60c7431304733
SHA512341e8df9aac718537281bfd20b1f19252e4c907c2af653dc7af2f9be791c4138c785d8b77fad57d59bd9ca43e00427bdb0dc1f58ae6eadb9af8cff852fb02eb4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku910799.exeFilesize
359KB
MD5e3e5a7b46b8780031a150218414c0072
SHA1fc6ff33e9757cccc3e5a8d48cb9ac3c82f80469a
SHA256193571da0729e86eab4f200ef9252eca51984eec55ceaa381de60c7431304733
SHA512341e8df9aac718537281bfd20b1f19252e4c907c2af653dc7af2f9be791c4138c785d8b77fad57d59bd9ca43e00427bdb0dc1f58ae6eadb9af8cff852fb02eb4
-
memory/1004-137-0x0000000001BD0000-0x0000000001C1B000-memory.dmpFilesize
300KB
-
memory/1004-138-0x00000000037F0000-0x0000000003836000-memory.dmpFilesize
280KB
-
memory/1004-139-0x0000000006280000-0x000000000677E000-memory.dmpFilesize
5.0MB
-
memory/1004-140-0x00000000039B0000-0x00000000039F4000-memory.dmpFilesize
272KB
-
memory/1004-141-0x00000000039B0000-0x00000000039EF000-memory.dmpFilesize
252KB
-
memory/1004-144-0x00000000039B0000-0x00000000039EF000-memory.dmpFilesize
252KB
-
memory/1004-142-0x00000000039B0000-0x00000000039EF000-memory.dmpFilesize
252KB
-
memory/1004-146-0x0000000006270000-0x0000000006280000-memory.dmpFilesize
64KB
-
memory/1004-149-0x0000000006270000-0x0000000006280000-memory.dmpFilesize
64KB
-
memory/1004-147-0x00000000039B0000-0x00000000039EF000-memory.dmpFilesize
252KB
-
memory/1004-151-0x00000000039B0000-0x00000000039EF000-memory.dmpFilesize
252KB
-
memory/1004-155-0x00000000039B0000-0x00000000039EF000-memory.dmpFilesize
252KB
-
memory/1004-157-0x00000000039B0000-0x00000000039EF000-memory.dmpFilesize
252KB
-
memory/1004-159-0x00000000039B0000-0x00000000039EF000-memory.dmpFilesize
252KB
-
memory/1004-153-0x00000000039B0000-0x00000000039EF000-memory.dmpFilesize
252KB
-
memory/1004-150-0x0000000006270000-0x0000000006280000-memory.dmpFilesize
64KB
-
memory/1004-161-0x00000000039B0000-0x00000000039EF000-memory.dmpFilesize
252KB
-
memory/1004-163-0x00000000039B0000-0x00000000039EF000-memory.dmpFilesize
252KB
-
memory/1004-165-0x00000000039B0000-0x00000000039EF000-memory.dmpFilesize
252KB
-
memory/1004-167-0x00000000039B0000-0x00000000039EF000-memory.dmpFilesize
252KB
-
memory/1004-169-0x00000000039B0000-0x00000000039EF000-memory.dmpFilesize
252KB
-
memory/1004-171-0x00000000039B0000-0x00000000039EF000-memory.dmpFilesize
252KB
-
memory/1004-173-0x00000000039B0000-0x00000000039EF000-memory.dmpFilesize
252KB
-
memory/1004-175-0x00000000039B0000-0x00000000039EF000-memory.dmpFilesize
252KB
-
memory/1004-177-0x00000000039B0000-0x00000000039EF000-memory.dmpFilesize
252KB
-
memory/1004-179-0x00000000039B0000-0x00000000039EF000-memory.dmpFilesize
252KB
-
memory/1004-181-0x00000000039B0000-0x00000000039EF000-memory.dmpFilesize
252KB
-
memory/1004-183-0x00000000039B0000-0x00000000039EF000-memory.dmpFilesize
252KB
-
memory/1004-185-0x00000000039B0000-0x00000000039EF000-memory.dmpFilesize
252KB
-
memory/1004-187-0x00000000039B0000-0x00000000039EF000-memory.dmpFilesize
252KB
-
memory/1004-189-0x00000000039B0000-0x00000000039EF000-memory.dmpFilesize
252KB
-
memory/1004-191-0x00000000039B0000-0x00000000039EF000-memory.dmpFilesize
252KB
-
memory/1004-193-0x00000000039B0000-0x00000000039EF000-memory.dmpFilesize
252KB
-
memory/1004-195-0x00000000039B0000-0x00000000039EF000-memory.dmpFilesize
252KB
-
memory/1004-203-0x00000000039B0000-0x00000000039EF000-memory.dmpFilesize
252KB
-
memory/1004-201-0x00000000039B0000-0x00000000039EF000-memory.dmpFilesize
252KB
-
memory/1004-199-0x00000000039B0000-0x00000000039EF000-memory.dmpFilesize
252KB
-
memory/1004-197-0x00000000039B0000-0x00000000039EF000-memory.dmpFilesize
252KB
-
memory/1004-205-0x00000000039B0000-0x00000000039EF000-memory.dmpFilesize
252KB
-
memory/1004-207-0x00000000039B0000-0x00000000039EF000-memory.dmpFilesize
252KB
-
memory/1004-1050-0x0000000006780000-0x0000000006D86000-memory.dmpFilesize
6.0MB
-
memory/1004-1051-0x0000000006D90000-0x0000000006E9A000-memory.dmpFilesize
1.0MB
-
memory/1004-1052-0x00000000061B0000-0x00000000061C2000-memory.dmpFilesize
72KB
-
memory/1004-1053-0x00000000061D0000-0x000000000620E000-memory.dmpFilesize
248KB
-
memory/1004-1054-0x0000000006220000-0x000000000626B000-memory.dmpFilesize
300KB
-
memory/1004-1055-0x0000000006270000-0x0000000006280000-memory.dmpFilesize
64KB
-
memory/1004-1057-0x00000000070E0000-0x0000000007146000-memory.dmpFilesize
408KB
-
memory/1004-1058-0x0000000006270000-0x0000000006280000-memory.dmpFilesize
64KB
-
memory/1004-1059-0x0000000006270000-0x0000000006280000-memory.dmpFilesize
64KB
-
memory/1004-1060-0x0000000006270000-0x0000000006280000-memory.dmpFilesize
64KB
-
memory/1004-1061-0x00000000077A0000-0x0000000007832000-memory.dmpFilesize
584KB
-
memory/1004-1062-0x0000000007870000-0x00000000078E6000-memory.dmpFilesize
472KB
-
memory/1004-1063-0x00000000078F0000-0x0000000007940000-memory.dmpFilesize
320KB
-
memory/1004-1064-0x0000000007A80000-0x0000000007C42000-memory.dmpFilesize
1.8MB
-
memory/1004-1065-0x0000000007C50000-0x000000000817C000-memory.dmpFilesize
5.2MB
-
memory/1004-1066-0x0000000006270000-0x0000000006280000-memory.dmpFilesize
64KB
-
memory/3508-131-0x0000000000D90000-0x0000000000D9A000-memory.dmpFilesize
40KB
-
memory/3604-1072-0x00000000001C0000-0x00000000001F2000-memory.dmpFilesize
200KB
-
memory/3604-1073-0x0000000004C00000-0x0000000004C4B000-memory.dmpFilesize
300KB
-
memory/3604-1074-0x0000000004D60000-0x0000000004D70000-memory.dmpFilesize
64KB