Analysis
-
max time kernel
72s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 17:38
Static task
static1
Behavioral task
behavioral1
Sample
e70eb8961d0716e02a549f92abe4437fed11d46b054f94845555ea2757b9dbcd.exe
Resource
win10v2004-20230220-en
General
-
Target
e70eb8961d0716e02a549f92abe4437fed11d46b054f94845555ea2757b9dbcd.exe
-
Size
671KB
-
MD5
14d854d16f6d596500fab92a885dff20
-
SHA1
b62762750b38b86e5b3415d8ced0a1b966e221b2
-
SHA256
e70eb8961d0716e02a549f92abe4437fed11d46b054f94845555ea2757b9dbcd
-
SHA512
74b9fbdbcb079ca59422df366b2f6f18b830099629c1703994f79503aed271b32f0bbf37ddec9bf3ef244de24e93e367f2e605dcfbb3ec4649847e02ad84a655
-
SSDEEP
12288:sMrWy90A3Q3R2GbRCUVDdmIJiRJjomEG+YvTOJpEtJwqA:KyMBjRCcDdLJiRJjobccStJwD
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro4433.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro4433.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro4433.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro4433.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro4433.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro4433.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro4433.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/4664-192-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4664-191-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4664-194-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4664-196-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4664-198-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4664-200-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4664-202-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4664-204-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4664-206-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4664-208-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4664-210-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4664-212-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4664-214-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4664-216-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4664-218-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4664-220-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4664-222-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4664-224-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un432846.exepro4433.exequ7093.exesi477040.exepid process 892 un432846.exe 1752 pro4433.exe 4664 qu7093.exe 3372 si477040.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro4433.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro4433.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro4433.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un432846.exee70eb8961d0716e02a549f92abe4437fed11d46b054f94845555ea2757b9dbcd.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un432846.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un432846.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce e70eb8961d0716e02a549f92abe4437fed11d46b054f94845555ea2757b9dbcd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" e70eb8961d0716e02a549f92abe4437fed11d46b054f94845555ea2757b9dbcd.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 116 1752 WerFault.exe pro4433.exe 2152 4664 WerFault.exe qu7093.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro4433.exequ7093.exesi477040.exepid process 1752 pro4433.exe 1752 pro4433.exe 4664 qu7093.exe 4664 qu7093.exe 3372 si477040.exe 3372 si477040.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro4433.exequ7093.exesi477040.exedescription pid process Token: SeDebugPrivilege 1752 pro4433.exe Token: SeDebugPrivilege 4664 qu7093.exe Token: SeDebugPrivilege 3372 si477040.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
e70eb8961d0716e02a549f92abe4437fed11d46b054f94845555ea2757b9dbcd.exeun432846.exedescription pid process target process PID 5040 wrote to memory of 892 5040 e70eb8961d0716e02a549f92abe4437fed11d46b054f94845555ea2757b9dbcd.exe un432846.exe PID 5040 wrote to memory of 892 5040 e70eb8961d0716e02a549f92abe4437fed11d46b054f94845555ea2757b9dbcd.exe un432846.exe PID 5040 wrote to memory of 892 5040 e70eb8961d0716e02a549f92abe4437fed11d46b054f94845555ea2757b9dbcd.exe un432846.exe PID 892 wrote to memory of 1752 892 un432846.exe pro4433.exe PID 892 wrote to memory of 1752 892 un432846.exe pro4433.exe PID 892 wrote to memory of 1752 892 un432846.exe pro4433.exe PID 892 wrote to memory of 4664 892 un432846.exe qu7093.exe PID 892 wrote to memory of 4664 892 un432846.exe qu7093.exe PID 892 wrote to memory of 4664 892 un432846.exe qu7093.exe PID 5040 wrote to memory of 3372 5040 e70eb8961d0716e02a549f92abe4437fed11d46b054f94845555ea2757b9dbcd.exe si477040.exe PID 5040 wrote to memory of 3372 5040 e70eb8961d0716e02a549f92abe4437fed11d46b054f94845555ea2757b9dbcd.exe si477040.exe PID 5040 wrote to memory of 3372 5040 e70eb8961d0716e02a549f92abe4437fed11d46b054f94845555ea2757b9dbcd.exe si477040.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e70eb8961d0716e02a549f92abe4437fed11d46b054f94845555ea2757b9dbcd.exe"C:\Users\Admin\AppData\Local\Temp\e70eb8961d0716e02a549f92abe4437fed11d46b054f94845555ea2757b9dbcd.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un432846.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un432846.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4433.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4433.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1752 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 10804⤵
- Program crash
PID:116 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7093.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7093.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4664 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 17324⤵
- Program crash
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si477040.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si477040.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3372
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1752 -ip 17521⤵PID:1352
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4664 -ip 46641⤵PID:3632
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si477040.exeFilesize
175KB
MD58ddcff817b94ab4eebbd5f3754701b15
SHA14641d83c9bfea20b52dd40a9974b6438919fb49a
SHA2564a961dadbe857982a7a186df8ce219ea42e6d5a95634421d99da7f3b33e7bb8c
SHA5126a15e0b8e46cc52288eb9e1896d26d2fff1dac4b189e97c403e937e3d45e632bcafca63d3fb06247e9c133bf7edaedcc40ec247181bc59c157fae228a6b469f4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si477040.exeFilesize
175KB
MD58ddcff817b94ab4eebbd5f3754701b15
SHA14641d83c9bfea20b52dd40a9974b6438919fb49a
SHA2564a961dadbe857982a7a186df8ce219ea42e6d5a95634421d99da7f3b33e7bb8c
SHA5126a15e0b8e46cc52288eb9e1896d26d2fff1dac4b189e97c403e937e3d45e632bcafca63d3fb06247e9c133bf7edaedcc40ec247181bc59c157fae228a6b469f4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un432846.exeFilesize
530KB
MD54949f8b1774e16c8edd1edbb7910d4b2
SHA1aa4f62315b1e74d828032e39c9284dce167363c7
SHA256dc44d7cf493e08058f9c6f3d6b58ae530822ba1c24e07e5d899eb4b0e22d5340
SHA5120d65edb5bb1fb7ea8ef0d393392fa9505afe1ff9ece01fa1b00abf4b5e92c869daba889b16a0a96763ccd74d9c5584e8dd351d09ab0d34e2e20b7632938c3292
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un432846.exeFilesize
530KB
MD54949f8b1774e16c8edd1edbb7910d4b2
SHA1aa4f62315b1e74d828032e39c9284dce167363c7
SHA256dc44d7cf493e08058f9c6f3d6b58ae530822ba1c24e07e5d899eb4b0e22d5340
SHA5120d65edb5bb1fb7ea8ef0d393392fa9505afe1ff9ece01fa1b00abf4b5e92c869daba889b16a0a96763ccd74d9c5584e8dd351d09ab0d34e2e20b7632938c3292
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4433.exeFilesize
259KB
MD533d7bfbbad029b6e054559fca98da9fb
SHA1307bbc6b34d8f6789af075d5c7e646fc3e421909
SHA256344aef1b6531bdf699d14fec9b72f7c2f873da68b1aecd02716dd82dc1748fee
SHA51261e97542ec1e5fa8eeb90d28c5081a0140e81236173b392c01877af9c1288c6192fa2c8ab1f0c48add582d44ed496e2bb151f4f6582e84cf268d8127b8bb9551
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4433.exeFilesize
259KB
MD533d7bfbbad029b6e054559fca98da9fb
SHA1307bbc6b34d8f6789af075d5c7e646fc3e421909
SHA256344aef1b6531bdf699d14fec9b72f7c2f873da68b1aecd02716dd82dc1748fee
SHA51261e97542ec1e5fa8eeb90d28c5081a0140e81236173b392c01877af9c1288c6192fa2c8ab1f0c48add582d44ed496e2bb151f4f6582e84cf268d8127b8bb9551
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7093.exeFilesize
318KB
MD57355e76d4e7c1e7f48ab6590bc0f68a1
SHA19fb5e4aff105825d0e23b29b702f446f00303772
SHA2568e4cec9e62253ca164cd098296a78f6287dadbd6c2fa2d7ded413a73464e795d
SHA512e2e7381b30048103160a223b2381f04de95cd3e14d804c8636633dec44d1fe598023480b9e8995350533c646a4d57847b3a6e07e445962a1d5549e86fef642fc
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7093.exeFilesize
318KB
MD57355e76d4e7c1e7f48ab6590bc0f68a1
SHA19fb5e4aff105825d0e23b29b702f446f00303772
SHA2568e4cec9e62253ca164cd098296a78f6287dadbd6c2fa2d7ded413a73464e795d
SHA512e2e7381b30048103160a223b2381f04de95cd3e14d804c8636633dec44d1fe598023480b9e8995350533c646a4d57847b3a6e07e445962a1d5549e86fef642fc
-
memory/1752-165-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/1752-171-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/1752-151-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/1752-150-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/1752-153-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/1752-155-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/1752-157-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/1752-159-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/1752-161-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/1752-163-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/1752-148-0x00000000020F0000-0x000000000211D000-memory.dmpFilesize
180KB
-
memory/1752-167-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/1752-169-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/1752-149-0x0000000004AE0000-0x0000000005084000-memory.dmpFilesize
5.6MB
-
memory/1752-173-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/1752-175-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/1752-177-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/1752-178-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/1752-179-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/1752-180-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/1752-181-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/1752-183-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/1752-184-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/1752-185-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/1752-186-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/3372-1121-0x0000000000CA0000-0x0000000000CD2000-memory.dmpFilesize
200KB
-
memory/3372-1123-0x0000000005580000-0x0000000005590000-memory.dmpFilesize
64KB
-
memory/3372-1122-0x0000000005580000-0x0000000005590000-memory.dmpFilesize
64KB
-
memory/4664-194-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4664-196-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4664-198-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4664-200-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4664-202-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4664-204-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4664-206-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4664-208-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4664-210-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4664-212-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4664-214-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4664-216-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4664-218-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4664-220-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4664-222-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4664-224-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4664-253-0x00000000020F0000-0x000000000213B000-memory.dmpFilesize
300KB
-
memory/4664-254-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/4664-256-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/4664-1100-0x00000000050C0000-0x00000000056D8000-memory.dmpFilesize
6.1MB
-
memory/4664-1101-0x0000000005760000-0x000000000586A000-memory.dmpFilesize
1.0MB
-
memory/4664-1102-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/4664-1103-0x00000000058C0000-0x00000000058FC000-memory.dmpFilesize
240KB
-
memory/4664-1104-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/4664-1105-0x0000000005BB0000-0x0000000005C42000-memory.dmpFilesize
584KB
-
memory/4664-1106-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/4664-1108-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/4664-1109-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/4664-1110-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/4664-1111-0x0000000006460000-0x00000000064D6000-memory.dmpFilesize
472KB
-
memory/4664-1112-0x00000000064E0000-0x0000000006530000-memory.dmpFilesize
320KB
-
memory/4664-191-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4664-192-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4664-1113-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/4664-1114-0x00000000066A0000-0x0000000006862000-memory.dmpFilesize
1.8MB
-
memory/4664-1115-0x0000000006880000-0x0000000006DAC000-memory.dmpFilesize
5.2MB