Analysis
-
max time kernel
75s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 17:39
Static task
static1
Behavioral task
behavioral1
Sample
1a80616070833b9cd693e6a98027eb55ce1747e74fb13d7c47bad59c850abf6c.exe
Resource
win10v2004-20230220-en
General
-
Target
1a80616070833b9cd693e6a98027eb55ce1747e74fb13d7c47bad59c850abf6c.exe
-
Size
672KB
-
MD5
e2b102dec6b99e71983d485c50fb6178
-
SHA1
4100134bdcb435e24fe26ba8e1cb842d896efd9f
-
SHA256
1a80616070833b9cd693e6a98027eb55ce1747e74fb13d7c47bad59c850abf6c
-
SHA512
afc292345048d78f65a1acd761f00911be239b6977de2e89b7a9ba8cb41d061afd7f06097b940129b8b1a9a0a1c9144be17a914b7de082ac6f550ae6ecbfbd3e
-
SSDEEP
12288:aMrgy90n3UnjYVv4MEd/SaLn43mB/sqceLuAiombb+Ysn46pGPvI:mySFVv4MEE2z5uro7xFgXI
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro0208.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro0208.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro0208.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro0208.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro0208.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro0208.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro0208.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/2464-193-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/2464-194-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/2464-196-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/2464-198-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/2464-200-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/2464-202-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/2464-204-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/2464-206-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/2464-208-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/2464-210-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/2464-212-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/2464-214-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/2464-216-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/2464-218-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/2464-220-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/2464-222-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/2464-224-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/2464-379-0x0000000004BF0000-0x0000000004C00000-memory.dmp family_redline behavioral1/memory/2464-1110-0x0000000004BF0000-0x0000000004C00000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un544531.exepro0208.exequ0460.exesi039038.exepid process 728 un544531.exe 2700 pro0208.exe 2464 qu0460.exe 4964 si039038.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro0208.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro0208.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro0208.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
1a80616070833b9cd693e6a98027eb55ce1747e74fb13d7c47bad59c850abf6c.exeun544531.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 1a80616070833b9cd693e6a98027eb55ce1747e74fb13d7c47bad59c850abf6c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1a80616070833b9cd693e6a98027eb55ce1747e74fb13d7c47bad59c850abf6c.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un544531.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un544531.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2688 2700 WerFault.exe pro0208.exe 2392 2464 WerFault.exe qu0460.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro0208.exequ0460.exesi039038.exepid process 2700 pro0208.exe 2700 pro0208.exe 2464 qu0460.exe 2464 qu0460.exe 4964 si039038.exe 4964 si039038.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro0208.exequ0460.exesi039038.exedescription pid process Token: SeDebugPrivilege 2700 pro0208.exe Token: SeDebugPrivilege 2464 qu0460.exe Token: SeDebugPrivilege 4964 si039038.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
1a80616070833b9cd693e6a98027eb55ce1747e74fb13d7c47bad59c850abf6c.exeun544531.exedescription pid process target process PID 2468 wrote to memory of 728 2468 1a80616070833b9cd693e6a98027eb55ce1747e74fb13d7c47bad59c850abf6c.exe un544531.exe PID 2468 wrote to memory of 728 2468 1a80616070833b9cd693e6a98027eb55ce1747e74fb13d7c47bad59c850abf6c.exe un544531.exe PID 2468 wrote to memory of 728 2468 1a80616070833b9cd693e6a98027eb55ce1747e74fb13d7c47bad59c850abf6c.exe un544531.exe PID 728 wrote to memory of 2700 728 un544531.exe pro0208.exe PID 728 wrote to memory of 2700 728 un544531.exe pro0208.exe PID 728 wrote to memory of 2700 728 un544531.exe pro0208.exe PID 728 wrote to memory of 2464 728 un544531.exe qu0460.exe PID 728 wrote to memory of 2464 728 un544531.exe qu0460.exe PID 728 wrote to memory of 2464 728 un544531.exe qu0460.exe PID 2468 wrote to memory of 4964 2468 1a80616070833b9cd693e6a98027eb55ce1747e74fb13d7c47bad59c850abf6c.exe si039038.exe PID 2468 wrote to memory of 4964 2468 1a80616070833b9cd693e6a98027eb55ce1747e74fb13d7c47bad59c850abf6c.exe si039038.exe PID 2468 wrote to memory of 4964 2468 1a80616070833b9cd693e6a98027eb55ce1747e74fb13d7c47bad59c850abf6c.exe si039038.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a80616070833b9cd693e6a98027eb55ce1747e74fb13d7c47bad59c850abf6c.exe"C:\Users\Admin\AppData\Local\Temp\1a80616070833b9cd693e6a98027eb55ce1747e74fb13d7c47bad59c850abf6c.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un544531.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un544531.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0208.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0208.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 10884⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0460.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0460.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 13404⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si039038.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si039038.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2700 -ip 27001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2464 -ip 24641⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si039038.exeFilesize
175KB
MD5e79aa0a014c97b0c1ed0a69bab710648
SHA1330ea2b2f0dcad3d93cc1a943f1b3090338c04ff
SHA25677ee850fc66a2fc7fc090b9848effd34be93752f8dc046ce7069a542babc422b
SHA512c5a63aa7af249b7d3602a9f47cdef6254831c65700a23799f4e7e0a1fb2bd132aeffac59197b23b6d371d59bedcb787188d364180edbf174bd995653bb21ffd0
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si039038.exeFilesize
175KB
MD5e79aa0a014c97b0c1ed0a69bab710648
SHA1330ea2b2f0dcad3d93cc1a943f1b3090338c04ff
SHA25677ee850fc66a2fc7fc090b9848effd34be93752f8dc046ce7069a542babc422b
SHA512c5a63aa7af249b7d3602a9f47cdef6254831c65700a23799f4e7e0a1fb2bd132aeffac59197b23b6d371d59bedcb787188d364180edbf174bd995653bb21ffd0
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un544531.exeFilesize
530KB
MD51e9fb892e8130f0b748009fd36c917cd
SHA1b5dfdd8ad94e669d41d92b71314f6e89cd04b0f7
SHA256ab41287c0210b8eb4534f378b18a96a4d4b290ac77f18e4e9e6a01178e47876e
SHA5126a10a25c09858cdf70e094b86994adaabbca5ca0c753ed9254395158bc93a91aba3e2ec1b8a20386e6073ca92ad3ba78a9fd1031af0991778880ad2bc2487f69
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un544531.exeFilesize
530KB
MD51e9fb892e8130f0b748009fd36c917cd
SHA1b5dfdd8ad94e669d41d92b71314f6e89cd04b0f7
SHA256ab41287c0210b8eb4534f378b18a96a4d4b290ac77f18e4e9e6a01178e47876e
SHA5126a10a25c09858cdf70e094b86994adaabbca5ca0c753ed9254395158bc93a91aba3e2ec1b8a20386e6073ca92ad3ba78a9fd1031af0991778880ad2bc2487f69
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0208.exeFilesize
259KB
MD5fce1c99d026aa80fc099875daf727fac
SHA13a2996653a81e3bd6d1bd91755bc41448415ef76
SHA256bf1c72954636a878eee25024ebc1e3026ed9155969e4f7359961d932fc1fabef
SHA5123dce0a08476a72489860a047ff4ecc5d1fdfe85eff0402df9a2eb4007f92068188c3372c4289c8625e258996c8ba79e20b400b9b65be7ea7fcb4509c7b1d4957
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0208.exeFilesize
259KB
MD5fce1c99d026aa80fc099875daf727fac
SHA13a2996653a81e3bd6d1bd91755bc41448415ef76
SHA256bf1c72954636a878eee25024ebc1e3026ed9155969e4f7359961d932fc1fabef
SHA5123dce0a08476a72489860a047ff4ecc5d1fdfe85eff0402df9a2eb4007f92068188c3372c4289c8625e258996c8ba79e20b400b9b65be7ea7fcb4509c7b1d4957
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0460.exeFilesize
318KB
MD5f5eb2d75282c40296a46ed10c93bddf8
SHA16151286fa47474694fb7739780d622907044a276
SHA256eba9dd850b4eaa11bdfc76531d28a8efb7fe8f4c8ea2a3b317b58790384bc8d2
SHA512acb1fa0dbbeead9761604585d366a3fb4e50fc19c663969b86f0fdc00e845a8eee59716826abadc9b4ace2bc105183acc71d9db0c1862a73038bef28d03ca2af
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0460.exeFilesize
318KB
MD5f5eb2d75282c40296a46ed10c93bddf8
SHA16151286fa47474694fb7739780d622907044a276
SHA256eba9dd850b4eaa11bdfc76531d28a8efb7fe8f4c8ea2a3b317b58790384bc8d2
SHA512acb1fa0dbbeead9761604585d366a3fb4e50fc19c663969b86f0fdc00e845a8eee59716826abadc9b4ace2bc105183acc71d9db0c1862a73038bef28d03ca2af
-
memory/2464-379-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/2464-1104-0x0000000004BB0000-0x0000000004BC2000-memory.dmpFilesize
72KB
-
memory/2464-1117-0x0000000006A70000-0x0000000006F9C000-memory.dmpFilesize
5.2MB
-
memory/2464-1116-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/2464-1115-0x00000000068A0000-0x0000000006A62000-memory.dmpFilesize
1.8MB
-
memory/2464-1114-0x00000000064E0000-0x0000000006530000-memory.dmpFilesize
320KB
-
memory/2464-1113-0x0000000006450000-0x00000000064C6000-memory.dmpFilesize
472KB
-
memory/2464-1112-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/2464-1111-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/2464-1110-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/2464-1109-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/2464-1108-0x0000000005BB0000-0x0000000005C42000-memory.dmpFilesize
584KB
-
memory/2464-1106-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/2464-1105-0x00000000058E0000-0x000000000591C000-memory.dmpFilesize
240KB
-
memory/2464-1103-0x00000000057D0000-0x00000000058DA000-memory.dmpFilesize
1.0MB
-
memory/2464-1102-0x00000000051B0000-0x00000000057C8000-memory.dmpFilesize
6.1MB
-
memory/2464-382-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/2464-378-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/2464-224-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/2464-222-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/2464-220-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/2464-218-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/2464-216-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/2464-192-0x0000000002010000-0x000000000205B000-memory.dmpFilesize
300KB
-
memory/2464-193-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/2464-194-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/2464-196-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/2464-198-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/2464-200-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/2464-202-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/2464-204-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/2464-206-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/2464-208-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/2464-210-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/2464-212-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/2464-214-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/2700-176-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/2700-162-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/2700-151-0x0000000004CC0000-0x0000000004CD0000-memory.dmpFilesize
64KB
-
memory/2700-184-0x0000000004CC0000-0x0000000004CD0000-memory.dmpFilesize
64KB
-
memory/2700-183-0x0000000004CC0000-0x0000000004CD0000-memory.dmpFilesize
64KB
-
memory/2700-182-0x0000000004CC0000-0x0000000004CD0000-memory.dmpFilesize
64KB
-
memory/2700-181-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/2700-150-0x0000000004CC0000-0x0000000004CD0000-memory.dmpFilesize
64KB
-
memory/2700-172-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/2700-178-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/2700-153-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/2700-180-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/2700-186-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/2700-174-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/2700-158-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/2700-166-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/2700-168-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/2700-164-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/2700-160-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/2700-152-0x0000000004CC0000-0x0000000004CD0000-memory.dmpFilesize
64KB
-
memory/2700-156-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/2700-170-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/2700-154-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/2700-149-0x0000000004CD0000-0x0000000005274000-memory.dmpFilesize
5.6MB
-
memory/2700-148-0x0000000000540000-0x000000000056D000-memory.dmpFilesize
180KB
-
memory/4964-1124-0x0000000000DC0000-0x0000000000DF2000-memory.dmpFilesize
200KB
-
memory/4964-1125-0x00000000059E0000-0x00000000059F0000-memory.dmpFilesize
64KB