Analysis
-
max time kernel
137s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 18:29
Static task
static1
Behavioral task
behavioral1
Sample
18ee352fbba1ede02fd1d0eb36990018dd93151f88566178c0dd158e8f0b76a1.exe
Resource
win10v2004-20230220-en
General
-
Target
18ee352fbba1ede02fd1d0eb36990018dd93151f88566178c0dd158e8f0b76a1.exe
-
Size
672KB
-
MD5
7d1b7f15ce2d611440b670d341736401
-
SHA1
c3ad773d77bfccbb590072506c4300549b8a398d
-
SHA256
18ee352fbba1ede02fd1d0eb36990018dd93151f88566178c0dd158e8f0b76a1
-
SHA512
0f1b281d14a1f998c91d31e4253b71dc8d790c3f675190f99fe835b67b994bfc50f6faa13e645df64479b03be462a0b8e8d5b9044aa44fb0edc14e986996e9f2
-
SSDEEP
12288:cMrty90SSv6j+ShgCBvbLmbg6l5upomXM+YAULRptLi7:JyLk6HhgUL/M5Ko+hg3Li7
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro0504.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro0504.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro0504.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro0504.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro0504.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro0504.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro0504.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/828-190-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/828-191-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/828-195-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/828-198-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/828-201-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/828-203-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/828-205-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/828-207-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/828-209-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/828-211-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/828-213-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/828-215-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/828-217-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/828-219-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/828-221-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/828-223-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/828-225-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/828-227-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/828-1108-0x0000000002550000-0x0000000002560000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un633139.exepro0504.exequ6289.exesi813192.exepid process 1284 un633139.exe 4384 pro0504.exe 828 qu6289.exe 3772 si813192.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro0504.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro0504.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro0504.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
18ee352fbba1ede02fd1d0eb36990018dd93151f88566178c0dd158e8f0b76a1.exeun633139.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 18ee352fbba1ede02fd1d0eb36990018dd93151f88566178c0dd158e8f0b76a1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 18ee352fbba1ede02fd1d0eb36990018dd93151f88566178c0dd158e8f0b76a1.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un633139.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un633139.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 2908 sc.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3340 4384 WerFault.exe pro0504.exe 392 828 WerFault.exe qu6289.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro0504.exequ6289.exesi813192.exepid process 4384 pro0504.exe 4384 pro0504.exe 828 qu6289.exe 828 qu6289.exe 3772 si813192.exe 3772 si813192.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro0504.exequ6289.exesi813192.exedescription pid process Token: SeDebugPrivilege 4384 pro0504.exe Token: SeDebugPrivilege 828 qu6289.exe Token: SeDebugPrivilege 3772 si813192.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
18ee352fbba1ede02fd1d0eb36990018dd93151f88566178c0dd158e8f0b76a1.exeun633139.exedescription pid process target process PID 1344 wrote to memory of 1284 1344 18ee352fbba1ede02fd1d0eb36990018dd93151f88566178c0dd158e8f0b76a1.exe un633139.exe PID 1344 wrote to memory of 1284 1344 18ee352fbba1ede02fd1d0eb36990018dd93151f88566178c0dd158e8f0b76a1.exe un633139.exe PID 1344 wrote to memory of 1284 1344 18ee352fbba1ede02fd1d0eb36990018dd93151f88566178c0dd158e8f0b76a1.exe un633139.exe PID 1284 wrote to memory of 4384 1284 un633139.exe pro0504.exe PID 1284 wrote to memory of 4384 1284 un633139.exe pro0504.exe PID 1284 wrote to memory of 4384 1284 un633139.exe pro0504.exe PID 1284 wrote to memory of 828 1284 un633139.exe qu6289.exe PID 1284 wrote to memory of 828 1284 un633139.exe qu6289.exe PID 1284 wrote to memory of 828 1284 un633139.exe qu6289.exe PID 1344 wrote to memory of 3772 1344 18ee352fbba1ede02fd1d0eb36990018dd93151f88566178c0dd158e8f0b76a1.exe si813192.exe PID 1344 wrote to memory of 3772 1344 18ee352fbba1ede02fd1d0eb36990018dd93151f88566178c0dd158e8f0b76a1.exe si813192.exe PID 1344 wrote to memory of 3772 1344 18ee352fbba1ede02fd1d0eb36990018dd93151f88566178c0dd158e8f0b76a1.exe si813192.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\18ee352fbba1ede02fd1d0eb36990018dd93151f88566178c0dd158e8f0b76a1.exe"C:\Users\Admin\AppData\Local\Temp\18ee352fbba1ede02fd1d0eb36990018dd93151f88566178c0dd158e8f0b76a1.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un633139.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un633139.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0504.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0504.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4384 -s 10844⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6289.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6289.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 13484⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si813192.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si813192.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4384 -ip 43841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 828 -ip 8281⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si813192.exeFilesize
175KB
MD50ed39baa94d4d4e8e3e2584a080590f9
SHA1f42f3fd85200449efbbb0e6d9059bfd42d9cfab4
SHA256de066b89f0c329b5e84fc4718a43fb88669df96bb8bf8bf720915fae87fd7119
SHA5123b7ce272a3cc10027dc88da275de85a47cba8cfd6e5b89b4f572484f5c62563b74a0bb96c6d0dbf93d51d3270a2e6e1486f72f3addedd626ca5c10ffcd47bde2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si813192.exeFilesize
175KB
MD50ed39baa94d4d4e8e3e2584a080590f9
SHA1f42f3fd85200449efbbb0e6d9059bfd42d9cfab4
SHA256de066b89f0c329b5e84fc4718a43fb88669df96bb8bf8bf720915fae87fd7119
SHA5123b7ce272a3cc10027dc88da275de85a47cba8cfd6e5b89b4f572484f5c62563b74a0bb96c6d0dbf93d51d3270a2e6e1486f72f3addedd626ca5c10ffcd47bde2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un633139.exeFilesize
530KB
MD52a96a0a1866002f8ba302f846116656e
SHA11f2133a4419df10cf5963f06ca542c4dbf62e91e
SHA2563d17e0525ed8a7c9e31609d86dc109affbd29d7586427039d0d0297de3a7627a
SHA51219245d96a5d07b91fd7ba00bd1ad8a2a3bc084453c9665f1b6f19fef420d70676b34528262984b5d5e84e0bdf9e913d90a3f625cebaacf72099b98eb3df8533e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un633139.exeFilesize
530KB
MD52a96a0a1866002f8ba302f846116656e
SHA11f2133a4419df10cf5963f06ca542c4dbf62e91e
SHA2563d17e0525ed8a7c9e31609d86dc109affbd29d7586427039d0d0297de3a7627a
SHA51219245d96a5d07b91fd7ba00bd1ad8a2a3bc084453c9665f1b6f19fef420d70676b34528262984b5d5e84e0bdf9e913d90a3f625cebaacf72099b98eb3df8533e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0504.exeFilesize
259KB
MD5b5526acabae8055288eb7d281252a02a
SHA1b6ce45119f93a76bc4794009f622bfc989ee9661
SHA25686aa6fcd1085d29bc22dbe1afecfaac2bf222a4698f598de57c04187e4d45c59
SHA5128485bdfb6d4de5b02f3746e2e2d3b865564a2e7b75ffa76cc4ef266d9d96d250e3cb943cc916a327e69f25639c0dd270d8266c8187c84c6dcf08ea117ecf766c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0504.exeFilesize
259KB
MD5b5526acabae8055288eb7d281252a02a
SHA1b6ce45119f93a76bc4794009f622bfc989ee9661
SHA25686aa6fcd1085d29bc22dbe1afecfaac2bf222a4698f598de57c04187e4d45c59
SHA5128485bdfb6d4de5b02f3746e2e2d3b865564a2e7b75ffa76cc4ef266d9d96d250e3cb943cc916a327e69f25639c0dd270d8266c8187c84c6dcf08ea117ecf766c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6289.exeFilesize
318KB
MD5ad4c2c3439e97bd172a8ae8c4d9cc80f
SHA1793d9701eb4d7b04feb5a849786f599d76647d2a
SHA256b4e99d90069d7349832fe6f957da8ae0f8b5762906733e855790d33140429ea3
SHA5125d56a657e1a2313460cfbd131f10b43fa92f8aea75711719d7a66a8854c9c6badd35ac92a9a8cca1919d77f94120d72f1e199a4ed36305dcbf307106968c7ed1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6289.exeFilesize
318KB
MD5ad4c2c3439e97bd172a8ae8c4d9cc80f
SHA1793d9701eb4d7b04feb5a849786f599d76647d2a
SHA256b4e99d90069d7349832fe6f957da8ae0f8b5762906733e855790d33140429ea3
SHA5125d56a657e1a2313460cfbd131f10b43fa92f8aea75711719d7a66a8854c9c6badd35ac92a9a8cca1919d77f94120d72f1e199a4ed36305dcbf307106968c7ed1
-
memory/828-1102-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/828-1101-0x00000000058C0000-0x00000000059CA000-memory.dmpFilesize
1.0MB
-
memory/828-219-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/828-217-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/828-201-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/828-203-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/828-1115-0x0000000002550000-0x0000000002560000-memory.dmpFilesize
64KB
-
memory/828-1114-0x0000000006E80000-0x0000000006ED0000-memory.dmpFilesize
320KB
-
memory/828-1113-0x0000000006DF0000-0x0000000006E66000-memory.dmpFilesize
472KB
-
memory/828-1112-0x0000000006690000-0x0000000006BBC000-memory.dmpFilesize
5.2MB
-
memory/828-205-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/828-1111-0x00000000064B0000-0x0000000006672000-memory.dmpFilesize
1.8MB
-
memory/828-1110-0x0000000002550000-0x0000000002560000-memory.dmpFilesize
64KB
-
memory/828-1109-0x0000000002550000-0x0000000002560000-memory.dmpFilesize
64KB
-
memory/828-1108-0x0000000002550000-0x0000000002560000-memory.dmpFilesize
64KB
-
memory/828-1107-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/828-1106-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/828-1104-0x0000000002550000-0x0000000002560000-memory.dmpFilesize
64KB
-
memory/828-1103-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/828-221-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/828-1100-0x00000000052A0000-0x00000000058B8000-memory.dmpFilesize
6.1MB
-
memory/828-227-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/828-190-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/828-191-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/828-193-0x0000000002140000-0x000000000218B000-memory.dmpFilesize
300KB
-
memory/828-194-0x0000000002550000-0x0000000002560000-memory.dmpFilesize
64KB
-
memory/828-195-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/828-196-0x0000000002550000-0x0000000002560000-memory.dmpFilesize
64KB
-
memory/828-198-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/828-199-0x0000000002550000-0x0000000002560000-memory.dmpFilesize
64KB
-
memory/828-215-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/828-225-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/828-223-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/828-207-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/828-209-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/828-211-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/828-213-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/3772-1121-0x0000000000C70000-0x0000000000CA2000-memory.dmpFilesize
200KB
-
memory/3772-1122-0x0000000005510000-0x0000000005520000-memory.dmpFilesize
64KB
-
memory/3772-1123-0x0000000005510000-0x0000000005520000-memory.dmpFilesize
64KB
-
memory/4384-181-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/4384-167-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/4384-149-0x0000000004B90000-0x0000000005134000-memory.dmpFilesize
5.6MB
-
memory/4384-151-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/4384-153-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/4384-185-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/4384-150-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/4384-184-0x0000000004B80000-0x0000000004B90000-memory.dmpFilesize
64KB
-
memory/4384-183-0x0000000004B80000-0x0000000004B90000-memory.dmpFilesize
64KB
-
memory/4384-155-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/4384-180-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/4384-178-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/4384-176-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/4384-174-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/4384-172-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/4384-168-0x0000000004B80000-0x0000000004B90000-memory.dmpFilesize
64KB
-
memory/4384-170-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/4384-163-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/4384-164-0x0000000004B80000-0x0000000004B90000-memory.dmpFilesize
64KB
-
memory/4384-165-0x0000000004B80000-0x0000000004B90000-memory.dmpFilesize
64KB
-
memory/4384-148-0x00000000005D0000-0x00000000005FD000-memory.dmpFilesize
180KB
-
memory/4384-161-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/4384-159-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/4384-157-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB