Analysis
-
max time kernel
135s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 18:35
Static task
static1
Behavioral task
behavioral1
Sample
2235c9574f3dcad27f1a76cfdd14f7e7e83b31dd880ea0fef36fa034c7360936.exe
Resource
win10v2004-20230220-en
General
-
Target
2235c9574f3dcad27f1a76cfdd14f7e7e83b31dd880ea0fef36fa034c7360936.exe
-
Size
673KB
-
MD5
487b9988714dba1390b206084c6dfb5e
-
SHA1
77f858f049835dbeed2c11f0b7764fe65c1efe0a
-
SHA256
2235c9574f3dcad27f1a76cfdd14f7e7e83b31dd880ea0fef36fa034c7360936
-
SHA512
aea324c07dca4d39bbd463af789696439fbc4dad5c10e3a3df7086bd838d3ed80a0bf607a49e97c53ad9a68d6b9459f00c2983a74d044496fb78a4f416f41a8e
-
SSDEEP
12288:UMrQy90PmiUyu9qWXYehaGmCFIsmkeH8gsomVX+YpvhapZl0Nf+s2l:Eyo4yuX7hae88gsoBaYfl0Nf9M
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro2098.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro2098.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro2098.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro2098.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro2098.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro2098.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro2098.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/4960-191-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/4960-192-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/4960-194-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/4960-196-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/4960-198-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/4960-200-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/4960-202-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/4960-204-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/4960-206-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/4960-208-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/4960-210-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/4960-212-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/4960-214-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/4960-216-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/4960-218-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/4960-221-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/4960-223-0x0000000004AF0000-0x0000000004B00000-memory.dmp family_redline behavioral1/memory/4960-225-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/4960-228-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un984302.exepro2098.exequ9369.exesi900829.exepid process 392 un984302.exe 4668 pro2098.exe 4960 qu9369.exe 4624 si900829.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro2098.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro2098.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro2098.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
2235c9574f3dcad27f1a76cfdd14f7e7e83b31dd880ea0fef36fa034c7360936.exeun984302.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 2235c9574f3dcad27f1a76cfdd14f7e7e83b31dd880ea0fef36fa034c7360936.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 2235c9574f3dcad27f1a76cfdd14f7e7e83b31dd880ea0fef36fa034c7360936.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un984302.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un984302.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4752 4668 WerFault.exe pro2098.exe 2724 4960 WerFault.exe qu9369.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro2098.exequ9369.exesi900829.exepid process 4668 pro2098.exe 4668 pro2098.exe 4960 qu9369.exe 4960 qu9369.exe 4624 si900829.exe 4624 si900829.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro2098.exequ9369.exesi900829.exedescription pid process Token: SeDebugPrivilege 4668 pro2098.exe Token: SeDebugPrivilege 4960 qu9369.exe Token: SeDebugPrivilege 4624 si900829.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
2235c9574f3dcad27f1a76cfdd14f7e7e83b31dd880ea0fef36fa034c7360936.exeun984302.exedescription pid process target process PID 4628 wrote to memory of 392 4628 2235c9574f3dcad27f1a76cfdd14f7e7e83b31dd880ea0fef36fa034c7360936.exe un984302.exe PID 4628 wrote to memory of 392 4628 2235c9574f3dcad27f1a76cfdd14f7e7e83b31dd880ea0fef36fa034c7360936.exe un984302.exe PID 4628 wrote to memory of 392 4628 2235c9574f3dcad27f1a76cfdd14f7e7e83b31dd880ea0fef36fa034c7360936.exe un984302.exe PID 392 wrote to memory of 4668 392 un984302.exe pro2098.exe PID 392 wrote to memory of 4668 392 un984302.exe pro2098.exe PID 392 wrote to memory of 4668 392 un984302.exe pro2098.exe PID 392 wrote to memory of 4960 392 un984302.exe qu9369.exe PID 392 wrote to memory of 4960 392 un984302.exe qu9369.exe PID 392 wrote to memory of 4960 392 un984302.exe qu9369.exe PID 4628 wrote to memory of 4624 4628 2235c9574f3dcad27f1a76cfdd14f7e7e83b31dd880ea0fef36fa034c7360936.exe si900829.exe PID 4628 wrote to memory of 4624 4628 2235c9574f3dcad27f1a76cfdd14f7e7e83b31dd880ea0fef36fa034c7360936.exe si900829.exe PID 4628 wrote to memory of 4624 4628 2235c9574f3dcad27f1a76cfdd14f7e7e83b31dd880ea0fef36fa034c7360936.exe si900829.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2235c9574f3dcad27f1a76cfdd14f7e7e83b31dd880ea0fef36fa034c7360936.exe"C:\Users\Admin\AppData\Local\Temp\2235c9574f3dcad27f1a76cfdd14f7e7e83b31dd880ea0fef36fa034c7360936.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un984302.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un984302.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2098.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2098.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4668 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 10884⤵
- Program crash
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9369.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9369.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4960 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 13324⤵
- Program crash
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si900829.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si900829.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4624
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4668 -ip 46681⤵PID:1636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4960 -ip 49601⤵PID:4368
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si900829.exeFilesize
175KB
MD558980b27daad1a657354eff6201ec6c4
SHA168c5251a12d426129c40929fcee674526321202a
SHA256ab966e618a09ed3df5626addcc41ee7d3229967c37856d37cd2a63ec775e884e
SHA5129f99cc6ddc66698e1f0c95d6c92dede2c0c65c8f10cd8a8cc0782ea22e81610a108e2e6d0293d0448728938e8aa0107b77818a5116acc72df4f2efd8d336f6e9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si900829.exeFilesize
175KB
MD558980b27daad1a657354eff6201ec6c4
SHA168c5251a12d426129c40929fcee674526321202a
SHA256ab966e618a09ed3df5626addcc41ee7d3229967c37856d37cd2a63ec775e884e
SHA5129f99cc6ddc66698e1f0c95d6c92dede2c0c65c8f10cd8a8cc0782ea22e81610a108e2e6d0293d0448728938e8aa0107b77818a5116acc72df4f2efd8d336f6e9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un984302.exeFilesize
531KB
MD52a2414ef80026f6dd2732a3f9b5cdabb
SHA173445b564c43fc73b8faa1b0f3f2e1fd91955751
SHA256ae6949d43df36b17bf1a0b2fa9eb410ccb0ffb46d1b2b43599e69841865be161
SHA512da8a842c98e3cc1c77a58433f5b741b630a076317e87a23d54b05d66d666bfecb6ace1c6bf37160c3be86e90fe32062f2118779e956c1e02bc1df6485a0c95b5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un984302.exeFilesize
531KB
MD52a2414ef80026f6dd2732a3f9b5cdabb
SHA173445b564c43fc73b8faa1b0f3f2e1fd91955751
SHA256ae6949d43df36b17bf1a0b2fa9eb410ccb0ffb46d1b2b43599e69841865be161
SHA512da8a842c98e3cc1c77a58433f5b741b630a076317e87a23d54b05d66d666bfecb6ace1c6bf37160c3be86e90fe32062f2118779e956c1e02bc1df6485a0c95b5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2098.exeFilesize
259KB
MD54dcbefff081530bef32f4c0f1bc85606
SHA11620be3f762d5674d3716f5ca8e4b82e3a1be99a
SHA2564dc7a3a36b8a70f4a70432cdee216ecd88e2a9fd80ad08344fca985e949f3fe2
SHA51248081d2287df6c0a30f536b8c43d6d7f4fcfd6e4ce3729271559ff6ab8cf470894497c9091cb3a3204e4bfcbd41ecc729078cccd68b96e78e4eb884b47bd4e46
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2098.exeFilesize
259KB
MD54dcbefff081530bef32f4c0f1bc85606
SHA11620be3f762d5674d3716f5ca8e4b82e3a1be99a
SHA2564dc7a3a36b8a70f4a70432cdee216ecd88e2a9fd80ad08344fca985e949f3fe2
SHA51248081d2287df6c0a30f536b8c43d6d7f4fcfd6e4ce3729271559ff6ab8cf470894497c9091cb3a3204e4bfcbd41ecc729078cccd68b96e78e4eb884b47bd4e46
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9369.exeFilesize
318KB
MD53376392d6aff1e221417b7aab6196a69
SHA1598bcb542410a4439872558c0e00e26544bf4e69
SHA2567b94916be650bc63b670cbead5b6cb50db5b7d9bec6c5cc07405c630d01675fe
SHA5121e9a2c94ff0b44e50897ef074eec6952c03c1020749f9c447ea05a65dd46acc7da521dd7fede2797c343ee3aa39fdc3ee60462ccf806060fd3f552f6f2ffe041
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9369.exeFilesize
318KB
MD53376392d6aff1e221417b7aab6196a69
SHA1598bcb542410a4439872558c0e00e26544bf4e69
SHA2567b94916be650bc63b670cbead5b6cb50db5b7d9bec6c5cc07405c630d01675fe
SHA5121e9a2c94ff0b44e50897ef074eec6952c03c1020749f9c447ea05a65dd46acc7da521dd7fede2797c343ee3aa39fdc3ee60462ccf806060fd3f552f6f2ffe041
-
memory/4624-1122-0x0000000000220000-0x0000000000252000-memory.dmpFilesize
200KB
-
memory/4624-1123-0x0000000004E30000-0x0000000004E40000-memory.dmpFilesize
64KB
-
memory/4668-158-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/4668-172-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/4668-151-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/4668-152-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/4668-154-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/4668-156-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/4668-149-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/4668-160-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/4668-162-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/4668-164-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/4668-166-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/4668-168-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/4668-170-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/4668-150-0x0000000004BE0000-0x0000000005184000-memory.dmpFilesize
5.6MB
-
memory/4668-174-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/4668-176-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/4668-178-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/4668-179-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/4668-180-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/4668-181-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/4668-182-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/4668-184-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/4668-185-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/4668-186-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/4668-148-0x0000000000590000-0x00000000005BD000-memory.dmpFilesize
180KB
-
memory/4960-194-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/4960-224-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/4960-196-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/4960-198-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/4960-200-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/4960-202-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/4960-204-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/4960-206-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/4960-208-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/4960-210-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/4960-212-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/4960-214-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/4960-216-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/4960-218-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/4960-220-0x0000000000610000-0x000000000065B000-memory.dmpFilesize
300KB
-
memory/4960-221-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/4960-223-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/4960-226-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/4960-225-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/4960-192-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/4960-228-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/4960-1101-0x0000000005200000-0x0000000005818000-memory.dmpFilesize
6.1MB
-
memory/4960-1102-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/4960-1103-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/4960-1104-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/4960-1105-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/4960-1106-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/4960-1107-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/4960-1109-0x00000000064B0000-0x0000000006672000-memory.dmpFilesize
1.8MB
-
memory/4960-1110-0x0000000006680000-0x0000000006BAC000-memory.dmpFilesize
5.2MB
-
memory/4960-1111-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/4960-1112-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/4960-1113-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/4960-191-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/4960-1114-0x0000000006CE0000-0x0000000006D56000-memory.dmpFilesize
472KB
-
memory/4960-1115-0x0000000006D70000-0x0000000006DC0000-memory.dmpFilesize
320KB
-
memory/4960-1116-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB