Analysis
-
max time kernel
95s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 18:36
Static task
static1
Behavioral task
behavioral1
Sample
531a8b4448ca3824c5913a1fe8a1340cbf289901db709d70558354305956b521.exe
Resource
win10v2004-20230220-en
General
-
Target
531a8b4448ca3824c5913a1fe8a1340cbf289901db709d70558354305956b521.exe
-
Size
672KB
-
MD5
f6985c7fec6751719c74295d49dbad7a
-
SHA1
5029b02d97220a9ec6d8d36e198ee6d52abd077d
-
SHA256
531a8b4448ca3824c5913a1fe8a1340cbf289901db709d70558354305956b521
-
SHA512
40d8104b83fca13b8af26698b749d92669855fc24cb9339cd85d1ee8105e56fc06bef8e3321b85f4a677bd2a5de5cd1337d313d94dc5a1df0586d30913c47378
-
SSDEEP
12288:EMrQy90pqwK0RHu82+Q4a7TBLuVtZPgBl3RmomAE+YO+Chp5oe7xtW:kyqDROFVBObgQoFlnnxU
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro6667.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro6667.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro6667.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro6667.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro6667.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro6667.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro6667.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/4656-192-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4656-193-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4656-195-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4656-197-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4656-199-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4656-201-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4656-203-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4656-205-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4656-207-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4656-209-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4656-211-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4656-213-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4656-215-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4656-217-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4656-219-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4656-221-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4656-223-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4656-225-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4656-394-0x0000000004B30000-0x0000000004B40000-memory.dmp family_redline behavioral1/memory/4656-395-0x0000000004B30000-0x0000000004B40000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un825740.exepro6667.exequ4931.exesi737773.exepid process 1656 un825740.exe 844 pro6667.exe 4656 qu4931.exe 3080 si737773.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro6667.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro6667.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro6667.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un825740.exe531a8b4448ca3824c5913a1fe8a1340cbf289901db709d70558354305956b521.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un825740.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 531a8b4448ca3824c5913a1fe8a1340cbf289901db709d70558354305956b521.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 531a8b4448ca3824c5913a1fe8a1340cbf289901db709d70558354305956b521.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un825740.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4956 844 WerFault.exe pro6667.exe 2316 4656 WerFault.exe qu4931.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro6667.exequ4931.exesi737773.exepid process 844 pro6667.exe 844 pro6667.exe 4656 qu4931.exe 4656 qu4931.exe 3080 si737773.exe 3080 si737773.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro6667.exequ4931.exesi737773.exedescription pid process Token: SeDebugPrivilege 844 pro6667.exe Token: SeDebugPrivilege 4656 qu4931.exe Token: SeDebugPrivilege 3080 si737773.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
531a8b4448ca3824c5913a1fe8a1340cbf289901db709d70558354305956b521.exeun825740.exedescription pid process target process PID 3600 wrote to memory of 1656 3600 531a8b4448ca3824c5913a1fe8a1340cbf289901db709d70558354305956b521.exe un825740.exe PID 3600 wrote to memory of 1656 3600 531a8b4448ca3824c5913a1fe8a1340cbf289901db709d70558354305956b521.exe un825740.exe PID 3600 wrote to memory of 1656 3600 531a8b4448ca3824c5913a1fe8a1340cbf289901db709d70558354305956b521.exe un825740.exe PID 1656 wrote to memory of 844 1656 un825740.exe pro6667.exe PID 1656 wrote to memory of 844 1656 un825740.exe pro6667.exe PID 1656 wrote to memory of 844 1656 un825740.exe pro6667.exe PID 1656 wrote to memory of 4656 1656 un825740.exe qu4931.exe PID 1656 wrote to memory of 4656 1656 un825740.exe qu4931.exe PID 1656 wrote to memory of 4656 1656 un825740.exe qu4931.exe PID 3600 wrote to memory of 3080 3600 531a8b4448ca3824c5913a1fe8a1340cbf289901db709d70558354305956b521.exe si737773.exe PID 3600 wrote to memory of 3080 3600 531a8b4448ca3824c5913a1fe8a1340cbf289901db709d70558354305956b521.exe si737773.exe PID 3600 wrote to memory of 3080 3600 531a8b4448ca3824c5913a1fe8a1340cbf289901db709d70558354305956b521.exe si737773.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\531a8b4448ca3824c5913a1fe8a1340cbf289901db709d70558354305956b521.exe"C:\Users\Admin\AppData\Local\Temp\531a8b4448ca3824c5913a1fe8a1340cbf289901db709d70558354305956b521.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un825740.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un825740.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6667.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6667.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 844 -s 10884⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4931.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4931.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 13484⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si737773.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si737773.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 844 -ip 8441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4656 -ip 46561⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si737773.exeFilesize
175KB
MD5a56ec82cbe4f215e9a745a42ca6403f0
SHA1e29751624749e95f6b5a64e34ece93c3c325e049
SHA2562b0a7a4f825d865604d072647909afd437c3a1481ce5fd838eb5c752ef9b31ab
SHA512326c57472a36986ceccedea335ec2ebd5f39e83bc488301dc4f090357ff48a62e5c1a5cb9d2c00ef0259d283d49b53ad14dd70a09b137ecf2886e1e7c92ff51c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si737773.exeFilesize
175KB
MD5a56ec82cbe4f215e9a745a42ca6403f0
SHA1e29751624749e95f6b5a64e34ece93c3c325e049
SHA2562b0a7a4f825d865604d072647909afd437c3a1481ce5fd838eb5c752ef9b31ab
SHA512326c57472a36986ceccedea335ec2ebd5f39e83bc488301dc4f090357ff48a62e5c1a5cb9d2c00ef0259d283d49b53ad14dd70a09b137ecf2886e1e7c92ff51c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un825740.exeFilesize
530KB
MD58f70f3df55e21f944b1205e7715ac148
SHA1965aed2b547889550424ed7df37a16dbfed25a0d
SHA2564a0bf17f4cf80368990be0d6c8f041aef96e20238a81af18ddcdfc98dde91d62
SHA5129481547b6b100a16ad30a28e1724080396ec72bd5d1dfb1d783efc3cf99b4f95c007e6a9a73d23a232a936a5bedffe8df9c0416e6370f06291b94ca00cb62c7f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un825740.exeFilesize
530KB
MD58f70f3df55e21f944b1205e7715ac148
SHA1965aed2b547889550424ed7df37a16dbfed25a0d
SHA2564a0bf17f4cf80368990be0d6c8f041aef96e20238a81af18ddcdfc98dde91d62
SHA5129481547b6b100a16ad30a28e1724080396ec72bd5d1dfb1d783efc3cf99b4f95c007e6a9a73d23a232a936a5bedffe8df9c0416e6370f06291b94ca00cb62c7f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6667.exeFilesize
259KB
MD5b57a63fa9bfa839ffc8b542cba0ce6d4
SHA115bb5cf410ddbebb0b3fcf2217d3da02e3d8e5ea
SHA256f13f7e01d009fec74953eeedd218cf1f97bc40c1302ddc085ab99619d693a730
SHA51288c2a04880682cbb2b4606a1080ea2b78e454e1013870b8147cf137cc4c5f6fc9fd6855d59b12d07464d8a418174b8c775672b6937116fbfb1722dde4621d6da
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6667.exeFilesize
259KB
MD5b57a63fa9bfa839ffc8b542cba0ce6d4
SHA115bb5cf410ddbebb0b3fcf2217d3da02e3d8e5ea
SHA256f13f7e01d009fec74953eeedd218cf1f97bc40c1302ddc085ab99619d693a730
SHA51288c2a04880682cbb2b4606a1080ea2b78e454e1013870b8147cf137cc4c5f6fc9fd6855d59b12d07464d8a418174b8c775672b6937116fbfb1722dde4621d6da
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4931.exeFilesize
318KB
MD5bf8e7915941c8b5b65fe252e4c372b66
SHA17e53cfbb76859a31e99696d8dd61d90479d1dc58
SHA2566a7d42ac356832461f2a69df7a52bf1cd774a864b58001a6d7b18a791679ace1
SHA5127ca8a182f747a5d6338f6373b894406bacbf3d646a4a183904fed4d56a1d242484bbe406731bdc301ecf8fdd6258cfcc37a09c0ce67f062fa7884f651810b75a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4931.exeFilesize
318KB
MD5bf8e7915941c8b5b65fe252e4c372b66
SHA17e53cfbb76859a31e99696d8dd61d90479d1dc58
SHA2566a7d42ac356832461f2a69df7a52bf1cd774a864b58001a6d7b18a791679ace1
SHA5127ca8a182f747a5d6338f6373b894406bacbf3d646a4a183904fed4d56a1d242484bbe406731bdc301ecf8fdd6258cfcc37a09c0ce67f062fa7884f651810b75a
-
memory/844-148-0x0000000000750000-0x000000000077D000-memory.dmpFilesize
180KB
-
memory/844-149-0x0000000004C40000-0x0000000004C50000-memory.dmpFilesize
64KB
-
memory/844-150-0x0000000004C50000-0x00000000051F4000-memory.dmpFilesize
5.6MB
-
memory/844-151-0x00000000023F0000-0x0000000002402000-memory.dmpFilesize
72KB
-
memory/844-154-0x00000000023F0000-0x0000000002402000-memory.dmpFilesize
72KB
-
memory/844-156-0x00000000023F0000-0x0000000002402000-memory.dmpFilesize
72KB
-
memory/844-158-0x0000000004C40000-0x0000000004C50000-memory.dmpFilesize
64KB
-
memory/844-152-0x00000000023F0000-0x0000000002402000-memory.dmpFilesize
72KB
-
memory/844-160-0x0000000004C40000-0x0000000004C50000-memory.dmpFilesize
64KB
-
memory/844-159-0x00000000023F0000-0x0000000002402000-memory.dmpFilesize
72KB
-
memory/844-162-0x00000000023F0000-0x0000000002402000-memory.dmpFilesize
72KB
-
memory/844-164-0x00000000023F0000-0x0000000002402000-memory.dmpFilesize
72KB
-
memory/844-166-0x00000000023F0000-0x0000000002402000-memory.dmpFilesize
72KB
-
memory/844-168-0x00000000023F0000-0x0000000002402000-memory.dmpFilesize
72KB
-
memory/844-170-0x00000000023F0000-0x0000000002402000-memory.dmpFilesize
72KB
-
memory/844-172-0x00000000023F0000-0x0000000002402000-memory.dmpFilesize
72KB
-
memory/844-174-0x00000000023F0000-0x0000000002402000-memory.dmpFilesize
72KB
-
memory/844-176-0x00000000023F0000-0x0000000002402000-memory.dmpFilesize
72KB
-
memory/844-178-0x00000000023F0000-0x0000000002402000-memory.dmpFilesize
72KB
-
memory/844-180-0x00000000023F0000-0x0000000002402000-memory.dmpFilesize
72KB
-
memory/844-181-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/844-182-0x0000000004C40000-0x0000000004C50000-memory.dmpFilesize
64KB
-
memory/844-183-0x0000000004C40000-0x0000000004C50000-memory.dmpFilesize
64KB
-
memory/844-184-0x0000000004C40000-0x0000000004C50000-memory.dmpFilesize
64KB
-
memory/844-186-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/3080-1122-0x0000000000030000-0x0000000000062000-memory.dmpFilesize
200KB
-
memory/3080-1123-0x0000000004C60000-0x0000000004C70000-memory.dmpFilesize
64KB
-
memory/4656-193-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/4656-392-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/4656-195-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/4656-197-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/4656-199-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/4656-201-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/4656-203-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/4656-205-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/4656-207-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/4656-209-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/4656-211-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/4656-213-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/4656-215-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/4656-217-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/4656-219-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/4656-221-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/4656-223-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/4656-225-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/4656-394-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/4656-192-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/4656-395-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/4656-1101-0x00000000050F0000-0x0000000005708000-memory.dmpFilesize
6.1MB
-
memory/4656-1102-0x0000000005760000-0x000000000586A000-memory.dmpFilesize
1.0MB
-
memory/4656-1103-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/4656-1104-0x00000000058C0000-0x00000000058FC000-memory.dmpFilesize
240KB
-
memory/4656-1105-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/4656-1107-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/4656-1108-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/4656-1109-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/4656-1110-0x0000000005BB0000-0x0000000005C42000-memory.dmpFilesize
584KB
-
memory/4656-1111-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/4656-1112-0x0000000006370000-0x00000000063E6000-memory.dmpFilesize
472KB
-
memory/4656-1113-0x0000000006400000-0x0000000006450000-memory.dmpFilesize
320KB
-
memory/4656-191-0x0000000000730000-0x000000000077B000-memory.dmpFilesize
300KB
-
memory/4656-1114-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/4656-1115-0x0000000006590000-0x0000000006752000-memory.dmpFilesize
1.8MB
-
memory/4656-1116-0x0000000006960000-0x0000000006E8C000-memory.dmpFilesize
5.2MB