Analysis
-
max time kernel
55s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
31-03-2023 18:07
Static task
static1
Behavioral task
behavioral1
Sample
2a6445d6c02c11bca161d22963feeabc93f73dd5e5b13c339456e8a838abfd90.exe
Resource
win10-20230220-en
General
-
Target
2a6445d6c02c11bca161d22963feeabc93f73dd5e5b13c339456e8a838abfd90.exe
-
Size
672KB
-
MD5
87b33007fa0a318368d35933cd8e9225
-
SHA1
3fe3bf78c10c4ab82eee2f527003c86253293641
-
SHA256
2a6445d6c02c11bca161d22963feeabc93f73dd5e5b13c339456e8a838abfd90
-
SHA512
68aa360f2257b2b9b487d95565fa4ca7afb5d4ce6f1bec9ea1523aa986500da8b34630b6fe5dbc5193b07aa68531057c420174aedaf07a923a980fb59a0a9fc7
-
SSDEEP
12288:zMr6y90ydkupYPS3Bx6VRXDIwqLVrFyomHZ+YD524pMzPpzd6:NyDbvytjqLRkoR+vqzPpd6
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro4825.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro4825.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro4825.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro4825.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro4825.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro4825.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/4408-179-0x00000000025C0000-0x0000000002606000-memory.dmp family_redline behavioral1/memory/4408-180-0x0000000004AB0000-0x0000000004AF4000-memory.dmp family_redline behavioral1/memory/4408-181-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/4408-182-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/4408-184-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/4408-186-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/4408-188-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/4408-190-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/4408-192-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/4408-194-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/4408-196-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/4408-198-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/4408-200-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/4408-202-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/4408-204-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/4408-208-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/4408-206-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/4408-210-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/4408-212-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/4408-214-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/4408-1099-0x0000000004C70000-0x0000000004C80000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un759528.exepro4825.exequ8907.exesi149386.exepid process 384 un759528.exe 4504 pro4825.exe 4408 qu8907.exe 4804 si149386.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro4825.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro4825.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro4825.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
2a6445d6c02c11bca161d22963feeabc93f73dd5e5b13c339456e8a838abfd90.exeun759528.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 2a6445d6c02c11bca161d22963feeabc93f73dd5e5b13c339456e8a838abfd90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 2a6445d6c02c11bca161d22963feeabc93f73dd5e5b13c339456e8a838abfd90.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un759528.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un759528.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro4825.exequ8907.exesi149386.exepid process 4504 pro4825.exe 4504 pro4825.exe 4408 qu8907.exe 4408 qu8907.exe 4804 si149386.exe 4804 si149386.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro4825.exequ8907.exesi149386.exedescription pid process Token: SeDebugPrivilege 4504 pro4825.exe Token: SeDebugPrivilege 4408 qu8907.exe Token: SeDebugPrivilege 4804 si149386.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
2a6445d6c02c11bca161d22963feeabc93f73dd5e5b13c339456e8a838abfd90.exeun759528.exedescription pid process target process PID 4108 wrote to memory of 384 4108 2a6445d6c02c11bca161d22963feeabc93f73dd5e5b13c339456e8a838abfd90.exe un759528.exe PID 4108 wrote to memory of 384 4108 2a6445d6c02c11bca161d22963feeabc93f73dd5e5b13c339456e8a838abfd90.exe un759528.exe PID 4108 wrote to memory of 384 4108 2a6445d6c02c11bca161d22963feeabc93f73dd5e5b13c339456e8a838abfd90.exe un759528.exe PID 384 wrote to memory of 4504 384 un759528.exe pro4825.exe PID 384 wrote to memory of 4504 384 un759528.exe pro4825.exe PID 384 wrote to memory of 4504 384 un759528.exe pro4825.exe PID 384 wrote to memory of 4408 384 un759528.exe qu8907.exe PID 384 wrote to memory of 4408 384 un759528.exe qu8907.exe PID 384 wrote to memory of 4408 384 un759528.exe qu8907.exe PID 4108 wrote to memory of 4804 4108 2a6445d6c02c11bca161d22963feeabc93f73dd5e5b13c339456e8a838abfd90.exe si149386.exe PID 4108 wrote to memory of 4804 4108 2a6445d6c02c11bca161d22963feeabc93f73dd5e5b13c339456e8a838abfd90.exe si149386.exe PID 4108 wrote to memory of 4804 4108 2a6445d6c02c11bca161d22963feeabc93f73dd5e5b13c339456e8a838abfd90.exe si149386.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a6445d6c02c11bca161d22963feeabc93f73dd5e5b13c339456e8a838abfd90.exe"C:\Users\Admin\AppData\Local\Temp\2a6445d6c02c11bca161d22963feeabc93f73dd5e5b13c339456e8a838abfd90.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un759528.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un759528.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4825.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4825.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8907.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8907.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si149386.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si149386.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4804
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si149386.exeFilesize
175KB
MD56994a95f2b4f5a115560bf23a1c477de
SHA12f296e2551c8362aff2b9c2f26b9737b3de37e0e
SHA2568cfb35d4cc565d57ba573910a59710058122eab4aa53d02d2b30201963d73975
SHA512b6572363f322219e46a513337e36085d248ee599165fe383b8bbfd24a7b7e51b9d8dbcec6a1a20de9c903ee5dbe1b1bab5523f264a5f731c4e104e5bf643f3ef
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si149386.exeFilesize
175KB
MD56994a95f2b4f5a115560bf23a1c477de
SHA12f296e2551c8362aff2b9c2f26b9737b3de37e0e
SHA2568cfb35d4cc565d57ba573910a59710058122eab4aa53d02d2b30201963d73975
SHA512b6572363f322219e46a513337e36085d248ee599165fe383b8bbfd24a7b7e51b9d8dbcec6a1a20de9c903ee5dbe1b1bab5523f264a5f731c4e104e5bf643f3ef
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un759528.exeFilesize
530KB
MD597d7713f493dbe9ea595e48fa294ab44
SHA10f135807cee2c282417ee07827b55eb6b6d74bd3
SHA256fd1e169ed879953532411d94c4f1288c4ff0a065a93e784760c4d542739b4bc7
SHA51223b92c2329f1449c7702633b08696b6e472bf39f13a9d56d1682fe629935d5e7ac3c774cc7f5567a7c780714dbed3216e113b9749152e4079fb37a2401359fd4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un759528.exeFilesize
530KB
MD597d7713f493dbe9ea595e48fa294ab44
SHA10f135807cee2c282417ee07827b55eb6b6d74bd3
SHA256fd1e169ed879953532411d94c4f1288c4ff0a065a93e784760c4d542739b4bc7
SHA51223b92c2329f1449c7702633b08696b6e472bf39f13a9d56d1682fe629935d5e7ac3c774cc7f5567a7c780714dbed3216e113b9749152e4079fb37a2401359fd4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4825.exeFilesize
259KB
MD56f7471fe16ca09e2cbd1d8594aa0e1ba
SHA1e78e8aa6e2679a695ba70ea0aeb6e1a071079178
SHA256c8dc8645af2403ca274ab96ad72c3389e6db2a0b6fbd3618c4f90a0688adf513
SHA51248c847fc3d269909fa8d39f9aead820713332edf3722ba46fa4bc41d602ef99e6597760e319de568b16395b9c0432aa67b7eb5a78aaa9ced07c9dff7b9da4ac9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4825.exeFilesize
259KB
MD56f7471fe16ca09e2cbd1d8594aa0e1ba
SHA1e78e8aa6e2679a695ba70ea0aeb6e1a071079178
SHA256c8dc8645af2403ca274ab96ad72c3389e6db2a0b6fbd3618c4f90a0688adf513
SHA51248c847fc3d269909fa8d39f9aead820713332edf3722ba46fa4bc41d602ef99e6597760e319de568b16395b9c0432aa67b7eb5a78aaa9ced07c9dff7b9da4ac9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8907.exeFilesize
318KB
MD504ec591cd16cab613600d42bb53ce57c
SHA19c8c775b38516452fb916679248477979cba5a63
SHA256e849b928aa41f4f2a70edb37fdfd85a08ddb08e6e527497e5d0e0173b3eaa4e9
SHA5125937904742ee38375e5948bb15c296c088b751cc30e3ca0784fce20bfe689421b4d3eb73169285f53985b2ed8101bab0a83c6134d620f8c3c6fb7c90afd3c0bf
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8907.exeFilesize
318KB
MD504ec591cd16cab613600d42bb53ce57c
SHA19c8c775b38516452fb916679248477979cba5a63
SHA256e849b928aa41f4f2a70edb37fdfd85a08ddb08e6e527497e5d0e0173b3eaa4e9
SHA5125937904742ee38375e5948bb15c296c088b751cc30e3ca0784fce20bfe689421b4d3eb73169285f53985b2ed8101bab0a83c6134d620f8c3c6fb7c90afd3c0bf
-
memory/4408-1091-0x0000000004B40000-0x0000000004C4A000-memory.dmpFilesize
1.0MB
-
memory/4408-1090-0x0000000005790000-0x0000000005D96000-memory.dmpFilesize
6.0MB
-
memory/4408-194-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/4408-1106-0x0000000006750000-0x0000000006C7C000-memory.dmpFilesize
5.2MB
-
memory/4408-1105-0x0000000006580000-0x0000000006742000-memory.dmpFilesize
1.8MB
-
memory/4408-196-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/4408-1104-0x00000000062D0000-0x0000000006320000-memory.dmpFilesize
320KB
-
memory/4408-1103-0x0000000006240000-0x00000000062B6000-memory.dmpFilesize
472KB
-
memory/4408-1102-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/4408-198-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/4408-1101-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/4408-1100-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/4408-1099-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/4408-1097-0x0000000006160000-0x00000000061F2000-memory.dmpFilesize
584KB
-
memory/4408-1096-0x0000000005490000-0x00000000054F6000-memory.dmpFilesize
408KB
-
memory/4408-1095-0x0000000005300000-0x000000000534B000-memory.dmpFilesize
300KB
-
memory/4408-1094-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/4408-1093-0x00000000051B0000-0x00000000051EE000-memory.dmpFilesize
248KB
-
memory/4408-1092-0x0000000005190000-0x00000000051A2000-memory.dmpFilesize
72KB
-
memory/4408-208-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/4408-411-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/4408-414-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/4408-410-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/4408-214-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/4408-179-0x00000000025C0000-0x0000000002606000-memory.dmpFilesize
280KB
-
memory/4408-178-0x0000000000590000-0x00000000005DB000-memory.dmpFilesize
300KB
-
memory/4408-180-0x0000000004AB0000-0x0000000004AF4000-memory.dmpFilesize
272KB
-
memory/4408-181-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/4408-182-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/4408-184-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/4408-186-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/4408-188-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/4408-190-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/4408-192-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/4408-212-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/4408-210-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/4408-206-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/4408-200-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/4408-202-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/4408-204-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/4504-169-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/4504-152-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4504-146-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4504-134-0x0000000001F90000-0x0000000001FAA000-memory.dmpFilesize
104KB
-
memory/4504-137-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/4504-139-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/4504-173-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/4504-171-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/4504-170-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/4504-136-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/4504-138-0x0000000004AA0000-0x0000000004F9E000-memory.dmpFilesize
5.0MB
-
memory/4504-168-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4504-166-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4504-164-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4504-162-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4504-160-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4504-158-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4504-156-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4504-154-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4504-150-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4504-148-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4504-142-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4504-144-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4504-141-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4504-135-0x00000000004C0000-0x00000000004ED000-memory.dmpFilesize
180KB
-
memory/4504-140-0x00000000049E0000-0x00000000049F8000-memory.dmpFilesize
96KB
-
memory/4804-1112-0x0000000000130000-0x0000000000162000-memory.dmpFilesize
200KB
-
memory/4804-1113-0x0000000004B70000-0x0000000004BBB000-memory.dmpFilesize
300KB
-
memory/4804-1114-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB