Analysis
-
max time kernel
127s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 18:16
Static task
static1
Behavioral task
behavioral1
Sample
f0d925dad1755590d7435a836609a9a2d37c47da8d8a2542d5af48e2d26f0753.exe
Resource
win10v2004-20230221-en
General
-
Target
f0d925dad1755590d7435a836609a9a2d37c47da8d8a2542d5af48e2d26f0753.exe
-
Size
672KB
-
MD5
6a3034805e5875a97b12eb5f4ae98476
-
SHA1
92703e457946359fbfa7565a64ea88a0fd5610b7
-
SHA256
f0d925dad1755590d7435a836609a9a2d37c47da8d8a2542d5af48e2d26f0753
-
SHA512
354f80a831a5496514e24577d2abf96efdd76f11ad4ce0785bb00a1da2f00ec7b5fe5f9b662ecd677be59c2c3ca76d7943865dfc3647c6275e92b19651c77de6
-
SSDEEP
12288:+Mrey90m8io4GOP2gdZRrBuv4XBTL7K95UlMR+omJg+YQyeJphBn5:8yD8i9GMkgxvg5AoA3LLB5
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro0050.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro0050.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro0050.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro0050.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro0050.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro0050.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro0050.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/376-191-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/376-190-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/376-193-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/376-195-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/376-197-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/376-199-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/376-201-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/376-203-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/376-205-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/376-207-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/376-209-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/376-214-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/376-217-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/376-219-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/376-221-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/376-223-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/376-225-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/376-227-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/376-1107-0x0000000004C00000-0x0000000004C10000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un095025.exepro0050.exequ5543.exesi332704.exepid process 1440 un095025.exe 1988 pro0050.exe 376 qu5543.exe 4392 si332704.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro0050.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro0050.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro0050.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
f0d925dad1755590d7435a836609a9a2d37c47da8d8a2542d5af48e2d26f0753.exeun095025.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce f0d925dad1755590d7435a836609a9a2d37c47da8d8a2542d5af48e2d26f0753.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" f0d925dad1755590d7435a836609a9a2d37c47da8d8a2542d5af48e2d26f0753.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un095025.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un095025.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2624 1988 WerFault.exe pro0050.exe 5100 376 WerFault.exe qu5543.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro0050.exequ5543.exesi332704.exepid process 1988 pro0050.exe 1988 pro0050.exe 376 qu5543.exe 376 qu5543.exe 4392 si332704.exe 4392 si332704.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro0050.exequ5543.exesi332704.exedescription pid process Token: SeDebugPrivilege 1988 pro0050.exe Token: SeDebugPrivilege 376 qu5543.exe Token: SeDebugPrivilege 4392 si332704.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
f0d925dad1755590d7435a836609a9a2d37c47da8d8a2542d5af48e2d26f0753.exeun095025.exedescription pid process target process PID 1732 wrote to memory of 1440 1732 f0d925dad1755590d7435a836609a9a2d37c47da8d8a2542d5af48e2d26f0753.exe un095025.exe PID 1732 wrote to memory of 1440 1732 f0d925dad1755590d7435a836609a9a2d37c47da8d8a2542d5af48e2d26f0753.exe un095025.exe PID 1732 wrote to memory of 1440 1732 f0d925dad1755590d7435a836609a9a2d37c47da8d8a2542d5af48e2d26f0753.exe un095025.exe PID 1440 wrote to memory of 1988 1440 un095025.exe pro0050.exe PID 1440 wrote to memory of 1988 1440 un095025.exe pro0050.exe PID 1440 wrote to memory of 1988 1440 un095025.exe pro0050.exe PID 1440 wrote to memory of 376 1440 un095025.exe qu5543.exe PID 1440 wrote to memory of 376 1440 un095025.exe qu5543.exe PID 1440 wrote to memory of 376 1440 un095025.exe qu5543.exe PID 1732 wrote to memory of 4392 1732 f0d925dad1755590d7435a836609a9a2d37c47da8d8a2542d5af48e2d26f0753.exe si332704.exe PID 1732 wrote to memory of 4392 1732 f0d925dad1755590d7435a836609a9a2d37c47da8d8a2542d5af48e2d26f0753.exe si332704.exe PID 1732 wrote to memory of 4392 1732 f0d925dad1755590d7435a836609a9a2d37c47da8d8a2542d5af48e2d26f0753.exe si332704.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0d925dad1755590d7435a836609a9a2d37c47da8d8a2542d5af48e2d26f0753.exe"C:\Users\Admin\AppData\Local\Temp\f0d925dad1755590d7435a836609a9a2d37c47da8d8a2542d5af48e2d26f0753.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un095025.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un095025.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0050.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0050.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 10804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5543.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5543.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 19004⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si332704.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si332704.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1988 -ip 19881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 376 -ip 3761⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si332704.exeFilesize
175KB
MD5a588838757bbce50a8f8903711e28722
SHA12cc4e50d8b3bd1e574913bee000f6a2ffd42f4ab
SHA2562c83c767277d05cbcbdb1114624d894375e2589a9b4d85774b5bbe533410a25c
SHA5120cd1975a4a3efd1f4114ce2f2eade9478e6c6da8811eb09ea023957d7d9ddcd823aa111b3126a9f650c3548abdb9c8275e571ecc9bc4222b973e627815a20c5a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si332704.exeFilesize
175KB
MD5a588838757bbce50a8f8903711e28722
SHA12cc4e50d8b3bd1e574913bee000f6a2ffd42f4ab
SHA2562c83c767277d05cbcbdb1114624d894375e2589a9b4d85774b5bbe533410a25c
SHA5120cd1975a4a3efd1f4114ce2f2eade9478e6c6da8811eb09ea023957d7d9ddcd823aa111b3126a9f650c3548abdb9c8275e571ecc9bc4222b973e627815a20c5a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un095025.exeFilesize
530KB
MD5b67798bed891a8c9f39ae58fd8014e1f
SHA13e576c278f5553c7a245dcfd20055a86852cd0f2
SHA25607fa260a5db93ebed8af5110e3393da9c549ad32949cd2e5b62da2fb9a73910b
SHA512b19b00a2ea419bb3fd7496ac262fdeae6578ce6935b5100c44b07e427883d6a110f5cd5a7fbb13f061450d57ed91fa0ea05affc7d22b5269af4f08a9f6ebd3ad
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un095025.exeFilesize
530KB
MD5b67798bed891a8c9f39ae58fd8014e1f
SHA13e576c278f5553c7a245dcfd20055a86852cd0f2
SHA25607fa260a5db93ebed8af5110e3393da9c549ad32949cd2e5b62da2fb9a73910b
SHA512b19b00a2ea419bb3fd7496ac262fdeae6578ce6935b5100c44b07e427883d6a110f5cd5a7fbb13f061450d57ed91fa0ea05affc7d22b5269af4f08a9f6ebd3ad
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0050.exeFilesize
259KB
MD56ff176e452012e07d26186bea3537e4d
SHA1f3b185aace93398a4d8615f05582b039077ace94
SHA256d6efda9a36c4fedcc7742499d7a67fcf2347df7adeeca14e22c15faf46b098a1
SHA512608a69a20ce03b3c25b8d4d796c5df9217dfe9fed899f08cb0603f89a39b5f15434493c2856ff677676eb0765f2c1eaa600b16c19fa17ef2af048cdf2fe67538
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0050.exeFilesize
259KB
MD56ff176e452012e07d26186bea3537e4d
SHA1f3b185aace93398a4d8615f05582b039077ace94
SHA256d6efda9a36c4fedcc7742499d7a67fcf2347df7adeeca14e22c15faf46b098a1
SHA512608a69a20ce03b3c25b8d4d796c5df9217dfe9fed899f08cb0603f89a39b5f15434493c2856ff677676eb0765f2c1eaa600b16c19fa17ef2af048cdf2fe67538
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5543.exeFilesize
318KB
MD5b29487fec2b2d048c10b86c292a10d63
SHA167b2e965255d38c0bcc81d45d6f6df6f324f4417
SHA256677bd65f7fcf21e74798ff640a11a70a0caa976d205459b84a675aaa6cdf9292
SHA512c03d7d73875373807dbc7e6d5d9102e6c11d62f37178face46e93e6b89501dea1d14785d425568fe34f806e16252e1382d45d58a36d3ddda646b7b407df7c688
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5543.exeFilesize
318KB
MD5b29487fec2b2d048c10b86c292a10d63
SHA167b2e965255d38c0bcc81d45d6f6df6f324f4417
SHA256677bd65f7fcf21e74798ff640a11a70a0caa976d205459b84a675aaa6cdf9292
SHA512c03d7d73875373807dbc7e6d5d9102e6c11d62f37178face46e93e6b89501dea1d14785d425568fe34f806e16252e1382d45d58a36d3ddda646b7b407df7c688
-
memory/376-1102-0x0000000004BB0000-0x0000000004BC2000-memory.dmpFilesize
72KB
-
memory/376-227-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/376-205-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/376-207-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/376-1116-0x0000000006D40000-0x0000000006D90000-memory.dmpFilesize
320KB
-
memory/376-1115-0x0000000006CC0000-0x0000000006D36000-memory.dmpFilesize
472KB
-
memory/376-1114-0x0000000006650000-0x0000000006B7C000-memory.dmpFilesize
5.2MB
-
memory/376-1113-0x0000000006470000-0x0000000006632000-memory.dmpFilesize
1.8MB
-
memory/376-1111-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/376-1110-0x0000000006270000-0x0000000006302000-memory.dmpFilesize
584KB
-
memory/376-210-0x00000000020F0000-0x000000000213B000-memory.dmpFilesize
300KB
-
memory/376-1109-0x0000000005BB0000-0x0000000005C16000-memory.dmpFilesize
408KB
-
memory/376-1108-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/376-1107-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/376-1106-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/376-1104-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/376-1103-0x00000000058F0000-0x000000000592C000-memory.dmpFilesize
240KB
-
memory/376-1101-0x00000000057E0000-0x00000000058EA000-memory.dmpFilesize
1.0MB
-
memory/376-1100-0x00000000051C0000-0x00000000057D8000-memory.dmpFilesize
6.1MB
-
memory/376-216-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/376-225-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/376-223-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/376-191-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/376-190-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/376-193-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/376-195-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/376-197-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/376-199-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/376-201-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/376-203-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/376-221-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/376-219-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/376-217-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/376-209-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/376-212-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/376-214-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/376-213-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/1988-181-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/1988-176-0x0000000004B80000-0x0000000004B92000-memory.dmpFilesize
72KB
-
memory/1988-149-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/1988-154-0x0000000004B80000-0x0000000004B92000-memory.dmpFilesize
72KB
-
memory/1988-151-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/1988-152-0x0000000004BC0000-0x0000000005164000-memory.dmpFilesize
5.6MB
-
memory/1988-185-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/1988-183-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/1988-182-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/1988-150-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/1988-153-0x0000000004B80000-0x0000000004B92000-memory.dmpFilesize
72KB
-
memory/1988-180-0x0000000004B80000-0x0000000004B92000-memory.dmpFilesize
72KB
-
memory/1988-178-0x0000000004B80000-0x0000000004B92000-memory.dmpFilesize
72KB
-
memory/1988-170-0x0000000004B80000-0x0000000004B92000-memory.dmpFilesize
72KB
-
memory/1988-174-0x0000000004B80000-0x0000000004B92000-memory.dmpFilesize
72KB
-
memory/1988-172-0x0000000004B80000-0x0000000004B92000-memory.dmpFilesize
72KB
-
memory/1988-168-0x0000000004B80000-0x0000000004B92000-memory.dmpFilesize
72KB
-
memory/1988-166-0x0000000004B80000-0x0000000004B92000-memory.dmpFilesize
72KB
-
memory/1988-164-0x0000000004B80000-0x0000000004B92000-memory.dmpFilesize
72KB
-
memory/1988-162-0x0000000004B80000-0x0000000004B92000-memory.dmpFilesize
72KB
-
memory/1988-160-0x0000000004B80000-0x0000000004B92000-memory.dmpFilesize
72KB
-
memory/1988-158-0x0000000004B80000-0x0000000004B92000-memory.dmpFilesize
72KB
-
memory/1988-156-0x0000000004B80000-0x0000000004B92000-memory.dmpFilesize
72KB
-
memory/1988-148-0x0000000000550000-0x000000000057D000-memory.dmpFilesize
180KB
-
memory/4392-1122-0x0000000000700000-0x0000000000732000-memory.dmpFilesize
200KB
-
memory/4392-1123-0x0000000004FF0000-0x0000000005000000-memory.dmpFilesize
64KB
-
memory/4392-1124-0x0000000004FF0000-0x0000000005000000-memory.dmpFilesize
64KB