Analysis
-
max time kernel
90s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 18:19
Static task
static1
Behavioral task
behavioral1
Sample
50f71c39d9d1a26311064405b16707c13a340879b8aec06f6aa4203869b5adb5.exe
Resource
win10v2004-20230220-en
General
-
Target
50f71c39d9d1a26311064405b16707c13a340879b8aec06f6aa4203869b5adb5.exe
-
Size
672KB
-
MD5
511ad173cfc0d9b74a58e25bc15a6971
-
SHA1
3dae459e86e6a796fe935c29bdd6ca7fc6551af1
-
SHA256
50f71c39d9d1a26311064405b16707c13a340879b8aec06f6aa4203869b5adb5
-
SHA512
de320dadc627f8a106d60462beb80e7f6466cb76ecd73b95ca9e110b89e7960c37420714ec11c7b9c9c143e854ab30f405fea3a55985d7c9950fb70c56ceb9b0
-
SSDEEP
12288:qMrXy901e7nDVLZ0fE4loNi83cIubIbTmAfKRvFMomVq+Y0elopAeN0MjCm8A:Jymez0fE4lm3bbTZKRvFMo6XFp2Mjlz
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro4376.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro4376.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro4376.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro4376.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro4376.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro4376.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro4376.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/1732-191-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/1732-192-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/1732-194-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/1732-196-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/1732-198-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/1732-200-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/1732-202-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/1732-204-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/1732-206-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/1732-208-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/1732-210-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/1732-212-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/1732-214-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/1732-216-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/1732-218-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/1732-220-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/1732-222-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/1732-224-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/1732-1109-0x0000000004B70000-0x0000000004B80000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un977161.exepro4376.exequ5750.exesi320621.exepid process 4444 un977161.exe 4792 pro4376.exe 1732 qu5750.exe 1396 si320621.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro4376.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro4376.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro4376.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
50f71c39d9d1a26311064405b16707c13a340879b8aec06f6aa4203869b5adb5.exeun977161.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 50f71c39d9d1a26311064405b16707c13a340879b8aec06f6aa4203869b5adb5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 50f71c39d9d1a26311064405b16707c13a340879b8aec06f6aa4203869b5adb5.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un977161.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un977161.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4188 4792 WerFault.exe pro4376.exe 4128 1732 WerFault.exe qu5750.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro4376.exequ5750.exesi320621.exepid process 4792 pro4376.exe 4792 pro4376.exe 1732 qu5750.exe 1732 qu5750.exe 1396 si320621.exe 1396 si320621.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro4376.exequ5750.exesi320621.exedescription pid process Token: SeDebugPrivilege 4792 pro4376.exe Token: SeDebugPrivilege 1732 qu5750.exe Token: SeDebugPrivilege 1396 si320621.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
50f71c39d9d1a26311064405b16707c13a340879b8aec06f6aa4203869b5adb5.exeun977161.exedescription pid process target process PID 5044 wrote to memory of 4444 5044 50f71c39d9d1a26311064405b16707c13a340879b8aec06f6aa4203869b5adb5.exe un977161.exe PID 5044 wrote to memory of 4444 5044 50f71c39d9d1a26311064405b16707c13a340879b8aec06f6aa4203869b5adb5.exe un977161.exe PID 5044 wrote to memory of 4444 5044 50f71c39d9d1a26311064405b16707c13a340879b8aec06f6aa4203869b5adb5.exe un977161.exe PID 4444 wrote to memory of 4792 4444 un977161.exe pro4376.exe PID 4444 wrote to memory of 4792 4444 un977161.exe pro4376.exe PID 4444 wrote to memory of 4792 4444 un977161.exe pro4376.exe PID 4444 wrote to memory of 1732 4444 un977161.exe qu5750.exe PID 4444 wrote to memory of 1732 4444 un977161.exe qu5750.exe PID 4444 wrote to memory of 1732 4444 un977161.exe qu5750.exe PID 5044 wrote to memory of 1396 5044 50f71c39d9d1a26311064405b16707c13a340879b8aec06f6aa4203869b5adb5.exe si320621.exe PID 5044 wrote to memory of 1396 5044 50f71c39d9d1a26311064405b16707c13a340879b8aec06f6aa4203869b5adb5.exe si320621.exe PID 5044 wrote to memory of 1396 5044 50f71c39d9d1a26311064405b16707c13a340879b8aec06f6aa4203869b5adb5.exe si320621.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\50f71c39d9d1a26311064405b16707c13a340879b8aec06f6aa4203869b5adb5.exe"C:\Users\Admin\AppData\Local\Temp\50f71c39d9d1a26311064405b16707c13a340879b8aec06f6aa4203869b5adb5.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un977161.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un977161.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4376.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4376.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 10844⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5750.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5750.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 15844⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si320621.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si320621.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4792 -ip 47921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1732 -ip 17321⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si320621.exeFilesize
175KB
MD56cb143b7c93771669ccb13278d98ff8e
SHA10fab7bf3faae7ab8f2c50dc7a89b280a84a0513a
SHA2562d9e15d67b8cf9a620704528951513596ba0e4410cfd1f311e32ecfc4f2266aa
SHA5128627e89475f2d723ca7619b77f2b078868bcc37a9fe1100c569e579af25ef9e5b875fd0e7d3aa5129cfca4ead60b9036455882fc879184dd53dc51b3f071eb94
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si320621.exeFilesize
175KB
MD56cb143b7c93771669ccb13278d98ff8e
SHA10fab7bf3faae7ab8f2c50dc7a89b280a84a0513a
SHA2562d9e15d67b8cf9a620704528951513596ba0e4410cfd1f311e32ecfc4f2266aa
SHA5128627e89475f2d723ca7619b77f2b078868bcc37a9fe1100c569e579af25ef9e5b875fd0e7d3aa5129cfca4ead60b9036455882fc879184dd53dc51b3f071eb94
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un977161.exeFilesize
530KB
MD5629272ee5d47efac5b3542dbf67bdbe5
SHA1c0c8372b38be1bcaff4a639d02a07fe7e6ec9b35
SHA256033c3b03613c0d64f69c8854ee22c0422f9742a97c92220f0942bc2012655a29
SHA512128836905175c56e3c0cf2870eab2d7c1d6a251e3088f24ff293d57f0138a645a487f82b33759122ba52b3f8c1001d4b5ab15755d04733439d9c8898316d2774
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un977161.exeFilesize
530KB
MD5629272ee5d47efac5b3542dbf67bdbe5
SHA1c0c8372b38be1bcaff4a639d02a07fe7e6ec9b35
SHA256033c3b03613c0d64f69c8854ee22c0422f9742a97c92220f0942bc2012655a29
SHA512128836905175c56e3c0cf2870eab2d7c1d6a251e3088f24ff293d57f0138a645a487f82b33759122ba52b3f8c1001d4b5ab15755d04733439d9c8898316d2774
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4376.exeFilesize
259KB
MD59d9201209333c81085ebe66e3fefd284
SHA1b9eb3ed687080042f590c21cd96a3ed3cb14115f
SHA25618e4dc6d5ec51ed26fa0f1cf3af6ee5d3de0950dae03b9b56edd7ce4a3ffd34e
SHA512b56b0d1f0b0ddcb2914aa0725bda5350b6eea764d726df7d2a68bf8ab7ea619a4c178b657e5b6de99066ec007fc232de40c4ef8682a84236c99fcd619a33a62f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4376.exeFilesize
259KB
MD59d9201209333c81085ebe66e3fefd284
SHA1b9eb3ed687080042f590c21cd96a3ed3cb14115f
SHA25618e4dc6d5ec51ed26fa0f1cf3af6ee5d3de0950dae03b9b56edd7ce4a3ffd34e
SHA512b56b0d1f0b0ddcb2914aa0725bda5350b6eea764d726df7d2a68bf8ab7ea619a4c178b657e5b6de99066ec007fc232de40c4ef8682a84236c99fcd619a33a62f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5750.exeFilesize
318KB
MD5ecc85d35b5ca3caa42f5ed3fcc611f1a
SHA11dfa48e6447754281beda1982d8a66181d5774ba
SHA25625a66ba766736012f2a4bd2d232b4848017cd739ce4604b9f3bcfa079845da6a
SHA51279584a92c846d724129ddc36409ed1552ea936b49db070a8f8879e4126891e8c28fbd7bc98fdd4297aa9bb014600060a68ceceb6f9f6d41a42b601cf6f4acb5e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5750.exeFilesize
318KB
MD5ecc85d35b5ca3caa42f5ed3fcc611f1a
SHA11dfa48e6447754281beda1982d8a66181d5774ba
SHA25625a66ba766736012f2a4bd2d232b4848017cd739ce4604b9f3bcfa079845da6a
SHA51279584a92c846d724129ddc36409ed1552ea936b49db070a8f8879e4126891e8c28fbd7bc98fdd4297aa9bb014600060a68ceceb6f9f6d41a42b601cf6f4acb5e
-
memory/1396-1124-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/1396-1123-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/1396-1122-0x00000000001F0000-0x0000000000222000-memory.dmpFilesize
200KB
-
memory/1732-1102-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/1732-1105-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/1732-1116-0x0000000007A20000-0x0000000007F4C000-memory.dmpFilesize
5.2MB
-
memory/1732-1115-0x0000000007850000-0x0000000007A12000-memory.dmpFilesize
1.8MB
-
memory/1732-1114-0x00000000077F0000-0x0000000007840000-memory.dmpFilesize
320KB
-
memory/1732-1113-0x0000000007760000-0x00000000077D6000-memory.dmpFilesize
472KB
-
memory/1732-1112-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/1732-1111-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/1732-1110-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/1732-1109-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/1732-1107-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/1732-1106-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/1732-1104-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/1732-1103-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/1732-1101-0x0000000005230000-0x0000000005848000-memory.dmpFilesize
6.1MB
-
memory/1732-417-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/1732-419-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/1732-414-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/1732-413-0x0000000002140000-0x000000000218B000-memory.dmpFilesize
300KB
-
memory/1732-224-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/1732-191-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/1732-192-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/1732-194-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/1732-196-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/1732-198-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/1732-200-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/1732-202-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/1732-204-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/1732-206-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/1732-208-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/1732-210-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/1732-212-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/1732-214-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/1732-216-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/1732-218-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/1732-220-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/1732-222-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/4792-174-0x00000000026B0000-0x00000000026C2000-memory.dmpFilesize
72KB
-
memory/4792-183-0x00000000024F0000-0x0000000002500000-memory.dmpFilesize
64KB
-
memory/4792-154-0x00000000026B0000-0x00000000026C2000-memory.dmpFilesize
72KB
-
memory/4792-184-0x00000000024F0000-0x0000000002500000-memory.dmpFilesize
64KB
-
memory/4792-172-0x00000000026B0000-0x00000000026C2000-memory.dmpFilesize
72KB
-
memory/4792-182-0x00000000024F0000-0x0000000002500000-memory.dmpFilesize
64KB
-
memory/4792-153-0x00000000026B0000-0x00000000026C2000-memory.dmpFilesize
72KB
-
memory/4792-170-0x00000000026B0000-0x00000000026C2000-memory.dmpFilesize
72KB
-
memory/4792-180-0x00000000026B0000-0x00000000026C2000-memory.dmpFilesize
72KB
-
memory/4792-158-0x00000000026B0000-0x00000000026C2000-memory.dmpFilesize
72KB
-
memory/4792-178-0x00000000026B0000-0x00000000026C2000-memory.dmpFilesize
72KB
-
memory/4792-176-0x00000000026B0000-0x00000000026C2000-memory.dmpFilesize
72KB
-
memory/4792-186-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/4792-156-0x00000000026B0000-0x00000000026C2000-memory.dmpFilesize
72KB
-
memory/4792-181-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/4792-168-0x00000000026B0000-0x00000000026C2000-memory.dmpFilesize
72KB
-
memory/4792-166-0x00000000026B0000-0x00000000026C2000-memory.dmpFilesize
72KB
-
memory/4792-164-0x00000000026B0000-0x00000000026C2000-memory.dmpFilesize
72KB
-
memory/4792-162-0x00000000026B0000-0x00000000026C2000-memory.dmpFilesize
72KB
-
memory/4792-160-0x00000000026B0000-0x00000000026C2000-memory.dmpFilesize
72KB
-
memory/4792-152-0x00000000024F0000-0x0000000002500000-memory.dmpFilesize
64KB
-
memory/4792-151-0x00000000024F0000-0x0000000002500000-memory.dmpFilesize
64KB
-
memory/4792-150-0x00000000024F0000-0x0000000002500000-memory.dmpFilesize
64KB
-
memory/4792-149-0x0000000000720000-0x000000000074D000-memory.dmpFilesize
180KB
-
memory/4792-148-0x0000000004A30000-0x0000000004FD4000-memory.dmpFilesize
5.6MB