Analysis
-
max time kernel
73s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 18:22
Static task
static1
Behavioral task
behavioral1
Sample
c351df5741d28bf17cfd34f750ad730d2e10ab64f5049e768b9f98b6731218e1.exe
Resource
win10v2004-20230221-en
General
-
Target
c351df5741d28bf17cfd34f750ad730d2e10ab64f5049e768b9f98b6731218e1.exe
-
Size
673KB
-
MD5
20ea84833345a28c1c7e74c0020e1274
-
SHA1
76d2d5913487b3fd95fb9eed896bf119d2402785
-
SHA256
c351df5741d28bf17cfd34f750ad730d2e10ab64f5049e768b9f98b6731218e1
-
SHA512
b5a6e73e984a38e92c668d2587f46ede6ad264acfe9e8be2c0a5c8fa31bef153a49bd8c243ec74e13e929a7f8cd20921ca90c2b7e8c6d8ac11ba174514b13669
-
SSDEEP
12288:iMrry90T+iL++8kn3KUZSBQv8FBVZnhRtMujWPn9RomRx+YibQjp4LEhpo:dyYiSv0rpMu29Roj5oOLy+
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro8416.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro8416.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro8416.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro8416.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro8416.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro8416.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro8416.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/4860-189-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4860-190-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4860-192-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4860-194-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4860-200-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4860-198-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4860-196-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4860-202-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4860-204-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4860-206-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4860-208-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4860-210-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4860-212-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4860-214-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4860-216-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4860-218-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4860-220-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4860-222-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un759426.exepro8416.exequ9214.exesi084268.exepid process 4620 un759426.exe 4292 pro8416.exe 4860 qu9214.exe 636 si084268.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro8416.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro8416.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro8416.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
c351df5741d28bf17cfd34f750ad730d2e10ab64f5049e768b9f98b6731218e1.exeun759426.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce c351df5741d28bf17cfd34f750ad730d2e10ab64f5049e768b9f98b6731218e1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c351df5741d28bf17cfd34f750ad730d2e10ab64f5049e768b9f98b6731218e1.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un759426.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un759426.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3560 4292 WerFault.exe pro8416.exe 4952 4860 WerFault.exe qu9214.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro8416.exequ9214.exesi084268.exepid process 4292 pro8416.exe 4292 pro8416.exe 4860 qu9214.exe 4860 qu9214.exe 636 si084268.exe 636 si084268.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro8416.exequ9214.exesi084268.exedescription pid process Token: SeDebugPrivilege 4292 pro8416.exe Token: SeDebugPrivilege 4860 qu9214.exe Token: SeDebugPrivilege 636 si084268.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
c351df5741d28bf17cfd34f750ad730d2e10ab64f5049e768b9f98b6731218e1.exeun759426.exedescription pid process target process PID 4628 wrote to memory of 4620 4628 c351df5741d28bf17cfd34f750ad730d2e10ab64f5049e768b9f98b6731218e1.exe un759426.exe PID 4628 wrote to memory of 4620 4628 c351df5741d28bf17cfd34f750ad730d2e10ab64f5049e768b9f98b6731218e1.exe un759426.exe PID 4628 wrote to memory of 4620 4628 c351df5741d28bf17cfd34f750ad730d2e10ab64f5049e768b9f98b6731218e1.exe un759426.exe PID 4620 wrote to memory of 4292 4620 un759426.exe pro8416.exe PID 4620 wrote to memory of 4292 4620 un759426.exe pro8416.exe PID 4620 wrote to memory of 4292 4620 un759426.exe pro8416.exe PID 4620 wrote to memory of 4860 4620 un759426.exe qu9214.exe PID 4620 wrote to memory of 4860 4620 un759426.exe qu9214.exe PID 4620 wrote to memory of 4860 4620 un759426.exe qu9214.exe PID 4628 wrote to memory of 636 4628 c351df5741d28bf17cfd34f750ad730d2e10ab64f5049e768b9f98b6731218e1.exe si084268.exe PID 4628 wrote to memory of 636 4628 c351df5741d28bf17cfd34f750ad730d2e10ab64f5049e768b9f98b6731218e1.exe si084268.exe PID 4628 wrote to memory of 636 4628 c351df5741d28bf17cfd34f750ad730d2e10ab64f5049e768b9f98b6731218e1.exe si084268.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c351df5741d28bf17cfd34f750ad730d2e10ab64f5049e768b9f98b6731218e1.exe"C:\Users\Admin\AppData\Local\Temp\c351df5741d28bf17cfd34f750ad730d2e10ab64f5049e768b9f98b6731218e1.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un759426.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un759426.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8416.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8416.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 10844⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9214.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9214.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 18884⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si084268.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si084268.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4292 -ip 42921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4860 -ip 48601⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si084268.exeFilesize
175KB
MD50e161fa0d43576fb860ea822840a67ea
SHA1fc53ab65baa958fa8bbbbfecf5ec1951d46667e5
SHA256b45edc9aeeb31cb3d2523ca93a8261d086f8a8d187d4e46ff423115dc96a3cc1
SHA5126c31020a3933a298c4118bca5a7ea91ca74a31a5da2f6c13f1ed58b6505e3d934d5df8f1688c2677ac4a8efa5d403c9d174d816c81a17c6dd7ca32b400305034
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si084268.exeFilesize
175KB
MD50e161fa0d43576fb860ea822840a67ea
SHA1fc53ab65baa958fa8bbbbfecf5ec1951d46667e5
SHA256b45edc9aeeb31cb3d2523ca93a8261d086f8a8d187d4e46ff423115dc96a3cc1
SHA5126c31020a3933a298c4118bca5a7ea91ca74a31a5da2f6c13f1ed58b6505e3d934d5df8f1688c2677ac4a8efa5d403c9d174d816c81a17c6dd7ca32b400305034
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un759426.exeFilesize
531KB
MD51ac8a7c564aea43370ecd5968cc9792f
SHA1249b456c8ffd5eb457b76ceb4debd7abaea13c23
SHA256746dd393ae81beead9e905472ab654181937f31f501a5592c5dcf6885cc5076c
SHA512c8b3ba35d558418c0545b68c33c6cac8ef508241978e1510da771a3a594c7cbf32ceca5b3576cf1521576b30f48d9ffbb9655a54379064e20d17b85284c7ba90
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un759426.exeFilesize
531KB
MD51ac8a7c564aea43370ecd5968cc9792f
SHA1249b456c8ffd5eb457b76ceb4debd7abaea13c23
SHA256746dd393ae81beead9e905472ab654181937f31f501a5592c5dcf6885cc5076c
SHA512c8b3ba35d558418c0545b68c33c6cac8ef508241978e1510da771a3a594c7cbf32ceca5b3576cf1521576b30f48d9ffbb9655a54379064e20d17b85284c7ba90
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8416.exeFilesize
259KB
MD546abbf5266524ba32cfe958526c48db2
SHA1c9071a5738849f5f2e001680c48ae5cc6d12a3fa
SHA25682e1376724395fb3bca7e9115ba4438c134fe450ce6c49e91589b7fe1f8d10ce
SHA512b13806ee7d1acb05e0e2cd15e6a21d3c2f0951cfecc9025c979b7726978c5707aa5b164de224ea434e9026caa4960ff17a7ef1815306f1958952bf5a60023b0a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8416.exeFilesize
259KB
MD546abbf5266524ba32cfe958526c48db2
SHA1c9071a5738849f5f2e001680c48ae5cc6d12a3fa
SHA25682e1376724395fb3bca7e9115ba4438c134fe450ce6c49e91589b7fe1f8d10ce
SHA512b13806ee7d1acb05e0e2cd15e6a21d3c2f0951cfecc9025c979b7726978c5707aa5b164de224ea434e9026caa4960ff17a7ef1815306f1958952bf5a60023b0a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9214.exeFilesize
318KB
MD59e250f4765e006876d58f42706f85c6f
SHA141730dd3df415b84e8aca8143f4a0e363b598c8c
SHA256126d8a5e112d18048446e153b87ecfa8263791615ea7bed4fdd3b5f112e14e4c
SHA51208ebcfa9423b4dc1b52d183143072cb1226362838363703677258a8f966f9c6ce81f45c2f7e2c74d69116365b12c20f9b72b2f76abca25d76a3818c14568a3f9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9214.exeFilesize
318KB
MD59e250f4765e006876d58f42706f85c6f
SHA141730dd3df415b84e8aca8143f4a0e363b598c8c
SHA256126d8a5e112d18048446e153b87ecfa8263791615ea7bed4fdd3b5f112e14e4c
SHA51208ebcfa9423b4dc1b52d183143072cb1226362838363703677258a8f966f9c6ce81f45c2f7e2c74d69116365b12c20f9b72b2f76abca25d76a3818c14568a3f9
-
memory/636-1120-0x0000000000AB0000-0x0000000000AE2000-memory.dmpFilesize
200KB
-
memory/636-1121-0x00000000056F0000-0x0000000005700000-memory.dmpFilesize
64KB
-
memory/4292-158-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/4292-168-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/4292-152-0x0000000004C10000-0x00000000051B4000-memory.dmpFilesize
5.6MB
-
memory/4292-153-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/4292-154-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/4292-156-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/4292-149-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/4292-160-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/4292-162-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/4292-164-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/4292-166-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/4292-151-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/4292-170-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/4292-172-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/4292-174-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/4292-176-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/4292-178-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/4292-180-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/4292-181-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/4292-182-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/4292-184-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/4292-150-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/4292-148-0x0000000002100000-0x000000000212D000-memory.dmpFilesize
180KB
-
memory/4860-194-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4860-356-0x0000000004B60000-0x0000000004B70000-memory.dmpFilesize
64KB
-
memory/4860-200-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4860-198-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4860-196-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4860-202-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4860-204-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4860-206-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4860-208-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4860-210-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4860-212-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4860-214-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4860-216-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4860-218-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4860-220-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4860-222-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4860-352-0x0000000004B60000-0x0000000004B70000-memory.dmpFilesize
64KB
-
memory/4860-350-0x0000000000630000-0x000000000067B000-memory.dmpFilesize
300KB
-
memory/4860-354-0x0000000004B60000-0x0000000004B70000-memory.dmpFilesize
64KB
-
memory/4860-192-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4860-1099-0x0000000005220000-0x0000000005838000-memory.dmpFilesize
6.1MB
-
memory/4860-1100-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/4860-1101-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/4860-1102-0x0000000004B60000-0x0000000004B70000-memory.dmpFilesize
64KB
-
memory/4860-1103-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/4860-1104-0x0000000005CF0000-0x0000000005D56000-memory.dmpFilesize
408KB
-
memory/4860-1105-0x00000000063B0000-0x0000000006442000-memory.dmpFilesize
584KB
-
memory/4860-1107-0x00000000064C0000-0x0000000006682000-memory.dmpFilesize
1.8MB
-
memory/4860-1108-0x0000000006690000-0x0000000006BBC000-memory.dmpFilesize
5.2MB
-
memory/4860-1109-0x0000000004B60000-0x0000000004B70000-memory.dmpFilesize
64KB
-
memory/4860-1110-0x0000000004B60000-0x0000000004B70000-memory.dmpFilesize
64KB
-
memory/4860-1111-0x0000000004B60000-0x0000000004B70000-memory.dmpFilesize
64KB
-
memory/4860-1112-0x0000000004B60000-0x0000000004B70000-memory.dmpFilesize
64KB
-
memory/4860-190-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4860-189-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4860-1113-0x0000000007080000-0x00000000070F6000-memory.dmpFilesize
472KB
-
memory/4860-1114-0x0000000007100000-0x0000000007150000-memory.dmpFilesize
320KB