Analysis
-
max time kernel
61s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 19:24
Static task
static1
Behavioral task
behavioral1
Sample
3d989326b86fe2f1884850f81c8227f3b6ab063ed6c77bf8e7fff0a9ee8c4ecb.exe
Resource
win10v2004-20230220-en
General
-
Target
3d989326b86fe2f1884850f81c8227f3b6ab063ed6c77bf8e7fff0a9ee8c4ecb.exe
-
Size
533KB
-
MD5
9a7234550622db14f104c1a8c818a698
-
SHA1
0e0afbc8f6e1a59b951455c5e3f97a863e8b9f02
-
SHA256
3d989326b86fe2f1884850f81c8227f3b6ab063ed6c77bf8e7fff0a9ee8c4ecb
-
SHA512
785b46734db15d5394e483fa70f50fcf0db1073d1d99ddf1fcffab758f5d879c16e05a0ece17e62d3289ba7366de3867ffa603fe4a013419b44bf1acd7f13d01
-
SSDEEP
12288:HMrey90ISeo+6h92FeYeWaYObKrqG2Krw9Ufi:hyKbyibLJpWK
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr011746.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr011746.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr011746.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr011746.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr011746.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr011746.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr011746.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/3640-155-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3640-156-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3640-161-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3640-163-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3640-165-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3640-167-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3640-169-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3640-171-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3640-173-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3640-175-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3640-177-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3640-179-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3640-181-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3640-183-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3640-185-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3640-187-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3640-189-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3640-191-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3640-195-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3640-197-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3640-193-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3640-199-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3640-201-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3640-203-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3640-205-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3640-207-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3640-209-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3640-211-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3640-213-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3640-215-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3640-219-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3640-217-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3640-221-0x0000000002530000-0x000000000256F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
zilC9049.exejr011746.exeku715533.exelr592450.exepid process 3112 zilC9049.exe 2780 jr011746.exe 3640 ku715533.exe 1940 lr592450.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr011746.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr011746.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
3d989326b86fe2f1884850f81c8227f3b6ab063ed6c77bf8e7fff0a9ee8c4ecb.exezilC9049.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 3d989326b86fe2f1884850f81c8227f3b6ab063ed6c77bf8e7fff0a9ee8c4ecb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 3d989326b86fe2f1884850f81c8227f3b6ab063ed6c77bf8e7fff0a9ee8c4ecb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zilC9049.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zilC9049.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4468 3640 WerFault.exe ku715533.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr011746.exeku715533.exelr592450.exepid process 2780 jr011746.exe 2780 jr011746.exe 3640 ku715533.exe 3640 ku715533.exe 1940 lr592450.exe 1940 lr592450.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr011746.exeku715533.exelr592450.exedescription pid process Token: SeDebugPrivilege 2780 jr011746.exe Token: SeDebugPrivilege 3640 ku715533.exe Token: SeDebugPrivilege 1940 lr592450.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
3d989326b86fe2f1884850f81c8227f3b6ab063ed6c77bf8e7fff0a9ee8c4ecb.exezilC9049.exedescription pid process target process PID 2032 wrote to memory of 3112 2032 3d989326b86fe2f1884850f81c8227f3b6ab063ed6c77bf8e7fff0a9ee8c4ecb.exe zilC9049.exe PID 2032 wrote to memory of 3112 2032 3d989326b86fe2f1884850f81c8227f3b6ab063ed6c77bf8e7fff0a9ee8c4ecb.exe zilC9049.exe PID 2032 wrote to memory of 3112 2032 3d989326b86fe2f1884850f81c8227f3b6ab063ed6c77bf8e7fff0a9ee8c4ecb.exe zilC9049.exe PID 3112 wrote to memory of 2780 3112 zilC9049.exe jr011746.exe PID 3112 wrote to memory of 2780 3112 zilC9049.exe jr011746.exe PID 3112 wrote to memory of 3640 3112 zilC9049.exe ku715533.exe PID 3112 wrote to memory of 3640 3112 zilC9049.exe ku715533.exe PID 3112 wrote to memory of 3640 3112 zilC9049.exe ku715533.exe PID 2032 wrote to memory of 1940 2032 3d989326b86fe2f1884850f81c8227f3b6ab063ed6c77bf8e7fff0a9ee8c4ecb.exe lr592450.exe PID 2032 wrote to memory of 1940 2032 3d989326b86fe2f1884850f81c8227f3b6ab063ed6c77bf8e7fff0a9ee8c4ecb.exe lr592450.exe PID 2032 wrote to memory of 1940 2032 3d989326b86fe2f1884850f81c8227f3b6ab063ed6c77bf8e7fff0a9ee8c4ecb.exe lr592450.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d989326b86fe2f1884850f81c8227f3b6ab063ed6c77bf8e7fff0a9ee8c4ecb.exe"C:\Users\Admin\AppData\Local\Temp\3d989326b86fe2f1884850f81c8227f3b6ab063ed6c77bf8e7fff0a9ee8c4ecb.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zilC9049.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zilC9049.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr011746.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr011746.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku715533.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku715533.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 13604⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr592450.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr592450.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3640 -ip 36401⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr592450.exeFilesize
175KB
MD544319c9326834f0da3afdb98f2a17daa
SHA1902f06799dfc6971867ccf1b60b7b4d53ddc5b31
SHA2568b9fa3b3205e559d01f787b5e76ea0c033cab4996e85213403c12ad7a3adc470
SHA512e856d446abeb45abc0f36d7ab4b54074e284ee87604e979202d480c53d61c41fdf5307953dee43006fa18855a8edb1576ae2587debc276c2c0dbf8fd7298a2ee
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr592450.exeFilesize
175KB
MD544319c9326834f0da3afdb98f2a17daa
SHA1902f06799dfc6971867ccf1b60b7b4d53ddc5b31
SHA2568b9fa3b3205e559d01f787b5e76ea0c033cab4996e85213403c12ad7a3adc470
SHA512e856d446abeb45abc0f36d7ab4b54074e284ee87604e979202d480c53d61c41fdf5307953dee43006fa18855a8edb1576ae2587debc276c2c0dbf8fd7298a2ee
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zilC9049.exeFilesize
391KB
MD5e664ed467ecb5cde81842dda6ae26ce0
SHA1117194aded767fdb601d79247c1be4fe02f260c6
SHA256c02d96548cb6b3d7936096b1625adaeb0f56bc4acd0855ab8e9aff130e1cc8cc
SHA51200c38af4820ca7ee6a419f77d05d51eb432e2220fa5585a2431b01efbb529f9e0e1fc19dab413ecc7a9a468d8c9a5503e1c37939ed69c5c4d7222cb89ff75d7f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zilC9049.exeFilesize
391KB
MD5e664ed467ecb5cde81842dda6ae26ce0
SHA1117194aded767fdb601d79247c1be4fe02f260c6
SHA256c02d96548cb6b3d7936096b1625adaeb0f56bc4acd0855ab8e9aff130e1cc8cc
SHA51200c38af4820ca7ee6a419f77d05d51eb432e2220fa5585a2431b01efbb529f9e0e1fc19dab413ecc7a9a468d8c9a5503e1c37939ed69c5c4d7222cb89ff75d7f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr011746.exeFilesize
11KB
MD56c63e91fa1bf39ea0f7bc72129471179
SHA14044fb32e3e4b16244a8c61398335278107375b8
SHA2563a593f96fd1f6b6cd781f36637348b8e03ffed900086149fd4cc37a2c0b14b06
SHA512c97d4503e7439735bb2e14a4dfa254855e5437001f13693b6649f827c45a04d823e27f359f4411c07578155c86c62a02dc42f1382428d619db73b198719d3544
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr011746.exeFilesize
11KB
MD56c63e91fa1bf39ea0f7bc72129471179
SHA14044fb32e3e4b16244a8c61398335278107375b8
SHA2563a593f96fd1f6b6cd781f36637348b8e03ffed900086149fd4cc37a2c0b14b06
SHA512c97d4503e7439735bb2e14a4dfa254855e5437001f13693b6649f827c45a04d823e27f359f4411c07578155c86c62a02dc42f1382428d619db73b198719d3544
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku715533.exeFilesize
318KB
MD572fda53adaaa7ac9334260b818d79e08
SHA1b6e1efb9bf47fa4537dcd8ca60df485dd819f800
SHA256f0dbc6be59b7d8e4a2007cb5ff1eb47a2f1a838eed378b8ffd48efe86ee7b9ed
SHA51247a8536508ec9b97b70408f2a5a8e05c7585c412f214eef2078265e86da838a8bcd09bbb386b1a63537493c6b67897fe08b6c8cce5ee58675c5055fe85bc0f5d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku715533.exeFilesize
318KB
MD572fda53adaaa7ac9334260b818d79e08
SHA1b6e1efb9bf47fa4537dcd8ca60df485dd819f800
SHA256f0dbc6be59b7d8e4a2007cb5ff1eb47a2f1a838eed378b8ffd48efe86ee7b9ed
SHA51247a8536508ec9b97b70408f2a5a8e05c7585c412f214eef2078265e86da838a8bcd09bbb386b1a63537493c6b67897fe08b6c8cce5ee58675c5055fe85bc0f5d
-
memory/1940-1085-0x0000000000A30000-0x0000000000A62000-memory.dmpFilesize
200KB
-
memory/1940-1086-0x00000000052B0000-0x00000000052C0000-memory.dmpFilesize
64KB
-
memory/1940-1087-0x00000000052B0000-0x00000000052C0000-memory.dmpFilesize
64KB
-
memory/2780-147-0x0000000000D20000-0x0000000000D2A000-memory.dmpFilesize
40KB
-
memory/3640-189-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3640-203-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3640-157-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/3640-156-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3640-158-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/3640-160-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/3640-161-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3640-163-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3640-165-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3640-167-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3640-169-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3640-171-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3640-173-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3640-175-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3640-177-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3640-179-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3640-181-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3640-183-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3640-185-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3640-187-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3640-154-0x0000000004CB0000-0x0000000005254000-memory.dmpFilesize
5.6MB
-
memory/3640-191-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3640-195-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3640-197-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3640-193-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3640-199-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3640-201-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3640-155-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3640-205-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3640-207-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3640-209-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3640-211-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3640-213-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3640-215-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3640-219-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3640-217-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3640-221-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3640-1064-0x0000000005260000-0x0000000005878000-memory.dmpFilesize
6.1MB
-
memory/3640-1065-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/3640-1066-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/3640-1067-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/3640-1068-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/3640-1070-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/3640-1071-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/3640-1072-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/3640-1073-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/3640-1074-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/3640-1075-0x0000000006700000-0x0000000006776000-memory.dmpFilesize
472KB
-
memory/3640-153-0x0000000000760000-0x00000000007AB000-memory.dmpFilesize
300KB
-
memory/3640-1076-0x0000000006780000-0x00000000067D0000-memory.dmpFilesize
320KB
-
memory/3640-1077-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/3640-1078-0x0000000006810000-0x00000000069D2000-memory.dmpFilesize
1.8MB
-
memory/3640-1079-0x00000000069E0000-0x0000000006F0C000-memory.dmpFilesize
5.2MB