Analysis
-
max time kernel
99s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 19:26
Static task
static1
Behavioral task
behavioral1
Sample
4952ed9cd0b6be445edddef3131f2eba4a6a111c03b48cc990a282fe26549b29.exe
Resource
win10v2004-20230220-en
General
-
Target
4952ed9cd0b6be445edddef3131f2eba4a6a111c03b48cc990a282fe26549b29.exe
-
Size
533KB
-
MD5
d941e9109e4f04c50ca27a4cc8779776
-
SHA1
debe1461a5687210d10d2ba6ae60fbb6982b68cd
-
SHA256
4952ed9cd0b6be445edddef3131f2eba4a6a111c03b48cc990a282fe26549b29
-
SHA512
d9dee4639fef02e86e8b063b12172f97c9569f67a939508ca0d145111210777fd4cb30fb407d023a03fba442256d9e3a953b62a1ce2a37288d6f175dd7e2c00f
-
SSDEEP
12288:9MrPy90gMTfF6DWaG6r8DDueceWxTOburar8iGyR8H:myjEfycKcbbYitRQ
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr138816.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr138816.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr138816.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr138816.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr138816.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr138816.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr138816.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/1904-158-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1904-159-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1904-161-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1904-163-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1904-165-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1904-167-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1904-169-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1904-171-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1904-173-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1904-175-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1904-177-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1904-179-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1904-181-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1904-183-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1904-185-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1904-187-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1904-189-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1904-191-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1904-193-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1904-195-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1904-197-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1904-199-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1904-201-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1904-203-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1904-205-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1904-207-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1904-209-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1904-211-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1904-213-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1904-215-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1904-217-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1904-219-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1904-221-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
zixK2219.exejr138816.exeku586324.exelr031045.exepid process 1400 zixK2219.exe 2436 jr138816.exe 1904 ku586324.exe 1988 lr031045.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr138816.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr138816.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
4952ed9cd0b6be445edddef3131f2eba4a6a111c03b48cc990a282fe26549b29.exezixK2219.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 4952ed9cd0b6be445edddef3131f2eba4a6a111c03b48cc990a282fe26549b29.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 4952ed9cd0b6be445edddef3131f2eba4a6a111c03b48cc990a282fe26549b29.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zixK2219.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zixK2219.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3284 1904 WerFault.exe ku586324.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr138816.exeku586324.exelr031045.exepid process 2436 jr138816.exe 2436 jr138816.exe 1904 ku586324.exe 1904 ku586324.exe 1988 lr031045.exe 1988 lr031045.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr138816.exeku586324.exelr031045.exedescription pid process Token: SeDebugPrivilege 2436 jr138816.exe Token: SeDebugPrivilege 1904 ku586324.exe Token: SeDebugPrivilege 1988 lr031045.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
4952ed9cd0b6be445edddef3131f2eba4a6a111c03b48cc990a282fe26549b29.exezixK2219.exedescription pid process target process PID 2932 wrote to memory of 1400 2932 4952ed9cd0b6be445edddef3131f2eba4a6a111c03b48cc990a282fe26549b29.exe zixK2219.exe PID 2932 wrote to memory of 1400 2932 4952ed9cd0b6be445edddef3131f2eba4a6a111c03b48cc990a282fe26549b29.exe zixK2219.exe PID 2932 wrote to memory of 1400 2932 4952ed9cd0b6be445edddef3131f2eba4a6a111c03b48cc990a282fe26549b29.exe zixK2219.exe PID 1400 wrote to memory of 2436 1400 zixK2219.exe jr138816.exe PID 1400 wrote to memory of 2436 1400 zixK2219.exe jr138816.exe PID 1400 wrote to memory of 1904 1400 zixK2219.exe ku586324.exe PID 1400 wrote to memory of 1904 1400 zixK2219.exe ku586324.exe PID 1400 wrote to memory of 1904 1400 zixK2219.exe ku586324.exe PID 2932 wrote to memory of 1988 2932 4952ed9cd0b6be445edddef3131f2eba4a6a111c03b48cc990a282fe26549b29.exe lr031045.exe PID 2932 wrote to memory of 1988 2932 4952ed9cd0b6be445edddef3131f2eba4a6a111c03b48cc990a282fe26549b29.exe lr031045.exe PID 2932 wrote to memory of 1988 2932 4952ed9cd0b6be445edddef3131f2eba4a6a111c03b48cc990a282fe26549b29.exe lr031045.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4952ed9cd0b6be445edddef3131f2eba4a6a111c03b48cc990a282fe26549b29.exe"C:\Users\Admin\AppData\Local\Temp\4952ed9cd0b6be445edddef3131f2eba4a6a111c03b48cc990a282fe26549b29.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zixK2219.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zixK2219.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr138816.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr138816.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku586324.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku586324.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 17084⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr031045.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr031045.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1904 -ip 19041⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr031045.exeFilesize
175KB
MD580dcff3c2cdfebcf3c02f2009ad15cf4
SHA1172947bbfeda33439952a4adc2f8eda8ea67fbf3
SHA256235ff838d82d603ccbb07b65d3fe7dcc6313a7b41b1b88235d0a38edcddaab06
SHA5126aff27bf35e63a6dfbf732f621a5a4e827d45090358715cb431d148b5fed92d46b9c336e6ebd4f4860653ff9a1cf39353df6d0ae32615243d1650ea4941b84b7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr031045.exeFilesize
175KB
MD580dcff3c2cdfebcf3c02f2009ad15cf4
SHA1172947bbfeda33439952a4adc2f8eda8ea67fbf3
SHA256235ff838d82d603ccbb07b65d3fe7dcc6313a7b41b1b88235d0a38edcddaab06
SHA5126aff27bf35e63a6dfbf732f621a5a4e827d45090358715cb431d148b5fed92d46b9c336e6ebd4f4860653ff9a1cf39353df6d0ae32615243d1650ea4941b84b7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zixK2219.exeFilesize
391KB
MD53e875819e9b16c46adbd085dec1fe435
SHA14261c6df219eabed0f475c6d4a450e3fb4b0ee42
SHA256705f32ba80c102aeb0fc71cdc16606e3487a2033c30113ed42baf0ff38f14157
SHA512cb6bea0af8fc976fa8ce880829a613430bb1ef5b67310f4c4d94397ef516d45840cceb5bbbcc7114145019716f94f0f07cf35fe14c28f5aa910e2bb2b8249ca2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zixK2219.exeFilesize
391KB
MD53e875819e9b16c46adbd085dec1fe435
SHA14261c6df219eabed0f475c6d4a450e3fb4b0ee42
SHA256705f32ba80c102aeb0fc71cdc16606e3487a2033c30113ed42baf0ff38f14157
SHA512cb6bea0af8fc976fa8ce880829a613430bb1ef5b67310f4c4d94397ef516d45840cceb5bbbcc7114145019716f94f0f07cf35fe14c28f5aa910e2bb2b8249ca2
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr138816.exeFilesize
11KB
MD5b42dd8589d88b328d4082f9a1456cde5
SHA165fdc6e25cd4099451e630a1993dae8be0c5868c
SHA256208c8355b36dac2698c05e8aecc8185d70293da2709e8a262c7b6a3fe8475f6d
SHA512f73de5e1ef14befa9f1b820f96afac00016befe4d56a257da8f3a546b6cea96df2cc40fa9dcdb5dcb9fa0640969c77b22465bda8d1cc84903f9594a1ac41f8b8
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr138816.exeFilesize
11KB
MD5b42dd8589d88b328d4082f9a1456cde5
SHA165fdc6e25cd4099451e630a1993dae8be0c5868c
SHA256208c8355b36dac2698c05e8aecc8185d70293da2709e8a262c7b6a3fe8475f6d
SHA512f73de5e1ef14befa9f1b820f96afac00016befe4d56a257da8f3a546b6cea96df2cc40fa9dcdb5dcb9fa0640969c77b22465bda8d1cc84903f9594a1ac41f8b8
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku586324.exeFilesize
318KB
MD5cd343c75a14821c2edcc0ab2d708235d
SHA1948ab50c43c56940f0dad256427b987dd945a347
SHA256e0af078f149affe3e7aaacd5991d7a3c9c42446f58e63954e3bd52c19d01b320
SHA5120888f80cc2bc484d1b06d6e95ced52ed4d57f827b90023d2a523ead99c395d0dec4e6ecd9d93a8edcc4c76be559a8350fba49809290ca676245c6884085bf439
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku586324.exeFilesize
318KB
MD5cd343c75a14821c2edcc0ab2d708235d
SHA1948ab50c43c56940f0dad256427b987dd945a347
SHA256e0af078f149affe3e7aaacd5991d7a3c9c42446f58e63954e3bd52c19d01b320
SHA5120888f80cc2bc484d1b06d6e95ced52ed4d57f827b90023d2a523ead99c395d0dec4e6ecd9d93a8edcc4c76be559a8350fba49809290ca676245c6884085bf439
-
memory/1904-153-0x0000000001FF0000-0x000000000203B000-memory.dmpFilesize
300KB
-
memory/1904-154-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB
-
memory/1904-155-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB
-
memory/1904-156-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB
-
memory/1904-157-0x0000000004C90000-0x0000000005234000-memory.dmpFilesize
5.6MB
-
memory/1904-158-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1904-159-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1904-161-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1904-163-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1904-165-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1904-167-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1904-169-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1904-171-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1904-173-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1904-175-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1904-177-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1904-179-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1904-181-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1904-183-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1904-185-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1904-187-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1904-189-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1904-191-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1904-193-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1904-195-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1904-197-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1904-199-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1904-201-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1904-203-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1904-205-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1904-207-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1904-209-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1904-211-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1904-213-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1904-215-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1904-217-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1904-219-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1904-221-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1904-1065-0x0000000005240000-0x0000000005858000-memory.dmpFilesize
6.1MB
-
memory/1904-1066-0x0000000005860000-0x000000000596A000-memory.dmpFilesize
1.0MB
-
memory/1904-1067-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB
-
memory/1904-1068-0x0000000004BB0000-0x0000000004BC2000-memory.dmpFilesize
72KB
-
memory/1904-1069-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB
-
memory/1904-1070-0x0000000004BD0000-0x0000000004C0C000-memory.dmpFilesize
240KB
-
memory/1904-1071-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB
-
memory/1904-1072-0x0000000005BB0000-0x0000000005C16000-memory.dmpFilesize
408KB
-
memory/1904-1073-0x0000000006280000-0x0000000006312000-memory.dmpFilesize
584KB
-
memory/1904-1075-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB
-
memory/1904-1076-0x00000000076D0000-0x0000000007892000-memory.dmpFilesize
1.8MB
-
memory/1904-1077-0x00000000078A0000-0x0000000007DCC000-memory.dmpFilesize
5.2MB
-
memory/1904-1078-0x00000000064A0000-0x0000000006516000-memory.dmpFilesize
472KB
-
memory/1904-1079-0x0000000006520000-0x0000000006570000-memory.dmpFilesize
320KB
-
memory/1988-1085-0x0000000000F70000-0x0000000000FA2000-memory.dmpFilesize
200KB
-
memory/1988-1086-0x0000000005B70000-0x0000000005B80000-memory.dmpFilesize
64KB
-
memory/2436-147-0x0000000000D70000-0x0000000000D7A000-memory.dmpFilesize
40KB