Analysis
-
max time kernel
138s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 19:29
Static task
static1
Behavioral task
behavioral1
Sample
09db2eafb230b6d4ec71389dfd682be9d9e37cb630a1fad2d38eb0e58b42c8e9.exe
Resource
win10v2004-20230220-en
General
-
Target
09db2eafb230b6d4ec71389dfd682be9d9e37cb630a1fad2d38eb0e58b42c8e9.exe
-
Size
673KB
-
MD5
4afb11aa81194dad25d3f6ffae31b0b5
-
SHA1
233d5971c002714a6c1febad61b658dc9629baf9
-
SHA256
09db2eafb230b6d4ec71389dfd682be9d9e37cb630a1fad2d38eb0e58b42c8e9
-
SHA512
b06e3d2e0f09462389235369ae16fdf393ace6708d2de8b5a9bbd056467d7b9333a724c2dbd67c896865417706593a320851773ac49e6bab1cdf3ee115f0fcf3
-
SSDEEP
12288:OMrNy904BYnjH5kfO+DTvjNznR6PITHo+FKCEug0IvL8TObZr9m5YG5e:vyfByL6fLvjhR6sHJ8u/IbvYYGg
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro9721.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro9721.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro9721.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro9721.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro9721.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro9721.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro9721.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/2128-190-0x0000000002600000-0x000000000263F000-memory.dmp family_redline behavioral1/memory/2128-189-0x0000000002600000-0x000000000263F000-memory.dmp family_redline behavioral1/memory/2128-192-0x0000000002600000-0x000000000263F000-memory.dmp family_redline behavioral1/memory/2128-194-0x0000000002600000-0x000000000263F000-memory.dmp family_redline behavioral1/memory/2128-196-0x0000000002600000-0x000000000263F000-memory.dmp family_redline behavioral1/memory/2128-198-0x0000000002600000-0x000000000263F000-memory.dmp family_redline behavioral1/memory/2128-200-0x0000000002600000-0x000000000263F000-memory.dmp family_redline behavioral1/memory/2128-202-0x0000000002600000-0x000000000263F000-memory.dmp family_redline behavioral1/memory/2128-204-0x0000000002600000-0x000000000263F000-memory.dmp family_redline behavioral1/memory/2128-206-0x0000000002600000-0x000000000263F000-memory.dmp family_redline behavioral1/memory/2128-208-0x0000000002600000-0x000000000263F000-memory.dmp family_redline behavioral1/memory/2128-210-0x0000000002600000-0x000000000263F000-memory.dmp family_redline behavioral1/memory/2128-212-0x0000000002600000-0x000000000263F000-memory.dmp family_redline behavioral1/memory/2128-214-0x0000000002600000-0x000000000263F000-memory.dmp family_redline behavioral1/memory/2128-216-0x0000000002600000-0x000000000263F000-memory.dmp family_redline behavioral1/memory/2128-218-0x0000000002600000-0x000000000263F000-memory.dmp family_redline behavioral1/memory/2128-220-0x0000000002600000-0x000000000263F000-memory.dmp family_redline behavioral1/memory/2128-222-0x0000000002600000-0x000000000263F000-memory.dmp family_redline behavioral1/memory/2128-310-0x0000000004C50000-0x0000000004C60000-memory.dmp family_redline behavioral1/memory/2128-1109-0x0000000004C50000-0x0000000004C60000-memory.dmp family_redline behavioral1/memory/2128-1110-0x0000000004C50000-0x0000000004C60000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un867105.exepro9721.exequ1470.exesi956226.exepid process 2764 un867105.exe 4732 pro9721.exe 2128 qu1470.exe 4300 si956226.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro9721.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro9721.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro9721.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
09db2eafb230b6d4ec71389dfd682be9d9e37cb630a1fad2d38eb0e58b42c8e9.exeun867105.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 09db2eafb230b6d4ec71389dfd682be9d9e37cb630a1fad2d38eb0e58b42c8e9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 09db2eafb230b6d4ec71389dfd682be9d9e37cb630a1fad2d38eb0e58b42c8e9.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un867105.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un867105.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 1412 sc.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4900 4732 WerFault.exe pro9721.exe 2788 2128 WerFault.exe qu1470.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro9721.exequ1470.exesi956226.exepid process 4732 pro9721.exe 4732 pro9721.exe 2128 qu1470.exe 2128 qu1470.exe 4300 si956226.exe 4300 si956226.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro9721.exequ1470.exesi956226.exedescription pid process Token: SeDebugPrivilege 4732 pro9721.exe Token: SeDebugPrivilege 2128 qu1470.exe Token: SeDebugPrivilege 4300 si956226.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
09db2eafb230b6d4ec71389dfd682be9d9e37cb630a1fad2d38eb0e58b42c8e9.exeun867105.exedescription pid process target process PID 5012 wrote to memory of 2764 5012 09db2eafb230b6d4ec71389dfd682be9d9e37cb630a1fad2d38eb0e58b42c8e9.exe un867105.exe PID 5012 wrote to memory of 2764 5012 09db2eafb230b6d4ec71389dfd682be9d9e37cb630a1fad2d38eb0e58b42c8e9.exe un867105.exe PID 5012 wrote to memory of 2764 5012 09db2eafb230b6d4ec71389dfd682be9d9e37cb630a1fad2d38eb0e58b42c8e9.exe un867105.exe PID 2764 wrote to memory of 4732 2764 un867105.exe pro9721.exe PID 2764 wrote to memory of 4732 2764 un867105.exe pro9721.exe PID 2764 wrote to memory of 4732 2764 un867105.exe pro9721.exe PID 2764 wrote to memory of 2128 2764 un867105.exe qu1470.exe PID 2764 wrote to memory of 2128 2764 un867105.exe qu1470.exe PID 2764 wrote to memory of 2128 2764 un867105.exe qu1470.exe PID 5012 wrote to memory of 4300 5012 09db2eafb230b6d4ec71389dfd682be9d9e37cb630a1fad2d38eb0e58b42c8e9.exe si956226.exe PID 5012 wrote to memory of 4300 5012 09db2eafb230b6d4ec71389dfd682be9d9e37cb630a1fad2d38eb0e58b42c8e9.exe si956226.exe PID 5012 wrote to memory of 4300 5012 09db2eafb230b6d4ec71389dfd682be9d9e37cb630a1fad2d38eb0e58b42c8e9.exe si956226.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\09db2eafb230b6d4ec71389dfd682be9d9e37cb630a1fad2d38eb0e58b42c8e9.exe"C:\Users\Admin\AppData\Local\Temp\09db2eafb230b6d4ec71389dfd682be9d9e37cb630a1fad2d38eb0e58b42c8e9.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un867105.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un867105.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9721.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9721.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 10844⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1470.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1470.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 17924⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si956226.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si956226.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4732 -ip 47321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2128 -ip 21281⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si956226.exeFilesize
175KB
MD5552df1906b81676742d9d15af19d31cf
SHA128241a3e38c99214a4346c34c7f2e0af72edca39
SHA256c645b7ffb268b63543a4e8fae97a992d3847fbe65fc190f873e7c3a914b7ec32
SHA512631a95f7d39abc5b14e20de9dae796ffc2082fdc6aa91350de321049bbb1b13201611e8c6370f2bcb15394f7c75b9338db22134a477ddc8446a4dadb332e0110
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si956226.exeFilesize
175KB
MD5552df1906b81676742d9d15af19d31cf
SHA128241a3e38c99214a4346c34c7f2e0af72edca39
SHA256c645b7ffb268b63543a4e8fae97a992d3847fbe65fc190f873e7c3a914b7ec32
SHA512631a95f7d39abc5b14e20de9dae796ffc2082fdc6aa91350de321049bbb1b13201611e8c6370f2bcb15394f7c75b9338db22134a477ddc8446a4dadb332e0110
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un867105.exeFilesize
531KB
MD514c9363c84a659b11571e5ebea832adf
SHA14c9e873d709cc519152693b078fbe09ced2d947b
SHA256ac9108b0511c3b1f28c4e77060f79409434cb05485e25508d9077780dd064d6b
SHA512abc8750b1a681b8c4b61c5689b65bbcbb23fe0001ec8c24891ad43f1a92fc6a0283c481d63c6593ba74fc9fc970453912452470a54b38ea15f1a2b54ddbdb08c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un867105.exeFilesize
531KB
MD514c9363c84a659b11571e5ebea832adf
SHA14c9e873d709cc519152693b078fbe09ced2d947b
SHA256ac9108b0511c3b1f28c4e77060f79409434cb05485e25508d9077780dd064d6b
SHA512abc8750b1a681b8c4b61c5689b65bbcbb23fe0001ec8c24891ad43f1a92fc6a0283c481d63c6593ba74fc9fc970453912452470a54b38ea15f1a2b54ddbdb08c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9721.exeFilesize
260KB
MD5b997b49389f9e279f3a55985ce1b358e
SHA1dac6c72e9a1a2af3b0240f7c79013987639ef910
SHA2568624b8845abb207a09412830c75e255950aa19abbeafcfe219be8985ac20f975
SHA512c40142a3da37bf299c17751d9dcaf88b53feef1f86bfbb2516aa4b0b5e3a2bc770726206dad76d368a070846c3474712aa674ffc7b96be8d18649a3b959ede5a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9721.exeFilesize
260KB
MD5b997b49389f9e279f3a55985ce1b358e
SHA1dac6c72e9a1a2af3b0240f7c79013987639ef910
SHA2568624b8845abb207a09412830c75e255950aa19abbeafcfe219be8985ac20f975
SHA512c40142a3da37bf299c17751d9dcaf88b53feef1f86bfbb2516aa4b0b5e3a2bc770726206dad76d368a070846c3474712aa674ffc7b96be8d18649a3b959ede5a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1470.exeFilesize
318KB
MD5dfc983c9a5999879f8e4fdf490accfb8
SHA1d8b71b7c8d6e47a9342aeae4321f1218b2177c00
SHA2567781189b48e65942593373041b3a0aef998f8393c15e7c959f178a993e977379
SHA512f8ab9481872e2fa659859b7e82a4e641d7aca3e021915d39bc75370f353efbd77125f72f48d37679c6c3a42a04c342b539ef451d2fda77667d52ca781e7ea972
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1470.exeFilesize
318KB
MD5dfc983c9a5999879f8e4fdf490accfb8
SHA1d8b71b7c8d6e47a9342aeae4321f1218b2177c00
SHA2567781189b48e65942593373041b3a0aef998f8393c15e7c959f178a993e977379
SHA512f8ab9481872e2fa659859b7e82a4e641d7aca3e021915d39bc75370f353efbd77125f72f48d37679c6c3a42a04c342b539ef451d2fda77667d52ca781e7ea972
-
memory/2128-1099-0x0000000005310000-0x0000000005928000-memory.dmpFilesize
6.1MB
-
memory/2128-1102-0x0000000004C50000-0x0000000004C60000-memory.dmpFilesize
64KB
-
memory/2128-1114-0x0000000004C50000-0x0000000004C60000-memory.dmpFilesize
64KB
-
memory/2128-1113-0x0000000006770000-0x0000000006C9C000-memory.dmpFilesize
5.2MB
-
memory/2128-1112-0x00000000065A0000-0x0000000006762000-memory.dmpFilesize
1.8MB
-
memory/2128-1111-0x0000000004C50000-0x0000000004C60000-memory.dmpFilesize
64KB
-
memory/2128-1110-0x0000000004C50000-0x0000000004C60000-memory.dmpFilesize
64KB
-
memory/2128-1109-0x0000000004C50000-0x0000000004C60000-memory.dmpFilesize
64KB
-
memory/2128-1107-0x0000000006520000-0x0000000006570000-memory.dmpFilesize
320KB
-
memory/2128-1106-0x0000000006490000-0x0000000006506000-memory.dmpFilesize
472KB
-
memory/2128-1105-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/2128-1104-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/2128-1103-0x0000000004C10000-0x0000000004C4C000-memory.dmpFilesize
240KB
-
memory/2128-1101-0x0000000004BF0000-0x0000000004C02000-memory.dmpFilesize
72KB
-
memory/2128-1100-0x0000000005930000-0x0000000005A3A000-memory.dmpFilesize
1.0MB
-
memory/2128-310-0x0000000004C50000-0x0000000004C60000-memory.dmpFilesize
64KB
-
memory/2128-308-0x0000000004C50000-0x0000000004C60000-memory.dmpFilesize
64KB
-
memory/2128-306-0x0000000004C50000-0x0000000004C60000-memory.dmpFilesize
64KB
-
memory/2128-304-0x00000000020E0000-0x000000000212B000-memory.dmpFilesize
300KB
-
memory/2128-222-0x0000000002600000-0x000000000263F000-memory.dmpFilesize
252KB
-
memory/2128-220-0x0000000002600000-0x000000000263F000-memory.dmpFilesize
252KB
-
memory/2128-190-0x0000000002600000-0x000000000263F000-memory.dmpFilesize
252KB
-
memory/2128-189-0x0000000002600000-0x000000000263F000-memory.dmpFilesize
252KB
-
memory/2128-192-0x0000000002600000-0x000000000263F000-memory.dmpFilesize
252KB
-
memory/2128-194-0x0000000002600000-0x000000000263F000-memory.dmpFilesize
252KB
-
memory/2128-196-0x0000000002600000-0x000000000263F000-memory.dmpFilesize
252KB
-
memory/2128-198-0x0000000002600000-0x000000000263F000-memory.dmpFilesize
252KB
-
memory/2128-200-0x0000000002600000-0x000000000263F000-memory.dmpFilesize
252KB
-
memory/2128-202-0x0000000002600000-0x000000000263F000-memory.dmpFilesize
252KB
-
memory/2128-204-0x0000000002600000-0x000000000263F000-memory.dmpFilesize
252KB
-
memory/2128-206-0x0000000002600000-0x000000000263F000-memory.dmpFilesize
252KB
-
memory/2128-208-0x0000000002600000-0x000000000263F000-memory.dmpFilesize
252KB
-
memory/2128-210-0x0000000002600000-0x000000000263F000-memory.dmpFilesize
252KB
-
memory/2128-212-0x0000000002600000-0x000000000263F000-memory.dmpFilesize
252KB
-
memory/2128-214-0x0000000002600000-0x000000000263F000-memory.dmpFilesize
252KB
-
memory/2128-216-0x0000000002600000-0x000000000263F000-memory.dmpFilesize
252KB
-
memory/2128-218-0x0000000002600000-0x000000000263F000-memory.dmpFilesize
252KB
-
memory/4300-1121-0x0000000000EB0000-0x0000000000EE2000-memory.dmpFilesize
200KB
-
memory/4300-1123-0x0000000005A50000-0x0000000005A60000-memory.dmpFilesize
64KB
-
memory/4300-1122-0x0000000005A50000-0x0000000005A60000-memory.dmpFilesize
64KB
-
memory/4732-171-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/4732-167-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/4732-180-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/4732-150-0x0000000004CF0000-0x0000000004D00000-memory.dmpFilesize
64KB
-
memory/4732-179-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/4732-177-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/4732-153-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/4732-175-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/4732-173-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/4732-148-0x0000000002110000-0x000000000213D000-memory.dmpFilesize
180KB
-
memory/4732-169-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/4732-181-0x0000000004CF0000-0x0000000004D00000-memory.dmpFilesize
64KB
-
memory/4732-165-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/4732-163-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/4732-161-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/4732-159-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/4732-157-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/4732-155-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/4732-182-0x0000000004CF0000-0x0000000004D00000-memory.dmpFilesize
64KB
-
memory/4732-151-0x0000000004CF0000-0x0000000004D00000-memory.dmpFilesize
64KB
-
memory/4732-149-0x0000000004D00000-0x00000000052A4000-memory.dmpFilesize
5.6MB
-
memory/4732-184-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/4732-152-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB