Analysis
-
max time kernel
94s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 19:32
Static task
static1
Behavioral task
behavioral1
Sample
3d0b9155086a78a92911be51a867a8dcae294d6a3f7e8771e71b361118ea2820.exe
Resource
win10v2004-20230220-en
General
-
Target
3d0b9155086a78a92911be51a867a8dcae294d6a3f7e8771e71b361118ea2820.exe
-
Size
534KB
-
MD5
e0411349621ffabc0c9175bf3a5c47c7
-
SHA1
d7a9f20f267e7246325b95cab76e51ec18680c47
-
SHA256
3d0b9155086a78a92911be51a867a8dcae294d6a3f7e8771e71b361118ea2820
-
SHA512
c4d9c437e28cc91859d91c88afdf8feeb5fe798c5a6207e295fffef61b2beacfa09c528bdf7b97633b2dd948e65706a25ffe06c9ddab26fb7abf4e48ca1bca7c
-
SSDEEP
12288:/Mr4y90wE9zA3dE8entWeW2XOblr3dQ4ej7N1r:jye9zAq8etQLb7Q4ef
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr270425.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr270425.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr270425.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr270425.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr270425.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr270425.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr270425.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/4880-158-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/4880-159-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/4880-161-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/4880-163-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/4880-165-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/4880-167-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/4880-169-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/4880-171-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/4880-173-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/4880-175-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/4880-177-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/4880-179-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/4880-181-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/4880-183-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/4880-185-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/4880-187-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/4880-189-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/4880-191-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/4880-193-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/4880-195-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/4880-197-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/4880-199-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/4880-201-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/4880-203-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/4880-205-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/4880-207-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/4880-209-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/4880-211-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/4880-213-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/4880-215-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/4880-217-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/4880-219-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/4880-221-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
ziLn4654.exejr270425.exeku027718.exelr495848.exepid process 1420 ziLn4654.exe 1820 jr270425.exe 4880 ku027718.exe 2144 lr495848.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr270425.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr270425.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
3d0b9155086a78a92911be51a867a8dcae294d6a3f7e8771e71b361118ea2820.exeziLn4654.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 3d0b9155086a78a92911be51a867a8dcae294d6a3f7e8771e71b361118ea2820.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 3d0b9155086a78a92911be51a867a8dcae294d6a3f7e8771e71b361118ea2820.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziLn4654.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziLn4654.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 432 4880 WerFault.exe ku027718.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr270425.exeku027718.exelr495848.exepid process 1820 jr270425.exe 1820 jr270425.exe 4880 ku027718.exe 4880 ku027718.exe 2144 lr495848.exe 2144 lr495848.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr270425.exeku027718.exelr495848.exedescription pid process Token: SeDebugPrivilege 1820 jr270425.exe Token: SeDebugPrivilege 4880 ku027718.exe Token: SeDebugPrivilege 2144 lr495848.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
3d0b9155086a78a92911be51a867a8dcae294d6a3f7e8771e71b361118ea2820.exeziLn4654.exedescription pid process target process PID 1092 wrote to memory of 1420 1092 3d0b9155086a78a92911be51a867a8dcae294d6a3f7e8771e71b361118ea2820.exe ziLn4654.exe PID 1092 wrote to memory of 1420 1092 3d0b9155086a78a92911be51a867a8dcae294d6a3f7e8771e71b361118ea2820.exe ziLn4654.exe PID 1092 wrote to memory of 1420 1092 3d0b9155086a78a92911be51a867a8dcae294d6a3f7e8771e71b361118ea2820.exe ziLn4654.exe PID 1420 wrote to memory of 1820 1420 ziLn4654.exe jr270425.exe PID 1420 wrote to memory of 1820 1420 ziLn4654.exe jr270425.exe PID 1420 wrote to memory of 4880 1420 ziLn4654.exe ku027718.exe PID 1420 wrote to memory of 4880 1420 ziLn4654.exe ku027718.exe PID 1420 wrote to memory of 4880 1420 ziLn4654.exe ku027718.exe PID 1092 wrote to memory of 2144 1092 3d0b9155086a78a92911be51a867a8dcae294d6a3f7e8771e71b361118ea2820.exe lr495848.exe PID 1092 wrote to memory of 2144 1092 3d0b9155086a78a92911be51a867a8dcae294d6a3f7e8771e71b361118ea2820.exe lr495848.exe PID 1092 wrote to memory of 2144 1092 3d0b9155086a78a92911be51a867a8dcae294d6a3f7e8771e71b361118ea2820.exe lr495848.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d0b9155086a78a92911be51a867a8dcae294d6a3f7e8771e71b361118ea2820.exe"C:\Users\Admin\AppData\Local\Temp\3d0b9155086a78a92911be51a867a8dcae294d6a3f7e8771e71b361118ea2820.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziLn4654.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziLn4654.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr270425.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr270425.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku027718.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku027718.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 13404⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr495848.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr495848.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4880 -ip 48801⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr495848.exeFilesize
175KB
MD5478a25483c56a6af10cb1ccaa516b47f
SHA1d5c652a99af5ed75035a7804bb30a69a607e2740
SHA2566f7858162a428427dbfa75ce1893c56681472292b00c4397e6936fa71b6ceaea
SHA51241c418e69ee59e7f9b5a70a5ebde5315133bb9a619fbbcb099453b6062bd0ddd18365b9271bea14bb98282d764caae54d1e174f7036144a87033e77707859424
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr495848.exeFilesize
175KB
MD5478a25483c56a6af10cb1ccaa516b47f
SHA1d5c652a99af5ed75035a7804bb30a69a607e2740
SHA2566f7858162a428427dbfa75ce1893c56681472292b00c4397e6936fa71b6ceaea
SHA51241c418e69ee59e7f9b5a70a5ebde5315133bb9a619fbbcb099453b6062bd0ddd18365b9271bea14bb98282d764caae54d1e174f7036144a87033e77707859424
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziLn4654.exeFilesize
392KB
MD58b608803137d50549ae9146632a2d6fc
SHA107de1f1ae077b26a2c6061beca085c20d07bfe19
SHA256da78b1540ff7863e7436619789ad7aecf9910e43f615b9341e7f4cbfa37f2abf
SHA512c9b2e55594c2ce45a7d88be8fbd2611ac8bda42e461e822845c832beac61e0330959432965635d7058b2f8589de8daa20820d7171c74ee207cb7838e06bf7c2a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziLn4654.exeFilesize
392KB
MD58b608803137d50549ae9146632a2d6fc
SHA107de1f1ae077b26a2c6061beca085c20d07bfe19
SHA256da78b1540ff7863e7436619789ad7aecf9910e43f615b9341e7f4cbfa37f2abf
SHA512c9b2e55594c2ce45a7d88be8fbd2611ac8bda42e461e822845c832beac61e0330959432965635d7058b2f8589de8daa20820d7171c74ee207cb7838e06bf7c2a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr270425.exeFilesize
11KB
MD50c0de871894c865dc125585cb28e6421
SHA171ef70f292bd5e642dd59b8eea5c947745f25a34
SHA25650d72be66239677b18fe54b0020e3a47374554a1c317879e7219da84368d18d3
SHA512019e0000c4ca687ee1af2871140c3b268d93392fa6298c27029ff0d7bfd93d5be6b12d3cf8ca7cd2dfa11dcede69e57c7c9fb1e899636f51c302bc267e435dd6
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr270425.exeFilesize
11KB
MD50c0de871894c865dc125585cb28e6421
SHA171ef70f292bd5e642dd59b8eea5c947745f25a34
SHA25650d72be66239677b18fe54b0020e3a47374554a1c317879e7219da84368d18d3
SHA512019e0000c4ca687ee1af2871140c3b268d93392fa6298c27029ff0d7bfd93d5be6b12d3cf8ca7cd2dfa11dcede69e57c7c9fb1e899636f51c302bc267e435dd6
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku027718.exeFilesize
318KB
MD5a48d56225da32d2970963b8a4b7081a6
SHA167bc2b9aa4846bb41b9d3096fe854413b66c849e
SHA2564cad52cfa55bfcb49ddcb9d419a26a8f1ad5105f88724a529959e65e6a59bf86
SHA5123657f298186fa9d93bdeb1faaeb5c937c28ddf67259ed173e9deefdc9258ffac6c7c42fc001b919d3a08d314913d6cd473cae53f86d28a5442668bad9628717c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku027718.exeFilesize
318KB
MD5a48d56225da32d2970963b8a4b7081a6
SHA167bc2b9aa4846bb41b9d3096fe854413b66c849e
SHA2564cad52cfa55bfcb49ddcb9d419a26a8f1ad5105f88724a529959e65e6a59bf86
SHA5123657f298186fa9d93bdeb1faaeb5c937c28ddf67259ed173e9deefdc9258ffac6c7c42fc001b919d3a08d314913d6cd473cae53f86d28a5442668bad9628717c
-
memory/1820-147-0x0000000000CC0000-0x0000000000CCA000-memory.dmpFilesize
40KB
-
memory/2144-1085-0x0000000000570000-0x00000000005A2000-memory.dmpFilesize
200KB
-
memory/2144-1086-0x0000000004E40000-0x0000000004E50000-memory.dmpFilesize
64KB
-
memory/4880-189-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/4880-201-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/4880-155-0x0000000004C20000-0x0000000004C30000-memory.dmpFilesize
64KB
-
memory/4880-156-0x0000000004C20000-0x0000000004C30000-memory.dmpFilesize
64KB
-
memory/4880-157-0x0000000004C20000-0x0000000004C30000-memory.dmpFilesize
64KB
-
memory/4880-158-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/4880-159-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/4880-161-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/4880-163-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/4880-165-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/4880-167-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/4880-169-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/4880-171-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/4880-173-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/4880-175-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/4880-177-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/4880-179-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/4880-181-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/4880-183-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/4880-185-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/4880-187-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/4880-153-0x0000000002160000-0x00000000021AB000-memory.dmpFilesize
300KB
-
memory/4880-191-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/4880-193-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/4880-195-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/4880-197-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/4880-199-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/4880-154-0x0000000004C30000-0x00000000051D4000-memory.dmpFilesize
5.6MB
-
memory/4880-203-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/4880-205-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/4880-207-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/4880-209-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/4880-211-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/4880-213-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/4880-215-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/4880-217-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/4880-219-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/4880-221-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/4880-1064-0x00000000052E0000-0x00000000058F8000-memory.dmpFilesize
6.1MB
-
memory/4880-1065-0x0000000005900000-0x0000000005A0A000-memory.dmpFilesize
1.0MB
-
memory/4880-1066-0x0000000004BF0000-0x0000000004C02000-memory.dmpFilesize
72KB
-
memory/4880-1067-0x0000000005A10000-0x0000000005A4C000-memory.dmpFilesize
240KB
-
memory/4880-1068-0x0000000004C20000-0x0000000004C30000-memory.dmpFilesize
64KB
-
memory/4880-1070-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/4880-1071-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/4880-1072-0x0000000004C20000-0x0000000004C30000-memory.dmpFilesize
64KB
-
memory/4880-1073-0x0000000004C20000-0x0000000004C30000-memory.dmpFilesize
64KB
-
memory/4880-1074-0x0000000004C20000-0x0000000004C30000-memory.dmpFilesize
64KB
-
memory/4880-1075-0x00000000064B0000-0x0000000006672000-memory.dmpFilesize
1.8MB
-
memory/4880-1076-0x0000000006680000-0x0000000006BAC000-memory.dmpFilesize
5.2MB
-
memory/4880-1077-0x0000000004C20000-0x0000000004C30000-memory.dmpFilesize
64KB
-
memory/4880-1078-0x0000000006D00000-0x0000000006D76000-memory.dmpFilesize
472KB
-
memory/4880-1079-0x0000000006D80000-0x0000000006DD0000-memory.dmpFilesize
320KB