Analysis
-
max time kernel
86s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 18:42
Static task
static1
Behavioral task
behavioral1
Sample
0f7fd6f45f56947b6a1e2670cb3f9d3d03f4e4c4d0ed517597745d30659c4107.exe
Resource
win10v2004-20230220-en
General
-
Target
0f7fd6f45f56947b6a1e2670cb3f9d3d03f4e4c4d0ed517597745d30659c4107.exe
-
Size
672KB
-
MD5
9c6507eaddc195b19a8fd5474dee3fcb
-
SHA1
8cab23e3fbb788b8a327711421051c2e96ff369b
-
SHA256
0f7fd6f45f56947b6a1e2670cb3f9d3d03f4e4c4d0ed517597745d30659c4107
-
SHA512
2e0ce161574c09fd87af23ca8756c52f322f47aae51222d63180134f1a1dff634927acf4b5b8a91579ecd91d8a60d19c33b145223a579f7cb7b99a0c30c36d04
-
SSDEEP
12288:MMrky90lUyzwvyGEm0T5cMSzBHpJpcXYvzGomJg+YOEehpqx5fe:Qy8aEm0T5cRnPoYrGoA31Uxxe
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro2302.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro2302.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro2302.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro2302.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro2302.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro2302.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro2302.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/2884-192-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/2884-193-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/2884-195-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/2884-197-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/2884-201-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/2884-199-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/2884-203-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/2884-205-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/2884-215-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/2884-213-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/2884-210-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/2884-217-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/2884-219-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/2884-221-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/2884-223-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/2884-225-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/2884-227-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/2884-1113-0x00000000025F0000-0x0000000002600000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un274073.exepro2302.exequ3802.exesi195892.exepid process 1752 un274073.exe 1632 pro2302.exe 2884 qu3802.exe 3540 si195892.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro2302.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro2302.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro2302.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
0f7fd6f45f56947b6a1e2670cb3f9d3d03f4e4c4d0ed517597745d30659c4107.exeun274073.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 0f7fd6f45f56947b6a1e2670cb3f9d3d03f4e4c4d0ed517597745d30659c4107.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 0f7fd6f45f56947b6a1e2670cb3f9d3d03f4e4c4d0ed517597745d30659c4107.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un274073.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un274073.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4020 1632 WerFault.exe pro2302.exe 1492 2884 WerFault.exe qu3802.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro2302.exequ3802.exesi195892.exepid process 1632 pro2302.exe 1632 pro2302.exe 2884 qu3802.exe 2884 qu3802.exe 3540 si195892.exe 3540 si195892.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro2302.exequ3802.exesi195892.exedescription pid process Token: SeDebugPrivilege 1632 pro2302.exe Token: SeDebugPrivilege 2884 qu3802.exe Token: SeDebugPrivilege 3540 si195892.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
0f7fd6f45f56947b6a1e2670cb3f9d3d03f4e4c4d0ed517597745d30659c4107.exeun274073.exedescription pid process target process PID 1432 wrote to memory of 1752 1432 0f7fd6f45f56947b6a1e2670cb3f9d3d03f4e4c4d0ed517597745d30659c4107.exe un274073.exe PID 1432 wrote to memory of 1752 1432 0f7fd6f45f56947b6a1e2670cb3f9d3d03f4e4c4d0ed517597745d30659c4107.exe un274073.exe PID 1432 wrote to memory of 1752 1432 0f7fd6f45f56947b6a1e2670cb3f9d3d03f4e4c4d0ed517597745d30659c4107.exe un274073.exe PID 1752 wrote to memory of 1632 1752 un274073.exe pro2302.exe PID 1752 wrote to memory of 1632 1752 un274073.exe pro2302.exe PID 1752 wrote to memory of 1632 1752 un274073.exe pro2302.exe PID 1752 wrote to memory of 2884 1752 un274073.exe qu3802.exe PID 1752 wrote to memory of 2884 1752 un274073.exe qu3802.exe PID 1752 wrote to memory of 2884 1752 un274073.exe qu3802.exe PID 1432 wrote to memory of 3540 1432 0f7fd6f45f56947b6a1e2670cb3f9d3d03f4e4c4d0ed517597745d30659c4107.exe si195892.exe PID 1432 wrote to memory of 3540 1432 0f7fd6f45f56947b6a1e2670cb3f9d3d03f4e4c4d0ed517597745d30659c4107.exe si195892.exe PID 1432 wrote to memory of 3540 1432 0f7fd6f45f56947b6a1e2670cb3f9d3d03f4e4c4d0ed517597745d30659c4107.exe si195892.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f7fd6f45f56947b6a1e2670cb3f9d3d03f4e4c4d0ed517597745d30659c4107.exe"C:\Users\Admin\AppData\Local\Temp\0f7fd6f45f56947b6a1e2670cb3f9d3d03f4e4c4d0ed517597745d30659c4107.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un274073.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un274073.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2302.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2302.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 10844⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3802.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3802.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 13524⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si195892.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si195892.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1632 -ip 16321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2884 -ip 28841⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si195892.exeFilesize
175KB
MD5001ae1863ba1969706f1e5952991250c
SHA1470c852b3400f93eb132fbdfdc4d4c0fe5674f7e
SHA256dc547bf2c51ef26d9c2ccc78367e27c388739ebffcfdf985058c06fb06269bea
SHA51208963d2facde2ac7ac1896b7faf4cb90a0860d94877ae7728990ea718da460a1630bd705d213c4a9cca3910f3e7246c3a4864c09e2052ac6a149530317312f81
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si195892.exeFilesize
175KB
MD5001ae1863ba1969706f1e5952991250c
SHA1470c852b3400f93eb132fbdfdc4d4c0fe5674f7e
SHA256dc547bf2c51ef26d9c2ccc78367e27c388739ebffcfdf985058c06fb06269bea
SHA51208963d2facde2ac7ac1896b7faf4cb90a0860d94877ae7728990ea718da460a1630bd705d213c4a9cca3910f3e7246c3a4864c09e2052ac6a149530317312f81
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un274073.exeFilesize
530KB
MD5e882f6fd93bc7e8d1fc5d0335825dde4
SHA1e94fa901c7d459b54812b524d4cf3c8c0373d977
SHA25627524c60213c262d8ff1bff107169c9e94a4b5e22878fd3eb4d4426d1a16b12c
SHA512020469af2c425f6fe65fa1be1c7661b8f4e56f96e06432d9d77cc7d001569b9cfdd208e066ea591429cb0f6e252a3de0bd1d0c35b330182c0639895384fd84e0
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un274073.exeFilesize
530KB
MD5e882f6fd93bc7e8d1fc5d0335825dde4
SHA1e94fa901c7d459b54812b524d4cf3c8c0373d977
SHA25627524c60213c262d8ff1bff107169c9e94a4b5e22878fd3eb4d4426d1a16b12c
SHA512020469af2c425f6fe65fa1be1c7661b8f4e56f96e06432d9d77cc7d001569b9cfdd208e066ea591429cb0f6e252a3de0bd1d0c35b330182c0639895384fd84e0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2302.exeFilesize
259KB
MD5e7cd00ebdb7ce11f0c3779bc62e178f9
SHA1f9d8445d4a9e581ae3ba38bb16aecd368c82205f
SHA2568bc456f4edb1b711b8c3455d386c390ed907495586af150831c71e8dbcf9ad04
SHA512b7542e1ecde674cb4b61ec46ad026f7bc52b8671ee15ed03ef69176a8868f45b3d473b6975373fab20dd54f369a8f1bb7aaf914daa60760b4b6337150852d0bb
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2302.exeFilesize
259KB
MD5e7cd00ebdb7ce11f0c3779bc62e178f9
SHA1f9d8445d4a9e581ae3ba38bb16aecd368c82205f
SHA2568bc456f4edb1b711b8c3455d386c390ed907495586af150831c71e8dbcf9ad04
SHA512b7542e1ecde674cb4b61ec46ad026f7bc52b8671ee15ed03ef69176a8868f45b3d473b6975373fab20dd54f369a8f1bb7aaf914daa60760b4b6337150852d0bb
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3802.exeFilesize
318KB
MD5012e46284cd8f0762c37d1149d39d789
SHA1bda99c22241071ff4a59ff9ac78423d911e64b60
SHA256f3ddf9a16badc5cf461e179f5728e773037a1a74fa0450fa33326ebc4dd7b0a7
SHA51265cd88b55de1b2aba921feec9aca4135167d64a243b3453e652efad333cb23f63b0bfd2e50a0fb66cb513ab83154099a3b80ef30f17d45d54a4ef47c44663522
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3802.exeFilesize
318KB
MD5012e46284cd8f0762c37d1149d39d789
SHA1bda99c22241071ff4a59ff9ac78423d911e64b60
SHA256f3ddf9a16badc5cf461e179f5728e773037a1a74fa0450fa33326ebc4dd7b0a7
SHA51265cd88b55de1b2aba921feec9aca4135167d64a243b3453e652efad333cb23f63b0bfd2e50a0fb66cb513ab83154099a3b80ef30f17d45d54a4ef47c44663522
-
memory/1632-148-0x0000000004A80000-0x0000000005024000-memory.dmpFilesize
5.6MB
-
memory/1632-149-0x0000000000740000-0x000000000076D000-memory.dmpFilesize
180KB
-
memory/1632-150-0x0000000002250000-0x0000000002260000-memory.dmpFilesize
64KB
-
memory/1632-151-0x0000000002250000-0x0000000002260000-memory.dmpFilesize
64KB
-
memory/1632-152-0x0000000002250000-0x0000000002260000-memory.dmpFilesize
64KB
-
memory/1632-153-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/1632-154-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/1632-156-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/1632-158-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/1632-160-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/1632-164-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/1632-162-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/1632-166-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/1632-168-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/1632-170-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/1632-172-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/1632-174-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/1632-176-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/1632-178-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/1632-180-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/1632-181-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/1632-182-0x0000000002250000-0x0000000002260000-memory.dmpFilesize
64KB
-
memory/1632-183-0x0000000002250000-0x0000000002260000-memory.dmpFilesize
64KB
-
memory/1632-184-0x0000000002250000-0x0000000002260000-memory.dmpFilesize
64KB
-
memory/1632-186-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/2884-192-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/2884-193-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/2884-195-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/2884-197-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/2884-201-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/2884-199-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/2884-203-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/2884-205-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/2884-206-0x0000000000640000-0x000000000068B000-memory.dmpFilesize
300KB
-
memory/2884-207-0x00000000025F0000-0x0000000002600000-memory.dmpFilesize
64KB
-
memory/2884-209-0x00000000025F0000-0x0000000002600000-memory.dmpFilesize
64KB
-
memory/2884-215-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/2884-213-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/2884-210-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/2884-211-0x00000000025F0000-0x0000000002600000-memory.dmpFilesize
64KB
-
memory/2884-217-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/2884-219-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/2884-221-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/2884-223-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/2884-225-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/2884-227-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/2884-1102-0x0000000005200000-0x0000000005818000-memory.dmpFilesize
6.1MB
-
memory/2884-1103-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/2884-1104-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/2884-1105-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/2884-1106-0x00000000025F0000-0x0000000002600000-memory.dmpFilesize
64KB
-
memory/2884-1108-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/2884-1109-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/2884-1110-0x0000000006480000-0x00000000064F6000-memory.dmpFilesize
472KB
-
memory/2884-1113-0x00000000025F0000-0x0000000002600000-memory.dmpFilesize
64KB
-
memory/2884-1112-0x0000000006520000-0x0000000006570000-memory.dmpFilesize
320KB
-
memory/2884-1111-0x00000000025F0000-0x0000000002600000-memory.dmpFilesize
64KB
-
memory/2884-1114-0x00000000025F0000-0x0000000002600000-memory.dmpFilesize
64KB
-
memory/2884-1115-0x0000000006590000-0x0000000006752000-memory.dmpFilesize
1.8MB
-
memory/2884-1116-0x0000000006760000-0x0000000006C8C000-memory.dmpFilesize
5.2MB
-
memory/2884-1117-0x00000000025F0000-0x0000000002600000-memory.dmpFilesize
64KB
-
memory/3540-1123-0x0000000000010000-0x0000000000042000-memory.dmpFilesize
200KB
-
memory/3540-1124-0x0000000004C50000-0x0000000004C60000-memory.dmpFilesize
64KB
-
memory/3540-1125-0x0000000004C50000-0x0000000004C60000-memory.dmpFilesize
64KB