Analysis
-
max time kernel
151s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 18:44
Static task
static1
Behavioral task
behavioral1
Sample
024c0b4bdf8b4c598defd27f8511e9f571af3b2bdc47ae7c4cb92aa1d90cf9d4.exe
Resource
win10v2004-20230221-en
General
-
Target
024c0b4bdf8b4c598defd27f8511e9f571af3b2bdc47ae7c4cb92aa1d90cf9d4.exe
-
Size
672KB
-
MD5
f6cb2e6781bbdf4a151fb37a6e27ef66
-
SHA1
3183f448c0672669bcea763f49619f388a8c96af
-
SHA256
024c0b4bdf8b4c598defd27f8511e9f571af3b2bdc47ae7c4cb92aa1d90cf9d4
-
SHA512
d19d752e7ae73704a4fef465a49c1522865821e71e6a206bf3fbe4b5132c470e8b85297090429f5532baa7db6652ea705b731f82910123e09afb094510cd1115
-
SSDEEP
12288:0Mrqy904x1U7wXHkFKBpLj3wM/7FVYpomRZ+Ym5GFpW5kP6UY:2yzx1oWHIGL7V7FQozVucePVY
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro8708.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro8708.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro8708.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro8708.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro8708.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro8708.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro8708.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/2020-195-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2020-193-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2020-197-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2020-199-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2020-201-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2020-203-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2020-205-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2020-207-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2020-209-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2020-215-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2020-213-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2020-211-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2020-217-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2020-219-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2020-221-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2020-223-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2020-225-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2020-227-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un941869.exepro8708.exequ7843.exesi898950.exepid process 3604 un941869.exe 496 pro8708.exe 2020 qu7843.exe 2544 si898950.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro8708.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro8708.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro8708.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
024c0b4bdf8b4c598defd27f8511e9f571af3b2bdc47ae7c4cb92aa1d90cf9d4.exeun941869.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 024c0b4bdf8b4c598defd27f8511e9f571af3b2bdc47ae7c4cb92aa1d90cf9d4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 024c0b4bdf8b4c598defd27f8511e9f571af3b2bdc47ae7c4cb92aa1d90cf9d4.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un941869.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un941869.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 4772 sc.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1196 496 WerFault.exe pro8708.exe 3280 2020 WerFault.exe qu7843.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro8708.exequ7843.exesi898950.exepid process 496 pro8708.exe 496 pro8708.exe 2020 qu7843.exe 2020 qu7843.exe 2544 si898950.exe 2544 si898950.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro8708.exequ7843.exesi898950.exedescription pid process Token: SeDebugPrivilege 496 pro8708.exe Token: SeDebugPrivilege 2020 qu7843.exe Token: SeDebugPrivilege 2544 si898950.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
024c0b4bdf8b4c598defd27f8511e9f571af3b2bdc47ae7c4cb92aa1d90cf9d4.exeun941869.exedescription pid process target process PID 2872 wrote to memory of 3604 2872 024c0b4bdf8b4c598defd27f8511e9f571af3b2bdc47ae7c4cb92aa1d90cf9d4.exe un941869.exe PID 2872 wrote to memory of 3604 2872 024c0b4bdf8b4c598defd27f8511e9f571af3b2bdc47ae7c4cb92aa1d90cf9d4.exe un941869.exe PID 2872 wrote to memory of 3604 2872 024c0b4bdf8b4c598defd27f8511e9f571af3b2bdc47ae7c4cb92aa1d90cf9d4.exe un941869.exe PID 3604 wrote to memory of 496 3604 un941869.exe pro8708.exe PID 3604 wrote to memory of 496 3604 un941869.exe pro8708.exe PID 3604 wrote to memory of 496 3604 un941869.exe pro8708.exe PID 3604 wrote to memory of 2020 3604 un941869.exe qu7843.exe PID 3604 wrote to memory of 2020 3604 un941869.exe qu7843.exe PID 3604 wrote to memory of 2020 3604 un941869.exe qu7843.exe PID 2872 wrote to memory of 2544 2872 024c0b4bdf8b4c598defd27f8511e9f571af3b2bdc47ae7c4cb92aa1d90cf9d4.exe si898950.exe PID 2872 wrote to memory of 2544 2872 024c0b4bdf8b4c598defd27f8511e9f571af3b2bdc47ae7c4cb92aa1d90cf9d4.exe si898950.exe PID 2872 wrote to memory of 2544 2872 024c0b4bdf8b4c598defd27f8511e9f571af3b2bdc47ae7c4cb92aa1d90cf9d4.exe si898950.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\024c0b4bdf8b4c598defd27f8511e9f571af3b2bdc47ae7c4cb92aa1d90cf9d4.exe"C:\Users\Admin\AppData\Local\Temp\024c0b4bdf8b4c598defd27f8511e9f571af3b2bdc47ae7c4cb92aa1d90cf9d4.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un941869.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un941869.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8708.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8708.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:496 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 496 -s 10844⤵
- Program crash
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7843.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7843.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2020 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 13484⤵
- Program crash
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si898950.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si898950.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2544
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 496 -ip 4961⤵PID:4664
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2020 -ip 20201⤵PID:4148
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
PID:4772
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si898950.exeFilesize
175KB
MD54b78aacd0680ccbbd11397bf13771462
SHA1fa8e8bd75d2defb2807fe0fce6ff6b8dbe1e9447
SHA256ebc1838741b358037e8f35ecd1a6b956e108d1baf92693b6e81e7cdfb09ce249
SHA512edf36f161a42daefd0810569b384de80cf75c8166d0460427530669c856baac3ef862a326f2310073fe8c26fba61e5289ecc4b7ad407f5d59ba841586fba394d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si898950.exeFilesize
175KB
MD54b78aacd0680ccbbd11397bf13771462
SHA1fa8e8bd75d2defb2807fe0fce6ff6b8dbe1e9447
SHA256ebc1838741b358037e8f35ecd1a6b956e108d1baf92693b6e81e7cdfb09ce249
SHA512edf36f161a42daefd0810569b384de80cf75c8166d0460427530669c856baac3ef862a326f2310073fe8c26fba61e5289ecc4b7ad407f5d59ba841586fba394d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un941869.exeFilesize
530KB
MD5547b0e2cbc131687daf24f63af39ab0c
SHA105632709308daa16523d9b0d1f217c1aada34bbd
SHA256e19d506f912038ffa51d2c37fb8e9a105a6354842d4afe02fa60acfd4ab7575a
SHA5122ab18ff7a684746245aad2438476a5f053033a0a42ba5347b7a92bf1c524de51f913af3b378ba775136f36ac66275351bcec50fd2cb76a0549b370cbc2a67d52
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un941869.exeFilesize
530KB
MD5547b0e2cbc131687daf24f63af39ab0c
SHA105632709308daa16523d9b0d1f217c1aada34bbd
SHA256e19d506f912038ffa51d2c37fb8e9a105a6354842d4afe02fa60acfd4ab7575a
SHA5122ab18ff7a684746245aad2438476a5f053033a0a42ba5347b7a92bf1c524de51f913af3b378ba775136f36ac66275351bcec50fd2cb76a0549b370cbc2a67d52
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8708.exeFilesize
259KB
MD5e703735d049e9a2ca46518ceb6d225e2
SHA1f8546ea26e45740471cb9a993fe353a22feee3aa
SHA25663887bc1e6af5b199220592117d25b6bd24b68531b16c1fde550b2e9ec11a4b6
SHA5125c77a9eaab57a397efc9cc00d4affa82a44b63643407b77e35f9ea099bd45290967add67cd2c4e5875de912988e88755a99f2904c00d12fd2cb2cbfc7c1a964d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8708.exeFilesize
259KB
MD5e703735d049e9a2ca46518ceb6d225e2
SHA1f8546ea26e45740471cb9a993fe353a22feee3aa
SHA25663887bc1e6af5b199220592117d25b6bd24b68531b16c1fde550b2e9ec11a4b6
SHA5125c77a9eaab57a397efc9cc00d4affa82a44b63643407b77e35f9ea099bd45290967add67cd2c4e5875de912988e88755a99f2904c00d12fd2cb2cbfc7c1a964d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7843.exeFilesize
318KB
MD5cdd267d8c6e61282c04e9bc410f8ad97
SHA1c13c4438c0dd56a16f963996029f25537f606c62
SHA2560496a98d2d76014465d7f13c143fbee30ce5f8e029853c8e9b24896b38842d45
SHA5127bb4acb379aadac55c924b59b8cb2419c5bfd7174deb2b675f92421d69462397c37737b4832d264d2155ec0c1b899a00f5d00841da554ac9befbb095a37e4a90
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7843.exeFilesize
318KB
MD5cdd267d8c6e61282c04e9bc410f8ad97
SHA1c13c4438c0dd56a16f963996029f25537f606c62
SHA2560496a98d2d76014465d7f13c143fbee30ce5f8e029853c8e9b24896b38842d45
SHA5127bb4acb379aadac55c924b59b8cb2419c5bfd7174deb2b675f92421d69462397c37737b4832d264d2155ec0c1b899a00f5d00841da554ac9befbb095a37e4a90
-
memory/496-148-0x0000000004C10000-0x00000000051B4000-memory.dmpFilesize
5.6MB
-
memory/496-151-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/496-150-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/496-154-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/496-153-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/496-152-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/496-149-0x0000000000570000-0x000000000059D000-memory.dmpFilesize
180KB
-
memory/496-156-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/496-158-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/496-166-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/496-164-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/496-168-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/496-162-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/496-160-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/496-170-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/496-172-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/496-178-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/496-176-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/496-174-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/496-180-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/496-181-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/496-182-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/496-183-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/496-184-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/496-186-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/2020-191-0x00000000008D0000-0x000000000091B000-memory.dmpFilesize
300KB
-
memory/2020-195-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2020-194-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/2020-193-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2020-192-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/2020-197-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2020-199-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2020-201-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2020-203-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2020-205-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2020-207-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2020-209-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2020-215-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2020-213-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2020-211-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2020-217-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2020-219-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2020-221-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2020-223-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2020-225-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2020-227-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2020-1100-0x00000000050C0000-0x00000000056D8000-memory.dmpFilesize
6.1MB
-
memory/2020-1101-0x0000000005760000-0x000000000586A000-memory.dmpFilesize
1.0MB
-
memory/2020-1102-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/2020-1103-0x00000000058C0000-0x00000000058FC000-memory.dmpFilesize
240KB
-
memory/2020-1104-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/2020-1105-0x0000000005BB0000-0x0000000005C42000-memory.dmpFilesize
584KB
-
memory/2020-1106-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/2020-1108-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/2020-1109-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/2020-1110-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/2020-1111-0x00000000065B0000-0x0000000006626000-memory.dmpFilesize
472KB
-
memory/2020-1112-0x0000000006640000-0x0000000006690000-memory.dmpFilesize
320KB
-
memory/2020-1113-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/2020-1114-0x00000000066D0000-0x0000000006892000-memory.dmpFilesize
1.8MB
-
memory/2020-1115-0x00000000068A0000-0x0000000006DCC000-memory.dmpFilesize
5.2MB
-
memory/2544-1121-0x0000000000490000-0x00000000004C2000-memory.dmpFilesize
200KB
-
memory/2544-1122-0x0000000005040000-0x0000000005050000-memory.dmpFilesize
64KB