Analysis
-
max time kernel
95s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 18:45
Static task
static1
Behavioral task
behavioral1
Sample
f7c5fa4827337db7f3f3005a1b28a3da250617b19812555f1054731c454b7ac5.exe
Resource
win10v2004-20230220-en
General
-
Target
f7c5fa4827337db7f3f3005a1b28a3da250617b19812555f1054731c454b7ac5.exe
-
Size
672KB
-
MD5
4ed48d38b04c3c29c563b9e14209947d
-
SHA1
d113c9be013d20eed427c468506fb3a85550bfce
-
SHA256
f7c5fa4827337db7f3f3005a1b28a3da250617b19812555f1054731c454b7ac5
-
SHA512
f0063959c82ad96594a7cf5a211d291aeaeff2fce401bd1aeca56985cdcab82a6c52043d80eddf3ead569fcbd08e630d57a80e7ba15b013a5e0bbf3d5e69e1cf
-
SSDEEP
12288:+Mr0y90iaftyyrLttVqsQCGRmtp1AZtq6Womev+Yl7r+ptajQgZkX:uyaVDsI+ZxWo+8+najxZkX
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro8219.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro8219.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro8219.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro8219.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro8219.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro8219.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro8219.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/1676-190-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/1676-191-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/1676-193-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/1676-195-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/1676-197-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/1676-199-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/1676-201-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/1676-203-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/1676-205-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/1676-207-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/1676-209-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/1676-211-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/1676-213-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/1676-215-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/1676-218-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/1676-223-0x0000000002250000-0x0000000002260000-memory.dmp family_redline behavioral1/memory/1676-221-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/1676-225-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/1676-227-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/1676-1109-0x0000000002250000-0x0000000002260000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un342144.exepro8219.exequ6040.exesi229726.exepid process 264 un342144.exe 4132 pro8219.exe 1676 qu6040.exe 3736 si229726.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro8219.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro8219.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro8219.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
f7c5fa4827337db7f3f3005a1b28a3da250617b19812555f1054731c454b7ac5.exeun342144.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce f7c5fa4827337db7f3f3005a1b28a3da250617b19812555f1054731c454b7ac5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" f7c5fa4827337db7f3f3005a1b28a3da250617b19812555f1054731c454b7ac5.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un342144.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un342144.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3692 4132 WerFault.exe pro8219.exe 2680 1676 WerFault.exe qu6040.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro8219.exequ6040.exesi229726.exepid process 4132 pro8219.exe 4132 pro8219.exe 1676 qu6040.exe 1676 qu6040.exe 3736 si229726.exe 3736 si229726.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro8219.exequ6040.exesi229726.exedescription pid process Token: SeDebugPrivilege 4132 pro8219.exe Token: SeDebugPrivilege 1676 qu6040.exe Token: SeDebugPrivilege 3736 si229726.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
f7c5fa4827337db7f3f3005a1b28a3da250617b19812555f1054731c454b7ac5.exeun342144.exedescription pid process target process PID 1840 wrote to memory of 264 1840 f7c5fa4827337db7f3f3005a1b28a3da250617b19812555f1054731c454b7ac5.exe un342144.exe PID 1840 wrote to memory of 264 1840 f7c5fa4827337db7f3f3005a1b28a3da250617b19812555f1054731c454b7ac5.exe un342144.exe PID 1840 wrote to memory of 264 1840 f7c5fa4827337db7f3f3005a1b28a3da250617b19812555f1054731c454b7ac5.exe un342144.exe PID 264 wrote to memory of 4132 264 un342144.exe pro8219.exe PID 264 wrote to memory of 4132 264 un342144.exe pro8219.exe PID 264 wrote to memory of 4132 264 un342144.exe pro8219.exe PID 264 wrote to memory of 1676 264 un342144.exe qu6040.exe PID 264 wrote to memory of 1676 264 un342144.exe qu6040.exe PID 264 wrote to memory of 1676 264 un342144.exe qu6040.exe PID 1840 wrote to memory of 3736 1840 f7c5fa4827337db7f3f3005a1b28a3da250617b19812555f1054731c454b7ac5.exe si229726.exe PID 1840 wrote to memory of 3736 1840 f7c5fa4827337db7f3f3005a1b28a3da250617b19812555f1054731c454b7ac5.exe si229726.exe PID 1840 wrote to memory of 3736 1840 f7c5fa4827337db7f3f3005a1b28a3da250617b19812555f1054731c454b7ac5.exe si229726.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f7c5fa4827337db7f3f3005a1b28a3da250617b19812555f1054731c454b7ac5.exe"C:\Users\Admin\AppData\Local\Temp\f7c5fa4827337db7f3f3005a1b28a3da250617b19812555f1054731c454b7ac5.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un342144.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un342144.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8219.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8219.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 10804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6040.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6040.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 13484⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si229726.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si229726.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4132 -ip 41321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 1676 -ip 16761⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si229726.exeFilesize
175KB
MD5dce03d57be5e063617a65f3d96e6fb7b
SHA14edac4bb42e940d6dd77b6d4102e9d9bfae4480b
SHA2564f7196f8891fb9b6824f84c557f81e39b097ef0a122e0abfb968870feca2cb26
SHA512bb1e41c49dcd1d940d9802aebeb4c9f099a450b79d81fbc7cc4e7bb0e685564506f63f9bb266ebd51e5e7ac150c9731d4d30c622fe7b02e46a18a31b9927185c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si229726.exeFilesize
175KB
MD5dce03d57be5e063617a65f3d96e6fb7b
SHA14edac4bb42e940d6dd77b6d4102e9d9bfae4480b
SHA2564f7196f8891fb9b6824f84c557f81e39b097ef0a122e0abfb968870feca2cb26
SHA512bb1e41c49dcd1d940d9802aebeb4c9f099a450b79d81fbc7cc4e7bb0e685564506f63f9bb266ebd51e5e7ac150c9731d4d30c622fe7b02e46a18a31b9927185c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un342144.exeFilesize
530KB
MD53fd8a6d8d52c1adc9809c163c0a02a33
SHA15b3d4f0ba85e309a345fefa13deb8e8e5eb9603d
SHA256039c5665ecd01824f7a0aa0659e3aa35a3af1c295f3d3078ae181b252f0ef382
SHA5127f27d935ae299f12cf4285c19936f18c757ddf5a690a640e3cd17faa0b13adc74cea2e06dcf323ef5c12bdd6169ce848c62ecaed7da9d69eabc989cc4ea6f6c1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un342144.exeFilesize
530KB
MD53fd8a6d8d52c1adc9809c163c0a02a33
SHA15b3d4f0ba85e309a345fefa13deb8e8e5eb9603d
SHA256039c5665ecd01824f7a0aa0659e3aa35a3af1c295f3d3078ae181b252f0ef382
SHA5127f27d935ae299f12cf4285c19936f18c757ddf5a690a640e3cd17faa0b13adc74cea2e06dcf323ef5c12bdd6169ce848c62ecaed7da9d69eabc989cc4ea6f6c1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8219.exeFilesize
259KB
MD54692803ead38c14b6b17a1daa103a1e3
SHA1b807573950bf41e4203d3f0a9a8828b3efcc5d79
SHA256a2a4ea44873037bd80831319d5313a130b5b86ddcf77961265e308dc2bfc7171
SHA512832288ea447e17bcd415ae2c1f441f92a525d31582f966a540d98bab674e906dcd4e1ca3ee3f5da6aec79d714aaeab28054b87a44283646572b796909d93cf07
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8219.exeFilesize
259KB
MD54692803ead38c14b6b17a1daa103a1e3
SHA1b807573950bf41e4203d3f0a9a8828b3efcc5d79
SHA256a2a4ea44873037bd80831319d5313a130b5b86ddcf77961265e308dc2bfc7171
SHA512832288ea447e17bcd415ae2c1f441f92a525d31582f966a540d98bab674e906dcd4e1ca3ee3f5da6aec79d714aaeab28054b87a44283646572b796909d93cf07
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6040.exeFilesize
318KB
MD56bca244975accf011c06578496e6f623
SHA164f995d8dc5f65cbd235246762034a0c9a44a587
SHA25670b98d9e4fdff27d9d0f28aa72c2337a6686367333872698c7d8bebcdaf26b3d
SHA512acb6e006d0ac89bc0dce085ea574f640898288886f589670f7fb3e91424b3caa8b405a2b4bd0b5898579f1cf97679994a1f4f5a4ac8561f0d5d2be735e3dfbbb
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6040.exeFilesize
318KB
MD56bca244975accf011c06578496e6f623
SHA164f995d8dc5f65cbd235246762034a0c9a44a587
SHA25670b98d9e4fdff27d9d0f28aa72c2337a6686367333872698c7d8bebcdaf26b3d
SHA512acb6e006d0ac89bc0dce085ea574f640898288886f589670f7fb3e91424b3caa8b405a2b4bd0b5898579f1cf97679994a1f4f5a4ac8561f0d5d2be735e3dfbbb
-
memory/1676-227-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/1676-1102-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/1676-1115-0x00000000068A0000-0x0000000006DCC000-memory.dmpFilesize
5.2MB
-
memory/1676-1114-0x00000000066D0000-0x0000000006892000-memory.dmpFilesize
1.8MB
-
memory/1676-1113-0x0000000006650000-0x00000000066A0000-memory.dmpFilesize
320KB
-
memory/1676-1112-0x00000000065C0000-0x0000000006636000-memory.dmpFilesize
472KB
-
memory/1676-1111-0x0000000002250000-0x0000000002260000-memory.dmpFilesize
64KB
-
memory/1676-1110-0x0000000002250000-0x0000000002260000-memory.dmpFilesize
64KB
-
memory/1676-1109-0x0000000002250000-0x0000000002260000-memory.dmpFilesize
64KB
-
memory/1676-1108-0x0000000002250000-0x0000000002260000-memory.dmpFilesize
64KB
-
memory/1676-1106-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/1676-1105-0x0000000005BB0000-0x0000000005C42000-memory.dmpFilesize
584KB
-
memory/1676-1104-0x00000000058C0000-0x00000000058FC000-memory.dmpFilesize
240KB
-
memory/1676-1103-0x0000000002250000-0x0000000002260000-memory.dmpFilesize
64KB
-
memory/1676-1101-0x0000000005760000-0x000000000586A000-memory.dmpFilesize
1.0MB
-
memory/1676-1100-0x00000000050D0000-0x00000000056E8000-memory.dmpFilesize
6.1MB
-
memory/1676-225-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/1676-221-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/1676-222-0x0000000002250000-0x0000000002260000-memory.dmpFilesize
64KB
-
memory/1676-223-0x0000000002250000-0x0000000002260000-memory.dmpFilesize
64KB
-
memory/1676-220-0x0000000002250000-0x0000000002260000-memory.dmpFilesize
64KB
-
memory/1676-218-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/1676-190-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/1676-191-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/1676-193-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/1676-195-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/1676-197-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/1676-199-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/1676-201-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/1676-203-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/1676-205-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/1676-207-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/1676-209-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/1676-211-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/1676-213-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/1676-215-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/1676-217-0x00000000020C0000-0x000000000210B000-memory.dmpFilesize
300KB
-
memory/3736-1121-0x00000000007D0000-0x0000000000802000-memory.dmpFilesize
200KB
-
memory/3736-1122-0x0000000005100000-0x0000000005110000-memory.dmpFilesize
64KB
-
memory/4132-175-0x00000000026D0000-0x00000000026E2000-memory.dmpFilesize
72KB
-
memory/4132-148-0x00000000005D0000-0x00000000005FD000-memory.dmpFilesize
180KB
-
memory/4132-183-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/4132-182-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/4132-150-0x00000000026D0000-0x00000000026E2000-memory.dmpFilesize
72KB
-
memory/4132-180-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/4132-179-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/4132-155-0x00000000026D0000-0x00000000026E2000-memory.dmpFilesize
72KB
-
memory/4132-178-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/4132-177-0x00000000026D0000-0x00000000026E2000-memory.dmpFilesize
72KB
-
memory/4132-153-0x00000000026D0000-0x00000000026E2000-memory.dmpFilesize
72KB
-
memory/4132-184-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/4132-167-0x00000000026D0000-0x00000000026E2000-memory.dmpFilesize
72KB
-
memory/4132-169-0x00000000026D0000-0x00000000026E2000-memory.dmpFilesize
72KB
-
memory/4132-171-0x00000000026D0000-0x00000000026E2000-memory.dmpFilesize
72KB
-
memory/4132-165-0x00000000026D0000-0x00000000026E2000-memory.dmpFilesize
72KB
-
memory/4132-163-0x00000000026D0000-0x00000000026E2000-memory.dmpFilesize
72KB
-
memory/4132-161-0x00000000026D0000-0x00000000026E2000-memory.dmpFilesize
72KB
-
memory/4132-159-0x00000000026D0000-0x00000000026E2000-memory.dmpFilesize
72KB
-
memory/4132-157-0x00000000026D0000-0x00000000026E2000-memory.dmpFilesize
72KB
-
memory/4132-149-0x0000000004C20000-0x00000000051C4000-memory.dmpFilesize
5.6MB
-
memory/4132-173-0x00000000026D0000-0x00000000026E2000-memory.dmpFilesize
72KB
-
memory/4132-185-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/4132-151-0x00000000026D0000-0x00000000026E2000-memory.dmpFilesize
72KB