Analysis
-
max time kernel
108s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 18:52
Static task
static1
Behavioral task
behavioral1
Sample
995aa4d10aa722354c4b4bebb778c0b69902cfad27cdef2e30cf471e07efe426.exe
Resource
win10v2004-20230221-en
General
-
Target
995aa4d10aa722354c4b4bebb778c0b69902cfad27cdef2e30cf471e07efe426.exe
-
Size
673KB
-
MD5
945833e141f860a405389d4dbeaf6d45
-
SHA1
21271f04d3c45aa0c0f2de550a3da4844a902c5b
-
SHA256
995aa4d10aa722354c4b4bebb778c0b69902cfad27cdef2e30cf471e07efe426
-
SHA512
e6ea2cfdd98b64a741a0fa55dcb6661a970eef86e91fa3f3590b878abed6a348b3a5a9ea502118e7bd947314336013db5e888b677b0adcd15b63e3b2c7da87a8
-
SSDEEP
12288:UMrAy90OgbWcuPx4iK+8Go88CemCEIrmWt278cY1om/V+YvZV6p8L/:0yaWPiw8C6rt278r1oJAqWL/
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro9328.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro9328.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro9328.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro9328.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro9328.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro9328.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro9328.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/1792-191-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1792-192-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1792-194-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1792-196-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1792-198-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1792-200-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1792-202-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1792-204-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1792-206-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1792-208-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1792-210-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1792-214-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1792-212-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1792-216-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1792-218-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1792-220-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1792-222-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1792-224-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1792-390-0x0000000004C00000-0x0000000004C10000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un086586.exepro9328.exequ6522.exesi228731.exepid process 648 un086586.exe 4468 pro9328.exe 1792 qu6522.exe 1632 si228731.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro9328.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro9328.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro9328.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
995aa4d10aa722354c4b4bebb778c0b69902cfad27cdef2e30cf471e07efe426.exeun086586.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 995aa4d10aa722354c4b4bebb778c0b69902cfad27cdef2e30cf471e07efe426.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 995aa4d10aa722354c4b4bebb778c0b69902cfad27cdef2e30cf471e07efe426.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un086586.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un086586.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4588 4468 WerFault.exe pro9328.exe 4576 1792 WerFault.exe qu6522.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro9328.exequ6522.exesi228731.exepid process 4468 pro9328.exe 4468 pro9328.exe 1792 qu6522.exe 1792 qu6522.exe 1632 si228731.exe 1632 si228731.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro9328.exequ6522.exesi228731.exedescription pid process Token: SeDebugPrivilege 4468 pro9328.exe Token: SeDebugPrivilege 1792 qu6522.exe Token: SeDebugPrivilege 1632 si228731.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
995aa4d10aa722354c4b4bebb778c0b69902cfad27cdef2e30cf471e07efe426.exeun086586.exedescription pid process target process PID 3204 wrote to memory of 648 3204 995aa4d10aa722354c4b4bebb778c0b69902cfad27cdef2e30cf471e07efe426.exe un086586.exe PID 3204 wrote to memory of 648 3204 995aa4d10aa722354c4b4bebb778c0b69902cfad27cdef2e30cf471e07efe426.exe un086586.exe PID 3204 wrote to memory of 648 3204 995aa4d10aa722354c4b4bebb778c0b69902cfad27cdef2e30cf471e07efe426.exe un086586.exe PID 648 wrote to memory of 4468 648 un086586.exe pro9328.exe PID 648 wrote to memory of 4468 648 un086586.exe pro9328.exe PID 648 wrote to memory of 4468 648 un086586.exe pro9328.exe PID 648 wrote to memory of 1792 648 un086586.exe qu6522.exe PID 648 wrote to memory of 1792 648 un086586.exe qu6522.exe PID 648 wrote to memory of 1792 648 un086586.exe qu6522.exe PID 3204 wrote to memory of 1632 3204 995aa4d10aa722354c4b4bebb778c0b69902cfad27cdef2e30cf471e07efe426.exe si228731.exe PID 3204 wrote to memory of 1632 3204 995aa4d10aa722354c4b4bebb778c0b69902cfad27cdef2e30cf471e07efe426.exe si228731.exe PID 3204 wrote to memory of 1632 3204 995aa4d10aa722354c4b4bebb778c0b69902cfad27cdef2e30cf471e07efe426.exe si228731.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\995aa4d10aa722354c4b4bebb778c0b69902cfad27cdef2e30cf471e07efe426.exe"C:\Users\Admin\AppData\Local\Temp\995aa4d10aa722354c4b4bebb778c0b69902cfad27cdef2e30cf471e07efe426.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un086586.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un086586.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9328.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9328.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 10804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6522.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6522.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 13484⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si228731.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si228731.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4468 -ip 44681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1792 -ip 17921⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si228731.exeFilesize
175KB
MD58c7563c78ccd1f89251dc543b5ba6b07
SHA1f9ddcdedb9edb1d872ba64dcd28cb8d622ef1dd0
SHA256d2f46cde5e02a130938a0a4c4db3e07780e41fb326c4dec78c2fefd094a4d9a4
SHA51239bf861c0043fbf22dd824811df85f831bddbc512dd0269e690694dc41b7aeff39255b624eb26e83447a3c48759feea9d62005997b7767d6db48a9e070a9fd1a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si228731.exeFilesize
175KB
MD58c7563c78ccd1f89251dc543b5ba6b07
SHA1f9ddcdedb9edb1d872ba64dcd28cb8d622ef1dd0
SHA256d2f46cde5e02a130938a0a4c4db3e07780e41fb326c4dec78c2fefd094a4d9a4
SHA51239bf861c0043fbf22dd824811df85f831bddbc512dd0269e690694dc41b7aeff39255b624eb26e83447a3c48759feea9d62005997b7767d6db48a9e070a9fd1a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un086586.exeFilesize
531KB
MD5f87aff44c2b7756e7bc8ee087112fcca
SHA1baaadd1a8b2368da4e10329c64c960c4e97ac4f9
SHA256218b0664a77d8081999e1b84a255c96c52dd55af32f182a267e6416d07c980ac
SHA512dc71c1a9da02e1479346a0c55b9dddc20d42cc7138e32d835b8fb8a66e4e21b4f22ec231a21fd5edca3b06ee308645f37d02d57f320aa652bd62916a9cf85a47
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un086586.exeFilesize
531KB
MD5f87aff44c2b7756e7bc8ee087112fcca
SHA1baaadd1a8b2368da4e10329c64c960c4e97ac4f9
SHA256218b0664a77d8081999e1b84a255c96c52dd55af32f182a267e6416d07c980ac
SHA512dc71c1a9da02e1479346a0c55b9dddc20d42cc7138e32d835b8fb8a66e4e21b4f22ec231a21fd5edca3b06ee308645f37d02d57f320aa652bd62916a9cf85a47
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9328.exeFilesize
259KB
MD5acb0ae7852f4c58c9b879f8a132fb633
SHA19ce973fa7583238b98224b226d645802a9ac6617
SHA256d3059973d9f15ebc263a234156ce3ba2163d4ca22415bf22b8f362e0b544dc19
SHA512fa87a158a66f1a3bca178fea2dc2d064e5ef4b88e7da72a6e6b0e6f791938160ceea67b439b117e513786c7bd2c442674c8f2a70477b0be64a2e73ab0c7a5bc8
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9328.exeFilesize
259KB
MD5acb0ae7852f4c58c9b879f8a132fb633
SHA19ce973fa7583238b98224b226d645802a9ac6617
SHA256d3059973d9f15ebc263a234156ce3ba2163d4ca22415bf22b8f362e0b544dc19
SHA512fa87a158a66f1a3bca178fea2dc2d064e5ef4b88e7da72a6e6b0e6f791938160ceea67b439b117e513786c7bd2c442674c8f2a70477b0be64a2e73ab0c7a5bc8
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6522.exeFilesize
318KB
MD5b0ef7dff6c0c254941252d164f47628a
SHA1740a9976d0b04605dc73e2085c42f956fdcba5d9
SHA256322ee19d85d99d4d5f6fe533af346e757d3e12a58fceecb89fe3f25ba9fb6ba2
SHA512148904b87cd14759c8b165d7d6a6a2667687d8255459efa541a2448ed9712c3f9980d742bf5bbed154276ed862218586d293d967c6e91be3b8b6fc07ba85022d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6522.exeFilesize
318KB
MD5b0ef7dff6c0c254941252d164f47628a
SHA1740a9976d0b04605dc73e2085c42f956fdcba5d9
SHA256322ee19d85d99d4d5f6fe533af346e757d3e12a58fceecb89fe3f25ba9fb6ba2
SHA512148904b87cd14759c8b165d7d6a6a2667687d8255459efa541a2448ed9712c3f9980d742bf5bbed154276ed862218586d293d967c6e91be3b8b6fc07ba85022d
-
memory/1632-1122-0x0000000005A50000-0x0000000005A60000-memory.dmpFilesize
64KB
-
memory/1632-1121-0x0000000000D40000-0x0000000000D72000-memory.dmpFilesize
200KB
-
memory/1792-390-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/1792-1104-0x00000000058F0000-0x000000000592C000-memory.dmpFilesize
240KB
-
memory/1792-1115-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/1792-1114-0x0000000006870000-0x0000000006D9C000-memory.dmpFilesize
5.2MB
-
memory/1792-1113-0x00000000066A0000-0x0000000006862000-memory.dmpFilesize
1.8MB
-
memory/1792-1112-0x0000000006620000-0x0000000006670000-memory.dmpFilesize
320KB
-
memory/1792-1111-0x0000000006590000-0x0000000006606000-memory.dmpFilesize
472KB
-
memory/1792-1110-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/1792-1109-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/1792-1108-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/1792-1106-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/1792-1105-0x0000000005BB0000-0x0000000005C42000-memory.dmpFilesize
584KB
-
memory/1792-1103-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/1792-1102-0x0000000004BB0000-0x0000000004BC2000-memory.dmpFilesize
72KB
-
memory/1792-1101-0x00000000057E0000-0x00000000058EA000-memory.dmpFilesize
1.0MB
-
memory/1792-1100-0x00000000051C0000-0x00000000057D8000-memory.dmpFilesize
6.1MB
-
memory/1792-388-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/1792-387-0x0000000002150000-0x000000000219B000-memory.dmpFilesize
300KB
-
memory/1792-224-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1792-222-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1792-220-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1792-191-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1792-192-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1792-194-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1792-196-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1792-198-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1792-200-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1792-202-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1792-204-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1792-206-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1792-208-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1792-210-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1792-214-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1792-212-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1792-216-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1792-218-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/4468-174-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/4468-183-0x0000000002370000-0x0000000002380000-memory.dmpFilesize
64KB
-
memory/4468-156-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/4468-184-0x0000000002370000-0x0000000002380000-memory.dmpFilesize
64KB
-
memory/4468-172-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/4468-150-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/4468-182-0x0000000002370000-0x0000000002380000-memory.dmpFilesize
64KB
-
memory/4468-170-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/4468-180-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/4468-178-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/4468-151-0x0000000002370000-0x0000000002380000-memory.dmpFilesize
64KB
-
memory/4468-176-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/4468-186-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/4468-155-0x0000000002370000-0x0000000002380000-memory.dmpFilesize
64KB
-
memory/4468-181-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/4468-164-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/4468-168-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/4468-166-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/4468-162-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/4468-160-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/4468-158-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/4468-154-0x0000000002370000-0x0000000002380000-memory.dmpFilesize
64KB
-
memory/4468-152-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/4468-149-0x0000000002100000-0x000000000212D000-memory.dmpFilesize
180KB
-
memory/4468-148-0x0000000004AA0000-0x0000000005044000-memory.dmpFilesize
5.6MB