Analysis
-
max time kernel
50s -
max time network
58s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
31-03-2023 19:07
Static task
static1
Behavioral task
behavioral1
Sample
d5ed95268ced1c0758daa7527983209f982ac75254274fb7bbcd296f558d71eb.exe
Resource
win10-20230220-en
General
-
Target
d5ed95268ced1c0758daa7527983209f982ac75254274fb7bbcd296f558d71eb.exe
-
Size
672KB
-
MD5
c7411dcd7d11f2ab5f566451774eda6a
-
SHA1
3a573e0f933503bbf0fdad4101a59ecef0b3a354
-
SHA256
d5ed95268ced1c0758daa7527983209f982ac75254274fb7bbcd296f558d71eb
-
SHA512
2fbc8d1af29a339417b1552319bea8eaeb6452422ac14ddffbdf3e7f1426d377f521ef3f3b7e041171d3bddfc14d29eaedaf6cefd98cfe088e300528c809bd40
-
SSDEEP
12288:cMrMy90ePxjWpuZ1Fp5hbMryea0s2PzSqMq3/OC3Dx/O1H3ETINoie9:YyVPxznMryeJs2PP3/OvXE7
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro0159.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro0159.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro0159.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro0159.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro0159.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro0159.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/3480-175-0x0000000002390000-0x00000000023D6000-memory.dmp family_redline behavioral1/memory/3480-176-0x0000000004A20000-0x0000000004A64000-memory.dmp family_redline behavioral1/memory/3480-177-0x0000000004A20000-0x0000000004A5F000-memory.dmp family_redline behavioral1/memory/3480-178-0x0000000004A20000-0x0000000004A5F000-memory.dmp family_redline behavioral1/memory/3480-180-0x0000000004A20000-0x0000000004A5F000-memory.dmp family_redline behavioral1/memory/3480-182-0x0000000004A20000-0x0000000004A5F000-memory.dmp family_redline behavioral1/memory/3480-184-0x0000000004A20000-0x0000000004A5F000-memory.dmp family_redline behavioral1/memory/3480-186-0x0000000004A20000-0x0000000004A5F000-memory.dmp family_redline behavioral1/memory/3480-188-0x0000000004A20000-0x0000000004A5F000-memory.dmp family_redline behavioral1/memory/3480-190-0x0000000004A20000-0x0000000004A5F000-memory.dmp family_redline behavioral1/memory/3480-192-0x0000000004A20000-0x0000000004A5F000-memory.dmp family_redline behavioral1/memory/3480-194-0x0000000004A20000-0x0000000004A5F000-memory.dmp family_redline behavioral1/memory/3480-196-0x0000000004A20000-0x0000000004A5F000-memory.dmp family_redline behavioral1/memory/3480-198-0x0000000004A20000-0x0000000004A5F000-memory.dmp family_redline behavioral1/memory/3480-202-0x0000000004A20000-0x0000000004A5F000-memory.dmp family_redline behavioral1/memory/3480-200-0x0000000004A20000-0x0000000004A5F000-memory.dmp family_redline behavioral1/memory/3480-204-0x0000000004A20000-0x0000000004A5F000-memory.dmp family_redline behavioral1/memory/3480-206-0x0000000004A20000-0x0000000004A5F000-memory.dmp family_redline behavioral1/memory/3480-210-0x0000000004A20000-0x0000000004A5F000-memory.dmp family_redline behavioral1/memory/3480-208-0x0000000004A20000-0x0000000004A5F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un896578.exepro0159.exequ7850.exesi798434.exepid process 4144 un896578.exe 4140 pro0159.exe 3480 qu7850.exe 4852 si798434.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro0159.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro0159.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro0159.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un896578.exed5ed95268ced1c0758daa7527983209f982ac75254274fb7bbcd296f558d71eb.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un896578.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un896578.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce d5ed95268ced1c0758daa7527983209f982ac75254274fb7bbcd296f558d71eb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" d5ed95268ced1c0758daa7527983209f982ac75254274fb7bbcd296f558d71eb.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro0159.exequ7850.exesi798434.exepid process 4140 pro0159.exe 4140 pro0159.exe 3480 qu7850.exe 3480 qu7850.exe 4852 si798434.exe 4852 si798434.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro0159.exequ7850.exesi798434.exedescription pid process Token: SeDebugPrivilege 4140 pro0159.exe Token: SeDebugPrivilege 3480 qu7850.exe Token: SeDebugPrivilege 4852 si798434.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
d5ed95268ced1c0758daa7527983209f982ac75254274fb7bbcd296f558d71eb.exeun896578.exedescription pid process target process PID 3508 wrote to memory of 4144 3508 d5ed95268ced1c0758daa7527983209f982ac75254274fb7bbcd296f558d71eb.exe un896578.exe PID 3508 wrote to memory of 4144 3508 d5ed95268ced1c0758daa7527983209f982ac75254274fb7bbcd296f558d71eb.exe un896578.exe PID 3508 wrote to memory of 4144 3508 d5ed95268ced1c0758daa7527983209f982ac75254274fb7bbcd296f558d71eb.exe un896578.exe PID 4144 wrote to memory of 4140 4144 un896578.exe pro0159.exe PID 4144 wrote to memory of 4140 4144 un896578.exe pro0159.exe PID 4144 wrote to memory of 4140 4144 un896578.exe pro0159.exe PID 4144 wrote to memory of 3480 4144 un896578.exe qu7850.exe PID 4144 wrote to memory of 3480 4144 un896578.exe qu7850.exe PID 4144 wrote to memory of 3480 4144 un896578.exe qu7850.exe PID 3508 wrote to memory of 4852 3508 d5ed95268ced1c0758daa7527983209f982ac75254274fb7bbcd296f558d71eb.exe si798434.exe PID 3508 wrote to memory of 4852 3508 d5ed95268ced1c0758daa7527983209f982ac75254274fb7bbcd296f558d71eb.exe si798434.exe PID 3508 wrote to memory of 4852 3508 d5ed95268ced1c0758daa7527983209f982ac75254274fb7bbcd296f558d71eb.exe si798434.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5ed95268ced1c0758daa7527983209f982ac75254274fb7bbcd296f558d71eb.exe"C:\Users\Admin\AppData\Local\Temp\d5ed95268ced1c0758daa7527983209f982ac75254274fb7bbcd296f558d71eb.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un896578.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un896578.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0159.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0159.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7850.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7850.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si798434.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si798434.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si798434.exeFilesize
175KB
MD5fc6a2a00578cf3f45981b9efbc3af47f
SHA17b70855f65ee6313b210737466d223c53730350b
SHA256013cb634064eace55ed6e7be683c9ac14038f39cb8497813708415aed00a2a89
SHA512694ff4d0cbb3c681f81b559f69a115d0bcba278f89cc29f5451f89da60fae69a2a6affe10bfeb08b791caaabc8760c6b117cfc080832a47c73760553ebb01bea
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si798434.exeFilesize
175KB
MD5fc6a2a00578cf3f45981b9efbc3af47f
SHA17b70855f65ee6313b210737466d223c53730350b
SHA256013cb634064eace55ed6e7be683c9ac14038f39cb8497813708415aed00a2a89
SHA512694ff4d0cbb3c681f81b559f69a115d0bcba278f89cc29f5451f89da60fae69a2a6affe10bfeb08b791caaabc8760c6b117cfc080832a47c73760553ebb01bea
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un896578.exeFilesize
530KB
MD5c7e120726fc4ea7fad07527b33957d5a
SHA1aa4b3b31b0b40c258361c7434365c5c5fd29cda2
SHA256b02ee5c3c9c793040b7fb2e02c6fed9435efa7538251b5f1684ff5eab5b86f0f
SHA512ace28751896ae0e78772f89bac7c273fde48dbcffb16e0e2701b18c7998896da7b241c381ad3ea4b4620fc513535ca502111c968cd272af68722e09ae8c7faa7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un896578.exeFilesize
530KB
MD5c7e120726fc4ea7fad07527b33957d5a
SHA1aa4b3b31b0b40c258361c7434365c5c5fd29cda2
SHA256b02ee5c3c9c793040b7fb2e02c6fed9435efa7538251b5f1684ff5eab5b86f0f
SHA512ace28751896ae0e78772f89bac7c273fde48dbcffb16e0e2701b18c7998896da7b241c381ad3ea4b4620fc513535ca502111c968cd272af68722e09ae8c7faa7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0159.exeFilesize
259KB
MD57ff8ffa5103892ee81667b46416564b0
SHA1c4f69178f300e0063651575a2fba0e93874c5019
SHA2569ceb9fd8a1a9dd8bc805b8fd85da396672af7456eeff5a85b0b5f257983b20ea
SHA512dfd128bf4b871ddf92ce86c34fffba5566a1d880496a012386405bb6b9bf7a5badfbcba1586348bf1a7b99eeffd3569a92351087505770446acb691e4c62cba9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0159.exeFilesize
259KB
MD57ff8ffa5103892ee81667b46416564b0
SHA1c4f69178f300e0063651575a2fba0e93874c5019
SHA2569ceb9fd8a1a9dd8bc805b8fd85da396672af7456eeff5a85b0b5f257983b20ea
SHA512dfd128bf4b871ddf92ce86c34fffba5566a1d880496a012386405bb6b9bf7a5badfbcba1586348bf1a7b99eeffd3569a92351087505770446acb691e4c62cba9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7850.exeFilesize
318KB
MD5fd1538d4b881e6f0df41203e46e53fd4
SHA143daa49199d4d511bd93368da431825740332b1c
SHA256b0a5e26218ddc1ba51fb32c6a096fdd13e8e0a1533fb69e5b418d08cba843ffc
SHA5125ec79b3de410b27d75ba6e1d477a5315f4f02eb3ebefee80d8de13edbfd0910c0639262acc613f82e745e4b5b8667c4b4944ff58348dfe9f19efd1a14f9019e0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7850.exeFilesize
318KB
MD5fd1538d4b881e6f0df41203e46e53fd4
SHA143daa49199d4d511bd93368da431825740332b1c
SHA256b0a5e26218ddc1ba51fb32c6a096fdd13e8e0a1533fb69e5b418d08cba843ffc
SHA5125ec79b3de410b27d75ba6e1d477a5315f4f02eb3ebefee80d8de13edbfd0910c0639262acc613f82e745e4b5b8667c4b4944ff58348dfe9f19efd1a14f9019e0
-
memory/3480-1087-0x0000000005080000-0x0000000005686000-memory.dmpFilesize
6.0MB
-
memory/3480-1088-0x0000000005690000-0x000000000579A000-memory.dmpFilesize
1.0MB
-
memory/3480-1103-0x0000000006D50000-0x0000000006DA0000-memory.dmpFilesize
320KB
-
memory/3480-1102-0x0000000006CC0000-0x0000000006D36000-memory.dmpFilesize
472KB
-
memory/3480-1101-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/3480-1100-0x0000000006530000-0x0000000006A5C000-memory.dmpFilesize
5.2MB
-
memory/3480-1099-0x0000000006360000-0x0000000006522000-memory.dmpFilesize
1.8MB
-
memory/3480-192-0x0000000004A20000-0x0000000004A5F000-memory.dmpFilesize
252KB
-
memory/3480-1098-0x0000000005B40000-0x0000000005BA6000-memory.dmpFilesize
408KB
-
memory/3480-1097-0x0000000005AA0000-0x0000000005B32000-memory.dmpFilesize
584KB
-
memory/3480-1096-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/3480-1095-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/3480-1094-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/3480-194-0x0000000004A20000-0x0000000004A5F000-memory.dmpFilesize
252KB
-
memory/3480-1092-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/3480-1091-0x0000000005910000-0x000000000595B000-memory.dmpFilesize
300KB
-
memory/3480-1090-0x00000000057C0000-0x00000000057FE000-memory.dmpFilesize
248KB
-
memory/3480-196-0x0000000004A20000-0x0000000004A5F000-memory.dmpFilesize
252KB
-
memory/3480-1089-0x00000000057A0000-0x00000000057B2000-memory.dmpFilesize
72KB
-
memory/3480-210-0x0000000004A20000-0x0000000004A5F000-memory.dmpFilesize
252KB
-
memory/3480-372-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/3480-368-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/3480-175-0x0000000002390000-0x00000000023D6000-memory.dmpFilesize
280KB
-
memory/3480-176-0x0000000004A20000-0x0000000004A64000-memory.dmpFilesize
272KB
-
memory/3480-177-0x0000000004A20000-0x0000000004A5F000-memory.dmpFilesize
252KB
-
memory/3480-178-0x0000000004A20000-0x0000000004A5F000-memory.dmpFilesize
252KB
-
memory/3480-180-0x0000000004A20000-0x0000000004A5F000-memory.dmpFilesize
252KB
-
memory/3480-182-0x0000000004A20000-0x0000000004A5F000-memory.dmpFilesize
252KB
-
memory/3480-184-0x0000000004A20000-0x0000000004A5F000-memory.dmpFilesize
252KB
-
memory/3480-186-0x0000000004A20000-0x0000000004A5F000-memory.dmpFilesize
252KB
-
memory/3480-188-0x0000000004A20000-0x0000000004A5F000-memory.dmpFilesize
252KB
-
memory/3480-190-0x0000000004A20000-0x0000000004A5F000-memory.dmpFilesize
252KB
-
memory/3480-370-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/3480-366-0x00000000005A0000-0x00000000005EB000-memory.dmpFilesize
300KB
-
memory/3480-208-0x0000000004A20000-0x0000000004A5F000-memory.dmpFilesize
252KB
-
memory/3480-198-0x0000000004A20000-0x0000000004A5F000-memory.dmpFilesize
252KB
-
memory/3480-202-0x0000000004A20000-0x0000000004A5F000-memory.dmpFilesize
252KB
-
memory/3480-200-0x0000000004A20000-0x0000000004A5F000-memory.dmpFilesize
252KB
-
memory/3480-204-0x0000000004A20000-0x0000000004A5F000-memory.dmpFilesize
252KB
-
memory/3480-206-0x0000000004A20000-0x0000000004A5F000-memory.dmpFilesize
252KB
-
memory/4140-166-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/4140-167-0x0000000004CF0000-0x0000000004D00000-memory.dmpFilesize
64KB
-
memory/4140-163-0x00000000020F0000-0x0000000002102000-memory.dmpFilesize
72KB
-
memory/4140-151-0x00000000020F0000-0x0000000002102000-memory.dmpFilesize
72KB
-
memory/4140-136-0x00000000020F0000-0x0000000002108000-memory.dmpFilesize
96KB
-
memory/4140-137-0x0000000004CF0000-0x0000000004D00000-memory.dmpFilesize
64KB
-
memory/4140-135-0x0000000004D00000-0x00000000051FE000-memory.dmpFilesize
5.0MB
-
memory/4140-170-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/4140-168-0x0000000004CF0000-0x0000000004D00000-memory.dmpFilesize
64KB
-
memory/4140-138-0x00000000020F0000-0x0000000002102000-memory.dmpFilesize
72KB
-
memory/4140-157-0x00000000020F0000-0x0000000002102000-memory.dmpFilesize
72KB
-
memory/4140-161-0x00000000020F0000-0x0000000002102000-memory.dmpFilesize
72KB
-
memory/4140-165-0x00000000020F0000-0x0000000002102000-memory.dmpFilesize
72KB
-
memory/4140-159-0x00000000020F0000-0x0000000002102000-memory.dmpFilesize
72KB
-
memory/4140-155-0x00000000020F0000-0x0000000002102000-memory.dmpFilesize
72KB
-
memory/4140-153-0x00000000020F0000-0x0000000002102000-memory.dmpFilesize
72KB
-
memory/4140-149-0x00000000020F0000-0x0000000002102000-memory.dmpFilesize
72KB
-
memory/4140-147-0x00000000020F0000-0x0000000002102000-memory.dmpFilesize
72KB
-
memory/4140-145-0x00000000020F0000-0x0000000002102000-memory.dmpFilesize
72KB
-
memory/4140-143-0x00000000020F0000-0x0000000002102000-memory.dmpFilesize
72KB
-
memory/4140-141-0x00000000020F0000-0x0000000002102000-memory.dmpFilesize
72KB
-
memory/4140-139-0x00000000020F0000-0x0000000002102000-memory.dmpFilesize
72KB
-
memory/4140-134-0x00000000007C0000-0x00000000007DA000-memory.dmpFilesize
104KB
-
memory/4140-133-0x00000000001D0000-0x00000000001FD000-memory.dmpFilesize
180KB
-
memory/4852-1109-0x0000000000D00000-0x0000000000D32000-memory.dmpFilesize
200KB
-
memory/4852-1110-0x0000000005740000-0x000000000578B000-memory.dmpFilesize
300KB
-
memory/4852-1111-0x0000000005590000-0x00000000055A0000-memory.dmpFilesize
64KB