Analysis
-
max time kernel
61s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 19:09
Static task
static1
Behavioral task
behavioral1
Sample
808f46eda5cc5186e6b9134e3117df2ed1efdff316f47e0f5691783b0bac37a4.exe
Resource
win10v2004-20230220-en
General
-
Target
808f46eda5cc5186e6b9134e3117df2ed1efdff316f47e0f5691783b0bac37a4.exe
-
Size
534KB
-
MD5
c08a47390134cb61562000af6e434d24
-
SHA1
eafefbe4dfbaa29c8c1507e110853cd453c6b73a
-
SHA256
808f46eda5cc5186e6b9134e3117df2ed1efdff316f47e0f5691783b0bac37a4
-
SHA512
f7a72134228811e35655ad30ee36fe3f5f6dd7b59f49507319e394a4a477f02fda003214a419b4fe241633bc1863d7290d9ccb91adc25bd60ec4a2e58c423bab
-
SSDEEP
12288:IMrqy90e67T6cLx5olAzEyqBpOCGrL/O61poVrePDT1:Syy5ypBpOhbEry1
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr994584.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr994584.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr994584.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr994584.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr994584.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr994584.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr994584.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 34 IoCs
Processes:
resource yara_rule behavioral1/memory/2204-154-0x0000000002460000-0x000000000249F000-memory.dmp family_redline behavioral1/memory/2204-155-0x0000000002460000-0x000000000249F000-memory.dmp family_redline behavioral1/memory/2204-160-0x0000000002460000-0x000000000249F000-memory.dmp family_redline behavioral1/memory/2204-157-0x0000000002460000-0x000000000249F000-memory.dmp family_redline behavioral1/memory/2204-167-0x0000000002460000-0x000000000249F000-memory.dmp family_redline behavioral1/memory/2204-169-0x0000000002460000-0x000000000249F000-memory.dmp family_redline behavioral1/memory/2204-171-0x0000000002460000-0x000000000249F000-memory.dmp family_redline behavioral1/memory/2204-164-0x0000000002460000-0x000000000249F000-memory.dmp family_redline behavioral1/memory/2204-173-0x0000000002460000-0x000000000249F000-memory.dmp family_redline behavioral1/memory/2204-175-0x0000000002460000-0x000000000249F000-memory.dmp family_redline behavioral1/memory/2204-177-0x0000000002460000-0x000000000249F000-memory.dmp family_redline behavioral1/memory/2204-179-0x0000000002460000-0x000000000249F000-memory.dmp family_redline behavioral1/memory/2204-181-0x0000000002460000-0x000000000249F000-memory.dmp family_redline behavioral1/memory/2204-183-0x0000000002460000-0x000000000249F000-memory.dmp family_redline behavioral1/memory/2204-185-0x0000000002460000-0x000000000249F000-memory.dmp family_redline behavioral1/memory/2204-187-0x0000000002460000-0x000000000249F000-memory.dmp family_redline behavioral1/memory/2204-189-0x0000000002460000-0x000000000249F000-memory.dmp family_redline behavioral1/memory/2204-191-0x0000000002460000-0x000000000249F000-memory.dmp family_redline behavioral1/memory/2204-193-0x0000000002460000-0x000000000249F000-memory.dmp family_redline behavioral1/memory/2204-195-0x0000000002460000-0x000000000249F000-memory.dmp family_redline behavioral1/memory/2204-197-0x0000000002460000-0x000000000249F000-memory.dmp family_redline behavioral1/memory/2204-199-0x0000000002460000-0x000000000249F000-memory.dmp family_redline behavioral1/memory/2204-201-0x0000000002460000-0x000000000249F000-memory.dmp family_redline behavioral1/memory/2204-203-0x0000000002460000-0x000000000249F000-memory.dmp family_redline behavioral1/memory/2204-205-0x0000000002460000-0x000000000249F000-memory.dmp family_redline behavioral1/memory/2204-207-0x0000000002460000-0x000000000249F000-memory.dmp family_redline behavioral1/memory/2204-209-0x0000000002460000-0x000000000249F000-memory.dmp family_redline behavioral1/memory/2204-211-0x0000000002460000-0x000000000249F000-memory.dmp family_redline behavioral1/memory/2204-213-0x0000000002460000-0x000000000249F000-memory.dmp family_redline behavioral1/memory/2204-215-0x0000000002460000-0x000000000249F000-memory.dmp family_redline behavioral1/memory/2204-217-0x0000000002460000-0x000000000249F000-memory.dmp family_redline behavioral1/memory/2204-219-0x0000000002460000-0x000000000249F000-memory.dmp family_redline behavioral1/memory/2204-221-0x0000000002460000-0x000000000249F000-memory.dmp family_redline behavioral1/memory/2204-1072-0x0000000004C10000-0x0000000004C20000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
zieo2541.exejr994584.exeku672592.exelr807580.exepid process 4444 zieo2541.exe 1280 jr994584.exe 2204 ku672592.exe 1308 lr807580.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr994584.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr994584.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
zieo2541.exe808f46eda5cc5186e6b9134e3117df2ed1efdff316f47e0f5691783b0bac37a4.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zieo2541.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zieo2541.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 808f46eda5cc5186e6b9134e3117df2ed1efdff316f47e0f5691783b0bac37a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 808f46eda5cc5186e6b9134e3117df2ed1efdff316f47e0f5691783b0bac37a4.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4624 2204 WerFault.exe ku672592.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr994584.exeku672592.exelr807580.exepid process 1280 jr994584.exe 1280 jr994584.exe 2204 ku672592.exe 2204 ku672592.exe 1308 lr807580.exe 1308 lr807580.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr994584.exeku672592.exelr807580.exedescription pid process Token: SeDebugPrivilege 1280 jr994584.exe Token: SeDebugPrivilege 2204 ku672592.exe Token: SeDebugPrivilege 1308 lr807580.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
808f46eda5cc5186e6b9134e3117df2ed1efdff316f47e0f5691783b0bac37a4.exezieo2541.exedescription pid process target process PID 452 wrote to memory of 4444 452 808f46eda5cc5186e6b9134e3117df2ed1efdff316f47e0f5691783b0bac37a4.exe zieo2541.exe PID 452 wrote to memory of 4444 452 808f46eda5cc5186e6b9134e3117df2ed1efdff316f47e0f5691783b0bac37a4.exe zieo2541.exe PID 452 wrote to memory of 4444 452 808f46eda5cc5186e6b9134e3117df2ed1efdff316f47e0f5691783b0bac37a4.exe zieo2541.exe PID 4444 wrote to memory of 1280 4444 zieo2541.exe jr994584.exe PID 4444 wrote to memory of 1280 4444 zieo2541.exe jr994584.exe PID 4444 wrote to memory of 2204 4444 zieo2541.exe ku672592.exe PID 4444 wrote to memory of 2204 4444 zieo2541.exe ku672592.exe PID 4444 wrote to memory of 2204 4444 zieo2541.exe ku672592.exe PID 452 wrote to memory of 1308 452 808f46eda5cc5186e6b9134e3117df2ed1efdff316f47e0f5691783b0bac37a4.exe lr807580.exe PID 452 wrote to memory of 1308 452 808f46eda5cc5186e6b9134e3117df2ed1efdff316f47e0f5691783b0bac37a4.exe lr807580.exe PID 452 wrote to memory of 1308 452 808f46eda5cc5186e6b9134e3117df2ed1efdff316f47e0f5691783b0bac37a4.exe lr807580.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\808f46eda5cc5186e6b9134e3117df2ed1efdff316f47e0f5691783b0bac37a4.exe"C:\Users\Admin\AppData\Local\Temp\808f46eda5cc5186e6b9134e3117df2ed1efdff316f47e0f5691783b0bac37a4.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zieo2541.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zieo2541.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr994584.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr994584.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku672592.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku672592.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 18164⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr807580.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr807580.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2204 -ip 22041⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr807580.exeFilesize
175KB
MD5096a66cad1991addf457da9c27d706d6
SHA18da7ced64aec698727d46ce8ca7e4832db63aa6f
SHA256dceec9ba106f94c3d0e20fc567575829ba7b7ba117a204861bbfa23f19fc1be1
SHA5129e416092ef44e5d583d6754689a1436ac3ba9306c1e71cebaf3d09a56b927408ef42947153ca58c154b01f8b691fcbc652669f457d5aaf09067cbee877173590
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr807580.exeFilesize
175KB
MD5096a66cad1991addf457da9c27d706d6
SHA18da7ced64aec698727d46ce8ca7e4832db63aa6f
SHA256dceec9ba106f94c3d0e20fc567575829ba7b7ba117a204861bbfa23f19fc1be1
SHA5129e416092ef44e5d583d6754689a1436ac3ba9306c1e71cebaf3d09a56b927408ef42947153ca58c154b01f8b691fcbc652669f457d5aaf09067cbee877173590
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zieo2541.exeFilesize
392KB
MD53f604f1b7d7ac5989c4aa16de5c5e3ce
SHA1803123a6d72b543fbee60b08d1a91c92b7f9ccec
SHA256bfb0652eb4a224d003b56e8c9dd1d0637b86de5d437c58a726c5970284c6f8a1
SHA5120593f0d46cc6aaa1fe083e262a5d1858b50856b81d1767ff8a8a4159e5a5848dbba11cfab3ee9ab7a198d39fc728af074a591aaa366d49b436fab1e40b827203
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zieo2541.exeFilesize
392KB
MD53f604f1b7d7ac5989c4aa16de5c5e3ce
SHA1803123a6d72b543fbee60b08d1a91c92b7f9ccec
SHA256bfb0652eb4a224d003b56e8c9dd1d0637b86de5d437c58a726c5970284c6f8a1
SHA5120593f0d46cc6aaa1fe083e262a5d1858b50856b81d1767ff8a8a4159e5a5848dbba11cfab3ee9ab7a198d39fc728af074a591aaa366d49b436fab1e40b827203
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr994584.exeFilesize
11KB
MD5e8ed1f81397f5f52efbbeb3d4e4c11a2
SHA1db8f98b1d64afa55ca3702a0aa99aee275121080
SHA25637f44c0ef6d51e0d14c1e542015bd61890e740e0867f6212b90a56452627355f
SHA51272af2dd2ca0169c85f430a0b0e3f0adc34e3bca50853a99564caa56a377005821b10bb6519c397dd5d08f6a835442fb9370d6d566508f8d256de4c470311b2d4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr994584.exeFilesize
11KB
MD5e8ed1f81397f5f52efbbeb3d4e4c11a2
SHA1db8f98b1d64afa55ca3702a0aa99aee275121080
SHA25637f44c0ef6d51e0d14c1e542015bd61890e740e0867f6212b90a56452627355f
SHA51272af2dd2ca0169c85f430a0b0e3f0adc34e3bca50853a99564caa56a377005821b10bb6519c397dd5d08f6a835442fb9370d6d566508f8d256de4c470311b2d4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku672592.exeFilesize
318KB
MD512b6727bf2ca6825c1dea3f2129fc3f8
SHA1ef6a1770368574872e32e2d1bfd01b5277152143
SHA256fbd74b0411f355bd72805cf07cd6675c7839ad9871342e629bd6e4f671430d07
SHA512a35a6b27a4ead65937cb7616465d2931aff7c042fcb7c5d40fadbe932bdd87935c8eeaa129f0efaa8d6281dc2b6f40fe2cef4c47325b1c87515213bf66ba040d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku672592.exeFilesize
318KB
MD512b6727bf2ca6825c1dea3f2129fc3f8
SHA1ef6a1770368574872e32e2d1bfd01b5277152143
SHA256fbd74b0411f355bd72805cf07cd6675c7839ad9871342e629bd6e4f671430d07
SHA512a35a6b27a4ead65937cb7616465d2931aff7c042fcb7c5d40fadbe932bdd87935c8eeaa129f0efaa8d6281dc2b6f40fe2cef4c47325b1c87515213bf66ba040d
-
memory/1280-147-0x0000000000C90000-0x0000000000C9A000-memory.dmpFilesize
40KB
-
memory/1308-1086-0x00000000002F0000-0x0000000000322000-memory.dmpFilesize
200KB
-
memory/1308-1087-0x0000000004B60000-0x0000000004B70000-memory.dmpFilesize
64KB
-
memory/2204-189-0x0000000002460000-0x000000000249F000-memory.dmpFilesize
252KB
-
memory/2204-201-0x0000000002460000-0x000000000249F000-memory.dmpFilesize
252KB
-
memory/2204-155-0x0000000002460000-0x000000000249F000-memory.dmpFilesize
252KB
-
memory/2204-159-0x0000000000780000-0x00000000007CB000-memory.dmpFilesize
300KB
-
memory/2204-161-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/2204-160-0x0000000002460000-0x000000000249F000-memory.dmpFilesize
252KB
-
memory/2204-163-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/2204-157-0x0000000002460000-0x000000000249F000-memory.dmpFilesize
252KB
-
memory/2204-165-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/2204-167-0x0000000002460000-0x000000000249F000-memory.dmpFilesize
252KB
-
memory/2204-169-0x0000000002460000-0x000000000249F000-memory.dmpFilesize
252KB
-
memory/2204-171-0x0000000002460000-0x000000000249F000-memory.dmpFilesize
252KB
-
memory/2204-164-0x0000000002460000-0x000000000249F000-memory.dmpFilesize
252KB
-
memory/2204-173-0x0000000002460000-0x000000000249F000-memory.dmpFilesize
252KB
-
memory/2204-175-0x0000000002460000-0x000000000249F000-memory.dmpFilesize
252KB
-
memory/2204-177-0x0000000002460000-0x000000000249F000-memory.dmpFilesize
252KB
-
memory/2204-179-0x0000000002460000-0x000000000249F000-memory.dmpFilesize
252KB
-
memory/2204-181-0x0000000002460000-0x000000000249F000-memory.dmpFilesize
252KB
-
memory/2204-183-0x0000000002460000-0x000000000249F000-memory.dmpFilesize
252KB
-
memory/2204-185-0x0000000002460000-0x000000000249F000-memory.dmpFilesize
252KB
-
memory/2204-187-0x0000000002460000-0x000000000249F000-memory.dmpFilesize
252KB
-
memory/2204-153-0x0000000004C20000-0x00000000051C4000-memory.dmpFilesize
5.6MB
-
memory/2204-191-0x0000000002460000-0x000000000249F000-memory.dmpFilesize
252KB
-
memory/2204-193-0x0000000002460000-0x000000000249F000-memory.dmpFilesize
252KB
-
memory/2204-195-0x0000000002460000-0x000000000249F000-memory.dmpFilesize
252KB
-
memory/2204-197-0x0000000002460000-0x000000000249F000-memory.dmpFilesize
252KB
-
memory/2204-199-0x0000000002460000-0x000000000249F000-memory.dmpFilesize
252KB
-
memory/2204-154-0x0000000002460000-0x000000000249F000-memory.dmpFilesize
252KB
-
memory/2204-203-0x0000000002460000-0x000000000249F000-memory.dmpFilesize
252KB
-
memory/2204-205-0x0000000002460000-0x000000000249F000-memory.dmpFilesize
252KB
-
memory/2204-207-0x0000000002460000-0x000000000249F000-memory.dmpFilesize
252KB
-
memory/2204-209-0x0000000002460000-0x000000000249F000-memory.dmpFilesize
252KB
-
memory/2204-211-0x0000000002460000-0x000000000249F000-memory.dmpFilesize
252KB
-
memory/2204-213-0x0000000002460000-0x000000000249F000-memory.dmpFilesize
252KB
-
memory/2204-215-0x0000000002460000-0x000000000249F000-memory.dmpFilesize
252KB
-
memory/2204-217-0x0000000002460000-0x000000000249F000-memory.dmpFilesize
252KB
-
memory/2204-219-0x0000000002460000-0x000000000249F000-memory.dmpFilesize
252KB
-
memory/2204-221-0x0000000002460000-0x000000000249F000-memory.dmpFilesize
252KB
-
memory/2204-1064-0x00000000051D0000-0x00000000057E8000-memory.dmpFilesize
6.1MB
-
memory/2204-1065-0x00000000057F0000-0x00000000058FA000-memory.dmpFilesize
1.0MB
-
memory/2204-1066-0x0000000004BB0000-0x0000000004BC2000-memory.dmpFilesize
72KB
-
memory/2204-1067-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/2204-1068-0x0000000004BD0000-0x0000000004C0C000-memory.dmpFilesize
240KB
-
memory/2204-1070-0x0000000005BB0000-0x0000000005C42000-memory.dmpFilesize
584KB
-
memory/2204-1071-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/2204-1072-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/2204-1073-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/2204-1074-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/2204-1075-0x0000000006350000-0x00000000063C6000-memory.dmpFilesize
472KB
-
memory/2204-1076-0x00000000063E0000-0x0000000006430000-memory.dmpFilesize
320KB
-
memory/2204-1077-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/2204-1078-0x0000000006550000-0x0000000006712000-memory.dmpFilesize
1.8MB
-
memory/2204-1079-0x0000000006740000-0x0000000006C6C000-memory.dmpFilesize
5.2MB