Analysis
-
max time kernel
63s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 19:12
Static task
static1
Behavioral task
behavioral1
Sample
2fe06f2fa56ad2eecff095d0f69add2d0e16ff24d4e0f2c5d09515262d3df6c4.exe
Resource
win10v2004-20230220-en
General
-
Target
2fe06f2fa56ad2eecff095d0f69add2d0e16ff24d4e0f2c5d09515262d3df6c4.exe
-
Size
671KB
-
MD5
0bb77a32046247803d398a842865a848
-
SHA1
d54be8eaf1b80b2fd463b686ab0dcbacbc010b41
-
SHA256
2fe06f2fa56ad2eecff095d0f69add2d0e16ff24d4e0f2c5d09515262d3df6c4
-
SHA512
c427bcf35fd9302174f8c5bdd90ac4cad20e35a7ed68975ecdc3181fe75fe8a5bd26e12f823f949884e24fc456112e212c25bb94e6189b47d7456c49576657d6
-
SSDEEP
12288:KMrMy90+Cc1T05pG30J3RQBXn1s1ApCM3T0ml1zvqeNOCmDP/Ot3+8S4iqgtT:iyx3A20JyVn1s18Ck0mTCeNOS3+h5hT
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro5838.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro5838.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro5838.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro5838.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro5838.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro5838.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro5838.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/2724-191-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2724-190-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2724-193-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2724-195-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2724-197-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2724-199-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2724-201-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2724-203-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2724-205-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2724-207-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2724-209-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2724-211-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2724-214-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2724-218-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2724-221-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2724-225-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2724-227-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2724-223-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un342273.exepro5838.exequ8948.exesi780513.exepid process 1144 un342273.exe 4428 pro5838.exe 2724 qu8948.exe 3744 si780513.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro5838.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro5838.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro5838.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
2fe06f2fa56ad2eecff095d0f69add2d0e16ff24d4e0f2c5d09515262d3df6c4.exeun342273.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 2fe06f2fa56ad2eecff095d0f69add2d0e16ff24d4e0f2c5d09515262d3df6c4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 2fe06f2fa56ad2eecff095d0f69add2d0e16ff24d4e0f2c5d09515262d3df6c4.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un342273.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un342273.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4368 4428 WerFault.exe pro5838.exe 1704 2724 WerFault.exe qu8948.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro5838.exequ8948.exesi780513.exepid process 4428 pro5838.exe 4428 pro5838.exe 2724 qu8948.exe 2724 qu8948.exe 3744 si780513.exe 3744 si780513.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro5838.exequ8948.exesi780513.exedescription pid process Token: SeDebugPrivilege 4428 pro5838.exe Token: SeDebugPrivilege 2724 qu8948.exe Token: SeDebugPrivilege 3744 si780513.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
2fe06f2fa56ad2eecff095d0f69add2d0e16ff24d4e0f2c5d09515262d3df6c4.exeun342273.exedescription pid process target process PID 4632 wrote to memory of 1144 4632 2fe06f2fa56ad2eecff095d0f69add2d0e16ff24d4e0f2c5d09515262d3df6c4.exe un342273.exe PID 4632 wrote to memory of 1144 4632 2fe06f2fa56ad2eecff095d0f69add2d0e16ff24d4e0f2c5d09515262d3df6c4.exe un342273.exe PID 4632 wrote to memory of 1144 4632 2fe06f2fa56ad2eecff095d0f69add2d0e16ff24d4e0f2c5d09515262d3df6c4.exe un342273.exe PID 1144 wrote to memory of 4428 1144 un342273.exe pro5838.exe PID 1144 wrote to memory of 4428 1144 un342273.exe pro5838.exe PID 1144 wrote to memory of 4428 1144 un342273.exe pro5838.exe PID 1144 wrote to memory of 2724 1144 un342273.exe qu8948.exe PID 1144 wrote to memory of 2724 1144 un342273.exe qu8948.exe PID 1144 wrote to memory of 2724 1144 un342273.exe qu8948.exe PID 4632 wrote to memory of 3744 4632 2fe06f2fa56ad2eecff095d0f69add2d0e16ff24d4e0f2c5d09515262d3df6c4.exe si780513.exe PID 4632 wrote to memory of 3744 4632 2fe06f2fa56ad2eecff095d0f69add2d0e16ff24d4e0f2c5d09515262d3df6c4.exe si780513.exe PID 4632 wrote to memory of 3744 4632 2fe06f2fa56ad2eecff095d0f69add2d0e16ff24d4e0f2c5d09515262d3df6c4.exe si780513.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2fe06f2fa56ad2eecff095d0f69add2d0e16ff24d4e0f2c5d09515262d3df6c4.exe"C:\Users\Admin\AppData\Local\Temp\2fe06f2fa56ad2eecff095d0f69add2d0e16ff24d4e0f2c5d09515262d3df6c4.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un342273.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un342273.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5838.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5838.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 10804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8948.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8948.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 13364⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si780513.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si780513.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4428 -ip 44281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2724 -ip 27241⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si780513.exeFilesize
175KB
MD55c7fcf2bc872c16bcdd8641068d711c3
SHA1bb64b2fc5ffbae1af7a6d1b96ed3a9daaf9f1500
SHA256837557853988ccaee1a0b4fd531071fcde860edfa86a289bed9683cf4cab448a
SHA512ead42153e4f865b3386aae40cecd41189348aacf90bfef5cd17af9bef6c7e182bcdbfa085ee321866644d5a909e240ee98524235ecfb38e69bc6496795030d82
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si780513.exeFilesize
175KB
MD55c7fcf2bc872c16bcdd8641068d711c3
SHA1bb64b2fc5ffbae1af7a6d1b96ed3a9daaf9f1500
SHA256837557853988ccaee1a0b4fd531071fcde860edfa86a289bed9683cf4cab448a
SHA512ead42153e4f865b3386aae40cecd41189348aacf90bfef5cd17af9bef6c7e182bcdbfa085ee321866644d5a909e240ee98524235ecfb38e69bc6496795030d82
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un342273.exeFilesize
529KB
MD575bffc2e40bda5c224786debd6027ee3
SHA1b69a38e3c80056fdc1592f863602306bb0b8bba5
SHA25651d86d4f8388bddb582cb17feff6daa4194a2f3711264e295bb3e560ac62ab1a
SHA512b90a42e92f89543dfe7814ab7ef156eba5a0a1f18dd534a0c5c0eee7822a943a9ba51983fad305032c65601130d56a8cf7e00226d36e927286649755134aaa84
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un342273.exeFilesize
529KB
MD575bffc2e40bda5c224786debd6027ee3
SHA1b69a38e3c80056fdc1592f863602306bb0b8bba5
SHA25651d86d4f8388bddb582cb17feff6daa4194a2f3711264e295bb3e560ac62ab1a
SHA512b90a42e92f89543dfe7814ab7ef156eba5a0a1f18dd534a0c5c0eee7822a943a9ba51983fad305032c65601130d56a8cf7e00226d36e927286649755134aaa84
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5838.exeFilesize
259KB
MD59acd2bd20f6a9a483fba58ec2b124514
SHA172a81e99d0ca27bded900ff0101663773563ccee
SHA256ae7ff2a897a302870fe55356d0c1d32f5254547822d641a34a58bf56cd226130
SHA512f3954c8d02776d4595c065603dce0563d8ef01caf6fbd420bb26bc71b9e75c12e158eff926e43758c6a79c7b46a9d8bdcc4ad06155eb4f8d701f58ba676a8e49
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5838.exeFilesize
259KB
MD59acd2bd20f6a9a483fba58ec2b124514
SHA172a81e99d0ca27bded900ff0101663773563ccee
SHA256ae7ff2a897a302870fe55356d0c1d32f5254547822d641a34a58bf56cd226130
SHA512f3954c8d02776d4595c065603dce0563d8ef01caf6fbd420bb26bc71b9e75c12e158eff926e43758c6a79c7b46a9d8bdcc4ad06155eb4f8d701f58ba676a8e49
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8948.exeFilesize
318KB
MD5a2d4d65b57d178c708abdfdc67910fab
SHA10471c29307cc1359c2eb33d8707b26d721455cb7
SHA2560d9c4eb70d2ff4b5f9553bd5b0d37004d70291c833844976ee97b3251c3710bd
SHA512c84b3465bb7972334c8d3dcf67b5b32f21efbc6bf1a63d7e38028243c61da8eb98cf7ce7af5a126584c26ae0ffcf2a1fe387d35d45bf6b75eac0f1510a8a6d60
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8948.exeFilesize
318KB
MD5a2d4d65b57d178c708abdfdc67910fab
SHA10471c29307cc1359c2eb33d8707b26d721455cb7
SHA2560d9c4eb70d2ff4b5f9553bd5b0d37004d70291c833844976ee97b3251c3710bd
SHA512c84b3465bb7972334c8d3dcf67b5b32f21efbc6bf1a63d7e38028243c61da8eb98cf7ce7af5a126584c26ae0ffcf2a1fe387d35d45bf6b75eac0f1510a8a6d60
-
memory/2724-1102-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/2724-1101-0x0000000005760000-0x000000000586A000-memory.dmpFilesize
1.0MB
-
memory/2724-219-0x0000000004AE0000-0x0000000004AF0000-memory.dmpFilesize
64KB
-
memory/2724-218-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2724-205-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2724-207-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2724-1115-0x0000000006FC0000-0x0000000007010000-memory.dmpFilesize
320KB
-
memory/2724-1114-0x0000000006F40000-0x0000000006FB6000-memory.dmpFilesize
472KB
-
memory/2724-1113-0x0000000004AE0000-0x0000000004AF0000-memory.dmpFilesize
64KB
-
memory/2724-1112-0x0000000006690000-0x0000000006BBC000-memory.dmpFilesize
5.2MB
-
memory/2724-209-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2724-1111-0x00000000064B0000-0x0000000006672000-memory.dmpFilesize
1.8MB
-
memory/2724-1109-0x0000000004AE0000-0x0000000004AF0000-memory.dmpFilesize
64KB
-
memory/2724-1110-0x0000000004AE0000-0x0000000004AF0000-memory.dmpFilesize
64KB
-
memory/2724-1108-0x0000000004AE0000-0x0000000004AF0000-memory.dmpFilesize
64KB
-
memory/2724-1107-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/2724-1106-0x0000000005BB0000-0x0000000005C42000-memory.dmpFilesize
584KB
-
memory/2724-1103-0x0000000004AE0000-0x0000000004AF0000-memory.dmpFilesize
64KB
-
memory/2724-1104-0x00000000058C0000-0x00000000058FC000-memory.dmpFilesize
240KB
-
memory/2724-221-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2724-1100-0x00000000050C0000-0x00000000056D8000-memory.dmpFilesize
6.1MB
-
memory/2724-223-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2724-191-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2724-190-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2724-193-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2724-195-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2724-197-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2724-199-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2724-201-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2724-203-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2724-217-0x0000000004AE0000-0x0000000004AF0000-memory.dmpFilesize
64KB
-
memory/2724-227-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2724-225-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2724-211-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2724-213-0x0000000002110000-0x000000000215B000-memory.dmpFilesize
300KB
-
memory/2724-215-0x0000000004AE0000-0x0000000004AF0000-memory.dmpFilesize
64KB
-
memory/2724-214-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/3744-1121-0x00000000007D0000-0x0000000000802000-memory.dmpFilesize
200KB
-
memory/3744-1122-0x00000000053B0000-0x00000000053C0000-memory.dmpFilesize
64KB
-
memory/3744-1123-0x00000000053B0000-0x00000000053C0000-memory.dmpFilesize
64KB
-
memory/4428-181-0x00000000024F0000-0x0000000002500000-memory.dmpFilesize
64KB
-
memory/4428-171-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/4428-150-0x0000000004A80000-0x0000000005024000-memory.dmpFilesize
5.6MB
-
memory/4428-151-0x00000000024F0000-0x0000000002500000-memory.dmpFilesize
64KB
-
memory/4428-152-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/4428-185-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/4428-149-0x00000000024F0000-0x0000000002500000-memory.dmpFilesize
64KB
-
memory/4428-183-0x00000000024F0000-0x0000000002500000-memory.dmpFilesize
64KB
-
memory/4428-182-0x00000000024F0000-0x0000000002500000-memory.dmpFilesize
64KB
-
memory/4428-153-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/4428-180-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/4428-179-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/4428-177-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/4428-175-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/4428-173-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/4428-169-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/4428-167-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/4428-165-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/4428-163-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/4428-161-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/4428-148-0x0000000000500000-0x000000000052D000-memory.dmpFilesize
180KB
-
memory/4428-159-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/4428-157-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/4428-155-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB