Analysis
-
max time kernel
97s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 20:18
Static task
static1
Behavioral task
behavioral1
Sample
c0fe8aa839c806cf3079b1516cd217638238fd6778944e9f792fe0e9b3cd3b5e.exe
Resource
win10v2004-20230220-en
General
-
Target
c0fe8aa839c806cf3079b1516cd217638238fd6778944e9f792fe0e9b3cd3b5e.exe
-
Size
672KB
-
MD5
8ece5999d57ae464fe9509227f132bfc
-
SHA1
b0cf71dfbcc4a39702dc29a1eecc975b10eb1e9f
-
SHA256
c0fe8aa839c806cf3079b1516cd217638238fd6778944e9f792fe0e9b3cd3b5e
-
SHA512
7266f9cbc6537acab49567c7786294eb239de5c1ce680ca298e89e68ed01ecee6e6d257e0492f185241b71ed2dc6a41eda388cf0325dc36790fba88e8a6e0fe9
-
SSDEEP
12288:8MrPy90RJbzf3KWTcZXirPlkW9RjSiJ+oTgeOciQnQTYimULqE8kXZDBUAgm0:DyeJbb3KWT6OCOFJEpwiQnQTYimUGE7q
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro9517.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro9517.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro9517.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro9517.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro9517.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro9517.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro9517.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/1736-189-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1736-190-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1736-192-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1736-194-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1736-196-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1736-198-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1736-200-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1736-202-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1736-204-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1736-206-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1736-208-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1736-212-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1736-210-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1736-214-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1736-216-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1736-218-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1736-220-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1736-222-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1736-244-0x00000000061F0000-0x0000000006200000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un733890.exepro9517.exequ7801.exesi435865.exepid process 1188 un733890.exe 3664 pro9517.exe 1736 qu7801.exe 3096 si435865.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro9517.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro9517.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro9517.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
c0fe8aa839c806cf3079b1516cd217638238fd6778944e9f792fe0e9b3cd3b5e.exeun733890.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce c0fe8aa839c806cf3079b1516cd217638238fd6778944e9f792fe0e9b3cd3b5e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c0fe8aa839c806cf3079b1516cd217638238fd6778944e9f792fe0e9b3cd3b5e.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un733890.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un733890.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3040 3664 WerFault.exe pro9517.exe 2308 1736 WerFault.exe qu7801.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro9517.exequ7801.exesi435865.exepid process 3664 pro9517.exe 3664 pro9517.exe 1736 qu7801.exe 1736 qu7801.exe 3096 si435865.exe 3096 si435865.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro9517.exequ7801.exesi435865.exedescription pid process Token: SeDebugPrivilege 3664 pro9517.exe Token: SeDebugPrivilege 1736 qu7801.exe Token: SeDebugPrivilege 3096 si435865.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
c0fe8aa839c806cf3079b1516cd217638238fd6778944e9f792fe0e9b3cd3b5e.exeun733890.exedescription pid process target process PID 5044 wrote to memory of 1188 5044 c0fe8aa839c806cf3079b1516cd217638238fd6778944e9f792fe0e9b3cd3b5e.exe un733890.exe PID 5044 wrote to memory of 1188 5044 c0fe8aa839c806cf3079b1516cd217638238fd6778944e9f792fe0e9b3cd3b5e.exe un733890.exe PID 5044 wrote to memory of 1188 5044 c0fe8aa839c806cf3079b1516cd217638238fd6778944e9f792fe0e9b3cd3b5e.exe un733890.exe PID 1188 wrote to memory of 3664 1188 un733890.exe pro9517.exe PID 1188 wrote to memory of 3664 1188 un733890.exe pro9517.exe PID 1188 wrote to memory of 3664 1188 un733890.exe pro9517.exe PID 1188 wrote to memory of 1736 1188 un733890.exe qu7801.exe PID 1188 wrote to memory of 1736 1188 un733890.exe qu7801.exe PID 1188 wrote to memory of 1736 1188 un733890.exe qu7801.exe PID 5044 wrote to memory of 3096 5044 c0fe8aa839c806cf3079b1516cd217638238fd6778944e9f792fe0e9b3cd3b5e.exe si435865.exe PID 5044 wrote to memory of 3096 5044 c0fe8aa839c806cf3079b1516cd217638238fd6778944e9f792fe0e9b3cd3b5e.exe si435865.exe PID 5044 wrote to memory of 3096 5044 c0fe8aa839c806cf3079b1516cd217638238fd6778944e9f792fe0e9b3cd3b5e.exe si435865.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0fe8aa839c806cf3079b1516cd217638238fd6778944e9f792fe0e9b3cd3b5e.exe"C:\Users\Admin\AppData\Local\Temp\c0fe8aa839c806cf3079b1516cd217638238fd6778944e9f792fe0e9b3cd3b5e.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un733890.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un733890.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9517.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9517.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 10804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7801.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7801.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 13484⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si435865.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si435865.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3664 -ip 36641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1736 -ip 17361⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si435865.exeFilesize
175KB
MD54b411dd84f555ec1f611ea2025a29d1d
SHA1f36a9b77d84ace20e880c625b0b797a04c88d5d0
SHA256fbf09d99756182753858bd216ae910c7d94b94c39f060d79d9827645e5d4e6c7
SHA512c971aa4676a459101cde17525fb7c7c185486b9c18299246a0c01b4fdb188395341f96f90b8cef43ddd2db0f6b82d0587dbf8061cf567fea8e7c0a91502f7e9f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si435865.exeFilesize
175KB
MD54b411dd84f555ec1f611ea2025a29d1d
SHA1f36a9b77d84ace20e880c625b0b797a04c88d5d0
SHA256fbf09d99756182753858bd216ae910c7d94b94c39f060d79d9827645e5d4e6c7
SHA512c971aa4676a459101cde17525fb7c7c185486b9c18299246a0c01b4fdb188395341f96f90b8cef43ddd2db0f6b82d0587dbf8061cf567fea8e7c0a91502f7e9f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un733890.exeFilesize
531KB
MD5a97e5524ad4da59b3ed78eb3639ffb04
SHA16a02d6a21540f8a40d67009218fad11e7a182ee9
SHA256f5c633b3eb6fcc0401c153549396f92c48df6274e12477c1848e3e79cb19ba59
SHA5123a4caf68115f2d305e54cf027b66a6741e0e2b1cbb4917da46f4266d641d7e0a4ea84d8f0124659cd7de59ec6c70c22a1f5e043f3fdbca63207c4d8b94ce2b74
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un733890.exeFilesize
531KB
MD5a97e5524ad4da59b3ed78eb3639ffb04
SHA16a02d6a21540f8a40d67009218fad11e7a182ee9
SHA256f5c633b3eb6fcc0401c153549396f92c48df6274e12477c1848e3e79cb19ba59
SHA5123a4caf68115f2d305e54cf027b66a6741e0e2b1cbb4917da46f4266d641d7e0a4ea84d8f0124659cd7de59ec6c70c22a1f5e043f3fdbca63207c4d8b94ce2b74
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9517.exeFilesize
260KB
MD5880bfb003944832aa82b2b85cc4b591b
SHA14df674d0c385197f5c12ce7cb76ed0a7048be33f
SHA25696a23ac4c4fbf84362da7c2d8d18bf15a73fbe26e91e7eb69a4337b49be9c932
SHA51241bd743c8298a96a4f60e52af7c4f8d998629aab0924ef647871773a5d425070ae26cac51ca822ccb961437eb9e388e35521cbbe722c4706999875124d3224f0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9517.exeFilesize
260KB
MD5880bfb003944832aa82b2b85cc4b591b
SHA14df674d0c385197f5c12ce7cb76ed0a7048be33f
SHA25696a23ac4c4fbf84362da7c2d8d18bf15a73fbe26e91e7eb69a4337b49be9c932
SHA51241bd743c8298a96a4f60e52af7c4f8d998629aab0924ef647871773a5d425070ae26cac51ca822ccb961437eb9e388e35521cbbe722c4706999875124d3224f0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7801.exeFilesize
359KB
MD57b4c5e148d1308f7390f19325c8ce0c7
SHA1bbb1e41747e38729764e304e7d51562a9a9ca433
SHA256d942b75d9c5c65d7a21c1711a5846701633a289e4a08f601f61e4c375fcd2958
SHA51284b3e8ef6dba0067acdc99337adfa77748b3a79b87021a4eb042a66325c11ab7c6961201ac95e8a66a922537e5a644eeff6c62fb67b8f4305640dabac6996f8f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7801.exeFilesize
359KB
MD57b4c5e148d1308f7390f19325c8ce0c7
SHA1bbb1e41747e38729764e304e7d51562a9a9ca433
SHA256d942b75d9c5c65d7a21c1711a5846701633a289e4a08f601f61e4c375fcd2958
SHA51284b3e8ef6dba0067acdc99337adfa77748b3a79b87021a4eb042a66325c11ab7c6961201ac95e8a66a922537e5a644eeff6c62fb67b8f4305640dabac6996f8f
-
memory/1736-1099-0x00000000068B0000-0x0000000006EC8000-memory.dmpFilesize
6.1MB
-
memory/1736-1102-0x0000000007040000-0x000000000707C000-memory.dmpFilesize
240KB
-
memory/1736-1114-0x0000000008030000-0x000000000855C000-memory.dmpFilesize
5.2MB
-
memory/1736-1113-0x0000000007E50000-0x0000000008012000-memory.dmpFilesize
1.8MB
-
memory/1736-1112-0x00000000061F0000-0x0000000006200000-memory.dmpFilesize
64KB
-
memory/1736-1111-0x00000000061F0000-0x0000000006200000-memory.dmpFilesize
64KB
-
memory/1736-1110-0x00000000061F0000-0x0000000006200000-memory.dmpFilesize
64KB
-
memory/1736-1109-0x00000000061F0000-0x0000000006200000-memory.dmpFilesize
64KB
-
memory/1736-1108-0x0000000007B60000-0x0000000007BB0000-memory.dmpFilesize
320KB
-
memory/1736-1107-0x0000000007AC0000-0x0000000007B36000-memory.dmpFilesize
472KB
-
memory/1736-1106-0x00000000073D0000-0x0000000007436000-memory.dmpFilesize
408KB
-
memory/1736-1105-0x0000000007330000-0x00000000073C2000-memory.dmpFilesize
584KB
-
memory/1736-1103-0x00000000061F0000-0x0000000006200000-memory.dmpFilesize
64KB
-
memory/1736-1101-0x0000000007020000-0x0000000007032000-memory.dmpFilesize
72KB
-
memory/1736-1100-0x0000000006EE0000-0x0000000006FEA000-memory.dmpFilesize
1.0MB
-
memory/1736-247-0x00000000061F0000-0x0000000006200000-memory.dmpFilesize
64KB
-
memory/1736-244-0x00000000061F0000-0x0000000006200000-memory.dmpFilesize
64KB
-
memory/1736-243-0x00000000061F0000-0x0000000006200000-memory.dmpFilesize
64KB
-
memory/1736-241-0x0000000001F10000-0x0000000001F5B000-memory.dmpFilesize
300KB
-
memory/1736-222-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1736-220-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1736-189-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1736-190-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1736-192-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1736-194-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1736-196-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1736-198-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1736-200-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1736-202-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1736-204-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1736-206-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1736-208-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1736-212-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1736-210-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1736-214-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1736-216-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1736-218-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/3096-1121-0x00000000002D0000-0x0000000000302000-memory.dmpFilesize
200KB
-
memory/3096-1123-0x0000000004F40000-0x0000000004F50000-memory.dmpFilesize
64KB
-
memory/3096-1122-0x0000000004F40000-0x0000000004F50000-memory.dmpFilesize
64KB
-
memory/3664-171-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/3664-167-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/3664-180-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/3664-150-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/3664-179-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/3664-177-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/3664-158-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/3664-175-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/3664-173-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/3664-152-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/3664-169-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/3664-181-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/3664-165-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/3664-163-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/3664-161-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/3664-159-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/3664-155-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/3664-156-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/3664-149-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/3664-148-0x0000000004AE0000-0x0000000005084000-memory.dmpFilesize
5.6MB
-
memory/3664-182-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/3664-184-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/3664-154-0x0000000000820000-0x000000000084D000-memory.dmpFilesize
180KB