Analysis
-
max time kernel
97s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 20:23
Static task
static1
Behavioral task
behavioral1
Sample
d907a84af6c07ee24426935ccb3b90bf6174901a27c0e86a0a371789f0caa070.exe
Resource
win10v2004-20230220-en
General
-
Target
d907a84af6c07ee24426935ccb3b90bf6174901a27c0e86a0a371789f0caa070.exe
-
Size
533KB
-
MD5
4fe1985b85a76f95e71378a1913fec5b
-
SHA1
75e887455320cd9b1be58a117c515fbbbaaa363c
-
SHA256
d907a84af6c07ee24426935ccb3b90bf6174901a27c0e86a0a371789f0caa070
-
SHA512
1c08575b712f990a71044306831e3ee82c8b84a90b528f0c05b309cdb1b430c13d3c4f3afc0b297bc90e6148512623632bb9261079c820ed6fb2b0fd4d009d60
-
SSDEEP
12288:CMrky90pE0Pa4bzMs296GPb3LqXm0YmzeeUvR:CyL4W96kb3GXYNBR
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr633210.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr633210.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr633210.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr633210.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr633210.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr633210.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr633210.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/3040-158-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/3040-161-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/3040-163-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/3040-159-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/3040-165-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/3040-167-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/3040-169-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/3040-171-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/3040-173-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/3040-175-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/3040-177-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/3040-179-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/3040-181-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/3040-183-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/3040-185-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/3040-189-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/3040-187-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/3040-195-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/3040-193-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/3040-197-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/3040-191-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/3040-199-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/3040-201-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/3040-203-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/3040-205-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/3040-207-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/3040-209-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/3040-211-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/3040-213-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/3040-215-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/3040-217-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/3040-219-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/3040-221-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
zioz8220.exejr633210.exeku520855.exelr735065.exepid process 1576 zioz8220.exe 4432 jr633210.exe 3040 ku520855.exe 3964 lr735065.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr633210.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr633210.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
zioz8220.exed907a84af6c07ee24426935ccb3b90bf6174901a27c0e86a0a371789f0caa070.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zioz8220.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zioz8220.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce d907a84af6c07ee24426935ccb3b90bf6174901a27c0e86a0a371789f0caa070.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" d907a84af6c07ee24426935ccb3b90bf6174901a27c0e86a0a371789f0caa070.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4412 3040 WerFault.exe ku520855.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr633210.exeku520855.exelr735065.exepid process 4432 jr633210.exe 4432 jr633210.exe 3040 ku520855.exe 3040 ku520855.exe 3964 lr735065.exe 3964 lr735065.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr633210.exeku520855.exelr735065.exedescription pid process Token: SeDebugPrivilege 4432 jr633210.exe Token: SeDebugPrivilege 3040 ku520855.exe Token: SeDebugPrivilege 3964 lr735065.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
d907a84af6c07ee24426935ccb3b90bf6174901a27c0e86a0a371789f0caa070.exezioz8220.exedescription pid process target process PID 5012 wrote to memory of 1576 5012 d907a84af6c07ee24426935ccb3b90bf6174901a27c0e86a0a371789f0caa070.exe zioz8220.exe PID 5012 wrote to memory of 1576 5012 d907a84af6c07ee24426935ccb3b90bf6174901a27c0e86a0a371789f0caa070.exe zioz8220.exe PID 5012 wrote to memory of 1576 5012 d907a84af6c07ee24426935ccb3b90bf6174901a27c0e86a0a371789f0caa070.exe zioz8220.exe PID 1576 wrote to memory of 4432 1576 zioz8220.exe jr633210.exe PID 1576 wrote to memory of 4432 1576 zioz8220.exe jr633210.exe PID 1576 wrote to memory of 3040 1576 zioz8220.exe ku520855.exe PID 1576 wrote to memory of 3040 1576 zioz8220.exe ku520855.exe PID 1576 wrote to memory of 3040 1576 zioz8220.exe ku520855.exe PID 5012 wrote to memory of 3964 5012 d907a84af6c07ee24426935ccb3b90bf6174901a27c0e86a0a371789f0caa070.exe lr735065.exe PID 5012 wrote to memory of 3964 5012 d907a84af6c07ee24426935ccb3b90bf6174901a27c0e86a0a371789f0caa070.exe lr735065.exe PID 5012 wrote to memory of 3964 5012 d907a84af6c07ee24426935ccb3b90bf6174901a27c0e86a0a371789f0caa070.exe lr735065.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d907a84af6c07ee24426935ccb3b90bf6174901a27c0e86a0a371789f0caa070.exe"C:\Users\Admin\AppData\Local\Temp\d907a84af6c07ee24426935ccb3b90bf6174901a27c0e86a0a371789f0caa070.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zioz8220.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zioz8220.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr633210.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr633210.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku520855.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku520855.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 18484⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr735065.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr735065.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3040 -ip 30401⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr735065.exeFilesize
175KB
MD541e84310cd9215d6f423071d1de1e002
SHA1bb4a33717f8dca26095cae1588528c9da9b29bb4
SHA256c3dcd55ae30d66bdf7838b1c06e1a5513b961e958e11a37477c81893028c6409
SHA512d9ff555b586e5c47b08d8b840d02dd5ae92773777a20c54ffd7d2b6187ff992f1028602a1bf0c7d94b33c86b621c6bd20d1630cd860c1d6cb1391ffcd5472b47
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr735065.exeFilesize
175KB
MD541e84310cd9215d6f423071d1de1e002
SHA1bb4a33717f8dca26095cae1588528c9da9b29bb4
SHA256c3dcd55ae30d66bdf7838b1c06e1a5513b961e958e11a37477c81893028c6409
SHA512d9ff555b586e5c47b08d8b840d02dd5ae92773777a20c54ffd7d2b6187ff992f1028602a1bf0c7d94b33c86b621c6bd20d1630cd860c1d6cb1391ffcd5472b47
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zioz8220.exeFilesize
391KB
MD5d1c569554d498a7a0da982d9d982f29b
SHA10f80bb9f541d7b6f69194ede4c4d4971b09cc02e
SHA2564b30d24baf95df584f61e8ec0c52bb520da91b254b78ebdabb993750456e7740
SHA5122c1992b77892d7deb6604e340233f5cb196bb20a4d2bb7ea98d89a057beda24cb68b20977f661df3f630187e2bad151a339961461a66351b1435cbc616efa55a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zioz8220.exeFilesize
391KB
MD5d1c569554d498a7a0da982d9d982f29b
SHA10f80bb9f541d7b6f69194ede4c4d4971b09cc02e
SHA2564b30d24baf95df584f61e8ec0c52bb520da91b254b78ebdabb993750456e7740
SHA5122c1992b77892d7deb6604e340233f5cb196bb20a4d2bb7ea98d89a057beda24cb68b20977f661df3f630187e2bad151a339961461a66351b1435cbc616efa55a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr633210.exeFilesize
11KB
MD51b626f4516a1cc3281d56bf3627d3b16
SHA12cc391e102e5083fee7c757f20a976f5c8874e52
SHA25697d7e9acf2cc5c4f924cd0feded260730fd995e6a054a551b33989be6cd5fadf
SHA512e67fe03d98a40c8539427dd6ecb0eea3f2c5f60569a0819bf62b358614c14617a978f114295314cc32885bb5b415419db8e52c4655f7043807ccfd9df3cf12c2
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr633210.exeFilesize
11KB
MD51b626f4516a1cc3281d56bf3627d3b16
SHA12cc391e102e5083fee7c757f20a976f5c8874e52
SHA25697d7e9acf2cc5c4f924cd0feded260730fd995e6a054a551b33989be6cd5fadf
SHA512e67fe03d98a40c8539427dd6ecb0eea3f2c5f60569a0819bf62b358614c14617a978f114295314cc32885bb5b415419db8e52c4655f7043807ccfd9df3cf12c2
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku520855.exeFilesize
359KB
MD5f8324f8dc00db81fbe35c6a0859d5523
SHA17bf45c47a9787829686c3fcf84cf5f5e3cdf6f46
SHA256a687ac39c75b968d244f9f94f3d8b025b2a558eb40b9b83e7666b1df6ece84b8
SHA512286c9cf4aecfde84a89a741afef0082e84fa890984917c93aafacc3b9a918b650874baad5ba428ae4d8c32e387ce90d9d92796ecc1181c8846f12f5072181c4b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku520855.exeFilesize
359KB
MD5f8324f8dc00db81fbe35c6a0859d5523
SHA17bf45c47a9787829686c3fcf84cf5f5e3cdf6f46
SHA256a687ac39c75b968d244f9f94f3d8b025b2a558eb40b9b83e7666b1df6ece84b8
SHA512286c9cf4aecfde84a89a741afef0082e84fa890984917c93aafacc3b9a918b650874baad5ba428ae4d8c32e387ce90d9d92796ecc1181c8846f12f5072181c4b
-
memory/3040-153-0x0000000003720000-0x000000000376B000-memory.dmpFilesize
300KB
-
memory/3040-154-0x0000000006190000-0x0000000006734000-memory.dmpFilesize
5.6MB
-
memory/3040-155-0x0000000006180000-0x0000000006190000-memory.dmpFilesize
64KB
-
memory/3040-156-0x0000000006180000-0x0000000006190000-memory.dmpFilesize
64KB
-
memory/3040-157-0x0000000006180000-0x0000000006190000-memory.dmpFilesize
64KB
-
memory/3040-158-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/3040-161-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/3040-163-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/3040-159-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/3040-165-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/3040-167-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/3040-169-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/3040-171-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/3040-173-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/3040-175-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/3040-177-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/3040-179-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/3040-181-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/3040-183-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/3040-185-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/3040-189-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/3040-187-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/3040-195-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/3040-193-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/3040-197-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/3040-191-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/3040-199-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/3040-201-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/3040-203-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/3040-205-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/3040-207-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/3040-209-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/3040-211-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/3040-213-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/3040-215-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/3040-217-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/3040-219-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/3040-221-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/3040-1064-0x0000000006840000-0x0000000006E58000-memory.dmpFilesize
6.1MB
-
memory/3040-1065-0x0000000006EE0000-0x0000000006FEA000-memory.dmpFilesize
1.0MB
-
memory/3040-1066-0x0000000007020000-0x0000000007032000-memory.dmpFilesize
72KB
-
memory/3040-1067-0x0000000007040000-0x000000000707C000-memory.dmpFilesize
240KB
-
memory/3040-1068-0x0000000006180000-0x0000000006190000-memory.dmpFilesize
64KB
-
memory/3040-1070-0x0000000006180000-0x0000000006190000-memory.dmpFilesize
64KB
-
memory/3040-1071-0x0000000006180000-0x0000000006190000-memory.dmpFilesize
64KB
-
memory/3040-1072-0x0000000006180000-0x0000000006190000-memory.dmpFilesize
64KB
-
memory/3040-1073-0x0000000007330000-0x00000000073C2000-memory.dmpFilesize
584KB
-
memory/3040-1074-0x00000000073D0000-0x0000000007436000-memory.dmpFilesize
408KB
-
memory/3040-1075-0x0000000007AC0000-0x0000000007B36000-memory.dmpFilesize
472KB
-
memory/3040-1076-0x0000000007B60000-0x0000000007BB0000-memory.dmpFilesize
320KB
-
memory/3040-1077-0x0000000006180000-0x0000000006190000-memory.dmpFilesize
64KB
-
memory/3040-1078-0x0000000008190000-0x0000000008352000-memory.dmpFilesize
1.8MB
-
memory/3040-1079-0x0000000008360000-0x000000000888C000-memory.dmpFilesize
5.2MB
-
memory/3964-1085-0x0000000000D90000-0x0000000000DC2000-memory.dmpFilesize
200KB
-
memory/3964-1086-0x0000000005680000-0x0000000005690000-memory.dmpFilesize
64KB
-
memory/3964-1087-0x0000000005680000-0x0000000005690000-memory.dmpFilesize
64KB
-
memory/4432-147-0x0000000000BD0000-0x0000000000BDA000-memory.dmpFilesize
40KB