Analysis
-
max time kernel
50s -
max time network
140s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
31-03-2023 20:23
Static task
static1
Behavioral task
behavioral1
Sample
efcbd1af4190cb8f35b30fcfad852ae29b26194be807dd3c7e22c587788d383e.exe
Resource
win10-20230220-en
General
-
Target
efcbd1af4190cb8f35b30fcfad852ae29b26194be807dd3c7e22c587788d383e.exe
-
Size
673KB
-
MD5
9617634223a3f383437da9083935d580
-
SHA1
c9efb1567fb3dcc157f6819fae7fb5174e4c644e
-
SHA256
efcbd1af4190cb8f35b30fcfad852ae29b26194be807dd3c7e22c587788d383e
-
SHA512
ea75630b8d153ef4ef37462dc96056be8e51689e2fde692ae54d67fd5f467899e0e08de9bdc12c030e6fd050a94b7921f9687fb0221ddc9de144c4005586151d
-
SSDEEP
12288:GMrwy90WSHTKYUdomalIRA3mbIzzvzf2a7mULqD2JSlqDs6hAtE:6yKKYUdoX2ERX77mUGDkRRqu
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro0296.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro0296.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro0296.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro0296.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro0296.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro0296.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/3928-173-0x00000000037C0000-0x0000000003806000-memory.dmp family_redline behavioral1/memory/3928-174-0x00000000065E0000-0x0000000006624000-memory.dmp family_redline behavioral1/memory/3928-175-0x00000000065E0000-0x000000000661F000-memory.dmp family_redline behavioral1/memory/3928-178-0x00000000065E0000-0x000000000661F000-memory.dmp family_redline behavioral1/memory/3928-176-0x00000000065E0000-0x000000000661F000-memory.dmp family_redline behavioral1/memory/3928-180-0x00000000065E0000-0x000000000661F000-memory.dmp family_redline behavioral1/memory/3928-182-0x00000000065E0000-0x000000000661F000-memory.dmp family_redline behavioral1/memory/3928-184-0x00000000065E0000-0x000000000661F000-memory.dmp family_redline behavioral1/memory/3928-186-0x00000000065E0000-0x000000000661F000-memory.dmp family_redline behavioral1/memory/3928-188-0x00000000065E0000-0x000000000661F000-memory.dmp family_redline behavioral1/memory/3928-190-0x00000000065E0000-0x000000000661F000-memory.dmp family_redline behavioral1/memory/3928-192-0x00000000065E0000-0x000000000661F000-memory.dmp family_redline behavioral1/memory/3928-194-0x00000000065E0000-0x000000000661F000-memory.dmp family_redline behavioral1/memory/3928-196-0x00000000065E0000-0x000000000661F000-memory.dmp family_redline behavioral1/memory/3928-198-0x00000000065E0000-0x000000000661F000-memory.dmp family_redline behavioral1/memory/3928-200-0x00000000065E0000-0x000000000661F000-memory.dmp family_redline behavioral1/memory/3928-202-0x00000000065E0000-0x000000000661F000-memory.dmp family_redline behavioral1/memory/3928-204-0x00000000065E0000-0x000000000661F000-memory.dmp family_redline behavioral1/memory/3928-208-0x00000000065E0000-0x000000000661F000-memory.dmp family_redline behavioral1/memory/3928-206-0x00000000065E0000-0x000000000661F000-memory.dmp family_redline behavioral1/memory/3928-234-0x0000000005FD0000-0x0000000005FE0000-memory.dmp family_redline behavioral1/memory/3928-1098-0x0000000005FD0000-0x0000000005FE0000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un245390.exepro0296.exequ4134.exesi930874.exepid process 3548 un245390.exe 2348 pro0296.exe 3928 qu4134.exe 1524 si930874.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro0296.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro0296.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro0296.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un245390.exeefcbd1af4190cb8f35b30fcfad852ae29b26194be807dd3c7e22c587788d383e.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un245390.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce efcbd1af4190cb8f35b30fcfad852ae29b26194be807dd3c7e22c587788d383e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" efcbd1af4190cb8f35b30fcfad852ae29b26194be807dd3c7e22c587788d383e.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un245390.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro0296.exequ4134.exesi930874.exepid process 2348 pro0296.exe 2348 pro0296.exe 3928 qu4134.exe 3928 qu4134.exe 1524 si930874.exe 1524 si930874.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro0296.exequ4134.exesi930874.exedescription pid process Token: SeDebugPrivilege 2348 pro0296.exe Token: SeDebugPrivilege 3928 qu4134.exe Token: SeDebugPrivilege 1524 si930874.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
efcbd1af4190cb8f35b30fcfad852ae29b26194be807dd3c7e22c587788d383e.exeun245390.exedescription pid process target process PID 4124 wrote to memory of 3548 4124 efcbd1af4190cb8f35b30fcfad852ae29b26194be807dd3c7e22c587788d383e.exe un245390.exe PID 4124 wrote to memory of 3548 4124 efcbd1af4190cb8f35b30fcfad852ae29b26194be807dd3c7e22c587788d383e.exe un245390.exe PID 4124 wrote to memory of 3548 4124 efcbd1af4190cb8f35b30fcfad852ae29b26194be807dd3c7e22c587788d383e.exe un245390.exe PID 3548 wrote to memory of 2348 3548 un245390.exe pro0296.exe PID 3548 wrote to memory of 2348 3548 un245390.exe pro0296.exe PID 3548 wrote to memory of 2348 3548 un245390.exe pro0296.exe PID 3548 wrote to memory of 3928 3548 un245390.exe qu4134.exe PID 3548 wrote to memory of 3928 3548 un245390.exe qu4134.exe PID 3548 wrote to memory of 3928 3548 un245390.exe qu4134.exe PID 4124 wrote to memory of 1524 4124 efcbd1af4190cb8f35b30fcfad852ae29b26194be807dd3c7e22c587788d383e.exe si930874.exe PID 4124 wrote to memory of 1524 4124 efcbd1af4190cb8f35b30fcfad852ae29b26194be807dd3c7e22c587788d383e.exe si930874.exe PID 4124 wrote to memory of 1524 4124 efcbd1af4190cb8f35b30fcfad852ae29b26194be807dd3c7e22c587788d383e.exe si930874.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\efcbd1af4190cb8f35b30fcfad852ae29b26194be807dd3c7e22c587788d383e.exe"C:\Users\Admin\AppData\Local\Temp\efcbd1af4190cb8f35b30fcfad852ae29b26194be807dd3c7e22c587788d383e.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un245390.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un245390.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0296.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0296.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4134.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4134.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si930874.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si930874.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si930874.exeFilesize
175KB
MD5c5328cc0c8e26111eeb1a18559b47818
SHA1c8a33a7a914f139d3625259fe74448e9e753770d
SHA2566009254f6eb3531c3cca8507f40c2c2250857591d582b081fbde8ee56d1a5ee5
SHA512d6c2e76e2a16008a9e8c0b244a222a8d1cc7684e20a064fbec2a7f40244bd3cc9dc276f3d57b05b601fd513cb0623e0ba53815662bac61eb560ca110ad4d79b1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si930874.exeFilesize
175KB
MD5c5328cc0c8e26111eeb1a18559b47818
SHA1c8a33a7a914f139d3625259fe74448e9e753770d
SHA2566009254f6eb3531c3cca8507f40c2c2250857591d582b081fbde8ee56d1a5ee5
SHA512d6c2e76e2a16008a9e8c0b244a222a8d1cc7684e20a064fbec2a7f40244bd3cc9dc276f3d57b05b601fd513cb0623e0ba53815662bac61eb560ca110ad4d79b1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un245390.exeFilesize
531KB
MD5d64aeeb142f5c0a365d95927bfc07cd2
SHA19c5782963c4c1ab39b0af633c9ffac90f4ab1af9
SHA256ccae0dbe7f908319b8f0141b386a50a440f9c6a63db57839379f9c3cbdb57d09
SHA512ef2e4979f61592f48eb1d26e56d1193975d8600d78b77e28d098652191af6cb6e6c90cc71c8344742671cc2923652bbf00bee233a0f606b1df314339bf87de8b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un245390.exeFilesize
531KB
MD5d64aeeb142f5c0a365d95927bfc07cd2
SHA19c5782963c4c1ab39b0af633c9ffac90f4ab1af9
SHA256ccae0dbe7f908319b8f0141b386a50a440f9c6a63db57839379f9c3cbdb57d09
SHA512ef2e4979f61592f48eb1d26e56d1193975d8600d78b77e28d098652191af6cb6e6c90cc71c8344742671cc2923652bbf00bee233a0f606b1df314339bf87de8b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0296.exeFilesize
260KB
MD56c1d6f058ab20c415abb34b705a708c6
SHA1c917d6dd0319a6fff8fc1a6a2b14721d05ec3ddb
SHA256f8261ca65937f9ff8c7e8de2ae52b22dcc51f70e34a74e41f4230067ce539258
SHA512579abbc1415d1d299aec98f44371d3484f880fb2250726b5588cf987823adf0474f1da10d8f659905c5b299546a80baf389df0df260f325ff2ba7c7e295ab5ef
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0296.exeFilesize
260KB
MD56c1d6f058ab20c415abb34b705a708c6
SHA1c917d6dd0319a6fff8fc1a6a2b14721d05ec3ddb
SHA256f8261ca65937f9ff8c7e8de2ae52b22dcc51f70e34a74e41f4230067ce539258
SHA512579abbc1415d1d299aec98f44371d3484f880fb2250726b5588cf987823adf0474f1da10d8f659905c5b299546a80baf389df0df260f325ff2ba7c7e295ab5ef
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4134.exeFilesize
359KB
MD5cec17e64c87aefbc788ee54b6cec2af9
SHA167f810d51731999dd778330be93227d641043456
SHA2563227f18262008263b9f2f55ea38c41a8c904b6228877e50c693ae5af26c1f720
SHA5123be362a670bd2b785123b0aba0e07ad312d9b75ca474f587f26a2b2760c6f6fe73f7c1e861e69f8933573a2e5b91cea14d5f1125d78a3cedde08129e9f6e00bb
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4134.exeFilesize
359KB
MD5cec17e64c87aefbc788ee54b6cec2af9
SHA167f810d51731999dd778330be93227d641043456
SHA2563227f18262008263b9f2f55ea38c41a8c904b6228877e50c693ae5af26c1f720
SHA5123be362a670bd2b785123b0aba0e07ad312d9b75ca474f587f26a2b2760c6f6fe73f7c1e861e69f8933573a2e5b91cea14d5f1125d78a3cedde08129e9f6e00bb
-
memory/1524-1107-0x00000000004C0000-0x00000000004F2000-memory.dmpFilesize
200KB
-
memory/1524-1108-0x0000000004D20000-0x0000000004D30000-memory.dmpFilesize
64KB
-
memory/1524-1109-0x0000000004F00000-0x0000000004F4B000-memory.dmpFilesize
300KB
-
memory/1524-1110-0x0000000004D20000-0x0000000004D30000-memory.dmpFilesize
64KB
-
memory/2348-144-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/2348-154-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/2348-136-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/2348-138-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/2348-140-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/2348-142-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/2348-134-0x00000000023B0000-0x00000000023C8000-memory.dmpFilesize
96KB
-
memory/2348-146-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/2348-148-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/2348-150-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/2348-152-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/2348-135-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/2348-156-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/2348-158-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/2348-160-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/2348-162-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/2348-163-0x00000000006D0000-0x00000000006E0000-memory.dmpFilesize
64KB
-
memory/2348-164-0x00000000006D0000-0x00000000006E0000-memory.dmpFilesize
64KB
-
memory/2348-165-0x00000000006D0000-0x00000000006E0000-memory.dmpFilesize
64KB
-
memory/2348-166-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/2348-168-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/2348-133-0x0000000004A90000-0x0000000004F8E000-memory.dmpFilesize
5.0MB
-
memory/2348-132-0x0000000000960000-0x000000000097A000-memory.dmpFilesize
104KB
-
memory/2348-131-0x00000000001D0000-0x00000000001FD000-memory.dmpFilesize
180KB
-
memory/3928-180-0x00000000065E0000-0x000000000661F000-memory.dmpFilesize
252KB
-
memory/3928-236-0x0000000005FD0000-0x0000000005FE0000-memory.dmpFilesize
64KB
-
memory/3928-178-0x00000000065E0000-0x000000000661F000-memory.dmpFilesize
252KB
-
memory/3928-182-0x00000000065E0000-0x000000000661F000-memory.dmpFilesize
252KB
-
memory/3928-184-0x00000000065E0000-0x000000000661F000-memory.dmpFilesize
252KB
-
memory/3928-186-0x00000000065E0000-0x000000000661F000-memory.dmpFilesize
252KB
-
memory/3928-188-0x00000000065E0000-0x000000000661F000-memory.dmpFilesize
252KB
-
memory/3928-190-0x00000000065E0000-0x000000000661F000-memory.dmpFilesize
252KB
-
memory/3928-192-0x00000000065E0000-0x000000000661F000-memory.dmpFilesize
252KB
-
memory/3928-194-0x00000000065E0000-0x000000000661F000-memory.dmpFilesize
252KB
-
memory/3928-196-0x00000000065E0000-0x000000000661F000-memory.dmpFilesize
252KB
-
memory/3928-198-0x00000000065E0000-0x000000000661F000-memory.dmpFilesize
252KB
-
memory/3928-200-0x00000000065E0000-0x000000000661F000-memory.dmpFilesize
252KB
-
memory/3928-202-0x00000000065E0000-0x000000000661F000-memory.dmpFilesize
252KB
-
memory/3928-204-0x00000000065E0000-0x000000000661F000-memory.dmpFilesize
252KB
-
memory/3928-208-0x00000000065E0000-0x000000000661F000-memory.dmpFilesize
252KB
-
memory/3928-206-0x00000000065E0000-0x000000000661F000-memory.dmpFilesize
252KB
-
memory/3928-230-0x00000000034D0000-0x000000000351B000-memory.dmpFilesize
300KB
-
memory/3928-232-0x0000000005FD0000-0x0000000005FE0000-memory.dmpFilesize
64KB
-
memory/3928-176-0x00000000065E0000-0x000000000661F000-memory.dmpFilesize
252KB
-
memory/3928-234-0x0000000005FD0000-0x0000000005FE0000-memory.dmpFilesize
64KB
-
memory/3928-1085-0x0000000006760000-0x0000000006D66000-memory.dmpFilesize
6.0MB
-
memory/3928-1086-0x0000000006DE0000-0x0000000006EEA000-memory.dmpFilesize
1.0MB
-
memory/3928-1087-0x0000000006F20000-0x0000000006F32000-memory.dmpFilesize
72KB
-
memory/3928-1088-0x0000000006F40000-0x0000000006F7E000-memory.dmpFilesize
248KB
-
memory/3928-1089-0x0000000007090000-0x00000000070DB000-memory.dmpFilesize
300KB
-
memory/3928-1090-0x0000000005FD0000-0x0000000005FE0000-memory.dmpFilesize
64KB
-
memory/3928-1091-0x0000000007220000-0x0000000007286000-memory.dmpFilesize
408KB
-
memory/3928-1092-0x00000000078E0000-0x0000000007972000-memory.dmpFilesize
584KB
-
memory/3928-1094-0x0000000007980000-0x00000000079F6000-memory.dmpFilesize
472KB
-
memory/3928-1095-0x0000000007A20000-0x0000000007A70000-memory.dmpFilesize
320KB
-
memory/3928-1096-0x0000000007AA0000-0x0000000007C62000-memory.dmpFilesize
1.8MB
-
memory/3928-1097-0x0000000007C90000-0x00000000081BC000-memory.dmpFilesize
5.2MB
-
memory/3928-1098-0x0000000005FD0000-0x0000000005FE0000-memory.dmpFilesize
64KB
-
memory/3928-175-0x00000000065E0000-0x000000000661F000-memory.dmpFilesize
252KB
-
memory/3928-174-0x00000000065E0000-0x0000000006624000-memory.dmpFilesize
272KB
-
memory/3928-173-0x00000000037C0000-0x0000000003806000-memory.dmpFilesize
280KB
-
memory/3928-1100-0x0000000005FD0000-0x0000000005FE0000-memory.dmpFilesize
64KB
-
memory/3928-1099-0x0000000005FD0000-0x0000000005FE0000-memory.dmpFilesize
64KB
-
memory/3928-1101-0x0000000005FD0000-0x0000000005FE0000-memory.dmpFilesize
64KB