Analysis
-
max time kernel
135s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 20:24
Static task
static1
Behavioral task
behavioral1
Sample
2363aaacf7889e37565116b939ee00ccfa9d82604acdff1cc05ef7900c570f44.exe
Resource
win10v2004-20230220-en
General
-
Target
2363aaacf7889e37565116b939ee00ccfa9d82604acdff1cc05ef7900c570f44.exe
-
Size
673KB
-
MD5
b88c90556cfa95b5362dd539aae8c764
-
SHA1
01d5b2b8704d254f07d6a64c21bb22d8c4bdd7c7
-
SHA256
2363aaacf7889e37565116b939ee00ccfa9d82604acdff1cc05ef7900c570f44
-
SHA512
0dcfd16d3277ec6ce779228549c62ebbf777e67fb5723b3585fe47c0e63438250572a9a00dd4649c63ec006c116cecf770cf136f402ef4eb6d4dcd99d2f0579f
-
SSDEEP
12288:3MrKy90JneLX9LSA+LWvXagTFl2W9RabJ+omgG5hpq1SSm3Lq88PtDBBN8e:ByZhLSA5CWeOmEjgG5hpq1SSm3G8ct1j
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro9808.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro9808.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro9808.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro9808.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro9808.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro9808.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro9808.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/3716-190-0x0000000003B30000-0x0000000003B6F000-memory.dmp family_redline behavioral1/memory/3716-191-0x0000000003B30000-0x0000000003B6F000-memory.dmp family_redline behavioral1/memory/3716-193-0x0000000003B30000-0x0000000003B6F000-memory.dmp family_redline behavioral1/memory/3716-195-0x0000000003B30000-0x0000000003B6F000-memory.dmp family_redline behavioral1/memory/3716-197-0x0000000003B30000-0x0000000003B6F000-memory.dmp family_redline behavioral1/memory/3716-199-0x0000000003B30000-0x0000000003B6F000-memory.dmp family_redline behavioral1/memory/3716-201-0x0000000003B30000-0x0000000003B6F000-memory.dmp family_redline behavioral1/memory/3716-203-0x0000000003B30000-0x0000000003B6F000-memory.dmp family_redline behavioral1/memory/3716-205-0x0000000003B30000-0x0000000003B6F000-memory.dmp family_redline behavioral1/memory/3716-207-0x0000000003B30000-0x0000000003B6F000-memory.dmp family_redline behavioral1/memory/3716-209-0x0000000003B30000-0x0000000003B6F000-memory.dmp family_redline behavioral1/memory/3716-211-0x0000000003B30000-0x0000000003B6F000-memory.dmp family_redline behavioral1/memory/3716-215-0x0000000003B30000-0x0000000003B6F000-memory.dmp family_redline behavioral1/memory/3716-217-0x0000000003B30000-0x0000000003B6F000-memory.dmp family_redline behavioral1/memory/3716-213-0x0000000003B30000-0x0000000003B6F000-memory.dmp family_redline behavioral1/memory/3716-219-0x0000000003B30000-0x0000000003B6F000-memory.dmp family_redline behavioral1/memory/3716-221-0x0000000003B30000-0x0000000003B6F000-memory.dmp family_redline behavioral1/memory/3716-223-0x0000000003B30000-0x0000000003B6F000-memory.dmp family_redline behavioral1/memory/3716-377-0x00000000063B0000-0x00000000063C0000-memory.dmp family_redline behavioral1/memory/3716-1110-0x00000000063B0000-0x00000000063C0000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un458898.exepro9808.exequ3912.exesi265011.exepid process 4192 un458898.exe 456 pro9808.exe 3716 qu3912.exe 1904 si265011.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro9808.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro9808.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro9808.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
2363aaacf7889e37565116b939ee00ccfa9d82604acdff1cc05ef7900c570f44.exeun458898.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 2363aaacf7889e37565116b939ee00ccfa9d82604acdff1cc05ef7900c570f44.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 2363aaacf7889e37565116b939ee00ccfa9d82604acdff1cc05ef7900c570f44.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un458898.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un458898.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1340 456 WerFault.exe pro9808.exe 3912 3716 WerFault.exe qu3912.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro9808.exequ3912.exesi265011.exepid process 456 pro9808.exe 456 pro9808.exe 3716 qu3912.exe 3716 qu3912.exe 1904 si265011.exe 1904 si265011.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro9808.exequ3912.exesi265011.exedescription pid process Token: SeDebugPrivilege 456 pro9808.exe Token: SeDebugPrivilege 3716 qu3912.exe Token: SeDebugPrivilege 1904 si265011.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
2363aaacf7889e37565116b939ee00ccfa9d82604acdff1cc05ef7900c570f44.exeun458898.exedescription pid process target process PID 1636 wrote to memory of 4192 1636 2363aaacf7889e37565116b939ee00ccfa9d82604acdff1cc05ef7900c570f44.exe un458898.exe PID 1636 wrote to memory of 4192 1636 2363aaacf7889e37565116b939ee00ccfa9d82604acdff1cc05ef7900c570f44.exe un458898.exe PID 1636 wrote to memory of 4192 1636 2363aaacf7889e37565116b939ee00ccfa9d82604acdff1cc05ef7900c570f44.exe un458898.exe PID 4192 wrote to memory of 456 4192 un458898.exe pro9808.exe PID 4192 wrote to memory of 456 4192 un458898.exe pro9808.exe PID 4192 wrote to memory of 456 4192 un458898.exe pro9808.exe PID 4192 wrote to memory of 3716 4192 un458898.exe qu3912.exe PID 4192 wrote to memory of 3716 4192 un458898.exe qu3912.exe PID 4192 wrote to memory of 3716 4192 un458898.exe qu3912.exe PID 1636 wrote to memory of 1904 1636 2363aaacf7889e37565116b939ee00ccfa9d82604acdff1cc05ef7900c570f44.exe si265011.exe PID 1636 wrote to memory of 1904 1636 2363aaacf7889e37565116b939ee00ccfa9d82604acdff1cc05ef7900c570f44.exe si265011.exe PID 1636 wrote to memory of 1904 1636 2363aaacf7889e37565116b939ee00ccfa9d82604acdff1cc05ef7900c570f44.exe si265011.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2363aaacf7889e37565116b939ee00ccfa9d82604acdff1cc05ef7900c570f44.exe"C:\Users\Admin\AppData\Local\Temp\2363aaacf7889e37565116b939ee00ccfa9d82604acdff1cc05ef7900c570f44.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un458898.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un458898.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9808.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9808.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 10844⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3912.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3912.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 13604⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si265011.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si265011.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 456 -ip 4561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3716 -ip 37161⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si265011.exeFilesize
175KB
MD56839e024c76b4b4a52705f7091e03c79
SHA198415c1841f658af4fa12b537ed55602fb340537
SHA256c055065a098afb4913ed87939a0ed6d7fa2d2f407696449922ccc9e3ccd3d6d9
SHA5122ff894b1c0506552a1dfb333b60d0ba8cb1ee135228fbe1b1d8c28f378386eb8baa7517c0a376472cd966f61c9e2888a657f47de0da5e7e5533fcfd29a2e98e6
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si265011.exeFilesize
175KB
MD56839e024c76b4b4a52705f7091e03c79
SHA198415c1841f658af4fa12b537ed55602fb340537
SHA256c055065a098afb4913ed87939a0ed6d7fa2d2f407696449922ccc9e3ccd3d6d9
SHA5122ff894b1c0506552a1dfb333b60d0ba8cb1ee135228fbe1b1d8c28f378386eb8baa7517c0a376472cd966f61c9e2888a657f47de0da5e7e5533fcfd29a2e98e6
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un458898.exeFilesize
531KB
MD52b07ca8b0564e64204da99703e88d188
SHA15c436a96201010aa2acec7c8e0af611fb2b38fc9
SHA2568c8e4ce5ff2c6d0a7059e90b0bcbf5118308f0621bd0742ac3f6616145bb7c06
SHA512b7021a027263ae29c9c6ecc5dd5c76b5af89f5309efc8b2518d8f526ed0eb6a93ab859162282f1d52a3e5613382a5b7589bc9cc479ac8495020fae203ae9f33c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un458898.exeFilesize
531KB
MD52b07ca8b0564e64204da99703e88d188
SHA15c436a96201010aa2acec7c8e0af611fb2b38fc9
SHA2568c8e4ce5ff2c6d0a7059e90b0bcbf5118308f0621bd0742ac3f6616145bb7c06
SHA512b7021a027263ae29c9c6ecc5dd5c76b5af89f5309efc8b2518d8f526ed0eb6a93ab859162282f1d52a3e5613382a5b7589bc9cc479ac8495020fae203ae9f33c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9808.exeFilesize
260KB
MD5b205ac27e8a7d5fcd9732553e97f0718
SHA139918169fb6e14459b7683791ba891fbf5e1b2b5
SHA2566eb6dc502c04ed26047a57244b8b7f97c98cc35fcced425a285a2f1ee5137e3b
SHA5127582d8c097f513c6826f811a78bf58b1b2ad77df47f432c61c65e17d264e45019a83f137ad1e835eca378cdc5adad7f4aabb11a1af509523887a63678a342da2
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9808.exeFilesize
260KB
MD5b205ac27e8a7d5fcd9732553e97f0718
SHA139918169fb6e14459b7683791ba891fbf5e1b2b5
SHA2566eb6dc502c04ed26047a57244b8b7f97c98cc35fcced425a285a2f1ee5137e3b
SHA5127582d8c097f513c6826f811a78bf58b1b2ad77df47f432c61c65e17d264e45019a83f137ad1e835eca378cdc5adad7f4aabb11a1af509523887a63678a342da2
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3912.exeFilesize
359KB
MD5824d8e30baa64ccead7c8be50f5a453f
SHA17b5757f9962aa0a4d13f3148d2b2b0dd99a2cacb
SHA256020dc8a12757fef7088f3d7d67cef1d0336ebe048099a7b6320d4cfbaafcd0b6
SHA512c53777af3e218fe6b8ede149b420c625bafc7fdfd5f5ae9186c575b57269a1d1570c7dce958dce82e13cf9e4affcc5fee6af57bc5236f0e5de0519c07ad34650
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3912.exeFilesize
359KB
MD5824d8e30baa64ccead7c8be50f5a453f
SHA17b5757f9962aa0a4d13f3148d2b2b0dd99a2cacb
SHA256020dc8a12757fef7088f3d7d67cef1d0336ebe048099a7b6320d4cfbaafcd0b6
SHA512c53777af3e218fe6b8ede149b420c625bafc7fdfd5f5ae9186c575b57269a1d1570c7dce958dce82e13cf9e4affcc5fee6af57bc5236f0e5de0519c07ad34650
-
memory/456-148-0x0000000001FF0000-0x000000000201D000-memory.dmpFilesize
180KB
-
memory/456-149-0x0000000004AA0000-0x0000000005044000-memory.dmpFilesize
5.6MB
-
memory/456-150-0x00000000023B0000-0x00000000023C0000-memory.dmpFilesize
64KB
-
memory/456-151-0x00000000023B0000-0x00000000023C0000-memory.dmpFilesize
64KB
-
memory/456-152-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/456-153-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/456-155-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/456-157-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/456-159-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/456-161-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/456-163-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/456-165-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/456-167-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/456-169-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/456-171-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/456-173-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/456-175-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/456-177-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/456-179-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/456-180-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/456-181-0x00000000023B0000-0x00000000023C0000-memory.dmpFilesize
64KB
-
memory/456-182-0x00000000023B0000-0x00000000023C0000-memory.dmpFilesize
64KB
-
memory/456-183-0x00000000023B0000-0x00000000023C0000-memory.dmpFilesize
64KB
-
memory/456-185-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/1904-1121-0x0000000000600000-0x0000000000632000-memory.dmpFilesize
200KB
-
memory/1904-1122-0x0000000005270000-0x0000000005280000-memory.dmpFilesize
64KB
-
memory/3716-191-0x0000000003B30000-0x0000000003B6F000-memory.dmpFilesize
252KB
-
memory/3716-380-0x00000000063B0000-0x00000000063C0000-memory.dmpFilesize
64KB
-
memory/3716-195-0x0000000003B30000-0x0000000003B6F000-memory.dmpFilesize
252KB
-
memory/3716-197-0x0000000003B30000-0x0000000003B6F000-memory.dmpFilesize
252KB
-
memory/3716-199-0x0000000003B30000-0x0000000003B6F000-memory.dmpFilesize
252KB
-
memory/3716-201-0x0000000003B30000-0x0000000003B6F000-memory.dmpFilesize
252KB
-
memory/3716-203-0x0000000003B30000-0x0000000003B6F000-memory.dmpFilesize
252KB
-
memory/3716-205-0x0000000003B30000-0x0000000003B6F000-memory.dmpFilesize
252KB
-
memory/3716-207-0x0000000003B30000-0x0000000003B6F000-memory.dmpFilesize
252KB
-
memory/3716-209-0x0000000003B30000-0x0000000003B6F000-memory.dmpFilesize
252KB
-
memory/3716-211-0x0000000003B30000-0x0000000003B6F000-memory.dmpFilesize
252KB
-
memory/3716-215-0x0000000003B30000-0x0000000003B6F000-memory.dmpFilesize
252KB
-
memory/3716-217-0x0000000003B30000-0x0000000003B6F000-memory.dmpFilesize
252KB
-
memory/3716-213-0x0000000003B30000-0x0000000003B6F000-memory.dmpFilesize
252KB
-
memory/3716-219-0x0000000003B30000-0x0000000003B6F000-memory.dmpFilesize
252KB
-
memory/3716-221-0x0000000003B30000-0x0000000003B6F000-memory.dmpFilesize
252KB
-
memory/3716-223-0x0000000003B30000-0x0000000003B6F000-memory.dmpFilesize
252KB
-
memory/3716-376-0x0000000003730000-0x000000000377B000-memory.dmpFilesize
300KB
-
memory/3716-377-0x00000000063B0000-0x00000000063C0000-memory.dmpFilesize
64KB
-
memory/3716-193-0x0000000003B30000-0x0000000003B6F000-memory.dmpFilesize
252KB
-
memory/3716-383-0x00000000063B0000-0x00000000063C0000-memory.dmpFilesize
64KB
-
memory/3716-1100-0x0000000006970000-0x0000000006F88000-memory.dmpFilesize
6.1MB
-
memory/3716-1101-0x0000000006F90000-0x000000000709A000-memory.dmpFilesize
1.0MB
-
memory/3716-1102-0x0000000003DE0000-0x0000000003DF2000-memory.dmpFilesize
72KB
-
memory/3716-1103-0x00000000070A0000-0x00000000070DC000-memory.dmpFilesize
240KB
-
memory/3716-1104-0x00000000063B0000-0x00000000063C0000-memory.dmpFilesize
64KB
-
memory/3716-1106-0x0000000007330000-0x00000000073C2000-memory.dmpFilesize
584KB
-
memory/3716-1107-0x00000000073D0000-0x0000000007436000-memory.dmpFilesize
408KB
-
memory/3716-1108-0x00000000063B0000-0x00000000063C0000-memory.dmpFilesize
64KB
-
memory/3716-1109-0x00000000063B0000-0x00000000063C0000-memory.dmpFilesize
64KB
-
memory/3716-1110-0x00000000063B0000-0x00000000063C0000-memory.dmpFilesize
64KB
-
memory/3716-1111-0x0000000007BD0000-0x0000000007C46000-memory.dmpFilesize
472KB
-
memory/3716-1112-0x0000000007C60000-0x0000000007CB0000-memory.dmpFilesize
320KB
-
memory/3716-190-0x0000000003B30000-0x0000000003B6F000-memory.dmpFilesize
252KB
-
memory/3716-1113-0x0000000007CE0000-0x0000000007EA2000-memory.dmpFilesize
1.8MB
-
memory/3716-1114-0x0000000007EB0000-0x00000000083DC000-memory.dmpFilesize
5.2MB
-
memory/3716-1116-0x00000000063B0000-0x00000000063C0000-memory.dmpFilesize
64KB