Analysis
-
max time kernel
52s -
max time network
64s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
31-03-2023 20:27
Static task
static1
Behavioral task
behavioral1
Sample
db61b6eb45e1a94c21fc977f35db18c2869000d2927ba66c83a9bdaf29d436bd.exe
Resource
win10-20230220-en
General
-
Target
db61b6eb45e1a94c21fc977f35db18c2869000d2927ba66c83a9bdaf29d436bd.exe
-
Size
533KB
-
MD5
032ca3338c605d0f1fdb18cf6cd32835
-
SHA1
842db03d8c71efac23138459612a756dfdef3def
-
SHA256
db61b6eb45e1a94c21fc977f35db18c2869000d2927ba66c83a9bdaf29d436bd
-
SHA512
9d29a2747aebe352b2ff2a845c67a3cb3c4bfc3a691955905b2720ba0863093c70488a2b7caaeee453149251d7ea6fb394da72b2d817fd57e443eeeb6a18ed8d
-
SSDEEP
12288:/MrWy905pstAM72KmXkzFN6ohE3LqkUOfifV1BzHxBom:1yms8KLr66E3GkWf1zH/
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr535455.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr535455.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr535455.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr535455.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr535455.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr535455.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
Processes:
resource yara_rule behavioral1/memory/4300-141-0x0000000003770000-0x00000000037B6000-memory.dmp family_redline behavioral1/memory/4300-147-0x0000000003830000-0x0000000003874000-memory.dmp family_redline behavioral1/memory/4300-148-0x0000000003830000-0x000000000386F000-memory.dmp family_redline behavioral1/memory/4300-149-0x0000000003830000-0x000000000386F000-memory.dmp family_redline behavioral1/memory/4300-151-0x0000000003830000-0x000000000386F000-memory.dmp family_redline behavioral1/memory/4300-153-0x0000000003830000-0x000000000386F000-memory.dmp family_redline behavioral1/memory/4300-155-0x0000000003830000-0x000000000386F000-memory.dmp family_redline behavioral1/memory/4300-157-0x0000000003830000-0x000000000386F000-memory.dmp family_redline behavioral1/memory/4300-159-0x0000000003830000-0x000000000386F000-memory.dmp family_redline behavioral1/memory/4300-161-0x0000000003830000-0x000000000386F000-memory.dmp family_redline behavioral1/memory/4300-163-0x0000000003830000-0x000000000386F000-memory.dmp family_redline behavioral1/memory/4300-165-0x0000000003830000-0x000000000386F000-memory.dmp family_redline behavioral1/memory/4300-167-0x0000000003830000-0x000000000386F000-memory.dmp family_redline behavioral1/memory/4300-169-0x0000000003830000-0x000000000386F000-memory.dmp family_redline behavioral1/memory/4300-171-0x0000000003830000-0x000000000386F000-memory.dmp family_redline behavioral1/memory/4300-173-0x0000000003830000-0x000000000386F000-memory.dmp family_redline behavioral1/memory/4300-175-0x0000000003830000-0x000000000386F000-memory.dmp family_redline behavioral1/memory/4300-177-0x0000000003830000-0x000000000386F000-memory.dmp family_redline behavioral1/memory/4300-179-0x0000000003830000-0x000000000386F000-memory.dmp family_redline behavioral1/memory/4300-181-0x0000000003830000-0x000000000386F000-memory.dmp family_redline behavioral1/memory/4300-183-0x0000000003830000-0x000000000386F000-memory.dmp family_redline behavioral1/memory/4300-185-0x0000000003830000-0x000000000386F000-memory.dmp family_redline behavioral1/memory/4300-187-0x0000000003830000-0x000000000386F000-memory.dmp family_redline behavioral1/memory/4300-189-0x0000000003830000-0x000000000386F000-memory.dmp family_redline behavioral1/memory/4300-191-0x0000000003830000-0x000000000386F000-memory.dmp family_redline behavioral1/memory/4300-193-0x0000000003830000-0x000000000386F000-memory.dmp family_redline behavioral1/memory/4300-195-0x0000000003830000-0x000000000386F000-memory.dmp family_redline behavioral1/memory/4300-197-0x0000000003830000-0x000000000386F000-memory.dmp family_redline behavioral1/memory/4300-199-0x0000000003830000-0x000000000386F000-memory.dmp family_redline behavioral1/memory/4300-201-0x0000000003830000-0x000000000386F000-memory.dmp family_redline behavioral1/memory/4300-203-0x0000000003830000-0x000000000386F000-memory.dmp family_redline behavioral1/memory/4300-205-0x0000000003830000-0x000000000386F000-memory.dmp family_redline behavioral1/memory/4300-207-0x0000000003830000-0x000000000386F000-memory.dmp family_redline behavioral1/memory/4300-209-0x0000000003830000-0x000000000386F000-memory.dmp family_redline behavioral1/memory/4300-211-0x0000000003830000-0x000000000386F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
ziXk6506.exejr535455.exeku759982.exelr285683.exepid process 2680 ziXk6506.exe 3412 jr535455.exe 4300 ku759982.exe 4876 lr285683.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr535455.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr535455.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
db61b6eb45e1a94c21fc977f35db18c2869000d2927ba66c83a9bdaf29d436bd.exeziXk6506.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" db61b6eb45e1a94c21fc977f35db18c2869000d2927ba66c83a9bdaf29d436bd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziXk6506.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziXk6506.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce db61b6eb45e1a94c21fc977f35db18c2869000d2927ba66c83a9bdaf29d436bd.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr535455.exeku759982.exelr285683.exepid process 3412 jr535455.exe 3412 jr535455.exe 4300 ku759982.exe 4300 ku759982.exe 4876 lr285683.exe 4876 lr285683.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr535455.exeku759982.exelr285683.exedescription pid process Token: SeDebugPrivilege 3412 jr535455.exe Token: SeDebugPrivilege 4300 ku759982.exe Token: SeDebugPrivilege 4876 lr285683.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
db61b6eb45e1a94c21fc977f35db18c2869000d2927ba66c83a9bdaf29d436bd.exeziXk6506.exedescription pid process target process PID 4028 wrote to memory of 2680 4028 db61b6eb45e1a94c21fc977f35db18c2869000d2927ba66c83a9bdaf29d436bd.exe ziXk6506.exe PID 4028 wrote to memory of 2680 4028 db61b6eb45e1a94c21fc977f35db18c2869000d2927ba66c83a9bdaf29d436bd.exe ziXk6506.exe PID 4028 wrote to memory of 2680 4028 db61b6eb45e1a94c21fc977f35db18c2869000d2927ba66c83a9bdaf29d436bd.exe ziXk6506.exe PID 2680 wrote to memory of 3412 2680 ziXk6506.exe jr535455.exe PID 2680 wrote to memory of 3412 2680 ziXk6506.exe jr535455.exe PID 2680 wrote to memory of 4300 2680 ziXk6506.exe ku759982.exe PID 2680 wrote to memory of 4300 2680 ziXk6506.exe ku759982.exe PID 2680 wrote to memory of 4300 2680 ziXk6506.exe ku759982.exe PID 4028 wrote to memory of 4876 4028 db61b6eb45e1a94c21fc977f35db18c2869000d2927ba66c83a9bdaf29d436bd.exe lr285683.exe PID 4028 wrote to memory of 4876 4028 db61b6eb45e1a94c21fc977f35db18c2869000d2927ba66c83a9bdaf29d436bd.exe lr285683.exe PID 4028 wrote to memory of 4876 4028 db61b6eb45e1a94c21fc977f35db18c2869000d2927ba66c83a9bdaf29d436bd.exe lr285683.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\db61b6eb45e1a94c21fc977f35db18c2869000d2927ba66c83a9bdaf29d436bd.exe"C:\Users\Admin\AppData\Local\Temp\db61b6eb45e1a94c21fc977f35db18c2869000d2927ba66c83a9bdaf29d436bd.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziXk6506.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziXk6506.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr535455.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr535455.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku759982.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku759982.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr285683.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr285683.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr285683.exeFilesize
175KB
MD5acd0f356054b6e5a104db66053753750
SHA1d7ac2643710c087b5985c5bb0ef4c500fb06f49c
SHA2568295be9b195d32af695c31230d5a90e73f72a816f015143f9ce0fa881348b758
SHA51203a9d03d7481d06685aad695ab21ad10c600eaae784b78ef946fd3c4fccc5dc7de3e22bb91e948b94051fdcd1782d4f42c53a1208668c2f681f3a6643628d07e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr285683.exeFilesize
175KB
MD5acd0f356054b6e5a104db66053753750
SHA1d7ac2643710c087b5985c5bb0ef4c500fb06f49c
SHA2568295be9b195d32af695c31230d5a90e73f72a816f015143f9ce0fa881348b758
SHA51203a9d03d7481d06685aad695ab21ad10c600eaae784b78ef946fd3c4fccc5dc7de3e22bb91e948b94051fdcd1782d4f42c53a1208668c2f681f3a6643628d07e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziXk6506.exeFilesize
391KB
MD583079b68717f66c84f80693cb2234ae6
SHA1c828a86916edd6205537fc9e89c92022170a22d2
SHA25617118da277bb7b9ef1d99fe4a50564cf016f2847d2c7c6476ed3b1f5fc646a91
SHA5122fb680ecc7e241a4285fa1f8f1290efd28f6470ea4417642fa5f4569641d73699e2a4c84afc6878e5578173ad2cd2bad517e57bca533bddf9392f6d6fc31e833
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziXk6506.exeFilesize
391KB
MD583079b68717f66c84f80693cb2234ae6
SHA1c828a86916edd6205537fc9e89c92022170a22d2
SHA25617118da277bb7b9ef1d99fe4a50564cf016f2847d2c7c6476ed3b1f5fc646a91
SHA5122fb680ecc7e241a4285fa1f8f1290efd28f6470ea4417642fa5f4569641d73699e2a4c84afc6878e5578173ad2cd2bad517e57bca533bddf9392f6d6fc31e833
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr535455.exeFilesize
11KB
MD598f232c8953dd6817d683ee58072244b
SHA1d74c46d8e4c92c3bcb383a35c5b0209e77d94721
SHA2561b4cbb9bf0d9327398975b75c3fb79f146f3681f21f342a110d363b4a916d573
SHA512267199ec926c2711bad4e5f42e2b697f525648b6be3020034e61fc1cb1ae4911a6d96c4b74c8fcd7f20162a72c39670493fc9871f26c31105ca9259b3a051779
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr535455.exeFilesize
11KB
MD598f232c8953dd6817d683ee58072244b
SHA1d74c46d8e4c92c3bcb383a35c5b0209e77d94721
SHA2561b4cbb9bf0d9327398975b75c3fb79f146f3681f21f342a110d363b4a916d573
SHA512267199ec926c2711bad4e5f42e2b697f525648b6be3020034e61fc1cb1ae4911a6d96c4b74c8fcd7f20162a72c39670493fc9871f26c31105ca9259b3a051779
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku759982.exeFilesize
359KB
MD58527b67ed1fb3b5a4e3668c72628b86a
SHA1230992e9d484a95d86f199628a09863e2080ab41
SHA2567c21c940e8f057106ee9f7d9e0faa05212a4d5065272e85627bedbc4ff5e0cee
SHA51275c5ce420c1c92d72d7be46290e3bf7251f4f16f974f17a1a93f784336aa4dedd4871eeb6eca6a8af710ab2f9fccea1b6e1675a99f71ca0dd34e4ddd852f015e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku759982.exeFilesize
359KB
MD58527b67ed1fb3b5a4e3668c72628b86a
SHA1230992e9d484a95d86f199628a09863e2080ab41
SHA2567c21c940e8f057106ee9f7d9e0faa05212a4d5065272e85627bedbc4ff5e0cee
SHA51275c5ce420c1c92d72d7be46290e3bf7251f4f16f974f17a1a93f784336aa4dedd4871eeb6eca6a8af710ab2f9fccea1b6e1675a99f71ca0dd34e4ddd852f015e
-
memory/3412-135-0x0000000000330000-0x000000000033A000-memory.dmpFilesize
40KB
-
memory/4300-141-0x0000000003770000-0x00000000037B6000-memory.dmpFilesize
280KB
-
memory/4300-142-0x0000000001BD0000-0x0000000001C1B000-memory.dmpFilesize
300KB
-
memory/4300-143-0x00000000063D0000-0x00000000063E0000-memory.dmpFilesize
64KB
-
memory/4300-144-0x00000000063D0000-0x00000000063E0000-memory.dmpFilesize
64KB
-
memory/4300-145-0x00000000063D0000-0x00000000063E0000-memory.dmpFilesize
64KB
-
memory/4300-146-0x00000000063E0000-0x00000000068DE000-memory.dmpFilesize
5.0MB
-
memory/4300-147-0x0000000003830000-0x0000000003874000-memory.dmpFilesize
272KB
-
memory/4300-148-0x0000000003830000-0x000000000386F000-memory.dmpFilesize
252KB
-
memory/4300-149-0x0000000003830000-0x000000000386F000-memory.dmpFilesize
252KB
-
memory/4300-151-0x0000000003830000-0x000000000386F000-memory.dmpFilesize
252KB
-
memory/4300-153-0x0000000003830000-0x000000000386F000-memory.dmpFilesize
252KB
-
memory/4300-155-0x0000000003830000-0x000000000386F000-memory.dmpFilesize
252KB
-
memory/4300-157-0x0000000003830000-0x000000000386F000-memory.dmpFilesize
252KB
-
memory/4300-159-0x0000000003830000-0x000000000386F000-memory.dmpFilesize
252KB
-
memory/4300-161-0x0000000003830000-0x000000000386F000-memory.dmpFilesize
252KB
-
memory/4300-163-0x0000000003830000-0x000000000386F000-memory.dmpFilesize
252KB
-
memory/4300-165-0x0000000003830000-0x000000000386F000-memory.dmpFilesize
252KB
-
memory/4300-167-0x0000000003830000-0x000000000386F000-memory.dmpFilesize
252KB
-
memory/4300-169-0x0000000003830000-0x000000000386F000-memory.dmpFilesize
252KB
-
memory/4300-171-0x0000000003830000-0x000000000386F000-memory.dmpFilesize
252KB
-
memory/4300-173-0x0000000003830000-0x000000000386F000-memory.dmpFilesize
252KB
-
memory/4300-175-0x0000000003830000-0x000000000386F000-memory.dmpFilesize
252KB
-
memory/4300-177-0x0000000003830000-0x000000000386F000-memory.dmpFilesize
252KB
-
memory/4300-179-0x0000000003830000-0x000000000386F000-memory.dmpFilesize
252KB
-
memory/4300-181-0x0000000003830000-0x000000000386F000-memory.dmpFilesize
252KB
-
memory/4300-183-0x0000000003830000-0x000000000386F000-memory.dmpFilesize
252KB
-
memory/4300-185-0x0000000003830000-0x000000000386F000-memory.dmpFilesize
252KB
-
memory/4300-187-0x0000000003830000-0x000000000386F000-memory.dmpFilesize
252KB
-
memory/4300-189-0x0000000003830000-0x000000000386F000-memory.dmpFilesize
252KB
-
memory/4300-191-0x0000000003830000-0x000000000386F000-memory.dmpFilesize
252KB
-
memory/4300-193-0x0000000003830000-0x000000000386F000-memory.dmpFilesize
252KB
-
memory/4300-195-0x0000000003830000-0x000000000386F000-memory.dmpFilesize
252KB
-
memory/4300-197-0x0000000003830000-0x000000000386F000-memory.dmpFilesize
252KB
-
memory/4300-199-0x0000000003830000-0x000000000386F000-memory.dmpFilesize
252KB
-
memory/4300-201-0x0000000003830000-0x000000000386F000-memory.dmpFilesize
252KB
-
memory/4300-203-0x0000000003830000-0x000000000386F000-memory.dmpFilesize
252KB
-
memory/4300-205-0x0000000003830000-0x000000000386F000-memory.dmpFilesize
252KB
-
memory/4300-207-0x0000000003830000-0x000000000386F000-memory.dmpFilesize
252KB
-
memory/4300-209-0x0000000003830000-0x000000000386F000-memory.dmpFilesize
252KB
-
memory/4300-211-0x0000000003830000-0x000000000386F000-memory.dmpFilesize
252KB
-
memory/4300-1054-0x0000000006EF0000-0x00000000074F6000-memory.dmpFilesize
6.0MB
-
memory/4300-1055-0x00000000062B0000-0x00000000063BA000-memory.dmpFilesize
1.0MB
-
memory/4300-1056-0x0000000003B50000-0x0000000003B62000-memory.dmpFilesize
72KB
-
memory/4300-1057-0x0000000003D90000-0x0000000003DCE000-memory.dmpFilesize
248KB
-
memory/4300-1058-0x0000000003DD0000-0x0000000003E1B000-memory.dmpFilesize
300KB
-
memory/4300-1059-0x00000000063D0000-0x00000000063E0000-memory.dmpFilesize
64KB
-
memory/4300-1061-0x0000000006AD0000-0x0000000006B36000-memory.dmpFilesize
408KB
-
memory/4300-1062-0x0000000007800000-0x0000000007892000-memory.dmpFilesize
584KB
-
memory/4300-1063-0x00000000079A0000-0x0000000007B62000-memory.dmpFilesize
1.8MB
-
memory/4300-1064-0x0000000007B70000-0x000000000809C000-memory.dmpFilesize
5.2MB
-
memory/4300-1065-0x00000000063D0000-0x00000000063E0000-memory.dmpFilesize
64KB
-
memory/4300-1066-0x000000000B730000-0x000000000B7A6000-memory.dmpFilesize
472KB
-
memory/4300-1067-0x00000000036A0000-0x00000000036F0000-memory.dmpFilesize
320KB
-
memory/4876-1073-0x0000000000430000-0x0000000000462000-memory.dmpFilesize
200KB
-
memory/4876-1074-0x0000000002750000-0x000000000279B000-memory.dmpFilesize
300KB
-
memory/4876-1075-0x0000000005120000-0x0000000005130000-memory.dmpFilesize
64KB