Analysis
-
max time kernel
49s -
max time network
57s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
31-03-2023 20:27
Static task
static1
Behavioral task
behavioral1
Sample
e36a7499a4d24e7bcb36d7a0164d4849b763be1b050bf14ab0cbcbe74d6254fa.exe
Resource
win10-20230220-en
General
-
Target
e36a7499a4d24e7bcb36d7a0164d4849b763be1b050bf14ab0cbcbe74d6254fa.exe
-
Size
672KB
-
MD5
fa270c3efbb285d69cb9da06266c3933
-
SHA1
4c332546da4ce981bb56b06854090e7cfbdba17a
-
SHA256
e36a7499a4d24e7bcb36d7a0164d4849b763be1b050bf14ab0cbcbe74d6254fa
-
SHA512
d32938785f52ac327f30a94299f08e75bd150460142cab726de447f9de4ca40216d01facc152b69d74498fb3c9d46818bae92f497da78f037a760d2addf3e64e
-
SSDEEP
12288:tMrOy909pQ4EBgSU/AiYpCnXkSn3LAuCMgLqPkpo95Dc:TyKQ4E+/sAXkSn7AFMgGPuP
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro0023.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro0023.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro0023.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro0023.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro0023.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro0023.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/4152-178-0x0000000005FF0000-0x0000000006036000-memory.dmp family_redline behavioral1/memory/4152-179-0x0000000006070000-0x00000000060B4000-memory.dmp family_redline behavioral1/memory/4152-180-0x0000000006070000-0x00000000060AF000-memory.dmp family_redline behavioral1/memory/4152-181-0x0000000006070000-0x00000000060AF000-memory.dmp family_redline behavioral1/memory/4152-183-0x0000000006070000-0x00000000060AF000-memory.dmp family_redline behavioral1/memory/4152-185-0x0000000006070000-0x00000000060AF000-memory.dmp family_redline behavioral1/memory/4152-187-0x0000000006070000-0x00000000060AF000-memory.dmp family_redline behavioral1/memory/4152-189-0x0000000006070000-0x00000000060AF000-memory.dmp family_redline behavioral1/memory/4152-191-0x0000000006070000-0x00000000060AF000-memory.dmp family_redline behavioral1/memory/4152-193-0x0000000006070000-0x00000000060AF000-memory.dmp family_redline behavioral1/memory/4152-195-0x0000000006070000-0x00000000060AF000-memory.dmp family_redline behavioral1/memory/4152-197-0x0000000006070000-0x00000000060AF000-memory.dmp family_redline behavioral1/memory/4152-199-0x0000000006070000-0x00000000060AF000-memory.dmp family_redline behavioral1/memory/4152-201-0x0000000006070000-0x00000000060AF000-memory.dmp family_redline behavioral1/memory/4152-203-0x0000000006070000-0x00000000060AF000-memory.dmp family_redline behavioral1/memory/4152-205-0x0000000006070000-0x00000000060AF000-memory.dmp family_redline behavioral1/memory/4152-207-0x0000000006070000-0x00000000060AF000-memory.dmp family_redline behavioral1/memory/4152-209-0x0000000006070000-0x00000000060AF000-memory.dmp family_redline behavioral1/memory/4152-211-0x0000000006070000-0x00000000060AF000-memory.dmp family_redline behavioral1/memory/4152-213-0x0000000006070000-0x00000000060AF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un048547.exepro0023.exequ7966.exesi965741.exepid process 2256 un048547.exe 2580 pro0023.exe 4152 qu7966.exe 3028 si965741.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro0023.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro0023.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro0023.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un048547.exee36a7499a4d24e7bcb36d7a0164d4849b763be1b050bf14ab0cbcbe74d6254fa.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un048547.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un048547.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce e36a7499a4d24e7bcb36d7a0164d4849b763be1b050bf14ab0cbcbe74d6254fa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" e36a7499a4d24e7bcb36d7a0164d4849b763be1b050bf14ab0cbcbe74d6254fa.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro0023.exequ7966.exesi965741.exepid process 2580 pro0023.exe 2580 pro0023.exe 4152 qu7966.exe 4152 qu7966.exe 3028 si965741.exe 3028 si965741.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro0023.exequ7966.exesi965741.exedescription pid process Token: SeDebugPrivilege 2580 pro0023.exe Token: SeDebugPrivilege 4152 qu7966.exe Token: SeDebugPrivilege 3028 si965741.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
e36a7499a4d24e7bcb36d7a0164d4849b763be1b050bf14ab0cbcbe74d6254fa.exeun048547.exedescription pid process target process PID 2060 wrote to memory of 2256 2060 e36a7499a4d24e7bcb36d7a0164d4849b763be1b050bf14ab0cbcbe74d6254fa.exe un048547.exe PID 2060 wrote to memory of 2256 2060 e36a7499a4d24e7bcb36d7a0164d4849b763be1b050bf14ab0cbcbe74d6254fa.exe un048547.exe PID 2060 wrote to memory of 2256 2060 e36a7499a4d24e7bcb36d7a0164d4849b763be1b050bf14ab0cbcbe74d6254fa.exe un048547.exe PID 2256 wrote to memory of 2580 2256 un048547.exe pro0023.exe PID 2256 wrote to memory of 2580 2256 un048547.exe pro0023.exe PID 2256 wrote to memory of 2580 2256 un048547.exe pro0023.exe PID 2256 wrote to memory of 4152 2256 un048547.exe qu7966.exe PID 2256 wrote to memory of 4152 2256 un048547.exe qu7966.exe PID 2256 wrote to memory of 4152 2256 un048547.exe qu7966.exe PID 2060 wrote to memory of 3028 2060 e36a7499a4d24e7bcb36d7a0164d4849b763be1b050bf14ab0cbcbe74d6254fa.exe si965741.exe PID 2060 wrote to memory of 3028 2060 e36a7499a4d24e7bcb36d7a0164d4849b763be1b050bf14ab0cbcbe74d6254fa.exe si965741.exe PID 2060 wrote to memory of 3028 2060 e36a7499a4d24e7bcb36d7a0164d4849b763be1b050bf14ab0cbcbe74d6254fa.exe si965741.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e36a7499a4d24e7bcb36d7a0164d4849b763be1b050bf14ab0cbcbe74d6254fa.exe"C:\Users\Admin\AppData\Local\Temp\e36a7499a4d24e7bcb36d7a0164d4849b763be1b050bf14ab0cbcbe74d6254fa.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un048547.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un048547.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0023.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0023.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7966.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7966.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si965741.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si965741.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si965741.exeFilesize
175KB
MD5fcefc286bafed64b722f4b8489cb374a
SHA1bfcb770d93295975805235f94105af52f0e989ae
SHA256a0dff83f81c9f68bac7f39aea0225a199bb4c4b31abe59931d2900fcd31c7a5d
SHA51250a787079a4e98fbdc79e9fc54ad2633281d373751eecdc102616cdb1f820253d87b16a42427367fc852b4e91dba9de85095de4b22e7be243e1267115544db54
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si965741.exeFilesize
175KB
MD5fcefc286bafed64b722f4b8489cb374a
SHA1bfcb770d93295975805235f94105af52f0e989ae
SHA256a0dff83f81c9f68bac7f39aea0225a199bb4c4b31abe59931d2900fcd31c7a5d
SHA51250a787079a4e98fbdc79e9fc54ad2633281d373751eecdc102616cdb1f820253d87b16a42427367fc852b4e91dba9de85095de4b22e7be243e1267115544db54
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un048547.exeFilesize
530KB
MD584ef0164b0e17f16109057db3761b757
SHA1a31573c813e38c921b43ba8a872c9f52c05b0d09
SHA2563fa94b71ea9b9b50ea3f4432fb19146c429f646b1218f6b45ce613788c156881
SHA51297edc875e7b192e10f5c64dc9893fb914d2bdff7b4b54f6ac689b4799d3df801ffc716a4b550cd6c6898f69a1fc9ba090c837de4f4973919e0ab75dcbcc8357d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un048547.exeFilesize
530KB
MD584ef0164b0e17f16109057db3761b757
SHA1a31573c813e38c921b43ba8a872c9f52c05b0d09
SHA2563fa94b71ea9b9b50ea3f4432fb19146c429f646b1218f6b45ce613788c156881
SHA51297edc875e7b192e10f5c64dc9893fb914d2bdff7b4b54f6ac689b4799d3df801ffc716a4b550cd6c6898f69a1fc9ba090c837de4f4973919e0ab75dcbcc8357d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0023.exeFilesize
260KB
MD503a21c73dfda0f31a2fa5d96af3c401d
SHA1f465d2431252d0ad931e0c5f28d7166a124fe310
SHA256f30f75737761a85fb2fa92a4e6025582228562430cd93132a026538cbf433868
SHA5127a0886cee95afe6c0d0783783517aa019cea081cbe840101c1aa8344cb8d7e528cab9ce4aabdb64014b2582f2b6b11768996c9b289fa2ba2b12d9a50981e0f40
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0023.exeFilesize
260KB
MD503a21c73dfda0f31a2fa5d96af3c401d
SHA1f465d2431252d0ad931e0c5f28d7166a124fe310
SHA256f30f75737761a85fb2fa92a4e6025582228562430cd93132a026538cbf433868
SHA5127a0886cee95afe6c0d0783783517aa019cea081cbe840101c1aa8344cb8d7e528cab9ce4aabdb64014b2582f2b6b11768996c9b289fa2ba2b12d9a50981e0f40
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7966.exeFilesize
359KB
MD50e9e98c0c1992dfe135055cdc0658698
SHA1c590a6ae1c0979e27e0c1a03465f1dd39b1a74fc
SHA2568c9b87e28690c89a99e18d0ce691c8294c2ddde65e6efdbfb63aeb92bb08c664
SHA51226c6308d76022df79d00b47ba3da7c1b501a3d709c21e7c2088ff15565a4e3979b7956d180eae15c96890cf8dc7a11551b2e4303a672bdf0a0909d9d5003da09
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7966.exeFilesize
359KB
MD50e9e98c0c1992dfe135055cdc0658698
SHA1c590a6ae1c0979e27e0c1a03465f1dd39b1a74fc
SHA2568c9b87e28690c89a99e18d0ce691c8294c2ddde65e6efdbfb63aeb92bb08c664
SHA51226c6308d76022df79d00b47ba3da7c1b501a3d709c21e7c2088ff15565a4e3979b7956d180eae15c96890cf8dc7a11551b2e4303a672bdf0a0909d9d5003da09
-
memory/2580-136-0x0000000000770000-0x000000000078A000-memory.dmpFilesize
104KB
-
memory/2580-137-0x0000000004C00000-0x00000000050FE000-memory.dmpFilesize
5.0MB
-
memory/2580-138-0x0000000002580000-0x0000000002598000-memory.dmpFilesize
96KB
-
memory/2580-139-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/2580-140-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/2580-142-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/2580-144-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/2580-146-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/2580-150-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/2580-152-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/2580-148-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/2580-154-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/2580-156-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/2580-159-0x00000000001D0000-0x00000000001FD000-memory.dmpFilesize
180KB
-
memory/2580-158-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/2580-160-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/2580-163-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/2580-162-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/2580-168-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/2580-170-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/2580-166-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/2580-164-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/2580-171-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/2580-173-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/3028-1112-0x0000000000FD0000-0x0000000001002000-memory.dmpFilesize
200KB
-
memory/3028-1114-0x0000000005A10000-0x0000000005A5B000-memory.dmpFilesize
300KB
-
memory/3028-1113-0x0000000005BC0000-0x0000000005BD0000-memory.dmpFilesize
64KB
-
memory/4152-181-0x0000000006070000-0x00000000060AF000-memory.dmpFilesize
252KB
-
memory/4152-345-0x0000000006190000-0x00000000061A0000-memory.dmpFilesize
64KB
-
memory/4152-183-0x0000000006070000-0x00000000060AF000-memory.dmpFilesize
252KB
-
memory/4152-185-0x0000000006070000-0x00000000060AF000-memory.dmpFilesize
252KB
-
memory/4152-187-0x0000000006070000-0x00000000060AF000-memory.dmpFilesize
252KB
-
memory/4152-189-0x0000000006070000-0x00000000060AF000-memory.dmpFilesize
252KB
-
memory/4152-191-0x0000000006070000-0x00000000060AF000-memory.dmpFilesize
252KB
-
memory/4152-193-0x0000000006070000-0x00000000060AF000-memory.dmpFilesize
252KB
-
memory/4152-195-0x0000000006070000-0x00000000060AF000-memory.dmpFilesize
252KB
-
memory/4152-197-0x0000000006070000-0x00000000060AF000-memory.dmpFilesize
252KB
-
memory/4152-199-0x0000000006070000-0x00000000060AF000-memory.dmpFilesize
252KB
-
memory/4152-201-0x0000000006070000-0x00000000060AF000-memory.dmpFilesize
252KB
-
memory/4152-203-0x0000000006070000-0x00000000060AF000-memory.dmpFilesize
252KB
-
memory/4152-205-0x0000000006070000-0x00000000060AF000-memory.dmpFilesize
252KB
-
memory/4152-207-0x0000000006070000-0x00000000060AF000-memory.dmpFilesize
252KB
-
memory/4152-209-0x0000000006070000-0x00000000060AF000-memory.dmpFilesize
252KB
-
memory/4152-211-0x0000000006070000-0x00000000060AF000-memory.dmpFilesize
252KB
-
memory/4152-213-0x0000000006070000-0x00000000060AF000-memory.dmpFilesize
252KB
-
memory/4152-341-0x00000000034D0000-0x000000000351B000-memory.dmpFilesize
300KB
-
memory/4152-180-0x0000000006070000-0x00000000060AF000-memory.dmpFilesize
252KB
-
memory/4152-343-0x0000000006190000-0x00000000061A0000-memory.dmpFilesize
64KB
-
memory/4152-348-0x0000000006190000-0x00000000061A0000-memory.dmpFilesize
64KB
-
memory/4152-1090-0x00000000066A0000-0x0000000006CA6000-memory.dmpFilesize
6.0MB
-
memory/4152-1091-0x0000000006CB0000-0x0000000006DBA000-memory.dmpFilesize
1.0MB
-
memory/4152-1092-0x0000000006DE0000-0x0000000006DF2000-memory.dmpFilesize
72KB
-
memory/4152-1093-0x0000000006E00000-0x0000000006E3E000-memory.dmpFilesize
248KB
-
memory/4152-1094-0x0000000006F90000-0x0000000006FDB000-memory.dmpFilesize
300KB
-
memory/4152-1095-0x0000000006190000-0x00000000061A0000-memory.dmpFilesize
64KB
-
memory/4152-1097-0x00000000070E0000-0x0000000007172000-memory.dmpFilesize
584KB
-
memory/4152-1098-0x0000000007180000-0x00000000071E6000-memory.dmpFilesize
408KB
-
memory/4152-1099-0x0000000006190000-0x00000000061A0000-memory.dmpFilesize
64KB
-
memory/4152-1100-0x0000000006190000-0x00000000061A0000-memory.dmpFilesize
64KB
-
memory/4152-1101-0x0000000006190000-0x00000000061A0000-memory.dmpFilesize
64KB
-
memory/4152-1102-0x0000000007C00000-0x0000000007C76000-memory.dmpFilesize
472KB
-
memory/4152-1103-0x0000000007C90000-0x0000000007CE0000-memory.dmpFilesize
320KB
-
memory/4152-179-0x0000000006070000-0x00000000060B4000-memory.dmpFilesize
272KB
-
memory/4152-178-0x0000000005FF0000-0x0000000006036000-memory.dmpFilesize
280KB
-
memory/4152-1104-0x0000000007D00000-0x0000000007EC2000-memory.dmpFilesize
1.8MB
-
memory/4152-1105-0x0000000007ED0000-0x00000000083FC000-memory.dmpFilesize
5.2MB
-
memory/4152-1106-0x0000000006190000-0x00000000061A0000-memory.dmpFilesize
64KB