Analysis
-
max time kernel
67s -
max time network
131s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
31-03-2023 19:36
Static task
static1
Behavioral task
behavioral1
Sample
bef50777e3de21313847efa5f76f69a7415fbfac9a0125e5a7d37a23db2ed23f.exe
Resource
win10-20230220-en
General
-
Target
bef50777e3de21313847efa5f76f69a7415fbfac9a0125e5a7d37a23db2ed23f.exe
-
Size
672KB
-
MD5
b9fbaa8f64280dd9d399d17adc71dd51
-
SHA1
a7d64a1a65529c2dcc0b33a887395940a38ad6b4
-
SHA256
bef50777e3de21313847efa5f76f69a7415fbfac9a0125e5a7d37a23db2ed23f
-
SHA512
3bf1878ee5abb5083926156c1bdb22153b1cee602c35f96e501357d49ef190c987a172eb4c2ad1520bddf5a32733f21fe7ba0a3dac2f0653bdaaef881c5ccef7
-
SSDEEP
12288:tMr+y90rmC8FRGLIo+vPAzzDtGkSRwOb7rSmaoy2Hj/:ryGp8H1omPAZGkSNbSDoyC/
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro5860.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro5860.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro5860.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro5860.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro5860.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro5860.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/4740-178-0x00000000049E0000-0x0000000004A26000-memory.dmp family_redline behavioral1/memory/4740-181-0x0000000004A60000-0x0000000004AA4000-memory.dmp family_redline behavioral1/memory/4740-182-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4740-183-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4740-185-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4740-187-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4740-189-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4740-191-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4740-193-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4740-195-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4740-197-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4740-199-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4740-201-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4740-203-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4740-205-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4740-207-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4740-209-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4740-211-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4740-213-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4740-215-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4740-1101-0x0000000004B20000-0x0000000004B30000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un975758.exepro5860.exequ0313.exesi025991.exepid process 2392 un975758.exe 2632 pro5860.exe 4740 qu0313.exe 1196 si025991.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro5860.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro5860.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro5860.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
bef50777e3de21313847efa5f76f69a7415fbfac9a0125e5a7d37a23db2ed23f.exeun975758.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce bef50777e3de21313847efa5f76f69a7415fbfac9a0125e5a7d37a23db2ed23f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" bef50777e3de21313847efa5f76f69a7415fbfac9a0125e5a7d37a23db2ed23f.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un975758.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un975758.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro5860.exequ0313.exesi025991.exepid process 2632 pro5860.exe 2632 pro5860.exe 4740 qu0313.exe 4740 qu0313.exe 1196 si025991.exe 1196 si025991.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro5860.exequ0313.exesi025991.exedescription pid process Token: SeDebugPrivilege 2632 pro5860.exe Token: SeDebugPrivilege 4740 qu0313.exe Token: SeDebugPrivilege 1196 si025991.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
bef50777e3de21313847efa5f76f69a7415fbfac9a0125e5a7d37a23db2ed23f.exeun975758.exedescription pid process target process PID 2052 wrote to memory of 2392 2052 bef50777e3de21313847efa5f76f69a7415fbfac9a0125e5a7d37a23db2ed23f.exe un975758.exe PID 2052 wrote to memory of 2392 2052 bef50777e3de21313847efa5f76f69a7415fbfac9a0125e5a7d37a23db2ed23f.exe un975758.exe PID 2052 wrote to memory of 2392 2052 bef50777e3de21313847efa5f76f69a7415fbfac9a0125e5a7d37a23db2ed23f.exe un975758.exe PID 2392 wrote to memory of 2632 2392 un975758.exe pro5860.exe PID 2392 wrote to memory of 2632 2392 un975758.exe pro5860.exe PID 2392 wrote to memory of 2632 2392 un975758.exe pro5860.exe PID 2392 wrote to memory of 4740 2392 un975758.exe qu0313.exe PID 2392 wrote to memory of 4740 2392 un975758.exe qu0313.exe PID 2392 wrote to memory of 4740 2392 un975758.exe qu0313.exe PID 2052 wrote to memory of 1196 2052 bef50777e3de21313847efa5f76f69a7415fbfac9a0125e5a7d37a23db2ed23f.exe si025991.exe PID 2052 wrote to memory of 1196 2052 bef50777e3de21313847efa5f76f69a7415fbfac9a0125e5a7d37a23db2ed23f.exe si025991.exe PID 2052 wrote to memory of 1196 2052 bef50777e3de21313847efa5f76f69a7415fbfac9a0125e5a7d37a23db2ed23f.exe si025991.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bef50777e3de21313847efa5f76f69a7415fbfac9a0125e5a7d37a23db2ed23f.exe"C:\Users\Admin\AppData\Local\Temp\bef50777e3de21313847efa5f76f69a7415fbfac9a0125e5a7d37a23db2ed23f.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un975758.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un975758.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5860.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5860.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0313.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0313.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si025991.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si025991.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si025991.exeFilesize
175KB
MD56303db0cab962c9eb729ed004240d527
SHA1770878697c3d1969ce8fdc43b06e6f17e6f4194d
SHA25611f7f43db0f7d2451a7306b6a9da8d28c9762217c67c78cc1f33f2b08c3833fe
SHA512b1d65775a7132cfb77850f9e99b223663661ff64bf1a059613599d4c18941504538a46950fd15bb32fb1c2ca750a7c42d6955fd3abae67180ca84f05564d0079
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si025991.exeFilesize
175KB
MD56303db0cab962c9eb729ed004240d527
SHA1770878697c3d1969ce8fdc43b06e6f17e6f4194d
SHA25611f7f43db0f7d2451a7306b6a9da8d28c9762217c67c78cc1f33f2b08c3833fe
SHA512b1d65775a7132cfb77850f9e99b223663661ff64bf1a059613599d4c18941504538a46950fd15bb32fb1c2ca750a7c42d6955fd3abae67180ca84f05564d0079
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un975758.exeFilesize
531KB
MD54474b750b5057e64a4d7d916ad47d96a
SHA1daaf96b9b3d36b82faf10d9eb23328d0907dc4ba
SHA2560fe897a4f34c2768bc8c5044c97be5414f221bc58d920be615453fe5b24ec242
SHA5128e3fea57e0a5bb93934760c53c37d5ec3a3d5b08a762a384a3f4ea6f76a59b2d22c3b2f853d96b03d0635e7ad99e217938f1a4875f772f8d79edab2f8679b764
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un975758.exeFilesize
531KB
MD54474b750b5057e64a4d7d916ad47d96a
SHA1daaf96b9b3d36b82faf10d9eb23328d0907dc4ba
SHA2560fe897a4f34c2768bc8c5044c97be5414f221bc58d920be615453fe5b24ec242
SHA5128e3fea57e0a5bb93934760c53c37d5ec3a3d5b08a762a384a3f4ea6f76a59b2d22c3b2f853d96b03d0635e7ad99e217938f1a4875f772f8d79edab2f8679b764
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5860.exeFilesize
260KB
MD5a78b13f73e07a977c81babb7679ca6aa
SHA1dae882829a8a7ade07e30b124f9ca26da2fe4c6f
SHA2560fe4bfe1d74790c8473230e24e3353b61302ed79e6c96e126bbaaf4fca16e8f9
SHA512154443ad0451e2ee8a6f9222a50c9586e310458b8e40711d42696142d9fe9a424a65219e57c6f65bd43995528094018b983a097a0940b6e849bd2564f75fe51f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5860.exeFilesize
260KB
MD5a78b13f73e07a977c81babb7679ca6aa
SHA1dae882829a8a7ade07e30b124f9ca26da2fe4c6f
SHA2560fe4bfe1d74790c8473230e24e3353b61302ed79e6c96e126bbaaf4fca16e8f9
SHA512154443ad0451e2ee8a6f9222a50c9586e310458b8e40711d42696142d9fe9a424a65219e57c6f65bd43995528094018b983a097a0940b6e849bd2564f75fe51f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0313.exeFilesize
318KB
MD57d861c98365a6a0d72c69742d945fd2d
SHA1ce3ffa0aff834c470596974a7987387608fcba3a
SHA256c0115b50c90223a6bb2d3dc7e163dcd0c9b7f2a5c6ef2bd7344316eb375a1280
SHA5122fbc20c08647da57afa270d426369d9351b998ee1e204ddb7378b80e3cadca395f52086f6093b81e04c9cb0e6f80963ffcbf2196bb93c0b2a322cdb0058147d0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0313.exeFilesize
318KB
MD57d861c98365a6a0d72c69742d945fd2d
SHA1ce3ffa0aff834c470596974a7987387608fcba3a
SHA256c0115b50c90223a6bb2d3dc7e163dcd0c9b7f2a5c6ef2bd7344316eb375a1280
SHA5122fbc20c08647da57afa270d426369d9351b998ee1e204ddb7378b80e3cadca395f52086f6093b81e04c9cb0e6f80963ffcbf2196bb93c0b2a322cdb0058147d0
-
memory/1196-1110-0x0000000000F40000-0x0000000000F72000-memory.dmpFilesize
200KB
-
memory/1196-1111-0x00000000057C0000-0x000000000580B000-memory.dmpFilesize
300KB
-
memory/1196-1112-0x0000000005810000-0x0000000005820000-memory.dmpFilesize
64KB
-
memory/2632-144-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/2632-156-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/2632-140-0x00000000024F0000-0x0000000002508000-memory.dmpFilesize
96KB
-
memory/2632-141-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/2632-142-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/2632-138-0x0000000002520000-0x0000000002530000-memory.dmpFilesize
64KB
-
memory/2632-146-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/2632-150-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/2632-148-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/2632-152-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/2632-154-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/2632-139-0x0000000004A70000-0x0000000004F6E000-memory.dmpFilesize
5.0MB
-
memory/2632-158-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/2632-160-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/2632-162-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/2632-164-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/2632-166-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/2632-168-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/2632-169-0x0000000002520000-0x0000000002530000-memory.dmpFilesize
64KB
-
memory/2632-170-0x0000000002520000-0x0000000002530000-memory.dmpFilesize
64KB
-
memory/2632-171-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/2632-173-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/2632-136-0x0000000002330000-0x000000000234A000-memory.dmpFilesize
104KB
-
memory/2632-137-0x00000000004C0000-0x00000000004ED000-memory.dmpFilesize
180KB
-
memory/4740-181-0x0000000004A60000-0x0000000004AA4000-memory.dmpFilesize
272KB
-
memory/4740-215-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4740-182-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4740-183-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4740-185-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4740-187-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4740-189-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4740-191-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4740-193-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4740-195-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4740-197-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4740-199-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4740-201-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4740-203-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4740-205-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4740-207-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4740-209-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4740-211-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4740-213-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4740-180-0x0000000004B20000-0x0000000004B30000-memory.dmpFilesize
64KB
-
memory/4740-424-0x0000000004B20000-0x0000000004B30000-memory.dmpFilesize
64KB
-
memory/4740-1089-0x0000000005030000-0x0000000005636000-memory.dmpFilesize
6.0MB
-
memory/4740-1090-0x0000000005660000-0x000000000576A000-memory.dmpFilesize
1.0MB
-
memory/4740-1091-0x00000000057A0000-0x00000000057B2000-memory.dmpFilesize
72KB
-
memory/4740-1092-0x00000000057C0000-0x00000000057FE000-memory.dmpFilesize
248KB
-
memory/4740-1093-0x0000000005910000-0x000000000595B000-memory.dmpFilesize
300KB
-
memory/4740-1094-0x0000000004B20000-0x0000000004B30000-memory.dmpFilesize
64KB
-
memory/4740-1096-0x0000000004B20000-0x0000000004B30000-memory.dmpFilesize
64KB
-
memory/4740-1097-0x0000000005AA0000-0x0000000005B06000-memory.dmpFilesize
408KB
-
memory/4740-1098-0x0000000006170000-0x0000000006202000-memory.dmpFilesize
584KB
-
memory/4740-1099-0x0000000006320000-0x0000000006396000-memory.dmpFilesize
472KB
-
memory/4740-1100-0x00000000063B0000-0x0000000006400000-memory.dmpFilesize
320KB
-
memory/4740-1101-0x0000000004B20000-0x0000000004B30000-memory.dmpFilesize
64KB
-
memory/4740-179-0x0000000000590000-0x00000000005DB000-memory.dmpFilesize
300KB
-
memory/4740-178-0x00000000049E0000-0x0000000004A26000-memory.dmpFilesize
280KB
-
memory/4740-1102-0x0000000006440000-0x0000000006602000-memory.dmpFilesize
1.8MB
-
memory/4740-1103-0x0000000006610000-0x0000000006B3C000-memory.dmpFilesize
5.2MB
-
memory/4740-1104-0x0000000004B20000-0x0000000004B30000-memory.dmpFilesize
64KB