Analysis
-
max time kernel
89s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 19:39
Static task
static1
Behavioral task
behavioral1
Sample
0535f73c2eff354ae0ef2d57a70bf8ddd26ad1bd00cb8bbc34fbacd0c8de244f.exe
Resource
win10v2004-20230221-en
General
-
Target
0535f73c2eff354ae0ef2d57a70bf8ddd26ad1bd00cb8bbc34fbacd0c8de244f.exe
-
Size
534KB
-
MD5
6e3079151aee1f4871f3a67181ed6f2b
-
SHA1
eebbe52bd7fb75ce5189357307072c9b3505ff55
-
SHA256
0535f73c2eff354ae0ef2d57a70bf8ddd26ad1bd00cb8bbc34fbacd0c8de244f
-
SHA512
cb85f32a09e224fafd20b097656d9ab688bd782d0a83d41d0433788e099dd31602b72436d1253938ad3be8f3b1eb55a5d87128c5cfe036f95d41091c7142dc04
-
SSDEEP
12288:4Mrcy90oEWjxlfTmEBG/2WRurtHgiObyr67EGNQ:UyhljxBTiJ6ab/5Q
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr953438.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr953438.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr953438.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr953438.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr953438.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr953438.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr953438.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/1828-157-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/1828-158-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/1828-160-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/1828-162-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/1828-164-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/1828-166-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/1828-170-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/1828-168-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/1828-172-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/1828-174-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/1828-176-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/1828-178-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/1828-180-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/1828-182-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/1828-184-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/1828-186-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/1828-188-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/1828-190-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/1828-192-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/1828-196-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/1828-194-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/1828-198-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/1828-200-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/1828-202-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/1828-204-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/1828-206-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/1828-208-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/1828-210-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/1828-212-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/1828-214-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/1828-216-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/1828-218-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/1828-220-0x0000000005030000-0x000000000506F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
zivx0364.exejr953438.exeku254857.exelr410021.exepid process 2244 zivx0364.exe 3472 jr953438.exe 1828 ku254857.exe 4956 lr410021.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr953438.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr953438.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
zivx0364.exe0535f73c2eff354ae0ef2d57a70bf8ddd26ad1bd00cb8bbc34fbacd0c8de244f.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zivx0364.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 0535f73c2eff354ae0ef2d57a70bf8ddd26ad1bd00cb8bbc34fbacd0c8de244f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 0535f73c2eff354ae0ef2d57a70bf8ddd26ad1bd00cb8bbc34fbacd0c8de244f.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zivx0364.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1860 1828 WerFault.exe ku254857.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr953438.exeku254857.exelr410021.exepid process 3472 jr953438.exe 3472 jr953438.exe 1828 ku254857.exe 1828 ku254857.exe 4956 lr410021.exe 4956 lr410021.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr953438.exeku254857.exelr410021.exedescription pid process Token: SeDebugPrivilege 3472 jr953438.exe Token: SeDebugPrivilege 1828 ku254857.exe Token: SeDebugPrivilege 4956 lr410021.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
0535f73c2eff354ae0ef2d57a70bf8ddd26ad1bd00cb8bbc34fbacd0c8de244f.exezivx0364.exedescription pid process target process PID 2136 wrote to memory of 2244 2136 0535f73c2eff354ae0ef2d57a70bf8ddd26ad1bd00cb8bbc34fbacd0c8de244f.exe zivx0364.exe PID 2136 wrote to memory of 2244 2136 0535f73c2eff354ae0ef2d57a70bf8ddd26ad1bd00cb8bbc34fbacd0c8de244f.exe zivx0364.exe PID 2136 wrote to memory of 2244 2136 0535f73c2eff354ae0ef2d57a70bf8ddd26ad1bd00cb8bbc34fbacd0c8de244f.exe zivx0364.exe PID 2244 wrote to memory of 3472 2244 zivx0364.exe jr953438.exe PID 2244 wrote to memory of 3472 2244 zivx0364.exe jr953438.exe PID 2244 wrote to memory of 1828 2244 zivx0364.exe ku254857.exe PID 2244 wrote to memory of 1828 2244 zivx0364.exe ku254857.exe PID 2244 wrote to memory of 1828 2244 zivx0364.exe ku254857.exe PID 2136 wrote to memory of 4956 2136 0535f73c2eff354ae0ef2d57a70bf8ddd26ad1bd00cb8bbc34fbacd0c8de244f.exe lr410021.exe PID 2136 wrote to memory of 4956 2136 0535f73c2eff354ae0ef2d57a70bf8ddd26ad1bd00cb8bbc34fbacd0c8de244f.exe lr410021.exe PID 2136 wrote to memory of 4956 2136 0535f73c2eff354ae0ef2d57a70bf8ddd26ad1bd00cb8bbc34fbacd0c8de244f.exe lr410021.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0535f73c2eff354ae0ef2d57a70bf8ddd26ad1bd00cb8bbc34fbacd0c8de244f.exe"C:\Users\Admin\AppData\Local\Temp\0535f73c2eff354ae0ef2d57a70bf8ddd26ad1bd00cb8bbc34fbacd0c8de244f.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zivx0364.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zivx0364.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr953438.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr953438.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku254857.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku254857.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1828 -s 13364⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr410021.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr410021.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1828 -ip 18281⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr410021.exeFilesize
175KB
MD56463d50483a2d8d923eb981b77f051ec
SHA1be1de63ddb89ab73eee463a054eba04d523c0c3b
SHA256d1009e366b6814b5bcd1e9de05e0d37db1a86120edf737b3a4fa6ae968b8e92e
SHA51216a2508d4db41a06e0029ef568133d489c9544255fa50f1852f4d162cd5154e5b6bab9d532452a29b658a625895626fde6cab8ba273ea4a12ed9c9ed286fa216
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr410021.exeFilesize
175KB
MD56463d50483a2d8d923eb981b77f051ec
SHA1be1de63ddb89ab73eee463a054eba04d523c0c3b
SHA256d1009e366b6814b5bcd1e9de05e0d37db1a86120edf737b3a4fa6ae968b8e92e
SHA51216a2508d4db41a06e0029ef568133d489c9544255fa50f1852f4d162cd5154e5b6bab9d532452a29b658a625895626fde6cab8ba273ea4a12ed9c9ed286fa216
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zivx0364.exeFilesize
392KB
MD5dbef52846677991f49ce319aeb3efe14
SHA1380247f24987d60600b0e1ee231b0f6eb67bbcbb
SHA256d2250fd8adc29ec058ba5aaa116518f28b662a0c228e3f9e24f054bf227b63fe
SHA512373ba2bbaf2e66f9c1b960fc51eba048a8f1c9f7f35ec35ec5531a6751f9476146714534a6dac975cfe766bac412af6966acb5733ec4c26409756e1c0763128f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zivx0364.exeFilesize
392KB
MD5dbef52846677991f49ce319aeb3efe14
SHA1380247f24987d60600b0e1ee231b0f6eb67bbcbb
SHA256d2250fd8adc29ec058ba5aaa116518f28b662a0c228e3f9e24f054bf227b63fe
SHA512373ba2bbaf2e66f9c1b960fc51eba048a8f1c9f7f35ec35ec5531a6751f9476146714534a6dac975cfe766bac412af6966acb5733ec4c26409756e1c0763128f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr953438.exeFilesize
11KB
MD5e990d9289a11a53f8f3d4782ec48ace0
SHA1da68207df1d2d60c65aa8026e0d15d0bfdcc9109
SHA2567a87d2934f6764e8e9c3671a5f61a2e8c1315d61333d6780444b6c6b794684d0
SHA5129926c7d4c4210bae835528b74ab1a7c504468faa674f7640f997e34c1d7b6ae9244268bb42005083f71666083e70dcda11f4212c28f054849fc17516f3ea6a79
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr953438.exeFilesize
11KB
MD5e990d9289a11a53f8f3d4782ec48ace0
SHA1da68207df1d2d60c65aa8026e0d15d0bfdcc9109
SHA2567a87d2934f6764e8e9c3671a5f61a2e8c1315d61333d6780444b6c6b794684d0
SHA5129926c7d4c4210bae835528b74ab1a7c504468faa674f7640f997e34c1d7b6ae9244268bb42005083f71666083e70dcda11f4212c28f054849fc17516f3ea6a79
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku254857.exeFilesize
318KB
MD5c16d15581bfb425e3a041d50c646f50d
SHA11cc63e395d881e6f0c4aded6d078c55dd791d01b
SHA25697a230b3a951c46e633f7828ff88de11538d3c735a6b7427d1f2c4e821347a22
SHA512791325d69d361487d2ba3eb5dbc67d0fb339fc24026403e5a8d264935db4473fd2b3956c5c010eb84b14a938c2e88fbe04c6fe89a9a98f97b4d8ceec95a3d5e6
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku254857.exeFilesize
318KB
MD5c16d15581bfb425e3a041d50c646f50d
SHA11cc63e395d881e6f0c4aded6d078c55dd791d01b
SHA25697a230b3a951c46e633f7828ff88de11538d3c735a6b7427d1f2c4e821347a22
SHA512791325d69d361487d2ba3eb5dbc67d0fb339fc24026403e5a8d264935db4473fd2b3956c5c010eb84b14a938c2e88fbe04c6fe89a9a98f97b4d8ceec95a3d5e6
-
memory/1828-154-0x00000000023A0000-0x00000000023B0000-memory.dmpFilesize
64KB
-
memory/1828-153-0x0000000000870000-0x00000000008BB000-memory.dmpFilesize
300KB
-
memory/1828-155-0x0000000004A40000-0x0000000004FE4000-memory.dmpFilesize
5.6MB
-
memory/1828-156-0x00000000023A0000-0x00000000023B0000-memory.dmpFilesize
64KB
-
memory/1828-157-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/1828-158-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/1828-160-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/1828-162-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/1828-164-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/1828-166-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/1828-170-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/1828-168-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/1828-172-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/1828-174-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/1828-176-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/1828-178-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/1828-180-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/1828-182-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/1828-184-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/1828-186-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/1828-188-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/1828-190-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/1828-192-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/1828-196-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/1828-194-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/1828-198-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/1828-200-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/1828-202-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/1828-204-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/1828-206-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/1828-208-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/1828-210-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/1828-212-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/1828-214-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/1828-216-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/1828-218-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/1828-220-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/1828-1063-0x00000000050C0000-0x00000000056D8000-memory.dmpFilesize
6.1MB
-
memory/1828-1064-0x0000000005760000-0x000000000586A000-memory.dmpFilesize
1.0MB
-
memory/1828-1065-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/1828-1066-0x00000000058C0000-0x00000000058FC000-memory.dmpFilesize
240KB
-
memory/1828-1067-0x00000000023A0000-0x00000000023B0000-memory.dmpFilesize
64KB
-
memory/1828-1069-0x0000000005BB0000-0x0000000005C42000-memory.dmpFilesize
584KB
-
memory/1828-1070-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/1828-1071-0x00000000023A0000-0x00000000023B0000-memory.dmpFilesize
64KB
-
memory/1828-1072-0x00000000023A0000-0x00000000023B0000-memory.dmpFilesize
64KB
-
memory/1828-1073-0x0000000006370000-0x0000000006532000-memory.dmpFilesize
1.8MB
-
memory/1828-1074-0x0000000006550000-0x0000000006A7C000-memory.dmpFilesize
5.2MB
-
memory/1828-1075-0x00000000023A0000-0x00000000023B0000-memory.dmpFilesize
64KB
-
memory/1828-1076-0x0000000007F90000-0x0000000008006000-memory.dmpFilesize
472KB
-
memory/1828-1077-0x0000000008020000-0x0000000008070000-memory.dmpFilesize
320KB
-
memory/3472-147-0x00000000004D0000-0x00000000004DA000-memory.dmpFilesize
40KB
-
memory/4956-1083-0x00000000005E0000-0x0000000000612000-memory.dmpFilesize
200KB
-
memory/4956-1084-0x0000000004E80000-0x0000000004E90000-memory.dmpFilesize
64KB
-
memory/4956-1085-0x0000000004E80000-0x0000000004E90000-memory.dmpFilesize
64KB