Analysis
-
max time kernel
67s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 19:43
Static task
static1
Behavioral task
behavioral1
Sample
b5b7c12f94ab354fc282072013762174a75b2fec2028b463364ffaaa6ee1638c.exe
Resource
win10v2004-20230220-en
General
-
Target
b5b7c12f94ab354fc282072013762174a75b2fec2028b463364ffaaa6ee1638c.exe
-
Size
534KB
-
MD5
59a14109de4fe602d81444675c535afc
-
SHA1
be40484e9ec6fcaef5cce72ae599ddfef9f0a809
-
SHA256
b5b7c12f94ab354fc282072013762174a75b2fec2028b463364ffaaa6ee1638c
-
SHA512
93a3ada0688a91baeabe7fe3afff82636c0fb0c9da65e0a7d583e15ee02d0186ed4e76253a78c532b5f0f4ae408e18aa08d88d9736f873d7a87f24d4c88ddd8d
-
SSDEEP
12288:DMrQy900zwtyvgmcA1PA1v8ObnrfUJbRrezoyVT:7y5RoI1PSbuNezoyR
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr469895.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr469895.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr469895.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr469895.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr469895.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr469895.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr469895.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/2796-158-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/2796-159-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/2796-161-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/2796-163-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/2796-165-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/2796-167-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/2796-169-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/2796-171-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/2796-175-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/2796-173-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/2796-177-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/2796-179-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/2796-181-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/2796-183-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/2796-185-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/2796-187-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/2796-189-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/2796-191-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/2796-193-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/2796-195-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/2796-197-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/2796-199-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/2796-201-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/2796-203-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/2796-205-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/2796-207-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/2796-213-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/2796-211-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/2796-209-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/2796-215-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/2796-217-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/2796-219-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/2796-221-0x0000000002610000-0x000000000264F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
zirY7803.exejr469895.exeku856635.exelr670608.exepid process 1496 zirY7803.exe 800 jr469895.exe 2796 ku856635.exe 3452 lr670608.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr469895.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr469895.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
b5b7c12f94ab354fc282072013762174a75b2fec2028b463364ffaaa6ee1638c.exezirY7803.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce b5b7c12f94ab354fc282072013762174a75b2fec2028b463364ffaaa6ee1638c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" b5b7c12f94ab354fc282072013762174a75b2fec2028b463364ffaaa6ee1638c.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zirY7803.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zirY7803.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 640 2796 WerFault.exe ku856635.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr469895.exeku856635.exelr670608.exepid process 800 jr469895.exe 800 jr469895.exe 2796 ku856635.exe 2796 ku856635.exe 3452 lr670608.exe 3452 lr670608.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr469895.exeku856635.exelr670608.exedescription pid process Token: SeDebugPrivilege 800 jr469895.exe Token: SeDebugPrivilege 2796 ku856635.exe Token: SeDebugPrivilege 3452 lr670608.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
b5b7c12f94ab354fc282072013762174a75b2fec2028b463364ffaaa6ee1638c.exezirY7803.exedescription pid process target process PID 1988 wrote to memory of 1496 1988 b5b7c12f94ab354fc282072013762174a75b2fec2028b463364ffaaa6ee1638c.exe zirY7803.exe PID 1988 wrote to memory of 1496 1988 b5b7c12f94ab354fc282072013762174a75b2fec2028b463364ffaaa6ee1638c.exe zirY7803.exe PID 1988 wrote to memory of 1496 1988 b5b7c12f94ab354fc282072013762174a75b2fec2028b463364ffaaa6ee1638c.exe zirY7803.exe PID 1496 wrote to memory of 800 1496 zirY7803.exe jr469895.exe PID 1496 wrote to memory of 800 1496 zirY7803.exe jr469895.exe PID 1496 wrote to memory of 2796 1496 zirY7803.exe ku856635.exe PID 1496 wrote to memory of 2796 1496 zirY7803.exe ku856635.exe PID 1496 wrote to memory of 2796 1496 zirY7803.exe ku856635.exe PID 1988 wrote to memory of 3452 1988 b5b7c12f94ab354fc282072013762174a75b2fec2028b463364ffaaa6ee1638c.exe lr670608.exe PID 1988 wrote to memory of 3452 1988 b5b7c12f94ab354fc282072013762174a75b2fec2028b463364ffaaa6ee1638c.exe lr670608.exe PID 1988 wrote to memory of 3452 1988 b5b7c12f94ab354fc282072013762174a75b2fec2028b463364ffaaa6ee1638c.exe lr670608.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5b7c12f94ab354fc282072013762174a75b2fec2028b463364ffaaa6ee1638c.exe"C:\Users\Admin\AppData\Local\Temp\b5b7c12f94ab354fc282072013762174a75b2fec2028b463364ffaaa6ee1638c.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zirY7803.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zirY7803.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr469895.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr469895.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku856635.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku856635.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 13324⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr670608.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr670608.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2796 -ip 27961⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr670608.exeFilesize
175KB
MD5e414ca443b00c65e8e5e200c6ad353f7
SHA1884328edc9856573ecf7ad6f2836ec6675169e52
SHA2561d3e8ab4c8f73d87da39c2b542375986333a2a790bb394d90bd9e7dada641a24
SHA512b240bbd616cb9d62e0f52810ba1699e39c301768304131b5e044151613e674af37bc7e17727e08aa00749d477f046e6adb878515d3e5f7c3539113a5ebcefba7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr670608.exeFilesize
175KB
MD5e414ca443b00c65e8e5e200c6ad353f7
SHA1884328edc9856573ecf7ad6f2836ec6675169e52
SHA2561d3e8ab4c8f73d87da39c2b542375986333a2a790bb394d90bd9e7dada641a24
SHA512b240bbd616cb9d62e0f52810ba1699e39c301768304131b5e044151613e674af37bc7e17727e08aa00749d477f046e6adb878515d3e5f7c3539113a5ebcefba7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zirY7803.exeFilesize
392KB
MD57b80a73cdcfe47c8858cff7439f21439
SHA15118f1f0fe93c1f67aa6f6afbc554a292f2c3c08
SHA256edd0e583661ff6831f5d32ca7a0c3f8ce014536f60a5bc9fb701985ad5e1607f
SHA512eb9bdcd56d727e419db6d800e135583db8d24091ad95c0fd2f35b216c494c7a906012d99a29fd8358d95fc7fedf384530b815685c0c853b533723a57471345df
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zirY7803.exeFilesize
392KB
MD57b80a73cdcfe47c8858cff7439f21439
SHA15118f1f0fe93c1f67aa6f6afbc554a292f2c3c08
SHA256edd0e583661ff6831f5d32ca7a0c3f8ce014536f60a5bc9fb701985ad5e1607f
SHA512eb9bdcd56d727e419db6d800e135583db8d24091ad95c0fd2f35b216c494c7a906012d99a29fd8358d95fc7fedf384530b815685c0c853b533723a57471345df
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr469895.exeFilesize
11KB
MD552e71135035f5a609b22d73a7219c25d
SHA148b934fecdf955427d892fecb908e7cdf8c3353a
SHA256f4c0bf60bd105b1e41b672dd68687b01c170ff83dcd73160744b836a8b721bf3
SHA5124618e2bb1ec8710ec62d5f6bf1b0908180e08c6112989765baa502043e58054d8d98a382014f0d0dde50509f0d0fd736d79499f1ced371ff705f7f5e090121d6
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr469895.exeFilesize
11KB
MD552e71135035f5a609b22d73a7219c25d
SHA148b934fecdf955427d892fecb908e7cdf8c3353a
SHA256f4c0bf60bd105b1e41b672dd68687b01c170ff83dcd73160744b836a8b721bf3
SHA5124618e2bb1ec8710ec62d5f6bf1b0908180e08c6112989765baa502043e58054d8d98a382014f0d0dde50509f0d0fd736d79499f1ced371ff705f7f5e090121d6
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku856635.exeFilesize
318KB
MD5eb691dc37b5548a1a6d96b641112b7cd
SHA1dd86d68b9e13695df5ecbd0c65428e3ea3481a64
SHA2560f95062f8901b99c3d8cd79cf73da14ea3f277ceb2015a4d949648676e67f6cf
SHA5127fe666b7c93a65f2f6877dcf16d2e4539c2c7953586f31d7da98683ec66883b0ab11092cb3ea46bce419952fa95a52e13b6a382a4bf490dbd730c4ce97581728
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku856635.exeFilesize
318KB
MD5eb691dc37b5548a1a6d96b641112b7cd
SHA1dd86d68b9e13695df5ecbd0c65428e3ea3481a64
SHA2560f95062f8901b99c3d8cd79cf73da14ea3f277ceb2015a4d949648676e67f6cf
SHA5127fe666b7c93a65f2f6877dcf16d2e4539c2c7953586f31d7da98683ec66883b0ab11092cb3ea46bce419952fa95a52e13b6a382a4bf490dbd730c4ce97581728
-
memory/800-147-0x0000000000870000-0x000000000087A000-memory.dmpFilesize
40KB
-
memory/2796-153-0x0000000004CB0000-0x0000000005254000-memory.dmpFilesize
5.6MB
-
memory/2796-154-0x0000000000630000-0x000000000067B000-memory.dmpFilesize
300KB
-
memory/2796-155-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/2796-156-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/2796-157-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/2796-158-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/2796-159-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/2796-161-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/2796-163-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/2796-165-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/2796-167-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/2796-169-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/2796-171-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/2796-175-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/2796-173-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/2796-177-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/2796-179-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/2796-181-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/2796-183-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/2796-185-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/2796-187-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/2796-189-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/2796-191-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/2796-193-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/2796-195-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/2796-197-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/2796-199-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/2796-201-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/2796-203-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/2796-205-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/2796-207-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/2796-213-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/2796-211-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/2796-209-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/2796-215-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/2796-217-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/2796-219-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/2796-221-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/2796-1064-0x0000000005260000-0x0000000005878000-memory.dmpFilesize
6.1MB
-
memory/2796-1065-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/2796-1066-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/2796-1067-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/2796-1068-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/2796-1070-0x0000000005CF0000-0x0000000005D56000-memory.dmpFilesize
408KB
-
memory/2796-1071-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/2796-1072-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/2796-1073-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/2796-1074-0x00000000063A0000-0x0000000006432000-memory.dmpFilesize
584KB
-
memory/2796-1075-0x00000000065B0000-0x0000000006772000-memory.dmpFilesize
1.8MB
-
memory/2796-1076-0x0000000006790000-0x0000000006CBC000-memory.dmpFilesize
5.2MB
-
memory/2796-1077-0x0000000006E10000-0x0000000006E86000-memory.dmpFilesize
472KB
-
memory/2796-1078-0x0000000006E90000-0x0000000006EE0000-memory.dmpFilesize
320KB
-
memory/2796-1079-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/3452-1085-0x0000000000F30000-0x0000000000F62000-memory.dmpFilesize
200KB
-
memory/3452-1086-0x0000000005B40000-0x0000000005B50000-memory.dmpFilesize
64KB