Analysis
-
max time kernel
135s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 19:41
Static task
static1
Behavioral task
behavioral1
Sample
3cd5869d5d8efb7b3bbf2dff338dd40c6f40ab9de13af550ed394cc61516dbfc.exe
Resource
win10v2004-20230221-en
General
-
Target
3cd5869d5d8efb7b3bbf2dff338dd40c6f40ab9de13af550ed394cc61516dbfc.exe
-
Size
673KB
-
MD5
53896513c95d6ba04fb284939e6f1b01
-
SHA1
9af36b53b679065df5ea4ef7f73a9078bee5f443
-
SHA256
3cd5869d5d8efb7b3bbf2dff338dd40c6f40ab9de13af550ed394cc61516dbfc
-
SHA512
d0eb03d297fc0468a16a6a91848c31b19b404964e2dad4d045b72c7b324eed2a42dd291e97e9b32a96d6f11a2848b762e2b1bce32a1e6be9b0b0200355b372b5
-
SSDEEP
12288:WMr6y902NvuinVERC2KmvBnRTlCW9RabJ+ofKn45Obyrymzyan32:YyrnVEw2KIRMOSEJn3bFayaG
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro9049.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro9049.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro9049.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro9049.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro9049.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro9049.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro9049.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/1752-191-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/1752-192-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/1752-194-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/1752-196-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/1752-198-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/1752-200-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/1752-202-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/1752-204-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/1752-206-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/1752-208-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/1752-210-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/1752-212-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/1752-214-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/1752-216-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/1752-218-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/1752-220-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/1752-222-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/1752-224-0x0000000002510000-0x000000000254F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un377045.exepro9049.exequ9350.exesi568574.exepid process 4228 un377045.exe 2116 pro9049.exe 1752 qu9350.exe 3808 si568574.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro9049.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro9049.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro9049.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
3cd5869d5d8efb7b3bbf2dff338dd40c6f40ab9de13af550ed394cc61516dbfc.exeun377045.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 3cd5869d5d8efb7b3bbf2dff338dd40c6f40ab9de13af550ed394cc61516dbfc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 3cd5869d5d8efb7b3bbf2dff338dd40c6f40ab9de13af550ed394cc61516dbfc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un377045.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un377045.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4504 2116 WerFault.exe pro9049.exe 3832 1752 WerFault.exe qu9350.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro9049.exequ9350.exesi568574.exepid process 2116 pro9049.exe 2116 pro9049.exe 1752 qu9350.exe 1752 qu9350.exe 3808 si568574.exe 3808 si568574.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro9049.exequ9350.exesi568574.exedescription pid process Token: SeDebugPrivilege 2116 pro9049.exe Token: SeDebugPrivilege 1752 qu9350.exe Token: SeDebugPrivilege 3808 si568574.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
3cd5869d5d8efb7b3bbf2dff338dd40c6f40ab9de13af550ed394cc61516dbfc.exeun377045.exedescription pid process target process PID 2264 wrote to memory of 4228 2264 3cd5869d5d8efb7b3bbf2dff338dd40c6f40ab9de13af550ed394cc61516dbfc.exe un377045.exe PID 2264 wrote to memory of 4228 2264 3cd5869d5d8efb7b3bbf2dff338dd40c6f40ab9de13af550ed394cc61516dbfc.exe un377045.exe PID 2264 wrote to memory of 4228 2264 3cd5869d5d8efb7b3bbf2dff338dd40c6f40ab9de13af550ed394cc61516dbfc.exe un377045.exe PID 4228 wrote to memory of 2116 4228 un377045.exe pro9049.exe PID 4228 wrote to memory of 2116 4228 un377045.exe pro9049.exe PID 4228 wrote to memory of 2116 4228 un377045.exe pro9049.exe PID 4228 wrote to memory of 1752 4228 un377045.exe qu9350.exe PID 4228 wrote to memory of 1752 4228 un377045.exe qu9350.exe PID 4228 wrote to memory of 1752 4228 un377045.exe qu9350.exe PID 2264 wrote to memory of 3808 2264 3cd5869d5d8efb7b3bbf2dff338dd40c6f40ab9de13af550ed394cc61516dbfc.exe si568574.exe PID 2264 wrote to memory of 3808 2264 3cd5869d5d8efb7b3bbf2dff338dd40c6f40ab9de13af550ed394cc61516dbfc.exe si568574.exe PID 2264 wrote to memory of 3808 2264 3cd5869d5d8efb7b3bbf2dff338dd40c6f40ab9de13af550ed394cc61516dbfc.exe si568574.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3cd5869d5d8efb7b3bbf2dff338dd40c6f40ab9de13af550ed394cc61516dbfc.exe"C:\Users\Admin\AppData\Local\Temp\3cd5869d5d8efb7b3bbf2dff338dd40c6f40ab9de13af550ed394cc61516dbfc.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un377045.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un377045.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9049.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9049.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 10844⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9350.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9350.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 13484⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si568574.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si568574.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2116 -ip 21161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1752 -ip 17521⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si568574.exeFilesize
175KB
MD5ac20caf20d2a61df557c9498b1f2cf72
SHA163041c91a51a0b992fec0b259370ba03c461b395
SHA25648b86dd3dc5432765dd95499a1cb39a587b273408eafee448127c05886d781ed
SHA512c1472e1ca08065e972b6e886385ba0e3e18ead092fac4a3f3b00636c655c899f2ea6f543f1d88f60db16c0b563c295af95e580ce404c8669ea7fd3322e7f884d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si568574.exeFilesize
175KB
MD5ac20caf20d2a61df557c9498b1f2cf72
SHA163041c91a51a0b992fec0b259370ba03c461b395
SHA25648b86dd3dc5432765dd95499a1cb39a587b273408eafee448127c05886d781ed
SHA512c1472e1ca08065e972b6e886385ba0e3e18ead092fac4a3f3b00636c655c899f2ea6f543f1d88f60db16c0b563c295af95e580ce404c8669ea7fd3322e7f884d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un377045.exeFilesize
530KB
MD5488d38f2f0b01979c8c620773a2a8d90
SHA104e5cf31621176dfb67ca0e1edc99484cc6065a8
SHA2560e097c44d483ffadab505eff96b18d5f77bbae2d3c0efc259a3465e0677a0e01
SHA5125c389702563b7f6fc2997f81cc2c374594d1ebdef206c9c0838b485d1bab0a5434f2f9216baaa0a68665a52c05bca520d1694bdadc0da0e9dd6a44e0cb130d51
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un377045.exeFilesize
530KB
MD5488d38f2f0b01979c8c620773a2a8d90
SHA104e5cf31621176dfb67ca0e1edc99484cc6065a8
SHA2560e097c44d483ffadab505eff96b18d5f77bbae2d3c0efc259a3465e0677a0e01
SHA5125c389702563b7f6fc2997f81cc2c374594d1ebdef206c9c0838b485d1bab0a5434f2f9216baaa0a68665a52c05bca520d1694bdadc0da0e9dd6a44e0cb130d51
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9049.exeFilesize
260KB
MD50b9d4d640c6b912d502cde73f7659755
SHA14428419ce6dac8d191c1cfdee7a70a8edfec9061
SHA25655633353aa829437081e22e2646ff176aef1667c9da35ec3343312b3ef3648a6
SHA512fd81fb977afb55ed77e65d04ec7178547a093b55351f8c6b9ee80d4cced58235f3aa025acb64e2434ec0b7df126fda3eb2de3e6d91f77b3f86c57a6190563522
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9049.exeFilesize
260KB
MD50b9d4d640c6b912d502cde73f7659755
SHA14428419ce6dac8d191c1cfdee7a70a8edfec9061
SHA25655633353aa829437081e22e2646ff176aef1667c9da35ec3343312b3ef3648a6
SHA512fd81fb977afb55ed77e65d04ec7178547a093b55351f8c6b9ee80d4cced58235f3aa025acb64e2434ec0b7df126fda3eb2de3e6d91f77b3f86c57a6190563522
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9350.exeFilesize
318KB
MD5beccdeac4e95024648f487c752bb6ee2
SHA1d412952aa7acaa734fccfafd22d1208ee929d427
SHA256a19be137529609f45abebffb8f7415a20aec03d8726f1fbe765a7a161bb03af8
SHA512de7417868f8faa5586756a5ad5cbb1942f35d4c6dfe3d7987c6a5f44732af6f647779f608e6348cbce24eb4b93feb469e997ca75ebd6239131a9c09eb25843ff
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9350.exeFilesize
318KB
MD5beccdeac4e95024648f487c752bb6ee2
SHA1d412952aa7acaa734fccfafd22d1208ee929d427
SHA256a19be137529609f45abebffb8f7415a20aec03d8726f1fbe765a7a161bb03af8
SHA512de7417868f8faa5586756a5ad5cbb1942f35d4c6dfe3d7987c6a5f44732af6f647779f608e6348cbce24eb4b93feb469e997ca75ebd6239131a9c09eb25843ff
-
memory/1752-1102-0x00000000058D0000-0x00000000059DA000-memory.dmpFilesize
1.0MB
-
memory/1752-257-0x0000000004CF0000-0x0000000004D00000-memory.dmpFilesize
64KB
-
memory/1752-204-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/1752-206-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/1752-1115-0x0000000006F30000-0x0000000006FA6000-memory.dmpFilesize
472KB
-
memory/1752-1114-0x0000000004CF0000-0x0000000004D00000-memory.dmpFilesize
64KB
-
memory/1752-1113-0x00000000067D0000-0x0000000006CFC000-memory.dmpFilesize
5.2MB
-
memory/1752-1112-0x0000000006600000-0x00000000067C2000-memory.dmpFilesize
1.8MB
-
memory/1752-1111-0x0000000004CF0000-0x0000000004D00000-memory.dmpFilesize
64KB
-
memory/1752-1110-0x0000000004CF0000-0x0000000004D00000-memory.dmpFilesize
64KB
-
memory/1752-208-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/1752-1109-0x0000000004CF0000-0x0000000004D00000-memory.dmpFilesize
64KB
-
memory/1752-1108-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/1752-1107-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/1752-1105-0x0000000004CF0000-0x0000000004D00000-memory.dmpFilesize
64KB
-
memory/1752-1104-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/1752-1103-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/1752-1101-0x00000000052B0000-0x00000000058C8000-memory.dmpFilesize
6.1MB
-
memory/1752-259-0x0000000004CF0000-0x0000000004D00000-memory.dmpFilesize
64KB
-
memory/1752-218-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/1752-256-0x0000000004CF0000-0x0000000004D00000-memory.dmpFilesize
64KB
-
memory/1752-254-0x0000000000570000-0x00000000005BB000-memory.dmpFilesize
300KB
-
memory/1752-224-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/1752-191-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/1752-192-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/1752-194-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/1752-196-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/1752-198-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/1752-200-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/1752-202-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/1752-222-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/1752-1116-0x0000000006FC0000-0x0000000007010000-memory.dmpFilesize
320KB
-
memory/1752-220-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/1752-210-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/1752-212-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/1752-214-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/1752-216-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/2116-181-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/2116-170-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/2116-148-0x0000000000630000-0x000000000065D000-memory.dmpFilesize
180KB
-
memory/2116-151-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/2116-152-0x0000000004CB0000-0x0000000005254000-memory.dmpFilesize
5.6MB
-
memory/2116-186-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/2116-184-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/2116-183-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/2116-182-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/2116-150-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/2116-153-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/2116-180-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/2116-178-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/2116-176-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/2116-174-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/2116-172-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/2116-166-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/2116-168-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/2116-164-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/2116-162-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/2116-160-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/2116-158-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/2116-156-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/2116-149-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/2116-154-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/3808-1122-0x0000000000790000-0x00000000007C2000-memory.dmpFilesize
200KB
-
memory/3808-1123-0x00000000050C0000-0x00000000050D0000-memory.dmpFilesize
64KB