Analysis
-
max time kernel
50s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
31-03-2023 19:44
Static task
static1
Behavioral task
behavioral1
Sample
fefa8145b6d261e5beeefbfda311e301008ff83591b949ab05916d1b24dd9109.exe
Resource
win10-20230220-en
General
-
Target
fefa8145b6d261e5beeefbfda311e301008ff83591b949ab05916d1b24dd9109.exe
-
Size
533KB
-
MD5
5f329d929ccf1b7dccebe1a300fd5c27
-
SHA1
3c6d5040acc8307a5981f9c3bebbace6fbf2aa7c
-
SHA256
fefa8145b6d261e5beeefbfda311e301008ff83591b949ab05916d1b24dd9109
-
SHA512
7547f5498a4f3b87cf0e074dca09674f2caf59d5c6eee0e57aac17d0d21b7780562361ce5b9643f122656c6a6b85cd815190aae19c6aa93360a7d18c0e8611fd
-
SSDEEP
12288:IMr9y904ja//GQdZNUZLveGeWVgObqr+2HJ3ikoI:1yM/GmM9biJ3ikoI
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr440692.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr440692.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr440692.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr440692.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr440692.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr440692.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 37 IoCs
Processes:
resource yara_rule behavioral1/memory/2848-141-0x00000000021A0000-0x00000000021E6000-memory.dmp family_redline behavioral1/memory/2848-143-0x0000000002560000-0x00000000025A4000-memory.dmp family_redline behavioral1/memory/2848-144-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/2848-145-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/2848-147-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/2848-149-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/2848-152-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/2848-156-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/2848-157-0x0000000004C70000-0x0000000004C80000-memory.dmp family_redline behavioral1/memory/2848-159-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/2848-161-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/2848-163-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/2848-165-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/2848-167-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/2848-171-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/2848-169-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/2848-173-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/2848-175-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/2848-177-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/2848-179-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/2848-181-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/2848-183-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/2848-185-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/2848-187-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/2848-189-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/2848-191-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/2848-193-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/2848-195-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/2848-197-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/2848-199-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/2848-201-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/2848-203-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/2848-205-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/2848-209-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/2848-207-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/2848-211-0x0000000002560000-0x000000000259F000-memory.dmp family_redline behavioral1/memory/2848-1062-0x0000000004C70000-0x0000000004C80000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
zihm7256.exejr440692.exeku302647.exelr166942.exepid process 2276 zihm7256.exe 2392 jr440692.exe 2848 ku302647.exe 1512 lr166942.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr440692.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr440692.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
fefa8145b6d261e5beeefbfda311e301008ff83591b949ab05916d1b24dd9109.exezihm7256.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce fefa8145b6d261e5beeefbfda311e301008ff83591b949ab05916d1b24dd9109.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" fefa8145b6d261e5beeefbfda311e301008ff83591b949ab05916d1b24dd9109.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zihm7256.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zihm7256.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr440692.exeku302647.exelr166942.exepid process 2392 jr440692.exe 2392 jr440692.exe 2848 ku302647.exe 2848 ku302647.exe 1512 lr166942.exe 1512 lr166942.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr440692.exeku302647.exelr166942.exedescription pid process Token: SeDebugPrivilege 2392 jr440692.exe Token: SeDebugPrivilege 2848 ku302647.exe Token: SeDebugPrivilege 1512 lr166942.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
fefa8145b6d261e5beeefbfda311e301008ff83591b949ab05916d1b24dd9109.exezihm7256.exedescription pid process target process PID 2036 wrote to memory of 2276 2036 fefa8145b6d261e5beeefbfda311e301008ff83591b949ab05916d1b24dd9109.exe zihm7256.exe PID 2036 wrote to memory of 2276 2036 fefa8145b6d261e5beeefbfda311e301008ff83591b949ab05916d1b24dd9109.exe zihm7256.exe PID 2036 wrote to memory of 2276 2036 fefa8145b6d261e5beeefbfda311e301008ff83591b949ab05916d1b24dd9109.exe zihm7256.exe PID 2276 wrote to memory of 2392 2276 zihm7256.exe jr440692.exe PID 2276 wrote to memory of 2392 2276 zihm7256.exe jr440692.exe PID 2276 wrote to memory of 2848 2276 zihm7256.exe ku302647.exe PID 2276 wrote to memory of 2848 2276 zihm7256.exe ku302647.exe PID 2276 wrote to memory of 2848 2276 zihm7256.exe ku302647.exe PID 2036 wrote to memory of 1512 2036 fefa8145b6d261e5beeefbfda311e301008ff83591b949ab05916d1b24dd9109.exe lr166942.exe PID 2036 wrote to memory of 1512 2036 fefa8145b6d261e5beeefbfda311e301008ff83591b949ab05916d1b24dd9109.exe lr166942.exe PID 2036 wrote to memory of 1512 2036 fefa8145b6d261e5beeefbfda311e301008ff83591b949ab05916d1b24dd9109.exe lr166942.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fefa8145b6d261e5beeefbfda311e301008ff83591b949ab05916d1b24dd9109.exe"C:\Users\Admin\AppData\Local\Temp\fefa8145b6d261e5beeefbfda311e301008ff83591b949ab05916d1b24dd9109.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zihm7256.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zihm7256.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr440692.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr440692.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku302647.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku302647.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr166942.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr166942.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr166942.exeFilesize
175KB
MD58a26c9a847b78a00df32a639a9c45699
SHA1a924b91157bb820c987aa1073689ad8b3b3db3d5
SHA25650619a7fa79dbbd64152ee7a58a43fa3934746b1d62636f3930ee98446ae97fe
SHA51215e3709b4028e5b6b49496b9d4ac86eaeb3c6fe962e0711c789f6c1192d7414a6e107ee90e71b5e92a76bb933de33ff2c1df714bc7cf7be178e5316892ae5ad4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr166942.exeFilesize
175KB
MD58a26c9a847b78a00df32a639a9c45699
SHA1a924b91157bb820c987aa1073689ad8b3b3db3d5
SHA25650619a7fa79dbbd64152ee7a58a43fa3934746b1d62636f3930ee98446ae97fe
SHA51215e3709b4028e5b6b49496b9d4ac86eaeb3c6fe962e0711c789f6c1192d7414a6e107ee90e71b5e92a76bb933de33ff2c1df714bc7cf7be178e5316892ae5ad4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zihm7256.exeFilesize
392KB
MD501e1aa15dcf15c60480f9f52afb6ebb7
SHA1fe6d0306187e613075a6abef00589fc72906f11f
SHA2561419be5f34856278fec8b19df3751d441f74f98b49cc40cc88e4d4aed13d552a
SHA512f9eb4ef5b821638190d16b9d58d5c980c796ed0f09f86a6d9c5a99d8397376969cbfdee0bc430eb5aa20eed5f34749244c5dd4bb68f19f3ff076135d9efd4d30
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zihm7256.exeFilesize
392KB
MD501e1aa15dcf15c60480f9f52afb6ebb7
SHA1fe6d0306187e613075a6abef00589fc72906f11f
SHA2561419be5f34856278fec8b19df3751d441f74f98b49cc40cc88e4d4aed13d552a
SHA512f9eb4ef5b821638190d16b9d58d5c980c796ed0f09f86a6d9c5a99d8397376969cbfdee0bc430eb5aa20eed5f34749244c5dd4bb68f19f3ff076135d9efd4d30
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr440692.exeFilesize
11KB
MD5e27fc2174dbba731cbd66b4e268b9af5
SHA1fa0a5c0e9ba4b9845fc81c7b4d077996ec17bbd8
SHA256a0dc443ce5fd5bbd5bddbca58344da09f98469ecb1406e17bdbfb4a913b97625
SHA512b912be118e7b72dd9d680b24409340b676ebfa30497f97f88eec50c3ac7ef24da12fce20e42f0cee1be4d7b8f9ea7ce713af3664b4094e326adb5744696d89d3
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr440692.exeFilesize
11KB
MD5e27fc2174dbba731cbd66b4e268b9af5
SHA1fa0a5c0e9ba4b9845fc81c7b4d077996ec17bbd8
SHA256a0dc443ce5fd5bbd5bddbca58344da09f98469ecb1406e17bdbfb4a913b97625
SHA512b912be118e7b72dd9d680b24409340b676ebfa30497f97f88eec50c3ac7ef24da12fce20e42f0cee1be4d7b8f9ea7ce713af3664b4094e326adb5744696d89d3
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku302647.exeFilesize
318KB
MD5434d39fe04ef52067f4f4203338199ed
SHA12d2ed904dd20a2615fa0913441a3eff1d7c758a1
SHA256dccbe5d209e7f54ba20ed60fef94f2f4a50cac2ccb5ba80c040ec06ab275345d
SHA51284940a72fc11de3f7d8ff9f543dc9e4181baf25accb2ae065b3cc11374ccc0c6134fbc5cfc6437c01b13d1ea0f4422e3fed8a171524e15d8d6f049be7321b386
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku302647.exeFilesize
318KB
MD5434d39fe04ef52067f4f4203338199ed
SHA12d2ed904dd20a2615fa0913441a3eff1d7c758a1
SHA256dccbe5d209e7f54ba20ed60fef94f2f4a50cac2ccb5ba80c040ec06ab275345d
SHA51284940a72fc11de3f7d8ff9f543dc9e4181baf25accb2ae065b3cc11374ccc0c6134fbc5cfc6437c01b13d1ea0f4422e3fed8a171524e15d8d6f049be7321b386
-
memory/1512-1076-0x0000000000D30000-0x0000000000D62000-memory.dmpFilesize
200KB
-
memory/1512-1077-0x0000000005770000-0x00000000057BB000-memory.dmpFilesize
300KB
-
memory/1512-1078-0x0000000005590000-0x00000000055A0000-memory.dmpFilesize
64KB
-
memory/2392-135-0x0000000000250000-0x000000000025A000-memory.dmpFilesize
40KB
-
memory/2848-179-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/2848-189-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/2848-144-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/2848-145-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/2848-147-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/2848-149-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/2848-150-0x00000000004C0000-0x000000000050B000-memory.dmpFilesize
300KB
-
memory/2848-153-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/2848-152-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/2848-156-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/2848-157-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/2848-155-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/2848-159-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/2848-161-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/2848-163-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/2848-165-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/2848-167-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/2848-171-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/2848-169-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/2848-173-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/2848-175-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/2848-177-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/2848-142-0x0000000004C80000-0x000000000517E000-memory.dmpFilesize
5.0MB
-
memory/2848-181-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/2848-183-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/2848-185-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/2848-187-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/2848-143-0x0000000002560000-0x00000000025A4000-memory.dmpFilesize
272KB
-
memory/2848-191-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/2848-193-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/2848-195-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/2848-197-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/2848-199-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/2848-201-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/2848-203-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/2848-205-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/2848-209-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/2848-207-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/2848-211-0x0000000002560000-0x000000000259F000-memory.dmpFilesize
252KB
-
memory/2848-1054-0x0000000005790000-0x0000000005D96000-memory.dmpFilesize
6.0MB
-
memory/2848-1055-0x0000000004B40000-0x0000000004C4A000-memory.dmpFilesize
1.0MB
-
memory/2848-1056-0x0000000005190000-0x00000000051A2000-memory.dmpFilesize
72KB
-
memory/2848-1057-0x00000000051B0000-0x00000000051EE000-memory.dmpFilesize
248KB
-
memory/2848-1058-0x0000000005300000-0x000000000534B000-memory.dmpFilesize
300KB
-
memory/2848-1059-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/2848-1061-0x0000000005490000-0x00000000054F6000-memory.dmpFilesize
408KB
-
memory/2848-1062-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/2848-1063-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/2848-1064-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/2848-1065-0x0000000006160000-0x00000000061F2000-memory.dmpFilesize
584KB
-
memory/2848-1066-0x0000000006360000-0x0000000006522000-memory.dmpFilesize
1.8MB
-
memory/2848-141-0x00000000021A0000-0x00000000021E6000-memory.dmpFilesize
280KB
-
memory/2848-1067-0x0000000006530000-0x0000000006A5C000-memory.dmpFilesize
5.2MB
-
memory/2848-1068-0x0000000006B90000-0x0000000006C06000-memory.dmpFilesize
472KB
-
memory/2848-1069-0x0000000006C10000-0x0000000006C60000-memory.dmpFilesize
320KB
-
memory/2848-1070-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB