Analysis
-
max time kernel
73s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 19:53
Static task
static1
Behavioral task
behavioral1
Sample
26f8cc19fc0538e955bc0b98fd25a11057f9a20d1ff0de70671956e33e3e38e8.exe
Resource
win10v2004-20230220-en
General
-
Target
26f8cc19fc0538e955bc0b98fd25a11057f9a20d1ff0de70671956e33e3e38e8.exe
-
Size
534KB
-
MD5
e8e615c75b59cbf9942b822e3b17c0f7
-
SHA1
9f86a2b7f39516a78fddb1cb746d77ee7e33953f
-
SHA256
26f8cc19fc0538e955bc0b98fd25a11057f9a20d1ff0de70671956e33e3e38e8
-
SHA512
38cae5805851906836639d0769aff5c80278b5dad87113a054b53afaa8114efb1e91b57238b2d18b3f1cde5a9834e5ab1b37b7d25e4b2f793f2825bfc0caf6bb
-
SSDEEP
12288:UMr+y90N1PAggPtyOovumhRBszuvObzrmcHa8UJq:yy8CXovuk8tb+YUM
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr878462.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr878462.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr878462.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr878462.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr878462.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr878462.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr878462.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/1068-156-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1068-158-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1068-161-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1068-163-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1068-165-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1068-167-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1068-169-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1068-171-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1068-173-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1068-175-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1068-177-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1068-179-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1068-181-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1068-183-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1068-185-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1068-187-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1068-189-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1068-191-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1068-193-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1068-195-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1068-197-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1068-199-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1068-201-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1068-203-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1068-205-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1068-207-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1068-209-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1068-211-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1068-213-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1068-215-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1068-217-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1068-219-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1068-221-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
ziNd9394.exejr878462.exeku948264.exelr711424.exepid process 2568 ziNd9394.exe 4492 jr878462.exe 1068 ku948264.exe 4628 lr711424.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr878462.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr878462.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
ziNd9394.exe26f8cc19fc0538e955bc0b98fd25a11057f9a20d1ff0de70671956e33e3e38e8.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziNd9394.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziNd9394.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 26f8cc19fc0538e955bc0b98fd25a11057f9a20d1ff0de70671956e33e3e38e8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 26f8cc19fc0538e955bc0b98fd25a11057f9a20d1ff0de70671956e33e3e38e8.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1828 1068 WerFault.exe ku948264.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr878462.exeku948264.exelr711424.exepid process 4492 jr878462.exe 4492 jr878462.exe 1068 ku948264.exe 1068 ku948264.exe 4628 lr711424.exe 4628 lr711424.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr878462.exeku948264.exelr711424.exedescription pid process Token: SeDebugPrivilege 4492 jr878462.exe Token: SeDebugPrivilege 1068 ku948264.exe Token: SeDebugPrivilege 4628 lr711424.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
26f8cc19fc0538e955bc0b98fd25a11057f9a20d1ff0de70671956e33e3e38e8.exeziNd9394.exedescription pid process target process PID 4412 wrote to memory of 2568 4412 26f8cc19fc0538e955bc0b98fd25a11057f9a20d1ff0de70671956e33e3e38e8.exe ziNd9394.exe PID 4412 wrote to memory of 2568 4412 26f8cc19fc0538e955bc0b98fd25a11057f9a20d1ff0de70671956e33e3e38e8.exe ziNd9394.exe PID 4412 wrote to memory of 2568 4412 26f8cc19fc0538e955bc0b98fd25a11057f9a20d1ff0de70671956e33e3e38e8.exe ziNd9394.exe PID 2568 wrote to memory of 4492 2568 ziNd9394.exe jr878462.exe PID 2568 wrote to memory of 4492 2568 ziNd9394.exe jr878462.exe PID 2568 wrote to memory of 1068 2568 ziNd9394.exe ku948264.exe PID 2568 wrote to memory of 1068 2568 ziNd9394.exe ku948264.exe PID 2568 wrote to memory of 1068 2568 ziNd9394.exe ku948264.exe PID 4412 wrote to memory of 4628 4412 26f8cc19fc0538e955bc0b98fd25a11057f9a20d1ff0de70671956e33e3e38e8.exe lr711424.exe PID 4412 wrote to memory of 4628 4412 26f8cc19fc0538e955bc0b98fd25a11057f9a20d1ff0de70671956e33e3e38e8.exe lr711424.exe PID 4412 wrote to memory of 4628 4412 26f8cc19fc0538e955bc0b98fd25a11057f9a20d1ff0de70671956e33e3e38e8.exe lr711424.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\26f8cc19fc0538e955bc0b98fd25a11057f9a20d1ff0de70671956e33e3e38e8.exe"C:\Users\Admin\AppData\Local\Temp\26f8cc19fc0538e955bc0b98fd25a11057f9a20d1ff0de70671956e33e3e38e8.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziNd9394.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziNd9394.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr878462.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr878462.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku948264.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku948264.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1068 -s 19404⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr711424.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr711424.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1068 -ip 10681⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr711424.exeFilesize
175KB
MD54076571517feb59b81b10a1189f2453c
SHA1bc4c783209f3dd7d8939fdd53c12770bd3cf8d2b
SHA2565e602d26d26a3aeb616222f120024095f21fa1286189ec375ce7f0ccd1f86272
SHA512e6c9407ba3a8a84893a60ef3dd13aae942cd1a97c46b277ac752c3e7afca16eb993e90551e2788208b315df57148a31e59bdd6d702c850d99f1042d682c6e4e4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr711424.exeFilesize
175KB
MD54076571517feb59b81b10a1189f2453c
SHA1bc4c783209f3dd7d8939fdd53c12770bd3cf8d2b
SHA2565e602d26d26a3aeb616222f120024095f21fa1286189ec375ce7f0ccd1f86272
SHA512e6c9407ba3a8a84893a60ef3dd13aae942cd1a97c46b277ac752c3e7afca16eb993e90551e2788208b315df57148a31e59bdd6d702c850d99f1042d682c6e4e4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziNd9394.exeFilesize
392KB
MD5bfa58db0ba9f50caf77b7283c6a75a95
SHA18921b6ac748d049c45fa17b6521dcd9c69fd77ee
SHA2565a382e159736c63c635dd6ea9ce6e2b516381e924d6b0628055a3ef6147ca7cf
SHA5120fa2ab424b400fae7eb4c50d0cad83fd53b152cd7a363cf86ab7f0e4a6fed1857f0671596353d53dcb383a11fdcebfd2316c20e8b44a8a201165fc1522c05878
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziNd9394.exeFilesize
392KB
MD5bfa58db0ba9f50caf77b7283c6a75a95
SHA18921b6ac748d049c45fa17b6521dcd9c69fd77ee
SHA2565a382e159736c63c635dd6ea9ce6e2b516381e924d6b0628055a3ef6147ca7cf
SHA5120fa2ab424b400fae7eb4c50d0cad83fd53b152cd7a363cf86ab7f0e4a6fed1857f0671596353d53dcb383a11fdcebfd2316c20e8b44a8a201165fc1522c05878
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr878462.exeFilesize
11KB
MD5af56016ecac8bf2c0f0f3aa9822911fb
SHA1f510035c7c776a50dd3a17abf441be1de126282f
SHA2564dd702cd774e79d6f55eabb5922498584a29f4a60b7f8b967b48b3cac0c48b41
SHA5121af5b6117a9d2d61cf9e3544c88d04c70ee65fec627b741374be5f9c9c3f7687a2bc221e61cf597f8c0e971e345a22c92874f714a5ae852ecde42b1b394cd591
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr878462.exeFilesize
11KB
MD5af56016ecac8bf2c0f0f3aa9822911fb
SHA1f510035c7c776a50dd3a17abf441be1de126282f
SHA2564dd702cd774e79d6f55eabb5922498584a29f4a60b7f8b967b48b3cac0c48b41
SHA5121af5b6117a9d2d61cf9e3544c88d04c70ee65fec627b741374be5f9c9c3f7687a2bc221e61cf597f8c0e971e345a22c92874f714a5ae852ecde42b1b394cd591
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku948264.exeFilesize
318KB
MD5371bd93bc850002b2cd1dd0bf85b64fb
SHA1cfc13ecc14f405235c714c26ee6773cc0a17cfd9
SHA256dcedce69da1e18b86ab382614c433ffb5384f4c3aacb8453525669730fb1f45f
SHA51213924b8f3684064291861938afc97497fcc1c6413549713ea3993d8b950d57eaab29fa894ed18488ef8e98e7144c06f40a00cbb61cbc27fa61d806bf1f0325d5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku948264.exeFilesize
318KB
MD5371bd93bc850002b2cd1dd0bf85b64fb
SHA1cfc13ecc14f405235c714c26ee6773cc0a17cfd9
SHA256dcedce69da1e18b86ab382614c433ffb5384f4c3aacb8453525669730fb1f45f
SHA51213924b8f3684064291861938afc97497fcc1c6413549713ea3993d8b950d57eaab29fa894ed18488ef8e98e7144c06f40a00cbb61cbc27fa61d806bf1f0325d5
-
memory/1068-153-0x0000000004B00000-0x00000000050A4000-memory.dmpFilesize
5.6MB
-
memory/1068-154-0x00000000020C0000-0x000000000210B000-memory.dmpFilesize
300KB
-
memory/1068-155-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/1068-156-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1068-159-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/1068-158-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1068-157-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/1068-161-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1068-163-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1068-165-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1068-167-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1068-169-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1068-171-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1068-173-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1068-175-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1068-177-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1068-179-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1068-181-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1068-183-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1068-185-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1068-187-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1068-189-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1068-191-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1068-193-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1068-195-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1068-197-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1068-199-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1068-201-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1068-203-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1068-205-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1068-207-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1068-209-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1068-211-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1068-213-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1068-215-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1068-217-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1068-219-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1068-221-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1068-1064-0x0000000005200000-0x0000000005818000-memory.dmpFilesize
6.1MB
-
memory/1068-1065-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/1068-1066-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/1068-1067-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/1068-1068-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/1068-1070-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/1068-1071-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/1068-1072-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/1068-1073-0x0000000005CF0000-0x0000000005D56000-memory.dmpFilesize
408KB
-
memory/1068-1074-0x00000000063A0000-0x0000000006432000-memory.dmpFilesize
584KB
-
memory/1068-1075-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/1068-1077-0x0000000007860000-0x00000000078D6000-memory.dmpFilesize
472KB
-
memory/1068-1078-0x0000000007900000-0x0000000007950000-memory.dmpFilesize
320KB
-
memory/1068-1079-0x0000000007980000-0x0000000007B42000-memory.dmpFilesize
1.8MB
-
memory/1068-1080-0x0000000007B50000-0x000000000807C000-memory.dmpFilesize
5.2MB
-
memory/4492-147-0x0000000000F30000-0x0000000000F3A000-memory.dmpFilesize
40KB
-
memory/4628-1086-0x0000000000E80000-0x0000000000EB2000-memory.dmpFilesize
200KB
-
memory/4628-1087-0x0000000005770000-0x0000000005780000-memory.dmpFilesize
64KB
-
memory/4628-1088-0x0000000005770000-0x0000000005780000-memory.dmpFilesize
64KB