Analysis
-
max time kernel
90s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 19:56
Static task
static1
Behavioral task
behavioral1
Sample
f34e8cd693d5daac61641a2b790488060763d47322d93438f127c24db76eb38f.exe
Resource
win10v2004-20230220-en
General
-
Target
f34e8cd693d5daac61641a2b790488060763d47322d93438f127c24db76eb38f.exe
-
Size
672KB
-
MD5
ddda4ebc4ae206d30eaa483c6b54f01d
-
SHA1
8000652132fad1873acdaa6925c2614323c9dd1b
-
SHA256
f34e8cd693d5daac61641a2b790488060763d47322d93438f127c24db76eb38f
-
SHA512
a93f0357f2908d673378d13a6c057c4ef121b607fe1640920d7a99b6549ac51dc390d1bd4cc625cd343aa6d036f2d1a62647f494de9c65a73fde069dc47f1934
-
SSDEEP
12288:GMriy90MUAf1aA+oDf0et6lbglJ39RsbJ+oQsirEeReve233ObBr4mdty:gyl5Dtt6lqNkEpsirEpGb+gY
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro1628.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro1628.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro1628.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro1628.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro1628.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro1628.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro1628.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/4784-192-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4784-191-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4784-194-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4784-196-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4784-198-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4784-200-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4784-204-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4784-206-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4784-202-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4784-208-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4784-210-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4784-212-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4784-216-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4784-214-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4784-218-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4784-220-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4784-222-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4784-224-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/4784-543-0x0000000004A70000-0x0000000004A80000-memory.dmp family_redline behavioral1/memory/4784-547-0x0000000004A70000-0x0000000004A80000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un177032.exepro1628.exequ9639.exesi003090.exepid process 820 un177032.exe 764 pro1628.exe 4784 qu9639.exe 4300 si003090.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro1628.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro1628.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro1628.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
f34e8cd693d5daac61641a2b790488060763d47322d93438f127c24db76eb38f.exeun177032.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce f34e8cd693d5daac61641a2b790488060763d47322d93438f127c24db76eb38f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" f34e8cd693d5daac61641a2b790488060763d47322d93438f127c24db76eb38f.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un177032.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un177032.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 520 764 WerFault.exe pro1628.exe 676 4784 WerFault.exe qu9639.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro1628.exequ9639.exesi003090.exepid process 764 pro1628.exe 764 pro1628.exe 4784 qu9639.exe 4784 qu9639.exe 4300 si003090.exe 4300 si003090.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro1628.exequ9639.exesi003090.exedescription pid process Token: SeDebugPrivilege 764 pro1628.exe Token: SeDebugPrivilege 4784 qu9639.exe Token: SeDebugPrivilege 4300 si003090.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
f34e8cd693d5daac61641a2b790488060763d47322d93438f127c24db76eb38f.exeun177032.exedescription pid process target process PID 4296 wrote to memory of 820 4296 f34e8cd693d5daac61641a2b790488060763d47322d93438f127c24db76eb38f.exe un177032.exe PID 4296 wrote to memory of 820 4296 f34e8cd693d5daac61641a2b790488060763d47322d93438f127c24db76eb38f.exe un177032.exe PID 4296 wrote to memory of 820 4296 f34e8cd693d5daac61641a2b790488060763d47322d93438f127c24db76eb38f.exe un177032.exe PID 820 wrote to memory of 764 820 un177032.exe pro1628.exe PID 820 wrote to memory of 764 820 un177032.exe pro1628.exe PID 820 wrote to memory of 764 820 un177032.exe pro1628.exe PID 820 wrote to memory of 4784 820 un177032.exe qu9639.exe PID 820 wrote to memory of 4784 820 un177032.exe qu9639.exe PID 820 wrote to memory of 4784 820 un177032.exe qu9639.exe PID 4296 wrote to memory of 4300 4296 f34e8cd693d5daac61641a2b790488060763d47322d93438f127c24db76eb38f.exe si003090.exe PID 4296 wrote to memory of 4300 4296 f34e8cd693d5daac61641a2b790488060763d47322d93438f127c24db76eb38f.exe si003090.exe PID 4296 wrote to memory of 4300 4296 f34e8cd693d5daac61641a2b790488060763d47322d93438f127c24db76eb38f.exe si003090.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f34e8cd693d5daac61641a2b790488060763d47322d93438f127c24db76eb38f.exe"C:\Users\Admin\AppData\Local\Temp\f34e8cd693d5daac61641a2b790488060763d47322d93438f127c24db76eb38f.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un177032.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un177032.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1628.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1628.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 10804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9639.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9639.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 11964⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si003090.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si003090.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 764 -ip 7641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4784 -ip 47841⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si003090.exeFilesize
175KB
MD52f11e5e815d81fb959a65142fc8c1264
SHA1109cba37c1baec4dc8d9a653c6adfd8270be003f
SHA256644563f423d6e69d3f9fad29e4c796974b1085b73080a16c83cb744923f10e0b
SHA512a5f74006c3bc078902d6e5e62f71756a1e107d28e3ea33b4324e2caf47d7e9042375de5e1dfa067b081718c3608547e5401126b55be85372f85f7123aec5589e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si003090.exeFilesize
175KB
MD52f11e5e815d81fb959a65142fc8c1264
SHA1109cba37c1baec4dc8d9a653c6adfd8270be003f
SHA256644563f423d6e69d3f9fad29e4c796974b1085b73080a16c83cb744923f10e0b
SHA512a5f74006c3bc078902d6e5e62f71756a1e107d28e3ea33b4324e2caf47d7e9042375de5e1dfa067b081718c3608547e5401126b55be85372f85f7123aec5589e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un177032.exeFilesize
530KB
MD57f026dbc10ec4730e048e3d158caf476
SHA18dce778d2aebe17ec60a31f1814b982164ee1015
SHA256b6e26d568f2c0b9133d68f79f0cef813df27de8c482400f6e91f1541d1079bbd
SHA51253ad81f8e7d4d86aafa91a333c1345af4644ce58b36c68789ab8c75e5f0ea85dd69f22a1596250cb67f8e062a29194c1185ee2d833d346c8075ac79b0ff68440
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un177032.exeFilesize
530KB
MD57f026dbc10ec4730e048e3d158caf476
SHA18dce778d2aebe17ec60a31f1814b982164ee1015
SHA256b6e26d568f2c0b9133d68f79f0cef813df27de8c482400f6e91f1541d1079bbd
SHA51253ad81f8e7d4d86aafa91a333c1345af4644ce58b36c68789ab8c75e5f0ea85dd69f22a1596250cb67f8e062a29194c1185ee2d833d346c8075ac79b0ff68440
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1628.exeFilesize
260KB
MD503d964b75d11f7fcc240fc261d821880
SHA192080bedfac47237e71a18732545f889175cad7c
SHA256c539b7752abb17195273e7b255a1ede7aa12e50b4007a3f8f77751bb5387e068
SHA512244d4c53f86c1a98690e55d3aaa6cebb5bbfc3fcb17d9be8c198c5880978cbc2b99cce21d82fa2e0cf1a7fdc61a94f7db3167a6ecdd2643196cce682aa136cb6
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1628.exeFilesize
260KB
MD503d964b75d11f7fcc240fc261d821880
SHA192080bedfac47237e71a18732545f889175cad7c
SHA256c539b7752abb17195273e7b255a1ede7aa12e50b4007a3f8f77751bb5387e068
SHA512244d4c53f86c1a98690e55d3aaa6cebb5bbfc3fcb17d9be8c198c5880978cbc2b99cce21d82fa2e0cf1a7fdc61a94f7db3167a6ecdd2643196cce682aa136cb6
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9639.exeFilesize
318KB
MD50a9a9f51522b5bc4bb39a49a313982e5
SHA1f755b7d73c3dc5ac5167af78727e01a6ea8c7e08
SHA25606d7470b7d757e6c30683c061e2427f6f4eff6c09facfd1721eae75981536d33
SHA512011a2be4d6b66dae281f5435e4e7ba17733a93c10704fb91484922ffc62b2fcad34f55d13020b87cbdab57e85f4e872a6ac56ac58c539c9d0094ed3c4a35148f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9639.exeFilesize
318KB
MD50a9a9f51522b5bc4bb39a49a313982e5
SHA1f755b7d73c3dc5ac5167af78727e01a6ea8c7e08
SHA25606d7470b7d757e6c30683c061e2427f6f4eff6c09facfd1721eae75981536d33
SHA512011a2be4d6b66dae281f5435e4e7ba17733a93c10704fb91484922ffc62b2fcad34f55d13020b87cbdab57e85f4e872a6ac56ac58c539c9d0094ed3c4a35148f
-
memory/764-148-0x0000000000610000-0x000000000063D000-memory.dmpFilesize
180KB
-
memory/764-149-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/764-150-0x0000000004CA0000-0x0000000005244000-memory.dmpFilesize
5.6MB
-
memory/764-152-0x0000000002430000-0x0000000002442000-memory.dmpFilesize
72KB
-
memory/764-151-0x0000000002430000-0x0000000002442000-memory.dmpFilesize
72KB
-
memory/764-154-0x0000000002430000-0x0000000002442000-memory.dmpFilesize
72KB
-
memory/764-158-0x0000000002430000-0x0000000002442000-memory.dmpFilesize
72KB
-
memory/764-156-0x0000000002430000-0x0000000002442000-memory.dmpFilesize
72KB
-
memory/764-160-0x0000000002430000-0x0000000002442000-memory.dmpFilesize
72KB
-
memory/764-162-0x0000000002430000-0x0000000002442000-memory.dmpFilesize
72KB
-
memory/764-164-0x0000000002430000-0x0000000002442000-memory.dmpFilesize
72KB
-
memory/764-166-0x0000000002430000-0x0000000002442000-memory.dmpFilesize
72KB
-
memory/764-168-0x0000000002430000-0x0000000002442000-memory.dmpFilesize
72KB
-
memory/764-174-0x0000000002430000-0x0000000002442000-memory.dmpFilesize
72KB
-
memory/764-172-0x0000000002430000-0x0000000002442000-memory.dmpFilesize
72KB
-
memory/764-170-0x0000000002430000-0x0000000002442000-memory.dmpFilesize
72KB
-
memory/764-176-0x0000000002430000-0x0000000002442000-memory.dmpFilesize
72KB
-
memory/764-178-0x0000000002430000-0x0000000002442000-memory.dmpFilesize
72KB
-
memory/764-179-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/764-180-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/764-181-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/764-182-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/764-184-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/764-185-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/764-186-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/4300-1124-0x00000000055C0000-0x00000000055D0000-memory.dmpFilesize
64KB
-
memory/4300-1123-0x00000000055C0000-0x00000000055D0000-memory.dmpFilesize
64KB
-
memory/4300-1122-0x0000000000C00000-0x0000000000C32000-memory.dmpFilesize
200KB
-
memory/4784-196-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4784-1101-0x00000000050C0000-0x00000000056D8000-memory.dmpFilesize
6.1MB
-
memory/4784-200-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4784-204-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4784-206-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4784-202-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4784-208-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4784-210-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4784-212-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4784-216-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4784-214-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4784-218-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4784-220-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4784-222-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4784-224-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4784-541-0x0000000002100000-0x000000000214B000-memory.dmpFilesize
300KB
-
memory/4784-543-0x0000000004A70000-0x0000000004A80000-memory.dmpFilesize
64KB
-
memory/4784-547-0x0000000004A70000-0x0000000004A80000-memory.dmpFilesize
64KB
-
memory/4784-545-0x0000000004A70000-0x0000000004A80000-memory.dmpFilesize
64KB
-
memory/4784-198-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4784-1102-0x0000000005760000-0x000000000586A000-memory.dmpFilesize
1.0MB
-
memory/4784-1103-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/4784-1104-0x00000000058C0000-0x00000000058FC000-memory.dmpFilesize
240KB
-
memory/4784-1105-0x0000000004A70000-0x0000000004A80000-memory.dmpFilesize
64KB
-
memory/4784-1106-0x0000000005BB0000-0x0000000005C42000-memory.dmpFilesize
584KB
-
memory/4784-1107-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/4784-1108-0x0000000006360000-0x00000000063D6000-memory.dmpFilesize
472KB
-
memory/4784-1109-0x00000000063E0000-0x0000000006430000-memory.dmpFilesize
320KB
-
memory/4784-1111-0x0000000004A70000-0x0000000004A80000-memory.dmpFilesize
64KB
-
memory/4784-1112-0x0000000004A70000-0x0000000004A80000-memory.dmpFilesize
64KB
-
memory/4784-1113-0x0000000004A70000-0x0000000004A80000-memory.dmpFilesize
64KB
-
memory/4784-1114-0x0000000006550000-0x0000000006712000-memory.dmpFilesize
1.8MB
-
memory/4784-194-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4784-191-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4784-192-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/4784-1115-0x0000000006740000-0x0000000006C6C000-memory.dmpFilesize
5.2MB
-
memory/4784-1116-0x0000000004A70000-0x0000000004A80000-memory.dmpFilesize
64KB