Analysis
-
max time kernel
97s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 19:56
Static task
static1
Behavioral task
behavioral1
Sample
bd7aea696946ec46336f5ef2dd9bee8050c9639b9f2e7e281fae878b2ca8506d.exe
Resource
win10v2004-20230220-en
General
-
Target
bd7aea696946ec46336f5ef2dd9bee8050c9639b9f2e7e281fae878b2ca8506d.exe
-
Size
534KB
-
MD5
ee685ca5d7cc6bdcf09c3c83d4d09fde
-
SHA1
d95446230e0a31ba9c5979026cd9999189326d97
-
SHA256
bd7aea696946ec46336f5ef2dd9bee8050c9639b9f2e7e281fae878b2ca8506d
-
SHA512
7c70365778702f115f0a9168f00b342d7ef69ff2d254ed70c23b3c14bdf82e3cdb0637443bac3460df2308321856c007c5ae75ae4074a47c906f74ac896b9f23
-
SSDEEP
12288:rMrTy90qjYGT8/j9k61/cLjNDbObXrWIMaZreYOj:oylhAp/1/ujAbeaxeRj
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr624283.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr624283.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr624283.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr624283.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr624283.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr624283.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr624283.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/3248-158-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3248-159-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3248-161-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3248-163-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3248-167-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3248-165-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3248-169-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3248-171-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3248-173-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3248-175-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3248-177-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3248-179-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3248-181-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3248-183-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3248-185-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3248-187-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3248-189-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3248-191-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3248-193-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3248-195-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3248-197-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3248-199-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3248-201-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3248-203-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3248-205-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3248-207-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3248-209-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3248-211-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3248-213-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3248-215-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3248-217-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3248-219-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3248-221-0x0000000002530000-0x000000000256F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
ziJa0840.exejr624283.exeku541003.exelr307981.exepid process 4924 ziJa0840.exe 2192 jr624283.exe 3248 ku541003.exe 4320 lr307981.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr624283.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr624283.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
bd7aea696946ec46336f5ef2dd9bee8050c9639b9f2e7e281fae878b2ca8506d.exeziJa0840.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce bd7aea696946ec46336f5ef2dd9bee8050c9639b9f2e7e281fae878b2ca8506d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" bd7aea696946ec46336f5ef2dd9bee8050c9639b9f2e7e281fae878b2ca8506d.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziJa0840.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziJa0840.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3524 3248 WerFault.exe ku541003.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr624283.exeku541003.exelr307981.exepid process 2192 jr624283.exe 2192 jr624283.exe 3248 ku541003.exe 3248 ku541003.exe 4320 lr307981.exe 4320 lr307981.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr624283.exeku541003.exelr307981.exedescription pid process Token: SeDebugPrivilege 2192 jr624283.exe Token: SeDebugPrivilege 3248 ku541003.exe Token: SeDebugPrivilege 4320 lr307981.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
bd7aea696946ec46336f5ef2dd9bee8050c9639b9f2e7e281fae878b2ca8506d.exeziJa0840.exedescription pid process target process PID 4268 wrote to memory of 4924 4268 bd7aea696946ec46336f5ef2dd9bee8050c9639b9f2e7e281fae878b2ca8506d.exe ziJa0840.exe PID 4268 wrote to memory of 4924 4268 bd7aea696946ec46336f5ef2dd9bee8050c9639b9f2e7e281fae878b2ca8506d.exe ziJa0840.exe PID 4268 wrote to memory of 4924 4268 bd7aea696946ec46336f5ef2dd9bee8050c9639b9f2e7e281fae878b2ca8506d.exe ziJa0840.exe PID 4924 wrote to memory of 2192 4924 ziJa0840.exe jr624283.exe PID 4924 wrote to memory of 2192 4924 ziJa0840.exe jr624283.exe PID 4924 wrote to memory of 3248 4924 ziJa0840.exe ku541003.exe PID 4924 wrote to memory of 3248 4924 ziJa0840.exe ku541003.exe PID 4924 wrote to memory of 3248 4924 ziJa0840.exe ku541003.exe PID 4268 wrote to memory of 4320 4268 bd7aea696946ec46336f5ef2dd9bee8050c9639b9f2e7e281fae878b2ca8506d.exe lr307981.exe PID 4268 wrote to memory of 4320 4268 bd7aea696946ec46336f5ef2dd9bee8050c9639b9f2e7e281fae878b2ca8506d.exe lr307981.exe PID 4268 wrote to memory of 4320 4268 bd7aea696946ec46336f5ef2dd9bee8050c9639b9f2e7e281fae878b2ca8506d.exe lr307981.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd7aea696946ec46336f5ef2dd9bee8050c9639b9f2e7e281fae878b2ca8506d.exe"C:\Users\Admin\AppData\Local\Temp\bd7aea696946ec46336f5ef2dd9bee8050c9639b9f2e7e281fae878b2ca8506d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziJa0840.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziJa0840.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr624283.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr624283.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku541003.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku541003.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 13284⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr307981.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr307981.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3248 -ip 32481⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr307981.exeFilesize
175KB
MD5f76ccb5bae102cb1323294ce3cef3a8f
SHA137c303eb17499932c6bff8ab821da2fe9776434e
SHA2568c17048296ef26a161ca4c3d67c6a5b6e3d13d49674fc49a27ed1174675ce70c
SHA51205f33b95f359caa4e405476f86fd84c35c2afb5ef9ba899fa2d003b1621b175cca307459fd022cce476cd93af8666f99adf235dd290a2ccbc9b9fce567bf2019
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr307981.exeFilesize
175KB
MD5f76ccb5bae102cb1323294ce3cef3a8f
SHA137c303eb17499932c6bff8ab821da2fe9776434e
SHA2568c17048296ef26a161ca4c3d67c6a5b6e3d13d49674fc49a27ed1174675ce70c
SHA51205f33b95f359caa4e405476f86fd84c35c2afb5ef9ba899fa2d003b1621b175cca307459fd022cce476cd93af8666f99adf235dd290a2ccbc9b9fce567bf2019
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziJa0840.exeFilesize
392KB
MD521d3d336057ce2f2c5544c57551a17f6
SHA1c3cad12817c4919a0faca7e4acaec3b6747d7da0
SHA256261aa5e53e5b5cb2a8d29c000455847380c368f1dd72392a5a06c333dc137fb9
SHA512ea9e7136d4fafdd43bd7aeeb1128d2297b82a54cbb7a9513edd426f5eb96febff6b1f073b3e3e08187d278ddb8e1cc1a66e35ef17e07b5999d73b5c845434bfd
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziJa0840.exeFilesize
392KB
MD521d3d336057ce2f2c5544c57551a17f6
SHA1c3cad12817c4919a0faca7e4acaec3b6747d7da0
SHA256261aa5e53e5b5cb2a8d29c000455847380c368f1dd72392a5a06c333dc137fb9
SHA512ea9e7136d4fafdd43bd7aeeb1128d2297b82a54cbb7a9513edd426f5eb96febff6b1f073b3e3e08187d278ddb8e1cc1a66e35ef17e07b5999d73b5c845434bfd
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr624283.exeFilesize
11KB
MD5d8c5787eccdf1a982b642ddde7667899
SHA1a12d727bf992e0aceda76cd1d782dff89cb85fc1
SHA256c684fe61d26739acec9b186b1387f5e4a7b0a384d2716eefc6881d0387784409
SHA5127860d16712baae543e463c2305c99892c444f5755e03d407086d395adfdd2d11ac6567cf136b1e713f950b2b3ba02b9376d4abb4ccebbc845b2685ddeafe302b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr624283.exeFilesize
11KB
MD5d8c5787eccdf1a982b642ddde7667899
SHA1a12d727bf992e0aceda76cd1d782dff89cb85fc1
SHA256c684fe61d26739acec9b186b1387f5e4a7b0a384d2716eefc6881d0387784409
SHA5127860d16712baae543e463c2305c99892c444f5755e03d407086d395adfdd2d11ac6567cf136b1e713f950b2b3ba02b9376d4abb4ccebbc845b2685ddeafe302b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku541003.exeFilesize
318KB
MD5df6ed9a234b52e127baddfe6283c0eed
SHA14bf09140de66abe0acedff4d8e2ebb2501e83f7b
SHA256398f08457fd3df69c39ed0884cde1a53a5e8981acb1934a81c2e23973b86e120
SHA5126ce406c7b95f160b47ccae3383162fc73e5e8f7738a3a19562887110c5328ab565209426ceaaf72b5a7e0a46cc80e4d64f23fe70a3a15a51dc8b24dfa1c67905
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku541003.exeFilesize
318KB
MD5df6ed9a234b52e127baddfe6283c0eed
SHA14bf09140de66abe0acedff4d8e2ebb2501e83f7b
SHA256398f08457fd3df69c39ed0884cde1a53a5e8981acb1934a81c2e23973b86e120
SHA5126ce406c7b95f160b47ccae3383162fc73e5e8f7738a3a19562887110c5328ab565209426ceaaf72b5a7e0a46cc80e4d64f23fe70a3a15a51dc8b24dfa1c67905
-
memory/2192-147-0x00000000001D0000-0x00000000001DA000-memory.dmpFilesize
40KB
-
memory/3248-153-0x0000000004AC0000-0x0000000005064000-memory.dmpFilesize
5.6MB
-
memory/3248-154-0x00000000020F0000-0x000000000213B000-memory.dmpFilesize
300KB
-
memory/3248-156-0x00000000023C0000-0x00000000023D0000-memory.dmpFilesize
64KB
-
memory/3248-155-0x00000000023C0000-0x00000000023D0000-memory.dmpFilesize
64KB
-
memory/3248-157-0x00000000023C0000-0x00000000023D0000-memory.dmpFilesize
64KB
-
memory/3248-158-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3248-159-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3248-161-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3248-163-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3248-167-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3248-165-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3248-169-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3248-171-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3248-173-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3248-175-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3248-177-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3248-179-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3248-181-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3248-183-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3248-185-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3248-187-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3248-189-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3248-191-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3248-193-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3248-195-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3248-197-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3248-199-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3248-201-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3248-203-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3248-205-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3248-207-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3248-209-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3248-211-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3248-213-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3248-215-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3248-217-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3248-219-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3248-221-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3248-1064-0x00000000050C0000-0x00000000056D8000-memory.dmpFilesize
6.1MB
-
memory/3248-1065-0x0000000005760000-0x000000000586A000-memory.dmpFilesize
1.0MB
-
memory/3248-1066-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/3248-1067-0x00000000059C0000-0x00000000059FC000-memory.dmpFilesize
240KB
-
memory/3248-1068-0x00000000023C0000-0x00000000023D0000-memory.dmpFilesize
64KB
-
memory/3248-1070-0x0000000005BB0000-0x0000000005C16000-memory.dmpFilesize
408KB
-
memory/3248-1071-0x00000000023C0000-0x00000000023D0000-memory.dmpFilesize
64KB
-
memory/3248-1072-0x00000000023C0000-0x00000000023D0000-memory.dmpFilesize
64KB
-
memory/3248-1073-0x00000000023C0000-0x00000000023D0000-memory.dmpFilesize
64KB
-
memory/3248-1074-0x0000000006280000-0x0000000006312000-memory.dmpFilesize
584KB
-
memory/3248-1075-0x0000000006370000-0x0000000006532000-memory.dmpFilesize
1.8MB
-
memory/3248-1076-0x0000000006550000-0x0000000006A7C000-memory.dmpFilesize
5.2MB
-
memory/3248-1077-0x00000000023C0000-0x00000000023D0000-memory.dmpFilesize
64KB
-
memory/3248-1079-0x0000000007F80000-0x0000000007FF6000-memory.dmpFilesize
472KB
-
memory/3248-1080-0x0000000008010000-0x0000000008060000-memory.dmpFilesize
320KB
-
memory/4320-1087-0x0000000000CB0000-0x0000000000CE2000-memory.dmpFilesize
200KB
-
memory/4320-1088-0x00000000055B0000-0x00000000055C0000-memory.dmpFilesize
64KB
-
memory/4320-1089-0x00000000055B0000-0x00000000055C0000-memory.dmpFilesize
64KB