Analysis
-
max time kernel
101s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 20:02
Static task
static1
Behavioral task
behavioral1
Sample
5908cc617a93f65455aab3b08d060087eeb4b247d3eeac1b4b2082e46e2fadc2.exe
Resource
win10v2004-20230221-en
General
-
Target
5908cc617a93f65455aab3b08d060087eeb4b247d3eeac1b4b2082e46e2fadc2.exe
-
Size
534KB
-
MD5
88167e1ff56b48afab98a6857e54de81
-
SHA1
a9eb0d59141a623db03cdfb999ce11f35b5e2439
-
SHA256
5908cc617a93f65455aab3b08d060087eeb4b247d3eeac1b4b2082e46e2fadc2
-
SHA512
91dc3ea071fd5461d35a182c647463f986deb6d57e4f04ad6c7a626868ce6e771d9157e993145863ee5d7d1186c60670516971b81bfe47347fcc0179dd65f225
-
SSDEEP
12288:BMrYy90RmAAyxdQj3ZskLTovQVdsiObgrhq244OVPmq4F6DM:Jy7GSFr3o4cbGkxzw
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr752829.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr752829.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr752829.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr752829.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr752829.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr752829.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr752829.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 34 IoCs
Processes:
resource yara_rule behavioral1/memory/2168-155-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2168-158-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2168-156-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2168-160-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2168-162-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2168-164-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2168-166-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2168-168-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2168-170-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2168-172-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2168-174-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2168-176-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2168-178-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2168-180-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2168-182-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2168-184-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2168-186-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2168-188-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2168-190-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2168-192-0x0000000004D20000-0x0000000004D30000-memory.dmp family_redline behavioral1/memory/2168-194-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2168-196-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2168-198-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2168-202-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2168-200-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2168-204-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2168-206-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2168-208-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2168-210-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2168-212-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2168-214-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2168-216-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2168-218-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2168-220-0x0000000002710000-0x000000000274F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
zinO9975.exejr752829.exeku183344.exelr791332.exepid process 4876 zinO9975.exe 4232 jr752829.exe 2168 ku183344.exe 2608 lr791332.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr752829.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr752829.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
zinO9975.exe5908cc617a93f65455aab3b08d060087eeb4b247d3eeac1b4b2082e46e2fadc2.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zinO9975.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zinO9975.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 5908cc617a93f65455aab3b08d060087eeb4b247d3eeac1b4b2082e46e2fadc2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5908cc617a93f65455aab3b08d060087eeb4b247d3eeac1b4b2082e46e2fadc2.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2088 2168 WerFault.exe ku183344.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr752829.exeku183344.exelr791332.exepid process 4232 jr752829.exe 4232 jr752829.exe 2168 ku183344.exe 2168 ku183344.exe 2608 lr791332.exe 2608 lr791332.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr752829.exeku183344.exelr791332.exedescription pid process Token: SeDebugPrivilege 4232 jr752829.exe Token: SeDebugPrivilege 2168 ku183344.exe Token: SeDebugPrivilege 2608 lr791332.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
5908cc617a93f65455aab3b08d060087eeb4b247d3eeac1b4b2082e46e2fadc2.exezinO9975.exedescription pid process target process PID 2704 wrote to memory of 4876 2704 5908cc617a93f65455aab3b08d060087eeb4b247d3eeac1b4b2082e46e2fadc2.exe zinO9975.exe PID 2704 wrote to memory of 4876 2704 5908cc617a93f65455aab3b08d060087eeb4b247d3eeac1b4b2082e46e2fadc2.exe zinO9975.exe PID 2704 wrote to memory of 4876 2704 5908cc617a93f65455aab3b08d060087eeb4b247d3eeac1b4b2082e46e2fadc2.exe zinO9975.exe PID 4876 wrote to memory of 4232 4876 zinO9975.exe jr752829.exe PID 4876 wrote to memory of 4232 4876 zinO9975.exe jr752829.exe PID 4876 wrote to memory of 2168 4876 zinO9975.exe ku183344.exe PID 4876 wrote to memory of 2168 4876 zinO9975.exe ku183344.exe PID 4876 wrote to memory of 2168 4876 zinO9975.exe ku183344.exe PID 2704 wrote to memory of 2608 2704 5908cc617a93f65455aab3b08d060087eeb4b247d3eeac1b4b2082e46e2fadc2.exe lr791332.exe PID 2704 wrote to memory of 2608 2704 5908cc617a93f65455aab3b08d060087eeb4b247d3eeac1b4b2082e46e2fadc2.exe lr791332.exe PID 2704 wrote to memory of 2608 2704 5908cc617a93f65455aab3b08d060087eeb4b247d3eeac1b4b2082e46e2fadc2.exe lr791332.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5908cc617a93f65455aab3b08d060087eeb4b247d3eeac1b4b2082e46e2fadc2.exe"C:\Users\Admin\AppData\Local\Temp\5908cc617a93f65455aab3b08d060087eeb4b247d3eeac1b4b2082e46e2fadc2.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zinO9975.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zinO9975.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr752829.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr752829.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku183344.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku183344.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 13524⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr791332.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr791332.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2168 -ip 21681⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr791332.exeFilesize
175KB
MD506392d504f3ee83a618507c84a6f89bc
SHA1a51e4cbec5a504212cf546749e09c30a9d8b7ffe
SHA2564651c874929f8afe398694d66126df3ad6ac7537aa9352384de834303134c4b8
SHA51254cea7f5568e0d1c1e0a9efd9ea2764b1b07197d60b5506a377ac9e1a4c1972c0caa5ea5391183b0109eee4dcf6314105918e46c8672e8bdb95b928386dd199d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr791332.exeFilesize
175KB
MD506392d504f3ee83a618507c84a6f89bc
SHA1a51e4cbec5a504212cf546749e09c30a9d8b7ffe
SHA2564651c874929f8afe398694d66126df3ad6ac7537aa9352384de834303134c4b8
SHA51254cea7f5568e0d1c1e0a9efd9ea2764b1b07197d60b5506a377ac9e1a4c1972c0caa5ea5391183b0109eee4dcf6314105918e46c8672e8bdb95b928386dd199d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zinO9975.exeFilesize
392KB
MD5f903d5343e883ecd39964aa61808cc98
SHA1201ece215d48522b5a3af685bcaa146c2d72a6dc
SHA2564a1cd2e858cdfac1493b4b14358fda513960abfa7a2bb20f8593050bdf879115
SHA512da5c7b47bdc1d3fbd73b8e41ec3cc7170c917c17f04bc78c7912a46a8d412d72c200cdae3da0cfad4d103da98b48b25082c4cfc75a4e35482bbe7ec816646544
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zinO9975.exeFilesize
392KB
MD5f903d5343e883ecd39964aa61808cc98
SHA1201ece215d48522b5a3af685bcaa146c2d72a6dc
SHA2564a1cd2e858cdfac1493b4b14358fda513960abfa7a2bb20f8593050bdf879115
SHA512da5c7b47bdc1d3fbd73b8e41ec3cc7170c917c17f04bc78c7912a46a8d412d72c200cdae3da0cfad4d103da98b48b25082c4cfc75a4e35482bbe7ec816646544
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr752829.exeFilesize
11KB
MD58049e71888ff041f4fa1afce82cc1dd6
SHA1057a9a55a81dae9428d7023f11dabfb2d2b8095f
SHA256479076695d105e53b0116565376c01af1a216c2f4a62389f9eef696b78c0dda6
SHA512570b943be0eee0482f7af50a617b9e5978b3c578c24acf79c1c88297389949c98c8e1afed6a7e8513899cb5986c3700d79332170bba712a771ce739191acbebb
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr752829.exeFilesize
11KB
MD58049e71888ff041f4fa1afce82cc1dd6
SHA1057a9a55a81dae9428d7023f11dabfb2d2b8095f
SHA256479076695d105e53b0116565376c01af1a216c2f4a62389f9eef696b78c0dda6
SHA512570b943be0eee0482f7af50a617b9e5978b3c578c24acf79c1c88297389949c98c8e1afed6a7e8513899cb5986c3700d79332170bba712a771ce739191acbebb
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku183344.exeFilesize
318KB
MD586f144e4ce264b9dcc6381acb405af59
SHA13a5de80c28ebc470f03615d55bffff049c588ea0
SHA2566721d91df16b4815e3927eb6eeaca3269b7bfbd49857e4a67c3b6ca48b83c3f5
SHA51269c2eb2ffa5df93588b4ecca84d5a72cc01ddec50261f7f271056af5787d6c86120cc69cef3b62186509de4b098869933202aa51027b709a2103b3634d72084c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku183344.exeFilesize
318KB
MD586f144e4ce264b9dcc6381acb405af59
SHA13a5de80c28ebc470f03615d55bffff049c588ea0
SHA2566721d91df16b4815e3927eb6eeaca3269b7bfbd49857e4a67c3b6ca48b83c3f5
SHA51269c2eb2ffa5df93588b4ecca84d5a72cc01ddec50261f7f271056af5787d6c86120cc69cef3b62186509de4b098869933202aa51027b709a2103b3634d72084c
-
memory/2168-153-0x00000000020F0000-0x000000000213B000-memory.dmpFilesize
300KB
-
memory/2168-154-0x0000000004D30000-0x00000000052D4000-memory.dmpFilesize
5.6MB
-
memory/2168-155-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2168-158-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2168-156-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2168-160-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2168-162-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2168-164-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2168-166-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2168-168-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2168-170-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2168-172-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2168-174-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2168-176-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2168-178-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2168-180-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2168-182-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2168-184-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2168-186-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2168-188-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2168-191-0x0000000004D20000-0x0000000004D30000-memory.dmpFilesize
64KB
-
memory/2168-190-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2168-192-0x0000000004D20000-0x0000000004D30000-memory.dmpFilesize
64KB
-
memory/2168-194-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2168-196-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2168-198-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2168-202-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2168-200-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2168-204-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2168-206-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2168-208-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2168-210-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2168-212-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2168-214-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2168-216-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2168-218-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2168-220-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2168-1063-0x00000000052E0000-0x00000000058F8000-memory.dmpFilesize
6.1MB
-
memory/2168-1064-0x0000000005900000-0x0000000005A0A000-memory.dmpFilesize
1.0MB
-
memory/2168-1065-0x0000000004CF0000-0x0000000004D02000-memory.dmpFilesize
72KB
-
memory/2168-1066-0x0000000004D20000-0x0000000004D30000-memory.dmpFilesize
64KB
-
memory/2168-1067-0x0000000005A10000-0x0000000005A4C000-memory.dmpFilesize
240KB
-
memory/2168-1069-0x0000000004D20000-0x0000000004D30000-memory.dmpFilesize
64KB
-
memory/2168-1070-0x0000000004D20000-0x0000000004D30000-memory.dmpFilesize
64KB
-
memory/2168-1071-0x0000000004D20000-0x0000000004D30000-memory.dmpFilesize
64KB
-
memory/2168-1072-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/2168-1073-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/2168-1074-0x0000000006590000-0x0000000006606000-memory.dmpFilesize
472KB
-
memory/2168-1075-0x0000000006620000-0x0000000006670000-memory.dmpFilesize
320KB
-
memory/2168-1076-0x0000000004D20000-0x0000000004D30000-memory.dmpFilesize
64KB
-
memory/2168-1077-0x00000000067E0000-0x00000000069A2000-memory.dmpFilesize
1.8MB
-
memory/2168-1078-0x00000000069F0000-0x0000000006F1C000-memory.dmpFilesize
5.2MB
-
memory/2608-1085-0x0000000000510000-0x0000000000542000-memory.dmpFilesize
200KB
-
memory/2608-1086-0x0000000005110000-0x0000000005120000-memory.dmpFilesize
64KB
-
memory/4232-147-0x0000000000340000-0x000000000034A000-memory.dmpFilesize
40KB