Analysis
-
max time kernel
61s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 20:05
Static task
static1
Behavioral task
behavioral1
Sample
ed2469260a387e92d7e524f06f555844d98498f0ba1eab157c80f0efca1156e3.exe
Resource
win10v2004-20230220-en
General
-
Target
ed2469260a387e92d7e524f06f555844d98498f0ba1eab157c80f0efca1156e3.exe
-
Size
534KB
-
MD5
8e0c54a8bb2388aea5713a3fd2c58e67
-
SHA1
f66f1f124e172acf94d4f06e319ab304137bda88
-
SHA256
ed2469260a387e92d7e524f06f555844d98498f0ba1eab157c80f0efca1156e3
-
SHA512
d2a900c8675e13ca7aa9c93ff44933314844450c5da0e06defed4c1ec5ffdc66087fe9d976f539b73dd76df87ff79530955d2f75604024690186ead56dc20bab
-
SSDEEP
12288:SMr6y90vgP/DQ516UAYrlYl9rObYrfHFGdYq7EnouW0:cyd/D2AnobGHkdYq76p
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr001120.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr001120.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr001120.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr001120.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr001120.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr001120.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr001120.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 34 IoCs
Processes:
resource yara_rule behavioral1/memory/1044-155-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/1044-156-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/1044-158-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/1044-162-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/1044-164-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/1044-160-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/1044-166-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/1044-174-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/1044-178-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/1044-176-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/1044-172-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/1044-182-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/1044-188-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/1044-190-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/1044-186-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/1044-184-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/1044-192-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/1044-180-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/1044-198-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/1044-206-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/1044-210-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/1044-213-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/1044-204-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/1044-202-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/1044-219-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/1044-221-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/1044-217-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/1044-215-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/1044-200-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/1044-196-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/1044-194-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/1044-170-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/1044-168-0x0000000002580000-0x00000000025BF000-memory.dmp family_redline behavioral1/memory/1044-1073-0x0000000004C00000-0x0000000004C10000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
ziXn6543.exejr001120.exeku999161.exelr550196.exepid process 1800 ziXn6543.exe 1788 jr001120.exe 1044 ku999161.exe 2980 lr550196.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr001120.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr001120.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
ed2469260a387e92d7e524f06f555844d98498f0ba1eab157c80f0efca1156e3.exeziXn6543.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" ed2469260a387e92d7e524f06f555844d98498f0ba1eab157c80f0efca1156e3.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziXn6543.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziXn6543.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ed2469260a387e92d7e524f06f555844d98498f0ba1eab157c80f0efca1156e3.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4996 1044 WerFault.exe ku999161.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr001120.exeku999161.exelr550196.exepid process 1788 jr001120.exe 1788 jr001120.exe 1044 ku999161.exe 1044 ku999161.exe 2980 lr550196.exe 2980 lr550196.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr001120.exeku999161.exelr550196.exedescription pid process Token: SeDebugPrivilege 1788 jr001120.exe Token: SeDebugPrivilege 1044 ku999161.exe Token: SeDebugPrivilege 2980 lr550196.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
ed2469260a387e92d7e524f06f555844d98498f0ba1eab157c80f0efca1156e3.exeziXn6543.exedescription pid process target process PID 2868 wrote to memory of 1800 2868 ed2469260a387e92d7e524f06f555844d98498f0ba1eab157c80f0efca1156e3.exe ziXn6543.exe PID 2868 wrote to memory of 1800 2868 ed2469260a387e92d7e524f06f555844d98498f0ba1eab157c80f0efca1156e3.exe ziXn6543.exe PID 2868 wrote to memory of 1800 2868 ed2469260a387e92d7e524f06f555844d98498f0ba1eab157c80f0efca1156e3.exe ziXn6543.exe PID 1800 wrote to memory of 1788 1800 ziXn6543.exe jr001120.exe PID 1800 wrote to memory of 1788 1800 ziXn6543.exe jr001120.exe PID 1800 wrote to memory of 1044 1800 ziXn6543.exe ku999161.exe PID 1800 wrote to memory of 1044 1800 ziXn6543.exe ku999161.exe PID 1800 wrote to memory of 1044 1800 ziXn6543.exe ku999161.exe PID 2868 wrote to memory of 2980 2868 ed2469260a387e92d7e524f06f555844d98498f0ba1eab157c80f0efca1156e3.exe lr550196.exe PID 2868 wrote to memory of 2980 2868 ed2469260a387e92d7e524f06f555844d98498f0ba1eab157c80f0efca1156e3.exe lr550196.exe PID 2868 wrote to memory of 2980 2868 ed2469260a387e92d7e524f06f555844d98498f0ba1eab157c80f0efca1156e3.exe lr550196.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed2469260a387e92d7e524f06f555844d98498f0ba1eab157c80f0efca1156e3.exe"C:\Users\Admin\AppData\Local\Temp\ed2469260a387e92d7e524f06f555844d98498f0ba1eab157c80f0efca1156e3.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziXn6543.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziXn6543.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr001120.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr001120.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku999161.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku999161.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 13484⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr550196.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr550196.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1044 -ip 10441⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr550196.exeFilesize
175KB
MD5f4367bc5a67ef352ed852f02a6c17f6a
SHA10c9fd4f3ce6592874a7da4cd63afcdeef4f0485e
SHA2567605bf216f8e6ee8a5ee0d4189e91a2277252d2e425824cfb58bcb7bf6bc123f
SHA512852f661da9bc26178d093c2d593832c941bff16b70f596f61f45d223b44851c867d1accda4aa25a4e2e5651c42f545720e55d5e8ea0ee8246e3b1128a8000bd6
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr550196.exeFilesize
175KB
MD5f4367bc5a67ef352ed852f02a6c17f6a
SHA10c9fd4f3ce6592874a7da4cd63afcdeef4f0485e
SHA2567605bf216f8e6ee8a5ee0d4189e91a2277252d2e425824cfb58bcb7bf6bc123f
SHA512852f661da9bc26178d093c2d593832c941bff16b70f596f61f45d223b44851c867d1accda4aa25a4e2e5651c42f545720e55d5e8ea0ee8246e3b1128a8000bd6
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziXn6543.exeFilesize
392KB
MD5955a1d5900c7454377ced0e8a916b157
SHA1c8eb60e9a9c76570fcb3df7b5a4e3883119769f0
SHA25612649f79b8fb4d05b7a0a2ce4300f8691d7327c6ca57a4864e3527c74b487d92
SHA5126626a673c35f41cd63ce3e00f44b5281b477503380105058411d40f8df6cd741bbd4623f6331444c2a7044e2114a4cb907a60ec2d746b24a16890de1ceea1e83
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziXn6543.exeFilesize
392KB
MD5955a1d5900c7454377ced0e8a916b157
SHA1c8eb60e9a9c76570fcb3df7b5a4e3883119769f0
SHA25612649f79b8fb4d05b7a0a2ce4300f8691d7327c6ca57a4864e3527c74b487d92
SHA5126626a673c35f41cd63ce3e00f44b5281b477503380105058411d40f8df6cd741bbd4623f6331444c2a7044e2114a4cb907a60ec2d746b24a16890de1ceea1e83
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr001120.exeFilesize
11KB
MD50446f99b584c6b532f259f86e7557f13
SHA1c266f5b0b124cd947268e036277ee346271181a6
SHA256309c626361ab25fee390fe49f10c01b64a9fa1d8d6433c1d6120d466a75d27c7
SHA512e241deb428450413a8af9deb66a0451961de727648726abd2f258516e12d60baf430303bb1662a60d3c1e9ac2df65cd4c85b6fb7e844756ac386511c016b876e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr001120.exeFilesize
11KB
MD50446f99b584c6b532f259f86e7557f13
SHA1c266f5b0b124cd947268e036277ee346271181a6
SHA256309c626361ab25fee390fe49f10c01b64a9fa1d8d6433c1d6120d466a75d27c7
SHA512e241deb428450413a8af9deb66a0451961de727648726abd2f258516e12d60baf430303bb1662a60d3c1e9ac2df65cd4c85b6fb7e844756ac386511c016b876e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku999161.exeFilesize
318KB
MD5ea200b63d8bbb3e53f91cb7809275ef5
SHA11a77eb0743e09b5de30bc2ffe0d7c899271c827b
SHA256271a6cd12c45304d622e1a25572d33449391338974e3eebaa056bee367f4b9a5
SHA5124c3441081fb754db1a7c54a8b64f19996f028289e262c9f916d0bd262ffc571d7cec1f39e2948789f4767ab64ae157007a2d7cb6a06fce08671e626e803bbee5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku999161.exeFilesize
318KB
MD5ea200b63d8bbb3e53f91cb7809275ef5
SHA11a77eb0743e09b5de30bc2ffe0d7c899271c827b
SHA256271a6cd12c45304d622e1a25572d33449391338974e3eebaa056bee367f4b9a5
SHA5124c3441081fb754db1a7c54a8b64f19996f028289e262c9f916d0bd262ffc571d7cec1f39e2948789f4767ab64ae157007a2d7cb6a06fce08671e626e803bbee5
-
memory/1044-153-0x0000000002010000-0x000000000205B000-memory.dmpFilesize
300KB
-
memory/1044-154-0x0000000004C10000-0x00000000051B4000-memory.dmpFilesize
5.6MB
-
memory/1044-155-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/1044-156-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/1044-158-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/1044-162-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/1044-164-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/1044-160-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/1044-166-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/1044-174-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/1044-178-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/1044-176-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/1044-172-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/1044-182-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/1044-188-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/1044-190-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/1044-186-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/1044-184-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/1044-192-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/1044-180-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/1044-198-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/1044-207-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/1044-209-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/1044-206-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/1044-210-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/1044-211-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/1044-213-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/1044-204-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/1044-202-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/1044-219-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/1044-221-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/1044-217-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/1044-215-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/1044-200-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/1044-196-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/1044-194-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/1044-170-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/1044-168-0x0000000002580000-0x00000000025BF000-memory.dmpFilesize
252KB
-
memory/1044-1064-0x00000000052C0000-0x00000000058D8000-memory.dmpFilesize
6.1MB
-
memory/1044-1065-0x00000000058E0000-0x00000000059EA000-memory.dmpFilesize
1.0MB
-
memory/1044-1066-0x00000000059F0000-0x0000000005A02000-memory.dmpFilesize
72KB
-
memory/1044-1067-0x0000000005A10000-0x0000000005A4C000-memory.dmpFilesize
240KB
-
memory/1044-1068-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/1044-1070-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/1044-1071-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/1044-1072-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/1044-1073-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/1044-1074-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/1044-1075-0x00000000065C0000-0x0000000006636000-memory.dmpFilesize
472KB
-
memory/1044-1076-0x0000000006640000-0x0000000006690000-memory.dmpFilesize
320KB
-
memory/1044-1077-0x00000000066A0000-0x0000000006862000-memory.dmpFilesize
1.8MB
-
memory/1044-1078-0x0000000006870000-0x0000000006D9C000-memory.dmpFilesize
5.2MB
-
memory/1044-1079-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/1788-147-0x0000000000A70000-0x0000000000A7A000-memory.dmpFilesize
40KB
-
memory/2980-1085-0x0000000000680000-0x00000000006B2000-memory.dmpFilesize
200KB
-
memory/2980-1086-0x0000000004F10000-0x0000000004F20000-memory.dmpFilesize
64KB