Analysis
-
max time kernel
75s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 20:04
Static task
static1
Behavioral task
behavioral1
Sample
c01c2092fb5b18d3cc95ac044ddfcc9ee7d2d22279faaf7ee87a06d8e78c75e0.exe
Resource
win10v2004-20230220-en
General
-
Target
c01c2092fb5b18d3cc95ac044ddfcc9ee7d2d22279faaf7ee87a06d8e78c75e0.exe
-
Size
533KB
-
MD5
883eaea58e30f8698c5cf55f4aa2c147
-
SHA1
de1dcb7115e37a657c35d2ba240e360204b14e89
-
SHA256
c01c2092fb5b18d3cc95ac044ddfcc9ee7d2d22279faaf7ee87a06d8e78c75e0
-
SHA512
a6a4ff9e3bfe0d3b047e72dca521e805db3f86c7eea915cbfce252297353f4fb5fda5e8418577c687bb9db6be1bc60c5d3febd4deb572882f27c96f58985b524
-
SSDEEP
12288:XMrsy90SLFA6F5q8m1eOM5DJRaQOZLKCObRrJWGrK4L:7yz1P5BNyVCbx
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr978195.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr978195.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr978195.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr978195.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr978195.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr978195.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr978195.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/3332-158-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3332-161-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3332-159-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3332-165-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3332-163-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3332-167-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3332-169-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3332-173-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3332-171-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3332-175-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3332-177-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3332-179-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3332-181-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3332-183-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3332-185-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3332-187-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3332-189-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3332-191-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3332-193-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3332-195-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3332-197-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3332-199-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3332-201-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3332-203-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3332-205-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3332-207-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3332-209-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3332-211-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3332-213-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3332-215-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3332-217-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3332-219-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3332-221-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
ziAv7473.exejr978195.exeku278193.exelr239842.exepid process 4688 ziAv7473.exe 4148 jr978195.exe 3332 ku278193.exe 4460 lr239842.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr978195.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr978195.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
c01c2092fb5b18d3cc95ac044ddfcc9ee7d2d22279faaf7ee87a06d8e78c75e0.exeziAv7473.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c01c2092fb5b18d3cc95ac044ddfcc9ee7d2d22279faaf7ee87a06d8e78c75e0.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziAv7473.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziAv7473.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce c01c2092fb5b18d3cc95ac044ddfcc9ee7d2d22279faaf7ee87a06d8e78c75e0.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4408 3332 WerFault.exe ku278193.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr978195.exeku278193.exelr239842.exepid process 4148 jr978195.exe 4148 jr978195.exe 3332 ku278193.exe 3332 ku278193.exe 4460 lr239842.exe 4460 lr239842.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr978195.exeku278193.exelr239842.exedescription pid process Token: SeDebugPrivilege 4148 jr978195.exe Token: SeDebugPrivilege 3332 ku278193.exe Token: SeDebugPrivilege 4460 lr239842.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
c01c2092fb5b18d3cc95ac044ddfcc9ee7d2d22279faaf7ee87a06d8e78c75e0.exeziAv7473.exedescription pid process target process PID 448 wrote to memory of 4688 448 c01c2092fb5b18d3cc95ac044ddfcc9ee7d2d22279faaf7ee87a06d8e78c75e0.exe ziAv7473.exe PID 448 wrote to memory of 4688 448 c01c2092fb5b18d3cc95ac044ddfcc9ee7d2d22279faaf7ee87a06d8e78c75e0.exe ziAv7473.exe PID 448 wrote to memory of 4688 448 c01c2092fb5b18d3cc95ac044ddfcc9ee7d2d22279faaf7ee87a06d8e78c75e0.exe ziAv7473.exe PID 4688 wrote to memory of 4148 4688 ziAv7473.exe jr978195.exe PID 4688 wrote to memory of 4148 4688 ziAv7473.exe jr978195.exe PID 4688 wrote to memory of 3332 4688 ziAv7473.exe ku278193.exe PID 4688 wrote to memory of 3332 4688 ziAv7473.exe ku278193.exe PID 4688 wrote to memory of 3332 4688 ziAv7473.exe ku278193.exe PID 448 wrote to memory of 4460 448 c01c2092fb5b18d3cc95ac044ddfcc9ee7d2d22279faaf7ee87a06d8e78c75e0.exe lr239842.exe PID 448 wrote to memory of 4460 448 c01c2092fb5b18d3cc95ac044ddfcc9ee7d2d22279faaf7ee87a06d8e78c75e0.exe lr239842.exe PID 448 wrote to memory of 4460 448 c01c2092fb5b18d3cc95ac044ddfcc9ee7d2d22279faaf7ee87a06d8e78c75e0.exe lr239842.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c01c2092fb5b18d3cc95ac044ddfcc9ee7d2d22279faaf7ee87a06d8e78c75e0.exe"C:\Users\Admin\AppData\Local\Temp\c01c2092fb5b18d3cc95ac044ddfcc9ee7d2d22279faaf7ee87a06d8e78c75e0.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziAv7473.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziAv7473.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr978195.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr978195.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku278193.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku278193.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3332 -s 13564⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr239842.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr239842.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3332 -ip 33321⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr239842.exeFilesize
175KB
MD5b8be60cb8e3de97e8e9eb423faa8135b
SHA1f32d1bd7e5f8f3fea43f31fd5bf82ca014c8d5de
SHA2569598b5032197a3e9dc240fc42f5436474386cca5866e1bed517a4377cd8963fb
SHA51251f8a056c597447f02923591412a3d63cc078e6d37fe706312968ce4d749171195444e1507e0b2dfc65e1df3674fdfa4c266475de3de3f7d305d40802283791c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr239842.exeFilesize
175KB
MD5b8be60cb8e3de97e8e9eb423faa8135b
SHA1f32d1bd7e5f8f3fea43f31fd5bf82ca014c8d5de
SHA2569598b5032197a3e9dc240fc42f5436474386cca5866e1bed517a4377cd8963fb
SHA51251f8a056c597447f02923591412a3d63cc078e6d37fe706312968ce4d749171195444e1507e0b2dfc65e1df3674fdfa4c266475de3de3f7d305d40802283791c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziAv7473.exeFilesize
392KB
MD56155001b550f7b35d12301dc65b4dd15
SHA13ec15827aff7b5f0025ec9ca3371452abd8dd1db
SHA256ffe547f65c2cc0a4257c3a1650ceeac8b7849009094e8443b4c8bd25c3f05e7d
SHA5129486ea584848956d6574e9b389c14d1a49c257488b7241035b9a8b37ba7c97bc52802340b53286cefe5badc289ee2833fbc01cca4abc5cd5a1d5be94f00043e4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziAv7473.exeFilesize
392KB
MD56155001b550f7b35d12301dc65b4dd15
SHA13ec15827aff7b5f0025ec9ca3371452abd8dd1db
SHA256ffe547f65c2cc0a4257c3a1650ceeac8b7849009094e8443b4c8bd25c3f05e7d
SHA5129486ea584848956d6574e9b389c14d1a49c257488b7241035b9a8b37ba7c97bc52802340b53286cefe5badc289ee2833fbc01cca4abc5cd5a1d5be94f00043e4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr978195.exeFilesize
11KB
MD5b9c8a8930f218e2fbc4a7eaf4019776a
SHA1000144594de0103a18542609a2d6721a81f47657
SHA256da8d8d4b7f3b2637f501ba6c7f78864459152f2bb374b91d0e09bdf16c7df745
SHA5120cdda4ee7dad82f5e4a342638cf5a2e6eda9457d3fd2b2d44496d2ad94c331b489b929f7b0a0658b6d6165fbad3b6f7b93cd26c624b6d6521b423a4e465cb14e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr978195.exeFilesize
11KB
MD5b9c8a8930f218e2fbc4a7eaf4019776a
SHA1000144594de0103a18542609a2d6721a81f47657
SHA256da8d8d4b7f3b2637f501ba6c7f78864459152f2bb374b91d0e09bdf16c7df745
SHA5120cdda4ee7dad82f5e4a342638cf5a2e6eda9457d3fd2b2d44496d2ad94c331b489b929f7b0a0658b6d6165fbad3b6f7b93cd26c624b6d6521b423a4e465cb14e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku278193.exeFilesize
318KB
MD57ca5b81017be5c2f77371d552c6a28e3
SHA18d0d6b8d55052b9e98ccd9074e1be019e8fa4ea8
SHA256ea6bcf4f82ad8ee76c415d10647d73c78571c9b63adb36d227fc57b51ece6e74
SHA512fe773f61eef9a9f7482b39f760657c789ff7de17a9c840f77b6f038c1d595b698d852f4d5e96675dcb4ef3c7ecceedc966ea1a4de4a042d3c8500932a4d3e019
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku278193.exeFilesize
318KB
MD57ca5b81017be5c2f77371d552c6a28e3
SHA18d0d6b8d55052b9e98ccd9074e1be019e8fa4ea8
SHA256ea6bcf4f82ad8ee76c415d10647d73c78571c9b63adb36d227fc57b51ece6e74
SHA512fe773f61eef9a9f7482b39f760657c789ff7de17a9c840f77b6f038c1d595b698d852f4d5e96675dcb4ef3c7ecceedc966ea1a4de4a042d3c8500932a4d3e019
-
memory/3332-153-0x0000000004B30000-0x00000000050D4000-memory.dmpFilesize
5.6MB
-
memory/3332-154-0x0000000002170000-0x00000000021BB000-memory.dmpFilesize
300KB
-
memory/3332-155-0x0000000004B20000-0x0000000004B30000-memory.dmpFilesize
64KB
-
memory/3332-157-0x0000000004B20000-0x0000000004B30000-memory.dmpFilesize
64KB
-
memory/3332-156-0x0000000004B20000-0x0000000004B30000-memory.dmpFilesize
64KB
-
memory/3332-158-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3332-161-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3332-159-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3332-165-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3332-163-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3332-167-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3332-169-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3332-173-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3332-171-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3332-175-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3332-177-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3332-179-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3332-181-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3332-183-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3332-185-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3332-187-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3332-189-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3332-191-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3332-193-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3332-195-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3332-197-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3332-199-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3332-201-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3332-203-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3332-205-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3332-207-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3332-209-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3332-211-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3332-213-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3332-215-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3332-217-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3332-219-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3332-221-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3332-1064-0x0000000005220000-0x0000000005838000-memory.dmpFilesize
6.1MB
-
memory/3332-1065-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/3332-1066-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/3332-1067-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/3332-1068-0x0000000004B20000-0x0000000004B30000-memory.dmpFilesize
64KB
-
memory/3332-1070-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/3332-1071-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/3332-1072-0x0000000004B20000-0x0000000004B30000-memory.dmpFilesize
64KB
-
memory/3332-1073-0x0000000004B20000-0x0000000004B30000-memory.dmpFilesize
64KB
-
memory/3332-1074-0x0000000006590000-0x0000000006606000-memory.dmpFilesize
472KB
-
memory/3332-1075-0x0000000006620000-0x0000000006670000-memory.dmpFilesize
320KB
-
memory/3332-1076-0x0000000004B20000-0x0000000004B30000-memory.dmpFilesize
64KB
-
memory/3332-1077-0x00000000069E0000-0x0000000006BA2000-memory.dmpFilesize
1.8MB
-
memory/3332-1078-0x0000000006BB0000-0x00000000070DC000-memory.dmpFilesize
5.2MB
-
memory/4148-147-0x0000000000C80000-0x0000000000C8A000-memory.dmpFilesize
40KB
-
memory/4460-1084-0x0000000000630000-0x0000000000662000-memory.dmpFilesize
200KB
-
memory/4460-1085-0x00000000052A0000-0x00000000052B0000-memory.dmpFilesize
64KB
-
memory/4460-1086-0x00000000052A0000-0x00000000052B0000-memory.dmpFilesize
64KB