Analysis
-
max time kernel
61s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 20:07
Static task
static1
Behavioral task
behavioral1
Sample
a9ec357c61e66523b2b1b94823f4ba2badb709e65e53c3b17b9d7aba80994513.exe
Resource
win10v2004-20230221-en
General
-
Target
a9ec357c61e66523b2b1b94823f4ba2badb709e65e53c3b17b9d7aba80994513.exe
-
Size
533KB
-
MD5
4f9819a8794e661c6b99834ab13d7241
-
SHA1
ec83bc38ead74600b5dfcf76c888308bc286d3d3
-
SHA256
a9ec357c61e66523b2b1b94823f4ba2badb709e65e53c3b17b9d7aba80994513
-
SHA512
b31a1bb817fc386c03835b769292d9ea09bc959e4221751f379c2bd552db1a71cb689937d71f017b568ef61e907992ca90515e0b152339709b52564a14735fad
-
SSDEEP
12288:FMrWy90Vu1LnKJMmmJWWUe2Bej8j8aObVreUz7SZEP:byXLhmxJpIJbnaEP
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr436735.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr436735.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr436735.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr436735.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr436735.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr436735.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr436735.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/1944-155-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1944-156-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1944-158-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1944-160-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1944-162-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1944-164-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1944-166-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1944-168-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1944-170-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1944-172-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1944-174-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1944-176-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1944-178-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1944-180-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1944-184-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1944-187-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1944-189-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1944-191-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1944-193-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1944-195-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1944-197-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1944-199-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1944-201-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1944-203-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1944-205-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1944-207-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1944-209-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1944-211-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1944-213-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1944-215-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1944-217-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1944-219-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1944-221-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
zicU7818.exejr436735.exeku872385.exelr679822.exepid process 1996 zicU7818.exe 2156 jr436735.exe 1944 ku872385.exe 2224 lr679822.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr436735.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr436735.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
a9ec357c61e66523b2b1b94823f4ba2badb709e65e53c3b17b9d7aba80994513.exezicU7818.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce a9ec357c61e66523b2b1b94823f4ba2badb709e65e53c3b17b9d7aba80994513.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a9ec357c61e66523b2b1b94823f4ba2badb709e65e53c3b17b9d7aba80994513.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zicU7818.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zicU7818.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4964 1944 WerFault.exe ku872385.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr436735.exeku872385.exelr679822.exepid process 2156 jr436735.exe 2156 jr436735.exe 1944 ku872385.exe 1944 ku872385.exe 2224 lr679822.exe 2224 lr679822.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr436735.exeku872385.exelr679822.exedescription pid process Token: SeDebugPrivilege 2156 jr436735.exe Token: SeDebugPrivilege 1944 ku872385.exe Token: SeDebugPrivilege 2224 lr679822.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
a9ec357c61e66523b2b1b94823f4ba2badb709e65e53c3b17b9d7aba80994513.exezicU7818.exedescription pid process target process PID 1000 wrote to memory of 1996 1000 a9ec357c61e66523b2b1b94823f4ba2badb709e65e53c3b17b9d7aba80994513.exe zicU7818.exe PID 1000 wrote to memory of 1996 1000 a9ec357c61e66523b2b1b94823f4ba2badb709e65e53c3b17b9d7aba80994513.exe zicU7818.exe PID 1000 wrote to memory of 1996 1000 a9ec357c61e66523b2b1b94823f4ba2badb709e65e53c3b17b9d7aba80994513.exe zicU7818.exe PID 1996 wrote to memory of 2156 1996 zicU7818.exe jr436735.exe PID 1996 wrote to memory of 2156 1996 zicU7818.exe jr436735.exe PID 1996 wrote to memory of 1944 1996 zicU7818.exe ku872385.exe PID 1996 wrote to memory of 1944 1996 zicU7818.exe ku872385.exe PID 1996 wrote to memory of 1944 1996 zicU7818.exe ku872385.exe PID 1000 wrote to memory of 2224 1000 a9ec357c61e66523b2b1b94823f4ba2badb709e65e53c3b17b9d7aba80994513.exe lr679822.exe PID 1000 wrote to memory of 2224 1000 a9ec357c61e66523b2b1b94823f4ba2badb709e65e53c3b17b9d7aba80994513.exe lr679822.exe PID 1000 wrote to memory of 2224 1000 a9ec357c61e66523b2b1b94823f4ba2badb709e65e53c3b17b9d7aba80994513.exe lr679822.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9ec357c61e66523b2b1b94823f4ba2badb709e65e53c3b17b9d7aba80994513.exe"C:\Users\Admin\AppData\Local\Temp\a9ec357c61e66523b2b1b94823f4ba2badb709e65e53c3b17b9d7aba80994513.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zicU7818.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zicU7818.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr436735.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr436735.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku872385.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku872385.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 17284⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr679822.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr679822.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1944 -ip 19441⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr679822.exeFilesize
175KB
MD5317432ac22547442916b73abb1ac9391
SHA1a295c636369212933ce7244d93c7e54e09a0c74e
SHA256df113e106c9028deb76daac9b6672a11a525f82e48859bb66acc5b00103efcba
SHA5126c6f21b2312402ec24bd4a3dd9ad1addca52abb4579fff9f0e94dff6efbc275a11c3d345528d62cb46ed999306e2590ce42278a8a51467b824d0561b4462d06e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr679822.exeFilesize
175KB
MD5317432ac22547442916b73abb1ac9391
SHA1a295c636369212933ce7244d93c7e54e09a0c74e
SHA256df113e106c9028deb76daac9b6672a11a525f82e48859bb66acc5b00103efcba
SHA5126c6f21b2312402ec24bd4a3dd9ad1addca52abb4579fff9f0e94dff6efbc275a11c3d345528d62cb46ed999306e2590ce42278a8a51467b824d0561b4462d06e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zicU7818.exeFilesize
391KB
MD51eae177be08301af0010495b7ab35a13
SHA15a3caeebc57e158dd4f887393f3d2e85c2bcf590
SHA2560d1ee508392b504d343bc60d4e9882198d617f77ebabca519c08bb829b6504bf
SHA512c0a26542a7a3caea1e87c9965a81c04ed0e40df0423f1f1c684db2a342db3ab366a2c01f0bdbf199b415306b8ffe1ee68087623877f4eb7055858d7d0be8c8b6
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zicU7818.exeFilesize
391KB
MD51eae177be08301af0010495b7ab35a13
SHA15a3caeebc57e158dd4f887393f3d2e85c2bcf590
SHA2560d1ee508392b504d343bc60d4e9882198d617f77ebabca519c08bb829b6504bf
SHA512c0a26542a7a3caea1e87c9965a81c04ed0e40df0423f1f1c684db2a342db3ab366a2c01f0bdbf199b415306b8ffe1ee68087623877f4eb7055858d7d0be8c8b6
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr436735.exeFilesize
11KB
MD568a62fb3dd65f9531f7ca2f3d5087874
SHA18f1407831b9a5ddaca84ca3517d321d1f6ffd595
SHA25619d0707c0ba4781db3ed1f0a719f0d5f686ca252d738a8a833e1f1667a8a6686
SHA512a6f88a7564795573031d9718a5129046f55126b3fc909a62dad6abc8e22f1b3ef28edff904bbfd9e95e9e33a3aef97aea6a7e2b6b2d7f5f2684e53f6eebbabff
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr436735.exeFilesize
11KB
MD568a62fb3dd65f9531f7ca2f3d5087874
SHA18f1407831b9a5ddaca84ca3517d321d1f6ffd595
SHA25619d0707c0ba4781db3ed1f0a719f0d5f686ca252d738a8a833e1f1667a8a6686
SHA512a6f88a7564795573031d9718a5129046f55126b3fc909a62dad6abc8e22f1b3ef28edff904bbfd9e95e9e33a3aef97aea6a7e2b6b2d7f5f2684e53f6eebbabff
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku872385.exeFilesize
318KB
MD50426bf65cd3330a368acd9e8e80ed8a3
SHA1f1997a27775168861b08970c3dfdd0461eadc38a
SHA256bf6f2993ec77334c9b168fed9e17d95d4f2ce69c6f9e82e513af0196b9ffb1d1
SHA512fd8167497ceacb68120e016bb07c7852bbd91a02b23df15dd14cba9a4375eb87fcd984bae35edfce40ea6eee1de0d15dc417349ec8207246e572c43198df98d5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku872385.exeFilesize
318KB
MD50426bf65cd3330a368acd9e8e80ed8a3
SHA1f1997a27775168861b08970c3dfdd0461eadc38a
SHA256bf6f2993ec77334c9b168fed9e17d95d4f2ce69c6f9e82e513af0196b9ffb1d1
SHA512fd8167497ceacb68120e016bb07c7852bbd91a02b23df15dd14cba9a4375eb87fcd984bae35edfce40ea6eee1de0d15dc417349ec8207246e572c43198df98d5
-
memory/1944-153-0x0000000002150000-0x000000000219B000-memory.dmpFilesize
300KB
-
memory/1944-154-0x0000000004C00000-0x00000000051A4000-memory.dmpFilesize
5.6MB
-
memory/1944-155-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1944-156-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1944-158-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1944-160-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1944-162-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1944-164-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1944-166-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1944-168-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1944-170-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1944-172-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1944-174-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1944-176-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1944-178-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1944-181-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/1944-180-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1944-185-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/1944-184-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1944-183-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/1944-187-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1944-189-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1944-191-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1944-193-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1944-195-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1944-197-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1944-199-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1944-201-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1944-203-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1944-205-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1944-207-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1944-209-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1944-211-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1944-213-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1944-215-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1944-217-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1944-219-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1944-221-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1944-1064-0x00000000052B0000-0x00000000058C8000-memory.dmpFilesize
6.1MB
-
memory/1944-1065-0x00000000058D0000-0x00000000059DA000-memory.dmpFilesize
1.0MB
-
memory/1944-1066-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/1944-1067-0x0000000005B00000-0x0000000005B3C000-memory.dmpFilesize
240KB
-
memory/1944-1068-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/1944-1070-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/1944-1071-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/1944-1072-0x00000000064A0000-0x0000000006516000-memory.dmpFilesize
472KB
-
memory/1944-1073-0x0000000006520000-0x0000000006570000-memory.dmpFilesize
320KB
-
memory/1944-1074-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/1944-1075-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/1944-1076-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/1944-1077-0x0000000006590000-0x0000000006752000-memory.dmpFilesize
1.8MB
-
memory/1944-1078-0x0000000006770000-0x0000000006C9C000-memory.dmpFilesize
5.2MB
-
memory/1944-1079-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/2156-147-0x0000000000A30000-0x0000000000A3A000-memory.dmpFilesize
40KB
-
memory/2224-1085-0x0000000000CA0000-0x0000000000CD2000-memory.dmpFilesize
200KB
-
memory/2224-1086-0x0000000005540000-0x0000000005550000-memory.dmpFilesize
64KB