Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 20:07
Static task
static1
Behavioral task
behavioral1
Sample
b5980c454bd94ea0a286cb0d9db4b7638ac1a3aabccba063bc9e9214df923501.exe
Resource
win10v2004-20230221-en
General
-
Target
b5980c454bd94ea0a286cb0d9db4b7638ac1a3aabccba063bc9e9214df923501.exe
-
Size
672KB
-
MD5
ef5a2fd9d4a1038e5119a85ae642ab74
-
SHA1
d795161efbbd79ba1cf42210b3a06237033eb803
-
SHA256
b5980c454bd94ea0a286cb0d9db4b7638ac1a3aabccba063bc9e9214df923501
-
SHA512
fe0e0b25b6bf237a5a4c3b3909dd8bd30a10d865bc2c59a2908e102d5d06a12b6285cf8e161ef11128381d14baa1c80a7a5405cf43c4d25cf1742399517d7548
-
SSDEEP
12288:UMrhy90irybJuDOOt4byl2W9R6bJ+ovRG62wvdBObOrXmmI4a:lyebJkOOt4b5O6EgRG62w+bavS
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro4549.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro4549.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro4549.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro4549.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro4549.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro4549.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro4549.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/4348-193-0x00000000025B0000-0x00000000025EF000-memory.dmp family_redline behavioral1/memory/4348-198-0x00000000025B0000-0x00000000025EF000-memory.dmp family_redline behavioral1/memory/4348-195-0x00000000025B0000-0x00000000025EF000-memory.dmp family_redline behavioral1/memory/4348-200-0x00000000025B0000-0x00000000025EF000-memory.dmp family_redline behavioral1/memory/4348-202-0x00000000025B0000-0x00000000025EF000-memory.dmp family_redline behavioral1/memory/4348-204-0x00000000025B0000-0x00000000025EF000-memory.dmp family_redline behavioral1/memory/4348-206-0x00000000025B0000-0x00000000025EF000-memory.dmp family_redline behavioral1/memory/4348-208-0x00000000025B0000-0x00000000025EF000-memory.dmp family_redline behavioral1/memory/4348-210-0x00000000025B0000-0x00000000025EF000-memory.dmp family_redline behavioral1/memory/4348-212-0x00000000025B0000-0x00000000025EF000-memory.dmp family_redline behavioral1/memory/4348-214-0x00000000025B0000-0x00000000025EF000-memory.dmp family_redline behavioral1/memory/4348-216-0x00000000025B0000-0x00000000025EF000-memory.dmp family_redline behavioral1/memory/4348-218-0x00000000025B0000-0x00000000025EF000-memory.dmp family_redline behavioral1/memory/4348-220-0x00000000025B0000-0x00000000025EF000-memory.dmp family_redline behavioral1/memory/4348-222-0x00000000025B0000-0x00000000025EF000-memory.dmp family_redline behavioral1/memory/4348-224-0x00000000025B0000-0x00000000025EF000-memory.dmp family_redline behavioral1/memory/4348-226-0x00000000025B0000-0x00000000025EF000-memory.dmp family_redline behavioral1/memory/4348-228-0x00000000025B0000-0x00000000025EF000-memory.dmp family_redline behavioral1/memory/4348-1111-0x00000000025A0000-0x00000000025B0000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un157012.exepro4549.exequ7547.exesi195226.exepid process 2336 un157012.exe 2136 pro4549.exe 4348 qu7547.exe 4312 si195226.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro4549.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro4549.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro4549.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
b5980c454bd94ea0a286cb0d9db4b7638ac1a3aabccba063bc9e9214df923501.exeun157012.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce b5980c454bd94ea0a286cb0d9db4b7638ac1a3aabccba063bc9e9214df923501.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" b5980c454bd94ea0a286cb0d9db4b7638ac1a3aabccba063bc9e9214df923501.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un157012.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un157012.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 1820 sc.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3804 2136 WerFault.exe pro4549.exe 1800 4348 WerFault.exe qu7547.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro4549.exequ7547.exesi195226.exepid process 2136 pro4549.exe 2136 pro4549.exe 4348 qu7547.exe 4348 qu7547.exe 4312 si195226.exe 4312 si195226.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro4549.exequ7547.exesi195226.exedescription pid process Token: SeDebugPrivilege 2136 pro4549.exe Token: SeDebugPrivilege 4348 qu7547.exe Token: SeDebugPrivilege 4312 si195226.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
b5980c454bd94ea0a286cb0d9db4b7638ac1a3aabccba063bc9e9214df923501.exeun157012.exedescription pid process target process PID 4560 wrote to memory of 2336 4560 b5980c454bd94ea0a286cb0d9db4b7638ac1a3aabccba063bc9e9214df923501.exe un157012.exe PID 4560 wrote to memory of 2336 4560 b5980c454bd94ea0a286cb0d9db4b7638ac1a3aabccba063bc9e9214df923501.exe un157012.exe PID 4560 wrote to memory of 2336 4560 b5980c454bd94ea0a286cb0d9db4b7638ac1a3aabccba063bc9e9214df923501.exe un157012.exe PID 2336 wrote to memory of 2136 2336 un157012.exe pro4549.exe PID 2336 wrote to memory of 2136 2336 un157012.exe pro4549.exe PID 2336 wrote to memory of 2136 2336 un157012.exe pro4549.exe PID 2336 wrote to memory of 4348 2336 un157012.exe qu7547.exe PID 2336 wrote to memory of 4348 2336 un157012.exe qu7547.exe PID 2336 wrote to memory of 4348 2336 un157012.exe qu7547.exe PID 4560 wrote to memory of 4312 4560 b5980c454bd94ea0a286cb0d9db4b7638ac1a3aabccba063bc9e9214df923501.exe si195226.exe PID 4560 wrote to memory of 4312 4560 b5980c454bd94ea0a286cb0d9db4b7638ac1a3aabccba063bc9e9214df923501.exe si195226.exe PID 4560 wrote to memory of 4312 4560 b5980c454bd94ea0a286cb0d9db4b7638ac1a3aabccba063bc9e9214df923501.exe si195226.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5980c454bd94ea0a286cb0d9db4b7638ac1a3aabccba063bc9e9214df923501.exe"C:\Users\Admin\AppData\Local\Temp\b5980c454bd94ea0a286cb0d9db4b7638ac1a3aabccba063bc9e9214df923501.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un157012.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un157012.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4549.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4549.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 10204⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7547.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7547.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 13284⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si195226.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si195226.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2136 -ip 21361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4348 -ip 43481⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si195226.exeFilesize
175KB
MD56ded39b3a52e5a99ad5c7d16e73a6b65
SHA146f2e47ad04111dd075f89ad82d2d8a5b57818f2
SHA256173d063350cd9a952527eda2b7e3067bc0c9d8bd1042bcae6217305a2a53c162
SHA512f3a0fb73e3e98ce6ffe7a626ff0808885d9f273ec0cfd4f2e885d47bcad59607e5d12646af8fa4806467ab4103ad0782a9c6b2a7de4540d7443b50428c0636d1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si195226.exeFilesize
175KB
MD56ded39b3a52e5a99ad5c7d16e73a6b65
SHA146f2e47ad04111dd075f89ad82d2d8a5b57818f2
SHA256173d063350cd9a952527eda2b7e3067bc0c9d8bd1042bcae6217305a2a53c162
SHA512f3a0fb73e3e98ce6ffe7a626ff0808885d9f273ec0cfd4f2e885d47bcad59607e5d12646af8fa4806467ab4103ad0782a9c6b2a7de4540d7443b50428c0636d1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un157012.exeFilesize
530KB
MD5db3e86d09597ef41c4d37ec429c448f7
SHA1005f284fc4eec8063fc6e8c8c7697211925dca79
SHA256f63f4b2037fb4724cd92a41a1cdbc98cf9edfdc5dda08304ce7961124762bfad
SHA5128f022d4964dc5790e3bdcfcf65cb8592fcf11b27e8ece2f7dcb4b35e208bdcf80489b4811f8c37bb6e95bb0473fbea670ffb861e0734860cf98db89d651af45d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un157012.exeFilesize
530KB
MD5db3e86d09597ef41c4d37ec429c448f7
SHA1005f284fc4eec8063fc6e8c8c7697211925dca79
SHA256f63f4b2037fb4724cd92a41a1cdbc98cf9edfdc5dda08304ce7961124762bfad
SHA5128f022d4964dc5790e3bdcfcf65cb8592fcf11b27e8ece2f7dcb4b35e208bdcf80489b4811f8c37bb6e95bb0473fbea670ffb861e0734860cf98db89d651af45d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4549.exeFilesize
260KB
MD53ec04fedb635aeed3886e2a6d107cceb
SHA19c6b5329be7426f3649887ee1accd6657fd3f9ca
SHA256eee7947a079d9cda55725fd512bab09357972e0406d358b54b146cce1ec624ea
SHA5125ae62ca7b610e78a58bb4a41efc0665e523a309c3bd35d1119d8e2c879f2ab7e3929017d34ab9af2674d3786b90ea666f13033c608f65dd1980e90a0a7a14760
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4549.exeFilesize
260KB
MD53ec04fedb635aeed3886e2a6d107cceb
SHA19c6b5329be7426f3649887ee1accd6657fd3f9ca
SHA256eee7947a079d9cda55725fd512bab09357972e0406d358b54b146cce1ec624ea
SHA5125ae62ca7b610e78a58bb4a41efc0665e523a309c3bd35d1119d8e2c879f2ab7e3929017d34ab9af2674d3786b90ea666f13033c608f65dd1980e90a0a7a14760
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7547.exeFilesize
318KB
MD5e0dbd8c4086d348c1ea98be7664ef09c
SHA1a925a67295ead8475a3c283bbd81c534d6309f75
SHA256fc7484bfb866558afec4b619db8fec2eb787fb4aaae7d9327153b48a8eef373a
SHA512c6dd53e9874c31892b931eecab71fc0e730bdb92d4e6c108cf53356e5d7679e6d68ad01fd44eee53e3f2e133267ace0d979919706e82b15f8fed6c7ab6d4e96e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7547.exeFilesize
318KB
MD5e0dbd8c4086d348c1ea98be7664ef09c
SHA1a925a67295ead8475a3c283bbd81c534d6309f75
SHA256fc7484bfb866558afec4b619db8fec2eb787fb4aaae7d9327153b48a8eef373a
SHA512c6dd53e9874c31892b931eecab71fc0e730bdb92d4e6c108cf53356e5d7679e6d68ad01fd44eee53e3f2e133267ace0d979919706e82b15f8fed6c7ab6d4e96e
-
memory/2136-148-0x0000000004B60000-0x0000000005104000-memory.dmpFilesize
5.6MB
-
memory/2136-149-0x0000000000540000-0x000000000056D000-memory.dmpFilesize
180KB
-
memory/2136-150-0x0000000002530000-0x0000000002540000-memory.dmpFilesize
64KB
-
memory/2136-151-0x0000000002530000-0x0000000002540000-memory.dmpFilesize
64KB
-
memory/2136-152-0x0000000002530000-0x0000000002540000-memory.dmpFilesize
64KB
-
memory/2136-153-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/2136-154-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/2136-156-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/2136-158-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/2136-160-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/2136-162-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/2136-166-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/2136-164-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/2136-168-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/2136-170-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/2136-172-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/2136-174-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/2136-176-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/2136-178-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/2136-180-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/2136-181-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/2136-182-0x0000000002530000-0x0000000002540000-memory.dmpFilesize
64KB
-
memory/2136-183-0x0000000002530000-0x0000000002540000-memory.dmpFilesize
64KB
-
memory/2136-184-0x0000000002530000-0x0000000002540000-memory.dmpFilesize
64KB
-
memory/2136-186-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/4312-1122-0x00000000008C0000-0x00000000008F2000-memory.dmpFilesize
200KB
-
memory/4312-1123-0x00000000051D0000-0x00000000051E0000-memory.dmpFilesize
64KB
-
memory/4348-193-0x00000000025B0000-0x00000000025EF000-memory.dmpFilesize
252KB
-
memory/4348-226-0x00000000025B0000-0x00000000025EF000-memory.dmpFilesize
252KB
-
memory/4348-198-0x00000000025B0000-0x00000000025EF000-memory.dmpFilesize
252KB
-
memory/4348-195-0x00000000025B0000-0x00000000025EF000-memory.dmpFilesize
252KB
-
memory/4348-194-0x00000000025A0000-0x00000000025B0000-memory.dmpFilesize
64KB
-
memory/4348-197-0x00000000025A0000-0x00000000025B0000-memory.dmpFilesize
64KB
-
memory/4348-200-0x00000000025B0000-0x00000000025EF000-memory.dmpFilesize
252KB
-
memory/4348-202-0x00000000025B0000-0x00000000025EF000-memory.dmpFilesize
252KB
-
memory/4348-204-0x00000000025B0000-0x00000000025EF000-memory.dmpFilesize
252KB
-
memory/4348-206-0x00000000025B0000-0x00000000025EF000-memory.dmpFilesize
252KB
-
memory/4348-208-0x00000000025B0000-0x00000000025EF000-memory.dmpFilesize
252KB
-
memory/4348-210-0x00000000025B0000-0x00000000025EF000-memory.dmpFilesize
252KB
-
memory/4348-212-0x00000000025B0000-0x00000000025EF000-memory.dmpFilesize
252KB
-
memory/4348-214-0x00000000025B0000-0x00000000025EF000-memory.dmpFilesize
252KB
-
memory/4348-216-0x00000000025B0000-0x00000000025EF000-memory.dmpFilesize
252KB
-
memory/4348-218-0x00000000025B0000-0x00000000025EF000-memory.dmpFilesize
252KB
-
memory/4348-220-0x00000000025B0000-0x00000000025EF000-memory.dmpFilesize
252KB
-
memory/4348-222-0x00000000025B0000-0x00000000025EF000-memory.dmpFilesize
252KB
-
memory/4348-224-0x00000000025B0000-0x00000000025EF000-memory.dmpFilesize
252KB
-
memory/4348-192-0x00000000025A0000-0x00000000025B0000-memory.dmpFilesize
64KB
-
memory/4348-228-0x00000000025B0000-0x00000000025EF000-memory.dmpFilesize
252KB
-
memory/4348-1101-0x0000000005100000-0x0000000005718000-memory.dmpFilesize
6.1MB
-
memory/4348-1102-0x0000000005760000-0x000000000586A000-memory.dmpFilesize
1.0MB
-
memory/4348-1103-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/4348-1104-0x00000000058C0000-0x00000000058FC000-memory.dmpFilesize
240KB
-
memory/4348-1105-0x00000000025A0000-0x00000000025B0000-memory.dmpFilesize
64KB
-
memory/4348-1106-0x0000000005BB0000-0x0000000005C16000-memory.dmpFilesize
408KB
-
memory/4348-1107-0x0000000006270000-0x0000000006302000-memory.dmpFilesize
584KB
-
memory/4348-1109-0x00000000025A0000-0x00000000025B0000-memory.dmpFilesize
64KB
-
memory/4348-1110-0x00000000025A0000-0x00000000025B0000-memory.dmpFilesize
64KB
-
memory/4348-1111-0x00000000025A0000-0x00000000025B0000-memory.dmpFilesize
64KB
-
memory/4348-1112-0x0000000006370000-0x0000000006532000-memory.dmpFilesize
1.8MB
-
memory/4348-1113-0x0000000006550000-0x0000000006A7C000-memory.dmpFilesize
5.2MB
-
memory/4348-191-0x0000000000660000-0x00000000006AB000-memory.dmpFilesize
300KB
-
memory/4348-1114-0x0000000006BB0000-0x0000000006C26000-memory.dmpFilesize
472KB
-
memory/4348-1115-0x0000000006C40000-0x0000000006C90000-memory.dmpFilesize
320KB
-
memory/4348-1116-0x00000000025A0000-0x00000000025B0000-memory.dmpFilesize
64KB