Analysis
-
max time kernel
111s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 20:11
Static task
static1
Behavioral task
behavioral1
Sample
bd1e66d6d2102fe8cf6a06ec0931bcbde14d4f8698f0abc74b60884a45c1a31b.exe
Resource
win10v2004-20230221-en
General
-
Target
bd1e66d6d2102fe8cf6a06ec0931bcbde14d4f8698f0abc74b60884a45c1a31b.exe
-
Size
673KB
-
MD5
5ea43ac5d7b11c56f26a634cf421b647
-
SHA1
61b9bf645224294ee184ee62deb007c77455d7ca
-
SHA256
bd1e66d6d2102fe8cf6a06ec0931bcbde14d4f8698f0abc74b60884a45c1a31b
-
SHA512
e243f4f62ab1ae08cccf46cb4f79bfff9e8fc56f31a627589b4dbab2d0d8c35f7272ad8f226e3b42644ef5e587380884ff06db76878732352dda74e2981ce986
-
SSDEEP
12288:gMriy90MjrhqLGq+jU4bqUoUzGlMW9RTbJ+of58C0YH9ObyramNmY65vV:yysGLjJm1UzvOdE2+0sbVYmZ59
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro4733.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro4733.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro4733.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro4733.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro4733.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro4733.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro4733.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/672-190-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/672-191-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/672-193-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/672-195-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/672-197-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/672-199-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/672-201-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/672-203-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/672-205-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/672-207-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/672-209-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/672-211-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/672-213-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/672-215-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/672-217-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/672-219-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/672-221-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/672-223-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un227640.exepro4733.exequ6927.exesi734843.exepid process 4456 un227640.exe 3680 pro4733.exe 672 qu6927.exe 4932 si734843.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro4733.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro4733.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro4733.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
bd1e66d6d2102fe8cf6a06ec0931bcbde14d4f8698f0abc74b60884a45c1a31b.exeun227640.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" bd1e66d6d2102fe8cf6a06ec0931bcbde14d4f8698f0abc74b60884a45c1a31b.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un227640.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un227640.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce bd1e66d6d2102fe8cf6a06ec0931bcbde14d4f8698f0abc74b60884a45c1a31b.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2140 3680 WerFault.exe pro4733.exe 936 672 WerFault.exe qu6927.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro4733.exequ6927.exesi734843.exepid process 3680 pro4733.exe 3680 pro4733.exe 672 qu6927.exe 672 qu6927.exe 4932 si734843.exe 4932 si734843.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro4733.exequ6927.exesi734843.exedescription pid process Token: SeDebugPrivilege 3680 pro4733.exe Token: SeDebugPrivilege 672 qu6927.exe Token: SeDebugPrivilege 4932 si734843.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
bd1e66d6d2102fe8cf6a06ec0931bcbde14d4f8698f0abc74b60884a45c1a31b.exeun227640.exedescription pid process target process PID 2700 wrote to memory of 4456 2700 bd1e66d6d2102fe8cf6a06ec0931bcbde14d4f8698f0abc74b60884a45c1a31b.exe un227640.exe PID 2700 wrote to memory of 4456 2700 bd1e66d6d2102fe8cf6a06ec0931bcbde14d4f8698f0abc74b60884a45c1a31b.exe un227640.exe PID 2700 wrote to memory of 4456 2700 bd1e66d6d2102fe8cf6a06ec0931bcbde14d4f8698f0abc74b60884a45c1a31b.exe un227640.exe PID 4456 wrote to memory of 3680 4456 un227640.exe pro4733.exe PID 4456 wrote to memory of 3680 4456 un227640.exe pro4733.exe PID 4456 wrote to memory of 3680 4456 un227640.exe pro4733.exe PID 4456 wrote to memory of 672 4456 un227640.exe qu6927.exe PID 4456 wrote to memory of 672 4456 un227640.exe qu6927.exe PID 4456 wrote to memory of 672 4456 un227640.exe qu6927.exe PID 2700 wrote to memory of 4932 2700 bd1e66d6d2102fe8cf6a06ec0931bcbde14d4f8698f0abc74b60884a45c1a31b.exe si734843.exe PID 2700 wrote to memory of 4932 2700 bd1e66d6d2102fe8cf6a06ec0931bcbde14d4f8698f0abc74b60884a45c1a31b.exe si734843.exe PID 2700 wrote to memory of 4932 2700 bd1e66d6d2102fe8cf6a06ec0931bcbde14d4f8698f0abc74b60884a45c1a31b.exe si734843.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd1e66d6d2102fe8cf6a06ec0931bcbde14d4f8698f0abc74b60884a45c1a31b.exe"C:\Users\Admin\AppData\Local\Temp\bd1e66d6d2102fe8cf6a06ec0931bcbde14d4f8698f0abc74b60884a45c1a31b.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un227640.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un227640.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4733.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4733.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 10804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6927.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6927.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 672 -s 15684⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si734843.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si734843.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3680 -ip 36801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 672 -ip 6721⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si734843.exeFilesize
175KB
MD59a3119c724abc2e135f182033a4c0c6b
SHA1b02e0916be974d0846b603024796c9659001baec
SHA256f57c71878c0ec87c3fbf69dd1e11d876a54e6998986bac9181d1143a81a96572
SHA5122d44fabbf33c5552fa50d5b972ce22ac8dbd7c91ef3dd5d5d1ec2ee3fb9e58bd1c0643230dddc7f302c0cfe22a0afe3c6f64d00bc283fc9366b9f7f1a05f0bce
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si734843.exeFilesize
175KB
MD59a3119c724abc2e135f182033a4c0c6b
SHA1b02e0916be974d0846b603024796c9659001baec
SHA256f57c71878c0ec87c3fbf69dd1e11d876a54e6998986bac9181d1143a81a96572
SHA5122d44fabbf33c5552fa50d5b972ce22ac8dbd7c91ef3dd5d5d1ec2ee3fb9e58bd1c0643230dddc7f302c0cfe22a0afe3c6f64d00bc283fc9366b9f7f1a05f0bce
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un227640.exeFilesize
530KB
MD5df599675daedab1fe6a31c203ea6bb6f
SHA14ab858f7bd36ee4ee73585c7b42a7c59a2fd6c63
SHA2565363c2804615721886fb4932d8559385cdf996cb1943805e3969b8ea7dda1a1b
SHA512a19315b3652520845b077534094fb5a159468000c0f5b513cbcec52213e7bca25b5775853a42c93d36a5476c0523b6ac6ff9b93243162ed8f5b2140a9aa10528
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un227640.exeFilesize
530KB
MD5df599675daedab1fe6a31c203ea6bb6f
SHA14ab858f7bd36ee4ee73585c7b42a7c59a2fd6c63
SHA2565363c2804615721886fb4932d8559385cdf996cb1943805e3969b8ea7dda1a1b
SHA512a19315b3652520845b077534094fb5a159468000c0f5b513cbcec52213e7bca25b5775853a42c93d36a5476c0523b6ac6ff9b93243162ed8f5b2140a9aa10528
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4733.exeFilesize
260KB
MD5720edae5964fdd2240c088e40fd5303c
SHA14fafdb047067fcee8578a3b2fd6331f2c6912b32
SHA256f8a6c6b91785054b92025d51cc31eb6991ba365156da19637270cd4436eea2e6
SHA512be45d93763e5614bdf80e977dc702b8c4c1ee323b30d7c882d550988296e3efba732288a5854c4b928206c0e0ccb28d62b61ab0ba831edd3d46d9bcbaf2cec90
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4733.exeFilesize
260KB
MD5720edae5964fdd2240c088e40fd5303c
SHA14fafdb047067fcee8578a3b2fd6331f2c6912b32
SHA256f8a6c6b91785054b92025d51cc31eb6991ba365156da19637270cd4436eea2e6
SHA512be45d93763e5614bdf80e977dc702b8c4c1ee323b30d7c882d550988296e3efba732288a5854c4b928206c0e0ccb28d62b61ab0ba831edd3d46d9bcbaf2cec90
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6927.exeFilesize
318KB
MD5f7597a51d4afd3e898e8fb7ba08796b7
SHA15e75f7f95385a71faa2078a17d5fc63ace5b090e
SHA25671e2e517be7c3ec11f8e9a722f9c4381d5c5b80a359068208fd85e2ef30973b7
SHA512ac795e96deaf40e9c3c81fcbcbb10082a04b7413d00787700e04199a6b0e6ca4e6c1f1af6e211636f01ca30ada1f8b27b916f031bf4a77d65bce92565dafbdb5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6927.exeFilesize
318KB
MD5f7597a51d4afd3e898e8fb7ba08796b7
SHA15e75f7f95385a71faa2078a17d5fc63ace5b090e
SHA25671e2e517be7c3ec11f8e9a722f9c4381d5c5b80a359068208fd85e2ef30973b7
SHA512ac795e96deaf40e9c3c81fcbcbb10082a04b7413d00787700e04199a6b0e6ca4e6c1f1af6e211636f01ca30ada1f8b27b916f031bf4a77d65bce92565dafbdb5
-
memory/672-1099-0x00000000050C0000-0x00000000056D8000-memory.dmpFilesize
6.1MB
-
memory/672-1102-0x00000000058C0000-0x00000000058FC000-memory.dmpFilesize
240KB
-
memory/672-1114-0x00000000021F0000-0x0000000002200000-memory.dmpFilesize
64KB
-
memory/672-1113-0x0000000006C40000-0x0000000006C90000-memory.dmpFilesize
320KB
-
memory/672-1112-0x0000000006BC0000-0x0000000006C36000-memory.dmpFilesize
472KB
-
memory/672-1111-0x00000000021F0000-0x0000000002200000-memory.dmpFilesize
64KB
-
memory/672-1110-0x00000000021F0000-0x0000000002200000-memory.dmpFilesize
64KB
-
memory/672-1109-0x00000000021F0000-0x0000000002200000-memory.dmpFilesize
64KB
-
memory/672-1108-0x0000000006540000-0x0000000006A6C000-memory.dmpFilesize
5.2MB
-
memory/672-1107-0x0000000006370000-0x0000000006532000-memory.dmpFilesize
1.8MB
-
memory/672-1106-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/672-1104-0x0000000005BB0000-0x0000000005C42000-memory.dmpFilesize
584KB
-
memory/672-1103-0x00000000021F0000-0x0000000002200000-memory.dmpFilesize
64KB
-
memory/672-1101-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/672-1100-0x0000000005760000-0x000000000586A000-memory.dmpFilesize
1.0MB
-
memory/672-304-0x00000000021F0000-0x0000000002200000-memory.dmpFilesize
64KB
-
memory/672-302-0x00000000021F0000-0x0000000002200000-memory.dmpFilesize
64KB
-
memory/672-301-0x0000000000610000-0x000000000065B000-memory.dmpFilesize
300KB
-
memory/672-223-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/672-221-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/672-219-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/672-217-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/672-190-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/672-191-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/672-193-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/672-195-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/672-197-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/672-199-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/672-201-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/672-203-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/672-205-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/672-207-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/672-209-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/672-211-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/672-213-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/672-215-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/3680-172-0x0000000002440000-0x0000000002452000-memory.dmpFilesize
72KB
-
memory/3680-185-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/3680-170-0x0000000002440000-0x0000000002452000-memory.dmpFilesize
72KB
-
memory/3680-168-0x0000000002440000-0x0000000002452000-memory.dmpFilesize
72KB
-
memory/3680-182-0x0000000002430000-0x0000000002440000-memory.dmpFilesize
64KB
-
memory/3680-181-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/3680-180-0x0000000002440000-0x0000000002452000-memory.dmpFilesize
72KB
-
memory/3680-151-0x0000000002430000-0x0000000002440000-memory.dmpFilesize
64KB
-
memory/3680-176-0x0000000002440000-0x0000000002452000-memory.dmpFilesize
72KB
-
memory/3680-178-0x0000000002440000-0x0000000002452000-memory.dmpFilesize
72KB
-
memory/3680-153-0x0000000002440000-0x0000000002452000-memory.dmpFilesize
72KB
-
memory/3680-174-0x0000000002440000-0x0000000002452000-memory.dmpFilesize
72KB
-
memory/3680-149-0x0000000000610000-0x000000000063D000-memory.dmpFilesize
180KB
-
memory/3680-152-0x0000000002430000-0x0000000002440000-memory.dmpFilesize
64KB
-
memory/3680-183-0x0000000002430000-0x0000000002440000-memory.dmpFilesize
64KB
-
memory/3680-166-0x0000000002440000-0x0000000002452000-memory.dmpFilesize
72KB
-
memory/3680-164-0x0000000002440000-0x0000000002452000-memory.dmpFilesize
72KB
-
memory/3680-162-0x0000000002440000-0x0000000002452000-memory.dmpFilesize
72KB
-
memory/3680-160-0x0000000002440000-0x0000000002452000-memory.dmpFilesize
72KB
-
memory/3680-158-0x0000000002440000-0x0000000002452000-memory.dmpFilesize
72KB
-
memory/3680-156-0x0000000002440000-0x0000000002452000-memory.dmpFilesize
72KB
-
memory/3680-154-0x0000000002440000-0x0000000002452000-memory.dmpFilesize
72KB
-
memory/3680-150-0x0000000002430000-0x0000000002440000-memory.dmpFilesize
64KB
-
memory/3680-148-0x0000000004AF0000-0x0000000005094000-memory.dmpFilesize
5.6MB
-
memory/4932-1120-0x0000000000EB0000-0x0000000000EE2000-memory.dmpFilesize
200KB
-
memory/4932-1121-0x0000000005730000-0x0000000005740000-memory.dmpFilesize
64KB