Analysis
-
max time kernel
57s -
max time network
148s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
31-03-2023 20:10
Static task
static1
Behavioral task
behavioral1
Sample
1138d90093a60709b3350f7231424f9bcba2b655e7efa3af06db362f15176d20.exe
Resource
win10-20230220-en
General
-
Target
1138d90093a60709b3350f7231424f9bcba2b655e7efa3af06db362f15176d20.exe
-
Size
533KB
-
MD5
f811751941af06cdc124494550b81979
-
SHA1
b07761e4a3d20f38407fc4e8275c4937ee3aa9e2
-
SHA256
1138d90093a60709b3350f7231424f9bcba2b655e7efa3af06db362f15176d20
-
SHA512
9eaa3ace6133928de53ec9efa0776bb7ba777919b8812e01b3b0244557415509477a0d23c6e8b9a7aa757e7c6af47a4adb48ddddd2cc32ce1484e93d5b09e67c
-
SSDEEP
12288:OMrwy90LuaqWa50moccPxvLJqeFeWhdOb5r7ceuz0V9l:SyY5jxubyeQ07l
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr308311.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr308311.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr308311.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr308311.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr308311.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr308311.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 37 IoCs
Processes:
resource yara_rule behavioral1/memory/4892-140-0x0000000002200000-0x0000000002246000-memory.dmp family_redline behavioral1/memory/4892-142-0x00000000022B0000-0x00000000022F4000-memory.dmp family_redline behavioral1/memory/4892-143-0x00000000022B0000-0x00000000022EF000-memory.dmp family_redline behavioral1/memory/4892-147-0x00000000022B0000-0x00000000022EF000-memory.dmp family_redline behavioral1/memory/4892-144-0x00000000022B0000-0x00000000022EF000-memory.dmp family_redline behavioral1/memory/4892-150-0x00000000022B0000-0x00000000022EF000-memory.dmp family_redline behavioral1/memory/4892-153-0x00000000022B0000-0x00000000022EF000-memory.dmp family_redline behavioral1/memory/4892-155-0x00000000022B0000-0x00000000022EF000-memory.dmp family_redline behavioral1/memory/4892-157-0x00000000022B0000-0x00000000022EF000-memory.dmp family_redline behavioral1/memory/4892-159-0x00000000022B0000-0x00000000022EF000-memory.dmp family_redline behavioral1/memory/4892-161-0x00000000022B0000-0x00000000022EF000-memory.dmp family_redline behavioral1/memory/4892-163-0x00000000022B0000-0x00000000022EF000-memory.dmp family_redline behavioral1/memory/4892-165-0x00000000022B0000-0x00000000022EF000-memory.dmp family_redline behavioral1/memory/4892-167-0x00000000022B0000-0x00000000022EF000-memory.dmp family_redline behavioral1/memory/4892-169-0x00000000022B0000-0x00000000022EF000-memory.dmp family_redline behavioral1/memory/4892-171-0x00000000022B0000-0x00000000022EF000-memory.dmp family_redline behavioral1/memory/4892-173-0x00000000022B0000-0x00000000022EF000-memory.dmp family_redline behavioral1/memory/4892-175-0x00000000022B0000-0x00000000022EF000-memory.dmp family_redline behavioral1/memory/4892-177-0x00000000022B0000-0x00000000022EF000-memory.dmp family_redline behavioral1/memory/4892-179-0x00000000022B0000-0x00000000022EF000-memory.dmp family_redline behavioral1/memory/4892-181-0x00000000022B0000-0x00000000022EF000-memory.dmp family_redline behavioral1/memory/4892-183-0x00000000022B0000-0x00000000022EF000-memory.dmp family_redline behavioral1/memory/4892-185-0x00000000022B0000-0x00000000022EF000-memory.dmp family_redline behavioral1/memory/4892-187-0x00000000022B0000-0x00000000022EF000-memory.dmp family_redline behavioral1/memory/4892-189-0x00000000022B0000-0x00000000022EF000-memory.dmp family_redline behavioral1/memory/4892-191-0x00000000022B0000-0x00000000022EF000-memory.dmp family_redline behavioral1/memory/4892-193-0x00000000022B0000-0x00000000022EF000-memory.dmp family_redline behavioral1/memory/4892-195-0x00000000022B0000-0x00000000022EF000-memory.dmp family_redline behavioral1/memory/4892-197-0x00000000022B0000-0x00000000022EF000-memory.dmp family_redline behavioral1/memory/4892-199-0x00000000022B0000-0x00000000022EF000-memory.dmp family_redline behavioral1/memory/4892-201-0x00000000022B0000-0x00000000022EF000-memory.dmp family_redline behavioral1/memory/4892-203-0x00000000022B0000-0x00000000022EF000-memory.dmp family_redline behavioral1/memory/4892-205-0x00000000022B0000-0x00000000022EF000-memory.dmp family_redline behavioral1/memory/4892-207-0x00000000022B0000-0x00000000022EF000-memory.dmp family_redline behavioral1/memory/4892-209-0x00000000022B0000-0x00000000022EF000-memory.dmp family_redline behavioral1/memory/4892-1062-0x0000000004E20000-0x0000000004E30000-memory.dmp family_redline behavioral1/memory/4892-1063-0x0000000004E20000-0x0000000004E30000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
ziwJ4256.exejr308311.exeku448615.exelr760975.exepid process 4140 ziwJ4256.exe 4312 jr308311.exe 4892 ku448615.exe 1952 lr760975.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr308311.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr308311.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
ziwJ4256.exe1138d90093a60709b3350f7231424f9bcba2b655e7efa3af06db362f15176d20.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziwJ4256.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziwJ4256.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 1138d90093a60709b3350f7231424f9bcba2b655e7efa3af06db362f15176d20.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1138d90093a60709b3350f7231424f9bcba2b655e7efa3af06db362f15176d20.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr308311.exeku448615.exelr760975.exepid process 4312 jr308311.exe 4312 jr308311.exe 4892 ku448615.exe 4892 ku448615.exe 1952 lr760975.exe 1952 lr760975.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr308311.exeku448615.exelr760975.exedescription pid process Token: SeDebugPrivilege 4312 jr308311.exe Token: SeDebugPrivilege 4892 ku448615.exe Token: SeDebugPrivilege 1952 lr760975.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
1138d90093a60709b3350f7231424f9bcba2b655e7efa3af06db362f15176d20.exeziwJ4256.exedescription pid process target process PID 4108 wrote to memory of 4140 4108 1138d90093a60709b3350f7231424f9bcba2b655e7efa3af06db362f15176d20.exe ziwJ4256.exe PID 4108 wrote to memory of 4140 4108 1138d90093a60709b3350f7231424f9bcba2b655e7efa3af06db362f15176d20.exe ziwJ4256.exe PID 4108 wrote to memory of 4140 4108 1138d90093a60709b3350f7231424f9bcba2b655e7efa3af06db362f15176d20.exe ziwJ4256.exe PID 4140 wrote to memory of 4312 4140 ziwJ4256.exe jr308311.exe PID 4140 wrote to memory of 4312 4140 ziwJ4256.exe jr308311.exe PID 4140 wrote to memory of 4892 4140 ziwJ4256.exe ku448615.exe PID 4140 wrote to memory of 4892 4140 ziwJ4256.exe ku448615.exe PID 4140 wrote to memory of 4892 4140 ziwJ4256.exe ku448615.exe PID 4108 wrote to memory of 1952 4108 1138d90093a60709b3350f7231424f9bcba2b655e7efa3af06db362f15176d20.exe lr760975.exe PID 4108 wrote to memory of 1952 4108 1138d90093a60709b3350f7231424f9bcba2b655e7efa3af06db362f15176d20.exe lr760975.exe PID 4108 wrote to memory of 1952 4108 1138d90093a60709b3350f7231424f9bcba2b655e7efa3af06db362f15176d20.exe lr760975.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1138d90093a60709b3350f7231424f9bcba2b655e7efa3af06db362f15176d20.exe"C:\Users\Admin\AppData\Local\Temp\1138d90093a60709b3350f7231424f9bcba2b655e7efa3af06db362f15176d20.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziwJ4256.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziwJ4256.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr308311.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr308311.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku448615.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku448615.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr760975.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr760975.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr760975.exeFilesize
175KB
MD56374bf4fb21b7a49c55e339bbcc07603
SHA1e66a9f76fc06bcba01301028a9a65ae2cab49d72
SHA256525f056967d3d2b401c5aab57af588bd0b1daf2b2b50b9d3c0e3cf384f51e7b2
SHA512c09b168d62fd3beb13bea59d7d0127bf3f5e4e57cbfc9bdc4409f251d397dfc4a292376d428e3f2adadbb91925313f1874dca5cc506e7affe3ba6edfce991e6f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr760975.exeFilesize
175KB
MD56374bf4fb21b7a49c55e339bbcc07603
SHA1e66a9f76fc06bcba01301028a9a65ae2cab49d72
SHA256525f056967d3d2b401c5aab57af588bd0b1daf2b2b50b9d3c0e3cf384f51e7b2
SHA512c09b168d62fd3beb13bea59d7d0127bf3f5e4e57cbfc9bdc4409f251d397dfc4a292376d428e3f2adadbb91925313f1874dca5cc506e7affe3ba6edfce991e6f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziwJ4256.exeFilesize
392KB
MD526d2d3d66024d38c8643d0fb99300ba0
SHA1b55f6ea7f37d09be0037c6ce2f74657ae822cddd
SHA25695bc15951df7053fe34a2c37d66a5ce98211882e5db76bdf74bb4c01eb31e5a0
SHA5125d9e5a7afc345d5a82ac03b94e7812247197f7b46e397e72374f820cc0e23fcd50e47594fd52baec0e751b33d989893fa47051956c4c97a3787008142a47e212
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziwJ4256.exeFilesize
392KB
MD526d2d3d66024d38c8643d0fb99300ba0
SHA1b55f6ea7f37d09be0037c6ce2f74657ae822cddd
SHA25695bc15951df7053fe34a2c37d66a5ce98211882e5db76bdf74bb4c01eb31e5a0
SHA5125d9e5a7afc345d5a82ac03b94e7812247197f7b46e397e72374f820cc0e23fcd50e47594fd52baec0e751b33d989893fa47051956c4c97a3787008142a47e212
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr308311.exeFilesize
11KB
MD516df74527e486f4dd4b7084e830d16c6
SHA164022b5897ab8d474d2e5c7da938502b7b149499
SHA25692fe80199dab774ba91703b15872df6375db0512ab8a7288e6d195ec41ee360e
SHA512aa0d79bf06a65ea5c6ad98619dd8532c8643b4e9bd1886ff0e75df0dbbd745deaf28121b3dcf793fad663085d72a6e1df139f7c002cbd662113d19a78a2c4c38
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr308311.exeFilesize
11KB
MD516df74527e486f4dd4b7084e830d16c6
SHA164022b5897ab8d474d2e5c7da938502b7b149499
SHA25692fe80199dab774ba91703b15872df6375db0512ab8a7288e6d195ec41ee360e
SHA512aa0d79bf06a65ea5c6ad98619dd8532c8643b4e9bd1886ff0e75df0dbbd745deaf28121b3dcf793fad663085d72a6e1df139f7c002cbd662113d19a78a2c4c38
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku448615.exeFilesize
318KB
MD58bee1f087aa1bccaa2d316b7da5c4a7f
SHA11b104580c089b4ebaf40068719037bba2642f495
SHA256f9573bd940453a0bdb7599a80ca57e6fc51d1f958415e69f4622b54f0493816e
SHA512a35cca87c01e6daf54b45f2254a08db8a72cf456dd73213929d50804f781611f4089e88880217c358b0ef90d2899010d08e2355954996eb29576c6635835d54d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku448615.exeFilesize
318KB
MD58bee1f087aa1bccaa2d316b7da5c4a7f
SHA11b104580c089b4ebaf40068719037bba2642f495
SHA256f9573bd940453a0bdb7599a80ca57e6fc51d1f958415e69f4622b54f0493816e
SHA512a35cca87c01e6daf54b45f2254a08db8a72cf456dd73213929d50804f781611f4089e88880217c358b0ef90d2899010d08e2355954996eb29576c6635835d54d
-
memory/1952-1074-0x0000000000980000-0x00000000009B2000-memory.dmpFilesize
200KB
-
memory/1952-1075-0x00000000053C0000-0x000000000540B000-memory.dmpFilesize
300KB
-
memory/1952-1076-0x0000000005540000-0x0000000005550000-memory.dmpFilesize
64KB
-
memory/4312-133-0x0000000000440000-0x000000000044A000-memory.dmpFilesize
40KB
-
memory/4892-177-0x00000000022B0000-0x00000000022EF000-memory.dmpFilesize
252KB
-
memory/4892-187-0x00000000022B0000-0x00000000022EF000-memory.dmpFilesize
252KB
-
memory/4892-142-0x00000000022B0000-0x00000000022F4000-memory.dmpFilesize
272KB
-
memory/4892-143-0x00000000022B0000-0x00000000022EF000-memory.dmpFilesize
252KB
-
memory/4892-145-0x0000000004E20000-0x0000000004E30000-memory.dmpFilesize
64KB
-
memory/4892-147-0x00000000022B0000-0x00000000022EF000-memory.dmpFilesize
252KB
-
memory/4892-144-0x00000000022B0000-0x00000000022EF000-memory.dmpFilesize
252KB
-
memory/4892-148-0x0000000004E20000-0x0000000004E30000-memory.dmpFilesize
64KB
-
memory/4892-151-0x0000000004E20000-0x0000000004E30000-memory.dmpFilesize
64KB
-
memory/4892-150-0x00000000022B0000-0x00000000022EF000-memory.dmpFilesize
252KB
-
memory/4892-153-0x00000000022B0000-0x00000000022EF000-memory.dmpFilesize
252KB
-
memory/4892-155-0x00000000022B0000-0x00000000022EF000-memory.dmpFilesize
252KB
-
memory/4892-157-0x00000000022B0000-0x00000000022EF000-memory.dmpFilesize
252KB
-
memory/4892-159-0x00000000022B0000-0x00000000022EF000-memory.dmpFilesize
252KB
-
memory/4892-161-0x00000000022B0000-0x00000000022EF000-memory.dmpFilesize
252KB
-
memory/4892-163-0x00000000022B0000-0x00000000022EF000-memory.dmpFilesize
252KB
-
memory/4892-165-0x00000000022B0000-0x00000000022EF000-memory.dmpFilesize
252KB
-
memory/4892-167-0x00000000022B0000-0x00000000022EF000-memory.dmpFilesize
252KB
-
memory/4892-169-0x00000000022B0000-0x00000000022EF000-memory.dmpFilesize
252KB
-
memory/4892-171-0x00000000022B0000-0x00000000022EF000-memory.dmpFilesize
252KB
-
memory/4892-173-0x00000000022B0000-0x00000000022EF000-memory.dmpFilesize
252KB
-
memory/4892-175-0x00000000022B0000-0x00000000022EF000-memory.dmpFilesize
252KB
-
memory/4892-140-0x0000000002200000-0x0000000002246000-memory.dmpFilesize
280KB
-
memory/4892-179-0x00000000022B0000-0x00000000022EF000-memory.dmpFilesize
252KB
-
memory/4892-181-0x00000000022B0000-0x00000000022EF000-memory.dmpFilesize
252KB
-
memory/4892-183-0x00000000022B0000-0x00000000022EF000-memory.dmpFilesize
252KB
-
memory/4892-185-0x00000000022B0000-0x00000000022EF000-memory.dmpFilesize
252KB
-
memory/4892-141-0x0000000004E30000-0x000000000532E000-memory.dmpFilesize
5.0MB
-
memory/4892-189-0x00000000022B0000-0x00000000022EF000-memory.dmpFilesize
252KB
-
memory/4892-191-0x00000000022B0000-0x00000000022EF000-memory.dmpFilesize
252KB
-
memory/4892-193-0x00000000022B0000-0x00000000022EF000-memory.dmpFilesize
252KB
-
memory/4892-195-0x00000000022B0000-0x00000000022EF000-memory.dmpFilesize
252KB
-
memory/4892-197-0x00000000022B0000-0x00000000022EF000-memory.dmpFilesize
252KB
-
memory/4892-199-0x00000000022B0000-0x00000000022EF000-memory.dmpFilesize
252KB
-
memory/4892-201-0x00000000022B0000-0x00000000022EF000-memory.dmpFilesize
252KB
-
memory/4892-203-0x00000000022B0000-0x00000000022EF000-memory.dmpFilesize
252KB
-
memory/4892-205-0x00000000022B0000-0x00000000022EF000-memory.dmpFilesize
252KB
-
memory/4892-207-0x00000000022B0000-0x00000000022EF000-memory.dmpFilesize
252KB
-
memory/4892-209-0x00000000022B0000-0x00000000022EF000-memory.dmpFilesize
252KB
-
memory/4892-1052-0x0000000005330000-0x0000000005936000-memory.dmpFilesize
6.0MB
-
memory/4892-1053-0x0000000004CE0000-0x0000000004DEA000-memory.dmpFilesize
1.0MB
-
memory/4892-1054-0x0000000002710000-0x0000000002722000-memory.dmpFilesize
72KB
-
memory/4892-1055-0x0000000002730000-0x000000000276E000-memory.dmpFilesize
248KB
-
memory/4892-1056-0x0000000004E20000-0x0000000004E30000-memory.dmpFilesize
64KB
-
memory/4892-1057-0x00000000028A0000-0x00000000028EB000-memory.dmpFilesize
300KB
-
memory/4892-1059-0x0000000005AA0000-0x0000000005B32000-memory.dmpFilesize
584KB
-
memory/4892-1060-0x0000000005B40000-0x0000000005BA6000-memory.dmpFilesize
408KB
-
memory/4892-1061-0x0000000004E20000-0x0000000004E30000-memory.dmpFilesize
64KB
-
memory/4892-1062-0x0000000004E20000-0x0000000004E30000-memory.dmpFilesize
64KB
-
memory/4892-1063-0x0000000004E20000-0x0000000004E30000-memory.dmpFilesize
64KB
-
memory/4892-1064-0x0000000006340000-0x0000000006502000-memory.dmpFilesize
1.8MB
-
memory/4892-139-0x0000000000590000-0x00000000005DB000-memory.dmpFilesize
300KB
-
memory/4892-1065-0x0000000006530000-0x0000000006A5C000-memory.dmpFilesize
5.2MB
-
memory/4892-1066-0x0000000004E20000-0x0000000004E30000-memory.dmpFilesize
64KB
-
memory/4892-1067-0x0000000006B90000-0x0000000006C06000-memory.dmpFilesize
472KB
-
memory/4892-1068-0x0000000006C10000-0x0000000006C60000-memory.dmpFilesize
320KB