Analysis
-
max time kernel
63s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 20:30
Static task
static1
Behavioral task
behavioral1
Sample
66a251c696355137f5a5fdc27c5aad4433fd89dc2f9a62378b4da8bc0d3375a7.exe
Resource
win10v2004-20230221-en
General
-
Target
66a251c696355137f5a5fdc27c5aad4433fd89dc2f9a62378b4da8bc0d3375a7.exe
-
Size
672KB
-
MD5
f8956a349279f59bfcc88f7be3bded56
-
SHA1
f27d5988c1b91702a6e86e2888b4dd4c652d2245
-
SHA256
66a251c696355137f5a5fdc27c5aad4433fd89dc2f9a62378b4da8bc0d3375a7
-
SHA512
958a22d7238d5be061bb30ae7afbbbad7e25008ff77c57dcaa0eb161dea2411d62ac166fd77c8c40e4072583692d3d18156a9568aa76dfa0d3fabec1309cdb7d
-
SSDEEP
12288:kMrSy90bp/0ECJO1Q+cX5mf9s2k5hcK8/qpaLq5asHp2ck+:Oyip/vC0Q+ceiiqpaG5VHs+
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro9583.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro9583.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro9583.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro9583.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro9583.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro9583.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro9583.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/4620-191-0x0000000003A90000-0x0000000003ACF000-memory.dmp family_redline behavioral1/memory/4620-192-0x0000000003A90000-0x0000000003ACF000-memory.dmp family_redline behavioral1/memory/4620-194-0x0000000003A90000-0x0000000003ACF000-memory.dmp family_redline behavioral1/memory/4620-199-0x0000000003A90000-0x0000000003ACF000-memory.dmp family_redline behavioral1/memory/4620-202-0x0000000003A90000-0x0000000003ACF000-memory.dmp family_redline behavioral1/memory/4620-204-0x0000000003A90000-0x0000000003ACF000-memory.dmp family_redline behavioral1/memory/4620-206-0x0000000003A90000-0x0000000003ACF000-memory.dmp family_redline behavioral1/memory/4620-208-0x0000000003A90000-0x0000000003ACF000-memory.dmp family_redline behavioral1/memory/4620-210-0x0000000003A90000-0x0000000003ACF000-memory.dmp family_redline behavioral1/memory/4620-212-0x0000000003A90000-0x0000000003ACF000-memory.dmp family_redline behavioral1/memory/4620-214-0x0000000003A90000-0x0000000003ACF000-memory.dmp family_redline behavioral1/memory/4620-216-0x0000000003A90000-0x0000000003ACF000-memory.dmp family_redline behavioral1/memory/4620-218-0x0000000003A90000-0x0000000003ACF000-memory.dmp family_redline behavioral1/memory/4620-220-0x0000000003A90000-0x0000000003ACF000-memory.dmp family_redline behavioral1/memory/4620-222-0x0000000003A90000-0x0000000003ACF000-memory.dmp family_redline behavioral1/memory/4620-224-0x0000000003A90000-0x0000000003ACF000-memory.dmp family_redline behavioral1/memory/4620-226-0x0000000003A90000-0x0000000003ACF000-memory.dmp family_redline behavioral1/memory/4620-228-0x0000000003A90000-0x0000000003ACF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un868506.exepro9583.exequ9601.exesi253665.exepid process 2464 un868506.exe 2816 pro9583.exe 4620 qu9601.exe 916 si253665.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro9583.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro9583.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro9583.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
66a251c696355137f5a5fdc27c5aad4433fd89dc2f9a62378b4da8bc0d3375a7.exeun868506.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 66a251c696355137f5a5fdc27c5aad4433fd89dc2f9a62378b4da8bc0d3375a7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 66a251c696355137f5a5fdc27c5aad4433fd89dc2f9a62378b4da8bc0d3375a7.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un868506.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un868506.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 740 2816 WerFault.exe pro9583.exe 1276 4620 WerFault.exe qu9601.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro9583.exequ9601.exesi253665.exepid process 2816 pro9583.exe 2816 pro9583.exe 4620 qu9601.exe 4620 qu9601.exe 916 si253665.exe 916 si253665.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro9583.exequ9601.exesi253665.exedescription pid process Token: SeDebugPrivilege 2816 pro9583.exe Token: SeDebugPrivilege 4620 qu9601.exe Token: SeDebugPrivilege 916 si253665.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
66a251c696355137f5a5fdc27c5aad4433fd89dc2f9a62378b4da8bc0d3375a7.exeun868506.exedescription pid process target process PID 380 wrote to memory of 2464 380 66a251c696355137f5a5fdc27c5aad4433fd89dc2f9a62378b4da8bc0d3375a7.exe un868506.exe PID 380 wrote to memory of 2464 380 66a251c696355137f5a5fdc27c5aad4433fd89dc2f9a62378b4da8bc0d3375a7.exe un868506.exe PID 380 wrote to memory of 2464 380 66a251c696355137f5a5fdc27c5aad4433fd89dc2f9a62378b4da8bc0d3375a7.exe un868506.exe PID 2464 wrote to memory of 2816 2464 un868506.exe pro9583.exe PID 2464 wrote to memory of 2816 2464 un868506.exe pro9583.exe PID 2464 wrote to memory of 2816 2464 un868506.exe pro9583.exe PID 2464 wrote to memory of 4620 2464 un868506.exe qu9601.exe PID 2464 wrote to memory of 4620 2464 un868506.exe qu9601.exe PID 2464 wrote to memory of 4620 2464 un868506.exe qu9601.exe PID 380 wrote to memory of 916 380 66a251c696355137f5a5fdc27c5aad4433fd89dc2f9a62378b4da8bc0d3375a7.exe si253665.exe PID 380 wrote to memory of 916 380 66a251c696355137f5a5fdc27c5aad4433fd89dc2f9a62378b4da8bc0d3375a7.exe si253665.exe PID 380 wrote to memory of 916 380 66a251c696355137f5a5fdc27c5aad4433fd89dc2f9a62378b4da8bc0d3375a7.exe si253665.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\66a251c696355137f5a5fdc27c5aad4433fd89dc2f9a62378b4da8bc0d3375a7.exe"C:\Users\Admin\AppData\Local\Temp\66a251c696355137f5a5fdc27c5aad4433fd89dc2f9a62378b4da8bc0d3375a7.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un868506.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un868506.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9583.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9583.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 10804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9601.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9601.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 13564⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si253665.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si253665.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2816 -ip 28161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4620 -ip 46201⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si253665.exeFilesize
175KB
MD567d9d59eea1cdcd2ac22aba8d2243cfc
SHA11efc3c82c6e5ec4b024f33f3de50a75cb12fc238
SHA2566422be639bba7763462c82ed9c476653619ca42c9ee4f0a3b56339e3f84c67f1
SHA512ef901c24d8131d43feb5319956487bd57cd72f0f900577203ba288ba22e381202f7c2b7614fc017c90a3fdbfd04aec99ccb726ba66d0aee1067ba69c760a3aee
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si253665.exeFilesize
175KB
MD567d9d59eea1cdcd2ac22aba8d2243cfc
SHA11efc3c82c6e5ec4b024f33f3de50a75cb12fc238
SHA2566422be639bba7763462c82ed9c476653619ca42c9ee4f0a3b56339e3f84c67f1
SHA512ef901c24d8131d43feb5319956487bd57cd72f0f900577203ba288ba22e381202f7c2b7614fc017c90a3fdbfd04aec99ccb726ba66d0aee1067ba69c760a3aee
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un868506.exeFilesize
530KB
MD52aab3c3cdeac2caf4ba2ac48fc404187
SHA14380dee37fb361642226299fae3d06c38b7e36eb
SHA2562893529bffa455aecb40b38224e5fa6f38ac7884a49772d239f5f9bc7c5da97e
SHA512412941e06a33a6ce1a2a3e09812d869e7d3b84252efbe06af2cf63bbee63866c44886760dc53268e3e4b7224cdbbc2dd2bfdbe440673edd2006911146850c2bb
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un868506.exeFilesize
530KB
MD52aab3c3cdeac2caf4ba2ac48fc404187
SHA14380dee37fb361642226299fae3d06c38b7e36eb
SHA2562893529bffa455aecb40b38224e5fa6f38ac7884a49772d239f5f9bc7c5da97e
SHA512412941e06a33a6ce1a2a3e09812d869e7d3b84252efbe06af2cf63bbee63866c44886760dc53268e3e4b7224cdbbc2dd2bfdbe440673edd2006911146850c2bb
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9583.exeFilesize
260KB
MD58f4f42406cf3da7a6798adbf653c4d30
SHA1e0e1503d67a48bacb32eb2ff125061b568764dd3
SHA2567c60bca5e56424fdd57ca03d964df0ec7a06ae4286f2fea81840f366ab4ab6eb
SHA51224cb3bc48573cd5793d5255d8d4664f701ac15f55ef9c149c1e3a45cc50b19b3fd87a1358b4a0fcb08812b1ac7d6073c4989f3228ad02be841d2cf1e3354b382
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9583.exeFilesize
260KB
MD58f4f42406cf3da7a6798adbf653c4d30
SHA1e0e1503d67a48bacb32eb2ff125061b568764dd3
SHA2567c60bca5e56424fdd57ca03d964df0ec7a06ae4286f2fea81840f366ab4ab6eb
SHA51224cb3bc48573cd5793d5255d8d4664f701ac15f55ef9c149c1e3a45cc50b19b3fd87a1358b4a0fcb08812b1ac7d6073c4989f3228ad02be841d2cf1e3354b382
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9601.exeFilesize
359KB
MD58e47e3d4cbbd1999fa773610b2a740ff
SHA1767e13e4e0d25ba38e0615ccaaac1ed4c34fd3ef
SHA256ff7662455c1db94b45cec779726af48f0e5dee43418d9803b62ba59e0e310f74
SHA51270515cb627ac0a5e5f60897b94abb29fde9d1d83ed75007d3bc23d90bb28e2fca480c66543c494ac44c0adb753223de04195222b5c2e9a1229f28311355e338e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9601.exeFilesize
359KB
MD58e47e3d4cbbd1999fa773610b2a740ff
SHA1767e13e4e0d25ba38e0615ccaaac1ed4c34fd3ef
SHA256ff7662455c1db94b45cec779726af48f0e5dee43418d9803b62ba59e0e310f74
SHA51270515cb627ac0a5e5f60897b94abb29fde9d1d83ed75007d3bc23d90bb28e2fca480c66543c494ac44c0adb753223de04195222b5c2e9a1229f28311355e338e
-
memory/916-1122-0x00000000004F0000-0x0000000000522000-memory.dmpFilesize
200KB
-
memory/916-1123-0x00000000050F0000-0x0000000005100000-memory.dmpFilesize
64KB
-
memory/916-1124-0x00000000050F0000-0x0000000005100000-memory.dmpFilesize
64KB
-
memory/2816-160-0x00000000026A0000-0x00000000026B2000-memory.dmpFilesize
72KB
-
memory/2816-172-0x00000000026A0000-0x00000000026B2000-memory.dmpFilesize
72KB
-
memory/2816-152-0x0000000004A70000-0x0000000005014000-memory.dmpFilesize
5.6MB
-
memory/2816-153-0x00000000026A0000-0x00000000026B2000-memory.dmpFilesize
72KB
-
memory/2816-154-0x00000000026A0000-0x00000000026B2000-memory.dmpFilesize
72KB
-
memory/2816-156-0x00000000026A0000-0x00000000026B2000-memory.dmpFilesize
72KB
-
memory/2816-158-0x00000000026A0000-0x00000000026B2000-memory.dmpFilesize
72KB
-
memory/2816-150-0x00000000026D0000-0x00000000026E0000-memory.dmpFilesize
64KB
-
memory/2816-162-0x00000000026A0000-0x00000000026B2000-memory.dmpFilesize
72KB
-
memory/2816-164-0x00000000026A0000-0x00000000026B2000-memory.dmpFilesize
72KB
-
memory/2816-166-0x00000000026A0000-0x00000000026B2000-memory.dmpFilesize
72KB
-
memory/2816-168-0x00000000026A0000-0x00000000026B2000-memory.dmpFilesize
72KB
-
memory/2816-170-0x00000000026A0000-0x00000000026B2000-memory.dmpFilesize
72KB
-
memory/2816-151-0x00000000026D0000-0x00000000026E0000-memory.dmpFilesize
64KB
-
memory/2816-174-0x00000000026A0000-0x00000000026B2000-memory.dmpFilesize
72KB
-
memory/2816-176-0x00000000026A0000-0x00000000026B2000-memory.dmpFilesize
72KB
-
memory/2816-178-0x00000000026A0000-0x00000000026B2000-memory.dmpFilesize
72KB
-
memory/2816-180-0x00000000026A0000-0x00000000026B2000-memory.dmpFilesize
72KB
-
memory/2816-181-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/2816-182-0x00000000026D0000-0x00000000026E0000-memory.dmpFilesize
64KB
-
memory/2816-183-0x00000000026D0000-0x00000000026E0000-memory.dmpFilesize
64KB
-
memory/2816-184-0x00000000026D0000-0x00000000026E0000-memory.dmpFilesize
64KB
-
memory/2816-186-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/2816-149-0x00000000026D0000-0x00000000026E0000-memory.dmpFilesize
64KB
-
memory/2816-148-0x0000000000630000-0x000000000065D000-memory.dmpFilesize
180KB
-
memory/4620-195-0x0000000001CA0000-0x0000000001CEB000-memory.dmpFilesize
300KB
-
memory/4620-228-0x0000000003A90000-0x0000000003ACF000-memory.dmpFilesize
252KB
-
memory/4620-198-0x0000000006240000-0x0000000006250000-memory.dmpFilesize
64KB
-
memory/4620-197-0x0000000006240000-0x0000000006250000-memory.dmpFilesize
64KB
-
memory/4620-199-0x0000000003A90000-0x0000000003ACF000-memory.dmpFilesize
252KB
-
memory/4620-202-0x0000000003A90000-0x0000000003ACF000-memory.dmpFilesize
252KB
-
memory/4620-200-0x0000000006240000-0x0000000006250000-memory.dmpFilesize
64KB
-
memory/4620-204-0x0000000003A90000-0x0000000003ACF000-memory.dmpFilesize
252KB
-
memory/4620-206-0x0000000003A90000-0x0000000003ACF000-memory.dmpFilesize
252KB
-
memory/4620-208-0x0000000003A90000-0x0000000003ACF000-memory.dmpFilesize
252KB
-
memory/4620-210-0x0000000003A90000-0x0000000003ACF000-memory.dmpFilesize
252KB
-
memory/4620-212-0x0000000003A90000-0x0000000003ACF000-memory.dmpFilesize
252KB
-
memory/4620-214-0x0000000003A90000-0x0000000003ACF000-memory.dmpFilesize
252KB
-
memory/4620-216-0x0000000003A90000-0x0000000003ACF000-memory.dmpFilesize
252KB
-
memory/4620-218-0x0000000003A90000-0x0000000003ACF000-memory.dmpFilesize
252KB
-
memory/4620-220-0x0000000003A90000-0x0000000003ACF000-memory.dmpFilesize
252KB
-
memory/4620-222-0x0000000003A90000-0x0000000003ACF000-memory.dmpFilesize
252KB
-
memory/4620-224-0x0000000003A90000-0x0000000003ACF000-memory.dmpFilesize
252KB
-
memory/4620-226-0x0000000003A90000-0x0000000003ACF000-memory.dmpFilesize
252KB
-
memory/4620-194-0x0000000003A90000-0x0000000003ACF000-memory.dmpFilesize
252KB
-
memory/4620-1101-0x0000000006800000-0x0000000006E18000-memory.dmpFilesize
6.1MB
-
memory/4620-1102-0x0000000006E20000-0x0000000006F2A000-memory.dmpFilesize
1.0MB
-
memory/4620-1103-0x00000000061F0000-0x0000000006202000-memory.dmpFilesize
72KB
-
memory/4620-1104-0x0000000006240000-0x0000000006250000-memory.dmpFilesize
64KB
-
memory/4620-1105-0x0000000006F30000-0x0000000006F6C000-memory.dmpFilesize
240KB
-
memory/4620-1107-0x00000000071F0000-0x0000000007282000-memory.dmpFilesize
584KB
-
memory/4620-1108-0x0000000007290000-0x00000000072F6000-memory.dmpFilesize
408KB
-
memory/4620-1109-0x00000000079B0000-0x0000000007B72000-memory.dmpFilesize
1.8MB
-
memory/4620-1110-0x0000000007B80000-0x00000000080AC000-memory.dmpFilesize
5.2MB
-
memory/4620-1111-0x0000000006240000-0x0000000006250000-memory.dmpFilesize
64KB
-
memory/4620-1112-0x0000000006240000-0x0000000006250000-memory.dmpFilesize
64KB
-
memory/4620-1113-0x0000000006240000-0x0000000006250000-memory.dmpFilesize
64KB
-
memory/4620-192-0x0000000003A90000-0x0000000003ACF000-memory.dmpFilesize
252KB
-
memory/4620-191-0x0000000003A90000-0x0000000003ACF000-memory.dmpFilesize
252KB
-
memory/4620-1114-0x0000000008200000-0x0000000008276000-memory.dmpFilesize
472KB
-
memory/4620-1115-0x0000000008280000-0x00000000082D0000-memory.dmpFilesize
320KB
-
memory/4620-1116-0x0000000006240000-0x0000000006250000-memory.dmpFilesize
64KB