Analysis
-
max time kernel
145s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 20:35
Static task
static1
Behavioral task
behavioral1
Sample
4d61c2e3f5414c5ad81295eaf2d7857bb5af7c72fd798c8ee707ced2618c8683.exe
Resource
win10v2004-20230221-en
General
-
Target
4d61c2e3f5414c5ad81295eaf2d7857bb5af7c72fd798c8ee707ced2618c8683.exe
-
Size
672KB
-
MD5
164c4b69d7d801fdeda54ff2e0d27c9b
-
SHA1
94c1bae224ea65010376e19c931410e117074f11
-
SHA256
4d61c2e3f5414c5ad81295eaf2d7857bb5af7c72fd798c8ee707ced2618c8683
-
SHA512
db80bc25ca33d4d28926303b6b47ac4d201596286d92a015aa957cbea9d0437a4de32e84c6af60460b15412614bdeafc396a08b258bf1a77439778c980e73e77
-
SSDEEP
12288:0Mruy90FQXEIn928TUCsnE3EDQHCTbfn699Oa7rR3Lq2lUAldyz:KyaIkCsn44/haXR3G2iAvyz
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro5071.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro5071.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro5071.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro5071.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro5071.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro5071.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro5071.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/4868-193-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4868-195-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4868-203-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4868-201-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4868-198-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4868-205-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4868-207-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4868-209-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4868-211-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4868-213-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4868-215-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4868-217-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4868-219-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4868-221-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4868-223-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4868-225-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4868-227-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4868-229-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un434984.exepro5071.exequ3267.exesi871085.exepid process 2584 un434984.exe 4316 pro5071.exe 4868 qu3267.exe 3608 si871085.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro5071.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro5071.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro5071.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un434984.exe4d61c2e3f5414c5ad81295eaf2d7857bb5af7c72fd798c8ee707ced2618c8683.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un434984.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 4d61c2e3f5414c5ad81295eaf2d7857bb5af7c72fd798c8ee707ced2618c8683.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 4d61c2e3f5414c5ad81295eaf2d7857bb5af7c72fd798c8ee707ced2618c8683.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un434984.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 2500 sc.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1680 4316 WerFault.exe pro5071.exe 1192 4868 WerFault.exe qu3267.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro5071.exequ3267.exesi871085.exepid process 4316 pro5071.exe 4316 pro5071.exe 4868 qu3267.exe 4868 qu3267.exe 3608 si871085.exe 3608 si871085.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro5071.exequ3267.exesi871085.exedescription pid process Token: SeDebugPrivilege 4316 pro5071.exe Token: SeDebugPrivilege 4868 qu3267.exe Token: SeDebugPrivilege 3608 si871085.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
4d61c2e3f5414c5ad81295eaf2d7857bb5af7c72fd798c8ee707ced2618c8683.exeun434984.exedescription pid process target process PID 3040 wrote to memory of 2584 3040 4d61c2e3f5414c5ad81295eaf2d7857bb5af7c72fd798c8ee707ced2618c8683.exe un434984.exe PID 3040 wrote to memory of 2584 3040 4d61c2e3f5414c5ad81295eaf2d7857bb5af7c72fd798c8ee707ced2618c8683.exe un434984.exe PID 3040 wrote to memory of 2584 3040 4d61c2e3f5414c5ad81295eaf2d7857bb5af7c72fd798c8ee707ced2618c8683.exe un434984.exe PID 2584 wrote to memory of 4316 2584 un434984.exe pro5071.exe PID 2584 wrote to memory of 4316 2584 un434984.exe pro5071.exe PID 2584 wrote to memory of 4316 2584 un434984.exe pro5071.exe PID 2584 wrote to memory of 4868 2584 un434984.exe qu3267.exe PID 2584 wrote to memory of 4868 2584 un434984.exe qu3267.exe PID 2584 wrote to memory of 4868 2584 un434984.exe qu3267.exe PID 3040 wrote to memory of 3608 3040 4d61c2e3f5414c5ad81295eaf2d7857bb5af7c72fd798c8ee707ced2618c8683.exe si871085.exe PID 3040 wrote to memory of 3608 3040 4d61c2e3f5414c5ad81295eaf2d7857bb5af7c72fd798c8ee707ced2618c8683.exe si871085.exe PID 3040 wrote to memory of 3608 3040 4d61c2e3f5414c5ad81295eaf2d7857bb5af7c72fd798c8ee707ced2618c8683.exe si871085.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d61c2e3f5414c5ad81295eaf2d7857bb5af7c72fd798c8ee707ced2618c8683.exe"C:\Users\Admin\AppData\Local\Temp\4d61c2e3f5414c5ad81295eaf2d7857bb5af7c72fd798c8ee707ced2618c8683.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un434984.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un434984.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5071.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5071.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 10844⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3267.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3267.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 13804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si871085.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si871085.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4316 -ip 43161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4868 -ip 48681⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si871085.exeFilesize
175KB
MD5589dbc73ab01c33abb13ca1864ec6849
SHA1dc5b5be94fdfaa98f05acd81bb23ecb3736f6894
SHA25691120e339286c976d33c040e8ea7173f7be5bf1f4801a0c92a525aca159afb71
SHA5124974505cf0bdf889c02cc9840040d03c764c18064c8c5f0d9178798f6912d0beced51647aa8aef76efc67c544865fc9f53de9df7b3788e05418a0ed4b46fd67b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si871085.exeFilesize
175KB
MD5589dbc73ab01c33abb13ca1864ec6849
SHA1dc5b5be94fdfaa98f05acd81bb23ecb3736f6894
SHA25691120e339286c976d33c040e8ea7173f7be5bf1f4801a0c92a525aca159afb71
SHA5124974505cf0bdf889c02cc9840040d03c764c18064c8c5f0d9178798f6912d0beced51647aa8aef76efc67c544865fc9f53de9df7b3788e05418a0ed4b46fd67b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un434984.exeFilesize
530KB
MD50093851ca9530cfce9a1c3c08a6611b9
SHA1aadb12ca043634afe113f5d974a04e87f938e368
SHA25669e55d30a4a567ce07c622bb65f9c552dd5a8f38a881c8bbfb812afe666a585b
SHA512e5623d0caf7b196484bb7ffac8b3af01ecbe28656c48fb23c2440eb62aac16b696f7b5c475dc1a10a2d4a1aca34f9d9adb657b83a6d0f206998843125329071f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un434984.exeFilesize
530KB
MD50093851ca9530cfce9a1c3c08a6611b9
SHA1aadb12ca043634afe113f5d974a04e87f938e368
SHA25669e55d30a4a567ce07c622bb65f9c552dd5a8f38a881c8bbfb812afe666a585b
SHA512e5623d0caf7b196484bb7ffac8b3af01ecbe28656c48fb23c2440eb62aac16b696f7b5c475dc1a10a2d4a1aca34f9d9adb657b83a6d0f206998843125329071f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5071.exeFilesize
301KB
MD58c6276b4c9f35ec93a97518f2315f827
SHA197e38cb5911ad24bf483009c4c86d799afd9e6e8
SHA256522ce3b35dd77cef260b6796e3a522a5315bd0575960200badb714a36ce2de12
SHA512f4cce77611aeaff5d09fe886c77be2dfe5eafe7b6f329afc0c280d12fdb9f1e1f6e0be5b74a5043c574aec3cfba617b712ae6f1bffd1997d9b8e0f89a6ebbcb9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5071.exeFilesize
301KB
MD58c6276b4c9f35ec93a97518f2315f827
SHA197e38cb5911ad24bf483009c4c86d799afd9e6e8
SHA256522ce3b35dd77cef260b6796e3a522a5315bd0575960200badb714a36ce2de12
SHA512f4cce77611aeaff5d09fe886c77be2dfe5eafe7b6f329afc0c280d12fdb9f1e1f6e0be5b74a5043c574aec3cfba617b712ae6f1bffd1997d9b8e0f89a6ebbcb9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3267.exeFilesize
359KB
MD5c99279b75be79d7a25f5addce97f1b06
SHA1c91dc9838ac308eea672e485c1b213751f852c03
SHA256dd682a84d28c08c34552141ac28ba823e524a6ab1a3224ab9aef39b7c6843ec7
SHA512a6601e8423f69d43d28a1bb68cfd867021ba8a024ff59d52877e53d81ee8d1a30fba939e7c59cdc633f97364757c499981ef6667ff431bfdb652680ef300634a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3267.exeFilesize
359KB
MD5c99279b75be79d7a25f5addce97f1b06
SHA1c91dc9838ac308eea672e485c1b213751f852c03
SHA256dd682a84d28c08c34552141ac28ba823e524a6ab1a3224ab9aef39b7c6843ec7
SHA512a6601e8423f69d43d28a1bb68cfd867021ba8a024ff59d52877e53d81ee8d1a30fba939e7c59cdc633f97364757c499981ef6667ff431bfdb652680ef300634a
-
memory/3608-1124-0x0000000005340000-0x0000000005350000-memory.dmpFilesize
64KB
-
memory/3608-1123-0x0000000000A40000-0x0000000000A72000-memory.dmpFilesize
200KB
-
memory/3608-1125-0x0000000005340000-0x0000000005350000-memory.dmpFilesize
64KB
-
memory/4316-162-0x0000000003A90000-0x0000000003AA2000-memory.dmpFilesize
72KB
-
memory/4316-172-0x0000000003A90000-0x0000000003AA2000-memory.dmpFilesize
72KB
-
memory/4316-151-0x0000000003A90000-0x0000000003AA2000-memory.dmpFilesize
72KB
-
memory/4316-155-0x0000000003A90000-0x0000000003AA2000-memory.dmpFilesize
72KB
-
memory/4316-158-0x00000000062D0000-0x00000000062E0000-memory.dmpFilesize
64KB
-
memory/4316-157-0x0000000003A90000-0x0000000003AA2000-memory.dmpFilesize
72KB
-
memory/4316-159-0x00000000062D0000-0x00000000062E0000-memory.dmpFilesize
64KB
-
memory/4316-150-0x0000000003A90000-0x0000000003AA2000-memory.dmpFilesize
72KB
-
memory/4316-161-0x00000000062D0000-0x00000000062E0000-memory.dmpFilesize
64KB
-
memory/4316-164-0x0000000003A90000-0x0000000003AA2000-memory.dmpFilesize
72KB
-
memory/4316-166-0x0000000003A90000-0x0000000003AA2000-memory.dmpFilesize
72KB
-
memory/4316-168-0x0000000003A90000-0x0000000003AA2000-memory.dmpFilesize
72KB
-
memory/4316-170-0x0000000003A90000-0x0000000003AA2000-memory.dmpFilesize
72KB
-
memory/4316-153-0x0000000003A90000-0x0000000003AA2000-memory.dmpFilesize
72KB
-
memory/4316-174-0x0000000003A90000-0x0000000003AA2000-memory.dmpFilesize
72KB
-
memory/4316-176-0x0000000003A90000-0x0000000003AA2000-memory.dmpFilesize
72KB
-
memory/4316-178-0x0000000003A90000-0x0000000003AA2000-memory.dmpFilesize
72KB
-
memory/4316-180-0x0000000003A90000-0x0000000003AA2000-memory.dmpFilesize
72KB
-
memory/4316-181-0x0000000000400000-0x0000000001AE3000-memory.dmpFilesize
22.9MB
-
memory/4316-182-0x0000000001C40000-0x0000000001C6D000-memory.dmpFilesize
180KB
-
memory/4316-183-0x00000000062D0000-0x00000000062E0000-memory.dmpFilesize
64KB
-
memory/4316-184-0x00000000062D0000-0x00000000062E0000-memory.dmpFilesize
64KB
-
memory/4316-185-0x00000000062D0000-0x00000000062E0000-memory.dmpFilesize
64KB
-
memory/4316-187-0x0000000000400000-0x0000000001AE3000-memory.dmpFilesize
22.9MB
-
memory/4316-149-0x00000000062E0000-0x0000000006884000-memory.dmpFilesize
5.6MB
-
memory/4316-148-0x0000000001C40000-0x0000000001C6D000-memory.dmpFilesize
180KB
-
memory/4868-193-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4868-197-0x0000000006410000-0x0000000006420000-memory.dmpFilesize
64KB
-
memory/4868-199-0x0000000006410000-0x0000000006420000-memory.dmpFilesize
64KB
-
memory/4868-203-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4868-201-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4868-198-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4868-194-0x0000000006410000-0x0000000006420000-memory.dmpFilesize
64KB
-
memory/4868-205-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4868-207-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4868-209-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4868-211-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4868-213-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4868-215-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4868-217-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4868-219-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4868-221-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4868-223-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4868-225-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4868-227-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4868-229-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4868-1102-0x00000000069D0000-0x0000000006FE8000-memory.dmpFilesize
6.1MB
-
memory/4868-1103-0x0000000006FF0000-0x00000000070FA000-memory.dmpFilesize
1.0MB
-
memory/4868-1104-0x0000000003CE0000-0x0000000003CF2000-memory.dmpFilesize
72KB
-
memory/4868-1105-0x0000000006360000-0x000000000639C000-memory.dmpFilesize
240KB
-
memory/4868-1106-0x0000000006410000-0x0000000006420000-memory.dmpFilesize
64KB
-
memory/4868-1107-0x0000000007330000-0x0000000007396000-memory.dmpFilesize
408KB
-
memory/4868-1109-0x00000000079F0000-0x0000000007A82000-memory.dmpFilesize
584KB
-
memory/4868-1110-0x0000000006410000-0x0000000006420000-memory.dmpFilesize
64KB
-
memory/4868-1111-0x0000000006410000-0x0000000006420000-memory.dmpFilesize
64KB
-
memory/4868-1112-0x0000000006410000-0x0000000006420000-memory.dmpFilesize
64KB
-
memory/4868-1113-0x0000000007D40000-0x0000000007DB6000-memory.dmpFilesize
472KB
-
memory/4868-1114-0x0000000007DC0000-0x0000000007E10000-memory.dmpFilesize
320KB
-
memory/4868-195-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4868-192-0x0000000003670000-0x00000000036BB000-memory.dmpFilesize
300KB
-
memory/4868-1115-0x0000000007E30000-0x0000000007FF2000-memory.dmpFilesize
1.8MB
-
memory/4868-1116-0x0000000006410000-0x0000000006420000-memory.dmpFilesize
64KB
-
memory/4868-1117-0x0000000008000000-0x000000000852C000-memory.dmpFilesize
5.2MB