Analysis
-
max time kernel
92s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 20:38
Static task
static1
Behavioral task
behavioral1
Sample
2ab15aacd705d5f7a1e8adb8063f92d3f2f13b365577e09c52da2a0404ad36a8.exe
Resource
win10v2004-20230221-en
General
-
Target
2ab15aacd705d5f7a1e8adb8063f92d3f2f13b365577e09c52da2a0404ad36a8.exe
-
Size
533KB
-
MD5
a62302f00a07551599cb00254593cdd3
-
SHA1
b2fa2001cdc0dc5bbfe4c5c58db2550afe427f6b
-
SHA256
2ab15aacd705d5f7a1e8adb8063f92d3f2f13b365577e09c52da2a0404ad36a8
-
SHA512
466c8b32a18dbccdd76e054b77726278517b4eb49efcf92f6303d8327769905ec902c56b2fdee77fc0f163d747009c9dc18956efa5cb9bd1aeeebd7b2d34208d
-
SSDEEP
12288:cMryy90hiJKxi3I7YHsTTd3Lq6vW4/TEGb0:GyGiJMyATd3GmN7b0
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr427595.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr427595.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr427595.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr427595.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr427595.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr427595.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr427595.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/4836-158-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/4836-159-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/4836-161-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/4836-163-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/4836-165-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/4836-167-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/4836-169-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/4836-171-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/4836-173-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/4836-175-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/4836-177-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/4836-179-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/4836-181-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/4836-183-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/4836-185-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/4836-187-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/4836-189-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/4836-191-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/4836-193-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/4836-195-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/4836-197-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/4836-199-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/4836-201-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/4836-203-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/4836-205-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/4836-207-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/4836-209-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/4836-211-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/4836-213-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/4836-215-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/4836-217-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/4836-219-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/4836-221-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
zirF4112.exejr427595.exeku883900.exelr002952.exepid process 2732 zirF4112.exe 1692 jr427595.exe 4836 ku883900.exe 3152 lr002952.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr427595.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr427595.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
2ab15aacd705d5f7a1e8adb8063f92d3f2f13b365577e09c52da2a0404ad36a8.exezirF4112.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 2ab15aacd705d5f7a1e8adb8063f92d3f2f13b365577e09c52da2a0404ad36a8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 2ab15aacd705d5f7a1e8adb8063f92d3f2f13b365577e09c52da2a0404ad36a8.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zirF4112.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zirF4112.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1116 4836 WerFault.exe ku883900.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr427595.exeku883900.exelr002952.exepid process 1692 jr427595.exe 1692 jr427595.exe 4836 ku883900.exe 4836 ku883900.exe 3152 lr002952.exe 3152 lr002952.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr427595.exeku883900.exelr002952.exedescription pid process Token: SeDebugPrivilege 1692 jr427595.exe Token: SeDebugPrivilege 4836 ku883900.exe Token: SeDebugPrivilege 3152 lr002952.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
2ab15aacd705d5f7a1e8adb8063f92d3f2f13b365577e09c52da2a0404ad36a8.exezirF4112.exedescription pid process target process PID 2372 wrote to memory of 2732 2372 2ab15aacd705d5f7a1e8adb8063f92d3f2f13b365577e09c52da2a0404ad36a8.exe zirF4112.exe PID 2372 wrote to memory of 2732 2372 2ab15aacd705d5f7a1e8adb8063f92d3f2f13b365577e09c52da2a0404ad36a8.exe zirF4112.exe PID 2372 wrote to memory of 2732 2372 2ab15aacd705d5f7a1e8adb8063f92d3f2f13b365577e09c52da2a0404ad36a8.exe zirF4112.exe PID 2732 wrote to memory of 1692 2732 zirF4112.exe jr427595.exe PID 2732 wrote to memory of 1692 2732 zirF4112.exe jr427595.exe PID 2732 wrote to memory of 4836 2732 zirF4112.exe ku883900.exe PID 2732 wrote to memory of 4836 2732 zirF4112.exe ku883900.exe PID 2732 wrote to memory of 4836 2732 zirF4112.exe ku883900.exe PID 2372 wrote to memory of 3152 2372 2ab15aacd705d5f7a1e8adb8063f92d3f2f13b365577e09c52da2a0404ad36a8.exe lr002952.exe PID 2372 wrote to memory of 3152 2372 2ab15aacd705d5f7a1e8adb8063f92d3f2f13b365577e09c52da2a0404ad36a8.exe lr002952.exe PID 2372 wrote to memory of 3152 2372 2ab15aacd705d5f7a1e8adb8063f92d3f2f13b365577e09c52da2a0404ad36a8.exe lr002952.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ab15aacd705d5f7a1e8adb8063f92d3f2f13b365577e09c52da2a0404ad36a8.exe"C:\Users\Admin\AppData\Local\Temp\2ab15aacd705d5f7a1e8adb8063f92d3f2f13b365577e09c52da2a0404ad36a8.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zirF4112.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zirF4112.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr427595.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr427595.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku883900.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku883900.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4836 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 13564⤵
- Program crash
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr002952.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr002952.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3152
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4836 -ip 48361⤵PID:636
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr002952.exeFilesize
175KB
MD5b615e62083a0cbe30de9f8ecba74abf9
SHA11bbdfbc426420ecc6b9e17f73e5a4cb4878bf7e1
SHA256bae14b66513354d3ce58d5ec02242b2bce69488b295268e64c0ae6be982feff3
SHA512d6b5f79c92cff499983750c9a88fbb64e1286d5d74ec342b250e8581de9ea09075bb600fd117614213068b50f6d5737a5e6ac3bb30dad26b898e2f78950162d1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr002952.exeFilesize
175KB
MD5b615e62083a0cbe30de9f8ecba74abf9
SHA11bbdfbc426420ecc6b9e17f73e5a4cb4878bf7e1
SHA256bae14b66513354d3ce58d5ec02242b2bce69488b295268e64c0ae6be982feff3
SHA512d6b5f79c92cff499983750c9a88fbb64e1286d5d74ec342b250e8581de9ea09075bb600fd117614213068b50f6d5737a5e6ac3bb30dad26b898e2f78950162d1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zirF4112.exeFilesize
392KB
MD56fc5105fad271636e5dedfcd8f7f0e36
SHA1f99cce5755df2bbc5da70b3ecb47eeeeb5008933
SHA256b51cb3328a25a8602a175ce0e390f36127edfefd90b704250a39e9403b54bda9
SHA5128e1517d62ab732d94f220d7977e1a822556bcb8e76c03f3d087cfd4d7bf64d417a909088b553ff2a17566af6e5cdb692b2586e954c52950e7b7511287b6b8189
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zirF4112.exeFilesize
392KB
MD56fc5105fad271636e5dedfcd8f7f0e36
SHA1f99cce5755df2bbc5da70b3ecb47eeeeb5008933
SHA256b51cb3328a25a8602a175ce0e390f36127edfefd90b704250a39e9403b54bda9
SHA5128e1517d62ab732d94f220d7977e1a822556bcb8e76c03f3d087cfd4d7bf64d417a909088b553ff2a17566af6e5cdb692b2586e954c52950e7b7511287b6b8189
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr427595.exeFilesize
11KB
MD58c01f200961544b9fd153507911b8452
SHA1e9c51a1d4ae3dc0540a7664f6e6ebf91d8b15de3
SHA256d41cfcb595b395df99cb1c347e785eac593eee959755c1340bca1592ea759566
SHA512c97a644a81fc2fc0a6a3b0c314c0ccae71b77918cb4c6a2fe953f2128ef615e10e6fbea092e7a5cfddfa6844c34a3ba52e0cacda6f7b0a2333301d43b85d930d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr427595.exeFilesize
11KB
MD58c01f200961544b9fd153507911b8452
SHA1e9c51a1d4ae3dc0540a7664f6e6ebf91d8b15de3
SHA256d41cfcb595b395df99cb1c347e785eac593eee959755c1340bca1592ea759566
SHA512c97a644a81fc2fc0a6a3b0c314c0ccae71b77918cb4c6a2fe953f2128ef615e10e6fbea092e7a5cfddfa6844c34a3ba52e0cacda6f7b0a2333301d43b85d930d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku883900.exeFilesize
359KB
MD54a811332b2b77fd7f2be6031f345cf39
SHA1314d71ce305d7010503c51f6c4587da4370ef9ea
SHA2566f166c9bd3650ebae1c3b2820b9210c2c1e2f488f943a4a4f3fa341e68ebd9d4
SHA512e2d91ca00a4b099d86aacc0bfa654345f8dab8c7d61e163288a1f930084da6ba1600369bc83f53c20032b7710269b6959af2242676405ad17ea664e05de25f1e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku883900.exeFilesize
359KB
MD54a811332b2b77fd7f2be6031f345cf39
SHA1314d71ce305d7010503c51f6c4587da4370ef9ea
SHA2566f166c9bd3650ebae1c3b2820b9210c2c1e2f488f943a4a4f3fa341e68ebd9d4
SHA512e2d91ca00a4b099d86aacc0bfa654345f8dab8c7d61e163288a1f930084da6ba1600369bc83f53c20032b7710269b6959af2242676405ad17ea664e05de25f1e
-
memory/1692-147-0x0000000000640000-0x000000000064A000-memory.dmpFilesize
40KB
-
memory/3152-1084-0x0000000000960000-0x0000000000992000-memory.dmpFilesize
200KB
-
memory/3152-1085-0x0000000005260000-0x0000000005270000-memory.dmpFilesize
64KB
-
memory/3152-1086-0x0000000005260000-0x0000000005270000-memory.dmpFilesize
64KB
-
memory/4836-189-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/4836-199-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/4836-156-0x0000000006200000-0x0000000006210000-memory.dmpFilesize
64KB
-
memory/4836-157-0x0000000006200000-0x0000000006210000-memory.dmpFilesize
64KB
-
memory/4836-158-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/4836-159-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/4836-161-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/4836-163-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/4836-165-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/4836-167-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/4836-169-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/4836-171-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/4836-173-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/4836-175-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/4836-177-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/4836-179-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/4836-181-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/4836-183-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/4836-185-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/4836-187-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/4836-154-0x0000000006210000-0x00000000067B4000-memory.dmpFilesize
5.6MB
-
memory/4836-191-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/4836-193-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/4836-195-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/4836-197-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/4836-155-0x0000000006200000-0x0000000006210000-memory.dmpFilesize
64KB
-
memory/4836-201-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/4836-203-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/4836-205-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/4836-207-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/4836-209-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/4836-211-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/4836-213-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/4836-215-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/4836-217-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/4836-219-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/4836-221-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/4836-1064-0x00000000068C0000-0x0000000006ED8000-memory.dmpFilesize
6.1MB
-
memory/4836-1065-0x0000000006EE0000-0x0000000006FEA000-memory.dmpFilesize
1.0MB
-
memory/4836-1066-0x0000000007020000-0x0000000007032000-memory.dmpFilesize
72KB
-
memory/4836-1067-0x0000000007040000-0x000000000707C000-memory.dmpFilesize
240KB
-
memory/4836-1068-0x0000000006200000-0x0000000006210000-memory.dmpFilesize
64KB
-
memory/4836-1070-0x0000000007330000-0x00000000073C2000-memory.dmpFilesize
584KB
-
memory/4836-1071-0x00000000073D0000-0x0000000007436000-memory.dmpFilesize
408KB
-
memory/4836-1073-0x0000000006200000-0x0000000006210000-memory.dmpFilesize
64KB
-
memory/4836-1072-0x0000000006200000-0x0000000006210000-memory.dmpFilesize
64KB
-
memory/4836-1074-0x0000000007AF0000-0x0000000007CB2000-memory.dmpFilesize
1.8MB
-
memory/4836-153-0x0000000003730000-0x000000000377B000-memory.dmpFilesize
300KB
-
memory/4836-1075-0x0000000007CD0000-0x00000000081FC000-memory.dmpFilesize
5.2MB
-
memory/4836-1076-0x0000000006200000-0x0000000006210000-memory.dmpFilesize
64KB
-
memory/4836-1077-0x0000000009700000-0x0000000009776000-memory.dmpFilesize
472KB
-
memory/4836-1078-0x0000000009790000-0x00000000097E0000-memory.dmpFilesize
320KB