Analysis
-
max time kernel
135s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 20:38
Static task
static1
Behavioral task
behavioral1
Sample
b7c225f0e3d4554ab6476899c3ae44280dd839f44f1e8bf5881219326393c355.exe
Resource
win10v2004-20230220-en
General
-
Target
b7c225f0e3d4554ab6476899c3ae44280dd839f44f1e8bf5881219326393c355.exe
-
Size
671KB
-
MD5
3e8672c566fc3386c3ac1a4776e2aff9
-
SHA1
24fd46de105dbf442e8ee2afddb8dd7178fcc661
-
SHA256
b7c225f0e3d4554ab6476899c3ae44280dd839f44f1e8bf5881219326393c355
-
SHA512
53da3dc3f8846d39d3737d66b4f757787fb341e69d49311feaaacf36279cc13ac59b004c5522416e689ca978fa0fa1796fcf326e9fa61d78339c9913827e05d2
-
SSDEEP
12288:dMrEy90+jf2MQY0uprU/GZDAJK7X225A50fgVkkL6VZxnxhKRnX73LqfsVjJAF8:RyHmgU/GlNX225A50fb46VZxCxX73GfM
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro1318.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro1318.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro1318.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro1318.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro1318.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro1318.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro1318.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/232-190-0x00000000060A0000-0x00000000060DF000-memory.dmp family_redline behavioral1/memory/232-191-0x00000000060A0000-0x00000000060DF000-memory.dmp family_redline behavioral1/memory/232-193-0x00000000060A0000-0x00000000060DF000-memory.dmp family_redline behavioral1/memory/232-195-0x00000000060A0000-0x00000000060DF000-memory.dmp family_redline behavioral1/memory/232-197-0x00000000060A0000-0x00000000060DF000-memory.dmp family_redline behavioral1/memory/232-199-0x00000000060A0000-0x00000000060DF000-memory.dmp family_redline behavioral1/memory/232-201-0x00000000060A0000-0x00000000060DF000-memory.dmp family_redline behavioral1/memory/232-203-0x00000000060A0000-0x00000000060DF000-memory.dmp family_redline behavioral1/memory/232-205-0x00000000060A0000-0x00000000060DF000-memory.dmp family_redline behavioral1/memory/232-207-0x00000000060A0000-0x00000000060DF000-memory.dmp family_redline behavioral1/memory/232-210-0x00000000060A0000-0x00000000060DF000-memory.dmp family_redline behavioral1/memory/232-213-0x00000000060A0000-0x00000000060DF000-memory.dmp family_redline behavioral1/memory/232-214-0x0000000006130000-0x0000000006140000-memory.dmp family_redline behavioral1/memory/232-217-0x00000000060A0000-0x00000000060DF000-memory.dmp family_redline behavioral1/memory/232-219-0x00000000060A0000-0x00000000060DF000-memory.dmp family_redline behavioral1/memory/232-221-0x00000000060A0000-0x00000000060DF000-memory.dmp family_redline behavioral1/memory/232-223-0x00000000060A0000-0x00000000060DF000-memory.dmp family_redline behavioral1/memory/232-225-0x00000000060A0000-0x00000000060DF000-memory.dmp family_redline behavioral1/memory/232-227-0x00000000060A0000-0x00000000060DF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un546408.exepro1318.exequ9080.exesi505126.exepid process 1068 un546408.exe 1104 pro1318.exe 232 qu9080.exe 992 si505126.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro1318.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro1318.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro1318.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un546408.exeb7c225f0e3d4554ab6476899c3ae44280dd839f44f1e8bf5881219326393c355.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un546408.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un546408.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce b7c225f0e3d4554ab6476899c3ae44280dd839f44f1e8bf5881219326393c355.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" b7c225f0e3d4554ab6476899c3ae44280dd839f44f1e8bf5881219326393c355.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3572 1104 WerFault.exe pro1318.exe 744 232 WerFault.exe qu9080.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro1318.exequ9080.exesi505126.exepid process 1104 pro1318.exe 1104 pro1318.exe 232 qu9080.exe 232 qu9080.exe 992 si505126.exe 992 si505126.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro1318.exequ9080.exesi505126.exedescription pid process Token: SeDebugPrivilege 1104 pro1318.exe Token: SeDebugPrivilege 232 qu9080.exe Token: SeDebugPrivilege 992 si505126.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
b7c225f0e3d4554ab6476899c3ae44280dd839f44f1e8bf5881219326393c355.exeun546408.exedescription pid process target process PID 1428 wrote to memory of 1068 1428 b7c225f0e3d4554ab6476899c3ae44280dd839f44f1e8bf5881219326393c355.exe un546408.exe PID 1428 wrote to memory of 1068 1428 b7c225f0e3d4554ab6476899c3ae44280dd839f44f1e8bf5881219326393c355.exe un546408.exe PID 1428 wrote to memory of 1068 1428 b7c225f0e3d4554ab6476899c3ae44280dd839f44f1e8bf5881219326393c355.exe un546408.exe PID 1068 wrote to memory of 1104 1068 un546408.exe pro1318.exe PID 1068 wrote to memory of 1104 1068 un546408.exe pro1318.exe PID 1068 wrote to memory of 1104 1068 un546408.exe pro1318.exe PID 1068 wrote to memory of 232 1068 un546408.exe qu9080.exe PID 1068 wrote to memory of 232 1068 un546408.exe qu9080.exe PID 1068 wrote to memory of 232 1068 un546408.exe qu9080.exe PID 1428 wrote to memory of 992 1428 b7c225f0e3d4554ab6476899c3ae44280dd839f44f1e8bf5881219326393c355.exe si505126.exe PID 1428 wrote to memory of 992 1428 b7c225f0e3d4554ab6476899c3ae44280dd839f44f1e8bf5881219326393c355.exe si505126.exe PID 1428 wrote to memory of 992 1428 b7c225f0e3d4554ab6476899c3ae44280dd839f44f1e8bf5881219326393c355.exe si505126.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7c225f0e3d4554ab6476899c3ae44280dd839f44f1e8bf5881219326393c355.exe"C:\Users\Admin\AppData\Local\Temp\b7c225f0e3d4554ab6476899c3ae44280dd839f44f1e8bf5881219326393c355.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un546408.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un546408.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1318.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1318.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 10844⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9080.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9080.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 232 -s 19284⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si505126.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si505126.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1104 -ip 11041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 232 -ip 2321⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si505126.exeFilesize
175KB
MD5cf0996241a9dc0fa19bd43977d4fd0c3
SHA193bda3b40dc24362e01f0b764b1b60564d710df1
SHA2560adefe49611e8c4349a3ffd17b4bbc1147a1e883b94ce07265d7ad4d12db292c
SHA512b3b16a6740d633d9c8b0b910cb1b405dec59c1fcdb5c9c86beb3087e2da977656260775f3293a9829e7085258b01e772a9cc65de05f6dd95e8d269afbc17ea1d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si505126.exeFilesize
175KB
MD5cf0996241a9dc0fa19bd43977d4fd0c3
SHA193bda3b40dc24362e01f0b764b1b60564d710df1
SHA2560adefe49611e8c4349a3ffd17b4bbc1147a1e883b94ce07265d7ad4d12db292c
SHA512b3b16a6740d633d9c8b0b910cb1b405dec59c1fcdb5c9c86beb3087e2da977656260775f3293a9829e7085258b01e772a9cc65de05f6dd95e8d269afbc17ea1d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un546408.exeFilesize
529KB
MD5f2c18edda02739aff983b2209e38fe82
SHA1a209e6beb9f99594fd14c8b411fb251fcee0fc49
SHA256635384a09b68cb3f216ed7d0fd86fbd426b563f4c74a9b29f2f2212b7cd3ed8f
SHA512eabc20483c6531a6688f51ac88da7ed71473a3abfc63cca0495192ad80dc974fa047087bc8d92903ec9ff4eee3d84708a08ea0799a0539cc9cb3f6c43c7606fc
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un546408.exeFilesize
529KB
MD5f2c18edda02739aff983b2209e38fe82
SHA1a209e6beb9f99594fd14c8b411fb251fcee0fc49
SHA256635384a09b68cb3f216ed7d0fd86fbd426b563f4c74a9b29f2f2212b7cd3ed8f
SHA512eabc20483c6531a6688f51ac88da7ed71473a3abfc63cca0495192ad80dc974fa047087bc8d92903ec9ff4eee3d84708a08ea0799a0539cc9cb3f6c43c7606fc
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1318.exeFilesize
301KB
MD52b968ec62c2d85c7f558bc9d0006d41f
SHA1067096d49c4a53bbf13307387324c235e4cfe672
SHA256d18d4b912061331ce8e685ccda28f9287e39a038db07812c26ba525546479a41
SHA51244adbed69bc58f291b84bfb53be7d96d08730fa0d2cab46d315b29da54c1c0986ef240c58867436f834acc8c27d6cd130d4815e342df3609c699b5569016f853
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1318.exeFilesize
301KB
MD52b968ec62c2d85c7f558bc9d0006d41f
SHA1067096d49c4a53bbf13307387324c235e4cfe672
SHA256d18d4b912061331ce8e685ccda28f9287e39a038db07812c26ba525546479a41
SHA51244adbed69bc58f291b84bfb53be7d96d08730fa0d2cab46d315b29da54c1c0986ef240c58867436f834acc8c27d6cd130d4815e342df3609c699b5569016f853
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9080.exeFilesize
359KB
MD5cd9b8fd8b703c7ed673e2a23f6ffa136
SHA1c3f4d8466f450f9f8de76da9163b57a7f706b2a0
SHA25603466228adb715901d8860585783f551d781d84173850726344a58755e2506e0
SHA51266aa74b4989f6a8b43ffb09034926765cb321937e53d8ad6b61398fab81bcb067b6e26b7cdeae8f984c8bdbf14ec5ada1a5e575b7a1fbaf995db2edc5b482a0e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9080.exeFilesize
359KB
MD5cd9b8fd8b703c7ed673e2a23f6ffa136
SHA1c3f4d8466f450f9f8de76da9163b57a7f706b2a0
SHA25603466228adb715901d8860585783f551d781d84173850726344a58755e2506e0
SHA51266aa74b4989f6a8b43ffb09034926765cb321937e53d8ad6b61398fab81bcb067b6e26b7cdeae8f984c8bdbf14ec5ada1a5e575b7a1fbaf995db2edc5b482a0e
-
memory/232-227-0x00000000060A0000-0x00000000060DF000-memory.dmpFilesize
252KB
-
memory/232-1102-0x0000000006EE0000-0x0000000006EF2000-memory.dmpFilesize
72KB
-
memory/232-1115-0x0000000008380000-0x00000000083D0000-memory.dmpFilesize
320KB
-
memory/232-1114-0x00000000082F0000-0x0000000008366000-memory.dmpFilesize
472KB
-
memory/232-1113-0x0000000006130000-0x0000000006140000-memory.dmpFilesize
64KB
-
memory/232-1112-0x0000000007C90000-0x00000000081BC000-memory.dmpFilesize
5.2MB
-
memory/232-1111-0x0000000007AB0000-0x0000000007C72000-memory.dmpFilesize
1.8MB
-
memory/232-1110-0x0000000006130000-0x0000000006140000-memory.dmpFilesize
64KB
-
memory/232-1109-0x0000000006130000-0x0000000006140000-memory.dmpFilesize
64KB
-
memory/232-1108-0x0000000006130000-0x0000000006140000-memory.dmpFilesize
64KB
-
memory/232-1107-0x0000000007290000-0x00000000072F6000-memory.dmpFilesize
408KB
-
memory/232-1106-0x00000000071F0000-0x0000000007282000-memory.dmpFilesize
584KB
-
memory/232-1104-0x0000000006130000-0x0000000006140000-memory.dmpFilesize
64KB
-
memory/232-1103-0x0000000006F00000-0x0000000006F3C000-memory.dmpFilesize
240KB
-
memory/232-1101-0x0000000006DA0000-0x0000000006EAA000-memory.dmpFilesize
1.0MB
-
memory/232-1100-0x0000000006700000-0x0000000006D18000-memory.dmpFilesize
6.1MB
-
memory/232-225-0x00000000060A0000-0x00000000060DF000-memory.dmpFilesize
252KB
-
memory/232-223-0x00000000060A0000-0x00000000060DF000-memory.dmpFilesize
252KB
-
memory/232-221-0x00000000060A0000-0x00000000060DF000-memory.dmpFilesize
252KB
-
memory/232-219-0x00000000060A0000-0x00000000060DF000-memory.dmpFilesize
252KB
-
memory/232-217-0x00000000060A0000-0x00000000060DF000-memory.dmpFilesize
252KB
-
memory/232-216-0x0000000006130000-0x0000000006140000-memory.dmpFilesize
64KB
-
memory/232-190-0x00000000060A0000-0x00000000060DF000-memory.dmpFilesize
252KB
-
memory/232-191-0x00000000060A0000-0x00000000060DF000-memory.dmpFilesize
252KB
-
memory/232-193-0x00000000060A0000-0x00000000060DF000-memory.dmpFilesize
252KB
-
memory/232-195-0x00000000060A0000-0x00000000060DF000-memory.dmpFilesize
252KB
-
memory/232-197-0x00000000060A0000-0x00000000060DF000-memory.dmpFilesize
252KB
-
memory/232-199-0x00000000060A0000-0x00000000060DF000-memory.dmpFilesize
252KB
-
memory/232-201-0x00000000060A0000-0x00000000060DF000-memory.dmpFilesize
252KB
-
memory/232-203-0x00000000060A0000-0x00000000060DF000-memory.dmpFilesize
252KB
-
memory/232-205-0x00000000060A0000-0x00000000060DF000-memory.dmpFilesize
252KB
-
memory/232-207-0x00000000060A0000-0x00000000060DF000-memory.dmpFilesize
252KB
-
memory/232-209-0x0000000003730000-0x000000000377B000-memory.dmpFilesize
300KB
-
memory/232-210-0x00000000060A0000-0x00000000060DF000-memory.dmpFilesize
252KB
-
memory/232-212-0x0000000006130000-0x0000000006140000-memory.dmpFilesize
64KB
-
memory/232-213-0x00000000060A0000-0x00000000060DF000-memory.dmpFilesize
252KB
-
memory/232-214-0x0000000006130000-0x0000000006140000-memory.dmpFilesize
64KB
-
memory/992-1121-0x00000000008D0000-0x0000000000902000-memory.dmpFilesize
200KB
-
memory/992-1122-0x0000000005230000-0x0000000005240000-memory.dmpFilesize
64KB
-
memory/1104-174-0x0000000003A40000-0x0000000003A52000-memory.dmpFilesize
72KB
-
memory/1104-148-0x0000000001C80000-0x0000000001CAD000-memory.dmpFilesize
180KB
-
memory/1104-183-0x00000000062F0000-0x0000000006300000-memory.dmpFilesize
64KB
-
memory/1104-181-0x0000000000400000-0x0000000001AE3000-memory.dmpFilesize
22.9MB
-
memory/1104-150-0x0000000006300000-0x00000000068A4000-memory.dmpFilesize
5.6MB
-
memory/1104-180-0x00000000062F0000-0x0000000006300000-memory.dmpFilesize
64KB
-
memory/1104-179-0x00000000062F0000-0x0000000006300000-memory.dmpFilesize
64KB
-
memory/1104-154-0x0000000003A40000-0x0000000003A52000-memory.dmpFilesize
72KB
-
memory/1104-178-0x0000000003A40000-0x0000000003A52000-memory.dmpFilesize
72KB
-
memory/1104-176-0x0000000003A40000-0x0000000003A52000-memory.dmpFilesize
72KB
-
memory/1104-152-0x0000000003A40000-0x0000000003A52000-memory.dmpFilesize
72KB
-
memory/1104-184-0x00000000062F0000-0x0000000006300000-memory.dmpFilesize
64KB
-
memory/1104-166-0x0000000003A40000-0x0000000003A52000-memory.dmpFilesize
72KB
-
memory/1104-168-0x0000000003A40000-0x0000000003A52000-memory.dmpFilesize
72KB
-
memory/1104-170-0x0000000003A40000-0x0000000003A52000-memory.dmpFilesize
72KB
-
memory/1104-164-0x0000000003A40000-0x0000000003A52000-memory.dmpFilesize
72KB
-
memory/1104-162-0x0000000003A40000-0x0000000003A52000-memory.dmpFilesize
72KB
-
memory/1104-160-0x0000000003A40000-0x0000000003A52000-memory.dmpFilesize
72KB
-
memory/1104-158-0x0000000003A40000-0x0000000003A52000-memory.dmpFilesize
72KB
-
memory/1104-156-0x0000000003A40000-0x0000000003A52000-memory.dmpFilesize
72KB
-
memory/1104-149-0x00000000062F0000-0x0000000006300000-memory.dmpFilesize
64KB
-
memory/1104-172-0x0000000003A40000-0x0000000003A52000-memory.dmpFilesize
72KB
-
memory/1104-185-0x0000000000400000-0x0000000001AE3000-memory.dmpFilesize
22.9MB
-
memory/1104-151-0x0000000003A40000-0x0000000003A52000-memory.dmpFilesize
72KB