Analysis
-
max time kernel
61s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 20:39
Static task
static1
Behavioral task
behavioral1
Sample
10c3c26570389422f135ed5e037ecbf7036b229de20b274c52b70d926a9cb1b7.exe
Resource
win10v2004-20230221-en
General
-
Target
10c3c26570389422f135ed5e037ecbf7036b229de20b274c52b70d926a9cb1b7.exe
-
Size
533KB
-
MD5
cf91b8e4785d01340b515232a0783c38
-
SHA1
579865b06fe7d63c0c980d12c847148058ed79be
-
SHA256
10c3c26570389422f135ed5e037ecbf7036b229de20b274c52b70d926a9cb1b7
-
SHA512
f04d96a82e1cf7254c5b78203b0b6febf9a35b5d0835ff079e4108e4e84aed37f3b5c3cbc03a2f89cb26748d376a642d55323c68c5682b3bed809786ca218d64
-
SSDEEP
12288:wMruy90hiigaaI2oo0xsFowIN3LqTIWWgfCXsRk:OyYgaBZxCopN3GsBl
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr288992.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr288992.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr288992.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr288992.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr288992.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr288992.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr288992.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/4144-157-0x00000000066F0000-0x000000000672F000-memory.dmp family_redline behavioral1/memory/4144-158-0x00000000066F0000-0x000000000672F000-memory.dmp family_redline behavioral1/memory/4144-160-0x00000000066F0000-0x000000000672F000-memory.dmp family_redline behavioral1/memory/4144-162-0x00000000066F0000-0x000000000672F000-memory.dmp family_redline behavioral1/memory/4144-164-0x00000000066F0000-0x000000000672F000-memory.dmp family_redline behavioral1/memory/4144-166-0x00000000066F0000-0x000000000672F000-memory.dmp family_redline behavioral1/memory/4144-168-0x00000000066F0000-0x000000000672F000-memory.dmp family_redline behavioral1/memory/4144-170-0x00000000066F0000-0x000000000672F000-memory.dmp family_redline behavioral1/memory/4144-174-0x00000000066F0000-0x000000000672F000-memory.dmp family_redline behavioral1/memory/4144-172-0x00000000066F0000-0x000000000672F000-memory.dmp family_redline behavioral1/memory/4144-176-0x00000000066F0000-0x000000000672F000-memory.dmp family_redline behavioral1/memory/4144-178-0x00000000066F0000-0x000000000672F000-memory.dmp family_redline behavioral1/memory/4144-180-0x00000000066F0000-0x000000000672F000-memory.dmp family_redline behavioral1/memory/4144-182-0x00000000066F0000-0x000000000672F000-memory.dmp family_redline behavioral1/memory/4144-184-0x00000000066F0000-0x000000000672F000-memory.dmp family_redline behavioral1/memory/4144-186-0x00000000066F0000-0x000000000672F000-memory.dmp family_redline behavioral1/memory/4144-188-0x00000000066F0000-0x000000000672F000-memory.dmp family_redline behavioral1/memory/4144-190-0x00000000066F0000-0x000000000672F000-memory.dmp family_redline behavioral1/memory/4144-192-0x00000000066F0000-0x000000000672F000-memory.dmp family_redline behavioral1/memory/4144-194-0x00000000066F0000-0x000000000672F000-memory.dmp family_redline behavioral1/memory/4144-196-0x00000000066F0000-0x000000000672F000-memory.dmp family_redline behavioral1/memory/4144-198-0x00000000066F0000-0x000000000672F000-memory.dmp family_redline behavioral1/memory/4144-200-0x00000000066F0000-0x000000000672F000-memory.dmp family_redline behavioral1/memory/4144-202-0x00000000066F0000-0x000000000672F000-memory.dmp family_redline behavioral1/memory/4144-204-0x00000000066F0000-0x000000000672F000-memory.dmp family_redline behavioral1/memory/4144-206-0x00000000066F0000-0x000000000672F000-memory.dmp family_redline behavioral1/memory/4144-208-0x00000000066F0000-0x000000000672F000-memory.dmp family_redline behavioral1/memory/4144-210-0x00000000066F0000-0x000000000672F000-memory.dmp family_redline behavioral1/memory/4144-212-0x00000000066F0000-0x000000000672F000-memory.dmp family_redline behavioral1/memory/4144-214-0x00000000066F0000-0x000000000672F000-memory.dmp family_redline behavioral1/memory/4144-216-0x00000000066F0000-0x000000000672F000-memory.dmp family_redline behavioral1/memory/4144-218-0x00000000066F0000-0x000000000672F000-memory.dmp family_redline behavioral1/memory/4144-220-0x00000000066F0000-0x000000000672F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
ziGy8433.exejr288992.exeku350220.exelr566332.exepid process 1984 ziGy8433.exe 4756 jr288992.exe 4144 ku350220.exe 4056 lr566332.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr288992.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr288992.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
10c3c26570389422f135ed5e037ecbf7036b229de20b274c52b70d926a9cb1b7.exeziGy8433.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 10c3c26570389422f135ed5e037ecbf7036b229de20b274c52b70d926a9cb1b7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 10c3c26570389422f135ed5e037ecbf7036b229de20b274c52b70d926a9cb1b7.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziGy8433.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziGy8433.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4104 4144 WerFault.exe ku350220.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr288992.exeku350220.exelr566332.exepid process 4756 jr288992.exe 4756 jr288992.exe 4144 ku350220.exe 4144 ku350220.exe 4056 lr566332.exe 4056 lr566332.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr288992.exeku350220.exelr566332.exedescription pid process Token: SeDebugPrivilege 4756 jr288992.exe Token: SeDebugPrivilege 4144 ku350220.exe Token: SeDebugPrivilege 4056 lr566332.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
10c3c26570389422f135ed5e037ecbf7036b229de20b274c52b70d926a9cb1b7.exeziGy8433.exedescription pid process target process PID 2680 wrote to memory of 1984 2680 10c3c26570389422f135ed5e037ecbf7036b229de20b274c52b70d926a9cb1b7.exe ziGy8433.exe PID 2680 wrote to memory of 1984 2680 10c3c26570389422f135ed5e037ecbf7036b229de20b274c52b70d926a9cb1b7.exe ziGy8433.exe PID 2680 wrote to memory of 1984 2680 10c3c26570389422f135ed5e037ecbf7036b229de20b274c52b70d926a9cb1b7.exe ziGy8433.exe PID 1984 wrote to memory of 4756 1984 ziGy8433.exe jr288992.exe PID 1984 wrote to memory of 4756 1984 ziGy8433.exe jr288992.exe PID 1984 wrote to memory of 4144 1984 ziGy8433.exe ku350220.exe PID 1984 wrote to memory of 4144 1984 ziGy8433.exe ku350220.exe PID 1984 wrote to memory of 4144 1984 ziGy8433.exe ku350220.exe PID 2680 wrote to memory of 4056 2680 10c3c26570389422f135ed5e037ecbf7036b229de20b274c52b70d926a9cb1b7.exe lr566332.exe PID 2680 wrote to memory of 4056 2680 10c3c26570389422f135ed5e037ecbf7036b229de20b274c52b70d926a9cb1b7.exe lr566332.exe PID 2680 wrote to memory of 4056 2680 10c3c26570389422f135ed5e037ecbf7036b229de20b274c52b70d926a9cb1b7.exe lr566332.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\10c3c26570389422f135ed5e037ecbf7036b229de20b274c52b70d926a9cb1b7.exe"C:\Users\Admin\AppData\Local\Temp\10c3c26570389422f135ed5e037ecbf7036b229de20b274c52b70d926a9cb1b7.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziGy8433.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziGy8433.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr288992.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr288992.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku350220.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku350220.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 18764⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr566332.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr566332.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4144 -ip 41441⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr566332.exeFilesize
175KB
MD5fc97b52caf1e887f51b8e21b2459e60a
SHA10ea50b3738376ea7a1b0ded18aeec3b0c50b7cdc
SHA256b28067989bae8f240fb97ca57ac27cd0250c595f3846751f5eb8d5530d1e33e8
SHA51237a1ed29b18ef352d022ee9c5e94ccafe8eb6e17b1f78ad0945c86152407f15ce2eebf51a09b3fd3ba30c73a9e3bb52444569f7dbf77ad4162099fb4c33e9254
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr566332.exeFilesize
175KB
MD5fc97b52caf1e887f51b8e21b2459e60a
SHA10ea50b3738376ea7a1b0ded18aeec3b0c50b7cdc
SHA256b28067989bae8f240fb97ca57ac27cd0250c595f3846751f5eb8d5530d1e33e8
SHA51237a1ed29b18ef352d022ee9c5e94ccafe8eb6e17b1f78ad0945c86152407f15ce2eebf51a09b3fd3ba30c73a9e3bb52444569f7dbf77ad4162099fb4c33e9254
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziGy8433.exeFilesize
391KB
MD587f102eb4c0bf6b1989c1481c01fdcb8
SHA123ff912f45e4e66c2f5ed1c7dfdd545f89147155
SHA256e1c52ff6c1d7b9ed09d1996ac35c0e402dc68f5f276f8f3284a104d592931dcb
SHA512bf5b3cf12c8d7fe1ad163760a4a558b42b77397bf6b0fb683d7e829954e59aca22ff1d82e1ac20b445bc12b0c774a67d59caf0cd561aa83ba6860faeeb6ec378
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziGy8433.exeFilesize
391KB
MD587f102eb4c0bf6b1989c1481c01fdcb8
SHA123ff912f45e4e66c2f5ed1c7dfdd545f89147155
SHA256e1c52ff6c1d7b9ed09d1996ac35c0e402dc68f5f276f8f3284a104d592931dcb
SHA512bf5b3cf12c8d7fe1ad163760a4a558b42b77397bf6b0fb683d7e829954e59aca22ff1d82e1ac20b445bc12b0c774a67d59caf0cd561aa83ba6860faeeb6ec378
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr288992.exeFilesize
11KB
MD58ae9a28dc8e090b3f455032427e65a99
SHA107f120d19ec3522a9ff8ec35237d748cda1b8450
SHA25634a987981c8737cd20c925ab2ed8df0e4977acfcf12d5432c3118cd9af7f2a05
SHA512a192629f7f4e1136b7703c20ef3b23091f3d79e5732d870518b51167bf08ae654b64617b3ba08265c6b159de1a6fbfb0f4579292fbd07acd65144fa4c3653fd5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr288992.exeFilesize
11KB
MD58ae9a28dc8e090b3f455032427e65a99
SHA107f120d19ec3522a9ff8ec35237d748cda1b8450
SHA25634a987981c8737cd20c925ab2ed8df0e4977acfcf12d5432c3118cd9af7f2a05
SHA512a192629f7f4e1136b7703c20ef3b23091f3d79e5732d870518b51167bf08ae654b64617b3ba08265c6b159de1a6fbfb0f4579292fbd07acd65144fa4c3653fd5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku350220.exeFilesize
359KB
MD5bfc7546ba4e58b5ec95ca937c3e1e2fc
SHA1ac1180a1aeb7fc3f19942cd4e2687f4be45a0c8e
SHA2560dbfc9a2b15906a0b0fac7f7cfe9c8c6d4c6a838ffbfd86902e302876d5ea86e
SHA512f6e91eeb6f17f2e81f844719ef207ec689bc77495c8381f621262e525f2cb181d349c52c3f7dda393d06e98f463a19272212f7b29ff3f2241f563a8d11f88149
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku350220.exeFilesize
359KB
MD5bfc7546ba4e58b5ec95ca937c3e1e2fc
SHA1ac1180a1aeb7fc3f19942cd4e2687f4be45a0c8e
SHA2560dbfc9a2b15906a0b0fac7f7cfe9c8c6d4c6a838ffbfd86902e302876d5ea86e
SHA512f6e91eeb6f17f2e81f844719ef207ec689bc77495c8381f621262e525f2cb181d349c52c3f7dda393d06e98f463a19272212f7b29ff3f2241f563a8d11f88149
-
memory/4056-1085-0x0000000000CD0000-0x0000000000D02000-memory.dmpFilesize
200KB
-
memory/4056-1086-0x0000000005930000-0x0000000005940000-memory.dmpFilesize
64KB
-
memory/4144-188-0x00000000066F0000-0x000000000672F000-memory.dmpFilesize
252KB
-
memory/4144-198-0x00000000066F0000-0x000000000672F000-memory.dmpFilesize
252KB
-
memory/4144-155-0x0000000003CB0000-0x0000000003CC0000-memory.dmpFilesize
64KB
-
memory/4144-156-0x0000000003CB0000-0x0000000003CC0000-memory.dmpFilesize
64KB
-
memory/4144-157-0x00000000066F0000-0x000000000672F000-memory.dmpFilesize
252KB
-
memory/4144-158-0x00000000066F0000-0x000000000672F000-memory.dmpFilesize
252KB
-
memory/4144-160-0x00000000066F0000-0x000000000672F000-memory.dmpFilesize
252KB
-
memory/4144-162-0x00000000066F0000-0x000000000672F000-memory.dmpFilesize
252KB
-
memory/4144-164-0x00000000066F0000-0x000000000672F000-memory.dmpFilesize
252KB
-
memory/4144-166-0x00000000066F0000-0x000000000672F000-memory.dmpFilesize
252KB
-
memory/4144-168-0x00000000066F0000-0x000000000672F000-memory.dmpFilesize
252KB
-
memory/4144-170-0x00000000066F0000-0x000000000672F000-memory.dmpFilesize
252KB
-
memory/4144-174-0x00000000066F0000-0x000000000672F000-memory.dmpFilesize
252KB
-
memory/4144-172-0x00000000066F0000-0x000000000672F000-memory.dmpFilesize
252KB
-
memory/4144-176-0x00000000066F0000-0x000000000672F000-memory.dmpFilesize
252KB
-
memory/4144-178-0x00000000066F0000-0x000000000672F000-memory.dmpFilesize
252KB
-
memory/4144-180-0x00000000066F0000-0x000000000672F000-memory.dmpFilesize
252KB
-
memory/4144-182-0x00000000066F0000-0x000000000672F000-memory.dmpFilesize
252KB
-
memory/4144-184-0x00000000066F0000-0x000000000672F000-memory.dmpFilesize
252KB
-
memory/4144-186-0x00000000066F0000-0x000000000672F000-memory.dmpFilesize
252KB
-
memory/4144-153-0x0000000001C90000-0x0000000001CDB000-memory.dmpFilesize
300KB
-
memory/4144-190-0x00000000066F0000-0x000000000672F000-memory.dmpFilesize
252KB
-
memory/4144-192-0x00000000066F0000-0x000000000672F000-memory.dmpFilesize
252KB
-
memory/4144-194-0x00000000066F0000-0x000000000672F000-memory.dmpFilesize
252KB
-
memory/4144-196-0x00000000066F0000-0x000000000672F000-memory.dmpFilesize
252KB
-
memory/4144-154-0x0000000006140000-0x00000000066E4000-memory.dmpFilesize
5.6MB
-
memory/4144-200-0x00000000066F0000-0x000000000672F000-memory.dmpFilesize
252KB
-
memory/4144-202-0x00000000066F0000-0x000000000672F000-memory.dmpFilesize
252KB
-
memory/4144-204-0x00000000066F0000-0x000000000672F000-memory.dmpFilesize
252KB
-
memory/4144-206-0x00000000066F0000-0x000000000672F000-memory.dmpFilesize
252KB
-
memory/4144-208-0x00000000066F0000-0x000000000672F000-memory.dmpFilesize
252KB
-
memory/4144-210-0x00000000066F0000-0x000000000672F000-memory.dmpFilesize
252KB
-
memory/4144-212-0x00000000066F0000-0x000000000672F000-memory.dmpFilesize
252KB
-
memory/4144-214-0x00000000066F0000-0x000000000672F000-memory.dmpFilesize
252KB
-
memory/4144-216-0x00000000066F0000-0x000000000672F000-memory.dmpFilesize
252KB
-
memory/4144-218-0x00000000066F0000-0x000000000672F000-memory.dmpFilesize
252KB
-
memory/4144-220-0x00000000066F0000-0x000000000672F000-memory.dmpFilesize
252KB
-
memory/4144-1063-0x0000000006730000-0x0000000006D48000-memory.dmpFilesize
6.1MB
-
memory/4144-1064-0x0000000006DA0000-0x0000000006EAA000-memory.dmpFilesize
1.0MB
-
memory/4144-1065-0x0000000006EE0000-0x0000000006EF2000-memory.dmpFilesize
72KB
-
memory/4144-1066-0x0000000003CB0000-0x0000000003CC0000-memory.dmpFilesize
64KB
-
memory/4144-1067-0x0000000006F00000-0x0000000006F3C000-memory.dmpFilesize
240KB
-
memory/4144-1069-0x0000000003CB0000-0x0000000003CC0000-memory.dmpFilesize
64KB
-
memory/4144-1070-0x0000000003CB0000-0x0000000003CC0000-memory.dmpFilesize
64KB
-
memory/4144-1071-0x0000000003CB0000-0x0000000003CC0000-memory.dmpFilesize
64KB
-
memory/4144-1073-0x00000000071F0000-0x0000000007282000-memory.dmpFilesize
584KB
-
memory/4144-1074-0x0000000007290000-0x00000000072F6000-memory.dmpFilesize
408KB
-
memory/4144-1075-0x0000000007BF0000-0x0000000007C66000-memory.dmpFilesize
472KB
-
memory/4144-1076-0x0000000007C70000-0x0000000007CC0000-memory.dmpFilesize
320KB
-
memory/4144-1077-0x0000000007E20000-0x0000000007FE2000-memory.dmpFilesize
1.8MB
-
memory/4144-1078-0x0000000008000000-0x000000000852C000-memory.dmpFilesize
5.2MB
-
memory/4756-147-0x00000000004B0000-0x00000000004BA000-memory.dmpFilesize
40KB