Analysis
-
max time kernel
54s -
max time network
152s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
31-03-2023 20:44
Static task
static1
Behavioral task
behavioral1
Sample
c862997fe8a5112f4cbe56b6dddc4245605b6f1b0ae344a8375db5ab1f5ff64e.exe
Resource
win10-20230220-en
General
-
Target
c862997fe8a5112f4cbe56b6dddc4245605b6f1b0ae344a8375db5ab1f5ff64e.exe
-
Size
533KB
-
MD5
9eb197c35c50d32a41d9efdb0c17e610
-
SHA1
9ae440e49d5dd80d3ea54e1424be84d3e4a33a8c
-
SHA256
c862997fe8a5112f4cbe56b6dddc4245605b6f1b0ae344a8375db5ab1f5ff64e
-
SHA512
3096943dcf9ef202d6feeb9e7ab74496570b1ec45d8245293ed9dc51ec59bc5721fd84b42e77ddfda4466d1bdb8df95138be128580f3f5c45bd068b653dea0ca
-
SSDEEP
12288:mMrAy90FZEcXalOeu9x7OQg8Q3LqL1hMcRp9bB:iyOEc3eu98Qg8Q3G1lbB
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr136764.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr136764.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr136764.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr136764.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr136764.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr136764.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 37 IoCs
Processes:
resource yara_rule behavioral1/memory/4408-137-0x0000000005FC0000-0x0000000006006000-memory.dmp family_redline behavioral1/memory/4408-139-0x0000000006060000-0x00000000060A4000-memory.dmp family_redline behavioral1/memory/4408-140-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/4408-141-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/4408-143-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/4408-145-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/4408-147-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/4408-148-0x00000000060A0000-0x00000000060B0000-memory.dmp family_redline behavioral1/memory/4408-151-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/4408-149-0x00000000060A0000-0x00000000060B0000-memory.dmp family_redline behavioral1/memory/4408-154-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/4408-156-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/4408-158-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/4408-160-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/4408-162-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/4408-164-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/4408-166-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/4408-168-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/4408-170-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/4408-172-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/4408-174-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/4408-176-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/4408-178-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/4408-180-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/4408-182-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/4408-184-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/4408-186-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/4408-188-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/4408-190-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/4408-192-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/4408-194-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/4408-196-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/4408-198-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/4408-200-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/4408-202-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/4408-204-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/4408-206-0x0000000006060000-0x000000000609F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
zihm2802.exejr136764.exeku619545.exelr915529.exepid process 2384 zihm2802.exe 4652 jr136764.exe 4408 ku619545.exe 3096 lr915529.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr136764.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr136764.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
c862997fe8a5112f4cbe56b6dddc4245605b6f1b0ae344a8375db5ab1f5ff64e.exezihm2802.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce c862997fe8a5112f4cbe56b6dddc4245605b6f1b0ae344a8375db5ab1f5ff64e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c862997fe8a5112f4cbe56b6dddc4245605b6f1b0ae344a8375db5ab1f5ff64e.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zihm2802.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zihm2802.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr136764.exeku619545.exelr915529.exepid process 4652 jr136764.exe 4652 jr136764.exe 4408 ku619545.exe 4408 ku619545.exe 3096 lr915529.exe 3096 lr915529.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr136764.exeku619545.exelr915529.exedescription pid process Token: SeDebugPrivilege 4652 jr136764.exe Token: SeDebugPrivilege 4408 ku619545.exe Token: SeDebugPrivilege 3096 lr915529.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
c862997fe8a5112f4cbe56b6dddc4245605b6f1b0ae344a8375db5ab1f5ff64e.exezihm2802.exedescription pid process target process PID 3704 wrote to memory of 2384 3704 c862997fe8a5112f4cbe56b6dddc4245605b6f1b0ae344a8375db5ab1f5ff64e.exe zihm2802.exe PID 3704 wrote to memory of 2384 3704 c862997fe8a5112f4cbe56b6dddc4245605b6f1b0ae344a8375db5ab1f5ff64e.exe zihm2802.exe PID 3704 wrote to memory of 2384 3704 c862997fe8a5112f4cbe56b6dddc4245605b6f1b0ae344a8375db5ab1f5ff64e.exe zihm2802.exe PID 2384 wrote to memory of 4652 2384 zihm2802.exe jr136764.exe PID 2384 wrote to memory of 4652 2384 zihm2802.exe jr136764.exe PID 2384 wrote to memory of 4408 2384 zihm2802.exe ku619545.exe PID 2384 wrote to memory of 4408 2384 zihm2802.exe ku619545.exe PID 2384 wrote to memory of 4408 2384 zihm2802.exe ku619545.exe PID 3704 wrote to memory of 3096 3704 c862997fe8a5112f4cbe56b6dddc4245605b6f1b0ae344a8375db5ab1f5ff64e.exe lr915529.exe PID 3704 wrote to memory of 3096 3704 c862997fe8a5112f4cbe56b6dddc4245605b6f1b0ae344a8375db5ab1f5ff64e.exe lr915529.exe PID 3704 wrote to memory of 3096 3704 c862997fe8a5112f4cbe56b6dddc4245605b6f1b0ae344a8375db5ab1f5ff64e.exe lr915529.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c862997fe8a5112f4cbe56b6dddc4245605b6f1b0ae344a8375db5ab1f5ff64e.exe"C:\Users\Admin\AppData\Local\Temp\c862997fe8a5112f4cbe56b6dddc4245605b6f1b0ae344a8375db5ab1f5ff64e.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zihm2802.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zihm2802.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr136764.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr136764.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku619545.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku619545.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr915529.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr915529.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr915529.exeFilesize
175KB
MD5b7ec08191a40662d290548676c94665f
SHA1857fbac74aff7a03755b2e991cad0ac2e783bf02
SHA2566a1c8f61ba9ea6e230a29a985c57679ed1aa63b43e9b28d6203ed8d392ae7ee2
SHA512923f20159da8a943c8dd880ad61e8c8c2c2846a96af6b5dda46a5cdb781fa2367895a7109c102bcc8314d9ed22c038ceb1d15fe99da76a58b719c7f12236ff3a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr915529.exeFilesize
175KB
MD5b7ec08191a40662d290548676c94665f
SHA1857fbac74aff7a03755b2e991cad0ac2e783bf02
SHA2566a1c8f61ba9ea6e230a29a985c57679ed1aa63b43e9b28d6203ed8d392ae7ee2
SHA512923f20159da8a943c8dd880ad61e8c8c2c2846a96af6b5dda46a5cdb781fa2367895a7109c102bcc8314d9ed22c038ceb1d15fe99da76a58b719c7f12236ff3a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zihm2802.exeFilesize
392KB
MD517904c68ae742958a0a943c28c701b8e
SHA1f195bf3cb0ce5b2a6874ec8d89c516f453137221
SHA256a3662adc2ac83b051cb3e6b0e17afbebd494009742b61ad59de3042f9099ff30
SHA512eb250efca5e6de287dbc44e5cb909f2bac5713e1d9e33dcbbc3c034475f567e6b4b4d8b5000822f7622fedad98e93fd2853218fe28cf7cc09d815c2b78624252
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zihm2802.exeFilesize
392KB
MD517904c68ae742958a0a943c28c701b8e
SHA1f195bf3cb0ce5b2a6874ec8d89c516f453137221
SHA256a3662adc2ac83b051cb3e6b0e17afbebd494009742b61ad59de3042f9099ff30
SHA512eb250efca5e6de287dbc44e5cb909f2bac5713e1d9e33dcbbc3c034475f567e6b4b4d8b5000822f7622fedad98e93fd2853218fe28cf7cc09d815c2b78624252
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr136764.exeFilesize
11KB
MD510b8a55500ed650d4616f9b1502802b3
SHA122805e11a675bcf2f148f2c104eea9f67327f3de
SHA256d625a4863d8c70c0b3f3270ad3783269108b30e505c8e940cb7e9ec273b026ba
SHA51234fc8e95d761e1147e0c157824fbd41765087c4fee30b80a63e669cafa3a0ed77ce00336efdd4e9f3aed8397065176bbe6025b1c572864be0472371ec0fc8ca6
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr136764.exeFilesize
11KB
MD510b8a55500ed650d4616f9b1502802b3
SHA122805e11a675bcf2f148f2c104eea9f67327f3de
SHA256d625a4863d8c70c0b3f3270ad3783269108b30e505c8e940cb7e9ec273b026ba
SHA51234fc8e95d761e1147e0c157824fbd41765087c4fee30b80a63e669cafa3a0ed77ce00336efdd4e9f3aed8397065176bbe6025b1c572864be0472371ec0fc8ca6
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku619545.exeFilesize
359KB
MD580f9f41bbd61ddd13884f606c2b6f90e
SHA1da68558e36b7d779b632be99aac099ae954f4631
SHA25617d723afb654096df46f49efa4ef6a4d77dddaa3001df0a73d5812b56cb96d55
SHA5123350152d08ebcbfec083afed8a19bc2e7e49134ceb01945d25f44eda9482e9d4404d0cd0164f0439e52381c8cf4bb3a855f3dce90a57db6188b55aa1ea059b63
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku619545.exeFilesize
359KB
MD580f9f41bbd61ddd13884f606c2b6f90e
SHA1da68558e36b7d779b632be99aac099ae954f4631
SHA25617d723afb654096df46f49efa4ef6a4d77dddaa3001df0a73d5812b56cb96d55
SHA5123350152d08ebcbfec083afed8a19bc2e7e49134ceb01945d25f44eda9482e9d4404d0cd0164f0439e52381c8cf4bb3a855f3dce90a57db6188b55aa1ea059b63
-
memory/3096-1071-0x0000000000A20000-0x0000000000A52000-memory.dmpFilesize
200KB
-
memory/3096-1072-0x0000000005460000-0x00000000054AB000-memory.dmpFilesize
300KB
-
memory/3096-1074-0x00000000055E0000-0x00000000055F0000-memory.dmpFilesize
64KB
-
memory/3096-1073-0x00000000055E0000-0x00000000055F0000-memory.dmpFilesize
64KB
-
memory/4408-176-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/4408-190-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/4408-140-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/4408-141-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/4408-143-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/4408-145-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/4408-147-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/4408-148-0x00000000060A0000-0x00000000060B0000-memory.dmpFilesize
64KB
-
memory/4408-151-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/4408-149-0x00000000060A0000-0x00000000060B0000-memory.dmpFilesize
64KB
-
memory/4408-154-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/4408-152-0x00000000060A0000-0x00000000060B0000-memory.dmpFilesize
64KB
-
memory/4408-156-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/4408-158-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/4408-160-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/4408-162-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/4408-164-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/4408-166-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/4408-168-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/4408-170-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/4408-172-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/4408-174-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/4408-138-0x00000000060B0000-0x00000000065AE000-memory.dmpFilesize
5.0MB
-
memory/4408-178-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/4408-180-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/4408-182-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/4408-184-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/4408-186-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/4408-188-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/4408-139-0x0000000006060000-0x00000000060A4000-memory.dmpFilesize
272KB
-
memory/4408-192-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/4408-194-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/4408-196-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/4408-198-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/4408-200-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/4408-202-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/4408-204-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/4408-206-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/4408-1049-0x0000000006C20000-0x0000000007226000-memory.dmpFilesize
6.0MB
-
memory/4408-1050-0x0000000006690000-0x000000000679A000-memory.dmpFilesize
1.0MB
-
memory/4408-1051-0x00000000067D0000-0x00000000067E2000-memory.dmpFilesize
72KB
-
memory/4408-1052-0x00000000060A0000-0x00000000060B0000-memory.dmpFilesize
64KB
-
memory/4408-1053-0x00000000067F0000-0x000000000682E000-memory.dmpFilesize
248KB
-
memory/4408-1054-0x0000000006940000-0x000000000698B000-memory.dmpFilesize
300KB
-
memory/4408-1056-0x0000000006AD0000-0x0000000006B62000-memory.dmpFilesize
584KB
-
memory/4408-1057-0x0000000006B70000-0x0000000006BD6000-memory.dmpFilesize
408KB
-
memory/4408-1058-0x0000000007860000-0x00000000078D6000-memory.dmpFilesize
472KB
-
memory/4408-1059-0x00000000078F0000-0x0000000007940000-memory.dmpFilesize
320KB
-
memory/4408-1060-0x00000000060A0000-0x00000000060B0000-memory.dmpFilesize
64KB
-
memory/4408-1061-0x00000000060A0000-0x00000000060B0000-memory.dmpFilesize
64KB
-
memory/4408-137-0x0000000005FC0000-0x0000000006006000-memory.dmpFilesize
280KB
-
memory/4408-136-0x0000000001B00000-0x0000000001B4B000-memory.dmpFilesize
300KB
-
memory/4408-1062-0x00000000060A0000-0x00000000060B0000-memory.dmpFilesize
64KB
-
memory/4408-1063-0x0000000007A60000-0x0000000007C22000-memory.dmpFilesize
1.8MB
-
memory/4408-1064-0x0000000007C50000-0x000000000817C000-memory.dmpFilesize
5.2MB
-
memory/4408-1065-0x00000000060A0000-0x00000000060B0000-memory.dmpFilesize
64KB
-
memory/4652-130-0x0000000000850000-0x000000000085A000-memory.dmpFilesize
40KB