Analysis
-
max time kernel
85s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 20:42
Static task
static1
Behavioral task
behavioral1
Sample
129a54a8611b59eac1f1f2b06f98cad7ab091f27abbeacedfe853d44ebf4935d.exe
Resource
win10v2004-20230220-en
General
-
Target
129a54a8611b59eac1f1f2b06f98cad7ab091f27abbeacedfe853d44ebf4935d.exe
-
Size
533KB
-
MD5
0b1df7f9259bfd4df96a28c5abbdcffb
-
SHA1
c0746878aa00ea36b0474733a3294f99be4aa1b0
-
SHA256
129a54a8611b59eac1f1f2b06f98cad7ab091f27abbeacedfe853d44ebf4935d
-
SHA512
5f0a41e028bd33ebc52ee9994cb7c3d5ef1377bdb86271d8e91d267f5f4c08f731ea11de22b771d4a0a82d02a2d5e08442f574d075727f463280cec027bbae2a
-
SSDEEP
12288:MMriy90NAfu/ZPpD6IH6c6n3LqCG1h6PE1:2ysAfu/ZPpDdH6/n3GC5C
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr895522.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr895522.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr895522.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr895522.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr895522.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr895522.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr895522.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/1340-158-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1340-159-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1340-161-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1340-163-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1340-165-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1340-167-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1340-169-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1340-171-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1340-173-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1340-175-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1340-177-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1340-179-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1340-181-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1340-183-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1340-185-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1340-187-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1340-189-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1340-191-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1340-193-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1340-195-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1340-197-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1340-199-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1340-201-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1340-203-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1340-205-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1340-207-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1340-209-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1340-211-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1340-213-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1340-215-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1340-217-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1340-219-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/1340-221-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
ziYX4928.exejr895522.exeku823799.exelr418907.exepid process 4240 ziYX4928.exe 1120 jr895522.exe 1340 ku823799.exe 996 lr418907.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr895522.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr895522.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
ziYX4928.exe129a54a8611b59eac1f1f2b06f98cad7ab091f27abbeacedfe853d44ebf4935d.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziYX4928.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziYX4928.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 129a54a8611b59eac1f1f2b06f98cad7ab091f27abbeacedfe853d44ebf4935d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 129a54a8611b59eac1f1f2b06f98cad7ab091f27abbeacedfe853d44ebf4935d.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4648 1340 WerFault.exe ku823799.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr895522.exeku823799.exelr418907.exepid process 1120 jr895522.exe 1120 jr895522.exe 1340 ku823799.exe 1340 ku823799.exe 996 lr418907.exe 996 lr418907.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr895522.exeku823799.exelr418907.exedescription pid process Token: SeDebugPrivilege 1120 jr895522.exe Token: SeDebugPrivilege 1340 ku823799.exe Token: SeDebugPrivilege 996 lr418907.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
129a54a8611b59eac1f1f2b06f98cad7ab091f27abbeacedfe853d44ebf4935d.exeziYX4928.exedescription pid process target process PID 4892 wrote to memory of 4240 4892 129a54a8611b59eac1f1f2b06f98cad7ab091f27abbeacedfe853d44ebf4935d.exe ziYX4928.exe PID 4892 wrote to memory of 4240 4892 129a54a8611b59eac1f1f2b06f98cad7ab091f27abbeacedfe853d44ebf4935d.exe ziYX4928.exe PID 4892 wrote to memory of 4240 4892 129a54a8611b59eac1f1f2b06f98cad7ab091f27abbeacedfe853d44ebf4935d.exe ziYX4928.exe PID 4240 wrote to memory of 1120 4240 ziYX4928.exe jr895522.exe PID 4240 wrote to memory of 1120 4240 ziYX4928.exe jr895522.exe PID 4240 wrote to memory of 1340 4240 ziYX4928.exe ku823799.exe PID 4240 wrote to memory of 1340 4240 ziYX4928.exe ku823799.exe PID 4240 wrote to memory of 1340 4240 ziYX4928.exe ku823799.exe PID 4892 wrote to memory of 996 4892 129a54a8611b59eac1f1f2b06f98cad7ab091f27abbeacedfe853d44ebf4935d.exe lr418907.exe PID 4892 wrote to memory of 996 4892 129a54a8611b59eac1f1f2b06f98cad7ab091f27abbeacedfe853d44ebf4935d.exe lr418907.exe PID 4892 wrote to memory of 996 4892 129a54a8611b59eac1f1f2b06f98cad7ab091f27abbeacedfe853d44ebf4935d.exe lr418907.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\129a54a8611b59eac1f1f2b06f98cad7ab091f27abbeacedfe853d44ebf4935d.exe"C:\Users\Admin\AppData\Local\Temp\129a54a8611b59eac1f1f2b06f98cad7ab091f27abbeacedfe853d44ebf4935d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziYX4928.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziYX4928.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr895522.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr895522.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku823799.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku823799.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 13764⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr418907.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr418907.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1340 -ip 13401⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr418907.exeFilesize
175KB
MD5efa370cacd287d7a84a64bd56208475c
SHA14ad8d948901b05d2be16fc6b93a5d1dbddf97612
SHA256d211e6eb8810f4f9b16f2c1ca8f03622394d20128f389ce9b20e58d9bde71ae8
SHA512f854249da4bed654dfe84aa013975a8eb74a0082334213d5a8487f442d1b4cd2185aa3b1d30c1fae250d3d9b96a2283148e977e0e1e77701353706276982c2d6
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr418907.exeFilesize
175KB
MD5efa370cacd287d7a84a64bd56208475c
SHA14ad8d948901b05d2be16fc6b93a5d1dbddf97612
SHA256d211e6eb8810f4f9b16f2c1ca8f03622394d20128f389ce9b20e58d9bde71ae8
SHA512f854249da4bed654dfe84aa013975a8eb74a0082334213d5a8487f442d1b4cd2185aa3b1d30c1fae250d3d9b96a2283148e977e0e1e77701353706276982c2d6
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziYX4928.exeFilesize
391KB
MD53f7af7360ecf3438332a10872dff697f
SHA19ab8a2733ca83d36abaf17ec9f187bc643d4f2cd
SHA2567d0ea3bc3354d2620f80ba9379332d56a810cc72c70a2e30dd9de9c14d03bb4c
SHA512c6d1508d7540ea850488827186c7b3f9d1eae6577296668b0a2c9f5d950d32e61cbf18cb363775521aba4ca6464884dcd4abadc8fefb39e9199162b0376a1699
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziYX4928.exeFilesize
391KB
MD53f7af7360ecf3438332a10872dff697f
SHA19ab8a2733ca83d36abaf17ec9f187bc643d4f2cd
SHA2567d0ea3bc3354d2620f80ba9379332d56a810cc72c70a2e30dd9de9c14d03bb4c
SHA512c6d1508d7540ea850488827186c7b3f9d1eae6577296668b0a2c9f5d950d32e61cbf18cb363775521aba4ca6464884dcd4abadc8fefb39e9199162b0376a1699
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr895522.exeFilesize
11KB
MD57d2cfcff3ca68fcc3095f17a1c88dab2
SHA140d0d506888ee124c6165f52680604988fe6a403
SHA25641164d42beb746ade5ed1304a5c48494b3f59c440644cc15940e9dec33d9e3b9
SHA5124e8cb9ed743e39b1ab652e882304e4fe9806437d6f4cb36443b455bd3f0340cc9b3109bc16f3bcb3226db4835f1a29c81d72baf1e6daaf39182d133d6beeabff
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr895522.exeFilesize
11KB
MD57d2cfcff3ca68fcc3095f17a1c88dab2
SHA140d0d506888ee124c6165f52680604988fe6a403
SHA25641164d42beb746ade5ed1304a5c48494b3f59c440644cc15940e9dec33d9e3b9
SHA5124e8cb9ed743e39b1ab652e882304e4fe9806437d6f4cb36443b455bd3f0340cc9b3109bc16f3bcb3226db4835f1a29c81d72baf1e6daaf39182d133d6beeabff
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku823799.exeFilesize
359KB
MD5fb0354f0ad3acadfef438e33873bc553
SHA1837956e0a72c7f4b4fdeb44561fe251acbd1f7d4
SHA256f872bab6cb7cda69180ccf50228775d15aaaa11b26323c7504a7bd62aabd5369
SHA512fb6471f507a2141cbe8c5805228aed01adfc717ed8b5bc6da3cfe394cd6d43609f243a0a4bacfb6ca1315145282d15a61cc21edfb71dc8c1eebbeac636fd7098
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku823799.exeFilesize
359KB
MD5fb0354f0ad3acadfef438e33873bc553
SHA1837956e0a72c7f4b4fdeb44561fe251acbd1f7d4
SHA256f872bab6cb7cda69180ccf50228775d15aaaa11b26323c7504a7bd62aabd5369
SHA512fb6471f507a2141cbe8c5805228aed01adfc717ed8b5bc6da3cfe394cd6d43609f243a0a4bacfb6ca1315145282d15a61cc21edfb71dc8c1eebbeac636fd7098
-
memory/996-1086-0x0000000000E40000-0x0000000000E72000-memory.dmpFilesize
200KB
-
memory/996-1087-0x00000000057A0000-0x00000000057B0000-memory.dmpFilesize
64KB
-
memory/996-1088-0x00000000057A0000-0x00000000057B0000-memory.dmpFilesize
64KB
-
memory/1120-147-0x00000000003E0000-0x00000000003EA000-memory.dmpFilesize
40KB
-
memory/1340-189-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1340-203-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1340-155-0x0000000006220000-0x0000000006230000-memory.dmpFilesize
64KB
-
memory/1340-157-0x0000000006220000-0x0000000006230000-memory.dmpFilesize
64KB
-
memory/1340-158-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1340-159-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1340-161-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1340-163-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1340-165-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1340-167-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1340-169-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1340-171-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1340-173-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1340-175-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1340-177-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1340-179-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1340-181-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1340-183-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1340-185-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1340-187-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1340-154-0x0000000003780000-0x00000000037CB000-memory.dmpFilesize
300KB
-
memory/1340-191-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1340-193-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1340-195-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1340-197-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1340-199-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1340-201-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1340-156-0x0000000006220000-0x0000000006230000-memory.dmpFilesize
64KB
-
memory/1340-205-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1340-207-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1340-209-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1340-211-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1340-213-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1340-215-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1340-217-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1340-219-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1340-221-0x00000000060D0000-0x000000000610F000-memory.dmpFilesize
252KB
-
memory/1340-1064-0x00000000068E0000-0x0000000006EF8000-memory.dmpFilesize
6.1MB
-
memory/1340-1065-0x0000000006F00000-0x000000000700A000-memory.dmpFilesize
1.0MB
-
memory/1340-1066-0x0000000007020000-0x0000000007032000-memory.dmpFilesize
72KB
-
memory/1340-1067-0x0000000007040000-0x000000000707C000-memory.dmpFilesize
240KB
-
memory/1340-1068-0x0000000006220000-0x0000000006230000-memory.dmpFilesize
64KB
-
memory/1340-1070-0x0000000006220000-0x0000000006230000-memory.dmpFilesize
64KB
-
memory/1340-1071-0x0000000006220000-0x0000000006230000-memory.dmpFilesize
64KB
-
memory/1340-1072-0x0000000006220000-0x0000000006230000-memory.dmpFilesize
64KB
-
memory/1340-1073-0x0000000006220000-0x0000000006230000-memory.dmpFilesize
64KB
-
memory/1340-1074-0x0000000007470000-0x0000000007502000-memory.dmpFilesize
584KB
-
memory/1340-1075-0x0000000007510000-0x0000000007576000-memory.dmpFilesize
408KB
-
memory/1340-153-0x0000000006230000-0x00000000067D4000-memory.dmpFilesize
5.6MB
-
memory/1340-1077-0x0000000007FB0000-0x0000000008026000-memory.dmpFilesize
472KB
-
memory/1340-1078-0x0000000008050000-0x00000000080A0000-memory.dmpFilesize
320KB
-
memory/1340-1079-0x00000000080D0000-0x0000000008292000-memory.dmpFilesize
1.8MB
-
memory/1340-1080-0x00000000082A0000-0x00000000087CC000-memory.dmpFilesize
5.2MB