Analysis
-
max time kernel
90s -
max time network
93s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
31-03-2023 20:43
Static task
static1
Behavioral task
behavioral1
Sample
94686da5403729d54a8cdc48f96be1b1090fe2ab8be733b9824ae15de6897008.exe
Resource
win10-20230220-en
General
-
Target
94686da5403729d54a8cdc48f96be1b1090fe2ab8be733b9824ae15de6897008.exe
-
Size
671KB
-
MD5
7c8a9a6ac9eb0b185751443ecd5d482f
-
SHA1
74c62b359bafc24cbf148e8b485ad48c7309a5d6
-
SHA256
94686da5403729d54a8cdc48f96be1b1090fe2ab8be733b9824ae15de6897008
-
SHA512
bf17e6ff7d9ea06fe3b34a2b76c5875b4e62ad0293f5a983d5b0536831140fbd5832591a9e98ca66d5b367fc9847aa4f07d719012e382d37bb0f39d2d1bebd9c
-
SSDEEP
12288:eMr+y90BQzm3+kv4w/KF0fgfuoRFMtLLsM63Lqylxr0lW9:EyYQK3Nv4AKF0f1oRFMtPsM63GybI89
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro7542.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro7542.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro7542.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro7542.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro7542.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro7542.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/3724-180-0x00000000038D0000-0x0000000003916000-memory.dmp family_redline behavioral1/memory/3724-181-0x0000000006060000-0x00000000060A4000-memory.dmp family_redline behavioral1/memory/3724-182-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/3724-183-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/3724-190-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/3724-185-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/3724-195-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/3724-193-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/3724-197-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/3724-199-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/3724-201-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/3724-203-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/3724-205-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/3724-207-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/3724-209-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/3724-211-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/3724-213-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/3724-215-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/3724-217-0x0000000006060000-0x000000000609F000-memory.dmp family_redline behavioral1/memory/3724-219-0x0000000006060000-0x000000000609F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un025897.exepro7542.exequ6430.exesi324118.exepid process 8 un025897.exe 4724 pro7542.exe 3724 qu6430.exe 3528 si324118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro7542.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro7542.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro7542.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
94686da5403729d54a8cdc48f96be1b1090fe2ab8be733b9824ae15de6897008.exeun025897.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 94686da5403729d54a8cdc48f96be1b1090fe2ab8be733b9824ae15de6897008.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 94686da5403729d54a8cdc48f96be1b1090fe2ab8be733b9824ae15de6897008.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un025897.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un025897.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro7542.exequ6430.exesi324118.exepid process 4724 pro7542.exe 4724 pro7542.exe 3724 qu6430.exe 3724 qu6430.exe 3528 si324118.exe 3528 si324118.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro7542.exequ6430.exesi324118.exedescription pid process Token: SeDebugPrivilege 4724 pro7542.exe Token: SeDebugPrivilege 3724 qu6430.exe Token: SeDebugPrivilege 3528 si324118.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
94686da5403729d54a8cdc48f96be1b1090fe2ab8be733b9824ae15de6897008.exeun025897.exedescription pid process target process PID 4192 wrote to memory of 8 4192 94686da5403729d54a8cdc48f96be1b1090fe2ab8be733b9824ae15de6897008.exe un025897.exe PID 4192 wrote to memory of 8 4192 94686da5403729d54a8cdc48f96be1b1090fe2ab8be733b9824ae15de6897008.exe un025897.exe PID 4192 wrote to memory of 8 4192 94686da5403729d54a8cdc48f96be1b1090fe2ab8be733b9824ae15de6897008.exe un025897.exe PID 8 wrote to memory of 4724 8 un025897.exe pro7542.exe PID 8 wrote to memory of 4724 8 un025897.exe pro7542.exe PID 8 wrote to memory of 4724 8 un025897.exe pro7542.exe PID 8 wrote to memory of 3724 8 un025897.exe qu6430.exe PID 8 wrote to memory of 3724 8 un025897.exe qu6430.exe PID 8 wrote to memory of 3724 8 un025897.exe qu6430.exe PID 4192 wrote to memory of 3528 4192 94686da5403729d54a8cdc48f96be1b1090fe2ab8be733b9824ae15de6897008.exe si324118.exe PID 4192 wrote to memory of 3528 4192 94686da5403729d54a8cdc48f96be1b1090fe2ab8be733b9824ae15de6897008.exe si324118.exe PID 4192 wrote to memory of 3528 4192 94686da5403729d54a8cdc48f96be1b1090fe2ab8be733b9824ae15de6897008.exe si324118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\94686da5403729d54a8cdc48f96be1b1090fe2ab8be733b9824ae15de6897008.exe"C:\Users\Admin\AppData\Local\Temp\94686da5403729d54a8cdc48f96be1b1090fe2ab8be733b9824ae15de6897008.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un025897.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un025897.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7542.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7542.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6430.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6430.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si324118.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si324118.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si324118.exeFilesize
175KB
MD53621b1505d42d0433113a3c61e52612e
SHA1f2e2c4a4f132b4f26be78f4f1b421198e2752113
SHA2568b578dad213dfa7a504cc8feb63ab2d68da21f8211a26125b4bdb1c30c65bbb0
SHA5129923f9deded577d14db501184631bd05e64470eb5273d1ef55252f9c2f12db0fceafeed48fe24d997ec652fd36bf18c8cbafa41f00afb3283ffc6bc1084f63a9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si324118.exeFilesize
175KB
MD53621b1505d42d0433113a3c61e52612e
SHA1f2e2c4a4f132b4f26be78f4f1b421198e2752113
SHA2568b578dad213dfa7a504cc8feb63ab2d68da21f8211a26125b4bdb1c30c65bbb0
SHA5129923f9deded577d14db501184631bd05e64470eb5273d1ef55252f9c2f12db0fceafeed48fe24d997ec652fd36bf18c8cbafa41f00afb3283ffc6bc1084f63a9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un025897.exeFilesize
529KB
MD54fe69eb0b8fd04168800d051c5cd1813
SHA16d1708b975a1b2b7cdddf3ca7c2e55ff6a5b0348
SHA256e815727b36ab687788f102564835ceafa2f17c946998c043964414a416337f47
SHA51283cb49e80817760d739714645600630112ee5461476a6902a4f1d785a943f64c23995281aeda82eeb4cffc2b19762039adb5cb624107f9075cf3334c73809790
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un025897.exeFilesize
529KB
MD54fe69eb0b8fd04168800d051c5cd1813
SHA16d1708b975a1b2b7cdddf3ca7c2e55ff6a5b0348
SHA256e815727b36ab687788f102564835ceafa2f17c946998c043964414a416337f47
SHA51283cb49e80817760d739714645600630112ee5461476a6902a4f1d785a943f64c23995281aeda82eeb4cffc2b19762039adb5cb624107f9075cf3334c73809790
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7542.exeFilesize
301KB
MD572733b566fe3c0ae0b9c74d3343ed3f5
SHA1e3cb2ed07c14fd5470a772b3c590770d1ba34784
SHA2562bfcd9b646277cbb672b2d76db6f49e874c0f2c463bc2bcc25bbcea9262b6ccb
SHA51267e9ac6b09ad1c239eb0bd4d1768f1dd58a34cb0d31762b76b6258b5df938ce24d7ddb86638bb62dd0913983d0087fc19e63680465f60dac920e1f3d3d210f26
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7542.exeFilesize
301KB
MD572733b566fe3c0ae0b9c74d3343ed3f5
SHA1e3cb2ed07c14fd5470a772b3c590770d1ba34784
SHA2562bfcd9b646277cbb672b2d76db6f49e874c0f2c463bc2bcc25bbcea9262b6ccb
SHA51267e9ac6b09ad1c239eb0bd4d1768f1dd58a34cb0d31762b76b6258b5df938ce24d7ddb86638bb62dd0913983d0087fc19e63680465f60dac920e1f3d3d210f26
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6430.exeFilesize
359KB
MD51340b71638ea02cfcb1458a1a8c535ea
SHA1e5906486c7157dbb8f925051b53728e59fc0f01c
SHA2568a8ae9243819a444bfc790a8a9f09d077f7a9de8fb6aef518f1826ef753d9353
SHA51260521c24a1fa5551986664775b3ab2f24965cbc300aac18f3c16c2bfd622c7d3443aa28d69f050c66edf9eb4cf733cff805b516c7b7c9d5119752f6117d815b6
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6430.exeFilesize
359KB
MD51340b71638ea02cfcb1458a1a8c535ea
SHA1e5906486c7157dbb8f925051b53728e59fc0f01c
SHA2568a8ae9243819a444bfc790a8a9f09d077f7a9de8fb6aef518f1826ef753d9353
SHA51260521c24a1fa5551986664775b3ab2f24965cbc300aac18f3c16c2bfd622c7d3443aa28d69f050c66edf9eb4cf733cff805b516c7b7c9d5119752f6117d815b6
-
memory/3528-1115-0x00000000050D0000-0x00000000050E0000-memory.dmpFilesize
64KB
-
memory/3528-1114-0x0000000004F30000-0x0000000004F7B000-memory.dmpFilesize
300KB
-
memory/3528-1113-0x00000000004F0000-0x0000000000522000-memory.dmpFilesize
200KB
-
memory/3724-1092-0x0000000006750000-0x0000000006D56000-memory.dmpFilesize
6.0MB
-
memory/3724-1095-0x0000000006F40000-0x0000000006F7E000-memory.dmpFilesize
248KB
-
memory/3724-1107-0x00000000060E0000-0x00000000060F0000-memory.dmpFilesize
64KB
-
memory/3724-1106-0x0000000007D90000-0x00000000082BC000-memory.dmpFilesize
5.2MB
-
memory/3724-1105-0x0000000007BC0000-0x0000000007D82000-memory.dmpFilesize
1.8MB
-
memory/3724-1104-0x00000000060E0000-0x00000000060F0000-memory.dmpFilesize
64KB
-
memory/3724-1103-0x00000000060E0000-0x00000000060F0000-memory.dmpFilesize
64KB
-
memory/3724-1102-0x0000000007A20000-0x0000000007A70000-memory.dmpFilesize
320KB
-
memory/3724-1101-0x0000000007980000-0x00000000079F6000-memory.dmpFilesize
472KB
-
memory/3724-1100-0x00000000078E0000-0x0000000007972000-memory.dmpFilesize
584KB
-
memory/3724-1099-0x0000000007220000-0x0000000007286000-memory.dmpFilesize
408KB
-
memory/3724-1097-0x00000000060E0000-0x00000000060F0000-memory.dmpFilesize
64KB
-
memory/3724-1096-0x0000000007090000-0x00000000070DB000-memory.dmpFilesize
300KB
-
memory/3724-1094-0x0000000006F20000-0x0000000006F32000-memory.dmpFilesize
72KB
-
memory/3724-1093-0x0000000006DE0000-0x0000000006EEA000-memory.dmpFilesize
1.0MB
-
memory/3724-219-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/3724-217-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/3724-215-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/3724-213-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/3724-211-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/3724-209-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/3724-207-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/3724-180-0x00000000038D0000-0x0000000003916000-memory.dmpFilesize
280KB
-
memory/3724-181-0x0000000006060000-0x00000000060A4000-memory.dmpFilesize
272KB
-
memory/3724-182-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/3724-183-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/3724-186-0x0000000001B40000-0x0000000001B8B000-memory.dmpFilesize
300KB
-
memory/3724-188-0x00000000060E0000-0x00000000060F0000-memory.dmpFilesize
64KB
-
memory/3724-190-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/3724-191-0x00000000060E0000-0x00000000060F0000-memory.dmpFilesize
64KB
-
memory/3724-189-0x00000000060E0000-0x00000000060F0000-memory.dmpFilesize
64KB
-
memory/3724-185-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/3724-195-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/3724-193-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/3724-197-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/3724-199-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/3724-201-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/3724-203-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/3724-205-0x0000000006060000-0x000000000609F000-memory.dmpFilesize
252KB
-
memory/4724-165-0x00000000039C0000-0x00000000039D2000-memory.dmpFilesize
72KB
-
memory/4724-135-0x0000000001F00000-0x0000000001F1A000-memory.dmpFilesize
104KB
-
memory/4724-141-0x0000000003A80000-0x0000000003A90000-memory.dmpFilesize
64KB
-
memory/4724-172-0x0000000003A80000-0x0000000003A90000-memory.dmpFilesize
64KB
-
memory/4724-173-0x0000000003A80000-0x0000000003A90000-memory.dmpFilesize
64KB
-
memory/4724-171-0x0000000003A80000-0x0000000003A90000-memory.dmpFilesize
64KB
-
memory/4724-170-0x0000000000400000-0x0000000001AE3000-memory.dmpFilesize
22.9MB
-
memory/4724-139-0x0000000003A80000-0x0000000003A90000-memory.dmpFilesize
64KB
-
memory/4724-151-0x00000000039C0000-0x00000000039D2000-memory.dmpFilesize
72KB
-
memory/4724-153-0x00000000039C0000-0x00000000039D2000-memory.dmpFilesize
72KB
-
memory/4724-143-0x00000000039C0000-0x00000000039D2000-memory.dmpFilesize
72KB
-
memory/4724-163-0x00000000039C0000-0x00000000039D2000-memory.dmpFilesize
72KB
-
memory/4724-175-0x0000000000400000-0x0000000001AE3000-memory.dmpFilesize
22.9MB
-
memory/4724-142-0x00000000039C0000-0x00000000039D2000-memory.dmpFilesize
72KB
-
memory/4724-145-0x00000000039C0000-0x00000000039D2000-memory.dmpFilesize
72KB
-
memory/4724-161-0x00000000039C0000-0x00000000039D2000-memory.dmpFilesize
72KB
-
memory/4724-155-0x00000000039C0000-0x00000000039D2000-memory.dmpFilesize
72KB
-
memory/4724-157-0x00000000039C0000-0x00000000039D2000-memory.dmpFilesize
72KB
-
memory/4724-159-0x00000000039C0000-0x00000000039D2000-memory.dmpFilesize
72KB
-
memory/4724-149-0x00000000039C0000-0x00000000039D2000-memory.dmpFilesize
72KB
-
memory/4724-147-0x00000000039C0000-0x00000000039D2000-memory.dmpFilesize
72KB
-
memory/4724-169-0x00000000039C0000-0x00000000039D2000-memory.dmpFilesize
72KB
-
memory/4724-140-0x0000000003A80000-0x0000000003A90000-memory.dmpFilesize
64KB
-
memory/4724-138-0x00000000001D0000-0x00000000001FD000-memory.dmpFilesize
180KB
-
memory/4724-137-0x00000000039C0000-0x00000000039D8000-memory.dmpFilesize
96KB
-
memory/4724-136-0x00000000061D0000-0x00000000066CE000-memory.dmpFilesize
5.0MB
-
memory/4724-167-0x00000000039C0000-0x00000000039D2000-memory.dmpFilesize
72KB