Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 20:45
Static task
static1
Behavioral task
behavioral1
Sample
5d48166a05928ad74625ecfc9a4a06896bd86fd3699f99b34633249a0828ce9f.exe
Resource
win10v2004-20230220-en
General
-
Target
5d48166a05928ad74625ecfc9a4a06896bd86fd3699f99b34633249a0828ce9f.exe
-
Size
534KB
-
MD5
8a0cda156646143044756cfd48b991af
-
SHA1
7281c772e7a2f235b9ff7448d139b9c5503fb7e0
-
SHA256
5d48166a05928ad74625ecfc9a4a06896bd86fd3699f99b34633249a0828ce9f
-
SHA512
ec323e6e85c0a8958ddfdc54b7d408c9bf8d72242b8e4a0d5617b5820b9e9c7a15d50481d4c97081839c0b2651c7aaf21217d96b38dec2dc7fce96e11d2c4dd9
-
SSDEEP
12288:VMr8y905SWEYtCSZVHAxUDJsY43LqKeRPSMM4Tms:pyIgSZVH1CY43GTRzp
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr214516.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr214516.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr214516.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr214516.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr214516.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr214516.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr214516.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/804-158-0x00000000060F0000-0x000000000612F000-memory.dmp family_redline behavioral1/memory/804-159-0x00000000060F0000-0x000000000612F000-memory.dmp family_redline behavioral1/memory/804-161-0x00000000060F0000-0x000000000612F000-memory.dmp family_redline behavioral1/memory/804-163-0x00000000060F0000-0x000000000612F000-memory.dmp family_redline behavioral1/memory/804-165-0x00000000060F0000-0x000000000612F000-memory.dmp family_redline behavioral1/memory/804-167-0x00000000060F0000-0x000000000612F000-memory.dmp family_redline behavioral1/memory/804-169-0x00000000060F0000-0x000000000612F000-memory.dmp family_redline behavioral1/memory/804-171-0x00000000060F0000-0x000000000612F000-memory.dmp family_redline behavioral1/memory/804-173-0x00000000060F0000-0x000000000612F000-memory.dmp family_redline behavioral1/memory/804-175-0x00000000060F0000-0x000000000612F000-memory.dmp family_redline behavioral1/memory/804-177-0x00000000060F0000-0x000000000612F000-memory.dmp family_redline behavioral1/memory/804-179-0x00000000060F0000-0x000000000612F000-memory.dmp family_redline behavioral1/memory/804-181-0x00000000060F0000-0x000000000612F000-memory.dmp family_redline behavioral1/memory/804-183-0x00000000060F0000-0x000000000612F000-memory.dmp family_redline behavioral1/memory/804-185-0x00000000060F0000-0x000000000612F000-memory.dmp family_redline behavioral1/memory/804-187-0x00000000060F0000-0x000000000612F000-memory.dmp family_redline behavioral1/memory/804-189-0x00000000060F0000-0x000000000612F000-memory.dmp family_redline behavioral1/memory/804-191-0x00000000060F0000-0x000000000612F000-memory.dmp family_redline behavioral1/memory/804-193-0x00000000060F0000-0x000000000612F000-memory.dmp family_redline behavioral1/memory/804-195-0x00000000060F0000-0x000000000612F000-memory.dmp family_redline behavioral1/memory/804-197-0x00000000060F0000-0x000000000612F000-memory.dmp family_redline behavioral1/memory/804-199-0x00000000060F0000-0x000000000612F000-memory.dmp family_redline behavioral1/memory/804-201-0x00000000060F0000-0x000000000612F000-memory.dmp family_redline behavioral1/memory/804-203-0x00000000060F0000-0x000000000612F000-memory.dmp family_redline behavioral1/memory/804-207-0x00000000060F0000-0x000000000612F000-memory.dmp family_redline behavioral1/memory/804-205-0x00000000060F0000-0x000000000612F000-memory.dmp family_redline behavioral1/memory/804-209-0x00000000060F0000-0x000000000612F000-memory.dmp family_redline behavioral1/memory/804-211-0x00000000060F0000-0x000000000612F000-memory.dmp family_redline behavioral1/memory/804-213-0x00000000060F0000-0x000000000612F000-memory.dmp family_redline behavioral1/memory/804-215-0x00000000060F0000-0x000000000612F000-memory.dmp family_redline behavioral1/memory/804-217-0x00000000060F0000-0x000000000612F000-memory.dmp family_redline behavioral1/memory/804-219-0x00000000060F0000-0x000000000612F000-memory.dmp family_redline behavioral1/memory/804-221-0x00000000060F0000-0x000000000612F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
ziGw6184.exejr214516.exeku673959.exelr719554.exepid process 3096 ziGw6184.exe 1896 jr214516.exe 804 ku673959.exe 4404 lr719554.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr214516.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr214516.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
5d48166a05928ad74625ecfc9a4a06896bd86fd3699f99b34633249a0828ce9f.exeziGw6184.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 5d48166a05928ad74625ecfc9a4a06896bd86fd3699f99b34633249a0828ce9f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5d48166a05928ad74625ecfc9a4a06896bd86fd3699f99b34633249a0828ce9f.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziGw6184.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziGw6184.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2872 804 WerFault.exe ku673959.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr214516.exeku673959.exelr719554.exepid process 1896 jr214516.exe 1896 jr214516.exe 804 ku673959.exe 804 ku673959.exe 4404 lr719554.exe 4404 lr719554.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr214516.exeku673959.exelr719554.exedescription pid process Token: SeDebugPrivilege 1896 jr214516.exe Token: SeDebugPrivilege 804 ku673959.exe Token: SeDebugPrivilege 4404 lr719554.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
5d48166a05928ad74625ecfc9a4a06896bd86fd3699f99b34633249a0828ce9f.exeziGw6184.exedescription pid process target process PID 4508 wrote to memory of 3096 4508 5d48166a05928ad74625ecfc9a4a06896bd86fd3699f99b34633249a0828ce9f.exe ziGw6184.exe PID 4508 wrote to memory of 3096 4508 5d48166a05928ad74625ecfc9a4a06896bd86fd3699f99b34633249a0828ce9f.exe ziGw6184.exe PID 4508 wrote to memory of 3096 4508 5d48166a05928ad74625ecfc9a4a06896bd86fd3699f99b34633249a0828ce9f.exe ziGw6184.exe PID 3096 wrote to memory of 1896 3096 ziGw6184.exe jr214516.exe PID 3096 wrote to memory of 1896 3096 ziGw6184.exe jr214516.exe PID 3096 wrote to memory of 804 3096 ziGw6184.exe ku673959.exe PID 3096 wrote to memory of 804 3096 ziGw6184.exe ku673959.exe PID 3096 wrote to memory of 804 3096 ziGw6184.exe ku673959.exe PID 4508 wrote to memory of 4404 4508 5d48166a05928ad74625ecfc9a4a06896bd86fd3699f99b34633249a0828ce9f.exe lr719554.exe PID 4508 wrote to memory of 4404 4508 5d48166a05928ad74625ecfc9a4a06896bd86fd3699f99b34633249a0828ce9f.exe lr719554.exe PID 4508 wrote to memory of 4404 4508 5d48166a05928ad74625ecfc9a4a06896bd86fd3699f99b34633249a0828ce9f.exe lr719554.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d48166a05928ad74625ecfc9a4a06896bd86fd3699f99b34633249a0828ce9f.exe"C:\Users\Admin\AppData\Local\Temp\5d48166a05928ad74625ecfc9a4a06896bd86fd3699f99b34633249a0828ce9f.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziGw6184.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziGw6184.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr214516.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr214516.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku673959.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku673959.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 17524⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr719554.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr719554.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 804 -ip 8041⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr719554.exeFilesize
175KB
MD56d64dc29cba44df3ac3725a7fe71c04e
SHA11ceea91639b05fe3c3ae8d85cfe2425533fad7a3
SHA256d27d84976d40ba2a118392465bba54c137dea18a7ea4ce664cda728e24522212
SHA5124728296a94c653a142d1e56b982a456d21895890121032a65f0d8cb499fad9aadb8d13a38357bb7e325814fa783612cd36a824919caa6d0e2ff9d474cbfd78f9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr719554.exeFilesize
175KB
MD56d64dc29cba44df3ac3725a7fe71c04e
SHA11ceea91639b05fe3c3ae8d85cfe2425533fad7a3
SHA256d27d84976d40ba2a118392465bba54c137dea18a7ea4ce664cda728e24522212
SHA5124728296a94c653a142d1e56b982a456d21895890121032a65f0d8cb499fad9aadb8d13a38357bb7e325814fa783612cd36a824919caa6d0e2ff9d474cbfd78f9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziGw6184.exeFilesize
391KB
MD57b6a3d976ddcb89d336f9fa2b7159fe1
SHA1527133f3a6c869b6816296b1a37e8990029087d9
SHA256e3649ce775782cc95f9263f452484714b352ba376d5174f7101b076e0f5401f9
SHA51273f70e2aacdd5d816cec6ab52fda1edb480c82271cdc641bf21d7f3ac608f06d885ffbd0ea4413aebbf873b1b28ba857818f5b63bd6cbcb787ac67459ea413b1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziGw6184.exeFilesize
391KB
MD57b6a3d976ddcb89d336f9fa2b7159fe1
SHA1527133f3a6c869b6816296b1a37e8990029087d9
SHA256e3649ce775782cc95f9263f452484714b352ba376d5174f7101b076e0f5401f9
SHA51273f70e2aacdd5d816cec6ab52fda1edb480c82271cdc641bf21d7f3ac608f06d885ffbd0ea4413aebbf873b1b28ba857818f5b63bd6cbcb787ac67459ea413b1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr214516.exeFilesize
11KB
MD524ad6a411edb549f724649d0966b6be7
SHA1767266eec600afcaeece76682b6655c329bf0347
SHA25682d65c0f238c9df18dc07a750a02f08dc6699024431e9e33d4b635010f2269af
SHA5123949a62dcf7e162dfb5f6272ea35fe7c937e3b7c3f06e046331ca761fd0691057fc1e6632aa0d6dabd45bf09fedfe9aa3edcf78ad2ce0ef34cdde07e1ddecf09
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr214516.exeFilesize
11KB
MD524ad6a411edb549f724649d0966b6be7
SHA1767266eec600afcaeece76682b6655c329bf0347
SHA25682d65c0f238c9df18dc07a750a02f08dc6699024431e9e33d4b635010f2269af
SHA5123949a62dcf7e162dfb5f6272ea35fe7c937e3b7c3f06e046331ca761fd0691057fc1e6632aa0d6dabd45bf09fedfe9aa3edcf78ad2ce0ef34cdde07e1ddecf09
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku673959.exeFilesize
359KB
MD55c71abcf0810bc61e6c9a15617ff1c8f
SHA1998a2f6626760c715f26e4cff7185b3ca47a0471
SHA25671b7f85c8481979487f2e5c001df9b1649b5ac43dd2c8d4ca5833fc08efdf4c8
SHA51275b5bffd28865abc154028cd8bf8e36c6f1425bb08fb8cbf6b7a66f8a42bb5e2acf24bd6b18ddcdcdcdc0844667f53f0f47181a63e507bc121f36a07cc6581fe
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku673959.exeFilesize
359KB
MD55c71abcf0810bc61e6c9a15617ff1c8f
SHA1998a2f6626760c715f26e4cff7185b3ca47a0471
SHA25671b7f85c8481979487f2e5c001df9b1649b5ac43dd2c8d4ca5833fc08efdf4c8
SHA51275b5bffd28865abc154028cd8bf8e36c6f1425bb08fb8cbf6b7a66f8a42bb5e2acf24bd6b18ddcdcdcdc0844667f53f0f47181a63e507bc121f36a07cc6581fe
-
memory/804-153-0x00000000062E0000-0x0000000006884000-memory.dmpFilesize
5.6MB
-
memory/804-154-0x0000000003710000-0x000000000375B000-memory.dmpFilesize
300KB
-
memory/804-156-0x00000000062D0000-0x00000000062E0000-memory.dmpFilesize
64KB
-
memory/804-155-0x00000000062D0000-0x00000000062E0000-memory.dmpFilesize
64KB
-
memory/804-157-0x00000000062D0000-0x00000000062E0000-memory.dmpFilesize
64KB
-
memory/804-158-0x00000000060F0000-0x000000000612F000-memory.dmpFilesize
252KB
-
memory/804-159-0x00000000060F0000-0x000000000612F000-memory.dmpFilesize
252KB
-
memory/804-161-0x00000000060F0000-0x000000000612F000-memory.dmpFilesize
252KB
-
memory/804-163-0x00000000060F0000-0x000000000612F000-memory.dmpFilesize
252KB
-
memory/804-165-0x00000000060F0000-0x000000000612F000-memory.dmpFilesize
252KB
-
memory/804-167-0x00000000060F0000-0x000000000612F000-memory.dmpFilesize
252KB
-
memory/804-169-0x00000000060F0000-0x000000000612F000-memory.dmpFilesize
252KB
-
memory/804-171-0x00000000060F0000-0x000000000612F000-memory.dmpFilesize
252KB
-
memory/804-173-0x00000000060F0000-0x000000000612F000-memory.dmpFilesize
252KB
-
memory/804-175-0x00000000060F0000-0x000000000612F000-memory.dmpFilesize
252KB
-
memory/804-177-0x00000000060F0000-0x000000000612F000-memory.dmpFilesize
252KB
-
memory/804-179-0x00000000060F0000-0x000000000612F000-memory.dmpFilesize
252KB
-
memory/804-181-0x00000000060F0000-0x000000000612F000-memory.dmpFilesize
252KB
-
memory/804-183-0x00000000060F0000-0x000000000612F000-memory.dmpFilesize
252KB
-
memory/804-185-0x00000000060F0000-0x000000000612F000-memory.dmpFilesize
252KB
-
memory/804-187-0x00000000060F0000-0x000000000612F000-memory.dmpFilesize
252KB
-
memory/804-189-0x00000000060F0000-0x000000000612F000-memory.dmpFilesize
252KB
-
memory/804-191-0x00000000060F0000-0x000000000612F000-memory.dmpFilesize
252KB
-
memory/804-193-0x00000000060F0000-0x000000000612F000-memory.dmpFilesize
252KB
-
memory/804-195-0x00000000060F0000-0x000000000612F000-memory.dmpFilesize
252KB
-
memory/804-197-0x00000000060F0000-0x000000000612F000-memory.dmpFilesize
252KB
-
memory/804-199-0x00000000060F0000-0x000000000612F000-memory.dmpFilesize
252KB
-
memory/804-201-0x00000000060F0000-0x000000000612F000-memory.dmpFilesize
252KB
-
memory/804-203-0x00000000060F0000-0x000000000612F000-memory.dmpFilesize
252KB
-
memory/804-207-0x00000000060F0000-0x000000000612F000-memory.dmpFilesize
252KB
-
memory/804-205-0x00000000060F0000-0x000000000612F000-memory.dmpFilesize
252KB
-
memory/804-209-0x00000000060F0000-0x000000000612F000-memory.dmpFilesize
252KB
-
memory/804-211-0x00000000060F0000-0x000000000612F000-memory.dmpFilesize
252KB
-
memory/804-213-0x00000000060F0000-0x000000000612F000-memory.dmpFilesize
252KB
-
memory/804-215-0x00000000060F0000-0x000000000612F000-memory.dmpFilesize
252KB
-
memory/804-217-0x00000000060F0000-0x000000000612F000-memory.dmpFilesize
252KB
-
memory/804-219-0x00000000060F0000-0x000000000612F000-memory.dmpFilesize
252KB
-
memory/804-221-0x00000000060F0000-0x000000000612F000-memory.dmpFilesize
252KB
-
memory/804-1064-0x0000000006890000-0x0000000006EA8000-memory.dmpFilesize
6.1MB
-
memory/804-1065-0x0000000006EE0000-0x0000000006FEA000-memory.dmpFilesize
1.0MB
-
memory/804-1066-0x0000000007020000-0x0000000007032000-memory.dmpFilesize
72KB
-
memory/804-1068-0x00000000062D0000-0x00000000062E0000-memory.dmpFilesize
64KB
-
memory/804-1067-0x0000000007040000-0x000000000707C000-memory.dmpFilesize
240KB
-
memory/804-1070-0x0000000007330000-0x00000000073C2000-memory.dmpFilesize
584KB
-
memory/804-1071-0x00000000062D0000-0x00000000062E0000-memory.dmpFilesize
64KB
-
memory/804-1072-0x00000000062D0000-0x00000000062E0000-memory.dmpFilesize
64KB
-
memory/804-1073-0x00000000062D0000-0x00000000062E0000-memory.dmpFilesize
64KB
-
memory/804-1074-0x00000000073D0000-0x0000000007436000-memory.dmpFilesize
408KB
-
memory/804-1075-0x0000000007BD0000-0x0000000007C46000-memory.dmpFilesize
472KB
-
memory/804-1076-0x0000000007C60000-0x0000000007CB0000-memory.dmpFilesize
320KB
-
memory/804-1077-0x0000000007CE0000-0x0000000007EA2000-memory.dmpFilesize
1.8MB
-
memory/804-1078-0x0000000007EB0000-0x00000000083DC000-memory.dmpFilesize
5.2MB
-
memory/804-1079-0x00000000062D0000-0x00000000062E0000-memory.dmpFilesize
64KB
-
memory/1896-147-0x00000000009E0000-0x00000000009EA000-memory.dmpFilesize
40KB
-
memory/4404-1086-0x0000000000B30000-0x0000000000B62000-memory.dmpFilesize
200KB
-
memory/4404-1087-0x00000000058E0000-0x00000000058F0000-memory.dmpFilesize
64KB
-
memory/4404-1088-0x00000000058E0000-0x00000000058F0000-memory.dmpFilesize
64KB