Analysis
-
max time kernel
106s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 20:44
Static task
static1
Behavioral task
behavioral1
Sample
775355942fbab72c2523c318b42be0cf29a3fddb0632997a4342d37020311262.exe
Resource
win10v2004-20230220-en
General
-
Target
775355942fbab72c2523c318b42be0cf29a3fddb0632997a4342d37020311262.exe
-
Size
672KB
-
MD5
f3779d4fd8744898984e00b505644e04
-
SHA1
747e49b035595959b4dd33f757bfaae275c62eb0
-
SHA256
775355942fbab72c2523c318b42be0cf29a3fddb0632997a4342d37020311262
-
SHA512
35dc772c56a4ec73573bf0a45569d6f321c66d050907e13a350707c5df4832efbe4a942d7e75e77140c9ac30254e9e20a0c43aff0473befb3a47b39fdd34c36f
-
SSDEEP
12288:oMrWy90+biTRJYhPl7b5mPeDzJDIA+2V8f1iUIjP63LqxCMhFvxbyjIZ:Oy3iR+hd8PQJDlqb6P63GxlvFaIZ
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro4029.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro4029.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro4029.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro4029.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro4029.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro4029.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro4029.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/2464-195-0x0000000006100000-0x000000000613F000-memory.dmp family_redline behavioral1/memory/2464-196-0x0000000006100000-0x000000000613F000-memory.dmp family_redline behavioral1/memory/2464-198-0x0000000006100000-0x000000000613F000-memory.dmp family_redline behavioral1/memory/2464-200-0x0000000006100000-0x000000000613F000-memory.dmp family_redline behavioral1/memory/2464-202-0x0000000006100000-0x000000000613F000-memory.dmp family_redline behavioral1/memory/2464-204-0x0000000006100000-0x000000000613F000-memory.dmp family_redline behavioral1/memory/2464-206-0x0000000006100000-0x000000000613F000-memory.dmp family_redline behavioral1/memory/2464-208-0x0000000006100000-0x000000000613F000-memory.dmp family_redline behavioral1/memory/2464-210-0x0000000006100000-0x000000000613F000-memory.dmp family_redline behavioral1/memory/2464-212-0x0000000006100000-0x000000000613F000-memory.dmp family_redline behavioral1/memory/2464-214-0x0000000006100000-0x000000000613F000-memory.dmp family_redline behavioral1/memory/2464-216-0x0000000006100000-0x000000000613F000-memory.dmp family_redline behavioral1/memory/2464-218-0x0000000006100000-0x000000000613F000-memory.dmp family_redline behavioral1/memory/2464-220-0x0000000006100000-0x000000000613F000-memory.dmp family_redline behavioral1/memory/2464-222-0x0000000006100000-0x000000000613F000-memory.dmp family_redline behavioral1/memory/2464-224-0x0000000006100000-0x000000000613F000-memory.dmp family_redline behavioral1/memory/2464-226-0x0000000006100000-0x000000000613F000-memory.dmp family_redline behavioral1/memory/2464-228-0x0000000006100000-0x000000000613F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un329077.exepro4029.exequ8884.exesi300829.exepid process 4312 un329077.exe 956 pro4029.exe 2464 qu8884.exe 3300 si300829.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro4029.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro4029.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro4029.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un329077.exe775355942fbab72c2523c318b42be0cf29a3fddb0632997a4342d37020311262.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un329077.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un329077.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 775355942fbab72c2523c318b42be0cf29a3fddb0632997a4342d37020311262.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 775355942fbab72c2523c318b42be0cf29a3fddb0632997a4342d37020311262.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3616 956 WerFault.exe pro4029.exe 1004 2464 WerFault.exe qu8884.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro4029.exequ8884.exesi300829.exepid process 956 pro4029.exe 956 pro4029.exe 2464 qu8884.exe 2464 qu8884.exe 3300 si300829.exe 3300 si300829.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro4029.exequ8884.exesi300829.exedescription pid process Token: SeDebugPrivilege 956 pro4029.exe Token: SeDebugPrivilege 2464 qu8884.exe Token: SeDebugPrivilege 3300 si300829.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
775355942fbab72c2523c318b42be0cf29a3fddb0632997a4342d37020311262.exeun329077.exedescription pid process target process PID 4484 wrote to memory of 4312 4484 775355942fbab72c2523c318b42be0cf29a3fddb0632997a4342d37020311262.exe un329077.exe PID 4484 wrote to memory of 4312 4484 775355942fbab72c2523c318b42be0cf29a3fddb0632997a4342d37020311262.exe un329077.exe PID 4484 wrote to memory of 4312 4484 775355942fbab72c2523c318b42be0cf29a3fddb0632997a4342d37020311262.exe un329077.exe PID 4312 wrote to memory of 956 4312 un329077.exe pro4029.exe PID 4312 wrote to memory of 956 4312 un329077.exe pro4029.exe PID 4312 wrote to memory of 956 4312 un329077.exe pro4029.exe PID 4312 wrote to memory of 2464 4312 un329077.exe qu8884.exe PID 4312 wrote to memory of 2464 4312 un329077.exe qu8884.exe PID 4312 wrote to memory of 2464 4312 un329077.exe qu8884.exe PID 4484 wrote to memory of 3300 4484 775355942fbab72c2523c318b42be0cf29a3fddb0632997a4342d37020311262.exe si300829.exe PID 4484 wrote to memory of 3300 4484 775355942fbab72c2523c318b42be0cf29a3fddb0632997a4342d37020311262.exe si300829.exe PID 4484 wrote to memory of 3300 4484 775355942fbab72c2523c318b42be0cf29a3fddb0632997a4342d37020311262.exe si300829.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\775355942fbab72c2523c318b42be0cf29a3fddb0632997a4342d37020311262.exe"C:\Users\Admin\AppData\Local\Temp\775355942fbab72c2523c318b42be0cf29a3fddb0632997a4342d37020311262.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un329077.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un329077.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4029.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4029.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 956 -s 10804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8884.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8884.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 13284⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si300829.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si300829.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 956 -ip 9561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2464 -ip 24641⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si300829.exeFilesize
175KB
MD55132b142545d2fba3472c62f4d6a827e
SHA1ad26ee46652eeb31417bf3ef07fdd2a0aeac4b0b
SHA25645030dd0364da401aadb9dba052e3910d1a247958cc773f0f2535218fe1b1457
SHA512c07aeeb36d1a3aa93ed3781a1bff6647623c7b629df2d29bd1782a299425811e049904bbcef61c7a2937bc0ebb49172a08e9027c913f6b15d195c3b811fe597e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si300829.exeFilesize
175KB
MD55132b142545d2fba3472c62f4d6a827e
SHA1ad26ee46652eeb31417bf3ef07fdd2a0aeac4b0b
SHA25645030dd0364da401aadb9dba052e3910d1a247958cc773f0f2535218fe1b1457
SHA512c07aeeb36d1a3aa93ed3781a1bff6647623c7b629df2d29bd1782a299425811e049904bbcef61c7a2937bc0ebb49172a08e9027c913f6b15d195c3b811fe597e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un329077.exeFilesize
530KB
MD5c1aa67f20cdffa7a84ec1b30c464631f
SHA1134a9d012206b58b3969277cb6868bf0a62b864b
SHA2560f7f4c57b7232d1fc571d5c3e9b1038e60f9517359e0c9b1b7933f0e43605fbc
SHA512f7668bb6ac5ed6b657ca00bf2f0ac755b9c748fe72bde8f8b4fa512c72a5f74a93e750400adea7913c92d0ff8a808c9dc0263d70ea6efea9bc6463aad1340ec8
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un329077.exeFilesize
530KB
MD5c1aa67f20cdffa7a84ec1b30c464631f
SHA1134a9d012206b58b3969277cb6868bf0a62b864b
SHA2560f7f4c57b7232d1fc571d5c3e9b1038e60f9517359e0c9b1b7933f0e43605fbc
SHA512f7668bb6ac5ed6b657ca00bf2f0ac755b9c748fe72bde8f8b4fa512c72a5f74a93e750400adea7913c92d0ff8a808c9dc0263d70ea6efea9bc6463aad1340ec8
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4029.exeFilesize
301KB
MD5b080b4c4a2bf8ef946c7bbe5234cace1
SHA140b94292be9796818eb14223bdd54325f61f8d82
SHA256f9ea69efdd9a82bd826420287e743b81d2068263df3b1daf7efad1ab31681044
SHA5126f174d1200c827ebb8fba60a3374a5dc44ac5e07c17cf4a49cdca50e6021897c2827ace6b0c785a47e8de05f581aa49a7a860f06f69d0eaa68729ddec1215cd4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4029.exeFilesize
301KB
MD5b080b4c4a2bf8ef946c7bbe5234cace1
SHA140b94292be9796818eb14223bdd54325f61f8d82
SHA256f9ea69efdd9a82bd826420287e743b81d2068263df3b1daf7efad1ab31681044
SHA5126f174d1200c827ebb8fba60a3374a5dc44ac5e07c17cf4a49cdca50e6021897c2827ace6b0c785a47e8de05f581aa49a7a860f06f69d0eaa68729ddec1215cd4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8884.exeFilesize
359KB
MD529e05f5b493098c2f5f53d2de7af4fec
SHA13b3d8664eec6914bb5d03711e7b32ab7324a3238
SHA256350364df79be8e42181615be8b6d8f9a0adcc3d090e351373ffff0ab482ca1a0
SHA5125bd7ed3943c39a408e1813d3747250e5fb7ef35c14301f995f5a58834139eeacbc5129af10ee57f9be57bdcb1f32c07ead731c193c26265e00fc237ddba7863b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8884.exeFilesize
359KB
MD529e05f5b493098c2f5f53d2de7af4fec
SHA13b3d8664eec6914bb5d03711e7b32ab7324a3238
SHA256350364df79be8e42181615be8b6d8f9a0adcc3d090e351373ffff0ab482ca1a0
SHA5125bd7ed3943c39a408e1813d3747250e5fb7ef35c14301f995f5a58834139eeacbc5129af10ee57f9be57bdcb1f32c07ead731c193c26265e00fc237ddba7863b
-
memory/956-148-0x0000000001C00000-0x0000000001C2D000-memory.dmpFilesize
180KB
-
memory/956-149-0x00000000063C0000-0x00000000063D0000-memory.dmpFilesize
64KB
-
memory/956-150-0x00000000063D0000-0x0000000006974000-memory.dmpFilesize
5.6MB
-
memory/956-151-0x0000000003990000-0x00000000039A2000-memory.dmpFilesize
72KB
-
memory/956-154-0x0000000003990000-0x00000000039A2000-memory.dmpFilesize
72KB
-
memory/956-152-0x0000000003990000-0x00000000039A2000-memory.dmpFilesize
72KB
-
memory/956-156-0x0000000003990000-0x00000000039A2000-memory.dmpFilesize
72KB
-
memory/956-158-0x0000000003990000-0x00000000039A2000-memory.dmpFilesize
72KB
-
memory/956-160-0x0000000003990000-0x00000000039A2000-memory.dmpFilesize
72KB
-
memory/956-162-0x0000000003990000-0x00000000039A2000-memory.dmpFilesize
72KB
-
memory/956-164-0x0000000003990000-0x00000000039A2000-memory.dmpFilesize
72KB
-
memory/956-166-0x0000000003990000-0x00000000039A2000-memory.dmpFilesize
72KB
-
memory/956-168-0x0000000003990000-0x00000000039A2000-memory.dmpFilesize
72KB
-
memory/956-170-0x0000000003990000-0x00000000039A2000-memory.dmpFilesize
72KB
-
memory/956-172-0x0000000003990000-0x00000000039A2000-memory.dmpFilesize
72KB
-
memory/956-174-0x0000000003990000-0x00000000039A2000-memory.dmpFilesize
72KB
-
memory/956-176-0x0000000003990000-0x00000000039A2000-memory.dmpFilesize
72KB
-
memory/956-178-0x0000000003990000-0x00000000039A2000-memory.dmpFilesize
72KB
-
memory/956-179-0x00000000063C0000-0x00000000063D0000-memory.dmpFilesize
64KB
-
memory/956-180-0x00000000063C0000-0x00000000063D0000-memory.dmpFilesize
64KB
-
memory/956-181-0x0000000000400000-0x0000000001AE3000-memory.dmpFilesize
22.9MB
-
memory/956-182-0x00000000063C0000-0x00000000063D0000-memory.dmpFilesize
64KB
-
memory/956-184-0x00000000063C0000-0x00000000063D0000-memory.dmpFilesize
64KB
-
memory/956-185-0x00000000063C0000-0x00000000063D0000-memory.dmpFilesize
64KB
-
memory/956-186-0x0000000000400000-0x0000000001AE3000-memory.dmpFilesize
22.9MB
-
memory/2464-195-0x0000000006100000-0x000000000613F000-memory.dmpFilesize
252KB
-
memory/2464-224-0x0000000006100000-0x000000000613F000-memory.dmpFilesize
252KB
-
memory/2464-193-0x0000000006250000-0x0000000006260000-memory.dmpFilesize
64KB
-
memory/2464-191-0x0000000001B90000-0x0000000001BDB000-memory.dmpFilesize
300KB
-
memory/2464-196-0x0000000006100000-0x000000000613F000-memory.dmpFilesize
252KB
-
memory/2464-194-0x0000000006250000-0x0000000006260000-memory.dmpFilesize
64KB
-
memory/2464-198-0x0000000006100000-0x000000000613F000-memory.dmpFilesize
252KB
-
memory/2464-200-0x0000000006100000-0x000000000613F000-memory.dmpFilesize
252KB
-
memory/2464-202-0x0000000006100000-0x000000000613F000-memory.dmpFilesize
252KB
-
memory/2464-204-0x0000000006100000-0x000000000613F000-memory.dmpFilesize
252KB
-
memory/2464-206-0x0000000006100000-0x000000000613F000-memory.dmpFilesize
252KB
-
memory/2464-208-0x0000000006100000-0x000000000613F000-memory.dmpFilesize
252KB
-
memory/2464-210-0x0000000006100000-0x000000000613F000-memory.dmpFilesize
252KB
-
memory/2464-212-0x0000000006100000-0x000000000613F000-memory.dmpFilesize
252KB
-
memory/2464-214-0x0000000006100000-0x000000000613F000-memory.dmpFilesize
252KB
-
memory/2464-216-0x0000000006100000-0x000000000613F000-memory.dmpFilesize
252KB
-
memory/2464-218-0x0000000006100000-0x000000000613F000-memory.dmpFilesize
252KB
-
memory/2464-220-0x0000000006100000-0x000000000613F000-memory.dmpFilesize
252KB
-
memory/2464-222-0x0000000006100000-0x000000000613F000-memory.dmpFilesize
252KB
-
memory/2464-192-0x0000000006250000-0x0000000006260000-memory.dmpFilesize
64KB
-
memory/2464-226-0x0000000006100000-0x000000000613F000-memory.dmpFilesize
252KB
-
memory/2464-228-0x0000000006100000-0x000000000613F000-memory.dmpFilesize
252KB
-
memory/2464-1101-0x0000000006910000-0x0000000006F28000-memory.dmpFilesize
6.1MB
-
memory/2464-1102-0x0000000006F30000-0x000000000703A000-memory.dmpFilesize
1.0MB
-
memory/2464-1103-0x0000000006230000-0x0000000006242000-memory.dmpFilesize
72KB
-
memory/2464-1104-0x0000000007040000-0x000000000707C000-memory.dmpFilesize
240KB
-
memory/2464-1105-0x0000000006250000-0x0000000006260000-memory.dmpFilesize
64KB
-
memory/2464-1107-0x0000000007330000-0x0000000007396000-memory.dmpFilesize
408KB
-
memory/2464-1108-0x00000000079F0000-0x0000000007A82000-memory.dmpFilesize
584KB
-
memory/2464-1109-0x0000000006250000-0x0000000006260000-memory.dmpFilesize
64KB
-
memory/2464-1110-0x0000000006250000-0x0000000006260000-memory.dmpFilesize
64KB
-
memory/2464-1111-0x0000000006250000-0x0000000006260000-memory.dmpFilesize
64KB
-
memory/2464-1112-0x0000000008C60000-0x0000000008CD6000-memory.dmpFilesize
472KB
-
memory/2464-1113-0x0000000008CF0000-0x0000000008D40000-memory.dmpFilesize
320KB
-
memory/2464-1114-0x0000000008F50000-0x0000000009112000-memory.dmpFilesize
1.8MB
-
memory/2464-1115-0x0000000009120000-0x000000000964C000-memory.dmpFilesize
5.2MB
-
memory/2464-1116-0x0000000006250000-0x0000000006260000-memory.dmpFilesize
64KB
-
memory/3300-1122-0x0000000000A70000-0x0000000000AA2000-memory.dmpFilesize
200KB
-
memory/3300-1123-0x0000000005610000-0x0000000005620000-memory.dmpFilesize
64KB