Analysis
-
max time kernel
84s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 20:47
Static task
static1
Behavioral task
behavioral1
Sample
3116e2c2d9b9c46c824a3eeafb6a8b6838202d26022836c8b82c03484dd7deff.exe
Resource
win10v2004-20230221-en
General
-
Target
3116e2c2d9b9c46c824a3eeafb6a8b6838202d26022836c8b82c03484dd7deff.exe
-
Size
533KB
-
MD5
903f2cac40f0a99a881598d021f04181
-
SHA1
93f180a370e84b8fd8802dc0eaec6de87f32b4a7
-
SHA256
3116e2c2d9b9c46c824a3eeafb6a8b6838202d26022836c8b82c03484dd7deff
-
SHA512
99beeef0abeb925c32b49d162263dbdb5c0219c7170da78148d665731df82a6aff1fc5a9ee4096e9a035c7c41f3a50d47a66d129ca998e68a20aed568df267f0
-
SSDEEP
12288:PMriy90WeLgl/uwiyCfR9p3LqjgAzSnWIP8s:ZyyaRbCZ9p3Gj1sJUs
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr492634.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr492634.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr492634.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr492634.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr492634.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr492634.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr492634.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/4496-158-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4496-159-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4496-161-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4496-165-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4496-163-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4496-167-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4496-169-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4496-171-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4496-173-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4496-175-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4496-177-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4496-179-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4496-181-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4496-183-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4496-185-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4496-187-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4496-189-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4496-191-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4496-193-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4496-197-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4496-195-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4496-199-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4496-201-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4496-203-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4496-205-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4496-209-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4496-211-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4496-207-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4496-213-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4496-215-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4496-217-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4496-219-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4496-221-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
ziGk5115.exejr492634.exeku457488.exelr152029.exepid process 4780 ziGk5115.exe 1828 jr492634.exe 4496 ku457488.exe 1752 lr152029.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr492634.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr492634.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
3116e2c2d9b9c46c824a3eeafb6a8b6838202d26022836c8b82c03484dd7deff.exeziGk5115.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 3116e2c2d9b9c46c824a3eeafb6a8b6838202d26022836c8b82c03484dd7deff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 3116e2c2d9b9c46c824a3eeafb6a8b6838202d26022836c8b82c03484dd7deff.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziGk5115.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziGk5115.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3596 4496 WerFault.exe ku457488.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr492634.exeku457488.exelr152029.exepid process 1828 jr492634.exe 1828 jr492634.exe 4496 ku457488.exe 4496 ku457488.exe 1752 lr152029.exe 1752 lr152029.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr492634.exeku457488.exelr152029.exedescription pid process Token: SeDebugPrivilege 1828 jr492634.exe Token: SeDebugPrivilege 4496 ku457488.exe Token: SeDebugPrivilege 1752 lr152029.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
3116e2c2d9b9c46c824a3eeafb6a8b6838202d26022836c8b82c03484dd7deff.exeziGk5115.exedescription pid process target process PID 2564 wrote to memory of 4780 2564 3116e2c2d9b9c46c824a3eeafb6a8b6838202d26022836c8b82c03484dd7deff.exe ziGk5115.exe PID 2564 wrote to memory of 4780 2564 3116e2c2d9b9c46c824a3eeafb6a8b6838202d26022836c8b82c03484dd7deff.exe ziGk5115.exe PID 2564 wrote to memory of 4780 2564 3116e2c2d9b9c46c824a3eeafb6a8b6838202d26022836c8b82c03484dd7deff.exe ziGk5115.exe PID 4780 wrote to memory of 1828 4780 ziGk5115.exe jr492634.exe PID 4780 wrote to memory of 1828 4780 ziGk5115.exe jr492634.exe PID 4780 wrote to memory of 4496 4780 ziGk5115.exe ku457488.exe PID 4780 wrote to memory of 4496 4780 ziGk5115.exe ku457488.exe PID 4780 wrote to memory of 4496 4780 ziGk5115.exe ku457488.exe PID 2564 wrote to memory of 1752 2564 3116e2c2d9b9c46c824a3eeafb6a8b6838202d26022836c8b82c03484dd7deff.exe lr152029.exe PID 2564 wrote to memory of 1752 2564 3116e2c2d9b9c46c824a3eeafb6a8b6838202d26022836c8b82c03484dd7deff.exe lr152029.exe PID 2564 wrote to memory of 1752 2564 3116e2c2d9b9c46c824a3eeafb6a8b6838202d26022836c8b82c03484dd7deff.exe lr152029.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3116e2c2d9b9c46c824a3eeafb6a8b6838202d26022836c8b82c03484dd7deff.exe"C:\Users\Admin\AppData\Local\Temp\3116e2c2d9b9c46c824a3eeafb6a8b6838202d26022836c8b82c03484dd7deff.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziGk5115.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziGk5115.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr492634.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr492634.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku457488.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku457488.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 13564⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr152029.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr152029.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4496 -ip 44961⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr152029.exeFilesize
175KB
MD5b7d2d1a5a0cd2ab1ee11383e3df5438f
SHA13381868fe3e0f2324ae91f38cb2a0185309f1ea4
SHA25661016f59f2e80d28ff0a1bbd57ae644c9f4743014bb0795ceffe7072cd08731b
SHA51217f245f11431c64fdc91be590eb9070705793391a25179f8fbf09b5b7e7fb6c154826fe96ff11de6d4c448ce1fad791147acc28f090edab21cac47bfb5e7f5f3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr152029.exeFilesize
175KB
MD5b7d2d1a5a0cd2ab1ee11383e3df5438f
SHA13381868fe3e0f2324ae91f38cb2a0185309f1ea4
SHA25661016f59f2e80d28ff0a1bbd57ae644c9f4743014bb0795ceffe7072cd08731b
SHA51217f245f11431c64fdc91be590eb9070705793391a25179f8fbf09b5b7e7fb6c154826fe96ff11de6d4c448ce1fad791147acc28f090edab21cac47bfb5e7f5f3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziGk5115.exeFilesize
391KB
MD5286d00fb8774d77afe60a360e7f4e638
SHA17a973b498926bd4ede517655cb99f300f5448613
SHA256583bc816d0fc868a5ff89191c8596f4320d5c0745ae36aa877e33a23355723b1
SHA51282b865e0276661fc757b441e1630d843bf973dcab65d0ea9aae6b90315f2a0e58d12b09cf6980afcb2e7f911550398025a528426be73115d66baf499bc8d7a27
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziGk5115.exeFilesize
391KB
MD5286d00fb8774d77afe60a360e7f4e638
SHA17a973b498926bd4ede517655cb99f300f5448613
SHA256583bc816d0fc868a5ff89191c8596f4320d5c0745ae36aa877e33a23355723b1
SHA51282b865e0276661fc757b441e1630d843bf973dcab65d0ea9aae6b90315f2a0e58d12b09cf6980afcb2e7f911550398025a528426be73115d66baf499bc8d7a27
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr492634.exeFilesize
11KB
MD53caf74acb68fcc62c6dcc0dd5420869e
SHA1dbc6b3a729425c24d73516cd0274339b9f1bb25e
SHA256378104be760b6a5d2adbbd549c9490780cf44e88c6a668cddaee10b2407fedfb
SHA512dc852a47eeb26c4396061f3bb725955657cb4d7d1a911fb6b23aebf1902803090e05bcd32bd0ab45ee6401403a0b15572e56ec03e46d83148276a2ba5539c666
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr492634.exeFilesize
11KB
MD53caf74acb68fcc62c6dcc0dd5420869e
SHA1dbc6b3a729425c24d73516cd0274339b9f1bb25e
SHA256378104be760b6a5d2adbbd549c9490780cf44e88c6a668cddaee10b2407fedfb
SHA512dc852a47eeb26c4396061f3bb725955657cb4d7d1a911fb6b23aebf1902803090e05bcd32bd0ab45ee6401403a0b15572e56ec03e46d83148276a2ba5539c666
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku457488.exeFilesize
359KB
MD59043eaa2b512bb2be5f17eb770a0f8a1
SHA14dd199f5dabda70b804d0ebb36752e15a2c3d0ba
SHA256c2e1703e3bc04b0354f429885401bedfdc56f9f65cb9727a804e5850397f0813
SHA5129270acb905231ba870631c427c00ef0ee0fe924e306753ce4caa4dcef5d8b97c7a02849586b312efbd326887edc5f6dd67d5d7d1159a729a7fa804b7a2aff8a0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku457488.exeFilesize
359KB
MD59043eaa2b512bb2be5f17eb770a0f8a1
SHA14dd199f5dabda70b804d0ebb36752e15a2c3d0ba
SHA256c2e1703e3bc04b0354f429885401bedfdc56f9f65cb9727a804e5850397f0813
SHA5129270acb905231ba870631c427c00ef0ee0fe924e306753ce4caa4dcef5d8b97c7a02849586b312efbd326887edc5f6dd67d5d7d1159a729a7fa804b7a2aff8a0
-
memory/1752-1087-0x0000000000860000-0x0000000000892000-memory.dmpFilesize
200KB
-
memory/1752-1088-0x00000000051C0000-0x00000000051D0000-memory.dmpFilesize
64KB
-
memory/1752-1089-0x00000000051C0000-0x00000000051D0000-memory.dmpFilesize
64KB
-
memory/1828-147-0x0000000000A10000-0x0000000000A1A000-memory.dmpFilesize
40KB
-
memory/4496-189-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4496-199-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4496-157-0x0000000006170000-0x0000000006180000-memory.dmpFilesize
64KB
-
memory/4496-155-0x0000000006170000-0x0000000006180000-memory.dmpFilesize
64KB
-
memory/4496-158-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4496-159-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4496-161-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4496-165-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4496-163-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4496-167-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4496-169-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4496-171-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4496-173-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4496-175-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4496-177-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4496-179-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4496-181-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4496-183-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4496-185-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4496-187-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4496-154-0x0000000006170000-0x0000000006180000-memory.dmpFilesize
64KB
-
memory/4496-191-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4496-193-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4496-197-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4496-195-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4496-156-0x0000000006180000-0x0000000006724000-memory.dmpFilesize
5.6MB
-
memory/4496-201-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4496-203-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4496-205-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4496-209-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4496-211-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4496-207-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4496-213-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4496-215-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4496-217-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4496-219-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4496-221-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4496-1065-0x0000000006170000-0x0000000006180000-memory.dmpFilesize
64KB
-
memory/4496-1066-0x0000000006170000-0x0000000006180000-memory.dmpFilesize
64KB
-
memory/4496-1068-0x0000000006730000-0x0000000006D48000-memory.dmpFilesize
6.1MB
-
memory/4496-1069-0x0000000006DA0000-0x0000000006EAA000-memory.dmpFilesize
1.0MB
-
memory/4496-1070-0x0000000006EE0000-0x0000000006EF2000-memory.dmpFilesize
72KB
-
memory/4496-1071-0x0000000006F00000-0x0000000006F3C000-memory.dmpFilesize
240KB
-
memory/4496-1072-0x0000000006170000-0x0000000006180000-memory.dmpFilesize
64KB
-
memory/4496-1074-0x0000000007470000-0x0000000007502000-memory.dmpFilesize
584KB
-
memory/4496-1075-0x0000000007510000-0x0000000007576000-memory.dmpFilesize
408KB
-
memory/4496-1076-0x00000000079B0000-0x0000000007B72000-memory.dmpFilesize
1.8MB
-
memory/4496-153-0x0000000001C90000-0x0000000001CDB000-memory.dmpFilesize
300KB
-
memory/4496-1077-0x0000000006170000-0x0000000006180000-memory.dmpFilesize
64KB
-
memory/4496-1078-0x0000000007B80000-0x00000000080AC000-memory.dmpFilesize
5.2MB
-
memory/4496-1080-0x0000000008580000-0x00000000085F6000-memory.dmpFilesize
472KB
-
memory/4496-1081-0x0000000008600000-0x0000000008650000-memory.dmpFilesize
320KB