Analysis
-
max time kernel
54s -
max time network
72s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
31-03-2023 20:48
Static task
static1
Behavioral task
behavioral1
Sample
a97c776b2f9a11a6a840b11566eb14fc6f4f3591762b1a996642788c8dc19bd6.exe
Resource
win10-20230220-en
General
-
Target
a97c776b2f9a11a6a840b11566eb14fc6f4f3591762b1a996642788c8dc19bd6.exe
-
Size
672KB
-
MD5
af8ad7dc44bad7be7894f36f84ce9332
-
SHA1
47bc9ecf65b8213a5aac0e12804a1062b6569e7c
-
SHA256
a97c776b2f9a11a6a840b11566eb14fc6f4f3591762b1a996642788c8dc19bd6
-
SHA512
52fc376e24bdc1e61e764656202ad79efbe4aecbeab4da6d13571a246477e7e37292ed0e2e097071d72779eb6eabc8e9f1604c298c05a311cc7a574d555a794f
-
SSDEEP
12288:sMrMy90YGVnGtNgHtGQnk4JaHKx1qp8xKVd3LqaJx9s/527DarVGDB:4yntcDkX+q8ed3GaJxO8vPDB
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro5962.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro5962.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro5962.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro5962.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro5962.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro5962.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/4732-178-0x0000000003660000-0x00000000036A6000-memory.dmp family_redline behavioral1/memory/4732-179-0x0000000003B50000-0x0000000003B94000-memory.dmp family_redline behavioral1/memory/4732-180-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4732-181-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4732-183-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4732-185-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4732-187-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4732-189-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4732-191-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4732-193-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4732-195-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4732-197-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4732-199-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4732-201-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4732-203-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4732-205-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4732-207-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4732-209-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4732-211-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4732-213-0x0000000003B50000-0x0000000003B8F000-memory.dmp family_redline behavioral1/memory/4732-1101-0x0000000003BF0000-0x0000000003C00000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un222484.exepro5962.exequ1581.exesi583401.exepid process 364 un222484.exe 3504 pro5962.exe 4732 qu1581.exe 4816 si583401.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro5962.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro5962.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro5962.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un222484.exea97c776b2f9a11a6a840b11566eb14fc6f4f3591762b1a996642788c8dc19bd6.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un222484.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un222484.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce a97c776b2f9a11a6a840b11566eb14fc6f4f3591762b1a996642788c8dc19bd6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a97c776b2f9a11a6a840b11566eb14fc6f4f3591762b1a996642788c8dc19bd6.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro5962.exequ1581.exesi583401.exepid process 3504 pro5962.exe 3504 pro5962.exe 4732 qu1581.exe 4732 qu1581.exe 4816 si583401.exe 4816 si583401.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro5962.exequ1581.exesi583401.exedescription pid process Token: SeDebugPrivilege 3504 pro5962.exe Token: SeDebugPrivilege 4732 qu1581.exe Token: SeDebugPrivilege 4816 si583401.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
a97c776b2f9a11a6a840b11566eb14fc6f4f3591762b1a996642788c8dc19bd6.exeun222484.exedescription pid process target process PID 1596 wrote to memory of 364 1596 a97c776b2f9a11a6a840b11566eb14fc6f4f3591762b1a996642788c8dc19bd6.exe un222484.exe PID 1596 wrote to memory of 364 1596 a97c776b2f9a11a6a840b11566eb14fc6f4f3591762b1a996642788c8dc19bd6.exe un222484.exe PID 1596 wrote to memory of 364 1596 a97c776b2f9a11a6a840b11566eb14fc6f4f3591762b1a996642788c8dc19bd6.exe un222484.exe PID 364 wrote to memory of 3504 364 un222484.exe pro5962.exe PID 364 wrote to memory of 3504 364 un222484.exe pro5962.exe PID 364 wrote to memory of 3504 364 un222484.exe pro5962.exe PID 364 wrote to memory of 4732 364 un222484.exe qu1581.exe PID 364 wrote to memory of 4732 364 un222484.exe qu1581.exe PID 364 wrote to memory of 4732 364 un222484.exe qu1581.exe PID 1596 wrote to memory of 4816 1596 a97c776b2f9a11a6a840b11566eb14fc6f4f3591762b1a996642788c8dc19bd6.exe si583401.exe PID 1596 wrote to memory of 4816 1596 a97c776b2f9a11a6a840b11566eb14fc6f4f3591762b1a996642788c8dc19bd6.exe si583401.exe PID 1596 wrote to memory of 4816 1596 a97c776b2f9a11a6a840b11566eb14fc6f4f3591762b1a996642788c8dc19bd6.exe si583401.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a97c776b2f9a11a6a840b11566eb14fc6f4f3591762b1a996642788c8dc19bd6.exe"C:\Users\Admin\AppData\Local\Temp\a97c776b2f9a11a6a840b11566eb14fc6f4f3591762b1a996642788c8dc19bd6.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un222484.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un222484.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5962.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5962.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1581.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1581.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si583401.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si583401.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si583401.exeFilesize
175KB
MD53df95578fc2f6f109a10f3a806fdf62b
SHA1e3736cd1fd792bfcee7e0dd9639eb07676d96b4e
SHA256640227a96e94c25217afb8834bb391546ddde1022b55265087ca3539705ce766
SHA512488f3cc6207a1bd259947436a1f09dcb4256cb93b23c2a5f13c8f832d2717c8a6986490cfd4806aae69f7303060d302bd0b838fafee467696af8f2eb2b5d4d01
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si583401.exeFilesize
175KB
MD53df95578fc2f6f109a10f3a806fdf62b
SHA1e3736cd1fd792bfcee7e0dd9639eb07676d96b4e
SHA256640227a96e94c25217afb8834bb391546ddde1022b55265087ca3539705ce766
SHA512488f3cc6207a1bd259947436a1f09dcb4256cb93b23c2a5f13c8f832d2717c8a6986490cfd4806aae69f7303060d302bd0b838fafee467696af8f2eb2b5d4d01
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un222484.exeFilesize
530KB
MD5b6bd54771d2feb5d83ee728f6f6ecb85
SHA1fa56da698171ca6a73f89670a2914d93b42c227f
SHA256cee830478546fdacc69964843839d6e9bbf0869e5cd7cf1425a4f2a00a5b4b11
SHA5121a1746b4d6a4b7bfebad936dc1d1ecb03b85be0f9ddba4552f3ac929fd811761c7a3c3b379d7eb250980a9173f2cb4dee7b379826e033de1e4eed45927c1fbcf
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un222484.exeFilesize
530KB
MD5b6bd54771d2feb5d83ee728f6f6ecb85
SHA1fa56da698171ca6a73f89670a2914d93b42c227f
SHA256cee830478546fdacc69964843839d6e9bbf0869e5cd7cf1425a4f2a00a5b4b11
SHA5121a1746b4d6a4b7bfebad936dc1d1ecb03b85be0f9ddba4552f3ac929fd811761c7a3c3b379d7eb250980a9173f2cb4dee7b379826e033de1e4eed45927c1fbcf
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5962.exeFilesize
301KB
MD530a07069423c84adcd565156c92edf64
SHA1fa4c2173a7aebfd1fab7410b0eaa2e1d85b5f65b
SHA25674331f5ad8d8cc1825edc3ea554dd682f0584371cafa11db3a3924a572a5e758
SHA512a3a2e43190a089cc23d82c41474eb93e228ca078f5015e24d1c60ce57b0e5caf11611420dd2959757156771e06a4043cd4588a6fd6cd64c7f804bf45515f831b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5962.exeFilesize
301KB
MD530a07069423c84adcd565156c92edf64
SHA1fa4c2173a7aebfd1fab7410b0eaa2e1d85b5f65b
SHA25674331f5ad8d8cc1825edc3ea554dd682f0584371cafa11db3a3924a572a5e758
SHA512a3a2e43190a089cc23d82c41474eb93e228ca078f5015e24d1c60ce57b0e5caf11611420dd2959757156771e06a4043cd4588a6fd6cd64c7f804bf45515f831b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1581.exeFilesize
359KB
MD5b9b5469d3fe379acb19b12a77bb36a53
SHA1eb5f544179b824060d7570e6977dfa91697ceecf
SHA2564f47ac32374d0d6201a1ce14cf7f6ce08c7f35b0eb00801594a5d3e4ab93a26b
SHA512858f725e654bdc79cbbc60a8996e63fb60c0cc32b2d081fc770887c0a97ec232c89305ce1793e2ec0cb4bde5c7a31d0b307887fe09deacd44dacf376f825c9d4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1581.exeFilesize
359KB
MD5b9b5469d3fe379acb19b12a77bb36a53
SHA1eb5f544179b824060d7570e6977dfa91697ceecf
SHA2564f47ac32374d0d6201a1ce14cf7f6ce08c7f35b0eb00801594a5d3e4ab93a26b
SHA512858f725e654bdc79cbbc60a8996e63fb60c0cc32b2d081fc770887c0a97ec232c89305ce1793e2ec0cb4bde5c7a31d0b307887fe09deacd44dacf376f825c9d4
-
memory/3504-134-0x00000000037D0000-0x00000000037EA000-memory.dmpFilesize
104KB
-
memory/3504-135-0x0000000001BC0000-0x0000000001BED000-memory.dmpFilesize
180KB
-
memory/3504-136-0x00000000060D0000-0x00000000060E0000-memory.dmpFilesize
64KB
-
memory/3504-137-0x00000000060E0000-0x00000000065DE000-memory.dmpFilesize
5.0MB
-
memory/3504-138-0x0000000006010000-0x0000000006028000-memory.dmpFilesize
96KB
-
memory/3504-139-0x0000000006010000-0x0000000006022000-memory.dmpFilesize
72KB
-
memory/3504-140-0x0000000006010000-0x0000000006022000-memory.dmpFilesize
72KB
-
memory/3504-142-0x0000000006010000-0x0000000006022000-memory.dmpFilesize
72KB
-
memory/3504-146-0x00000000060D0000-0x00000000060E0000-memory.dmpFilesize
64KB
-
memory/3504-145-0x0000000006010000-0x0000000006022000-memory.dmpFilesize
72KB
-
memory/3504-144-0x00000000060D0000-0x00000000060E0000-memory.dmpFilesize
64KB
-
memory/3504-148-0x0000000006010000-0x0000000006022000-memory.dmpFilesize
72KB
-
memory/3504-150-0x0000000006010000-0x0000000006022000-memory.dmpFilesize
72KB
-
memory/3504-152-0x0000000006010000-0x0000000006022000-memory.dmpFilesize
72KB
-
memory/3504-154-0x0000000006010000-0x0000000006022000-memory.dmpFilesize
72KB
-
memory/3504-156-0x0000000006010000-0x0000000006022000-memory.dmpFilesize
72KB
-
memory/3504-158-0x0000000006010000-0x0000000006022000-memory.dmpFilesize
72KB
-
memory/3504-160-0x0000000006010000-0x0000000006022000-memory.dmpFilesize
72KB
-
memory/3504-162-0x0000000006010000-0x0000000006022000-memory.dmpFilesize
72KB
-
memory/3504-164-0x0000000006010000-0x0000000006022000-memory.dmpFilesize
72KB
-
memory/3504-166-0x0000000006010000-0x0000000006022000-memory.dmpFilesize
72KB
-
memory/3504-168-0x0000000006010000-0x0000000006022000-memory.dmpFilesize
72KB
-
memory/3504-169-0x0000000000400000-0x0000000001AE3000-memory.dmpFilesize
22.9MB
-
memory/3504-170-0x00000000060D0000-0x00000000060E0000-memory.dmpFilesize
64KB
-
memory/3504-173-0x00000000060D0000-0x00000000060E0000-memory.dmpFilesize
64KB
-
memory/3504-172-0x0000000000400000-0x0000000001AE3000-memory.dmpFilesize
22.9MB
-
memory/4732-178-0x0000000003660000-0x00000000036A6000-memory.dmpFilesize
280KB
-
memory/4732-179-0x0000000003B50000-0x0000000003B94000-memory.dmpFilesize
272KB
-
memory/4732-180-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4732-181-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4732-183-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4732-185-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4732-187-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4732-189-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4732-191-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4732-193-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4732-195-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4732-197-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4732-199-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4732-201-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4732-203-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4732-205-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4732-207-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4732-209-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4732-211-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4732-213-0x0000000003B50000-0x0000000003B8F000-memory.dmpFilesize
252KB
-
memory/4732-231-0x0000000001BD0000-0x0000000001C1B000-memory.dmpFilesize
300KB
-
memory/4732-233-0x0000000003BF0000-0x0000000003C00000-memory.dmpFilesize
64KB
-
memory/4732-235-0x0000000003BF0000-0x0000000003C00000-memory.dmpFilesize
64KB
-
memory/4732-238-0x0000000003BF0000-0x0000000003C00000-memory.dmpFilesize
64KB
-
memory/4732-1090-0x0000000006650000-0x0000000006C56000-memory.dmpFilesize
6.0MB
-
memory/4732-1091-0x0000000006CA0000-0x0000000006DAA000-memory.dmpFilesize
1.0MB
-
memory/4732-1092-0x0000000006DE0000-0x0000000006DF2000-memory.dmpFilesize
72KB
-
memory/4732-1093-0x0000000003BF0000-0x0000000003C00000-memory.dmpFilesize
64KB
-
memory/4732-1094-0x0000000006E00000-0x0000000006E3E000-memory.dmpFilesize
248KB
-
memory/4732-1095-0x0000000006F50000-0x0000000006F9B000-memory.dmpFilesize
300KB
-
memory/4732-1097-0x00000000070E0000-0x0000000007172000-memory.dmpFilesize
584KB
-
memory/4732-1098-0x0000000007180000-0x00000000071E6000-memory.dmpFilesize
408KB
-
memory/4732-1099-0x0000000003BF0000-0x0000000003C00000-memory.dmpFilesize
64KB
-
memory/4732-1100-0x0000000003BF0000-0x0000000003C00000-memory.dmpFilesize
64KB
-
memory/4732-1101-0x0000000003BF0000-0x0000000003C00000-memory.dmpFilesize
64KB
-
memory/4732-1102-0x0000000003BF0000-0x0000000003C00000-memory.dmpFilesize
64KB
-
memory/4732-1103-0x0000000007AC0000-0x0000000007B36000-memory.dmpFilesize
472KB
-
memory/4732-1104-0x0000000007B50000-0x0000000007BA0000-memory.dmpFilesize
320KB
-
memory/4732-1105-0x0000000007BC0000-0x0000000007D82000-memory.dmpFilesize
1.8MB
-
memory/4732-1106-0x0000000007D90000-0x00000000082BC000-memory.dmpFilesize
5.2MB
-
memory/4816-1112-0x0000000000A00000-0x0000000000A32000-memory.dmpFilesize
200KB
-
memory/4816-1113-0x00000000055E0000-0x00000000055F0000-memory.dmpFilesize
64KB
-
memory/4816-1114-0x0000000005440000-0x000000000548B000-memory.dmpFilesize
300KB
-
memory/4816-1115-0x00000000055E0000-0x00000000055F0000-memory.dmpFilesize
64KB