Analysis
-
max time kernel
143s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 20:48
Static task
static1
Behavioral task
behavioral1
Sample
364ac9104550f745df8d101ec7e719b1178290b9ce28a76744d9a1b5431ff6ca.exe
Resource
win10v2004-20230220-en
General
-
Target
364ac9104550f745df8d101ec7e719b1178290b9ce28a76744d9a1b5431ff6ca.exe
-
Size
533KB
-
MD5
d1a702e7dd69b0f95c8bc7438a6e0256
-
SHA1
f35ec398095b78579cccb68c41ba4944c9791326
-
SHA256
364ac9104550f745df8d101ec7e719b1178290b9ce28a76744d9a1b5431ff6ca
-
SHA512
02b6089a3de8288b69cbebe9c220ecd4d4091c4f6c20e5ee7340e2c1eeb142db4ad4d6b90b2676b1cdee242fff1d7685c3b0c8cb2fc9d119d49bcc7e09256309
-
SSDEEP
12288:eMr8y90Lap5aK85Fcenbws6zKd3LqSl0jc6/Hr:eybUiebF6ed3Gz/r
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr993367.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr993367.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr993367.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr993367.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr993367.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr993367.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr993367.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/4636-156-0x00000000060B0000-0x00000000060EF000-memory.dmp family_redline behavioral1/memory/4636-159-0x00000000060B0000-0x00000000060EF000-memory.dmp family_redline behavioral1/memory/4636-157-0x00000000060B0000-0x00000000060EF000-memory.dmp family_redline behavioral1/memory/4636-161-0x00000000060B0000-0x00000000060EF000-memory.dmp family_redline behavioral1/memory/4636-163-0x00000000060B0000-0x00000000060EF000-memory.dmp family_redline behavioral1/memory/4636-165-0x00000000060B0000-0x00000000060EF000-memory.dmp family_redline behavioral1/memory/4636-167-0x00000000060B0000-0x00000000060EF000-memory.dmp family_redline behavioral1/memory/4636-169-0x00000000060B0000-0x00000000060EF000-memory.dmp family_redline behavioral1/memory/4636-171-0x00000000060B0000-0x00000000060EF000-memory.dmp family_redline behavioral1/memory/4636-173-0x00000000060B0000-0x00000000060EF000-memory.dmp family_redline behavioral1/memory/4636-175-0x00000000060B0000-0x00000000060EF000-memory.dmp family_redline behavioral1/memory/4636-178-0x00000000060B0000-0x00000000060EF000-memory.dmp family_redline behavioral1/memory/4636-181-0x00000000060B0000-0x00000000060EF000-memory.dmp family_redline behavioral1/memory/4636-183-0x00000000060B0000-0x00000000060EF000-memory.dmp family_redline behavioral1/memory/4636-185-0x00000000060B0000-0x00000000060EF000-memory.dmp family_redline behavioral1/memory/4636-187-0x00000000060B0000-0x00000000060EF000-memory.dmp family_redline behavioral1/memory/4636-189-0x00000000060B0000-0x00000000060EF000-memory.dmp family_redline behavioral1/memory/4636-191-0x00000000060B0000-0x00000000060EF000-memory.dmp family_redline behavioral1/memory/4636-193-0x00000000060B0000-0x00000000060EF000-memory.dmp family_redline behavioral1/memory/4636-195-0x00000000060B0000-0x00000000060EF000-memory.dmp family_redline behavioral1/memory/4636-197-0x00000000060B0000-0x00000000060EF000-memory.dmp family_redline behavioral1/memory/4636-199-0x00000000060B0000-0x00000000060EF000-memory.dmp family_redline behavioral1/memory/4636-201-0x00000000060B0000-0x00000000060EF000-memory.dmp family_redline behavioral1/memory/4636-203-0x00000000060B0000-0x00000000060EF000-memory.dmp family_redline behavioral1/memory/4636-205-0x00000000060B0000-0x00000000060EF000-memory.dmp family_redline behavioral1/memory/4636-207-0x00000000060B0000-0x00000000060EF000-memory.dmp family_redline behavioral1/memory/4636-209-0x00000000060B0000-0x00000000060EF000-memory.dmp family_redline behavioral1/memory/4636-211-0x00000000060B0000-0x00000000060EF000-memory.dmp family_redline behavioral1/memory/4636-213-0x00000000060B0000-0x00000000060EF000-memory.dmp family_redline behavioral1/memory/4636-215-0x00000000060B0000-0x00000000060EF000-memory.dmp family_redline behavioral1/memory/4636-217-0x00000000060B0000-0x00000000060EF000-memory.dmp family_redline behavioral1/memory/4636-219-0x00000000060B0000-0x00000000060EF000-memory.dmp family_redline behavioral1/memory/4636-221-0x00000000060B0000-0x00000000060EF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
ziyd2821.exejr993367.exeku372847.exelr653421.exepid process 3228 ziyd2821.exe 4980 jr993367.exe 4636 ku372847.exe 2000 lr653421.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr993367.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr993367.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
364ac9104550f745df8d101ec7e719b1178290b9ce28a76744d9a1b5431ff6ca.exeziyd2821.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 364ac9104550f745df8d101ec7e719b1178290b9ce28a76744d9a1b5431ff6ca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 364ac9104550f745df8d101ec7e719b1178290b9ce28a76744d9a1b5431ff6ca.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziyd2821.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziyd2821.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 4304 sc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2156 4636 WerFault.exe ku372847.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr993367.exeku372847.exelr653421.exepid process 4980 jr993367.exe 4980 jr993367.exe 4636 ku372847.exe 4636 ku372847.exe 2000 lr653421.exe 2000 lr653421.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr993367.exeku372847.exelr653421.exedescription pid process Token: SeDebugPrivilege 4980 jr993367.exe Token: SeDebugPrivilege 4636 ku372847.exe Token: SeDebugPrivilege 2000 lr653421.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
364ac9104550f745df8d101ec7e719b1178290b9ce28a76744d9a1b5431ff6ca.exeziyd2821.exedescription pid process target process PID 3812 wrote to memory of 3228 3812 364ac9104550f745df8d101ec7e719b1178290b9ce28a76744d9a1b5431ff6ca.exe ziyd2821.exe PID 3812 wrote to memory of 3228 3812 364ac9104550f745df8d101ec7e719b1178290b9ce28a76744d9a1b5431ff6ca.exe ziyd2821.exe PID 3812 wrote to memory of 3228 3812 364ac9104550f745df8d101ec7e719b1178290b9ce28a76744d9a1b5431ff6ca.exe ziyd2821.exe PID 3228 wrote to memory of 4980 3228 ziyd2821.exe jr993367.exe PID 3228 wrote to memory of 4980 3228 ziyd2821.exe jr993367.exe PID 3228 wrote to memory of 4636 3228 ziyd2821.exe ku372847.exe PID 3228 wrote to memory of 4636 3228 ziyd2821.exe ku372847.exe PID 3228 wrote to memory of 4636 3228 ziyd2821.exe ku372847.exe PID 3812 wrote to memory of 2000 3812 364ac9104550f745df8d101ec7e719b1178290b9ce28a76744d9a1b5431ff6ca.exe lr653421.exe PID 3812 wrote to memory of 2000 3812 364ac9104550f745df8d101ec7e719b1178290b9ce28a76744d9a1b5431ff6ca.exe lr653421.exe PID 3812 wrote to memory of 2000 3812 364ac9104550f745df8d101ec7e719b1178290b9ce28a76744d9a1b5431ff6ca.exe lr653421.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\364ac9104550f745df8d101ec7e719b1178290b9ce28a76744d9a1b5431ff6ca.exe"C:\Users\Admin\AppData\Local\Temp\364ac9104550f745df8d101ec7e719b1178290b9ce28a76744d9a1b5431ff6ca.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziyd2821.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziyd2821.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr993367.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr993367.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku372847.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku372847.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 13484⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr653421.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr653421.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4636 -ip 46361⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr653421.exeFilesize
175KB
MD57c4ea95b5e8e8958c7b53cbe30de3e8b
SHA1393f47a663806ae8257abe6869b0121ae56def7a
SHA2569be861bac551bab175e6578265c4a9f026d7a2ded99a3ddb9504208dc5ea8139
SHA51256b56a0674452ccb4092996ace8d58a48658565633fcc23d73fd6b2181f34c29dd87883ff0ca13cccca9f29eb61e989c5263b8e3c82d23e9b32bdaefae6be250
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr653421.exeFilesize
175KB
MD57c4ea95b5e8e8958c7b53cbe30de3e8b
SHA1393f47a663806ae8257abe6869b0121ae56def7a
SHA2569be861bac551bab175e6578265c4a9f026d7a2ded99a3ddb9504208dc5ea8139
SHA51256b56a0674452ccb4092996ace8d58a48658565633fcc23d73fd6b2181f34c29dd87883ff0ca13cccca9f29eb61e989c5263b8e3c82d23e9b32bdaefae6be250
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziyd2821.exeFilesize
391KB
MD51e84f4ad439bd5295889bebc4c488717
SHA1ef6893aa418f36e4ea84ea51d3cefcb3d0d2a7b3
SHA25647c92ef5a9513586388a9fa0b194a9339b3ec03c31131cb45c57fea420223959
SHA5124d00238e8aff0aaa76e8ab7ac1ed47e679b69f436d171d1752be700612ee3915dd32352ff45bdbf794986cb6747513319078231bd1b9ca17303274f59bfe7f54
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziyd2821.exeFilesize
391KB
MD51e84f4ad439bd5295889bebc4c488717
SHA1ef6893aa418f36e4ea84ea51d3cefcb3d0d2a7b3
SHA25647c92ef5a9513586388a9fa0b194a9339b3ec03c31131cb45c57fea420223959
SHA5124d00238e8aff0aaa76e8ab7ac1ed47e679b69f436d171d1752be700612ee3915dd32352ff45bdbf794986cb6747513319078231bd1b9ca17303274f59bfe7f54
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr993367.exeFilesize
11KB
MD5c530db4ffccd5224e6a11c79e5d37349
SHA16467e0b132ea2358554c8c5b0b0f7f166e22e90c
SHA2560cd6524b376bf46d4296e0e431cd3ee5fc13465c4f2a0eac191e523f7d263412
SHA512fa738c9bba1d4a1c8131478145c6fc5a281930bed5db17418a35189c55644cf8476b23aeef412b754c5e2a394e06270bd7032daf0c2014546ba1ec4c805ac80d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr993367.exeFilesize
11KB
MD5c530db4ffccd5224e6a11c79e5d37349
SHA16467e0b132ea2358554c8c5b0b0f7f166e22e90c
SHA2560cd6524b376bf46d4296e0e431cd3ee5fc13465c4f2a0eac191e523f7d263412
SHA512fa738c9bba1d4a1c8131478145c6fc5a281930bed5db17418a35189c55644cf8476b23aeef412b754c5e2a394e06270bd7032daf0c2014546ba1ec4c805ac80d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku372847.exeFilesize
359KB
MD5158d99cc5c190bc493d244b2738837f2
SHA11ec61266a95b8e4b3a6b886a52cec9f56d74e5e8
SHA2564c0ae7b241a2269b9be91d2fc5061b005f940c35e7d0159c0f87e5132e7473c7
SHA5122653460dd0a824c94f16349b8979bbe99e1e0389bafa39ec39164ba4628f28e94e8ab4d0ff9d635f76dc49fd513718ed381975bd12d739464fd0c1a02c5504aa
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku372847.exeFilesize
359KB
MD5158d99cc5c190bc493d244b2738837f2
SHA11ec61266a95b8e4b3a6b886a52cec9f56d74e5e8
SHA2564c0ae7b241a2269b9be91d2fc5061b005f940c35e7d0159c0f87e5132e7473c7
SHA5122653460dd0a824c94f16349b8979bbe99e1e0389bafa39ec39164ba4628f28e94e8ab4d0ff9d635f76dc49fd513718ed381975bd12d739464fd0c1a02c5504aa
-
memory/2000-1086-0x0000000000560000-0x0000000000592000-memory.dmpFilesize
200KB
-
memory/2000-1087-0x0000000005190000-0x00000000051A0000-memory.dmpFilesize
64KB
-
memory/2000-1088-0x0000000005190000-0x00000000051A0000-memory.dmpFilesize
64KB
-
memory/4636-191-0x00000000060B0000-0x00000000060EF000-memory.dmpFilesize
252KB
-
memory/4636-203-0x00000000060B0000-0x00000000060EF000-memory.dmpFilesize
252KB
-
memory/4636-156-0x00000000060B0000-0x00000000060EF000-memory.dmpFilesize
252KB
-
memory/4636-159-0x00000000060B0000-0x00000000060EF000-memory.dmpFilesize
252KB
-
memory/4636-157-0x00000000060B0000-0x00000000060EF000-memory.dmpFilesize
252KB
-
memory/4636-161-0x00000000060B0000-0x00000000060EF000-memory.dmpFilesize
252KB
-
memory/4636-163-0x00000000060B0000-0x00000000060EF000-memory.dmpFilesize
252KB
-
memory/4636-165-0x00000000060B0000-0x00000000060EF000-memory.dmpFilesize
252KB
-
memory/4636-167-0x00000000060B0000-0x00000000060EF000-memory.dmpFilesize
252KB
-
memory/4636-169-0x00000000060B0000-0x00000000060EF000-memory.dmpFilesize
252KB
-
memory/4636-171-0x00000000060B0000-0x00000000060EF000-memory.dmpFilesize
252KB
-
memory/4636-173-0x00000000060B0000-0x00000000060EF000-memory.dmpFilesize
252KB
-
memory/4636-175-0x00000000060B0000-0x00000000060EF000-memory.dmpFilesize
252KB
-
memory/4636-177-0x0000000006230000-0x0000000006240000-memory.dmpFilesize
64KB
-
memory/4636-179-0x0000000006230000-0x0000000006240000-memory.dmpFilesize
64KB
-
memory/4636-178-0x00000000060B0000-0x00000000060EF000-memory.dmpFilesize
252KB
-
memory/4636-181-0x00000000060B0000-0x00000000060EF000-memory.dmpFilesize
252KB
-
memory/4636-183-0x00000000060B0000-0x00000000060EF000-memory.dmpFilesize
252KB
-
memory/4636-185-0x00000000060B0000-0x00000000060EF000-memory.dmpFilesize
252KB
-
memory/4636-187-0x00000000060B0000-0x00000000060EF000-memory.dmpFilesize
252KB
-
memory/4636-189-0x00000000060B0000-0x00000000060EF000-memory.dmpFilesize
252KB
-
memory/4636-154-0x0000000006230000-0x0000000006240000-memory.dmpFilesize
64KB
-
memory/4636-193-0x00000000060B0000-0x00000000060EF000-memory.dmpFilesize
252KB
-
memory/4636-195-0x00000000060B0000-0x00000000060EF000-memory.dmpFilesize
252KB
-
memory/4636-197-0x00000000060B0000-0x00000000060EF000-memory.dmpFilesize
252KB
-
memory/4636-199-0x00000000060B0000-0x00000000060EF000-memory.dmpFilesize
252KB
-
memory/4636-201-0x00000000060B0000-0x00000000060EF000-memory.dmpFilesize
252KB
-
memory/4636-155-0x0000000006240000-0x00000000067E4000-memory.dmpFilesize
5.6MB
-
memory/4636-205-0x00000000060B0000-0x00000000060EF000-memory.dmpFilesize
252KB
-
memory/4636-207-0x00000000060B0000-0x00000000060EF000-memory.dmpFilesize
252KB
-
memory/4636-209-0x00000000060B0000-0x00000000060EF000-memory.dmpFilesize
252KB
-
memory/4636-211-0x00000000060B0000-0x00000000060EF000-memory.dmpFilesize
252KB
-
memory/4636-213-0x00000000060B0000-0x00000000060EF000-memory.dmpFilesize
252KB
-
memory/4636-215-0x00000000060B0000-0x00000000060EF000-memory.dmpFilesize
252KB
-
memory/4636-217-0x00000000060B0000-0x00000000060EF000-memory.dmpFilesize
252KB
-
memory/4636-219-0x00000000060B0000-0x00000000060EF000-memory.dmpFilesize
252KB
-
memory/4636-221-0x00000000060B0000-0x00000000060EF000-memory.dmpFilesize
252KB
-
memory/4636-1064-0x00000000068F0000-0x0000000006F08000-memory.dmpFilesize
6.1MB
-
memory/4636-1065-0x0000000006F10000-0x000000000701A000-memory.dmpFilesize
1.0MB
-
memory/4636-1066-0x0000000007020000-0x0000000007032000-memory.dmpFilesize
72KB
-
memory/4636-1067-0x0000000007040000-0x000000000707C000-memory.dmpFilesize
240KB
-
memory/4636-1068-0x0000000006230000-0x0000000006240000-memory.dmpFilesize
64KB
-
memory/4636-1070-0x0000000006230000-0x0000000006240000-memory.dmpFilesize
64KB
-
memory/4636-1071-0x0000000006230000-0x0000000006240000-memory.dmpFilesize
64KB
-
memory/4636-1072-0x0000000006230000-0x0000000006240000-memory.dmpFilesize
64KB
-
memory/4636-1073-0x0000000007330000-0x00000000073C2000-memory.dmpFilesize
584KB
-
memory/4636-1074-0x00000000073D0000-0x0000000007436000-memory.dmpFilesize
408KB
-
memory/4636-1075-0x0000000007C30000-0x0000000007DF2000-memory.dmpFilesize
1.8MB
-
memory/4636-153-0x00000000037A0000-0x00000000037EB000-memory.dmpFilesize
300KB
-
memory/4636-1076-0x0000000007E10000-0x000000000833C000-memory.dmpFilesize
5.2MB
-
memory/4636-1077-0x0000000006230000-0x0000000006240000-memory.dmpFilesize
64KB
-
memory/4636-1078-0x0000000008470000-0x00000000084E6000-memory.dmpFilesize
472KB
-
memory/4636-1079-0x0000000008500000-0x0000000008550000-memory.dmpFilesize
320KB
-
memory/4980-147-0x0000000000220000-0x000000000022A000-memory.dmpFilesize
40KB