Analysis
-
max time kernel
90s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 20:55
Static task
static1
Behavioral task
behavioral1
Sample
f821dc96e90219fbb16afb3fe2f69f7069d7a6af4692a90c4d1e430a05997624.exe
Resource
win10v2004-20230220-en
General
-
Target
f821dc96e90219fbb16afb3fe2f69f7069d7a6af4692a90c4d1e430a05997624.exe
-
Size
671KB
-
MD5
11228045491a0231be4576b60705ed17
-
SHA1
c2d2720f3e7cb56a03b1686e24dc1ab6368fff5a
-
SHA256
f821dc96e90219fbb16afb3fe2f69f7069d7a6af4692a90c4d1e430a05997624
-
SHA512
9f71bfff3b90bf0d79ac5bb5abc0a6d4625869a2664be43cdcb23f292d2b52a84993ca266bdee0245083a11c962988fb5760824d2cb6c25f284432a29eb041f8
-
SSDEEP
12288:tMryy90NiJsA3QHl+sAqn/3ktk0fgKaiZe+O9aFw3LqIGAOQAyl:PyWLF+6n8tk0fEiZe9aFw3GXQA0
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro3106.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro3106.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro3106.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro3106.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro3106.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro3106.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro3106.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/4216-191-0x0000000003BB0000-0x0000000003BEF000-memory.dmp family_redline behavioral1/memory/4216-192-0x0000000003BB0000-0x0000000003BEF000-memory.dmp family_redline behavioral1/memory/4216-194-0x0000000003BB0000-0x0000000003BEF000-memory.dmp family_redline behavioral1/memory/4216-196-0x0000000003BB0000-0x0000000003BEF000-memory.dmp family_redline behavioral1/memory/4216-198-0x0000000003BB0000-0x0000000003BEF000-memory.dmp family_redline behavioral1/memory/4216-200-0x0000000003BB0000-0x0000000003BEF000-memory.dmp family_redline behavioral1/memory/4216-204-0x0000000003BB0000-0x0000000003BEF000-memory.dmp family_redline behavioral1/memory/4216-207-0x0000000003BB0000-0x0000000003BEF000-memory.dmp family_redline behavioral1/memory/4216-210-0x0000000003BB0000-0x0000000003BEF000-memory.dmp family_redline behavioral1/memory/4216-212-0x0000000003BB0000-0x0000000003BEF000-memory.dmp family_redline behavioral1/memory/4216-214-0x0000000003BB0000-0x0000000003BEF000-memory.dmp family_redline behavioral1/memory/4216-216-0x0000000003BB0000-0x0000000003BEF000-memory.dmp family_redline behavioral1/memory/4216-218-0x0000000003BB0000-0x0000000003BEF000-memory.dmp family_redline behavioral1/memory/4216-220-0x0000000003BB0000-0x0000000003BEF000-memory.dmp family_redline behavioral1/memory/4216-222-0x0000000003BB0000-0x0000000003BEF000-memory.dmp family_redline behavioral1/memory/4216-224-0x0000000003BB0000-0x0000000003BEF000-memory.dmp family_redline behavioral1/memory/4216-226-0x0000000003BB0000-0x0000000003BEF000-memory.dmp family_redline behavioral1/memory/4216-228-0x0000000003BB0000-0x0000000003BEF000-memory.dmp family_redline behavioral1/memory/4216-1108-0x0000000006210000-0x0000000006220000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un933456.exepro3106.exequ7703.exesi017242.exepid process 4224 un933456.exe 2852 pro3106.exe 4216 qu7703.exe 3276 si017242.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro3106.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro3106.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro3106.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
f821dc96e90219fbb16afb3fe2f69f7069d7a6af4692a90c4d1e430a05997624.exeun933456.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce f821dc96e90219fbb16afb3fe2f69f7069d7a6af4692a90c4d1e430a05997624.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" f821dc96e90219fbb16afb3fe2f69f7069d7a6af4692a90c4d1e430a05997624.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un933456.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un933456.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4852 2852 WerFault.exe pro3106.exe 4944 4216 WerFault.exe qu7703.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro3106.exequ7703.exesi017242.exepid process 2852 pro3106.exe 2852 pro3106.exe 4216 qu7703.exe 4216 qu7703.exe 3276 si017242.exe 3276 si017242.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro3106.exequ7703.exesi017242.exedescription pid process Token: SeDebugPrivilege 2852 pro3106.exe Token: SeDebugPrivilege 4216 qu7703.exe Token: SeDebugPrivilege 3276 si017242.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
f821dc96e90219fbb16afb3fe2f69f7069d7a6af4692a90c4d1e430a05997624.exeun933456.exedescription pid process target process PID 1156 wrote to memory of 4224 1156 f821dc96e90219fbb16afb3fe2f69f7069d7a6af4692a90c4d1e430a05997624.exe un933456.exe PID 1156 wrote to memory of 4224 1156 f821dc96e90219fbb16afb3fe2f69f7069d7a6af4692a90c4d1e430a05997624.exe un933456.exe PID 1156 wrote to memory of 4224 1156 f821dc96e90219fbb16afb3fe2f69f7069d7a6af4692a90c4d1e430a05997624.exe un933456.exe PID 4224 wrote to memory of 2852 4224 un933456.exe pro3106.exe PID 4224 wrote to memory of 2852 4224 un933456.exe pro3106.exe PID 4224 wrote to memory of 2852 4224 un933456.exe pro3106.exe PID 4224 wrote to memory of 4216 4224 un933456.exe qu7703.exe PID 4224 wrote to memory of 4216 4224 un933456.exe qu7703.exe PID 4224 wrote to memory of 4216 4224 un933456.exe qu7703.exe PID 1156 wrote to memory of 3276 1156 f821dc96e90219fbb16afb3fe2f69f7069d7a6af4692a90c4d1e430a05997624.exe si017242.exe PID 1156 wrote to memory of 3276 1156 f821dc96e90219fbb16afb3fe2f69f7069d7a6af4692a90c4d1e430a05997624.exe si017242.exe PID 1156 wrote to memory of 3276 1156 f821dc96e90219fbb16afb3fe2f69f7069d7a6af4692a90c4d1e430a05997624.exe si017242.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f821dc96e90219fbb16afb3fe2f69f7069d7a6af4692a90c4d1e430a05997624.exe"C:\Users\Admin\AppData\Local\Temp\f821dc96e90219fbb16afb3fe2f69f7069d7a6af4692a90c4d1e430a05997624.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un933456.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un933456.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3106.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3106.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 10804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7703.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7703.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 13484⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si017242.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si017242.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2852 -ip 28521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4216 -ip 42161⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si017242.exeFilesize
175KB
MD5d56eacc5f71d775849ef3abb7814cb21
SHA173814a04d53c0d5a9e11a9c724f7957e7e3d9c88
SHA256616cd5b70d356fd3394550a25bb1deb2a9daa0cc118bdf2e04f6c96efaa3ed72
SHA51277ebb9fc3e6755cae226380a5b9b9463ce82a6d2aec60b316d66b75cb8a6e4011b594d6eef3cf3f0179073118ba624a83e7cc2f526d7fb897597d309d8dd2e52
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si017242.exeFilesize
175KB
MD5d56eacc5f71d775849ef3abb7814cb21
SHA173814a04d53c0d5a9e11a9c724f7957e7e3d9c88
SHA256616cd5b70d356fd3394550a25bb1deb2a9daa0cc118bdf2e04f6c96efaa3ed72
SHA51277ebb9fc3e6755cae226380a5b9b9463ce82a6d2aec60b316d66b75cb8a6e4011b594d6eef3cf3f0179073118ba624a83e7cc2f526d7fb897597d309d8dd2e52
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un933456.exeFilesize
530KB
MD5eb0a042e12db686443a90d65eef98a7d
SHA11ece4b1952339c3513fae47b1783ca4e588cea13
SHA256670e812bc0b7185b9322e889c0e1ad832fd1b0d5343ab5bd7f5441c1f5f95003
SHA512f3ec7ac5e8eb8541b5ff3500dcaaad37f5d66c1af699a226a1cb0c54f28404ee6b14f1163ec63dab2d7a95d24df325b91054f59a4fcdaee4274de9aa2a27d6b0
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un933456.exeFilesize
530KB
MD5eb0a042e12db686443a90d65eef98a7d
SHA11ece4b1952339c3513fae47b1783ca4e588cea13
SHA256670e812bc0b7185b9322e889c0e1ad832fd1b0d5343ab5bd7f5441c1f5f95003
SHA512f3ec7ac5e8eb8541b5ff3500dcaaad37f5d66c1af699a226a1cb0c54f28404ee6b14f1163ec63dab2d7a95d24df325b91054f59a4fcdaee4274de9aa2a27d6b0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3106.exeFilesize
301KB
MD5c81d14fde1e6fc6cab94d0e54fce29b8
SHA184fb5f310e9ef6dcede3b9f682505f78d35ce1d1
SHA2561013f89f1a9fa1f0ca3d7f850a142fea63dc68e095961d9eb1255991bc42f30a
SHA512e21c81748906beaf8b62caaa9757f7ed06631bb4af6f75b7e858778b2beb9627a7fb9d9d04179bf29f8294b198a415a909b1f497a955ba46620f90d01a75ee82
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3106.exeFilesize
301KB
MD5c81d14fde1e6fc6cab94d0e54fce29b8
SHA184fb5f310e9ef6dcede3b9f682505f78d35ce1d1
SHA2561013f89f1a9fa1f0ca3d7f850a142fea63dc68e095961d9eb1255991bc42f30a
SHA512e21c81748906beaf8b62caaa9757f7ed06631bb4af6f75b7e858778b2beb9627a7fb9d9d04179bf29f8294b198a415a909b1f497a955ba46620f90d01a75ee82
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7703.exeFilesize
359KB
MD5d399c9d5a3b5afa59e20ee4c17590b18
SHA11c520b7dd3385ac97d07c9c4ac3c0058f3c90167
SHA25687fcd5442dcda6d56f73a9b1b868742ab735f478065fcd40bad1128e3d0486d1
SHA5124f2e76cea4cc3d72f9958a1363e2614c6aaa592fe6f86750b971c08a5b9f9db68c6601b9a5a520d682eb58c096b16e98e4516abec10a0ec9ad6693f3f8a7f304
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7703.exeFilesize
359KB
MD5d399c9d5a3b5afa59e20ee4c17590b18
SHA11c520b7dd3385ac97d07c9c4ac3c0058f3c90167
SHA25687fcd5442dcda6d56f73a9b1b868742ab735f478065fcd40bad1128e3d0486d1
SHA5124f2e76cea4cc3d72f9958a1363e2614c6aaa592fe6f86750b971c08a5b9f9db68c6601b9a5a520d682eb58c096b16e98e4516abec10a0ec9ad6693f3f8a7f304
-
memory/2852-148-0x0000000001C50000-0x0000000001C7D000-memory.dmpFilesize
180KB
-
memory/2852-149-0x0000000006180000-0x0000000006190000-memory.dmpFilesize
64KB
-
memory/2852-150-0x0000000006180000-0x0000000006190000-memory.dmpFilesize
64KB
-
memory/2852-151-0x0000000006180000-0x0000000006190000-memory.dmpFilesize
64KB
-
memory/2852-152-0x0000000006190000-0x0000000006734000-memory.dmpFilesize
5.6MB
-
memory/2852-153-0x0000000006070000-0x0000000006082000-memory.dmpFilesize
72KB
-
memory/2852-154-0x0000000006070000-0x0000000006082000-memory.dmpFilesize
72KB
-
memory/2852-156-0x0000000006070000-0x0000000006082000-memory.dmpFilesize
72KB
-
memory/2852-158-0x0000000006070000-0x0000000006082000-memory.dmpFilesize
72KB
-
memory/2852-160-0x0000000006070000-0x0000000006082000-memory.dmpFilesize
72KB
-
memory/2852-162-0x0000000006070000-0x0000000006082000-memory.dmpFilesize
72KB
-
memory/2852-164-0x0000000006070000-0x0000000006082000-memory.dmpFilesize
72KB
-
memory/2852-166-0x0000000006070000-0x0000000006082000-memory.dmpFilesize
72KB
-
memory/2852-168-0x0000000006070000-0x0000000006082000-memory.dmpFilesize
72KB
-
memory/2852-172-0x0000000006070000-0x0000000006082000-memory.dmpFilesize
72KB
-
memory/2852-176-0x0000000006070000-0x0000000006082000-memory.dmpFilesize
72KB
-
memory/2852-180-0x0000000006070000-0x0000000006082000-memory.dmpFilesize
72KB
-
memory/2852-178-0x0000000006070000-0x0000000006082000-memory.dmpFilesize
72KB
-
memory/2852-174-0x0000000006070000-0x0000000006082000-memory.dmpFilesize
72KB
-
memory/2852-170-0x0000000006070000-0x0000000006082000-memory.dmpFilesize
72KB
-
memory/2852-181-0x0000000000400000-0x0000000001AE3000-memory.dmpFilesize
22.9MB
-
memory/2852-182-0x0000000006180000-0x0000000006190000-memory.dmpFilesize
64KB
-
memory/2852-183-0x0000000006180000-0x0000000006190000-memory.dmpFilesize
64KB
-
memory/2852-184-0x0000000006180000-0x0000000006190000-memory.dmpFilesize
64KB
-
memory/2852-186-0x0000000000400000-0x0000000001AE3000-memory.dmpFilesize
22.9MB
-
memory/3276-1123-0x0000000000C40000-0x0000000000C72000-memory.dmpFilesize
200KB
-
memory/3276-1125-0x00000000054D0000-0x00000000054E0000-memory.dmpFilesize
64KB
-
memory/3276-1124-0x00000000054D0000-0x00000000054E0000-memory.dmpFilesize
64KB
-
memory/4216-194-0x0000000003BB0000-0x0000000003BEF000-memory.dmpFilesize
252KB
-
memory/4216-228-0x0000000003BB0000-0x0000000003BEF000-memory.dmpFilesize
252KB
-
memory/4216-198-0x0000000003BB0000-0x0000000003BEF000-memory.dmpFilesize
252KB
-
memory/4216-200-0x0000000003BB0000-0x0000000003BEF000-memory.dmpFilesize
252KB
-
memory/4216-201-0x0000000001C60000-0x0000000001CAB000-memory.dmpFilesize
300KB
-
memory/4216-203-0x0000000006210000-0x0000000006220000-memory.dmpFilesize
64KB
-
memory/4216-204-0x0000000003BB0000-0x0000000003BEF000-memory.dmpFilesize
252KB
-
memory/4216-206-0x0000000006210000-0x0000000006220000-memory.dmpFilesize
64KB
-
memory/4216-208-0x0000000006210000-0x0000000006220000-memory.dmpFilesize
64KB
-
memory/4216-207-0x0000000003BB0000-0x0000000003BEF000-memory.dmpFilesize
252KB
-
memory/4216-210-0x0000000003BB0000-0x0000000003BEF000-memory.dmpFilesize
252KB
-
memory/4216-212-0x0000000003BB0000-0x0000000003BEF000-memory.dmpFilesize
252KB
-
memory/4216-214-0x0000000003BB0000-0x0000000003BEF000-memory.dmpFilesize
252KB
-
memory/4216-216-0x0000000003BB0000-0x0000000003BEF000-memory.dmpFilesize
252KB
-
memory/4216-218-0x0000000003BB0000-0x0000000003BEF000-memory.dmpFilesize
252KB
-
memory/4216-220-0x0000000003BB0000-0x0000000003BEF000-memory.dmpFilesize
252KB
-
memory/4216-222-0x0000000003BB0000-0x0000000003BEF000-memory.dmpFilesize
252KB
-
memory/4216-224-0x0000000003BB0000-0x0000000003BEF000-memory.dmpFilesize
252KB
-
memory/4216-226-0x0000000003BB0000-0x0000000003BEF000-memory.dmpFilesize
252KB
-
memory/4216-196-0x0000000003BB0000-0x0000000003BEF000-memory.dmpFilesize
252KB
-
memory/4216-1101-0x00000000067D0000-0x0000000006DE8000-memory.dmpFilesize
6.1MB
-
memory/4216-1102-0x0000000006DF0000-0x0000000006EFA000-memory.dmpFilesize
1.0MB
-
memory/4216-1103-0x00000000061F0000-0x0000000006202000-memory.dmpFilesize
72KB
-
memory/4216-1104-0x0000000006210000-0x0000000006220000-memory.dmpFilesize
64KB
-
memory/4216-1105-0x0000000006F00000-0x0000000006F3C000-memory.dmpFilesize
240KB
-
memory/4216-1107-0x0000000006210000-0x0000000006220000-memory.dmpFilesize
64KB
-
memory/4216-1108-0x0000000006210000-0x0000000006220000-memory.dmpFilesize
64KB
-
memory/4216-1109-0x0000000006210000-0x0000000006220000-memory.dmpFilesize
64KB
-
memory/4216-1110-0x00000000071F0000-0x0000000007282000-memory.dmpFilesize
584KB
-
memory/4216-1111-0x0000000007290000-0x00000000072F6000-memory.dmpFilesize
408KB
-
memory/4216-1112-0x0000000007BF0000-0x0000000007DB2000-memory.dmpFilesize
1.8MB
-
memory/4216-1113-0x0000000007DD0000-0x00000000082FC000-memory.dmpFilesize
5.2MB
-
memory/4216-192-0x0000000003BB0000-0x0000000003BEF000-memory.dmpFilesize
252KB
-
memory/4216-191-0x0000000003BB0000-0x0000000003BEF000-memory.dmpFilesize
252KB
-
memory/4216-1114-0x0000000008430000-0x00000000084A6000-memory.dmpFilesize
472KB
-
memory/4216-1115-0x00000000084C0000-0x0000000008510000-memory.dmpFilesize
320KB
-
memory/4216-1116-0x0000000006210000-0x0000000006220000-memory.dmpFilesize
64KB