Analysis
-
max time kernel
135s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 20:59
Static task
static1
Behavioral task
behavioral1
Sample
f1f48317f62c28cd18d7b234c2c66f845d6924a4f9f57c4752afb87f5544476d.exe
Resource
win10v2004-20230220-en
General
-
Target
f1f48317f62c28cd18d7b234c2c66f845d6924a4f9f57c4752afb87f5544476d.exe
-
Size
533KB
-
MD5
3635a0aab12ae245c23e35810435c62a
-
SHA1
cdcaae9b97c538980b9482bd5237a34ecd5752d8
-
SHA256
f1f48317f62c28cd18d7b234c2c66f845d6924a4f9f57c4752afb87f5544476d
-
SHA512
dadc54285671e388fc58ec1451dda63ccd39454669847d33a21101c67faf91d3b1758a4e0a3480e131c3e65ebe4cbcf09ecf8e9800af194976ec420a56542026
-
SSDEEP
12288:iMrty907+McQudCpXhPYEL3LqjnLBVzZYeZQPj:zyo1hudCpXhQEL3GjnLBT3e
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr538602.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr538602.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr538602.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr538602.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr538602.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr538602.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr538602.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/2920-158-0x0000000003A70000-0x0000000003AAF000-memory.dmp family_redline behavioral1/memory/2920-159-0x0000000003A70000-0x0000000003AAF000-memory.dmp family_redline behavioral1/memory/2920-161-0x0000000003A70000-0x0000000003AAF000-memory.dmp family_redline behavioral1/memory/2920-163-0x0000000003A70000-0x0000000003AAF000-memory.dmp family_redline behavioral1/memory/2920-167-0x0000000003A70000-0x0000000003AAF000-memory.dmp family_redline behavioral1/memory/2920-165-0x0000000003A70000-0x0000000003AAF000-memory.dmp family_redline behavioral1/memory/2920-177-0x0000000003A70000-0x0000000003AAF000-memory.dmp family_redline behavioral1/memory/2920-175-0x0000000003A70000-0x0000000003AAF000-memory.dmp family_redline behavioral1/memory/2920-179-0x0000000003A70000-0x0000000003AAF000-memory.dmp family_redline behavioral1/memory/2920-173-0x0000000003A70000-0x0000000003AAF000-memory.dmp family_redline behavioral1/memory/2920-171-0x0000000003A70000-0x0000000003AAF000-memory.dmp family_redline behavioral1/memory/2920-169-0x0000000003A70000-0x0000000003AAF000-memory.dmp family_redline behavioral1/memory/2920-181-0x0000000003A70000-0x0000000003AAF000-memory.dmp family_redline behavioral1/memory/2920-183-0x0000000003A70000-0x0000000003AAF000-memory.dmp family_redline behavioral1/memory/2920-187-0x0000000003A70000-0x0000000003AAF000-memory.dmp family_redline behavioral1/memory/2920-185-0x0000000003A70000-0x0000000003AAF000-memory.dmp family_redline behavioral1/memory/2920-189-0x0000000003A70000-0x0000000003AAF000-memory.dmp family_redline behavioral1/memory/2920-191-0x0000000003A70000-0x0000000003AAF000-memory.dmp family_redline behavioral1/memory/2920-193-0x0000000003A70000-0x0000000003AAF000-memory.dmp family_redline behavioral1/memory/2920-195-0x0000000003A70000-0x0000000003AAF000-memory.dmp family_redline behavioral1/memory/2920-197-0x0000000003A70000-0x0000000003AAF000-memory.dmp family_redline behavioral1/memory/2920-201-0x0000000003A70000-0x0000000003AAF000-memory.dmp family_redline behavioral1/memory/2920-203-0x0000000003A70000-0x0000000003AAF000-memory.dmp family_redline behavioral1/memory/2920-205-0x0000000003A70000-0x0000000003AAF000-memory.dmp family_redline behavioral1/memory/2920-199-0x0000000003A70000-0x0000000003AAF000-memory.dmp family_redline behavioral1/memory/2920-217-0x0000000003A70000-0x0000000003AAF000-memory.dmp family_redline behavioral1/memory/2920-215-0x0000000003A70000-0x0000000003AAF000-memory.dmp family_redline behavioral1/memory/2920-221-0x0000000003A70000-0x0000000003AAF000-memory.dmp family_redline behavioral1/memory/2920-219-0x0000000003A70000-0x0000000003AAF000-memory.dmp family_redline behavioral1/memory/2920-213-0x0000000003A70000-0x0000000003AAF000-memory.dmp family_redline behavioral1/memory/2920-211-0x0000000003A70000-0x0000000003AAF000-memory.dmp family_redline behavioral1/memory/2920-209-0x0000000003A70000-0x0000000003AAF000-memory.dmp family_redline behavioral1/memory/2920-207-0x0000000003A70000-0x0000000003AAF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
zirY4358.exejr538602.exeku933014.exelr219259.exepid process 5044 zirY4358.exe 2096 jr538602.exe 2920 ku933014.exe 760 lr219259.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr538602.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr538602.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
f1f48317f62c28cd18d7b234c2c66f845d6924a4f9f57c4752afb87f5544476d.exezirY4358.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce f1f48317f62c28cd18d7b234c2c66f845d6924a4f9f57c4752afb87f5544476d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" f1f48317f62c28cd18d7b234c2c66f845d6924a4f9f57c4752afb87f5544476d.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zirY4358.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zirY4358.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 4676 sc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4852 2920 WerFault.exe ku933014.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr538602.exeku933014.exelr219259.exepid process 2096 jr538602.exe 2096 jr538602.exe 2920 ku933014.exe 2920 ku933014.exe 760 lr219259.exe 760 lr219259.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr538602.exeku933014.exelr219259.exedescription pid process Token: SeDebugPrivilege 2096 jr538602.exe Token: SeDebugPrivilege 2920 ku933014.exe Token: SeDebugPrivilege 760 lr219259.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
f1f48317f62c28cd18d7b234c2c66f845d6924a4f9f57c4752afb87f5544476d.exezirY4358.exedescription pid process target process PID 2156 wrote to memory of 5044 2156 f1f48317f62c28cd18d7b234c2c66f845d6924a4f9f57c4752afb87f5544476d.exe zirY4358.exe PID 2156 wrote to memory of 5044 2156 f1f48317f62c28cd18d7b234c2c66f845d6924a4f9f57c4752afb87f5544476d.exe zirY4358.exe PID 2156 wrote to memory of 5044 2156 f1f48317f62c28cd18d7b234c2c66f845d6924a4f9f57c4752afb87f5544476d.exe zirY4358.exe PID 5044 wrote to memory of 2096 5044 zirY4358.exe jr538602.exe PID 5044 wrote to memory of 2096 5044 zirY4358.exe jr538602.exe PID 5044 wrote to memory of 2920 5044 zirY4358.exe ku933014.exe PID 5044 wrote to memory of 2920 5044 zirY4358.exe ku933014.exe PID 5044 wrote to memory of 2920 5044 zirY4358.exe ku933014.exe PID 2156 wrote to memory of 760 2156 f1f48317f62c28cd18d7b234c2c66f845d6924a4f9f57c4752afb87f5544476d.exe lr219259.exe PID 2156 wrote to memory of 760 2156 f1f48317f62c28cd18d7b234c2c66f845d6924a4f9f57c4752afb87f5544476d.exe lr219259.exe PID 2156 wrote to memory of 760 2156 f1f48317f62c28cd18d7b234c2c66f845d6924a4f9f57c4752afb87f5544476d.exe lr219259.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1f48317f62c28cd18d7b234c2c66f845d6924a4f9f57c4752afb87f5544476d.exe"C:\Users\Admin\AppData\Local\Temp\f1f48317f62c28cd18d7b234c2c66f845d6924a4f9f57c4752afb87f5544476d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zirY4358.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zirY4358.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr538602.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr538602.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku933014.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku933014.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 18524⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr219259.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr219259.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2920 -ip 29201⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr219259.exeFilesize
175KB
MD57834607842bcadfa13682a8968d13980
SHA16aea8e6c2910fe343812f3d27d926952729133f4
SHA256821d48a97ca5bb72ec63a9eaf976501fa17a088cbf713eb0b61f1e7e7a44effc
SHA51255498039e8a10d76823285a91c23f7625d140e7e32441549936d9fbcfa93bde4140141c08ff533f3eab0d698c5064fde2d95e216377a4f45b6f432865909c58b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr219259.exeFilesize
175KB
MD57834607842bcadfa13682a8968d13980
SHA16aea8e6c2910fe343812f3d27d926952729133f4
SHA256821d48a97ca5bb72ec63a9eaf976501fa17a088cbf713eb0b61f1e7e7a44effc
SHA51255498039e8a10d76823285a91c23f7625d140e7e32441549936d9fbcfa93bde4140141c08ff533f3eab0d698c5064fde2d95e216377a4f45b6f432865909c58b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zirY4358.exeFilesize
391KB
MD59ac967d85b4c1b3199bf0bf563b63db0
SHA12fdda1f2196e701850d1a9247bbdea700165cafe
SHA25621312a40e4f57dec82e8ec93f142009bced3f9cc332ad44f0ed647b39ea51bda
SHA51215721a2266370c4e40e308b351bc3db5611364c4a118859006c52a8b7ad54eb97faeee6aaa26f0e16ea28e65a9d5e1211391c07578ff3f772f12a2866f75d111
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zirY4358.exeFilesize
391KB
MD59ac967d85b4c1b3199bf0bf563b63db0
SHA12fdda1f2196e701850d1a9247bbdea700165cafe
SHA25621312a40e4f57dec82e8ec93f142009bced3f9cc332ad44f0ed647b39ea51bda
SHA51215721a2266370c4e40e308b351bc3db5611364c4a118859006c52a8b7ad54eb97faeee6aaa26f0e16ea28e65a9d5e1211391c07578ff3f772f12a2866f75d111
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr538602.exeFilesize
11KB
MD5dd11ddde5afc0d8d231a6aaa19573143
SHA15911fe8964008d341862475b11a4772dfbe7d86b
SHA256dff51c523f7cc99bfdd0736996c9b7d8fba6537a38a543b4d4c95713ce96a873
SHA5121b2577a7d0836c506a44bc546b06da590a142ea8042b7366cfc8c3f38233ab1d7d9fb9343e607a53ea8b676251bf6488eddfbdcc51f40b8521938b74e1c6cb21
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr538602.exeFilesize
11KB
MD5dd11ddde5afc0d8d231a6aaa19573143
SHA15911fe8964008d341862475b11a4772dfbe7d86b
SHA256dff51c523f7cc99bfdd0736996c9b7d8fba6537a38a543b4d4c95713ce96a873
SHA5121b2577a7d0836c506a44bc546b06da590a142ea8042b7366cfc8c3f38233ab1d7d9fb9343e607a53ea8b676251bf6488eddfbdcc51f40b8521938b74e1c6cb21
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku933014.exeFilesize
359KB
MD5882df7d749715a4ca7005e893fb9ca13
SHA16f53569cbcc8e9825c638903c1deb96a378a515c
SHA256e1ae6b96505ad4b1036518f8f11a552431e32a5f0aa8b4d720755268a5697eaf
SHA51249de864c79bea755bacdf8d6b05461a83348e42118ae370a70a42789b73e2a03f860d6acd9ffe4a6416201b5c5c155c0cf08b52ab3e4769b15c42a7437d16375
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku933014.exeFilesize
359KB
MD5882df7d749715a4ca7005e893fb9ca13
SHA16f53569cbcc8e9825c638903c1deb96a378a515c
SHA256e1ae6b96505ad4b1036518f8f11a552431e32a5f0aa8b4d720755268a5697eaf
SHA51249de864c79bea755bacdf8d6b05461a83348e42118ae370a70a42789b73e2a03f860d6acd9ffe4a6416201b5c5c155c0cf08b52ab3e4769b15c42a7437d16375
-
memory/760-1085-0x0000000000390000-0x00000000003C2000-memory.dmpFilesize
200KB
-
memory/760-1086-0x0000000004F20000-0x0000000004F30000-memory.dmpFilesize
64KB
-
memory/2096-147-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2920-191-0x0000000003A70000-0x0000000003AAF000-memory.dmpFilesize
252KB
-
memory/2920-205-0x0000000003A70000-0x0000000003AAF000-memory.dmpFilesize
252KB
-
memory/2920-155-0x00000000039E0000-0x00000000039F0000-memory.dmpFilesize
64KB
-
memory/2920-157-0x00000000039E0000-0x00000000039F0000-memory.dmpFilesize
64KB
-
memory/2920-158-0x0000000003A70000-0x0000000003AAF000-memory.dmpFilesize
252KB
-
memory/2920-159-0x0000000003A70000-0x0000000003AAF000-memory.dmpFilesize
252KB
-
memory/2920-161-0x0000000003A70000-0x0000000003AAF000-memory.dmpFilesize
252KB
-
memory/2920-163-0x0000000003A70000-0x0000000003AAF000-memory.dmpFilesize
252KB
-
memory/2920-167-0x0000000003A70000-0x0000000003AAF000-memory.dmpFilesize
252KB
-
memory/2920-165-0x0000000003A70000-0x0000000003AAF000-memory.dmpFilesize
252KB
-
memory/2920-177-0x0000000003A70000-0x0000000003AAF000-memory.dmpFilesize
252KB
-
memory/2920-175-0x0000000003A70000-0x0000000003AAF000-memory.dmpFilesize
252KB
-
memory/2920-179-0x0000000003A70000-0x0000000003AAF000-memory.dmpFilesize
252KB
-
memory/2920-173-0x0000000003A70000-0x0000000003AAF000-memory.dmpFilesize
252KB
-
memory/2920-171-0x0000000003A70000-0x0000000003AAF000-memory.dmpFilesize
252KB
-
memory/2920-169-0x0000000003A70000-0x0000000003AAF000-memory.dmpFilesize
252KB
-
memory/2920-181-0x0000000003A70000-0x0000000003AAF000-memory.dmpFilesize
252KB
-
memory/2920-183-0x0000000003A70000-0x0000000003AAF000-memory.dmpFilesize
252KB
-
memory/2920-187-0x0000000003A70000-0x0000000003AAF000-memory.dmpFilesize
252KB
-
memory/2920-185-0x0000000003A70000-0x0000000003AAF000-memory.dmpFilesize
252KB
-
memory/2920-189-0x0000000003A70000-0x0000000003AAF000-memory.dmpFilesize
252KB
-
memory/2920-154-0x0000000003750000-0x000000000379B000-memory.dmpFilesize
300KB
-
memory/2920-193-0x0000000003A70000-0x0000000003AAF000-memory.dmpFilesize
252KB
-
memory/2920-195-0x0000000003A70000-0x0000000003AAF000-memory.dmpFilesize
252KB
-
memory/2920-197-0x0000000003A70000-0x0000000003AAF000-memory.dmpFilesize
252KB
-
memory/2920-201-0x0000000003A70000-0x0000000003AAF000-memory.dmpFilesize
252KB
-
memory/2920-203-0x0000000003A70000-0x0000000003AAF000-memory.dmpFilesize
252KB
-
memory/2920-156-0x00000000039E0000-0x00000000039F0000-memory.dmpFilesize
64KB
-
memory/2920-199-0x0000000003A70000-0x0000000003AAF000-memory.dmpFilesize
252KB
-
memory/2920-217-0x0000000003A70000-0x0000000003AAF000-memory.dmpFilesize
252KB
-
memory/2920-215-0x0000000003A70000-0x0000000003AAF000-memory.dmpFilesize
252KB
-
memory/2920-221-0x0000000003A70000-0x0000000003AAF000-memory.dmpFilesize
252KB
-
memory/2920-219-0x0000000003A70000-0x0000000003AAF000-memory.dmpFilesize
252KB
-
memory/2920-213-0x0000000003A70000-0x0000000003AAF000-memory.dmpFilesize
252KB
-
memory/2920-211-0x0000000003A70000-0x0000000003AAF000-memory.dmpFilesize
252KB
-
memory/2920-209-0x0000000003A70000-0x0000000003AAF000-memory.dmpFilesize
252KB
-
memory/2920-207-0x0000000003A70000-0x0000000003AAF000-memory.dmpFilesize
252KB
-
memory/2920-1064-0x0000000006950000-0x0000000006F68000-memory.dmpFilesize
6.1MB
-
memory/2920-1065-0x0000000006F70000-0x000000000707A000-memory.dmpFilesize
1.0MB
-
memory/2920-1066-0x0000000003EF0000-0x0000000003F02000-memory.dmpFilesize
72KB
-
memory/2920-1068-0x0000000007080000-0x00000000070BC000-memory.dmpFilesize
240KB
-
memory/2920-1067-0x00000000039E0000-0x00000000039F0000-memory.dmpFilesize
64KB
-
memory/2920-1070-0x00000000039E0000-0x00000000039F0000-memory.dmpFilesize
64KB
-
memory/2920-1071-0x00000000039E0000-0x00000000039F0000-memory.dmpFilesize
64KB
-
memory/2920-1072-0x00000000039E0000-0x00000000039F0000-memory.dmpFilesize
64KB
-
memory/2920-1073-0x0000000007330000-0x0000000007396000-memory.dmpFilesize
408KB
-
memory/2920-1074-0x0000000007A00000-0x0000000007A92000-memory.dmpFilesize
584KB
-
memory/2920-1075-0x0000000007D30000-0x0000000007EF2000-memory.dmpFilesize
1.8MB
-
memory/2920-1076-0x0000000007F10000-0x000000000843C000-memory.dmpFilesize
5.2MB
-
memory/2920-153-0x00000000062A0000-0x0000000006844000-memory.dmpFilesize
5.6MB
-
memory/2920-1077-0x00000000039E0000-0x00000000039F0000-memory.dmpFilesize
64KB
-
memory/2920-1078-0x00000000086B0000-0x0000000008726000-memory.dmpFilesize
472KB
-
memory/2920-1079-0x0000000008740000-0x0000000008790000-memory.dmpFilesize
320KB