Analysis
-
max time kernel
111s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 21:01
Static task
static1
Behavioral task
behavioral1
Sample
068242821b22a66a123b067aa5d588f2875329d2d7c4d15f56a9d0dffd1a0711.exe
Resource
win10v2004-20230220-en
General
-
Target
068242821b22a66a123b067aa5d588f2875329d2d7c4d15f56a9d0dffd1a0711.exe
-
Size
671KB
-
MD5
a75be4620f57692f422beacc17d5fd33
-
SHA1
cfbff2f91ccb078db34b77b911317df44bcb69d6
-
SHA256
068242821b22a66a123b067aa5d588f2875329d2d7c4d15f56a9d0dffd1a0711
-
SHA512
243a154228f491f12d81ab97a3e988987bd9b688b9e351004d07b95cf39c623e17eae024b2f522fd5bc0c9acaa45cb93fcc23cf393e5b078205afdd52eb4caac
-
SSDEEP
12288:WMrOy90A2yvfyELpmgws87ukZ3EO0fgw7Uj204FX3LqsY+b+uWf3d:8yzfvfyEnL873FEO0fES0kX3Gs1b+uat
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro1044.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro1044.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro1044.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro1044.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro1044.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro1044.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro1044.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/1184-196-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/1184-197-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/1184-199-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/1184-201-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/1184-203-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/1184-205-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/1184-207-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/1184-209-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/1184-211-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/1184-213-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/1184-215-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/1184-217-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/1184-219-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/1184-221-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/1184-223-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/1184-225-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/1184-227-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline behavioral1/memory/1184-229-0x0000000003C50000-0x0000000003C8F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un078619.exepro1044.exequ1288.exesi769613.exepid process 3584 un078619.exe 5084 pro1044.exe 1184 qu1288.exe 3872 si769613.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro1044.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro1044.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro1044.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
068242821b22a66a123b067aa5d588f2875329d2d7c4d15f56a9d0dffd1a0711.exeun078619.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 068242821b22a66a123b067aa5d588f2875329d2d7c4d15f56a9d0dffd1a0711.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un078619.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un078619.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 068242821b22a66a123b067aa5d588f2875329d2d7c4d15f56a9d0dffd1a0711.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4664 5084 WerFault.exe pro1044.exe 3520 1184 WerFault.exe qu1288.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro1044.exequ1288.exesi769613.exepid process 5084 pro1044.exe 5084 pro1044.exe 1184 qu1288.exe 1184 qu1288.exe 3872 si769613.exe 3872 si769613.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro1044.exequ1288.exesi769613.exedescription pid process Token: SeDebugPrivilege 5084 pro1044.exe Token: SeDebugPrivilege 1184 qu1288.exe Token: SeDebugPrivilege 3872 si769613.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
068242821b22a66a123b067aa5d588f2875329d2d7c4d15f56a9d0dffd1a0711.exeun078619.exedescription pid process target process PID 4624 wrote to memory of 3584 4624 068242821b22a66a123b067aa5d588f2875329d2d7c4d15f56a9d0dffd1a0711.exe un078619.exe PID 4624 wrote to memory of 3584 4624 068242821b22a66a123b067aa5d588f2875329d2d7c4d15f56a9d0dffd1a0711.exe un078619.exe PID 4624 wrote to memory of 3584 4624 068242821b22a66a123b067aa5d588f2875329d2d7c4d15f56a9d0dffd1a0711.exe un078619.exe PID 3584 wrote to memory of 5084 3584 un078619.exe pro1044.exe PID 3584 wrote to memory of 5084 3584 un078619.exe pro1044.exe PID 3584 wrote to memory of 5084 3584 un078619.exe pro1044.exe PID 3584 wrote to memory of 1184 3584 un078619.exe qu1288.exe PID 3584 wrote to memory of 1184 3584 un078619.exe qu1288.exe PID 3584 wrote to memory of 1184 3584 un078619.exe qu1288.exe PID 4624 wrote to memory of 3872 4624 068242821b22a66a123b067aa5d588f2875329d2d7c4d15f56a9d0dffd1a0711.exe si769613.exe PID 4624 wrote to memory of 3872 4624 068242821b22a66a123b067aa5d588f2875329d2d7c4d15f56a9d0dffd1a0711.exe si769613.exe PID 4624 wrote to memory of 3872 4624 068242821b22a66a123b067aa5d588f2875329d2d7c4d15f56a9d0dffd1a0711.exe si769613.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\068242821b22a66a123b067aa5d588f2875329d2d7c4d15f56a9d0dffd1a0711.exe"C:\Users\Admin\AppData\Local\Temp\068242821b22a66a123b067aa5d588f2875329d2d7c4d15f56a9d0dffd1a0711.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un078619.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un078619.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1044.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1044.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 2364⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1288.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1288.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1184 -s 15364⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si769613.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si769613.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5084 -ip 50841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1184 -ip 11841⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si769613.exeFilesize
175KB
MD56644de9f3d56bf950e8fc4a4c655621d
SHA17b0f7baa96d0291c177177887668d528e9753005
SHA256ce671d1767064366974c2e4eb6a6fc4c24c95485357e44e8433d16ff1439aa9b
SHA512a52f88898730dcdc90979fbadf01228633d1b6047e0fad0b477696d389e7b7cb0e915f87e0415b42e1529c3fae67271723f05b8c8909bdb40785625a509599f5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si769613.exeFilesize
175KB
MD56644de9f3d56bf950e8fc4a4c655621d
SHA17b0f7baa96d0291c177177887668d528e9753005
SHA256ce671d1767064366974c2e4eb6a6fc4c24c95485357e44e8433d16ff1439aa9b
SHA512a52f88898730dcdc90979fbadf01228633d1b6047e0fad0b477696d389e7b7cb0e915f87e0415b42e1529c3fae67271723f05b8c8909bdb40785625a509599f5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un078619.exeFilesize
529KB
MD510526ebf3c1a22efcaac9bd1eb29cda9
SHA13aec437dc795fa59c8e2bb87594ddb4c71845cd0
SHA256d1ae88771d8d84df90083384253db3d1144fdd28c51a0bbd0fc62d1695ef79c7
SHA5129546c174e18d40dd75f0b51013ac3e05fe16ef1d08d0343178edf4eec946c04a9964dd7ccc73dafd258bbdc243055ce18cb037a7dc2c196db5e4c83cbd2b61f1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un078619.exeFilesize
529KB
MD510526ebf3c1a22efcaac9bd1eb29cda9
SHA13aec437dc795fa59c8e2bb87594ddb4c71845cd0
SHA256d1ae88771d8d84df90083384253db3d1144fdd28c51a0bbd0fc62d1695ef79c7
SHA5129546c174e18d40dd75f0b51013ac3e05fe16ef1d08d0343178edf4eec946c04a9964dd7ccc73dafd258bbdc243055ce18cb037a7dc2c196db5e4c83cbd2b61f1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1044.exeFilesize
301KB
MD53746718b3c6a06fe38239e37ccec1e11
SHA1b845bd2e43e17d1f7b43233d807f725410438161
SHA256fa60d5e327685f9e1d972c5b4e0ca4c331b083ea8145c2ed32300b2f58704ffd
SHA5127baa23b4442e041fd6fafcdfb2d3904e7378e6fb9b8d2fc6774b427a1eadf6d2c5a6595b444ef37254be6421b7801bd5dd89e3e48d0e3680446fb0ba630f5403
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1044.exeFilesize
301KB
MD53746718b3c6a06fe38239e37ccec1e11
SHA1b845bd2e43e17d1f7b43233d807f725410438161
SHA256fa60d5e327685f9e1d972c5b4e0ca4c331b083ea8145c2ed32300b2f58704ffd
SHA5127baa23b4442e041fd6fafcdfb2d3904e7378e6fb9b8d2fc6774b427a1eadf6d2c5a6595b444ef37254be6421b7801bd5dd89e3e48d0e3680446fb0ba630f5403
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1288.exeFilesize
359KB
MD5c4c9a3956c40b035c78a1170e3a30c95
SHA1e282aa45a492c9332d3edbb21f71c30e3c56c637
SHA2568fd6b8cf447c8077d0d67deeb67b37da1d154fda6e7563207a3fe33c91eaed85
SHA512b363e72f2fbe621e5a7ef93b2b901a80a29de79356abd46f07a8fc7701e02454f2aefb9b1c2791f175e8f526b16bb1603b07a6a5ee24b4a1f2783543d7e9c841
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1288.exeFilesize
359KB
MD5c4c9a3956c40b035c78a1170e3a30c95
SHA1e282aa45a492c9332d3edbb21f71c30e3c56c637
SHA2568fd6b8cf447c8077d0d67deeb67b37da1d154fda6e7563207a3fe33c91eaed85
SHA512b363e72f2fbe621e5a7ef93b2b901a80a29de79356abd46f07a8fc7701e02454f2aefb9b1c2791f175e8f526b16bb1603b07a6a5ee24b4a1f2783543d7e9c841
-
memory/1184-1102-0x00000000068C0000-0x0000000006ED8000-memory.dmpFilesize
6.1MB
-
memory/1184-1103-0x0000000006EE0000-0x0000000006FEA000-memory.dmpFilesize
1.0MB
-
memory/1184-215-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/1184-213-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/1184-211-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/1184-203-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/1184-1116-0x0000000003CF0000-0x0000000003D00000-memory.dmpFilesize
64KB
-
memory/1184-1115-0x00000000083C0000-0x0000000008410000-memory.dmpFilesize
320KB
-
memory/1184-1114-0x0000000008330000-0x00000000083A6000-memory.dmpFilesize
472KB
-
memory/1184-1113-0x0000000003CF0000-0x0000000003D00000-memory.dmpFilesize
64KB
-
memory/1184-1112-0x0000000003CF0000-0x0000000003D00000-memory.dmpFilesize
64KB
-
memory/1184-1111-0x0000000007CD0000-0x00000000081FC000-memory.dmpFilesize
5.2MB
-
memory/1184-1110-0x0000000007AF0000-0x0000000007CB2000-memory.dmpFilesize
1.8MB
-
memory/1184-205-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/1184-1109-0x00000000073D0000-0x0000000007436000-memory.dmpFilesize
408KB
-
memory/1184-1108-0x0000000007330000-0x00000000073C2000-memory.dmpFilesize
584KB
-
memory/1184-1106-0x0000000007040000-0x000000000707C000-memory.dmpFilesize
240KB
-
memory/1184-1105-0x0000000003CF0000-0x0000000003D00000-memory.dmpFilesize
64KB
-
memory/1184-1104-0x0000000007020000-0x0000000007032000-memory.dmpFilesize
72KB
-
memory/1184-217-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/1184-229-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/1184-227-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/1184-225-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/1184-223-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/1184-192-0x0000000001DC0000-0x0000000001E0B000-memory.dmpFilesize
300KB
-
memory/1184-207-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/1184-194-0x0000000003CF0000-0x0000000003D00000-memory.dmpFilesize
64KB
-
memory/1184-195-0x0000000003CF0000-0x0000000003D00000-memory.dmpFilesize
64KB
-
memory/1184-196-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/1184-197-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/1184-199-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/1184-201-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/1184-221-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/1184-219-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/1184-193-0x0000000003CF0000-0x0000000003D00000-memory.dmpFilesize
64KB
-
memory/1184-209-0x0000000003C50000-0x0000000003C8F000-memory.dmpFilesize
252KB
-
memory/3872-1122-0x0000000000380000-0x00000000003B2000-memory.dmpFilesize
200KB
-
memory/3872-1123-0x0000000004F70000-0x0000000004F80000-memory.dmpFilesize
64KB
-
memory/3872-1124-0x0000000004F70000-0x0000000004F80000-memory.dmpFilesize
64KB
-
memory/5084-182-0x0000000001D60000-0x0000000001D8D000-memory.dmpFilesize
180KB
-
memory/5084-176-0x0000000003B00000-0x0000000003B12000-memory.dmpFilesize
72KB
-
memory/5084-160-0x0000000003B00000-0x0000000003B12000-memory.dmpFilesize
72KB
-
memory/5084-151-0x00000000038E0000-0x00000000038F0000-memory.dmpFilesize
64KB
-
memory/5084-152-0x00000000038E0000-0x00000000038F0000-memory.dmpFilesize
64KB
-
memory/5084-187-0x0000000000400000-0x0000000001AE3000-memory.dmpFilesize
22.9MB
-
memory/5084-185-0x00000000038E0000-0x00000000038F0000-memory.dmpFilesize
64KB
-
memory/5084-150-0x00000000038E0000-0x00000000038F0000-memory.dmpFilesize
64KB
-
memory/5084-184-0x00000000038E0000-0x00000000038F0000-memory.dmpFilesize
64KB
-
memory/5084-183-0x00000000038E0000-0x00000000038F0000-memory.dmpFilesize
64KB
-
memory/5084-153-0x0000000003B00000-0x0000000003B12000-memory.dmpFilesize
72KB
-
memory/5084-181-0x0000000000400000-0x0000000001AE3000-memory.dmpFilesize
22.9MB
-
memory/5084-180-0x0000000003B00000-0x0000000003B12000-memory.dmpFilesize
72KB
-
memory/5084-178-0x0000000003B00000-0x0000000003B12000-memory.dmpFilesize
72KB
-
memory/5084-174-0x0000000003B00000-0x0000000003B12000-memory.dmpFilesize
72KB
-
memory/5084-172-0x0000000003B00000-0x0000000003B12000-memory.dmpFilesize
72KB
-
memory/5084-170-0x0000000003B00000-0x0000000003B12000-memory.dmpFilesize
72KB
-
memory/5084-168-0x0000000003B00000-0x0000000003B12000-memory.dmpFilesize
72KB
-
memory/5084-166-0x0000000003B00000-0x0000000003B12000-memory.dmpFilesize
72KB
-
memory/5084-164-0x0000000003B00000-0x0000000003B12000-memory.dmpFilesize
72KB
-
memory/5084-162-0x0000000003B00000-0x0000000003B12000-memory.dmpFilesize
72KB
-
memory/5084-149-0x0000000006140000-0x00000000066E4000-memory.dmpFilesize
5.6MB
-
memory/5084-148-0x0000000001D60000-0x0000000001D8D000-memory.dmpFilesize
180KB
-
memory/5084-158-0x0000000003B00000-0x0000000003B12000-memory.dmpFilesize
72KB
-
memory/5084-156-0x0000000003B00000-0x0000000003B12000-memory.dmpFilesize
72KB
-
memory/5084-154-0x0000000003B00000-0x0000000003B12000-memory.dmpFilesize
72KB