Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
02-04-2023 20:30
Static task
static1
Behavioral task
behavioral1
Sample
0f39f327cf9f21bbd00405ab8ab7373a84598defd710baa90abf95016a9d1864.exe
Resource
win10-20230220-en
General
-
Target
0f39f327cf9f21bbd00405ab8ab7373a84598defd710baa90abf95016a9d1864.exe
-
Size
536KB
-
MD5
8c06d071c1bf1ba68c50dd48aff71c32
-
SHA1
098dad468b0ceb6b5d2f3599602103566b3a5a1a
-
SHA256
0f39f327cf9f21bbd00405ab8ab7373a84598defd710baa90abf95016a9d1864
-
SHA512
7ae223aa158f0a916dc2c6b5e62ad82b74144037fb086535d74d3110cf465654dd8be7d1ad57fa94e516da41b5a336edb7c4245b23039ceea7312138c3d1515d
-
SSDEEP
12288:rMrWy90GLTmU0w0ZnOrbcOwhpaurbfsNUzDyHlLPbQIqSzLcgZ:hyfUw0ZnOrbclhMUENUSlLbQIjb
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr653871.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr653871.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr653871.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr653871.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr653871.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr653871.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
Processes:
resource yara_rule behavioral1/memory/5104-140-0x00000000027F0000-0x0000000002836000-memory.dmp family_redline behavioral1/memory/5104-143-0x00000000052D0000-0x0000000005314000-memory.dmp family_redline behavioral1/memory/5104-147-0x00000000052D0000-0x000000000530F000-memory.dmp family_redline behavioral1/memory/5104-148-0x00000000052D0000-0x000000000530F000-memory.dmp family_redline behavioral1/memory/5104-150-0x00000000052D0000-0x000000000530F000-memory.dmp family_redline behavioral1/memory/5104-152-0x00000000052D0000-0x000000000530F000-memory.dmp family_redline behavioral1/memory/5104-154-0x00000000052D0000-0x000000000530F000-memory.dmp family_redline behavioral1/memory/5104-156-0x00000000052D0000-0x000000000530F000-memory.dmp family_redline behavioral1/memory/5104-158-0x00000000052D0000-0x000000000530F000-memory.dmp family_redline behavioral1/memory/5104-160-0x00000000052D0000-0x000000000530F000-memory.dmp family_redline behavioral1/memory/5104-162-0x00000000052D0000-0x000000000530F000-memory.dmp family_redline behavioral1/memory/5104-164-0x00000000052D0000-0x000000000530F000-memory.dmp family_redline behavioral1/memory/5104-166-0x00000000052D0000-0x000000000530F000-memory.dmp family_redline behavioral1/memory/5104-168-0x00000000052D0000-0x000000000530F000-memory.dmp family_redline behavioral1/memory/5104-170-0x00000000052D0000-0x000000000530F000-memory.dmp family_redline behavioral1/memory/5104-172-0x00000000052D0000-0x000000000530F000-memory.dmp family_redline behavioral1/memory/5104-174-0x00000000052D0000-0x000000000530F000-memory.dmp family_redline behavioral1/memory/5104-176-0x00000000052D0000-0x000000000530F000-memory.dmp family_redline behavioral1/memory/5104-178-0x00000000052D0000-0x000000000530F000-memory.dmp family_redline behavioral1/memory/5104-180-0x00000000052D0000-0x000000000530F000-memory.dmp family_redline behavioral1/memory/5104-182-0x00000000052D0000-0x000000000530F000-memory.dmp family_redline behavioral1/memory/5104-184-0x00000000052D0000-0x000000000530F000-memory.dmp family_redline behavioral1/memory/5104-186-0x00000000052D0000-0x000000000530F000-memory.dmp family_redline behavioral1/memory/5104-188-0x00000000052D0000-0x000000000530F000-memory.dmp family_redline behavioral1/memory/5104-190-0x00000000052D0000-0x000000000530F000-memory.dmp family_redline behavioral1/memory/5104-192-0x00000000052D0000-0x000000000530F000-memory.dmp family_redline behavioral1/memory/5104-194-0x00000000052D0000-0x000000000530F000-memory.dmp family_redline behavioral1/memory/5104-196-0x00000000052D0000-0x000000000530F000-memory.dmp family_redline behavioral1/memory/5104-198-0x00000000052D0000-0x000000000530F000-memory.dmp family_redline behavioral1/memory/5104-200-0x00000000052D0000-0x000000000530F000-memory.dmp family_redline behavioral1/memory/5104-202-0x00000000052D0000-0x000000000530F000-memory.dmp family_redline behavioral1/memory/5104-204-0x00000000052D0000-0x000000000530F000-memory.dmp family_redline behavioral1/memory/5104-206-0x00000000052D0000-0x000000000530F000-memory.dmp family_redline behavioral1/memory/5104-208-0x00000000052D0000-0x000000000530F000-memory.dmp family_redline behavioral1/memory/5104-210-0x00000000052D0000-0x000000000530F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
zirF3218.exejr653871.exeku127189.exelr387263.exepid process 3640 zirF3218.exe 3960 jr653871.exe 5104 ku127189.exe 3724 lr387263.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr653871.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr653871.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
zirF3218.exe0f39f327cf9f21bbd00405ab8ab7373a84598defd710baa90abf95016a9d1864.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zirF3218.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 0f39f327cf9f21bbd00405ab8ab7373a84598defd710baa90abf95016a9d1864.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 0f39f327cf9f21bbd00405ab8ab7373a84598defd710baa90abf95016a9d1864.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zirF3218.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr653871.exeku127189.exelr387263.exepid process 3960 jr653871.exe 3960 jr653871.exe 5104 ku127189.exe 5104 ku127189.exe 3724 lr387263.exe 3724 lr387263.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr653871.exeku127189.exelr387263.exedescription pid process Token: SeDebugPrivilege 3960 jr653871.exe Token: SeDebugPrivilege 5104 ku127189.exe Token: SeDebugPrivilege 3724 lr387263.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
0f39f327cf9f21bbd00405ab8ab7373a84598defd710baa90abf95016a9d1864.exezirF3218.exedescription pid process target process PID 3632 wrote to memory of 3640 3632 0f39f327cf9f21bbd00405ab8ab7373a84598defd710baa90abf95016a9d1864.exe zirF3218.exe PID 3632 wrote to memory of 3640 3632 0f39f327cf9f21bbd00405ab8ab7373a84598defd710baa90abf95016a9d1864.exe zirF3218.exe PID 3632 wrote to memory of 3640 3632 0f39f327cf9f21bbd00405ab8ab7373a84598defd710baa90abf95016a9d1864.exe zirF3218.exe PID 3640 wrote to memory of 3960 3640 zirF3218.exe jr653871.exe PID 3640 wrote to memory of 3960 3640 zirF3218.exe jr653871.exe PID 3640 wrote to memory of 5104 3640 zirF3218.exe ku127189.exe PID 3640 wrote to memory of 5104 3640 zirF3218.exe ku127189.exe PID 3640 wrote to memory of 5104 3640 zirF3218.exe ku127189.exe PID 3632 wrote to memory of 3724 3632 0f39f327cf9f21bbd00405ab8ab7373a84598defd710baa90abf95016a9d1864.exe lr387263.exe PID 3632 wrote to memory of 3724 3632 0f39f327cf9f21bbd00405ab8ab7373a84598defd710baa90abf95016a9d1864.exe lr387263.exe PID 3632 wrote to memory of 3724 3632 0f39f327cf9f21bbd00405ab8ab7373a84598defd710baa90abf95016a9d1864.exe lr387263.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f39f327cf9f21bbd00405ab8ab7373a84598defd710baa90abf95016a9d1864.exe"C:\Users\Admin\AppData\Local\Temp\0f39f327cf9f21bbd00405ab8ab7373a84598defd710baa90abf95016a9d1864.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zirF3218.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zirF3218.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr653871.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr653871.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku127189.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku127189.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr387263.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr387263.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr387263.exeFilesize
175KB
MD5a6535ac9b5df9354461a1310229d9618
SHA1518619b32a0390e1f0b6cd84655d615270b4bf1e
SHA256ae6fe1a0a70d7af929a41f53a569e5f49df6ed9c7f6fbe168ec0f6f1a0963f8a
SHA5127e878a681be971fce5afe48e44a88f9fd86de5b17c86b19ae93658be17b6948d4e342426570d567d46f16f3636ecfc1d859652b3105dd03092c8b3724309c2cf
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr387263.exeFilesize
175KB
MD5a6535ac9b5df9354461a1310229d9618
SHA1518619b32a0390e1f0b6cd84655d615270b4bf1e
SHA256ae6fe1a0a70d7af929a41f53a569e5f49df6ed9c7f6fbe168ec0f6f1a0963f8a
SHA5127e878a681be971fce5afe48e44a88f9fd86de5b17c86b19ae93658be17b6948d4e342426570d567d46f16f3636ecfc1d859652b3105dd03092c8b3724309c2cf
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zirF3218.exeFilesize
394KB
MD5287b80030fa0d48313b8e164e4b1dbe9
SHA12d663ff3bfb8692a61702e18c6955647698f6c4d
SHA2560d1fb756c436661794f91b4495cde430e0cf7dcb716ee8ceeda96594c919118b
SHA5125d8fabcf48eba23686a26fa0d9ac95cce7c709a091e3ef4bf88a4fc2d811de593a251511f901b239a2cb3bb837fa0ee43d6a1418dbef889e0d8d28eaef1e797d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zirF3218.exeFilesize
394KB
MD5287b80030fa0d48313b8e164e4b1dbe9
SHA12d663ff3bfb8692a61702e18c6955647698f6c4d
SHA2560d1fb756c436661794f91b4495cde430e0cf7dcb716ee8ceeda96594c919118b
SHA5125d8fabcf48eba23686a26fa0d9ac95cce7c709a091e3ef4bf88a4fc2d811de593a251511f901b239a2cb3bb837fa0ee43d6a1418dbef889e0d8d28eaef1e797d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr653871.exeFilesize
13KB
MD5125783a95f2b7f8f42aa515e1fce1945
SHA12004e6de111c7320d0d59b853d345a95db9afcc3
SHA2569a95a98c9e10b84e9f9155faa12bf785a9953e5350c0747716cb2a6cc0c4c927
SHA5128ad1084d995b4fdd5cbe521e55745b2d128b0a69f8f0be09b7d47aaf32585956f9e851e8034ca22078ede3146b1971b06372cedabeb5a26734bfc21aedede928
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr653871.exeFilesize
13KB
MD5125783a95f2b7f8f42aa515e1fce1945
SHA12004e6de111c7320d0d59b853d345a95db9afcc3
SHA2569a95a98c9e10b84e9f9155faa12bf785a9953e5350c0747716cb2a6cc0c4c927
SHA5128ad1084d995b4fdd5cbe521e55745b2d128b0a69f8f0be09b7d47aaf32585956f9e851e8034ca22078ede3146b1971b06372cedabeb5a26734bfc21aedede928
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku127189.exeFilesize
353KB
MD56fbaa76c1e25409946e033d51746a738
SHA1e06f303a91fc2e477b12fd9bf7948f9959c6daac
SHA256fb8482a538478d16417ff9b311777f7d879cb7899850311c027867848e57abf8
SHA512a7b9b08cfa789e45b6b43a0f1a26629a1a8184887b9331a00c614654187e3c9f0007df433c795f2fedadd81b3be4b96fa431802069ae6a1f1a8919eda87efc65
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku127189.exeFilesize
353KB
MD56fbaa76c1e25409946e033d51746a738
SHA1e06f303a91fc2e477b12fd9bf7948f9959c6daac
SHA256fb8482a538478d16417ff9b311777f7d879cb7899850311c027867848e57abf8
SHA512a7b9b08cfa789e45b6b43a0f1a26629a1a8184887b9331a00c614654187e3c9f0007df433c795f2fedadd81b3be4b96fa431802069ae6a1f1a8919eda87efc65
-
memory/3724-1075-0x0000000000FA0000-0x0000000000FD2000-memory.dmpFilesize
200KB
-
memory/3724-1077-0x0000000005C90000-0x0000000005CA0000-memory.dmpFilesize
64KB
-
memory/3724-1076-0x0000000003450000-0x000000000349B000-memory.dmpFilesize
300KB
-
memory/3960-134-0x0000000000A70000-0x0000000000A7A000-memory.dmpFilesize
40KB
-
memory/5104-180-0x00000000052D0000-0x000000000530F000-memory.dmpFilesize
252KB
-
memory/5104-190-0x00000000052D0000-0x000000000530F000-memory.dmpFilesize
252KB
-
memory/5104-143-0x00000000052D0000-0x0000000005314000-memory.dmpFilesize
272KB
-
memory/5104-145-0x0000000002830000-0x0000000002840000-memory.dmpFilesize
64KB
-
memory/5104-146-0x0000000002830000-0x0000000002840000-memory.dmpFilesize
64KB
-
memory/5104-147-0x00000000052D0000-0x000000000530F000-memory.dmpFilesize
252KB
-
memory/5104-148-0x00000000052D0000-0x000000000530F000-memory.dmpFilesize
252KB
-
memory/5104-150-0x00000000052D0000-0x000000000530F000-memory.dmpFilesize
252KB
-
memory/5104-152-0x00000000052D0000-0x000000000530F000-memory.dmpFilesize
252KB
-
memory/5104-154-0x00000000052D0000-0x000000000530F000-memory.dmpFilesize
252KB
-
memory/5104-156-0x00000000052D0000-0x000000000530F000-memory.dmpFilesize
252KB
-
memory/5104-158-0x00000000052D0000-0x000000000530F000-memory.dmpFilesize
252KB
-
memory/5104-160-0x00000000052D0000-0x000000000530F000-memory.dmpFilesize
252KB
-
memory/5104-162-0x00000000052D0000-0x000000000530F000-memory.dmpFilesize
252KB
-
memory/5104-164-0x00000000052D0000-0x000000000530F000-memory.dmpFilesize
252KB
-
memory/5104-166-0x00000000052D0000-0x000000000530F000-memory.dmpFilesize
252KB
-
memory/5104-168-0x00000000052D0000-0x000000000530F000-memory.dmpFilesize
252KB
-
memory/5104-170-0x00000000052D0000-0x000000000530F000-memory.dmpFilesize
252KB
-
memory/5104-172-0x00000000052D0000-0x000000000530F000-memory.dmpFilesize
252KB
-
memory/5104-174-0x00000000052D0000-0x000000000530F000-memory.dmpFilesize
252KB
-
memory/5104-176-0x00000000052D0000-0x000000000530F000-memory.dmpFilesize
252KB
-
memory/5104-178-0x00000000052D0000-0x000000000530F000-memory.dmpFilesize
252KB
-
memory/5104-142-0x00000000008E0000-0x000000000092B000-memory.dmpFilesize
300KB
-
memory/5104-182-0x00000000052D0000-0x000000000530F000-memory.dmpFilesize
252KB
-
memory/5104-184-0x00000000052D0000-0x000000000530F000-memory.dmpFilesize
252KB
-
memory/5104-186-0x00000000052D0000-0x000000000530F000-memory.dmpFilesize
252KB
-
memory/5104-188-0x00000000052D0000-0x000000000530F000-memory.dmpFilesize
252KB
-
memory/5104-144-0x0000000002830000-0x0000000002840000-memory.dmpFilesize
64KB
-
memory/5104-192-0x00000000052D0000-0x000000000530F000-memory.dmpFilesize
252KB
-
memory/5104-194-0x00000000052D0000-0x000000000530F000-memory.dmpFilesize
252KB
-
memory/5104-196-0x00000000052D0000-0x000000000530F000-memory.dmpFilesize
252KB
-
memory/5104-198-0x00000000052D0000-0x000000000530F000-memory.dmpFilesize
252KB
-
memory/5104-200-0x00000000052D0000-0x000000000530F000-memory.dmpFilesize
252KB
-
memory/5104-202-0x00000000052D0000-0x000000000530F000-memory.dmpFilesize
252KB
-
memory/5104-204-0x00000000052D0000-0x000000000530F000-memory.dmpFilesize
252KB
-
memory/5104-206-0x00000000052D0000-0x000000000530F000-memory.dmpFilesize
252KB
-
memory/5104-208-0x00000000052D0000-0x000000000530F000-memory.dmpFilesize
252KB
-
memory/5104-210-0x00000000052D0000-0x000000000530F000-memory.dmpFilesize
252KB
-
memory/5104-1053-0x0000000005320000-0x0000000005926000-memory.dmpFilesize
6.0MB
-
memory/5104-1054-0x00000000059B0000-0x0000000005ABA000-memory.dmpFilesize
1.0MB
-
memory/5104-1055-0x0000000005AF0000-0x0000000005B02000-memory.dmpFilesize
72KB
-
memory/5104-1056-0x0000000005B10000-0x0000000005B4E000-memory.dmpFilesize
248KB
-
memory/5104-1057-0x0000000005C60000-0x0000000005CAB000-memory.dmpFilesize
300KB
-
memory/5104-1058-0x0000000002830000-0x0000000002840000-memory.dmpFilesize
64KB
-
memory/5104-1060-0x0000000005DF0000-0x0000000005E82000-memory.dmpFilesize
584KB
-
memory/5104-1061-0x0000000005E90000-0x0000000005EF6000-memory.dmpFilesize
408KB
-
memory/5104-1062-0x0000000002830000-0x0000000002840000-memory.dmpFilesize
64KB
-
memory/5104-1063-0x0000000002830000-0x0000000002840000-memory.dmpFilesize
64KB
-
memory/5104-1064-0x0000000002830000-0x0000000002840000-memory.dmpFilesize
64KB
-
memory/5104-1065-0x0000000006550000-0x00000000065C6000-memory.dmpFilesize
472KB
-
memory/5104-1066-0x00000000065F0000-0x0000000006640000-memory.dmpFilesize
320KB
-
memory/5104-141-0x0000000004D90000-0x000000000528E000-memory.dmpFilesize
5.0MB
-
memory/5104-140-0x00000000027F0000-0x0000000002836000-memory.dmpFilesize
280KB
-
memory/5104-1067-0x00000000068D0000-0x0000000006A92000-memory.dmpFilesize
1.8MB
-
memory/5104-1068-0x0000000006AA0000-0x0000000006FCC000-memory.dmpFilesize
5.2MB
-
memory/5104-1069-0x0000000002830000-0x0000000002840000-memory.dmpFilesize
64KB