Analysis
-
max time kernel
102s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 22:10
Static task
static1
Behavioral task
behavioral1
Sample
ae44202538c651945244d5ad1961de88f3a1648f9ac7db8ae9dfe5e103e95348.exe
Resource
win10v2004-20230220-en
General
-
Target
ae44202538c651945244d5ad1961de88f3a1648f9ac7db8ae9dfe5e103e95348.exe
-
Size
659KB
-
MD5
8773daf6af6d5fde79a0303ef20e5e2f
-
SHA1
3986b3918a25fcd3d2575f4192a46f9c7d50a9b2
-
SHA256
ae44202538c651945244d5ad1961de88f3a1648f9ac7db8ae9dfe5e103e95348
-
SHA512
08c7a1babe7029d2fd6927c57b9ff4bf8497cc4fd118dd5aeb5e570730afaed275d51bad05ca74ceeabc4e5a42b1f6816bc01425aabbcbfffad6a36a0c24ec7d
-
SSDEEP
12288:4Mrwy90u5bNGi87iRZrx2ivnrsuV8UcgVVvhow5pt597rwEcNClfsft/ju8COC:4yl5G9GrrMEnrhzvTt5FHcUlkBFC
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro3742.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro3742.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro3742.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro3742.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro3742.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro3742.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro3742.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/4072-191-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4072-192-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4072-195-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4072-198-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4072-202-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4072-204-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4072-206-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4072-208-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4072-210-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4072-212-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4072-214-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4072-216-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4072-220-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4072-218-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4072-222-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4072-224-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4072-226-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4072-228-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4072-1110-0x0000000004B70000-0x0000000004B80000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un871627.exepro3742.exequ7047.exesi349764.exepid process 4876 un871627.exe 1456 pro3742.exe 4072 qu7047.exe 3136 si349764.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro3742.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro3742.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro3742.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
ae44202538c651945244d5ad1961de88f3a1648f9ac7db8ae9dfe5e103e95348.exeun871627.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" ae44202538c651945244d5ad1961de88f3a1648f9ac7db8ae9dfe5e103e95348.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un871627.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un871627.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ae44202538c651945244d5ad1961de88f3a1648f9ac7db8ae9dfe5e103e95348.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3252 1456 WerFault.exe pro3742.exe 4740 4072 WerFault.exe qu7047.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro3742.exequ7047.exesi349764.exepid process 1456 pro3742.exe 1456 pro3742.exe 4072 qu7047.exe 4072 qu7047.exe 3136 si349764.exe 3136 si349764.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro3742.exequ7047.exesi349764.exedescription pid process Token: SeDebugPrivilege 1456 pro3742.exe Token: SeDebugPrivilege 4072 qu7047.exe Token: SeDebugPrivilege 3136 si349764.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
ae44202538c651945244d5ad1961de88f3a1648f9ac7db8ae9dfe5e103e95348.exeun871627.exedescription pid process target process PID 3580 wrote to memory of 4876 3580 ae44202538c651945244d5ad1961de88f3a1648f9ac7db8ae9dfe5e103e95348.exe un871627.exe PID 3580 wrote to memory of 4876 3580 ae44202538c651945244d5ad1961de88f3a1648f9ac7db8ae9dfe5e103e95348.exe un871627.exe PID 3580 wrote to memory of 4876 3580 ae44202538c651945244d5ad1961de88f3a1648f9ac7db8ae9dfe5e103e95348.exe un871627.exe PID 4876 wrote to memory of 1456 4876 un871627.exe pro3742.exe PID 4876 wrote to memory of 1456 4876 un871627.exe pro3742.exe PID 4876 wrote to memory of 1456 4876 un871627.exe pro3742.exe PID 4876 wrote to memory of 4072 4876 un871627.exe qu7047.exe PID 4876 wrote to memory of 4072 4876 un871627.exe qu7047.exe PID 4876 wrote to memory of 4072 4876 un871627.exe qu7047.exe PID 3580 wrote to memory of 3136 3580 ae44202538c651945244d5ad1961de88f3a1648f9ac7db8ae9dfe5e103e95348.exe si349764.exe PID 3580 wrote to memory of 3136 3580 ae44202538c651945244d5ad1961de88f3a1648f9ac7db8ae9dfe5e103e95348.exe si349764.exe PID 3580 wrote to memory of 3136 3580 ae44202538c651945244d5ad1961de88f3a1648f9ac7db8ae9dfe5e103e95348.exe si349764.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae44202538c651945244d5ad1961de88f3a1648f9ac7db8ae9dfe5e103e95348.exe"C:\Users\Admin\AppData\Local\Temp\ae44202538c651945244d5ad1961de88f3a1648f9ac7db8ae9dfe5e103e95348.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un871627.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un871627.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3742.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3742.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1456 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 10804⤵
- Program crash
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7047.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7047.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4072 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 13284⤵
- Program crash
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si349764.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si349764.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3136
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1456 -ip 14561⤵PID:2360
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4072 -ip 40721⤵PID:2472
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si349764.exeFilesize
175KB
MD5b6d6e7774875cad8f16711c48d37430c
SHA1024e4b64dc0b64f662df62c158aeb8ff43eaf550
SHA2569d33b1d5c3b4f8d14a122b6934d55023fa1a1570a3205184892356c88ab8bec1
SHA512c543c6cf192812f5df93676cd7799d8408661b715d3e0f61fd14130959a7822c1112d917aab16eedcc4b320e4eedb067586d035ed79cd3155f3f8222dfb465e4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si349764.exeFilesize
175KB
MD5b6d6e7774875cad8f16711c48d37430c
SHA1024e4b64dc0b64f662df62c158aeb8ff43eaf550
SHA2569d33b1d5c3b4f8d14a122b6934d55023fa1a1570a3205184892356c88ab8bec1
SHA512c543c6cf192812f5df93676cd7799d8408661b715d3e0f61fd14130959a7822c1112d917aab16eedcc4b320e4eedb067586d035ed79cd3155f3f8222dfb465e4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un871627.exeFilesize
517KB
MD566b1abc6eb15e94baaf81d586d75a258
SHA19672fa278ddae0ee9b01501823a91321dcaf0093
SHA25663098a8f17261ed304feefe822d312fae02458af253d392398836196d9bbcfcc
SHA512e5c1dc15ef7d649594751b7b276b9f8fbc85618630e98193fca7895c0c31a8d0963a43ac40a36bd807c8ec464849944fc4ef17ea650de4ed43fc8d68d9b300a6
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un871627.exeFilesize
517KB
MD566b1abc6eb15e94baaf81d586d75a258
SHA19672fa278ddae0ee9b01501823a91321dcaf0093
SHA25663098a8f17261ed304feefe822d312fae02458af253d392398836196d9bbcfcc
SHA512e5c1dc15ef7d649594751b7b276b9f8fbc85618630e98193fca7895c0c31a8d0963a43ac40a36bd807c8ec464849944fc4ef17ea650de4ed43fc8d68d9b300a6
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3742.exeFilesize
237KB
MD52153af9f65ce4e6249132a3963a5b3ac
SHA1364ca7abb9c4ae945170946e7c8af2ed71fc893d
SHA25639051cb934532c89ec426259583014c6100f650120cf40fa212e5b1af80c06a2
SHA512eab0c7d9785bb9792c7d189079b01fb7f4dc28c3dfd8bd706c6a6fb9a6ac51d93744f343577dd01420955bca9f584d85f421a3b7eca790925c969ad641989980
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3742.exeFilesize
237KB
MD52153af9f65ce4e6249132a3963a5b3ac
SHA1364ca7abb9c4ae945170946e7c8af2ed71fc893d
SHA25639051cb934532c89ec426259583014c6100f650120cf40fa212e5b1af80c06a2
SHA512eab0c7d9785bb9792c7d189079b01fb7f4dc28c3dfd8bd706c6a6fb9a6ac51d93744f343577dd01420955bca9f584d85f421a3b7eca790925c969ad641989980
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7047.exeFilesize
295KB
MD5951957f23df2d6b70e655f7db70bb917
SHA188a062bcb782c6fbc35fedc9e870448c70054a9d
SHA2562c43d0a3176b7c7da3c194432f1a57d65daa8eec3436ae4bdad43c66adb5cf30
SHA512a9aa2c536b765902da2d7c9253b1bf8b86484f4499b2e47caefa41fc46d39f1bf896e4974bfa1ecd920d5b0f89f46e9b5b7a52dd3a741d3215b5c41657b4635f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7047.exeFilesize
295KB
MD5951957f23df2d6b70e655f7db70bb917
SHA188a062bcb782c6fbc35fedc9e870448c70054a9d
SHA2562c43d0a3176b7c7da3c194432f1a57d65daa8eec3436ae4bdad43c66adb5cf30
SHA512a9aa2c536b765902da2d7c9253b1bf8b86484f4499b2e47caefa41fc46d39f1bf896e4974bfa1ecd920d5b0f89f46e9b5b7a52dd3a741d3215b5c41657b4635f
-
memory/1456-148-0x0000000001FD0000-0x0000000001FFD000-memory.dmpFilesize
180KB
-
memory/1456-149-0x0000000004D10000-0x00000000052B4000-memory.dmpFilesize
5.6MB
-
memory/1456-151-0x0000000004D00000-0x0000000004D10000-memory.dmpFilesize
64KB
-
memory/1456-150-0x0000000004D00000-0x0000000004D10000-memory.dmpFilesize
64KB
-
memory/1456-152-0x0000000004D00000-0x0000000004D10000-memory.dmpFilesize
64KB
-
memory/1456-153-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1456-154-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1456-156-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1456-158-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1456-160-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1456-162-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1456-164-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1456-166-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1456-168-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1456-170-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1456-172-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1456-174-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1456-176-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1456-178-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1456-180-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1456-181-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1456-182-0x0000000004D00000-0x0000000004D10000-memory.dmpFilesize
64KB
-
memory/1456-183-0x0000000004D00000-0x0000000004D10000-memory.dmpFilesize
64KB
-
memory/1456-184-0x0000000004D00000-0x0000000004D10000-memory.dmpFilesize
64KB
-
memory/1456-186-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/3136-1125-0x00000000007D0000-0x0000000000802000-memory.dmpFilesize
200KB
-
memory/3136-1126-0x0000000005400000-0x0000000005410000-memory.dmpFilesize
64KB
-
memory/4072-193-0x00000000020F0000-0x000000000213B000-memory.dmpFilesize
300KB
-
memory/4072-226-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4072-196-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/4072-195-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4072-199-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/4072-198-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4072-201-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/4072-202-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4072-204-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4072-206-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4072-208-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4072-210-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4072-212-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4072-214-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4072-216-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4072-220-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4072-218-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4072-222-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4072-224-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4072-192-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4072-228-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4072-1101-0x0000000005230000-0x0000000005848000-memory.dmpFilesize
6.1MB
-
memory/4072-1102-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/4072-1103-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/4072-1104-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/4072-1105-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/4072-1107-0x0000000005CF0000-0x0000000005D56000-memory.dmpFilesize
408KB
-
memory/4072-1108-0x00000000063C0000-0x0000000006452000-memory.dmpFilesize
584KB
-
memory/4072-1109-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/4072-1110-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/4072-1111-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/4072-1112-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/4072-1113-0x00000000066F0000-0x00000000068B2000-memory.dmpFilesize
1.8MB
-
memory/4072-191-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4072-1115-0x0000000006910000-0x0000000006E3C000-memory.dmpFilesize
5.2MB
-
memory/4072-1117-0x0000000007080000-0x00000000070F6000-memory.dmpFilesize
472KB
-
memory/4072-1118-0x0000000007110000-0x0000000007160000-memory.dmpFilesize
320KB