Analysis
-
max time kernel
68s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 22:15
Static task
static1
Behavioral task
behavioral1
Sample
5757b226c0bc27b1a9ca58ac735ab0ec2d08152ee4d93b8be4b4e084378daf41.exe
Resource
win10v2004-20230220-en
General
-
Target
5757b226c0bc27b1a9ca58ac735ab0ec2d08152ee4d93b8be4b4e084378daf41.exe
-
Size
659KB
-
MD5
96c9305e28a644ee459ba36f17ee2417
-
SHA1
367d90c6165e8605590951d01bafa0502b8e03c8
-
SHA256
5757b226c0bc27b1a9ca58ac735ab0ec2d08152ee4d93b8be4b4e084378daf41
-
SHA512
d33700aee7c23b3b95508f0b2d1f48b1825256899bf1be3bcea8ebb1aad5c2a85d9df026b3da58e9e8a9b923f0f1120c0a9f92fd14659ceb130c1f4fafdac4e1
-
SSDEEP
12288:tMrAy90fNmhLvmdAd0PupwMPpEJt59hrwVkzC6D6ft/jueeuWjmc:Ry4+v0IP8t5DCku62Bhe+c
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro1292.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro1292.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro1292.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro1292.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro1292.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro1292.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro1292.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/228-191-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/228-190-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/228-193-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/228-195-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/228-197-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/228-199-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/228-201-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/228-203-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/228-205-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/228-207-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/228-209-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/228-211-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/228-213-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/228-215-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/228-217-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/228-219-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/228-221-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/228-224-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un885003.exepro1292.exequ8008.exesi022712.exepid process 4816 un885003.exe 5096 pro1292.exe 228 qu8008.exe 2788 si022712.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro1292.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro1292.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro1292.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
5757b226c0bc27b1a9ca58ac735ab0ec2d08152ee4d93b8be4b4e084378daf41.exeun885003.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 5757b226c0bc27b1a9ca58ac735ab0ec2d08152ee4d93b8be4b4e084378daf41.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5757b226c0bc27b1a9ca58ac735ab0ec2d08152ee4d93b8be4b4e084378daf41.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un885003.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un885003.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2872 5096 WerFault.exe pro1292.exe 1468 228 WerFault.exe qu8008.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro1292.exequ8008.exesi022712.exepid process 5096 pro1292.exe 5096 pro1292.exe 228 qu8008.exe 228 qu8008.exe 2788 si022712.exe 2788 si022712.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro1292.exequ8008.exesi022712.exedescription pid process Token: SeDebugPrivilege 5096 pro1292.exe Token: SeDebugPrivilege 228 qu8008.exe Token: SeDebugPrivilege 2788 si022712.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
5757b226c0bc27b1a9ca58ac735ab0ec2d08152ee4d93b8be4b4e084378daf41.exeun885003.exedescription pid process target process PID 316 wrote to memory of 4816 316 5757b226c0bc27b1a9ca58ac735ab0ec2d08152ee4d93b8be4b4e084378daf41.exe un885003.exe PID 316 wrote to memory of 4816 316 5757b226c0bc27b1a9ca58ac735ab0ec2d08152ee4d93b8be4b4e084378daf41.exe un885003.exe PID 316 wrote to memory of 4816 316 5757b226c0bc27b1a9ca58ac735ab0ec2d08152ee4d93b8be4b4e084378daf41.exe un885003.exe PID 4816 wrote to memory of 5096 4816 un885003.exe pro1292.exe PID 4816 wrote to memory of 5096 4816 un885003.exe pro1292.exe PID 4816 wrote to memory of 5096 4816 un885003.exe pro1292.exe PID 4816 wrote to memory of 228 4816 un885003.exe qu8008.exe PID 4816 wrote to memory of 228 4816 un885003.exe qu8008.exe PID 4816 wrote to memory of 228 4816 un885003.exe qu8008.exe PID 316 wrote to memory of 2788 316 5757b226c0bc27b1a9ca58ac735ab0ec2d08152ee4d93b8be4b4e084378daf41.exe si022712.exe PID 316 wrote to memory of 2788 316 5757b226c0bc27b1a9ca58ac735ab0ec2d08152ee4d93b8be4b4e084378daf41.exe si022712.exe PID 316 wrote to memory of 2788 316 5757b226c0bc27b1a9ca58ac735ab0ec2d08152ee4d93b8be4b4e084378daf41.exe si022712.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5757b226c0bc27b1a9ca58ac735ab0ec2d08152ee4d93b8be4b4e084378daf41.exe"C:\Users\Admin\AppData\Local\Temp\5757b226c0bc27b1a9ca58ac735ab0ec2d08152ee4d93b8be4b4e084378daf41.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un885003.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un885003.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1292.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1292.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 10844⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8008.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8008.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 13484⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si022712.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si022712.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5096 -ip 50961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 228 -ip 2281⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si022712.exeFilesize
175KB
MD56c7a2017452f3a34d1869e9407d9ce5c
SHA1d3da4b0d914543cdc0a33d457e1f2510fd6d4406
SHA25683134471cf556de59e66add2d58b496cb8fdc588a008ae7984a566ab05e6d6a9
SHA5122c84de397e0ba92275ecb5c1e41424c852e610fd3554fb69dc57b510993e7a992e8fc3e158b45216b2944e4e8f4b0dc876d93a6a016852ce6aab9bf6973d6381
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si022712.exeFilesize
175KB
MD56c7a2017452f3a34d1869e9407d9ce5c
SHA1d3da4b0d914543cdc0a33d457e1f2510fd6d4406
SHA25683134471cf556de59e66add2d58b496cb8fdc588a008ae7984a566ab05e6d6a9
SHA5122c84de397e0ba92275ecb5c1e41424c852e610fd3554fb69dc57b510993e7a992e8fc3e158b45216b2944e4e8f4b0dc876d93a6a016852ce6aab9bf6973d6381
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un885003.exeFilesize
517KB
MD5208fe320bb4611500f41b219a4c8aa9f
SHA11d9008db9837048d773f176d55a32f985bb20028
SHA2564958e892792566af109bb88495c0dbad6ff547c55fba6c9013d712c42de65d7c
SHA51278fd41f854ca64481609f6b0e9ab555607651ba4bcea873da9eae23e51ac10961df77dbfe4fab4bb19e68cbaf1cc71e007ab8846cd2e6c7979f04c02c3c2a27a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un885003.exeFilesize
517KB
MD5208fe320bb4611500f41b219a4c8aa9f
SHA11d9008db9837048d773f176d55a32f985bb20028
SHA2564958e892792566af109bb88495c0dbad6ff547c55fba6c9013d712c42de65d7c
SHA51278fd41f854ca64481609f6b0e9ab555607651ba4bcea873da9eae23e51ac10961df77dbfe4fab4bb19e68cbaf1cc71e007ab8846cd2e6c7979f04c02c3c2a27a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1292.exeFilesize
237KB
MD59376b5fda124ac24c49005abc7a716fa
SHA174e7692affa70d6c4001359a602c3377c2b19efa
SHA2564d3349882a9fb8b83932f7c462ca65d14c4fc2941ffdb1cfde301f8fae40b6c3
SHA512b43c1942820fe93d38bfa8ceaafba87fca423629c101b2abfcea1c7ed5997b4a26e198c37273c03cdb8aabe53706b3866479b3292ca93375b4f90e6b83e4383f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1292.exeFilesize
237KB
MD59376b5fda124ac24c49005abc7a716fa
SHA174e7692affa70d6c4001359a602c3377c2b19efa
SHA2564d3349882a9fb8b83932f7c462ca65d14c4fc2941ffdb1cfde301f8fae40b6c3
SHA512b43c1942820fe93d38bfa8ceaafba87fca423629c101b2abfcea1c7ed5997b4a26e198c37273c03cdb8aabe53706b3866479b3292ca93375b4f90e6b83e4383f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8008.exeFilesize
295KB
MD53a5b587e07b1746819cdffa442c92d1b
SHA1ced8d69471c003fc1ab8cdea63760cd033394133
SHA256cc82c060eccdad4c7afb874412db56c14fa346d68d4d4e15c2ef51d82b733143
SHA5128b000fc40247711064c734e291d9ccaaca5ceb2cecd0f8a78b4ee666567f1d17e1d6b5742bac78a3a6728a14e29e925bc2442cd1f6d7004a82e9af43a39e4b10
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8008.exeFilesize
295KB
MD53a5b587e07b1746819cdffa442c92d1b
SHA1ced8d69471c003fc1ab8cdea63760cd033394133
SHA256cc82c060eccdad4c7afb874412db56c14fa346d68d4d4e15c2ef51d82b733143
SHA5128b000fc40247711064c734e291d9ccaaca5ceb2cecd0f8a78b4ee666567f1d17e1d6b5742bac78a3a6728a14e29e925bc2442cd1f6d7004a82e9af43a39e4b10
-
memory/228-1099-0x0000000005200000-0x0000000005818000-memory.dmpFilesize
6.1MB
-
memory/228-1102-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/228-1113-0x00000000023D0000-0x00000000023E0000-memory.dmpFilesize
64KB
-
memory/228-1112-0x00000000068B0000-0x0000000006DDC000-memory.dmpFilesize
5.2MB
-
memory/228-1111-0x00000000066A0000-0x0000000006862000-memory.dmpFilesize
1.8MB
-
memory/228-1110-0x00000000023D0000-0x00000000023E0000-memory.dmpFilesize
64KB
-
memory/228-1109-0x00000000023D0000-0x00000000023E0000-memory.dmpFilesize
64KB
-
memory/228-1108-0x0000000006620000-0x0000000006670000-memory.dmpFilesize
320KB
-
memory/228-1107-0x0000000006590000-0x0000000006606000-memory.dmpFilesize
472KB
-
memory/228-1105-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/228-1104-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/228-1103-0x00000000023D0000-0x00000000023E0000-memory.dmpFilesize
64KB
-
memory/228-1101-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/228-1100-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/228-228-0x00000000023D0000-0x00000000023E0000-memory.dmpFilesize
64KB
-
memory/228-225-0x00000000023D0000-0x00000000023E0000-memory.dmpFilesize
64KB
-
memory/228-223-0x0000000000840000-0x000000000088B000-memory.dmpFilesize
300KB
-
memory/228-224-0x0000000002680000-0x00000000026BF000-memory.dmpFilesize
252KB
-
memory/228-221-0x0000000002680000-0x00000000026BF000-memory.dmpFilesize
252KB
-
memory/228-219-0x0000000002680000-0x00000000026BF000-memory.dmpFilesize
252KB
-
memory/228-217-0x0000000002680000-0x00000000026BF000-memory.dmpFilesize
252KB
-
memory/228-215-0x0000000002680000-0x00000000026BF000-memory.dmpFilesize
252KB
-
memory/228-191-0x0000000002680000-0x00000000026BF000-memory.dmpFilesize
252KB
-
memory/228-190-0x0000000002680000-0x00000000026BF000-memory.dmpFilesize
252KB
-
memory/228-193-0x0000000002680000-0x00000000026BF000-memory.dmpFilesize
252KB
-
memory/228-195-0x0000000002680000-0x00000000026BF000-memory.dmpFilesize
252KB
-
memory/228-197-0x0000000002680000-0x00000000026BF000-memory.dmpFilesize
252KB
-
memory/228-199-0x0000000002680000-0x00000000026BF000-memory.dmpFilesize
252KB
-
memory/228-201-0x0000000002680000-0x00000000026BF000-memory.dmpFilesize
252KB
-
memory/228-203-0x0000000002680000-0x00000000026BF000-memory.dmpFilesize
252KB
-
memory/228-205-0x0000000002680000-0x00000000026BF000-memory.dmpFilesize
252KB
-
memory/228-207-0x0000000002680000-0x00000000026BF000-memory.dmpFilesize
252KB
-
memory/228-209-0x0000000002680000-0x00000000026BF000-memory.dmpFilesize
252KB
-
memory/228-211-0x0000000002680000-0x00000000026BF000-memory.dmpFilesize
252KB
-
memory/228-213-0x0000000002680000-0x00000000026BF000-memory.dmpFilesize
252KB
-
memory/2788-1119-0x0000000000BA0000-0x0000000000BD2000-memory.dmpFilesize
200KB
-
memory/2788-1121-0x0000000005810000-0x0000000005820000-memory.dmpFilesize
64KB
-
memory/2788-1120-0x0000000005810000-0x0000000005820000-memory.dmpFilesize
64KB
-
memory/5096-176-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/5096-172-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/5096-181-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/5096-180-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/5096-179-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/5096-150-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/5096-178-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/5096-177-0x0000000000600000-0x000000000062D000-memory.dmpFilesize
180KB
-
memory/5096-156-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/5096-152-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/5096-174-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/5096-182-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/5096-170-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/5096-168-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/5096-166-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/5096-164-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/5096-162-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/5096-160-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/5096-158-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/5096-149-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/5096-148-0x0000000004BD0000-0x0000000005174000-memory.dmpFilesize
5.6MB
-
memory/5096-183-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/5096-185-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/5096-154-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB