Analysis
-
max time kernel
93s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 22:13
Static task
static1
Behavioral task
behavioral1
Sample
2807f3981dfecb497a8d9343b1aa3e8b1a6394d5ca2468012eaafddc0337615c.exe
Resource
win10v2004-20230220-en
General
-
Target
2807f3981dfecb497a8d9343b1aa3e8b1a6394d5ca2468012eaafddc0337615c.exe
-
Size
659KB
-
MD5
d22694969045013b8edc82e9e7266c82
-
SHA1
bbb2c80af8c7e4ce2237adc4c0bda9ab1a632ee8
-
SHA256
2807f3981dfecb497a8d9343b1aa3e8b1a6394d5ca2468012eaafddc0337615c
-
SHA512
73ccd67faeefd25b3906b35c08203ac6f5d2f48c7f93038d8dae3d7087b70b7812b07acbf9fdd684a64d3d9e12b18b1565b40c32018d9a8017a2dd4db3af958b
-
SSDEEP
12288:zMrSy907WfWpLSYNzdz4AS6Ht1+syOSY/bQt59Lrwk+RC/vIft/juTfNWUj:pyw+WL/zfN1vS2Qt5Vz+I/gBsWc
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro9261.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro9261.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro9261.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro9261.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro9261.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro9261.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro9261.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/4892-189-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4892-190-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4892-192-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4892-194-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4892-196-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4892-198-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4892-200-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4892-202-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4892-204-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4892-206-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4892-208-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4892-210-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4892-212-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4892-214-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4892-216-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4892-218-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4892-220-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4892-222-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/4892-1110-0x0000000004B90000-0x0000000004BA0000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un515779.exepro9261.exequ5137.exesi178839.exepid process 3168 un515779.exe 712 pro9261.exe 4892 qu5137.exe 2252 si178839.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro9261.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro9261.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro9261.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
2807f3981dfecb497a8d9343b1aa3e8b1a6394d5ca2468012eaafddc0337615c.exeun515779.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 2807f3981dfecb497a8d9343b1aa3e8b1a6394d5ca2468012eaafddc0337615c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 2807f3981dfecb497a8d9343b1aa3e8b1a6394d5ca2468012eaafddc0337615c.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un515779.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un515779.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4992 712 WerFault.exe pro9261.exe 4648 4892 WerFault.exe qu5137.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro9261.exequ5137.exesi178839.exepid process 712 pro9261.exe 712 pro9261.exe 4892 qu5137.exe 4892 qu5137.exe 2252 si178839.exe 2252 si178839.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro9261.exequ5137.exesi178839.exedescription pid process Token: SeDebugPrivilege 712 pro9261.exe Token: SeDebugPrivilege 4892 qu5137.exe Token: SeDebugPrivilege 2252 si178839.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
2807f3981dfecb497a8d9343b1aa3e8b1a6394d5ca2468012eaafddc0337615c.exeun515779.exedescription pid process target process PID 1956 wrote to memory of 3168 1956 2807f3981dfecb497a8d9343b1aa3e8b1a6394d5ca2468012eaafddc0337615c.exe un515779.exe PID 1956 wrote to memory of 3168 1956 2807f3981dfecb497a8d9343b1aa3e8b1a6394d5ca2468012eaafddc0337615c.exe un515779.exe PID 1956 wrote to memory of 3168 1956 2807f3981dfecb497a8d9343b1aa3e8b1a6394d5ca2468012eaafddc0337615c.exe un515779.exe PID 3168 wrote to memory of 712 3168 un515779.exe pro9261.exe PID 3168 wrote to memory of 712 3168 un515779.exe pro9261.exe PID 3168 wrote to memory of 712 3168 un515779.exe pro9261.exe PID 3168 wrote to memory of 4892 3168 un515779.exe qu5137.exe PID 3168 wrote to memory of 4892 3168 un515779.exe qu5137.exe PID 3168 wrote to memory of 4892 3168 un515779.exe qu5137.exe PID 1956 wrote to memory of 2252 1956 2807f3981dfecb497a8d9343b1aa3e8b1a6394d5ca2468012eaafddc0337615c.exe si178839.exe PID 1956 wrote to memory of 2252 1956 2807f3981dfecb497a8d9343b1aa3e8b1a6394d5ca2468012eaafddc0337615c.exe si178839.exe PID 1956 wrote to memory of 2252 1956 2807f3981dfecb497a8d9343b1aa3e8b1a6394d5ca2468012eaafddc0337615c.exe si178839.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2807f3981dfecb497a8d9343b1aa3e8b1a6394d5ca2468012eaafddc0337615c.exe"C:\Users\Admin\AppData\Local\Temp\2807f3981dfecb497a8d9343b1aa3e8b1a6394d5ca2468012eaafddc0337615c.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un515779.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un515779.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9261.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9261.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 712 -s 10884⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5137.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5137.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 13524⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si178839.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si178839.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 712 -ip 7121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4892 -ip 48921⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si178839.exeFilesize
175KB
MD536f4ced7454f17784f9d35c11df17336
SHA1f2e443e482d157c203e338572de42a967e592fcb
SHA256926cfbeb3de04abd41e53cbb645e911ffc07969556bfa09c4b88362a6155c45f
SHA512384f7b3efd9693f21e93f897093866a619d03791bfb06e250a4f85813349262b87cdcd1da9518252405961368907c612b86189cee1049aa7c6487f484bf4281b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si178839.exeFilesize
175KB
MD536f4ced7454f17784f9d35c11df17336
SHA1f2e443e482d157c203e338572de42a967e592fcb
SHA256926cfbeb3de04abd41e53cbb645e911ffc07969556bfa09c4b88362a6155c45f
SHA512384f7b3efd9693f21e93f897093866a619d03791bfb06e250a4f85813349262b87cdcd1da9518252405961368907c612b86189cee1049aa7c6487f484bf4281b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un515779.exeFilesize
517KB
MD5f230bf150b7f1728dfcef58c578e22cd
SHA18888d76605266c51c76774ea35e66130fea2b355
SHA256bef03bb2525c0371770ece22cda680495f3919a98befcb790903251a2f51bc08
SHA51267e397d969a38b2e9bedb3c753cf28c867b469c766a0e4f517be325eb0dc9baf21c1b8b8aaf1354e482f42dfabee2a5a6c7f0c0881074a96576364eab5c08ca1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un515779.exeFilesize
517KB
MD5f230bf150b7f1728dfcef58c578e22cd
SHA18888d76605266c51c76774ea35e66130fea2b355
SHA256bef03bb2525c0371770ece22cda680495f3919a98befcb790903251a2f51bc08
SHA51267e397d969a38b2e9bedb3c753cf28c867b469c766a0e4f517be325eb0dc9baf21c1b8b8aaf1354e482f42dfabee2a5a6c7f0c0881074a96576364eab5c08ca1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9261.exeFilesize
237KB
MD5274abc92531bb5ac267c43a6b5f6f3e6
SHA18908813605dcf40ba1690b399fc8af3a39c7e9c4
SHA256a24642a021101669b121c05532d66def6d2da9cf908f82a8f6500ea14bc33eb3
SHA512c08ae87938932514091f1faa712e9178ccb819f456c7e9d1bd48aba4285669b997bb92b6095a100a7847d001410400a6050a34b476cd0007adafb268859004da
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9261.exeFilesize
237KB
MD5274abc92531bb5ac267c43a6b5f6f3e6
SHA18908813605dcf40ba1690b399fc8af3a39c7e9c4
SHA256a24642a021101669b121c05532d66def6d2da9cf908f82a8f6500ea14bc33eb3
SHA512c08ae87938932514091f1faa712e9178ccb819f456c7e9d1bd48aba4285669b997bb92b6095a100a7847d001410400a6050a34b476cd0007adafb268859004da
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5137.exeFilesize
295KB
MD5a3fbac059ee700ab5041cff9366ca5ae
SHA10ddcbda884fdac566a19ae943bc3476dcb45105d
SHA2562729bdff23a6e2ebe3e9caadd77ae95cfcdefc81a841d2d03f32960b21137fb5
SHA512d9106e19f62ac9829bbdb32c06943df52af4b95d53cd128fc08b2592f9056e88af997e7cf30bf98fe45eb7bc4b525c22bb9b5bf549e56771a7c6d2fab232ed5c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5137.exeFilesize
295KB
MD5a3fbac059ee700ab5041cff9366ca5ae
SHA10ddcbda884fdac566a19ae943bc3476dcb45105d
SHA2562729bdff23a6e2ebe3e9caadd77ae95cfcdefc81a841d2d03f32960b21137fb5
SHA512d9106e19f62ac9829bbdb32c06943df52af4b95d53cd128fc08b2592f9056e88af997e7cf30bf98fe45eb7bc4b525c22bb9b5bf549e56771a7c6d2fab232ed5c
-
memory/712-148-0x0000000004B50000-0x00000000050F4000-memory.dmpFilesize
5.6MB
-
memory/712-149-0x00000000004F0000-0x000000000051D000-memory.dmpFilesize
180KB
-
memory/712-150-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/712-151-0x0000000002520000-0x0000000002532000-memory.dmpFilesize
72KB
-
memory/712-152-0x0000000002520000-0x0000000002532000-memory.dmpFilesize
72KB
-
memory/712-154-0x0000000002520000-0x0000000002532000-memory.dmpFilesize
72KB
-
memory/712-156-0x0000000002520000-0x0000000002532000-memory.dmpFilesize
72KB
-
memory/712-158-0x0000000002520000-0x0000000002532000-memory.dmpFilesize
72KB
-
memory/712-160-0x0000000002520000-0x0000000002532000-memory.dmpFilesize
72KB
-
memory/712-162-0x0000000002520000-0x0000000002532000-memory.dmpFilesize
72KB
-
memory/712-164-0x0000000002520000-0x0000000002532000-memory.dmpFilesize
72KB
-
memory/712-166-0x0000000002520000-0x0000000002532000-memory.dmpFilesize
72KB
-
memory/712-168-0x0000000002520000-0x0000000002532000-memory.dmpFilesize
72KB
-
memory/712-170-0x0000000002520000-0x0000000002532000-memory.dmpFilesize
72KB
-
memory/712-172-0x0000000002520000-0x0000000002532000-memory.dmpFilesize
72KB
-
memory/712-176-0x0000000002520000-0x0000000002532000-memory.dmpFilesize
72KB
-
memory/712-174-0x0000000002520000-0x0000000002532000-memory.dmpFilesize
72KB
-
memory/712-178-0x0000000002520000-0x0000000002532000-memory.dmpFilesize
72KB
-
memory/712-179-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/712-180-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/712-181-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/712-182-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/712-184-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2252-1120-0x0000000000B90000-0x0000000000BC2000-memory.dmpFilesize
200KB
-
memory/2252-1123-0x00000000054C0000-0x00000000054D0000-memory.dmpFilesize
64KB
-
memory/2252-1121-0x00000000054C0000-0x00000000054D0000-memory.dmpFilesize
64KB
-
memory/4892-192-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4892-399-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/4892-196-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4892-198-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4892-200-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4892-202-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4892-204-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4892-206-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4892-208-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4892-210-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4892-212-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4892-214-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4892-216-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4892-218-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4892-220-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4892-222-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4892-398-0x0000000002130000-0x000000000217B000-memory.dmpFilesize
300KB
-
memory/4892-194-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4892-404-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/4892-402-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/4892-1099-0x0000000005250000-0x0000000005868000-memory.dmpFilesize
6.1MB
-
memory/4892-1100-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/4892-1101-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/4892-1102-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/4892-1103-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/4892-1104-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/4892-1105-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/4892-1107-0x00000000064C0000-0x0000000006682000-memory.dmpFilesize
1.8MB
-
memory/4892-1108-0x0000000006690000-0x0000000006BBC000-memory.dmpFilesize
5.2MB
-
memory/4892-1109-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/4892-1110-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/4892-190-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4892-189-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4892-1111-0x0000000006DE0000-0x0000000006E56000-memory.dmpFilesize
472KB
-
memory/4892-1112-0x0000000006E70000-0x0000000006EC0000-memory.dmpFilesize
320KB
-
memory/4892-1113-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB