Analysis
-
max time kernel
157s -
max time network
191s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 22:13
Static task
static1
Behavioral task
behavioral1
Sample
5bb561bef7a556e3ffd9635cfd0cdd80ff55fc832c0aa5f9eec25da1707d6580.exe
Resource
win10v2004-20230221-en
General
-
Target
5bb561bef7a556e3ffd9635cfd0cdd80ff55fc832c0aa5f9eec25da1707d6580.exe
-
Size
522KB
-
MD5
72f156e4da917f326d61f25f88472b16
-
SHA1
4bcb618b4b6db6c60a726ae74acfb7e38b7f70f1
-
SHA256
5bb561bef7a556e3ffd9635cfd0cdd80ff55fc832c0aa5f9eec25da1707d6580
-
SHA512
c109a6bc5bb9ce4769cf0a349d6cbd73cc06233eacb3e259a1aabf8606e10f5b8324a92588903a6692aee09977974f7dd1a58a5a1ace0e219a2f71fed9f5e8a0
-
SSDEEP
12288:mMrdy90fqppItPFMEgQiWdFGrhC7JrDg/LZWa8:LylDEPFMEFiWdUrY7JDg/LZWa8
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr344133.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr344133.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr344133.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr344133.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr344133.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr344133.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr344133.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/4064-158-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4064-159-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4064-161-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4064-163-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4064-165-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4064-167-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4064-169-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4064-171-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4064-173-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4064-175-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4064-177-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4064-179-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4064-181-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4064-183-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4064-185-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4064-187-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4064-189-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4064-191-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4064-193-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4064-195-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4064-197-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4064-199-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4064-201-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4064-203-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4064-205-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4064-207-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4064-209-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4064-211-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4064-217-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4064-215-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4064-213-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4064-219-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4064-221-0x0000000002610000-0x000000000264F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
zirK1586.exejr344133.exeku312993.exelr569027.exepid process 384 zirK1586.exe 1088 jr344133.exe 4064 ku312993.exe 344 lr569027.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr344133.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr344133.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
5bb561bef7a556e3ffd9635cfd0cdd80ff55fc832c0aa5f9eec25da1707d6580.exezirK1586.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 5bb561bef7a556e3ffd9635cfd0cdd80ff55fc832c0aa5f9eec25da1707d6580.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5bb561bef7a556e3ffd9635cfd0cdd80ff55fc832c0aa5f9eec25da1707d6580.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zirK1586.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zirK1586.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4368 4064 WerFault.exe ku312993.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr344133.exeku312993.exelr569027.exepid process 1088 jr344133.exe 1088 jr344133.exe 4064 ku312993.exe 4064 ku312993.exe 344 lr569027.exe 344 lr569027.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr344133.exeku312993.exelr569027.exedescription pid process Token: SeDebugPrivilege 1088 jr344133.exe Token: SeDebugPrivilege 4064 ku312993.exe Token: SeDebugPrivilege 344 lr569027.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
5bb561bef7a556e3ffd9635cfd0cdd80ff55fc832c0aa5f9eec25da1707d6580.exezirK1586.exedescription pid process target process PID 3628 wrote to memory of 384 3628 5bb561bef7a556e3ffd9635cfd0cdd80ff55fc832c0aa5f9eec25da1707d6580.exe zirK1586.exe PID 3628 wrote to memory of 384 3628 5bb561bef7a556e3ffd9635cfd0cdd80ff55fc832c0aa5f9eec25da1707d6580.exe zirK1586.exe PID 3628 wrote to memory of 384 3628 5bb561bef7a556e3ffd9635cfd0cdd80ff55fc832c0aa5f9eec25da1707d6580.exe zirK1586.exe PID 384 wrote to memory of 1088 384 zirK1586.exe jr344133.exe PID 384 wrote to memory of 1088 384 zirK1586.exe jr344133.exe PID 384 wrote to memory of 4064 384 zirK1586.exe ku312993.exe PID 384 wrote to memory of 4064 384 zirK1586.exe ku312993.exe PID 384 wrote to memory of 4064 384 zirK1586.exe ku312993.exe PID 3628 wrote to memory of 344 3628 5bb561bef7a556e3ffd9635cfd0cdd80ff55fc832c0aa5f9eec25da1707d6580.exe lr569027.exe PID 3628 wrote to memory of 344 3628 5bb561bef7a556e3ffd9635cfd0cdd80ff55fc832c0aa5f9eec25da1707d6580.exe lr569027.exe PID 3628 wrote to memory of 344 3628 5bb561bef7a556e3ffd9635cfd0cdd80ff55fc832c0aa5f9eec25da1707d6580.exe lr569027.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5bb561bef7a556e3ffd9635cfd0cdd80ff55fc832c0aa5f9eec25da1707d6580.exe"C:\Users\Admin\AppData\Local\Temp\5bb561bef7a556e3ffd9635cfd0cdd80ff55fc832c0aa5f9eec25da1707d6580.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zirK1586.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zirK1586.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr344133.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr344133.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku312993.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku312993.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 13364⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr569027.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr569027.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4064 -ip 40641⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr569027.exeFilesize
175KB
MD5e6396da0fe2c47f7aeff3f6a2bda30c6
SHA124844f553fcae6638e3fba9d1a21f9661aac4be1
SHA25676efbe867e46524dab93bdc024ad8b61a871ad2c251bfffe46972657892d8e1e
SHA5127b4298cefd6a39cc83e3b37d51d1eaee94c61c57d8a20605f7326fd68c10931dbb7eed2b637c89e189413426c9a8fbe31d5a7ea3f828a854c6d6bbfb988f4842
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr569027.exeFilesize
175KB
MD5e6396da0fe2c47f7aeff3f6a2bda30c6
SHA124844f553fcae6638e3fba9d1a21f9661aac4be1
SHA25676efbe867e46524dab93bdc024ad8b61a871ad2c251bfffe46972657892d8e1e
SHA5127b4298cefd6a39cc83e3b37d51d1eaee94c61c57d8a20605f7326fd68c10931dbb7eed2b637c89e189413426c9a8fbe31d5a7ea3f828a854c6d6bbfb988f4842
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zirK1586.exeFilesize
380KB
MD50cca360047a18e5d280b29608d5e9842
SHA1badaf626d12c39e380bf84439c2eb73acf1ba529
SHA2562afc25619dd1620480a73b73a8bcb1f8045b2600416199d82c948a603c60ba30
SHA512bfb3f0cb6abb7009f48758bfc5a4274f711973512bf99e7828d1b372021bf96cbdf6b5cf5cc970893c9130ffad0938816079cfb7f84e94765d78c5caddb72c32
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zirK1586.exeFilesize
380KB
MD50cca360047a18e5d280b29608d5e9842
SHA1badaf626d12c39e380bf84439c2eb73acf1ba529
SHA2562afc25619dd1620480a73b73a8bcb1f8045b2600416199d82c948a603c60ba30
SHA512bfb3f0cb6abb7009f48758bfc5a4274f711973512bf99e7828d1b372021bf96cbdf6b5cf5cc970893c9130ffad0938816079cfb7f84e94765d78c5caddb72c32
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr344133.exeFilesize
15KB
MD5b6ea677203afc753b9f1d5d7eb699b52
SHA1a6377e9e25a254e08a2f4d1c42ec4cdffeb45ceb
SHA256442a6e5d8b9421c2f833333bbc5b0691d724a487d1023af25e2d604c387ad446
SHA51278da2732660b1c316cd504a70b2b1697242915be3f0b08bd5b5b4df138cb2467153e9d72ea77c3a715ba85717297ca14e648e395e7e3e0ebce9045c8f3783fab
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr344133.exeFilesize
15KB
MD5b6ea677203afc753b9f1d5d7eb699b52
SHA1a6377e9e25a254e08a2f4d1c42ec4cdffeb45ceb
SHA256442a6e5d8b9421c2f833333bbc5b0691d724a487d1023af25e2d604c387ad446
SHA51278da2732660b1c316cd504a70b2b1697242915be3f0b08bd5b5b4df138cb2467153e9d72ea77c3a715ba85717297ca14e648e395e7e3e0ebce9045c8f3783fab
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku312993.exeFilesize
295KB
MD51e811cd5e7e9f3994dea72f185fbda2b
SHA199b4e905f96cc5c428a2a5dec52ce9e900217c6d
SHA256870ad4b1256afc818274b5acd832faba910f5a9414997ed102c7de859ecd0188
SHA512196c4b2a733d2d51920ed9712a94b57a615ea8af3c742199f77356625b63e64e183d6c6652eb6e79163c3a054a7d6981c3e0dc02b45ebc7047f7a66aafe05637
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku312993.exeFilesize
295KB
MD51e811cd5e7e9f3994dea72f185fbda2b
SHA199b4e905f96cc5c428a2a5dec52ce9e900217c6d
SHA256870ad4b1256afc818274b5acd832faba910f5a9414997ed102c7de859ecd0188
SHA512196c4b2a733d2d51920ed9712a94b57a615ea8af3c742199f77356625b63e64e183d6c6652eb6e79163c3a054a7d6981c3e0dc02b45ebc7047f7a66aafe05637
-
memory/344-1088-0x0000000000A80000-0x0000000000AB2000-memory.dmpFilesize
200KB
-
memory/344-1089-0x00000000056A0000-0x00000000056B0000-memory.dmpFilesize
64KB
-
memory/1088-147-0x0000000000390000-0x000000000039A000-memory.dmpFilesize
40KB
-
memory/4064-185-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4064-197-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4064-155-0x0000000004CA0000-0x0000000005244000-memory.dmpFilesize
5.6MB
-
memory/4064-156-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/4064-157-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/4064-158-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4064-159-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4064-161-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4064-163-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4064-165-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4064-167-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4064-169-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4064-171-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4064-173-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4064-175-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4064-177-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4064-179-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4064-181-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4064-183-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4064-153-0x0000000000770000-0x00000000007BB000-memory.dmpFilesize
300KB
-
memory/4064-187-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4064-189-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4064-191-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4064-193-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4064-195-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4064-154-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/4064-199-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4064-201-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4064-203-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4064-205-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4064-207-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4064-209-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4064-211-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4064-217-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4064-215-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4064-213-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4064-219-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4064-221-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4064-1065-0x0000000005250000-0x0000000005868000-memory.dmpFilesize
6.1MB
-
memory/4064-1066-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/4064-1067-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/4064-1068-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/4064-1069-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/4064-1070-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/4064-1071-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/4064-1073-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/4064-1074-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/4064-1075-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/4064-1077-0x0000000007760000-0x00000000077D6000-memory.dmpFilesize
472KB
-
memory/4064-1078-0x00000000077F0000-0x0000000007840000-memory.dmpFilesize
320KB
-
memory/4064-1080-0x0000000007AC0000-0x0000000007C82000-memory.dmpFilesize
1.8MB
-
memory/4064-1081-0x0000000007E90000-0x00000000083BC000-memory.dmpFilesize
5.2MB