Analysis
-
max time kernel
86s -
max time network
90s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
03-04-2023 22:16
Static task
static1
Behavioral task
behavioral1
Sample
82fe30d335b8a82fbf7006c06ae34800b20591ec9d9a2a713ccb612945961b12.exe
Resource
win10-20230220-en
General
-
Target
82fe30d335b8a82fbf7006c06ae34800b20591ec9d9a2a713ccb612945961b12.exe
-
Size
659KB
-
MD5
886331fa489e348c6b06f8cc35c6ed10
-
SHA1
dd7152e9d0c97ec4c029792757356cdd555202d3
-
SHA256
82fe30d335b8a82fbf7006c06ae34800b20591ec9d9a2a713ccb612945961b12
-
SHA512
fdcd58eb8ddfd11ac475110344a8d21589286a71f1f175581cc410d5afdd34e90f790d08e3819966fc1de86a5068233a9f25134d8512748543006a8cf5307d9d
-
SSDEEP
12288:7Mrqy903JyDjJR6WlOvIQLWH2wFftb+t599rwEyXCzfkft/ju0lUz0ch:1yO+JYWWB/w7yt5PHyyzMBb0rh
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro4200.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro4200.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro4200.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro4200.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro4200.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro4200.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/3560-181-0x00000000025D0000-0x0000000002616000-memory.dmp family_redline behavioral1/memory/3560-182-0x0000000005000000-0x0000000005044000-memory.dmp family_redline behavioral1/memory/3560-183-0x0000000005000000-0x000000000503F000-memory.dmp family_redline behavioral1/memory/3560-184-0x0000000005000000-0x000000000503F000-memory.dmp family_redline behavioral1/memory/3560-186-0x0000000005000000-0x000000000503F000-memory.dmp family_redline behavioral1/memory/3560-188-0x0000000005000000-0x000000000503F000-memory.dmp family_redline behavioral1/memory/3560-190-0x0000000005000000-0x000000000503F000-memory.dmp family_redline behavioral1/memory/3560-192-0x0000000005000000-0x000000000503F000-memory.dmp family_redline behavioral1/memory/3560-194-0x0000000005000000-0x000000000503F000-memory.dmp family_redline behavioral1/memory/3560-196-0x0000000005000000-0x000000000503F000-memory.dmp family_redline behavioral1/memory/3560-198-0x0000000005000000-0x000000000503F000-memory.dmp family_redline behavioral1/memory/3560-200-0x0000000005000000-0x000000000503F000-memory.dmp family_redline behavioral1/memory/3560-204-0x0000000005000000-0x000000000503F000-memory.dmp family_redline behavioral1/memory/3560-202-0x0000000005000000-0x000000000503F000-memory.dmp family_redline behavioral1/memory/3560-206-0x0000000005000000-0x000000000503F000-memory.dmp family_redline behavioral1/memory/3560-208-0x0000000005000000-0x000000000503F000-memory.dmp family_redline behavioral1/memory/3560-210-0x0000000005000000-0x000000000503F000-memory.dmp family_redline behavioral1/memory/3560-212-0x0000000005000000-0x000000000503F000-memory.dmp family_redline behavioral1/memory/3560-214-0x0000000005000000-0x000000000503F000-memory.dmp family_redline behavioral1/memory/3560-216-0x0000000005000000-0x000000000503F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un872435.exepro4200.exequ2857.exesi130764.exepid process 2512 un872435.exe 2592 pro4200.exe 3560 qu2857.exe 4704 si130764.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro4200.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro4200.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro4200.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
82fe30d335b8a82fbf7006c06ae34800b20591ec9d9a2a713ccb612945961b12.exeun872435.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 82fe30d335b8a82fbf7006c06ae34800b20591ec9d9a2a713ccb612945961b12.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 82fe30d335b8a82fbf7006c06ae34800b20591ec9d9a2a713ccb612945961b12.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un872435.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un872435.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro4200.exequ2857.exesi130764.exepid process 2592 pro4200.exe 2592 pro4200.exe 3560 qu2857.exe 3560 qu2857.exe 4704 si130764.exe 4704 si130764.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro4200.exequ2857.exesi130764.exedescription pid process Token: SeDebugPrivilege 2592 pro4200.exe Token: SeDebugPrivilege 3560 qu2857.exe Token: SeDebugPrivilege 4704 si130764.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
82fe30d335b8a82fbf7006c06ae34800b20591ec9d9a2a713ccb612945961b12.exeun872435.exedescription pid process target process PID 2476 wrote to memory of 2512 2476 82fe30d335b8a82fbf7006c06ae34800b20591ec9d9a2a713ccb612945961b12.exe un872435.exe PID 2476 wrote to memory of 2512 2476 82fe30d335b8a82fbf7006c06ae34800b20591ec9d9a2a713ccb612945961b12.exe un872435.exe PID 2476 wrote to memory of 2512 2476 82fe30d335b8a82fbf7006c06ae34800b20591ec9d9a2a713ccb612945961b12.exe un872435.exe PID 2512 wrote to memory of 2592 2512 un872435.exe pro4200.exe PID 2512 wrote to memory of 2592 2512 un872435.exe pro4200.exe PID 2512 wrote to memory of 2592 2512 un872435.exe pro4200.exe PID 2512 wrote to memory of 3560 2512 un872435.exe qu2857.exe PID 2512 wrote to memory of 3560 2512 un872435.exe qu2857.exe PID 2512 wrote to memory of 3560 2512 un872435.exe qu2857.exe PID 2476 wrote to memory of 4704 2476 82fe30d335b8a82fbf7006c06ae34800b20591ec9d9a2a713ccb612945961b12.exe si130764.exe PID 2476 wrote to memory of 4704 2476 82fe30d335b8a82fbf7006c06ae34800b20591ec9d9a2a713ccb612945961b12.exe si130764.exe PID 2476 wrote to memory of 4704 2476 82fe30d335b8a82fbf7006c06ae34800b20591ec9d9a2a713ccb612945961b12.exe si130764.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\82fe30d335b8a82fbf7006c06ae34800b20591ec9d9a2a713ccb612945961b12.exe"C:\Users\Admin\AppData\Local\Temp\82fe30d335b8a82fbf7006c06ae34800b20591ec9d9a2a713ccb612945961b12.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un872435.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un872435.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4200.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4200.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2857.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2857.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si130764.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si130764.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si130764.exeFilesize
175KB
MD574e68842a5bb9b52744341f3d0598a0e
SHA1ba28892f81e0f27cb55bc8e8702eb455c44dece7
SHA25623943e9ad20b260cd8ff3d3919db0e4e4a191b22841aa2fa014c6e13bfa53a15
SHA51255c3539ad4e6bc891f9ca6f6b5590d4a9f444b0c6218153db1dfbf67e33b2472d87b52a3b7cd3122aa6fba02bd5538a93f775db5fffde46896814fb8c4a961d7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si130764.exeFilesize
175KB
MD574e68842a5bb9b52744341f3d0598a0e
SHA1ba28892f81e0f27cb55bc8e8702eb455c44dece7
SHA25623943e9ad20b260cd8ff3d3919db0e4e4a191b22841aa2fa014c6e13bfa53a15
SHA51255c3539ad4e6bc891f9ca6f6b5590d4a9f444b0c6218153db1dfbf67e33b2472d87b52a3b7cd3122aa6fba02bd5538a93f775db5fffde46896814fb8c4a961d7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un872435.exeFilesize
517KB
MD57e364ed61e0d939078e24a28d1409d14
SHA125346fdd59f22024c135a3c27f0721eaf89b4406
SHA256ab64c314e680f0067974b468c5913fee0688deec5a7feee3a339d849d1845640
SHA512571b04b2ac0db13c15c2ce76006e894f9db5ba221b18aea66e0f0f72f99b169d54e68e613b373a0e8a8f86c1200d31bdfed258515824b16a038ab26f1bc3b6a9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un872435.exeFilesize
517KB
MD57e364ed61e0d939078e24a28d1409d14
SHA125346fdd59f22024c135a3c27f0721eaf89b4406
SHA256ab64c314e680f0067974b468c5913fee0688deec5a7feee3a339d849d1845640
SHA512571b04b2ac0db13c15c2ce76006e894f9db5ba221b18aea66e0f0f72f99b169d54e68e613b373a0e8a8f86c1200d31bdfed258515824b16a038ab26f1bc3b6a9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4200.exeFilesize
237KB
MD591006ba66ddaecfb606a59d67ed4a844
SHA1091d1d8e02c28fcdbc2310a33dc0abb1ee29e838
SHA2566e3e9e8238065087b414df5819626eadf343252b99ee64e3d241779f4cfdc427
SHA512a35429175775938eaa2979adac1c4ec0d230a3bbda7a54b2bcd2e777c2922153bbd57d8bebe1923b4d92351c6f7864fa71476ab148fd1fd9dc569ed05e564a59
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4200.exeFilesize
237KB
MD591006ba66ddaecfb606a59d67ed4a844
SHA1091d1d8e02c28fcdbc2310a33dc0abb1ee29e838
SHA2566e3e9e8238065087b414df5819626eadf343252b99ee64e3d241779f4cfdc427
SHA512a35429175775938eaa2979adac1c4ec0d230a3bbda7a54b2bcd2e777c2922153bbd57d8bebe1923b4d92351c6f7864fa71476ab148fd1fd9dc569ed05e564a59
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2857.exeFilesize
295KB
MD5ff7f47eb330336c684fce5f7d78115be
SHA13227abe049b69a675a37824c75913eb4cb45063d
SHA256b276d660d870f4e16ed7343f67c151f6d0ccb90fb1716a6fef1426396902b31f
SHA5123d78731c490a5cccc59c8d5b0d8b17f179b3f3dd394fbc1ef1cbfa0bd447027e65f9a07a3ee00a82be2148aac05181dc8ce4b72837edbc609c283628442c45d5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2857.exeFilesize
295KB
MD5ff7f47eb330336c684fce5f7d78115be
SHA13227abe049b69a675a37824c75913eb4cb45063d
SHA256b276d660d870f4e16ed7343f67c151f6d0ccb90fb1716a6fef1426396902b31f
SHA5123d78731c490a5cccc59c8d5b0d8b17f179b3f3dd394fbc1ef1cbfa0bd447027e65f9a07a3ee00a82be2148aac05181dc8ce4b72837edbc609c283628442c45d5
-
memory/2592-136-0x0000000000580000-0x00000000005AD000-memory.dmpFilesize
180KB
-
memory/2592-137-0x0000000000700000-0x000000000071A000-memory.dmpFilesize
104KB
-
memory/2592-138-0x0000000004B80000-0x000000000507E000-memory.dmpFilesize
5.0MB
-
memory/2592-139-0x0000000002250000-0x0000000002268000-memory.dmpFilesize
96KB
-
memory/2592-140-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/2592-141-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/2592-142-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/2592-143-0x0000000002250000-0x0000000002262000-memory.dmpFilesize
72KB
-
memory/2592-144-0x0000000002250000-0x0000000002262000-memory.dmpFilesize
72KB
-
memory/2592-146-0x0000000002250000-0x0000000002262000-memory.dmpFilesize
72KB
-
memory/2592-148-0x0000000002250000-0x0000000002262000-memory.dmpFilesize
72KB
-
memory/2592-150-0x0000000002250000-0x0000000002262000-memory.dmpFilesize
72KB
-
memory/2592-154-0x0000000002250000-0x0000000002262000-memory.dmpFilesize
72KB
-
memory/2592-152-0x0000000002250000-0x0000000002262000-memory.dmpFilesize
72KB
-
memory/2592-156-0x0000000002250000-0x0000000002262000-memory.dmpFilesize
72KB
-
memory/2592-158-0x0000000002250000-0x0000000002262000-memory.dmpFilesize
72KB
-
memory/2592-160-0x0000000002250000-0x0000000002262000-memory.dmpFilesize
72KB
-
memory/2592-162-0x0000000002250000-0x0000000002262000-memory.dmpFilesize
72KB
-
memory/2592-164-0x0000000002250000-0x0000000002262000-memory.dmpFilesize
72KB
-
memory/2592-166-0x0000000002250000-0x0000000002262000-memory.dmpFilesize
72KB
-
memory/2592-168-0x0000000002250000-0x0000000002262000-memory.dmpFilesize
72KB
-
memory/2592-170-0x0000000002250000-0x0000000002262000-memory.dmpFilesize
72KB
-
memory/2592-171-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2592-172-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/2592-173-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/2592-174-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/2592-176-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/3560-181-0x00000000025D0000-0x0000000002616000-memory.dmpFilesize
280KB
-
memory/3560-182-0x0000000005000000-0x0000000005044000-memory.dmpFilesize
272KB
-
memory/3560-183-0x0000000005000000-0x000000000503F000-memory.dmpFilesize
252KB
-
memory/3560-184-0x0000000005000000-0x000000000503F000-memory.dmpFilesize
252KB
-
memory/3560-186-0x0000000005000000-0x000000000503F000-memory.dmpFilesize
252KB
-
memory/3560-188-0x0000000005000000-0x000000000503F000-memory.dmpFilesize
252KB
-
memory/3560-190-0x0000000005000000-0x000000000503F000-memory.dmpFilesize
252KB
-
memory/3560-192-0x0000000005000000-0x000000000503F000-memory.dmpFilesize
252KB
-
memory/3560-194-0x0000000005000000-0x000000000503F000-memory.dmpFilesize
252KB
-
memory/3560-196-0x0000000005000000-0x000000000503F000-memory.dmpFilesize
252KB
-
memory/3560-198-0x0000000005000000-0x000000000503F000-memory.dmpFilesize
252KB
-
memory/3560-200-0x0000000005000000-0x000000000503F000-memory.dmpFilesize
252KB
-
memory/3560-204-0x0000000005000000-0x000000000503F000-memory.dmpFilesize
252KB
-
memory/3560-202-0x0000000005000000-0x000000000503F000-memory.dmpFilesize
252KB
-
memory/3560-206-0x0000000005000000-0x000000000503F000-memory.dmpFilesize
252KB
-
memory/3560-208-0x0000000005000000-0x000000000503F000-memory.dmpFilesize
252KB
-
memory/3560-210-0x0000000005000000-0x000000000503F000-memory.dmpFilesize
252KB
-
memory/3560-212-0x0000000005000000-0x000000000503F000-memory.dmpFilesize
252KB
-
memory/3560-214-0x0000000005000000-0x000000000503F000-memory.dmpFilesize
252KB
-
memory/3560-216-0x0000000005000000-0x000000000503F000-memory.dmpFilesize
252KB
-
memory/3560-300-0x00000000004C0000-0x000000000050B000-memory.dmpFilesize
300KB
-
memory/3560-301-0x0000000002640000-0x0000000002650000-memory.dmpFilesize
64KB
-
memory/3560-303-0x0000000002640000-0x0000000002650000-memory.dmpFilesize
64KB
-
memory/3560-305-0x0000000002640000-0x0000000002650000-memory.dmpFilesize
64KB
-
memory/3560-1093-0x0000000005650000-0x0000000005C56000-memory.dmpFilesize
6.0MB
-
memory/3560-1094-0x0000000005080000-0x000000000518A000-memory.dmpFilesize
1.0MB
-
memory/3560-1095-0x0000000005190000-0x00000000051A2000-memory.dmpFilesize
72KB
-
memory/3560-1096-0x00000000051B0000-0x00000000051EE000-memory.dmpFilesize
248KB
-
memory/3560-1097-0x0000000005300000-0x000000000534B000-memory.dmpFilesize
300KB
-
memory/3560-1098-0x0000000002640000-0x0000000002650000-memory.dmpFilesize
64KB
-
memory/3560-1100-0x0000000005490000-0x00000000054F6000-memory.dmpFilesize
408KB
-
memory/3560-1101-0x0000000002640000-0x0000000002650000-memory.dmpFilesize
64KB
-
memory/3560-1102-0x0000000002640000-0x0000000002650000-memory.dmpFilesize
64KB
-
memory/3560-1103-0x0000000002640000-0x0000000002650000-memory.dmpFilesize
64KB
-
memory/3560-1104-0x0000000006160000-0x00000000061F2000-memory.dmpFilesize
584KB
-
memory/3560-1105-0x0000000006220000-0x0000000006296000-memory.dmpFilesize
472KB
-
memory/3560-1106-0x00000000062B0000-0x0000000006300000-memory.dmpFilesize
320KB
-
memory/3560-1107-0x0000000006580000-0x0000000006742000-memory.dmpFilesize
1.8MB
-
memory/3560-1108-0x0000000006750000-0x0000000006C7C000-memory.dmpFilesize
5.2MB
-
memory/3560-1109-0x0000000002640000-0x0000000002650000-memory.dmpFilesize
64KB
-
memory/4704-1115-0x0000000000960000-0x0000000000992000-memory.dmpFilesize
200KB
-
memory/4704-1116-0x00000000053A0000-0x00000000053EB000-memory.dmpFilesize
300KB
-
memory/4704-1117-0x00000000051C0000-0x00000000051D0000-memory.dmpFilesize
64KB