Analysis
-
max time kernel
86s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 22:18
Static task
static1
Behavioral task
behavioral1
Sample
36feeb896bb81f964e99ac703cf69a2c4d55c56913f1765c18b0a93d3de22717.exe
Resource
win10v2004-20230220-en
General
-
Target
36feeb896bb81f964e99ac703cf69a2c4d55c56913f1765c18b0a93d3de22717.exe
-
Size
659KB
-
MD5
94a9519178c06ec2a4e9a2a504edca01
-
SHA1
d4dbca19176b7cbeb3ef9fdf52541c76e85ae1d8
-
SHA256
36feeb896bb81f964e99ac703cf69a2c4d55c56913f1765c18b0a93d3de22717
-
SHA512
8aa6d19bead713095b59c6b6248ea592db419ce92c1d0f79c37b046de1a3b70c8804ebbefe744088e4b8c97915a2ee7f56bb1eba16b6f541af91d98fab0d2481
-
SSDEEP
12288:DMrky90D/dkh0bbR3xzRUnd8UcgVyYEzst59XrwJbvCZAVft/juN4MKu5N6q:DyI/aK9VRwdzEwt5NubqZMB04MKw0q
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro0478.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro0478.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro0478.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro0478.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro0478.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro0478.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro0478.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/2384-190-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2384-189-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2384-192-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2384-194-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2384-196-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2384-198-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2384-202-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2384-200-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2384-205-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2384-208-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2384-212-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2384-214-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2384-216-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2384-218-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2384-220-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2384-222-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2384-224-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2384-226-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2384-1107-0x0000000004B90000-0x0000000004BA0000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un591900.exepro0478.exequ4160.exesi175564.exepid process 3116 un591900.exe 4804 pro0478.exe 2384 qu4160.exe 4140 si175564.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro0478.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro0478.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro0478.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
36feeb896bb81f964e99ac703cf69a2c4d55c56913f1765c18b0a93d3de22717.exeun591900.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 36feeb896bb81f964e99ac703cf69a2c4d55c56913f1765c18b0a93d3de22717.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un591900.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un591900.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 36feeb896bb81f964e99ac703cf69a2c4d55c56913f1765c18b0a93d3de22717.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3240 4804 WerFault.exe pro0478.exe 836 2384 WerFault.exe qu4160.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro0478.exequ4160.exesi175564.exepid process 4804 pro0478.exe 4804 pro0478.exe 2384 qu4160.exe 2384 qu4160.exe 4140 si175564.exe 4140 si175564.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro0478.exequ4160.exesi175564.exedescription pid process Token: SeDebugPrivilege 4804 pro0478.exe Token: SeDebugPrivilege 2384 qu4160.exe Token: SeDebugPrivilege 4140 si175564.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
36feeb896bb81f964e99ac703cf69a2c4d55c56913f1765c18b0a93d3de22717.exeun591900.exedescription pid process target process PID 4088 wrote to memory of 3116 4088 36feeb896bb81f964e99ac703cf69a2c4d55c56913f1765c18b0a93d3de22717.exe un591900.exe PID 4088 wrote to memory of 3116 4088 36feeb896bb81f964e99ac703cf69a2c4d55c56913f1765c18b0a93d3de22717.exe un591900.exe PID 4088 wrote to memory of 3116 4088 36feeb896bb81f964e99ac703cf69a2c4d55c56913f1765c18b0a93d3de22717.exe un591900.exe PID 3116 wrote to memory of 4804 3116 un591900.exe pro0478.exe PID 3116 wrote to memory of 4804 3116 un591900.exe pro0478.exe PID 3116 wrote to memory of 4804 3116 un591900.exe pro0478.exe PID 3116 wrote to memory of 2384 3116 un591900.exe qu4160.exe PID 3116 wrote to memory of 2384 3116 un591900.exe qu4160.exe PID 3116 wrote to memory of 2384 3116 un591900.exe qu4160.exe PID 4088 wrote to memory of 4140 4088 36feeb896bb81f964e99ac703cf69a2c4d55c56913f1765c18b0a93d3de22717.exe si175564.exe PID 4088 wrote to memory of 4140 4088 36feeb896bb81f964e99ac703cf69a2c4d55c56913f1765c18b0a93d3de22717.exe si175564.exe PID 4088 wrote to memory of 4140 4088 36feeb896bb81f964e99ac703cf69a2c4d55c56913f1765c18b0a93d3de22717.exe si175564.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\36feeb896bb81f964e99ac703cf69a2c4d55c56913f1765c18b0a93d3de22717.exe"C:\Users\Admin\AppData\Local\Temp\36feeb896bb81f964e99ac703cf69a2c4d55c56913f1765c18b0a93d3de22717.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un591900.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un591900.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0478.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0478.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4804 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 10124⤵
- Program crash
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4160.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4160.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2384 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 17964⤵
- Program crash
PID:836 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si175564.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si175564.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4140
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4804 -ip 48041⤵PID:5032
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2384 -ip 23841⤵PID:3696
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si175564.exeFilesize
175KB
MD5b5644c81f66707c6735c71fbf294904b
SHA17a845d0cbc02c80f1de16bae391d3cd71d1f41e7
SHA25674e1c7bd8ca026ec93ed858585f25e5de950685624877294fbc028da2cf1109d
SHA51219d24a6fd641c8f19c2a11ed7a994440329be9e55cc361e3d8aa4982476599c2613947c59d9539a7464688eaf56ff6e417b78018d2433290906b2c40c87d62d5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si175564.exeFilesize
175KB
MD5b5644c81f66707c6735c71fbf294904b
SHA17a845d0cbc02c80f1de16bae391d3cd71d1f41e7
SHA25674e1c7bd8ca026ec93ed858585f25e5de950685624877294fbc028da2cf1109d
SHA51219d24a6fd641c8f19c2a11ed7a994440329be9e55cc361e3d8aa4982476599c2613947c59d9539a7464688eaf56ff6e417b78018d2433290906b2c40c87d62d5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un591900.exeFilesize
517KB
MD532dc3ff3691e094fb4d0db9c2e70f924
SHA1b3087e81a8cdfc651403fe5a7ef26950614589a1
SHA256fd28254c3ead08485663e73ae29000e2710106333d727b0746f5823e5d91bbe1
SHA5121e7fd58c3f84de210a36595cab4fa254a5c1b1a6eac0add0350319504a9b5b87cf8b17d7c3ab302d4a01015c4bbfc28c461dfbde1b077d2987ee5ebf233d42ea
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un591900.exeFilesize
517KB
MD532dc3ff3691e094fb4d0db9c2e70f924
SHA1b3087e81a8cdfc651403fe5a7ef26950614589a1
SHA256fd28254c3ead08485663e73ae29000e2710106333d727b0746f5823e5d91bbe1
SHA5121e7fd58c3f84de210a36595cab4fa254a5c1b1a6eac0add0350319504a9b5b87cf8b17d7c3ab302d4a01015c4bbfc28c461dfbde1b077d2987ee5ebf233d42ea
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0478.exeFilesize
237KB
MD524cb75e728784526b3dcb8e0c0541fae
SHA1fbfe2cb2247012d0f3df60d0e6f2d7e4546b67d1
SHA256a1d8b41fec618a0b45789e5adf016305d7ad1bf58096888451bd9cddee7690e5
SHA512c16aeda227ded6e107ed57e6cab5dde7d1a7054ddaf602a32e43f09e2be60ba532d2bf1077299eb9994a7ca3b9a6833102de047449f518f13687a54c7b7e36c1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0478.exeFilesize
237KB
MD524cb75e728784526b3dcb8e0c0541fae
SHA1fbfe2cb2247012d0f3df60d0e6f2d7e4546b67d1
SHA256a1d8b41fec618a0b45789e5adf016305d7ad1bf58096888451bd9cddee7690e5
SHA512c16aeda227ded6e107ed57e6cab5dde7d1a7054ddaf602a32e43f09e2be60ba532d2bf1077299eb9994a7ca3b9a6833102de047449f518f13687a54c7b7e36c1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4160.exeFilesize
295KB
MD5e3c009dd048b74017ba49119db36dede
SHA1e3dbfd4ddc42f4ce58c02107c77f2a6e80fdc047
SHA256beb2605147c6da7320e74a8cbb038ad8b39279cd753dc9a7bf95755e3423e61f
SHA512f4927f3404b16d65b3dab60eaf3b9311994b7d93be140287033170d291a8bb2cbe9e881b10cc5dca5205620b17dd52c178afdf3cde141508f3a9608ac6530ba2
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4160.exeFilesize
295KB
MD5e3c009dd048b74017ba49119db36dede
SHA1e3dbfd4ddc42f4ce58c02107c77f2a6e80fdc047
SHA256beb2605147c6da7320e74a8cbb038ad8b39279cd753dc9a7bf95755e3423e61f
SHA512f4927f3404b16d65b3dab60eaf3b9311994b7d93be140287033170d291a8bb2cbe9e881b10cc5dca5205620b17dd52c178afdf3cde141508f3a9608ac6530ba2
-
memory/2384-1099-0x0000000005250000-0x0000000005868000-memory.dmpFilesize
6.1MB
-
memory/2384-1102-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/2384-1114-0x0000000008180000-0x00000000081D0000-memory.dmpFilesize
320KB
-
memory/2384-1113-0x0000000008100000-0x0000000008176000-memory.dmpFilesize
472KB
-
memory/2384-1112-0x0000000006790000-0x0000000006CBC000-memory.dmpFilesize
5.2MB
-
memory/2384-1111-0x00000000065B0000-0x0000000006772000-memory.dmpFilesize
1.8MB
-
memory/2384-1110-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/2384-1109-0x00000000063B0000-0x0000000006442000-memory.dmpFilesize
584KB
-
memory/2384-1108-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/2384-1107-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/2384-1106-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/2384-1105-0x0000000005CF0000-0x0000000005D56000-memory.dmpFilesize
408KB
-
memory/2384-1103-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/2384-1101-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/2384-1100-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/2384-226-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2384-224-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2384-222-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2384-220-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2384-218-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2384-216-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2384-190-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2384-189-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2384-192-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2384-194-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2384-196-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2384-198-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2384-202-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2384-200-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2384-205-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2384-204-0x00000000006A0000-0x00000000006EB000-memory.dmpFilesize
300KB
-
memory/2384-207-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/2384-209-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/2384-210-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/2384-208-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2384-212-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2384-214-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/4140-1121-0x0000000000810000-0x0000000000842000-memory.dmpFilesize
200KB
-
memory/4140-1123-0x0000000005460000-0x0000000005470000-memory.dmpFilesize
64KB
-
memory/4140-1122-0x0000000005460000-0x0000000005470000-memory.dmpFilesize
64KB
-
memory/4804-171-0x0000000002550000-0x0000000002562000-memory.dmpFilesize
72KB
-
memory/4804-169-0x0000000002550000-0x0000000002562000-memory.dmpFilesize
72KB
-
memory/4804-180-0x0000000002550000-0x0000000002562000-memory.dmpFilesize
72KB
-
memory/4804-150-0x0000000002550000-0x0000000002562000-memory.dmpFilesize
72KB
-
memory/4804-178-0x0000000002550000-0x0000000002562000-memory.dmpFilesize
72KB
-
memory/4804-175-0x0000000002550000-0x0000000002562000-memory.dmpFilesize
72KB
-
memory/4804-153-0x0000000002550000-0x0000000002562000-memory.dmpFilesize
72KB
-
memory/4804-174-0x0000000004B10000-0x0000000004B20000-memory.dmpFilesize
64KB
-
memory/4804-176-0x0000000004B10000-0x0000000004B20000-memory.dmpFilesize
64KB
-
memory/4804-151-0x0000000002550000-0x0000000002562000-memory.dmpFilesize
72KB
-
memory/4804-172-0x0000000004B10000-0x0000000004B20000-memory.dmpFilesize
64KB
-
memory/4804-181-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4804-167-0x0000000002550000-0x0000000002562000-memory.dmpFilesize
72KB
-
memory/4804-165-0x0000000002550000-0x0000000002562000-memory.dmpFilesize
72KB
-
memory/4804-163-0x0000000002550000-0x0000000002562000-memory.dmpFilesize
72KB
-
memory/4804-161-0x0000000002550000-0x0000000002562000-memory.dmpFilesize
72KB
-
memory/4804-159-0x0000000002550000-0x0000000002562000-memory.dmpFilesize
72KB
-
memory/4804-157-0x0000000002550000-0x0000000002562000-memory.dmpFilesize
72KB
-
memory/4804-149-0x0000000004B20000-0x00000000050C4000-memory.dmpFilesize
5.6MB
-
memory/4804-148-0x0000000000740000-0x000000000076D000-memory.dmpFilesize
180KB
-
memory/4804-182-0x0000000004B10000-0x0000000004B20000-memory.dmpFilesize
64KB
-
memory/4804-184-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4804-155-0x0000000002550000-0x0000000002562000-memory.dmpFilesize
72KB