Analysis
-
max time kernel
86s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 21:29
Static task
static1
Behavioral task
behavioral1
Sample
cde79ccd567208f34feab8c3adb57c490c38d19c08bfd9ee0421c115dda6b83c.exe
Resource
win10v2004-20230221-en
General
-
Target
cde79ccd567208f34feab8c3adb57c490c38d19c08bfd9ee0421c115dda6b83c.exe
-
Size
522KB
-
MD5
1f7049fec0de8df73f585d32242e52f6
-
SHA1
e80ed30d4527c6a790fe0ed2a2eaf3a3ea1d9dc8
-
SHA256
cde79ccd567208f34feab8c3adb57c490c38d19c08bfd9ee0421c115dda6b83c
-
SHA512
42a179759fc60a4074a220a460d66ac68e79c8f422f1d8689cb1854e8e9257093816a874eb86f69baa3896ac100cfd5e1ac56381e5f759ac92b8c81fd9de801d
-
SSDEEP
12288:OMrLy90FjMwNEWYJPv8ze44azWHw5Xv8Je0h2x:9yigmcUzX4jHT5C
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr872358.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr872358.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr872358.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr872358.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr872358.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr872358.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr872358.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/1620-155-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/1620-156-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/1620-158-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/1620-160-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/1620-162-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/1620-165-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/1620-169-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/1620-171-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/1620-173-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/1620-175-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/1620-177-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/1620-179-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/1620-181-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/1620-183-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/1620-185-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/1620-187-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/1620-189-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/1620-191-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/1620-197-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/1620-195-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/1620-199-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/1620-193-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/1620-203-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/1620-205-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/1620-201-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/1620-207-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/1620-209-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/1620-211-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/1620-213-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/1620-215-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/1620-217-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/1620-219-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline behavioral1/memory/1620-221-0x0000000002770000-0x00000000027AF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
ziQE8142.exejr872358.exeku978624.exelr235468.exepid process 2164 ziQE8142.exe 1364 jr872358.exe 1620 ku978624.exe 3112 lr235468.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr872358.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr872358.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
cde79ccd567208f34feab8c3adb57c490c38d19c08bfd9ee0421c115dda6b83c.exeziQE8142.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" cde79ccd567208f34feab8c3adb57c490c38d19c08bfd9ee0421c115dda6b83c.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziQE8142.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziQE8142.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce cde79ccd567208f34feab8c3adb57c490c38d19c08bfd9ee0421c115dda6b83c.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3392 1620 WerFault.exe ku978624.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr872358.exeku978624.exelr235468.exepid process 1364 jr872358.exe 1364 jr872358.exe 1620 ku978624.exe 1620 ku978624.exe 3112 lr235468.exe 3112 lr235468.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr872358.exeku978624.exelr235468.exedescription pid process Token: SeDebugPrivilege 1364 jr872358.exe Token: SeDebugPrivilege 1620 ku978624.exe Token: SeDebugPrivilege 3112 lr235468.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
cde79ccd567208f34feab8c3adb57c490c38d19c08bfd9ee0421c115dda6b83c.exeziQE8142.exedescription pid process target process PID 2092 wrote to memory of 2164 2092 cde79ccd567208f34feab8c3adb57c490c38d19c08bfd9ee0421c115dda6b83c.exe ziQE8142.exe PID 2092 wrote to memory of 2164 2092 cde79ccd567208f34feab8c3adb57c490c38d19c08bfd9ee0421c115dda6b83c.exe ziQE8142.exe PID 2092 wrote to memory of 2164 2092 cde79ccd567208f34feab8c3adb57c490c38d19c08bfd9ee0421c115dda6b83c.exe ziQE8142.exe PID 2164 wrote to memory of 1364 2164 ziQE8142.exe jr872358.exe PID 2164 wrote to memory of 1364 2164 ziQE8142.exe jr872358.exe PID 2164 wrote to memory of 1620 2164 ziQE8142.exe ku978624.exe PID 2164 wrote to memory of 1620 2164 ziQE8142.exe ku978624.exe PID 2164 wrote to memory of 1620 2164 ziQE8142.exe ku978624.exe PID 2092 wrote to memory of 3112 2092 cde79ccd567208f34feab8c3adb57c490c38d19c08bfd9ee0421c115dda6b83c.exe lr235468.exe PID 2092 wrote to memory of 3112 2092 cde79ccd567208f34feab8c3adb57c490c38d19c08bfd9ee0421c115dda6b83c.exe lr235468.exe PID 2092 wrote to memory of 3112 2092 cde79ccd567208f34feab8c3adb57c490c38d19c08bfd9ee0421c115dda6b83c.exe lr235468.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cde79ccd567208f34feab8c3adb57c490c38d19c08bfd9ee0421c115dda6b83c.exe"C:\Users\Admin\AppData\Local\Temp\cde79ccd567208f34feab8c3adb57c490c38d19c08bfd9ee0421c115dda6b83c.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziQE8142.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziQE8142.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr872358.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr872358.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku978624.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku978624.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1620 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 17684⤵
- Program crash
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr235468.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr235468.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3112
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1620 -ip 16201⤵PID:872
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr235468.exeFilesize
175KB
MD56d64dc29cba44df3ac3725a7fe71c04e
SHA11ceea91639b05fe3c3ae8d85cfe2425533fad7a3
SHA256d27d84976d40ba2a118392465bba54c137dea18a7ea4ce664cda728e24522212
SHA5124728296a94c653a142d1e56b982a456d21895890121032a65f0d8cb499fad9aadb8d13a38357bb7e325814fa783612cd36a824919caa6d0e2ff9d474cbfd78f9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr235468.exeFilesize
175KB
MD56d64dc29cba44df3ac3725a7fe71c04e
SHA11ceea91639b05fe3c3ae8d85cfe2425533fad7a3
SHA256d27d84976d40ba2a118392465bba54c137dea18a7ea4ce664cda728e24522212
SHA5124728296a94c653a142d1e56b982a456d21895890121032a65f0d8cb499fad9aadb8d13a38357bb7e325814fa783612cd36a824919caa6d0e2ff9d474cbfd78f9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziQE8142.exeFilesize
380KB
MD5eb052895afa3c0b912d9afadc6474242
SHA1f22f5d02784e6b1e50f209058939d2c967dd4af3
SHA256d87e91b984789f469f44d99f1284f08dc25f82f6f0c3c9d6d2deb5c2e70c0575
SHA512bec3ef51524bc85ae763bcab2e376196ac352d3f29d90c189bd4f7727a8c4a0e715fc6066505484399fa5489c3411b1d89dc9bb0c6742071ace237111ebd24fb
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziQE8142.exeFilesize
380KB
MD5eb052895afa3c0b912d9afadc6474242
SHA1f22f5d02784e6b1e50f209058939d2c967dd4af3
SHA256d87e91b984789f469f44d99f1284f08dc25f82f6f0c3c9d6d2deb5c2e70c0575
SHA512bec3ef51524bc85ae763bcab2e376196ac352d3f29d90c189bd4f7727a8c4a0e715fc6066505484399fa5489c3411b1d89dc9bb0c6742071ace237111ebd24fb
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr872358.exeFilesize
15KB
MD5c5ed91ebb3114edf229b7fe13883a879
SHA12a09d4ca8a409568484c7ac6fbad8d9652b09c86
SHA256975358f120f748b429c43efcadac0c362842d497c99ec87f0ac9cf5be4043333
SHA512b0fecaed62f8bf0626d51e088f8a547668d562e8811e31e44934375e1357b0c2e2fdba5b75e8e228969e56d4ee85d6c0ca7e171bc955cb734a059402cca42f05
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr872358.exeFilesize
15KB
MD5c5ed91ebb3114edf229b7fe13883a879
SHA12a09d4ca8a409568484c7ac6fbad8d9652b09c86
SHA256975358f120f748b429c43efcadac0c362842d497c99ec87f0ac9cf5be4043333
SHA512b0fecaed62f8bf0626d51e088f8a547668d562e8811e31e44934375e1357b0c2e2fdba5b75e8e228969e56d4ee85d6c0ca7e171bc955cb734a059402cca42f05
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku978624.exeFilesize
294KB
MD562d6895ef59703f8a0fe7467706fd03d
SHA16ab7c97a46914fb84849ebfdbc252db91fa00f89
SHA2567f8e25516426b08fb19ebf6b665003d1f53fde93da91be1b77224ac7c8648fd1
SHA512494b1edadf5094d7a5310ee6bbb106d3ef6d5f269d4d4d4a0b035713f08419af801488cefbf5dd7f9c0d8089ca4f153eb2ffac8385a48ad9ea63c87b8d7cd1c4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku978624.exeFilesize
294KB
MD562d6895ef59703f8a0fe7467706fd03d
SHA16ab7c97a46914fb84849ebfdbc252db91fa00f89
SHA2567f8e25516426b08fb19ebf6b665003d1f53fde93da91be1b77224ac7c8648fd1
SHA512494b1edadf5094d7a5310ee6bbb106d3ef6d5f269d4d4d4a0b035713f08419af801488cefbf5dd7f9c0d8089ca4f153eb2ffac8385a48ad9ea63c87b8d7cd1c4
-
memory/1364-147-0x00000000009B0000-0x00000000009BA000-memory.dmpFilesize
40KB
-
memory/1620-153-0x0000000000610000-0x000000000065B000-memory.dmpFilesize
300KB
-
memory/1620-154-0x0000000004B70000-0x0000000005114000-memory.dmpFilesize
5.6MB
-
memory/1620-155-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/1620-156-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/1620-158-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/1620-160-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/1620-162-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/1620-165-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/1620-166-0x0000000002330000-0x0000000002340000-memory.dmpFilesize
64KB
-
memory/1620-164-0x0000000002330000-0x0000000002340000-memory.dmpFilesize
64KB
-
memory/1620-168-0x0000000002330000-0x0000000002340000-memory.dmpFilesize
64KB
-
memory/1620-169-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/1620-171-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/1620-173-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/1620-175-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/1620-177-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/1620-179-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/1620-181-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/1620-183-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/1620-185-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/1620-187-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/1620-189-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/1620-191-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/1620-197-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/1620-195-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/1620-199-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/1620-193-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/1620-203-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/1620-205-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/1620-201-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/1620-207-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/1620-209-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/1620-211-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/1620-213-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/1620-215-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/1620-217-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/1620-219-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/1620-221-0x0000000002770000-0x00000000027AF000-memory.dmpFilesize
252KB
-
memory/1620-1064-0x0000000005220000-0x0000000005838000-memory.dmpFilesize
6.1MB
-
memory/1620-1065-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/1620-1066-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/1620-1067-0x0000000002330000-0x0000000002340000-memory.dmpFilesize
64KB
-
memory/1620-1068-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/1620-1070-0x0000000002330000-0x0000000002340000-memory.dmpFilesize
64KB
-
memory/1620-1071-0x0000000002330000-0x0000000002340000-memory.dmpFilesize
64KB
-
memory/1620-1072-0x0000000002330000-0x0000000002340000-memory.dmpFilesize
64KB
-
memory/1620-1073-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/1620-1074-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/1620-1075-0x00000000065A0000-0x0000000006616000-memory.dmpFilesize
472KB
-
memory/1620-1076-0x0000000006620000-0x0000000006670000-memory.dmpFilesize
320KB
-
memory/1620-1077-0x0000000002330000-0x0000000002340000-memory.dmpFilesize
64KB
-
memory/1620-1078-0x0000000006930000-0x0000000006AF2000-memory.dmpFilesize
1.8MB
-
memory/1620-1079-0x0000000006D00000-0x000000000722C000-memory.dmpFilesize
5.2MB
-
memory/3112-1086-0x00000000006B0000-0x00000000006E2000-memory.dmpFilesize
200KB
-
memory/3112-1087-0x0000000005240000-0x0000000005250000-memory.dmpFilesize
64KB