Analysis
-
max time kernel
54s -
max time network
65s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
03-04-2023 21:29
Static task
static1
Behavioral task
behavioral1
Sample
a1d4fe5724856a0a38db575f82735b5bb48e338682f9f118a6197770852534bf.exe
Resource
win10-20230220-en
General
-
Target
a1d4fe5724856a0a38db575f82735b5bb48e338682f9f118a6197770852534bf.exe
-
Size
658KB
-
MD5
e841297ce4c457aeafb1df733baa207e
-
SHA1
da7a411d5cc279a9267ea3b1ece95e1c7dc50a65
-
SHA256
a1d4fe5724856a0a38db575f82735b5bb48e338682f9f118a6197770852534bf
-
SHA512
4f8d292bf9ea8551f95dded9c70a3c8fd58b5d6cf24e12d495887b5c27c2abf3ddc7bb66252b93dfb0b17dfca128c4bac2db7d6787bfbc7562df22a5bc603e41
-
SSDEEP
12288:AMrKy90cYfHDmQDFjUCQUsptwoN8TylrFA1vaLt8g0Ulet44IzWKkk8vJh2N:6yMbtFoJ/ptwoNsvahYueu4BK2h2N
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro1007.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro1007.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro1007.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro1007.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro1007.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro1007.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/4444-178-0x0000000004960000-0x00000000049A6000-memory.dmp family_redline behavioral1/memory/4444-179-0x0000000004F30000-0x0000000004F74000-memory.dmp family_redline behavioral1/memory/4444-180-0x0000000004F30000-0x0000000004F6F000-memory.dmp family_redline behavioral1/memory/4444-181-0x0000000004F30000-0x0000000004F6F000-memory.dmp family_redline behavioral1/memory/4444-183-0x0000000004F30000-0x0000000004F6F000-memory.dmp family_redline behavioral1/memory/4444-185-0x0000000004F30000-0x0000000004F6F000-memory.dmp family_redline behavioral1/memory/4444-187-0x0000000004F30000-0x0000000004F6F000-memory.dmp family_redline behavioral1/memory/4444-189-0x0000000004F30000-0x0000000004F6F000-memory.dmp family_redline behavioral1/memory/4444-191-0x0000000004F30000-0x0000000004F6F000-memory.dmp family_redline behavioral1/memory/4444-193-0x0000000004F30000-0x0000000004F6F000-memory.dmp family_redline behavioral1/memory/4444-195-0x0000000004F30000-0x0000000004F6F000-memory.dmp family_redline behavioral1/memory/4444-197-0x0000000004F30000-0x0000000004F6F000-memory.dmp family_redline behavioral1/memory/4444-199-0x0000000004F30000-0x0000000004F6F000-memory.dmp family_redline behavioral1/memory/4444-201-0x0000000004F30000-0x0000000004F6F000-memory.dmp family_redline behavioral1/memory/4444-203-0x0000000004F30000-0x0000000004F6F000-memory.dmp family_redline behavioral1/memory/4444-205-0x0000000004F30000-0x0000000004F6F000-memory.dmp family_redline behavioral1/memory/4444-207-0x0000000004F30000-0x0000000004F6F000-memory.dmp family_redline behavioral1/memory/4444-209-0x0000000004F30000-0x0000000004F6F000-memory.dmp family_redline behavioral1/memory/4444-211-0x0000000004F30000-0x0000000004F6F000-memory.dmp family_redline behavioral1/memory/4444-213-0x0000000004F30000-0x0000000004F6F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un104793.exepro1007.exequ1773.exesi270364.exepid process 4072 un104793.exe 4128 pro1007.exe 4444 qu1773.exe 3528 si270364.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro1007.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro1007.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro1007.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
a1d4fe5724856a0a38db575f82735b5bb48e338682f9f118a6197770852534bf.exeun104793.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce a1d4fe5724856a0a38db575f82735b5bb48e338682f9f118a6197770852534bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a1d4fe5724856a0a38db575f82735b5bb48e338682f9f118a6197770852534bf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un104793.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un104793.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro1007.exequ1773.exesi270364.exepid process 4128 pro1007.exe 4128 pro1007.exe 4444 qu1773.exe 4444 qu1773.exe 3528 si270364.exe 3528 si270364.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro1007.exequ1773.exesi270364.exedescription pid process Token: SeDebugPrivilege 4128 pro1007.exe Token: SeDebugPrivilege 4444 qu1773.exe Token: SeDebugPrivilege 3528 si270364.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
a1d4fe5724856a0a38db575f82735b5bb48e338682f9f118a6197770852534bf.exeun104793.exedescription pid process target process PID 1736 wrote to memory of 4072 1736 a1d4fe5724856a0a38db575f82735b5bb48e338682f9f118a6197770852534bf.exe un104793.exe PID 1736 wrote to memory of 4072 1736 a1d4fe5724856a0a38db575f82735b5bb48e338682f9f118a6197770852534bf.exe un104793.exe PID 1736 wrote to memory of 4072 1736 a1d4fe5724856a0a38db575f82735b5bb48e338682f9f118a6197770852534bf.exe un104793.exe PID 4072 wrote to memory of 4128 4072 un104793.exe pro1007.exe PID 4072 wrote to memory of 4128 4072 un104793.exe pro1007.exe PID 4072 wrote to memory of 4128 4072 un104793.exe pro1007.exe PID 4072 wrote to memory of 4444 4072 un104793.exe qu1773.exe PID 4072 wrote to memory of 4444 4072 un104793.exe qu1773.exe PID 4072 wrote to memory of 4444 4072 un104793.exe qu1773.exe PID 1736 wrote to memory of 3528 1736 a1d4fe5724856a0a38db575f82735b5bb48e338682f9f118a6197770852534bf.exe si270364.exe PID 1736 wrote to memory of 3528 1736 a1d4fe5724856a0a38db575f82735b5bb48e338682f9f118a6197770852534bf.exe si270364.exe PID 1736 wrote to memory of 3528 1736 a1d4fe5724856a0a38db575f82735b5bb48e338682f9f118a6197770852534bf.exe si270364.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1d4fe5724856a0a38db575f82735b5bb48e338682f9f118a6197770852534bf.exe"C:\Users\Admin\AppData\Local\Temp\a1d4fe5724856a0a38db575f82735b5bb48e338682f9f118a6197770852534bf.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un104793.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un104793.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1007.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1007.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1773.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1773.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si270364.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si270364.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si270364.exeFilesize
175KB
MD55132b142545d2fba3472c62f4d6a827e
SHA1ad26ee46652eeb31417bf3ef07fdd2a0aeac4b0b
SHA25645030dd0364da401aadb9dba052e3910d1a247958cc773f0f2535218fe1b1457
SHA512c07aeeb36d1a3aa93ed3781a1bff6647623c7b629df2d29bd1782a299425811e049904bbcef61c7a2937bc0ebb49172a08e9027c913f6b15d195c3b811fe597e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si270364.exeFilesize
175KB
MD55132b142545d2fba3472c62f4d6a827e
SHA1ad26ee46652eeb31417bf3ef07fdd2a0aeac4b0b
SHA25645030dd0364da401aadb9dba052e3910d1a247958cc773f0f2535218fe1b1457
SHA512c07aeeb36d1a3aa93ed3781a1bff6647623c7b629df2d29bd1782a299425811e049904bbcef61c7a2937bc0ebb49172a08e9027c913f6b15d195c3b811fe597e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un104793.exeFilesize
516KB
MD50281e9a0aa0a96dac9eb805d2a46823c
SHA1fd6d2f04bddcc0ba307e8a611f8bdb466739162c
SHA25666ecdb6b6ced3b253d162d1175677a0fab962177578532127d827ec0bdf11fef
SHA512daabae660e0ec3a6da7906844ab1846b30b629f35b028e43e0636036c2941a56a7c8e461673e84113a03806cf880d25e9d2e3b223e24ef8fd9b5233af30b3033
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un104793.exeFilesize
516KB
MD50281e9a0aa0a96dac9eb805d2a46823c
SHA1fd6d2f04bddcc0ba307e8a611f8bdb466739162c
SHA25666ecdb6b6ced3b253d162d1175677a0fab962177578532127d827ec0bdf11fef
SHA512daabae660e0ec3a6da7906844ab1846b30b629f35b028e43e0636036c2941a56a7c8e461673e84113a03806cf880d25e9d2e3b223e24ef8fd9b5233af30b3033
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1007.exeFilesize
235KB
MD55242a928e5a3a07627d076f084cce1fb
SHA17202169dcc22fe13cb204da0d21ccf14de3896d1
SHA256b82e24645440986c58ed1ce79c214f68782e5f4d9c82df68403d64a5c77de614
SHA51278e0611657b432230bff55877f8c136599986177919956e2f5dca87b9bada5b1503280e980d244bbf22ed10bd17ee7f7d33b0b1d2719db4883429b2bd342c57e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1007.exeFilesize
235KB
MD55242a928e5a3a07627d076f084cce1fb
SHA17202169dcc22fe13cb204da0d21ccf14de3896d1
SHA256b82e24645440986c58ed1ce79c214f68782e5f4d9c82df68403d64a5c77de614
SHA51278e0611657b432230bff55877f8c136599986177919956e2f5dca87b9bada5b1503280e980d244bbf22ed10bd17ee7f7d33b0b1d2719db4883429b2bd342c57e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1773.exeFilesize
294KB
MD5e2bcd5f95a30f98d5533cc4040c3a13a
SHA1d2a1d356c183084b23dc480010c551406fc7fcb5
SHA2563a0c45a4746cb4e0a4f5a2dd90adc4b5066fa2f3793491006fa992a59d4987f6
SHA512e924daf24e34dcd25ad722e0cef01f505b66cb98c4b1b1344f62188ab6e47e3b212aafa7194d387eb403d7ead25e5e76e747d4da5c07676fc2aedb0a2bfa3bd0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1773.exeFilesize
294KB
MD5e2bcd5f95a30f98d5533cc4040c3a13a
SHA1d2a1d356c183084b23dc480010c551406fc7fcb5
SHA2563a0c45a4746cb4e0a4f5a2dd90adc4b5066fa2f3793491006fa992a59d4987f6
SHA512e924daf24e34dcd25ad722e0cef01f505b66cb98c4b1b1344f62188ab6e47e3b212aafa7194d387eb403d7ead25e5e76e747d4da5c07676fc2aedb0a2bfa3bd0
-
memory/3528-1112-0x00000000001E0000-0x0000000000212000-memory.dmpFilesize
200KB
-
memory/3528-1113-0x0000000004D20000-0x0000000004D30000-memory.dmpFilesize
64KB
-
memory/3528-1114-0x0000000004C20000-0x0000000004C6B000-memory.dmpFilesize
300KB
-
memory/4128-143-0x00000000021D0000-0x00000000021E2000-memory.dmpFilesize
72KB
-
memory/4128-157-0x00000000021D0000-0x00000000021E2000-memory.dmpFilesize
72KB
-
memory/4128-139-0x0000000004D30000-0x0000000004D40000-memory.dmpFilesize
64KB
-
memory/4128-140-0x0000000004D40000-0x000000000523E000-memory.dmpFilesize
5.0MB
-
memory/4128-141-0x00000000021D0000-0x00000000021E8000-memory.dmpFilesize
96KB
-
memory/4128-142-0x00000000021D0000-0x00000000021E2000-memory.dmpFilesize
72KB
-
memory/4128-145-0x00000000021D0000-0x00000000021E2000-memory.dmpFilesize
72KB
-
memory/4128-137-0x0000000004D30000-0x0000000004D40000-memory.dmpFilesize
64KB
-
memory/4128-147-0x00000000021D0000-0x00000000021E2000-memory.dmpFilesize
72KB
-
memory/4128-149-0x00000000021D0000-0x00000000021E2000-memory.dmpFilesize
72KB
-
memory/4128-151-0x00000000021D0000-0x00000000021E2000-memory.dmpFilesize
72KB
-
memory/4128-153-0x00000000021D0000-0x00000000021E2000-memory.dmpFilesize
72KB
-
memory/4128-155-0x00000000021D0000-0x00000000021E2000-memory.dmpFilesize
72KB
-
memory/4128-138-0x0000000004D30000-0x0000000004D40000-memory.dmpFilesize
64KB
-
memory/4128-159-0x00000000021D0000-0x00000000021E2000-memory.dmpFilesize
72KB
-
memory/4128-161-0x00000000021D0000-0x00000000021E2000-memory.dmpFilesize
72KB
-
memory/4128-163-0x00000000021D0000-0x00000000021E2000-memory.dmpFilesize
72KB
-
memory/4128-165-0x00000000021D0000-0x00000000021E2000-memory.dmpFilesize
72KB
-
memory/4128-167-0x00000000021D0000-0x00000000021E2000-memory.dmpFilesize
72KB
-
memory/4128-169-0x00000000021D0000-0x00000000021E2000-memory.dmpFilesize
72KB
-
memory/4128-170-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4128-171-0x0000000004D30000-0x0000000004D40000-memory.dmpFilesize
64KB
-
memory/4128-173-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4128-136-0x00000000001D0000-0x00000000001FD000-memory.dmpFilesize
180KB
-
memory/4128-135-0x0000000000760000-0x000000000077A000-memory.dmpFilesize
104KB
-
memory/4444-183-0x0000000004F30000-0x0000000004F6F000-memory.dmpFilesize
252KB
-
memory/4444-273-0x00000000049B0000-0x00000000049C0000-memory.dmpFilesize
64KB
-
memory/4444-180-0x0000000004F30000-0x0000000004F6F000-memory.dmpFilesize
252KB
-
memory/4444-185-0x0000000004F30000-0x0000000004F6F000-memory.dmpFilesize
252KB
-
memory/4444-187-0x0000000004F30000-0x0000000004F6F000-memory.dmpFilesize
252KB
-
memory/4444-189-0x0000000004F30000-0x0000000004F6F000-memory.dmpFilesize
252KB
-
memory/4444-191-0x0000000004F30000-0x0000000004F6F000-memory.dmpFilesize
252KB
-
memory/4444-193-0x0000000004F30000-0x0000000004F6F000-memory.dmpFilesize
252KB
-
memory/4444-195-0x0000000004F30000-0x0000000004F6F000-memory.dmpFilesize
252KB
-
memory/4444-197-0x0000000004F30000-0x0000000004F6F000-memory.dmpFilesize
252KB
-
memory/4444-199-0x0000000004F30000-0x0000000004F6F000-memory.dmpFilesize
252KB
-
memory/4444-201-0x0000000004F30000-0x0000000004F6F000-memory.dmpFilesize
252KB
-
memory/4444-203-0x0000000004F30000-0x0000000004F6F000-memory.dmpFilesize
252KB
-
memory/4444-205-0x0000000004F30000-0x0000000004F6F000-memory.dmpFilesize
252KB
-
memory/4444-207-0x0000000004F30000-0x0000000004F6F000-memory.dmpFilesize
252KB
-
memory/4444-209-0x0000000004F30000-0x0000000004F6F000-memory.dmpFilesize
252KB
-
memory/4444-211-0x0000000004F30000-0x0000000004F6F000-memory.dmpFilesize
252KB
-
memory/4444-213-0x0000000004F30000-0x0000000004F6F000-memory.dmpFilesize
252KB
-
memory/4444-269-0x00000000004C0000-0x000000000050B000-memory.dmpFilesize
300KB
-
memory/4444-181-0x0000000004F30000-0x0000000004F6F000-memory.dmpFilesize
252KB
-
memory/4444-271-0x00000000049B0000-0x00000000049C0000-memory.dmpFilesize
64KB
-
memory/4444-275-0x00000000049B0000-0x00000000049C0000-memory.dmpFilesize
64KB
-
memory/4444-1090-0x0000000005720000-0x0000000005D26000-memory.dmpFilesize
6.0MB
-
memory/4444-1091-0x0000000005190000-0x000000000529A000-memory.dmpFilesize
1.0MB
-
memory/4444-1092-0x00000000052D0000-0x00000000052E2000-memory.dmpFilesize
72KB
-
memory/4444-1093-0x00000000052F0000-0x000000000532E000-memory.dmpFilesize
248KB
-
memory/4444-1095-0x00000000049B0000-0x00000000049C0000-memory.dmpFilesize
64KB
-
memory/4444-1094-0x0000000005440000-0x000000000548B000-memory.dmpFilesize
300KB
-
memory/4444-1097-0x00000000049B0000-0x00000000049C0000-memory.dmpFilesize
64KB
-
memory/4444-1098-0x00000000049B0000-0x00000000049C0000-memory.dmpFilesize
64KB
-
memory/4444-1099-0x00000000049B0000-0x00000000049C0000-memory.dmpFilesize
64KB
-
memory/4444-1100-0x00000000055D0000-0x0000000005662000-memory.dmpFilesize
584KB
-
memory/4444-1101-0x0000000005670000-0x00000000056D6000-memory.dmpFilesize
408KB
-
memory/4444-1102-0x00000000065D0000-0x0000000006792000-memory.dmpFilesize
1.8MB
-
memory/4444-1103-0x00000000067B0000-0x0000000006CDC000-memory.dmpFilesize
5.2MB
-
memory/4444-179-0x0000000004F30000-0x0000000004F74000-memory.dmpFilesize
272KB
-
memory/4444-178-0x0000000004960000-0x00000000049A6000-memory.dmpFilesize
280KB
-
memory/4444-1104-0x00000000049B0000-0x00000000049C0000-memory.dmpFilesize
64KB
-
memory/4444-1105-0x0000000006E10000-0x0000000006E86000-memory.dmpFilesize
472KB
-
memory/4444-1106-0x0000000006E90000-0x0000000006EE0000-memory.dmpFilesize
320KB