Analysis
-
max time kernel
97s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 21:32
Static task
static1
Behavioral task
behavioral1
Sample
59b1e4b6c7ce8507201ad0efc47dae1aeb3b4dce0bdd6fb812b0d22a96286f3f.exe
Resource
win10v2004-20230220-en
General
-
Target
59b1e4b6c7ce8507201ad0efc47dae1aeb3b4dce0bdd6fb812b0d22a96286f3f.exe
-
Size
657KB
-
MD5
74f91039a11f45b8e288e526d36d8156
-
SHA1
69080fd73208f6939bceb553aa265bc2f3a3c549
-
SHA256
59b1e4b6c7ce8507201ad0efc47dae1aeb3b4dce0bdd6fb812b0d22a96286f3f
-
SHA512
980c0f986b3d99160bb867980adc453aeeb4fc38f126ec931ee80f9331e09731ab1bb962dafee3030e3c6bb4ec7cad690cf0d8a9c9226c8fd9c8893afa186d56
-
SSDEEP
12288:PMrcy90ZAWnxzEYEgVRjtDhpekef1ULt8UgmRFO44WzWKfQ8vABDlNfO7:zyOn+z+jt9pekef1UhUoFn4PKgBZNG7
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro9711.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro9711.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro9711.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro9711.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro9711.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro9711.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro9711.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/4928-195-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4928-196-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4928-198-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4928-200-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4928-202-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4928-204-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4928-206-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4928-208-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4928-210-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4928-212-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4928-214-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4928-216-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4928-218-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4928-220-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4928-222-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4928-224-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4928-226-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4928-228-0x0000000005050000-0x000000000508F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un227164.exepro9711.exequ0282.exesi078603.exepid process 936 un227164.exe 1892 pro9711.exe 4928 qu0282.exe 448 si078603.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro9711.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro9711.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro9711.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un227164.exe59b1e4b6c7ce8507201ad0efc47dae1aeb3b4dce0bdd6fb812b0d22a96286f3f.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un227164.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 59b1e4b6c7ce8507201ad0efc47dae1aeb3b4dce0bdd6fb812b0d22a96286f3f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 59b1e4b6c7ce8507201ad0efc47dae1aeb3b4dce0bdd6fb812b0d22a96286f3f.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un227164.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4044 1892 WerFault.exe pro9711.exe 1112 4928 WerFault.exe qu0282.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro9711.exequ0282.exesi078603.exepid process 1892 pro9711.exe 1892 pro9711.exe 4928 qu0282.exe 4928 qu0282.exe 448 si078603.exe 448 si078603.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro9711.exequ0282.exesi078603.exedescription pid process Token: SeDebugPrivilege 1892 pro9711.exe Token: SeDebugPrivilege 4928 qu0282.exe Token: SeDebugPrivilege 448 si078603.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
59b1e4b6c7ce8507201ad0efc47dae1aeb3b4dce0bdd6fb812b0d22a96286f3f.exeun227164.exedescription pid process target process PID 1096 wrote to memory of 936 1096 59b1e4b6c7ce8507201ad0efc47dae1aeb3b4dce0bdd6fb812b0d22a96286f3f.exe un227164.exe PID 1096 wrote to memory of 936 1096 59b1e4b6c7ce8507201ad0efc47dae1aeb3b4dce0bdd6fb812b0d22a96286f3f.exe un227164.exe PID 1096 wrote to memory of 936 1096 59b1e4b6c7ce8507201ad0efc47dae1aeb3b4dce0bdd6fb812b0d22a96286f3f.exe un227164.exe PID 936 wrote to memory of 1892 936 un227164.exe pro9711.exe PID 936 wrote to memory of 1892 936 un227164.exe pro9711.exe PID 936 wrote to memory of 1892 936 un227164.exe pro9711.exe PID 936 wrote to memory of 4928 936 un227164.exe qu0282.exe PID 936 wrote to memory of 4928 936 un227164.exe qu0282.exe PID 936 wrote to memory of 4928 936 un227164.exe qu0282.exe PID 1096 wrote to memory of 448 1096 59b1e4b6c7ce8507201ad0efc47dae1aeb3b4dce0bdd6fb812b0d22a96286f3f.exe si078603.exe PID 1096 wrote to memory of 448 1096 59b1e4b6c7ce8507201ad0efc47dae1aeb3b4dce0bdd6fb812b0d22a96286f3f.exe si078603.exe PID 1096 wrote to memory of 448 1096 59b1e4b6c7ce8507201ad0efc47dae1aeb3b4dce0bdd6fb812b0d22a96286f3f.exe si078603.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\59b1e4b6c7ce8507201ad0efc47dae1aeb3b4dce0bdd6fb812b0d22a96286f3f.exe"C:\Users\Admin\AppData\Local\Temp\59b1e4b6c7ce8507201ad0efc47dae1aeb3b4dce0bdd6fb812b0d22a96286f3f.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un227164.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un227164.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9711.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9711.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 10644⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0282.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0282.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 13564⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si078603.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si078603.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1892 -ip 18921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4928 -ip 49281⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si078603.exeFilesize
175KB
MD53df95578fc2f6f109a10f3a806fdf62b
SHA1e3736cd1fd792bfcee7e0dd9639eb07676d96b4e
SHA256640227a96e94c25217afb8834bb391546ddde1022b55265087ca3539705ce766
SHA512488f3cc6207a1bd259947436a1f09dcb4256cb93b23c2a5f13c8f832d2717c8a6986490cfd4806aae69f7303060d302bd0b838fafee467696af8f2eb2b5d4d01
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si078603.exeFilesize
175KB
MD53df95578fc2f6f109a10f3a806fdf62b
SHA1e3736cd1fd792bfcee7e0dd9639eb07676d96b4e
SHA256640227a96e94c25217afb8834bb391546ddde1022b55265087ca3539705ce766
SHA512488f3cc6207a1bd259947436a1f09dcb4256cb93b23c2a5f13c8f832d2717c8a6986490cfd4806aae69f7303060d302bd0b838fafee467696af8f2eb2b5d4d01
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un227164.exeFilesize
515KB
MD5221461d3b4c0682f6166f8bcbc6059ba
SHA134418561689a0aaacb5f90e41b2bed829be732d7
SHA256c9e37b646f98fd4dae40b0d371298f2e0a61ad7310c022db56178b86b2f8ba4a
SHA5120d087759632ed2581390f66b2385cbc05db93ada77894ada7605bfd36879e297233d38fbb319882d38f7c6c0c5065720ee53fa78db1d2ac01e8fac7258166f07
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un227164.exeFilesize
515KB
MD5221461d3b4c0682f6166f8bcbc6059ba
SHA134418561689a0aaacb5f90e41b2bed829be732d7
SHA256c9e37b646f98fd4dae40b0d371298f2e0a61ad7310c022db56178b86b2f8ba4a
SHA5120d087759632ed2581390f66b2385cbc05db93ada77894ada7605bfd36879e297233d38fbb319882d38f7c6c0c5065720ee53fa78db1d2ac01e8fac7258166f07
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9711.exeFilesize
235KB
MD5c3d04a812d2321f1467e3625910f4513
SHA1dd3c6176cb0e32bae17874369b4dff8698b4a1cc
SHA2563e45b5567238d7fde5a789e212a4545dd1571e8e2a3961ea7380f35e6cd70ca8
SHA512c2e7b068e1133c3e3f338e2b2b2f8d7cd8fd17ac5104d502c46b65e47a426fddda271004e11f20e4da3276f731accef6d2ac3e2a7cc1d22c3284fa299a03ebe8
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9711.exeFilesize
235KB
MD5c3d04a812d2321f1467e3625910f4513
SHA1dd3c6176cb0e32bae17874369b4dff8698b4a1cc
SHA2563e45b5567238d7fde5a789e212a4545dd1571e8e2a3961ea7380f35e6cd70ca8
SHA512c2e7b068e1133c3e3f338e2b2b2f8d7cd8fd17ac5104d502c46b65e47a426fddda271004e11f20e4da3276f731accef6d2ac3e2a7cc1d22c3284fa299a03ebe8
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0282.exeFilesize
294KB
MD5196cf1b4ccc0c4a4ac375cfaaecdf3da
SHA18f29907b0256d942cf5662f8c264b3a9347baf59
SHA256a9932820154ded00500a0cda6c780d0f38f20babbbccb54317d76bc1317c9f4f
SHA512826b02ac26145baa09b3b03f5e304437eea69998af918d3008ab4d80fe5d01dd15a0cf1e82a69f3df2d1c72eeb1b21b28eccd28b5463672c374de4edb6e36be5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0282.exeFilesize
294KB
MD5196cf1b4ccc0c4a4ac375cfaaecdf3da
SHA18f29907b0256d942cf5662f8c264b3a9347baf59
SHA256a9932820154ded00500a0cda6c780d0f38f20babbbccb54317d76bc1317c9f4f
SHA512826b02ac26145baa09b3b03f5e304437eea69998af918d3008ab4d80fe5d01dd15a0cf1e82a69f3df2d1c72eeb1b21b28eccd28b5463672c374de4edb6e36be5
-
memory/448-1123-0x0000000000DD0000-0x0000000000E02000-memory.dmpFilesize
200KB
-
memory/448-1124-0x0000000005990000-0x00000000059A0000-memory.dmpFilesize
64KB
-
memory/448-1125-0x0000000005990000-0x00000000059A0000-memory.dmpFilesize
64KB
-
memory/1892-160-0x00000000023A0000-0x00000000023B2000-memory.dmpFilesize
72KB
-
memory/1892-172-0x00000000023A0000-0x00000000023B2000-memory.dmpFilesize
72KB
-
memory/1892-152-0x0000000002400000-0x0000000002410000-memory.dmpFilesize
64KB
-
memory/1892-153-0x00000000023A0000-0x00000000023B2000-memory.dmpFilesize
72KB
-
memory/1892-154-0x00000000023A0000-0x00000000023B2000-memory.dmpFilesize
72KB
-
memory/1892-156-0x00000000023A0000-0x00000000023B2000-memory.dmpFilesize
72KB
-
memory/1892-158-0x00000000023A0000-0x00000000023B2000-memory.dmpFilesize
72KB
-
memory/1892-150-0x0000000002400000-0x0000000002410000-memory.dmpFilesize
64KB
-
memory/1892-162-0x00000000023A0000-0x00000000023B2000-memory.dmpFilesize
72KB
-
memory/1892-164-0x00000000023A0000-0x00000000023B2000-memory.dmpFilesize
72KB
-
memory/1892-166-0x00000000023A0000-0x00000000023B2000-memory.dmpFilesize
72KB
-
memory/1892-168-0x00000000023A0000-0x00000000023B2000-memory.dmpFilesize
72KB
-
memory/1892-170-0x00000000023A0000-0x00000000023B2000-memory.dmpFilesize
72KB
-
memory/1892-151-0x0000000002400000-0x0000000002410000-memory.dmpFilesize
64KB
-
memory/1892-174-0x00000000023A0000-0x00000000023B2000-memory.dmpFilesize
72KB
-
memory/1892-176-0x00000000023A0000-0x00000000023B2000-memory.dmpFilesize
72KB
-
memory/1892-178-0x00000000023A0000-0x00000000023B2000-memory.dmpFilesize
72KB
-
memory/1892-180-0x00000000023A0000-0x00000000023B2000-memory.dmpFilesize
72KB
-
memory/1892-181-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1892-182-0x0000000002400000-0x0000000002410000-memory.dmpFilesize
64KB
-
memory/1892-183-0x0000000002400000-0x0000000002410000-memory.dmpFilesize
64KB
-
memory/1892-184-0x0000000002400000-0x0000000002410000-memory.dmpFilesize
64KB
-
memory/1892-186-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1892-149-0x0000000004C30000-0x00000000051D4000-memory.dmpFilesize
5.6MB
-
memory/1892-148-0x0000000000550000-0x000000000057D000-memory.dmpFilesize
180KB
-
memory/4928-193-0x0000000004A10000-0x0000000004A20000-memory.dmpFilesize
64KB
-
memory/4928-228-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4928-195-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4928-196-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4928-198-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4928-200-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4928-202-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4928-204-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4928-206-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4928-208-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4928-210-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4928-212-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4928-214-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4928-216-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4928-218-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4928-220-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4928-222-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4928-224-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4928-226-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4928-194-0x0000000004A10000-0x0000000004A20000-memory.dmpFilesize
64KB
-
memory/4928-1101-0x0000000005200000-0x0000000005818000-memory.dmpFilesize
6.1MB
-
memory/4928-1102-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/4928-1103-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/4928-1104-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/4928-1105-0x0000000004A10000-0x0000000004A20000-memory.dmpFilesize
64KB
-
memory/4928-1107-0x0000000004A10000-0x0000000004A20000-memory.dmpFilesize
64KB
-
memory/4928-1108-0x0000000004A10000-0x0000000004A20000-memory.dmpFilesize
64KB
-
memory/4928-1109-0x0000000004A10000-0x0000000004A20000-memory.dmpFilesize
64KB
-
memory/4928-1110-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/4928-1111-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/4928-1112-0x0000000004A10000-0x0000000004A20000-memory.dmpFilesize
64KB
-
memory/4928-1113-0x0000000006590000-0x0000000006606000-memory.dmpFilesize
472KB
-
memory/4928-192-0x0000000004A10000-0x0000000004A20000-memory.dmpFilesize
64KB
-
memory/4928-191-0x0000000002100000-0x000000000214B000-memory.dmpFilesize
300KB
-
memory/4928-1114-0x0000000006620000-0x0000000006670000-memory.dmpFilesize
320KB
-
memory/4928-1115-0x00000000067F0000-0x00000000069B2000-memory.dmpFilesize
1.8MB
-
memory/4928-1116-0x00000000069C0000-0x0000000006EEC000-memory.dmpFilesize
5.2MB