Analysis
-
max time kernel
55s -
max time network
153s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
03-04-2023 21:40
Static task
static1
Behavioral task
behavioral1
Sample
ac4379f4aede9df2bda5e1d8afe6d7496bc9c401b9d1002da418f1766a389b25.exe
Resource
win10-20230220-en
General
-
Target
ac4379f4aede9df2bda5e1d8afe6d7496bc9c401b9d1002da418f1766a389b25.exe
-
Size
658KB
-
MD5
11706b96882d6a39e32b9788833983ee
-
SHA1
7e957cceffc9bc9230b6aeb66c120592461c3c5c
-
SHA256
ac4379f4aede9df2bda5e1d8afe6d7496bc9c401b9d1002da418f1766a389b25
-
SHA512
c5b91ffeae8b809ee0361fcb8773b4d8e2d627810c7765e816d0044f3b4ccb69adb81f1317144ac9d9622511283c2aaa0ace390a208e5cc3ec89cf6795085f92
-
SSDEEP
12288:VMruy90GCNDipXkQLgJf8EgRtDXZQ85G3Sx644MzWKDk8vqhr:/yhgipXkIkFgRtzayx74FKKp
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro5765.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro5765.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro5765.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro5765.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro5765.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro5765.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/4384-176-0x0000000002440000-0x0000000002486000-memory.dmp family_redline behavioral1/memory/4384-177-0x00000000024D0000-0x0000000002514000-memory.dmp family_redline behavioral1/memory/4384-178-0x00000000024D0000-0x000000000250F000-memory.dmp family_redline behavioral1/memory/4384-179-0x00000000024D0000-0x000000000250F000-memory.dmp family_redline behavioral1/memory/4384-181-0x00000000024D0000-0x000000000250F000-memory.dmp family_redline behavioral1/memory/4384-183-0x00000000024D0000-0x000000000250F000-memory.dmp family_redline behavioral1/memory/4384-185-0x00000000024D0000-0x000000000250F000-memory.dmp family_redline behavioral1/memory/4384-187-0x00000000024D0000-0x000000000250F000-memory.dmp family_redline behavioral1/memory/4384-189-0x00000000024D0000-0x000000000250F000-memory.dmp family_redline behavioral1/memory/4384-192-0x00000000024D0000-0x000000000250F000-memory.dmp family_redline behavioral1/memory/4384-196-0x00000000024D0000-0x000000000250F000-memory.dmp family_redline behavioral1/memory/4384-200-0x00000000024D0000-0x000000000250F000-memory.dmp family_redline behavioral1/memory/4384-202-0x00000000024D0000-0x000000000250F000-memory.dmp family_redline behavioral1/memory/4384-204-0x00000000024D0000-0x000000000250F000-memory.dmp family_redline behavioral1/memory/4384-198-0x00000000024D0000-0x000000000250F000-memory.dmp family_redline behavioral1/memory/4384-206-0x00000000024D0000-0x000000000250F000-memory.dmp family_redline behavioral1/memory/4384-208-0x00000000024D0000-0x000000000250F000-memory.dmp family_redline behavioral1/memory/4384-210-0x00000000024D0000-0x000000000250F000-memory.dmp family_redline behavioral1/memory/4384-212-0x00000000024D0000-0x000000000250F000-memory.dmp family_redline behavioral1/memory/4384-214-0x00000000024D0000-0x000000000250F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un835983.exepro5765.exequ1534.exesi496888.exepid process 4044 un835983.exe 4072 pro5765.exe 4384 qu1534.exe 2856 si496888.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro5765.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro5765.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro5765.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
ac4379f4aede9df2bda5e1d8afe6d7496bc9c401b9d1002da418f1766a389b25.exeun835983.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ac4379f4aede9df2bda5e1d8afe6d7496bc9c401b9d1002da418f1766a389b25.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" ac4379f4aede9df2bda5e1d8afe6d7496bc9c401b9d1002da418f1766a389b25.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un835983.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un835983.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro5765.exequ1534.exesi496888.exepid process 4072 pro5765.exe 4072 pro5765.exe 4384 qu1534.exe 4384 qu1534.exe 2856 si496888.exe 2856 si496888.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro5765.exequ1534.exesi496888.exedescription pid process Token: SeDebugPrivilege 4072 pro5765.exe Token: SeDebugPrivilege 4384 qu1534.exe Token: SeDebugPrivilege 2856 si496888.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
ac4379f4aede9df2bda5e1d8afe6d7496bc9c401b9d1002da418f1766a389b25.exeun835983.exedescription pid process target process PID 3232 wrote to memory of 4044 3232 ac4379f4aede9df2bda5e1d8afe6d7496bc9c401b9d1002da418f1766a389b25.exe un835983.exe PID 3232 wrote to memory of 4044 3232 ac4379f4aede9df2bda5e1d8afe6d7496bc9c401b9d1002da418f1766a389b25.exe un835983.exe PID 3232 wrote to memory of 4044 3232 ac4379f4aede9df2bda5e1d8afe6d7496bc9c401b9d1002da418f1766a389b25.exe un835983.exe PID 4044 wrote to memory of 4072 4044 un835983.exe pro5765.exe PID 4044 wrote to memory of 4072 4044 un835983.exe pro5765.exe PID 4044 wrote to memory of 4072 4044 un835983.exe pro5765.exe PID 4044 wrote to memory of 4384 4044 un835983.exe qu1534.exe PID 4044 wrote to memory of 4384 4044 un835983.exe qu1534.exe PID 4044 wrote to memory of 4384 4044 un835983.exe qu1534.exe PID 3232 wrote to memory of 2856 3232 ac4379f4aede9df2bda5e1d8afe6d7496bc9c401b9d1002da418f1766a389b25.exe si496888.exe PID 3232 wrote to memory of 2856 3232 ac4379f4aede9df2bda5e1d8afe6d7496bc9c401b9d1002da418f1766a389b25.exe si496888.exe PID 3232 wrote to memory of 2856 3232 ac4379f4aede9df2bda5e1d8afe6d7496bc9c401b9d1002da418f1766a389b25.exe si496888.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac4379f4aede9df2bda5e1d8afe6d7496bc9c401b9d1002da418f1766a389b25.exe"C:\Users\Admin\AppData\Local\Temp\ac4379f4aede9df2bda5e1d8afe6d7496bc9c401b9d1002da418f1766a389b25.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un835983.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un835983.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5765.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5765.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1534.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1534.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si496888.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si496888.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si496888.exeFilesize
175KB
MD5d56eacc5f71d775849ef3abb7814cb21
SHA173814a04d53c0d5a9e11a9c724f7957e7e3d9c88
SHA256616cd5b70d356fd3394550a25bb1deb2a9daa0cc118bdf2e04f6c96efaa3ed72
SHA51277ebb9fc3e6755cae226380a5b9b9463ce82a6d2aec60b316d66b75cb8a6e4011b594d6eef3cf3f0179073118ba624a83e7cc2f526d7fb897597d309d8dd2e52
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si496888.exeFilesize
175KB
MD5d56eacc5f71d775849ef3abb7814cb21
SHA173814a04d53c0d5a9e11a9c724f7957e7e3d9c88
SHA256616cd5b70d356fd3394550a25bb1deb2a9daa0cc118bdf2e04f6c96efaa3ed72
SHA51277ebb9fc3e6755cae226380a5b9b9463ce82a6d2aec60b316d66b75cb8a6e4011b594d6eef3cf3f0179073118ba624a83e7cc2f526d7fb897597d309d8dd2e52
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un835983.exeFilesize
516KB
MD530f491bbc065eec220ee83163e6c0df5
SHA192d9b975b35e54e2acb8e7967bc70a6df19f4d5a
SHA256897721873293e37eda07ea0a11b0c389935d9042fc44048db381f55b6e0378fb
SHA512c4c16548c0d59fc218161210685b5c620db18b0ddf1ec21674cad0ced9f682d00e4bbda72337d7b6d7c95b4f8abf4605ba80a0af242a050fb086e955e65863a7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un835983.exeFilesize
516KB
MD530f491bbc065eec220ee83163e6c0df5
SHA192d9b975b35e54e2acb8e7967bc70a6df19f4d5a
SHA256897721873293e37eda07ea0a11b0c389935d9042fc44048db381f55b6e0378fb
SHA512c4c16548c0d59fc218161210685b5c620db18b0ddf1ec21674cad0ced9f682d00e4bbda72337d7b6d7c95b4f8abf4605ba80a0af242a050fb086e955e65863a7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5765.exeFilesize
235KB
MD5f460d779edfdf1ed30191e450c3b9582
SHA13f6efe1f6e01196f30ed5a24ec64cf2d52ca0f5f
SHA25638080d9342692914f33ca75bd456b51f8a71912f0bd1a13ccbdd1bb01328f95b
SHA5126ab5aa2da47b6f5b77594c9c035e73d6b32fc45abb0dc22f6fd2a57867d3355888d110272d59426e4d45b702f1300c9bc24392b15da12a55d8b5861b728a5e9b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5765.exeFilesize
235KB
MD5f460d779edfdf1ed30191e450c3b9582
SHA13f6efe1f6e01196f30ed5a24ec64cf2d52ca0f5f
SHA25638080d9342692914f33ca75bd456b51f8a71912f0bd1a13ccbdd1bb01328f95b
SHA5126ab5aa2da47b6f5b77594c9c035e73d6b32fc45abb0dc22f6fd2a57867d3355888d110272d59426e4d45b702f1300c9bc24392b15da12a55d8b5861b728a5e9b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1534.exeFilesize
294KB
MD5e477dffcda88b15e1120052569474182
SHA142494874922007cc5cab91be6906907028e04ccb
SHA25687d146ea2199f1d0b4a7fe00f045d6521d8a6bc56fa12a6f87aeaa3dce12a122
SHA5126b59abc501db7f4044c14d86ad671a73b9c960a4d476fb330ad98fafc32e659ae6a1cefd79afe3a0db61617ec75b65e2972fd1c0a11be909eea1d087563bf933
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1534.exeFilesize
294KB
MD5e477dffcda88b15e1120052569474182
SHA142494874922007cc5cab91be6906907028e04ccb
SHA25687d146ea2199f1d0b4a7fe00f045d6521d8a6bc56fa12a6f87aeaa3dce12a122
SHA5126b59abc501db7f4044c14d86ad671a73b9c960a4d476fb330ad98fafc32e659ae6a1cefd79afe3a0db61617ec75b65e2972fd1c0a11be909eea1d087563bf933
-
memory/2856-1109-0x0000000000580000-0x00000000005B2000-memory.dmpFilesize
200KB
-
memory/2856-1110-0x0000000004E60000-0x0000000004EAB000-memory.dmpFilesize
300KB
-
memory/2856-1111-0x0000000004DF0000-0x0000000004E00000-memory.dmpFilesize
64KB
-
memory/4072-144-0x00000000021E0000-0x00000000021F2000-memory.dmpFilesize
72KB
-
memory/4072-156-0x00000000021E0000-0x00000000021F2000-memory.dmpFilesize
72KB
-
memory/4072-137-0x0000000004A30000-0x0000000004F2E000-memory.dmpFilesize
5.0MB
-
memory/4072-138-0x00000000021E0000-0x00000000021F8000-memory.dmpFilesize
96KB
-
memory/4072-139-0x00000000021E0000-0x00000000021F2000-memory.dmpFilesize
72KB
-
memory/4072-142-0x00000000021E0000-0x00000000021F2000-memory.dmpFilesize
72KB
-
memory/4072-140-0x00000000021E0000-0x00000000021F2000-memory.dmpFilesize
72KB
-
memory/4072-135-0x00000000007B0000-0x00000000007C0000-memory.dmpFilesize
64KB
-
memory/4072-146-0x00000000021E0000-0x00000000021F2000-memory.dmpFilesize
72KB
-
memory/4072-148-0x00000000021E0000-0x00000000021F2000-memory.dmpFilesize
72KB
-
memory/4072-150-0x00000000021E0000-0x00000000021F2000-memory.dmpFilesize
72KB
-
memory/4072-152-0x00000000021E0000-0x00000000021F2000-memory.dmpFilesize
72KB
-
memory/4072-154-0x00000000021E0000-0x00000000021F2000-memory.dmpFilesize
72KB
-
memory/4072-136-0x00000000007B0000-0x00000000007C0000-memory.dmpFilesize
64KB
-
memory/4072-158-0x00000000021E0000-0x00000000021F2000-memory.dmpFilesize
72KB
-
memory/4072-160-0x00000000021E0000-0x00000000021F2000-memory.dmpFilesize
72KB
-
memory/4072-162-0x00000000021E0000-0x00000000021F2000-memory.dmpFilesize
72KB
-
memory/4072-164-0x00000000021E0000-0x00000000021F2000-memory.dmpFilesize
72KB
-
memory/4072-166-0x00000000021E0000-0x00000000021F2000-memory.dmpFilesize
72KB
-
memory/4072-167-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4072-168-0x00000000007B0000-0x00000000007C0000-memory.dmpFilesize
64KB
-
memory/4072-169-0x00000000007B0000-0x00000000007C0000-memory.dmpFilesize
64KB
-
memory/4072-171-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4072-134-0x00000000007B0000-0x00000000007C0000-memory.dmpFilesize
64KB
-
memory/4072-133-0x00000000001D0000-0x00000000001FD000-memory.dmpFilesize
180KB
-
memory/4072-132-0x0000000002130000-0x000000000214A000-memory.dmpFilesize
104KB
-
memory/4384-181-0x00000000024D0000-0x000000000250F000-memory.dmpFilesize
252KB
-
memory/4384-214-0x00000000024D0000-0x000000000250F000-memory.dmpFilesize
252KB
-
memory/4384-183-0x00000000024D0000-0x000000000250F000-memory.dmpFilesize
252KB
-
memory/4384-185-0x00000000024D0000-0x000000000250F000-memory.dmpFilesize
252KB
-
memory/4384-187-0x00000000024D0000-0x000000000250F000-memory.dmpFilesize
252KB
-
memory/4384-189-0x00000000024D0000-0x000000000250F000-memory.dmpFilesize
252KB
-
memory/4384-191-0x0000000000700000-0x000000000074B000-memory.dmpFilesize
300KB
-
memory/4384-193-0x0000000002520000-0x0000000002530000-memory.dmpFilesize
64KB
-
memory/4384-194-0x0000000002520000-0x0000000002530000-memory.dmpFilesize
64KB
-
memory/4384-192-0x00000000024D0000-0x000000000250F000-memory.dmpFilesize
252KB
-
memory/4384-196-0x00000000024D0000-0x000000000250F000-memory.dmpFilesize
252KB
-
memory/4384-200-0x00000000024D0000-0x000000000250F000-memory.dmpFilesize
252KB
-
memory/4384-202-0x00000000024D0000-0x000000000250F000-memory.dmpFilesize
252KB
-
memory/4384-204-0x00000000024D0000-0x000000000250F000-memory.dmpFilesize
252KB
-
memory/4384-198-0x00000000024D0000-0x000000000250F000-memory.dmpFilesize
252KB
-
memory/4384-206-0x00000000024D0000-0x000000000250F000-memory.dmpFilesize
252KB
-
memory/4384-208-0x00000000024D0000-0x000000000250F000-memory.dmpFilesize
252KB
-
memory/4384-210-0x00000000024D0000-0x000000000250F000-memory.dmpFilesize
252KB
-
memory/4384-212-0x00000000024D0000-0x000000000250F000-memory.dmpFilesize
252KB
-
memory/4384-179-0x00000000024D0000-0x000000000250F000-memory.dmpFilesize
252KB
-
memory/4384-1087-0x0000000005720000-0x0000000005D26000-memory.dmpFilesize
6.0MB
-
memory/4384-1088-0x0000000005190000-0x000000000529A000-memory.dmpFilesize
1.0MB
-
memory/4384-1089-0x00000000052D0000-0x00000000052E2000-memory.dmpFilesize
72KB
-
memory/4384-1090-0x0000000002520000-0x0000000002530000-memory.dmpFilesize
64KB
-
memory/4384-1091-0x00000000052F0000-0x000000000532E000-memory.dmpFilesize
248KB
-
memory/4384-1092-0x0000000005440000-0x000000000548B000-memory.dmpFilesize
300KB
-
memory/4384-1094-0x00000000055D0000-0x0000000005662000-memory.dmpFilesize
584KB
-
memory/4384-1095-0x0000000005670000-0x00000000056D6000-memory.dmpFilesize
408KB
-
memory/4384-1096-0x0000000002520000-0x0000000002530000-memory.dmpFilesize
64KB
-
memory/4384-1097-0x0000000002520000-0x0000000002530000-memory.dmpFilesize
64KB
-
memory/4384-1098-0x0000000002520000-0x0000000002530000-memory.dmpFilesize
64KB
-
memory/4384-1099-0x0000000006460000-0x00000000064D6000-memory.dmpFilesize
472KB
-
memory/4384-1100-0x00000000064F0000-0x0000000006540000-memory.dmpFilesize
320KB
-
memory/4384-1101-0x0000000006560000-0x0000000006722000-memory.dmpFilesize
1.8MB
-
memory/4384-178-0x00000000024D0000-0x000000000250F000-memory.dmpFilesize
252KB
-
memory/4384-177-0x00000000024D0000-0x0000000002514000-memory.dmpFilesize
272KB
-
memory/4384-176-0x0000000002440000-0x0000000002486000-memory.dmpFilesize
280KB
-
memory/4384-1102-0x0000000006750000-0x0000000006C7C000-memory.dmpFilesize
5.2MB
-
memory/4384-1103-0x0000000002520000-0x0000000002530000-memory.dmpFilesize
64KB