Analysis
-
max time kernel
90s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 21:44
Static task
static1
Behavioral task
behavioral1
Sample
54cc57cc517176acd8b93dde23a4c4d27c1dd7377d3b2cfa9aedc8943b730229.exe
Resource
win10v2004-20230220-en
General
-
Target
54cc57cc517176acd8b93dde23a4c4d27c1dd7377d3b2cfa9aedc8943b730229.exe
-
Size
522KB
-
MD5
d2d3f5fb161c27a8eb293d8e6fa5922d
-
SHA1
a0b53654999f78fc47f3054eabab62d909911d7e
-
SHA256
54cc57cc517176acd8b93dde23a4c4d27c1dd7377d3b2cfa9aedc8943b730229
-
SHA512
b088b65732ab55ff59dfbf8756feed8ca4eabf52827d1e332b59027153281fd4384702d892fe44438a213f7e201c2cbb92acac3fc5bd52ec7c95cc216dd3f24e
-
SSDEEP
12288:8MrDy90iAX9wrRnVJZ5/uaXwJZLO88C42AzWrMY:fy7Y9OB1AJl8T2JrMY
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr261133.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr261133.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr261133.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr261133.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr261133.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr261133.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr261133.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/3436-158-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3436-161-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3436-159-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3436-163-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3436-165-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3436-167-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3436-169-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3436-171-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3436-173-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3436-175-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3436-177-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3436-179-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3436-181-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3436-183-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3436-185-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3436-187-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3436-189-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3436-191-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3436-193-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3436-195-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3436-197-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3436-199-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3436-201-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3436-203-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3436-205-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3436-207-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3436-209-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3436-211-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3436-213-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3436-215-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3436-217-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3436-219-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3436-221-0x0000000002620000-0x000000000265F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
ziUo9304.exejr261133.exeku654780.exelr833494.exepid process 1364 ziUo9304.exe 880 jr261133.exe 3436 ku654780.exe 2360 lr833494.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr261133.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr261133.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
54cc57cc517176acd8b93dde23a4c4d27c1dd7377d3b2cfa9aedc8943b730229.exeziUo9304.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 54cc57cc517176acd8b93dde23a4c4d27c1dd7377d3b2cfa9aedc8943b730229.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziUo9304.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziUo9304.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 54cc57cc517176acd8b93dde23a4c4d27c1dd7377d3b2cfa9aedc8943b730229.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2848 3436 WerFault.exe ku654780.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr261133.exeku654780.exelr833494.exepid process 880 jr261133.exe 880 jr261133.exe 3436 ku654780.exe 3436 ku654780.exe 2360 lr833494.exe 2360 lr833494.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr261133.exeku654780.exelr833494.exedescription pid process Token: SeDebugPrivilege 880 jr261133.exe Token: SeDebugPrivilege 3436 ku654780.exe Token: SeDebugPrivilege 2360 lr833494.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
54cc57cc517176acd8b93dde23a4c4d27c1dd7377d3b2cfa9aedc8943b730229.exeziUo9304.exedescription pid process target process PID 1824 wrote to memory of 1364 1824 54cc57cc517176acd8b93dde23a4c4d27c1dd7377d3b2cfa9aedc8943b730229.exe ziUo9304.exe PID 1824 wrote to memory of 1364 1824 54cc57cc517176acd8b93dde23a4c4d27c1dd7377d3b2cfa9aedc8943b730229.exe ziUo9304.exe PID 1824 wrote to memory of 1364 1824 54cc57cc517176acd8b93dde23a4c4d27c1dd7377d3b2cfa9aedc8943b730229.exe ziUo9304.exe PID 1364 wrote to memory of 880 1364 ziUo9304.exe jr261133.exe PID 1364 wrote to memory of 880 1364 ziUo9304.exe jr261133.exe PID 1364 wrote to memory of 3436 1364 ziUo9304.exe ku654780.exe PID 1364 wrote to memory of 3436 1364 ziUo9304.exe ku654780.exe PID 1364 wrote to memory of 3436 1364 ziUo9304.exe ku654780.exe PID 1824 wrote to memory of 2360 1824 54cc57cc517176acd8b93dde23a4c4d27c1dd7377d3b2cfa9aedc8943b730229.exe lr833494.exe PID 1824 wrote to memory of 2360 1824 54cc57cc517176acd8b93dde23a4c4d27c1dd7377d3b2cfa9aedc8943b730229.exe lr833494.exe PID 1824 wrote to memory of 2360 1824 54cc57cc517176acd8b93dde23a4c4d27c1dd7377d3b2cfa9aedc8943b730229.exe lr833494.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\54cc57cc517176acd8b93dde23a4c4d27c1dd7377d3b2cfa9aedc8943b730229.exe"C:\Users\Admin\AppData\Local\Temp\54cc57cc517176acd8b93dde23a4c4d27c1dd7377d3b2cfa9aedc8943b730229.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziUo9304.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziUo9304.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr261133.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr261133.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku654780.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku654780.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 14524⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr833494.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr833494.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3436 -ip 34361⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr833494.exeFilesize
175KB
MD53c1cc4c2ca4fb963d17119a1964fdc5d
SHA12b4ea2c9fd011562017cf5d08f2821b837ddb641
SHA256b52c41f6fc6d2e55742a43c1e97b3f777df9d2fa3b3d7afc3e4ae67cc6211522
SHA512a95e604ec82dc4235b1b0d3a9f2784c28e48187950c66eab48714fa0902ebc4ee8a6672e4948fa778a69fca5da82cff7097bc65461e1fb52ed28d15771ef462e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr833494.exeFilesize
175KB
MD53c1cc4c2ca4fb963d17119a1964fdc5d
SHA12b4ea2c9fd011562017cf5d08f2821b837ddb641
SHA256b52c41f6fc6d2e55742a43c1e97b3f777df9d2fa3b3d7afc3e4ae67cc6211522
SHA512a95e604ec82dc4235b1b0d3a9f2784c28e48187950c66eab48714fa0902ebc4ee8a6672e4948fa778a69fca5da82cff7097bc65461e1fb52ed28d15771ef462e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziUo9304.exeFilesize
379KB
MD514cda2b294ea0f03fff7559c514a0fb1
SHA1efcd23b2d60553c0996df2afab2b3960aa8e92dd
SHA25613b56f90904f5308c0d5491d8dcd1500995789e3ea685163630f3f0f9454addf
SHA512cd25776ee6c9d046d5316d833bb681cb5f05c5fab77468ede5cd5467c84d70dd6e5d6b57d99610ce3bcdbccd99930613d1adcd376743a6e4c3f4e19cc08c677d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziUo9304.exeFilesize
379KB
MD514cda2b294ea0f03fff7559c514a0fb1
SHA1efcd23b2d60553c0996df2afab2b3960aa8e92dd
SHA25613b56f90904f5308c0d5491d8dcd1500995789e3ea685163630f3f0f9454addf
SHA512cd25776ee6c9d046d5316d833bb681cb5f05c5fab77468ede5cd5467c84d70dd6e5d6b57d99610ce3bcdbccd99930613d1adcd376743a6e4c3f4e19cc08c677d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr261133.exeFilesize
15KB
MD575ca3a7a902685ba47174d786c925c83
SHA1960da2eb583c0372ff33faa56a61fd6e26630d19
SHA256543bad81400fb7acfac26cbd6558df8447ba1e0c927d6ff780311cd2a791ff11
SHA5120b9bf29d288bc7b2963b892158118fb6061232b7efce7916b6ece17d0bf507d0aa430980519121ec34cd2bb6f91ac161daa844103d2e3d2561cf285f461b72a2
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr261133.exeFilesize
15KB
MD575ca3a7a902685ba47174d786c925c83
SHA1960da2eb583c0372ff33faa56a61fd6e26630d19
SHA256543bad81400fb7acfac26cbd6558df8447ba1e0c927d6ff780311cd2a791ff11
SHA5120b9bf29d288bc7b2963b892158118fb6061232b7efce7916b6ece17d0bf507d0aa430980519121ec34cd2bb6f91ac161daa844103d2e3d2561cf285f461b72a2
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku654780.exeFilesize
294KB
MD5bb6e2d35f43166825ce1fa52842fedd3
SHA1d2a949071e875afa4170fafc9170b226e8dee7a2
SHA256a4d1ca033efb7fdc940ac3ba7f1a9f835658a8ff1bb32118953137171ca781e7
SHA5125e9c1a8c5c66f71ac47b74b0e9685f5ca11607bfc536348fd510c04d22b8808206ad0095973e4579d81be344257938db0a5b4e79e4c3e0d42bf5849ba909b759
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku654780.exeFilesize
294KB
MD5bb6e2d35f43166825ce1fa52842fedd3
SHA1d2a949071e875afa4170fafc9170b226e8dee7a2
SHA256a4d1ca033efb7fdc940ac3ba7f1a9f835658a8ff1bb32118953137171ca781e7
SHA5125e9c1a8c5c66f71ac47b74b0e9685f5ca11607bfc536348fd510c04d22b8808206ad0095973e4579d81be344257938db0a5b4e79e4c3e0d42bf5849ba909b759
-
memory/880-147-0x00000000002A0000-0x00000000002AA000-memory.dmpFilesize
40KB
-
memory/2360-1086-0x0000000000BB0000-0x0000000000BE2000-memory.dmpFilesize
200KB
-
memory/2360-1087-0x00000000054A0000-0x00000000054B0000-memory.dmpFilesize
64KB
-
memory/3436-189-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3436-201-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3436-155-0x0000000004C60000-0x0000000004C70000-memory.dmpFilesize
64KB
-
memory/3436-156-0x0000000004C60000-0x0000000004C70000-memory.dmpFilesize
64KB
-
memory/3436-157-0x0000000004C60000-0x0000000004C70000-memory.dmpFilesize
64KB
-
memory/3436-158-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3436-161-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3436-159-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3436-163-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3436-165-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3436-167-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3436-169-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3436-171-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3436-173-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3436-175-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3436-177-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3436-179-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3436-181-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3436-183-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3436-185-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3436-187-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3436-153-0x0000000002040000-0x000000000208B000-memory.dmpFilesize
300KB
-
memory/3436-191-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3436-193-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3436-195-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3436-197-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3436-199-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3436-154-0x0000000004C70000-0x0000000005214000-memory.dmpFilesize
5.6MB
-
memory/3436-203-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3436-205-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3436-207-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3436-209-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3436-211-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3436-213-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3436-215-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3436-217-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3436-219-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3436-221-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3436-1064-0x0000000005220000-0x0000000005838000-memory.dmpFilesize
6.1MB
-
memory/3436-1065-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/3436-1066-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/3436-1067-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/3436-1068-0x0000000004C60000-0x0000000004C70000-memory.dmpFilesize
64KB
-
memory/3436-1070-0x0000000002040000-0x000000000208B000-memory.dmpFilesize
300KB
-
memory/3436-1071-0x0000000004C60000-0x0000000004C70000-memory.dmpFilesize
64KB
-
memory/3436-1072-0x0000000004C60000-0x0000000004C70000-memory.dmpFilesize
64KB
-
memory/3436-1073-0x0000000004C60000-0x0000000004C70000-memory.dmpFilesize
64KB
-
memory/3436-1074-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/3436-1075-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/3436-1076-0x0000000004C60000-0x0000000004C70000-memory.dmpFilesize
64KB
-
memory/3436-1077-0x00000000066F0000-0x00000000068B2000-memory.dmpFilesize
1.8MB
-
memory/3436-1078-0x00000000068D0000-0x0000000006DFC000-memory.dmpFilesize
5.2MB
-
memory/3436-1079-0x0000000007150000-0x00000000071C6000-memory.dmpFilesize
472KB
-
memory/3436-1080-0x00000000071D0000-0x0000000007220000-memory.dmpFilesize
320KB