Analysis
-
max time kernel
123s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 21:55
Static task
static1
Behavioral task
behavioral1
Sample
171f1d365c419c8ca3e4d9d494c756aba2353b674691c1947414108541330f47.exe
Resource
win10v2004-20230221-en
General
-
Target
171f1d365c419c8ca3e4d9d494c756aba2353b674691c1947414108541330f47.exe
-
Size
522KB
-
MD5
b6225337dd5189828066809314650109
-
SHA1
abf3058a76fd9ab9d80ea2cbfe8b092d90510c1f
-
SHA256
171f1d365c419c8ca3e4d9d494c756aba2353b674691c1947414108541330f47
-
SHA512
6930c67e0207d36da330a9a72e47c06c8015ccdb6d3528447aac16bedc95b1194f6fe7e9fb45a7de6a4500ccbc7f3f766142b91c2503571c47e966d3ebd183fd
-
SSDEEP
12288:FMrpy904rEl/VvhkirfUzOorhCNJy/O9Md/dbH0L:0y2VJWOUYNs/O9c0L
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr301026.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr301026.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr301026.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr301026.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr301026.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr301026.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr301026.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/1100-158-0x0000000005060000-0x000000000509F000-memory.dmp family_redline behavioral1/memory/1100-159-0x0000000005060000-0x000000000509F000-memory.dmp family_redline behavioral1/memory/1100-161-0x0000000005060000-0x000000000509F000-memory.dmp family_redline behavioral1/memory/1100-165-0x0000000005060000-0x000000000509F000-memory.dmp family_redline behavioral1/memory/1100-163-0x0000000005060000-0x000000000509F000-memory.dmp family_redline behavioral1/memory/1100-167-0x0000000005060000-0x000000000509F000-memory.dmp family_redline behavioral1/memory/1100-169-0x0000000005060000-0x000000000509F000-memory.dmp family_redline behavioral1/memory/1100-171-0x0000000005060000-0x000000000509F000-memory.dmp family_redline behavioral1/memory/1100-173-0x0000000005060000-0x000000000509F000-memory.dmp family_redline behavioral1/memory/1100-175-0x0000000005060000-0x000000000509F000-memory.dmp family_redline behavioral1/memory/1100-177-0x0000000005060000-0x000000000509F000-memory.dmp family_redline behavioral1/memory/1100-179-0x0000000005060000-0x000000000509F000-memory.dmp family_redline behavioral1/memory/1100-181-0x0000000005060000-0x000000000509F000-memory.dmp family_redline behavioral1/memory/1100-183-0x0000000005060000-0x000000000509F000-memory.dmp family_redline behavioral1/memory/1100-185-0x0000000005060000-0x000000000509F000-memory.dmp family_redline behavioral1/memory/1100-187-0x0000000005060000-0x000000000509F000-memory.dmp family_redline behavioral1/memory/1100-189-0x0000000005060000-0x000000000509F000-memory.dmp family_redline behavioral1/memory/1100-191-0x0000000005060000-0x000000000509F000-memory.dmp family_redline behavioral1/memory/1100-193-0x0000000005060000-0x000000000509F000-memory.dmp family_redline behavioral1/memory/1100-195-0x0000000005060000-0x000000000509F000-memory.dmp family_redline behavioral1/memory/1100-197-0x0000000005060000-0x000000000509F000-memory.dmp family_redline behavioral1/memory/1100-199-0x0000000005060000-0x000000000509F000-memory.dmp family_redline behavioral1/memory/1100-201-0x0000000005060000-0x000000000509F000-memory.dmp family_redline behavioral1/memory/1100-203-0x0000000005060000-0x000000000509F000-memory.dmp family_redline behavioral1/memory/1100-205-0x0000000005060000-0x000000000509F000-memory.dmp family_redline behavioral1/memory/1100-207-0x0000000005060000-0x000000000509F000-memory.dmp family_redline behavioral1/memory/1100-209-0x0000000005060000-0x000000000509F000-memory.dmp family_redline behavioral1/memory/1100-211-0x0000000005060000-0x000000000509F000-memory.dmp family_redline behavioral1/memory/1100-213-0x0000000005060000-0x000000000509F000-memory.dmp family_redline behavioral1/memory/1100-215-0x0000000005060000-0x000000000509F000-memory.dmp family_redline behavioral1/memory/1100-217-0x0000000005060000-0x000000000509F000-memory.dmp family_redline behavioral1/memory/1100-219-0x0000000005060000-0x000000000509F000-memory.dmp family_redline behavioral1/memory/1100-221-0x0000000005060000-0x000000000509F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
ziIb0354.exejr301026.exeku242872.exelr627918.exepid process 3184 ziIb0354.exe 3840 jr301026.exe 1100 ku242872.exe 1128 lr627918.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr301026.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr301026.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
171f1d365c419c8ca3e4d9d494c756aba2353b674691c1947414108541330f47.exeziIb0354.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 171f1d365c419c8ca3e4d9d494c756aba2353b674691c1947414108541330f47.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 171f1d365c419c8ca3e4d9d494c756aba2353b674691c1947414108541330f47.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziIb0354.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziIb0354.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 876 1100 WerFault.exe ku242872.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr301026.exeku242872.exelr627918.exepid process 3840 jr301026.exe 3840 jr301026.exe 1100 ku242872.exe 1100 ku242872.exe 1128 lr627918.exe 1128 lr627918.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr301026.exeku242872.exelr627918.exedescription pid process Token: SeDebugPrivilege 3840 jr301026.exe Token: SeDebugPrivilege 1100 ku242872.exe Token: SeDebugPrivilege 1128 lr627918.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
171f1d365c419c8ca3e4d9d494c756aba2353b674691c1947414108541330f47.exeziIb0354.exedescription pid process target process PID 3028 wrote to memory of 3184 3028 171f1d365c419c8ca3e4d9d494c756aba2353b674691c1947414108541330f47.exe ziIb0354.exe PID 3028 wrote to memory of 3184 3028 171f1d365c419c8ca3e4d9d494c756aba2353b674691c1947414108541330f47.exe ziIb0354.exe PID 3028 wrote to memory of 3184 3028 171f1d365c419c8ca3e4d9d494c756aba2353b674691c1947414108541330f47.exe ziIb0354.exe PID 3184 wrote to memory of 3840 3184 ziIb0354.exe jr301026.exe PID 3184 wrote to memory of 3840 3184 ziIb0354.exe jr301026.exe PID 3184 wrote to memory of 1100 3184 ziIb0354.exe ku242872.exe PID 3184 wrote to memory of 1100 3184 ziIb0354.exe ku242872.exe PID 3184 wrote to memory of 1100 3184 ziIb0354.exe ku242872.exe PID 3028 wrote to memory of 1128 3028 171f1d365c419c8ca3e4d9d494c756aba2353b674691c1947414108541330f47.exe lr627918.exe PID 3028 wrote to memory of 1128 3028 171f1d365c419c8ca3e4d9d494c756aba2353b674691c1947414108541330f47.exe lr627918.exe PID 3028 wrote to memory of 1128 3028 171f1d365c419c8ca3e4d9d494c756aba2353b674691c1947414108541330f47.exe lr627918.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\171f1d365c419c8ca3e4d9d494c756aba2353b674691c1947414108541330f47.exe"C:\Users\Admin\AppData\Local\Temp\171f1d365c419c8ca3e4d9d494c756aba2353b674691c1947414108541330f47.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziIb0354.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziIb0354.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr301026.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr301026.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku242872.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku242872.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 19484⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr627918.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr627918.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1100 -ip 11001⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr627918.exeFilesize
175KB
MD5353c7ef9789b6f4bb815f18026dbd071
SHA1a85ecb4558f7877eff56b9a8954bf9f93a16e241
SHA2561e6e95e2bf5709575132a3028a23d83a1021429baf0004afb562e5bff9daeeb3
SHA5126b0860941bac569ce28722bea6a30e2724a299e1e86e29fcebabc7a243598864500c18e963a72721e7d57cbefe70e4c7fb460c38bfe31db52940a611d455bbd6
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr627918.exeFilesize
175KB
MD5353c7ef9789b6f4bb815f18026dbd071
SHA1a85ecb4558f7877eff56b9a8954bf9f93a16e241
SHA2561e6e95e2bf5709575132a3028a23d83a1021429baf0004afb562e5bff9daeeb3
SHA5126b0860941bac569ce28722bea6a30e2724a299e1e86e29fcebabc7a243598864500c18e963a72721e7d57cbefe70e4c7fb460c38bfe31db52940a611d455bbd6
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziIb0354.exeFilesize
380KB
MD58ccf45a74a5da446a35dc431692d6ba6
SHA14960ec6346082f9cfa2838cbf0b9ee81aeab8728
SHA2562e5aad5d1b894bcab153c733934d61432374bf44cc8ce422e9d6421da8d19f86
SHA51243a82d5681a50ff7cb994922183f89bc8fc495cc1c3f127053f35fdaaeeb810725d85b7f719c7b4fecc2a0d5a5ab3bd3d0bfbb995d9187457bac335563430083
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziIb0354.exeFilesize
380KB
MD58ccf45a74a5da446a35dc431692d6ba6
SHA14960ec6346082f9cfa2838cbf0b9ee81aeab8728
SHA2562e5aad5d1b894bcab153c733934d61432374bf44cc8ce422e9d6421da8d19f86
SHA51243a82d5681a50ff7cb994922183f89bc8fc495cc1c3f127053f35fdaaeeb810725d85b7f719c7b4fecc2a0d5a5ab3bd3d0bfbb995d9187457bac335563430083
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr301026.exeFilesize
15KB
MD5d1e68648135d18e827480607b7d91aaf
SHA1ddf855a40ed31f1ffb6f42a9aad925157fc66ac1
SHA256e7ab5d5d1ec4da99812bda6bf83085cc0967177fe0452b9c381681f0df26d784
SHA51269588336ccfc591e0c152a4d9a7a2152f03ce4b34548915d15d6f0a211f436f8e11765fbd80f304c6543dea3f5a9d445e9d137dc07d0844e96c7678a7ceb557e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr301026.exeFilesize
15KB
MD5d1e68648135d18e827480607b7d91aaf
SHA1ddf855a40ed31f1ffb6f42a9aad925157fc66ac1
SHA256e7ab5d5d1ec4da99812bda6bf83085cc0967177fe0452b9c381681f0df26d784
SHA51269588336ccfc591e0c152a4d9a7a2152f03ce4b34548915d15d6f0a211f436f8e11765fbd80f304c6543dea3f5a9d445e9d137dc07d0844e96c7678a7ceb557e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku242872.exeFilesize
295KB
MD520b178c8ce2b7d17ba658ab6eb68c44a
SHA1630d1666e7ec96fb01c3b17bcd53733b5f0b6f11
SHA256a27a42fc4b938b563f7239771cca2b2fc64094c32b84772f3cc36181a00db55e
SHA51224d6f3e98d1d3b74f358c5b72349e41968d998d9cd8a172a88187c20c0a7b42da16536cc7e8cd5bec9d69cdebf034c1ffc56c2bcf64889fe8602323184c3a511
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku242872.exeFilesize
295KB
MD520b178c8ce2b7d17ba658ab6eb68c44a
SHA1630d1666e7ec96fb01c3b17bcd53733b5f0b6f11
SHA256a27a42fc4b938b563f7239771cca2b2fc64094c32b84772f3cc36181a00db55e
SHA51224d6f3e98d1d3b74f358c5b72349e41968d998d9cd8a172a88187c20c0a7b42da16536cc7e8cd5bec9d69cdebf034c1ffc56c2bcf64889fe8602323184c3a511
-
memory/1100-153-0x00000000020F0000-0x000000000213B000-memory.dmpFilesize
300KB
-
memory/1100-154-0x0000000004AB0000-0x0000000005054000-memory.dmpFilesize
5.6MB
-
memory/1100-155-0x0000000004AA0000-0x0000000004AB0000-memory.dmpFilesize
64KB
-
memory/1100-156-0x0000000004AA0000-0x0000000004AB0000-memory.dmpFilesize
64KB
-
memory/1100-157-0x0000000004AA0000-0x0000000004AB0000-memory.dmpFilesize
64KB
-
memory/1100-158-0x0000000005060000-0x000000000509F000-memory.dmpFilesize
252KB
-
memory/1100-159-0x0000000005060000-0x000000000509F000-memory.dmpFilesize
252KB
-
memory/1100-161-0x0000000005060000-0x000000000509F000-memory.dmpFilesize
252KB
-
memory/1100-165-0x0000000005060000-0x000000000509F000-memory.dmpFilesize
252KB
-
memory/1100-163-0x0000000005060000-0x000000000509F000-memory.dmpFilesize
252KB
-
memory/1100-167-0x0000000005060000-0x000000000509F000-memory.dmpFilesize
252KB
-
memory/1100-169-0x0000000005060000-0x000000000509F000-memory.dmpFilesize
252KB
-
memory/1100-171-0x0000000005060000-0x000000000509F000-memory.dmpFilesize
252KB
-
memory/1100-173-0x0000000005060000-0x000000000509F000-memory.dmpFilesize
252KB
-
memory/1100-175-0x0000000005060000-0x000000000509F000-memory.dmpFilesize
252KB
-
memory/1100-177-0x0000000005060000-0x000000000509F000-memory.dmpFilesize
252KB
-
memory/1100-179-0x0000000005060000-0x000000000509F000-memory.dmpFilesize
252KB
-
memory/1100-181-0x0000000005060000-0x000000000509F000-memory.dmpFilesize
252KB
-
memory/1100-183-0x0000000005060000-0x000000000509F000-memory.dmpFilesize
252KB
-
memory/1100-185-0x0000000005060000-0x000000000509F000-memory.dmpFilesize
252KB
-
memory/1100-187-0x0000000005060000-0x000000000509F000-memory.dmpFilesize
252KB
-
memory/1100-189-0x0000000005060000-0x000000000509F000-memory.dmpFilesize
252KB
-
memory/1100-191-0x0000000005060000-0x000000000509F000-memory.dmpFilesize
252KB
-
memory/1100-193-0x0000000005060000-0x000000000509F000-memory.dmpFilesize
252KB
-
memory/1100-195-0x0000000005060000-0x000000000509F000-memory.dmpFilesize
252KB
-
memory/1100-197-0x0000000005060000-0x000000000509F000-memory.dmpFilesize
252KB
-
memory/1100-199-0x0000000005060000-0x000000000509F000-memory.dmpFilesize
252KB
-
memory/1100-201-0x0000000005060000-0x000000000509F000-memory.dmpFilesize
252KB
-
memory/1100-203-0x0000000005060000-0x000000000509F000-memory.dmpFilesize
252KB
-
memory/1100-205-0x0000000005060000-0x000000000509F000-memory.dmpFilesize
252KB
-
memory/1100-207-0x0000000005060000-0x000000000509F000-memory.dmpFilesize
252KB
-
memory/1100-209-0x0000000005060000-0x000000000509F000-memory.dmpFilesize
252KB
-
memory/1100-211-0x0000000005060000-0x000000000509F000-memory.dmpFilesize
252KB
-
memory/1100-213-0x0000000005060000-0x000000000509F000-memory.dmpFilesize
252KB
-
memory/1100-215-0x0000000005060000-0x000000000509F000-memory.dmpFilesize
252KB
-
memory/1100-217-0x0000000005060000-0x000000000509F000-memory.dmpFilesize
252KB
-
memory/1100-219-0x0000000005060000-0x000000000509F000-memory.dmpFilesize
252KB
-
memory/1100-221-0x0000000005060000-0x000000000509F000-memory.dmpFilesize
252KB
-
memory/1100-1065-0x0000000005200000-0x0000000005818000-memory.dmpFilesize
6.1MB
-
memory/1100-1066-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/1100-1067-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/1100-1068-0x0000000004AA0000-0x0000000004AB0000-memory.dmpFilesize
64KB
-
memory/1100-1069-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/1100-1070-0x0000000004AA0000-0x0000000004AB0000-memory.dmpFilesize
64KB
-
memory/1100-1071-0x0000000004AA0000-0x0000000004AB0000-memory.dmpFilesize
64KB
-
memory/1100-1072-0x0000000004AA0000-0x0000000004AB0000-memory.dmpFilesize
64KB
-
memory/1100-1074-0x0000000004AA0000-0x0000000004AB0000-memory.dmpFilesize
64KB
-
memory/1100-1075-0x0000000005CF0000-0x0000000005D56000-memory.dmpFilesize
408KB
-
memory/1100-1076-0x00000000063C0000-0x0000000006452000-memory.dmpFilesize
584KB
-
memory/1100-1077-0x00000000064B0000-0x0000000006672000-memory.dmpFilesize
1.8MB
-
memory/1100-1078-0x0000000006680000-0x0000000006BAC000-memory.dmpFilesize
5.2MB
-
memory/1100-1080-0x0000000007000000-0x0000000007076000-memory.dmpFilesize
472KB
-
memory/1100-1081-0x0000000007080000-0x00000000070D0000-memory.dmpFilesize
320KB
-
memory/1128-1087-0x0000000000380000-0x00000000003B2000-memory.dmpFilesize
200KB
-
memory/1128-1088-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/3840-147-0x0000000000700000-0x000000000070A000-memory.dmpFilesize
40KB