Analysis
-
max time kernel
63s -
max time network
74s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 21:56
Static task
static1
Behavioral task
behavioral1
Sample
000bec8de0ae1948d1e67e804d03001de815f09341452f82d4d231dddb67955c.exe
Resource
win10v2004-20230220-en
General
-
Target
000bec8de0ae1948d1e67e804d03001de815f09341452f82d4d231dddb67955c.exe
-
Size
522KB
-
MD5
4abeeec82b57adbe2cdc75a5be24b021
-
SHA1
054538c63fc3e1913393d5f57106030016d561e3
-
SHA256
000bec8de0ae1948d1e67e804d03001de815f09341452f82d4d231dddb67955c
-
SHA512
c0409ad16eb62ab91266b858241f2399a63e2120b10a16b14b680231ac6a19f3ccb741a01a306547631b7b243e79ac58ddb417c5ecd23fcb238d3e164c10834c
-
SSDEEP
12288:gMrpy90/qt7yoF7xq4iyYrwmhhC/JhuSSKL:5yiCq4iyYhhY/CSpL
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr334443.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr334443.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr334443.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr334443.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr334443.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr334443.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr334443.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 34 IoCs
Processes:
resource yara_rule behavioral1/memory/3960-156-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3960-159-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3960-157-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3960-161-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3960-163-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3960-165-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3960-168-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3960-171-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3960-173-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3960-175-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3960-177-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3960-179-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3960-181-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3960-183-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3960-185-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3960-187-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3960-189-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3960-191-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3960-193-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3960-195-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3960-197-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3960-199-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3960-201-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3960-203-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3960-205-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3960-207-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3960-209-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3960-211-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3960-213-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3960-215-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3960-217-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3960-219-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3960-221-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3960-1071-0x0000000004B30000-0x0000000004B40000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
ziiY6581.exejr334443.exeku750932.exelr169810.exepid process 4292 ziiY6581.exe 1048 jr334443.exe 3960 ku750932.exe 2904 lr169810.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr334443.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr334443.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
000bec8de0ae1948d1e67e804d03001de815f09341452f82d4d231dddb67955c.exeziiY6581.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 000bec8de0ae1948d1e67e804d03001de815f09341452f82d4d231dddb67955c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 000bec8de0ae1948d1e67e804d03001de815f09341452f82d4d231dddb67955c.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziiY6581.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziiY6581.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1324 3960 WerFault.exe ku750932.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr334443.exeku750932.exelr169810.exepid process 1048 jr334443.exe 1048 jr334443.exe 3960 ku750932.exe 3960 ku750932.exe 2904 lr169810.exe 2904 lr169810.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr334443.exeku750932.exelr169810.exedescription pid process Token: SeDebugPrivilege 1048 jr334443.exe Token: SeDebugPrivilege 3960 ku750932.exe Token: SeDebugPrivilege 2904 lr169810.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
000bec8de0ae1948d1e67e804d03001de815f09341452f82d4d231dddb67955c.exeziiY6581.exedescription pid process target process PID 5040 wrote to memory of 4292 5040 000bec8de0ae1948d1e67e804d03001de815f09341452f82d4d231dddb67955c.exe ziiY6581.exe PID 5040 wrote to memory of 4292 5040 000bec8de0ae1948d1e67e804d03001de815f09341452f82d4d231dddb67955c.exe ziiY6581.exe PID 5040 wrote to memory of 4292 5040 000bec8de0ae1948d1e67e804d03001de815f09341452f82d4d231dddb67955c.exe ziiY6581.exe PID 4292 wrote to memory of 1048 4292 ziiY6581.exe jr334443.exe PID 4292 wrote to memory of 1048 4292 ziiY6581.exe jr334443.exe PID 4292 wrote to memory of 3960 4292 ziiY6581.exe ku750932.exe PID 4292 wrote to memory of 3960 4292 ziiY6581.exe ku750932.exe PID 4292 wrote to memory of 3960 4292 ziiY6581.exe ku750932.exe PID 5040 wrote to memory of 2904 5040 000bec8de0ae1948d1e67e804d03001de815f09341452f82d4d231dddb67955c.exe lr169810.exe PID 5040 wrote to memory of 2904 5040 000bec8de0ae1948d1e67e804d03001de815f09341452f82d4d231dddb67955c.exe lr169810.exe PID 5040 wrote to memory of 2904 5040 000bec8de0ae1948d1e67e804d03001de815f09341452f82d4d231dddb67955c.exe lr169810.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\000bec8de0ae1948d1e67e804d03001de815f09341452f82d4d231dddb67955c.exe"C:\Users\Admin\AppData\Local\Temp\000bec8de0ae1948d1e67e804d03001de815f09341452f82d4d231dddb67955c.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziiY6581.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziiY6581.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr334443.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr334443.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku750932.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku750932.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 13564⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr169810.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr169810.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3960 -ip 39601⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr169810.exeFilesize
175KB
MD5abdfa0f8b83e066a07127b83079bc8d1
SHA140f67319644037b2416cf5dfcce729d0fa3e3f35
SHA256793409e3dd9a8b1685c8002d3868cdac8af07aec5a518b8f3ff0526ae56f1838
SHA512069bbe440e607bc47254a1fa4312033e76e9e7cf90e9ca260130a6e04f8619336d5891b38b74fd827420f52a69e19710553f8d316173953240eb89484a879272
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr169810.exeFilesize
175KB
MD5abdfa0f8b83e066a07127b83079bc8d1
SHA140f67319644037b2416cf5dfcce729d0fa3e3f35
SHA256793409e3dd9a8b1685c8002d3868cdac8af07aec5a518b8f3ff0526ae56f1838
SHA512069bbe440e607bc47254a1fa4312033e76e9e7cf90e9ca260130a6e04f8619336d5891b38b74fd827420f52a69e19710553f8d316173953240eb89484a879272
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziiY6581.exeFilesize
380KB
MD52dfb630eaf2d45cc22479810d639091e
SHA1456c348442cbaf8c81c99104f0d0db1a46a4a679
SHA2565e3c49e4051c1029d95ad22f88cc13cbf5888c11c034a6bf8fd6e72f5fd5aeba
SHA5128a034617ca98d32c96c234de30d174e11962d9c1ecec408c4c4bf920a76740d38568c809c6786d400eb4dbd94fe88f809747b2ecee388b69f08b9adf8f40eccc
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziiY6581.exeFilesize
380KB
MD52dfb630eaf2d45cc22479810d639091e
SHA1456c348442cbaf8c81c99104f0d0db1a46a4a679
SHA2565e3c49e4051c1029d95ad22f88cc13cbf5888c11c034a6bf8fd6e72f5fd5aeba
SHA5128a034617ca98d32c96c234de30d174e11962d9c1ecec408c4c4bf920a76740d38568c809c6786d400eb4dbd94fe88f809747b2ecee388b69f08b9adf8f40eccc
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr334443.exeFilesize
15KB
MD5ed09f295e79d49136d095b44b32ec38b
SHA16036c22d4756d1c84f0134443da61673e8c69b6c
SHA256d0f28a87ab8d3b73257cf213b7e94ed9e55ba29bdbf00d993e19e844925826b8
SHA512bda27de35b4a4cdecbbe6cc4d4d9778f90438b7c45660f882002e2a3284266cc7f9495049d75fcb67cfa13d8c7b2a16e1b3391ca0d27a52644c313cabe844167
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr334443.exeFilesize
15KB
MD5ed09f295e79d49136d095b44b32ec38b
SHA16036c22d4756d1c84f0134443da61673e8c69b6c
SHA256d0f28a87ab8d3b73257cf213b7e94ed9e55ba29bdbf00d993e19e844925826b8
SHA512bda27de35b4a4cdecbbe6cc4d4d9778f90438b7c45660f882002e2a3284266cc7f9495049d75fcb67cfa13d8c7b2a16e1b3391ca0d27a52644c313cabe844167
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku750932.exeFilesize
295KB
MD59e3dab71395e96d4bc5df15f6556e90c
SHA10e7758dab5ddfa026e1875cd73075b530d92a499
SHA256452c15f4a4a3dabb4c32dbbbf0c712044166e505c963a33eca1e9c29c67f1c28
SHA5121613b80b1a7cec25682ff8054208546f532af884b111614f63a93be4e7e26b68238bcc6d76ce24326b9e2442355dc79e58c3de5941f1fbab45eb3a5f357c3fb0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku750932.exeFilesize
295KB
MD59e3dab71395e96d4bc5df15f6556e90c
SHA10e7758dab5ddfa026e1875cd73075b530d92a499
SHA256452c15f4a4a3dabb4c32dbbbf0c712044166e505c963a33eca1e9c29c67f1c28
SHA5121613b80b1a7cec25682ff8054208546f532af884b111614f63a93be4e7e26b68238bcc6d76ce24326b9e2442355dc79e58c3de5941f1fbab45eb3a5f357c3fb0
-
memory/1048-147-0x00000000005F0000-0x00000000005FA000-memory.dmpFilesize
40KB
-
memory/2904-1085-0x00000000001A0000-0x00000000001D2000-memory.dmpFilesize
200KB
-
memory/2904-1086-0x0000000004D20000-0x0000000004D30000-memory.dmpFilesize
64KB
-
memory/2904-1087-0x0000000004D20000-0x0000000004D30000-memory.dmpFilesize
64KB
-
memory/3960-189-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3960-199-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3960-156-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3960-159-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3960-157-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3960-161-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3960-163-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3960-165-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3960-167-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/3960-169-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/3960-168-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3960-171-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3960-173-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3960-175-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3960-177-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3960-179-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3960-181-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3960-183-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3960-185-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3960-187-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3960-154-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/3960-191-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3960-193-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3960-195-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3960-197-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3960-155-0x0000000004B40000-0x00000000050E4000-memory.dmpFilesize
5.6MB
-
memory/3960-201-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3960-203-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3960-205-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3960-207-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3960-209-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3960-211-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3960-213-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3960-215-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3960-217-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3960-219-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3960-221-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3960-1064-0x0000000005200000-0x0000000005818000-memory.dmpFilesize
6.1MB
-
memory/3960-1066-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/3960-1067-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/3960-1068-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/3960-1069-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/3960-1070-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/3960-1071-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/3960-1073-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/3960-1074-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/3960-1075-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/3960-153-0x0000000000620000-0x000000000066B000-memory.dmpFilesize
300KB
-
memory/3960-1076-0x0000000007760000-0x0000000007922000-memory.dmpFilesize
1.8MB
-
memory/3960-1077-0x0000000007940000-0x0000000007E6C000-memory.dmpFilesize
5.2MB
-
memory/3960-1078-0x00000000022B0000-0x0000000002326000-memory.dmpFilesize
472KB
-
memory/3960-1079-0x0000000008090000-0x00000000080E0000-memory.dmpFilesize
320KB