Analysis
-
max time kernel
80s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 22:04
Static task
static1
Behavioral task
behavioral1
Sample
52f7eb46cf0e251575a1ab282cad1655fc7c85d4733e6dca9daa51a657d98708.exe
Resource
win10v2004-20230220-en
General
-
Target
52f7eb46cf0e251575a1ab282cad1655fc7c85d4733e6dca9daa51a657d98708.exe
-
Size
659KB
-
MD5
675e50000e0627a323c7b31f6e689406
-
SHA1
1b9bddcf60cbaa25b4741bcd9e24dc2f948c0eb6
-
SHA256
52f7eb46cf0e251575a1ab282cad1655fc7c85d4733e6dca9daa51a657d98708
-
SHA512
bfd876cd5187b08e72aadc90e96e78f6e0ac46465052dbebb7e1cddfaae0051fc346650a8797634ef75a69236329bf52546905b131b77100f329726cac937e3d
-
SSDEEP
12288:+MrIy90PQQMlKHbu5M5fDOvIowsf9Qtt597rwlHQCzAgft/ju5b1DszNuKdn:SyuQFlKT0Br9Qtt5NyHdzDBCbepu8n
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro3449.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro3449.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro3449.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro3449.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro3449.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro3449.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro3449.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/112-190-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/112-191-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/112-193-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/112-195-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/112-197-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/112-199-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/112-201-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/112-203-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/112-205-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/112-207-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/112-209-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/112-211-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/112-213-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/112-215-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/112-217-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/112-219-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/112-221-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/112-223-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un019520.exepro3449.exequ5052.exesi730831.exepid process 4456 un019520.exe 1656 pro3449.exe 112 qu5052.exe 3756 si730831.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro3449.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro3449.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro3449.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un019520.exe52f7eb46cf0e251575a1ab282cad1655fc7c85d4733e6dca9daa51a657d98708.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un019520.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 52f7eb46cf0e251575a1ab282cad1655fc7c85d4733e6dca9daa51a657d98708.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 52f7eb46cf0e251575a1ab282cad1655fc7c85d4733e6dca9daa51a657d98708.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un019520.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 836 1656 WerFault.exe pro3449.exe 3264 112 WerFault.exe qu5052.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro3449.exequ5052.exesi730831.exepid process 1656 pro3449.exe 1656 pro3449.exe 112 qu5052.exe 112 qu5052.exe 3756 si730831.exe 3756 si730831.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro3449.exequ5052.exesi730831.exedescription pid process Token: SeDebugPrivilege 1656 pro3449.exe Token: SeDebugPrivilege 112 qu5052.exe Token: SeDebugPrivilege 3756 si730831.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
52f7eb46cf0e251575a1ab282cad1655fc7c85d4733e6dca9daa51a657d98708.exeun019520.exedescription pid process target process PID 4528 wrote to memory of 4456 4528 52f7eb46cf0e251575a1ab282cad1655fc7c85d4733e6dca9daa51a657d98708.exe un019520.exe PID 4528 wrote to memory of 4456 4528 52f7eb46cf0e251575a1ab282cad1655fc7c85d4733e6dca9daa51a657d98708.exe un019520.exe PID 4528 wrote to memory of 4456 4528 52f7eb46cf0e251575a1ab282cad1655fc7c85d4733e6dca9daa51a657d98708.exe un019520.exe PID 4456 wrote to memory of 1656 4456 un019520.exe pro3449.exe PID 4456 wrote to memory of 1656 4456 un019520.exe pro3449.exe PID 4456 wrote to memory of 1656 4456 un019520.exe pro3449.exe PID 4456 wrote to memory of 112 4456 un019520.exe qu5052.exe PID 4456 wrote to memory of 112 4456 un019520.exe qu5052.exe PID 4456 wrote to memory of 112 4456 un019520.exe qu5052.exe PID 4528 wrote to memory of 3756 4528 52f7eb46cf0e251575a1ab282cad1655fc7c85d4733e6dca9daa51a657d98708.exe si730831.exe PID 4528 wrote to memory of 3756 4528 52f7eb46cf0e251575a1ab282cad1655fc7c85d4733e6dca9daa51a657d98708.exe si730831.exe PID 4528 wrote to memory of 3756 4528 52f7eb46cf0e251575a1ab282cad1655fc7c85d4733e6dca9daa51a657d98708.exe si730831.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\52f7eb46cf0e251575a1ab282cad1655fc7c85d4733e6dca9daa51a657d98708.exe"C:\Users\Admin\AppData\Local\Temp\52f7eb46cf0e251575a1ab282cad1655fc7c85d4733e6dca9daa51a657d98708.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un019520.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un019520.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3449.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3449.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1656 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 10844⤵
- Program crash
PID:836 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5052.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5052.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:112 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 112 -s 13364⤵
- Program crash
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si730831.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si730831.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3756
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1656 -ip 16561⤵PID:2744
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 112 -ip 1121⤵PID:3240
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si730831.exeFilesize
175KB
MD5800a33ced6b79777cc6407679b942cbb
SHA132bea86d63b8dbf541fc5ae4235b78b2d382f19f
SHA2563e9a6956ec5f1d63b01d91743339937cdb8390c2b84d84e5f9a4316936d3d8f4
SHA51243dbb762712152b891810d094e6cdc0142fba6a8a49373948760c6f29102b414f78089acebe9451ce885f5cf28e176a58d4ebb8972aacfa3594bf92e5648e3b4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si730831.exeFilesize
175KB
MD5800a33ced6b79777cc6407679b942cbb
SHA132bea86d63b8dbf541fc5ae4235b78b2d382f19f
SHA2563e9a6956ec5f1d63b01d91743339937cdb8390c2b84d84e5f9a4316936d3d8f4
SHA51243dbb762712152b891810d094e6cdc0142fba6a8a49373948760c6f29102b414f78089acebe9451ce885f5cf28e176a58d4ebb8972aacfa3594bf92e5648e3b4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un019520.exeFilesize
517KB
MD5e0e1f4bf924eebddde8fdbf27627f024
SHA12a212114bac7884af1e3fadc5405605d1d6e017d
SHA256298dd435e83a2572a1f0bd2b6b3e0302b577a9477806417d0a1485d667acaca2
SHA51294df9728c0093296c9412cd1d00bcdf3e52bceffded3ccbb378d7501b44ae427342a8a5452f44f7fa3eccf2124f0dd89f1c216db72dce76b379573b18837ae22
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un019520.exeFilesize
517KB
MD5e0e1f4bf924eebddde8fdbf27627f024
SHA12a212114bac7884af1e3fadc5405605d1d6e017d
SHA256298dd435e83a2572a1f0bd2b6b3e0302b577a9477806417d0a1485d667acaca2
SHA51294df9728c0093296c9412cd1d00bcdf3e52bceffded3ccbb378d7501b44ae427342a8a5452f44f7fa3eccf2124f0dd89f1c216db72dce76b379573b18837ae22
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3449.exeFilesize
237KB
MD5a464f680a45e3a9763473e3f054567c8
SHA12236b99c82543701409dad1f71ae78e1bcddfa2f
SHA256e8dd76f6432c3352cd14cc965ae4b6081ca8b911ad6238fa3f7548722318055e
SHA5128b89c1be8d535ab9ad2513f2247e3a7ec22482ad3b88e20c55d263aa1c2c134cdde00bf0ecac2f49c25d94f0f0988d169959dcc96417d2b73a5b5d8b93993a33
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3449.exeFilesize
237KB
MD5a464f680a45e3a9763473e3f054567c8
SHA12236b99c82543701409dad1f71ae78e1bcddfa2f
SHA256e8dd76f6432c3352cd14cc965ae4b6081ca8b911ad6238fa3f7548722318055e
SHA5128b89c1be8d535ab9ad2513f2247e3a7ec22482ad3b88e20c55d263aa1c2c134cdde00bf0ecac2f49c25d94f0f0988d169959dcc96417d2b73a5b5d8b93993a33
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5052.exeFilesize
295KB
MD50b1c671689ba7d23e564c88e27471fe3
SHA13d199b6f3cfb171978f9b5545726d2d95750c21a
SHA25684b6d64b5180c2572326c9f9d0f0f759639ed08b70129c3de06aafce957ec4a0
SHA512b163fb1fe248ffd6475f274dad9199f7aabc9faead186908ac7f45e1b6e471fd67a10adc7af28496c4572577a34cce2a4f43ab8dcb5076b21703ed81e50eb6c3
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5052.exeFilesize
295KB
MD50b1c671689ba7d23e564c88e27471fe3
SHA13d199b6f3cfb171978f9b5545726d2d95750c21a
SHA25684b6d64b5180c2572326c9f9d0f0f759639ed08b70129c3de06aafce957ec4a0
SHA512b163fb1fe248ffd6475f274dad9199f7aabc9faead186908ac7f45e1b6e471fd67a10adc7af28496c4572577a34cce2a4f43ab8dcb5076b21703ed81e50eb6c3
-
memory/112-345-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/112-1102-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/112-1115-0x0000000006BE0000-0x000000000710C000-memory.dmpFilesize
5.2MB
-
memory/112-1114-0x0000000006810000-0x00000000069D2000-memory.dmpFilesize
1.8MB
-
memory/112-1113-0x0000000006790000-0x00000000067E0000-memory.dmpFilesize
320KB
-
memory/112-1112-0x00000000066F0000-0x0000000006766000-memory.dmpFilesize
472KB
-
memory/112-1111-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/112-1110-0x00000000064E0000-0x0000000006572000-memory.dmpFilesize
584KB
-
memory/112-1109-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/112-1108-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/112-1107-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/112-1105-0x0000000005CF0000-0x0000000005D56000-memory.dmpFilesize
408KB
-
memory/112-1104-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/112-1103-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/112-1101-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/112-1100-0x0000000005280000-0x0000000005898000-memory.dmpFilesize
6.1MB
-
memory/112-343-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/112-341-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/112-340-0x0000000002190000-0x00000000021DB000-memory.dmpFilesize
300KB
-
memory/112-223-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/112-221-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/112-219-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/112-190-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/112-191-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/112-193-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/112-195-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/112-197-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/112-199-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/112-201-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/112-203-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/112-205-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/112-207-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/112-209-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/112-211-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/112-213-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/112-215-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/112-217-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1656-173-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/1656-185-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1656-171-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/1656-169-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/1656-182-0x0000000004BE0000-0x0000000004BF0000-memory.dmpFilesize
64KB
-
memory/1656-181-0x0000000004BE0000-0x0000000004BF0000-memory.dmpFilesize
64KB
-
memory/1656-150-0x0000000004BE0000-0x0000000004BF0000-memory.dmpFilesize
64KB
-
memory/1656-180-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1656-179-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/1656-155-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/1656-177-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/1656-175-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/1656-151-0x0000000004BE0000-0x0000000004BF0000-memory.dmpFilesize
64KB
-
memory/1656-153-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/1656-183-0x0000000004BE0000-0x0000000004BF0000-memory.dmpFilesize
64KB
-
memory/1656-167-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/1656-165-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/1656-163-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/1656-161-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/1656-159-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/1656-152-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/1656-157-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/1656-149-0x00000000008B0000-0x00000000008DD000-memory.dmpFilesize
180KB
-
memory/1656-148-0x0000000004BF0000-0x0000000005194000-memory.dmpFilesize
5.6MB
-
memory/3756-1122-0x0000000000910000-0x0000000000942000-memory.dmpFilesize
200KB
-
memory/3756-1123-0x0000000005570000-0x0000000005580000-memory.dmpFilesize
64KB