Analysis
-
max time kernel
135s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 22:05
Static task
static1
Behavioral task
behavioral1
Sample
fd09d8d6f1c056bd439f8349d70f79d95b06eda5c2a89f27fb09592f97686b59.exe
Resource
win10v2004-20230220-en
General
-
Target
fd09d8d6f1c056bd439f8349d70f79d95b06eda5c2a89f27fb09592f97686b59.exe
-
Size
660KB
-
MD5
845602cda2ee869e9e19e87fbc818def
-
SHA1
55d69282d6e12cb49448e6e79f11f07f40093ed1
-
SHA256
fd09d8d6f1c056bd439f8349d70f79d95b06eda5c2a89f27fb09592f97686b59
-
SHA512
09670fc76ddb33d3de74ea8a7765e91b612dbe225d547fad2990e3cb3a2bf05927b5da9aaf61ad4896f8a64a4141280a7900fb95d7b142671bb11a42efcea096
-
SSDEEP
12288:pMr4y90RVJDEwytjbNRRS7CDRvay3vaI9t59DrwMntCCDGft/juNXD3Q1G:JyErELN7S7s0ct5hHn0CCBoT/
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro6299.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro6299.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro6299.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro6299.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro6299.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro6299.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro6299.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/3268-190-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/3268-191-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/3268-193-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/3268-195-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/3268-198-0x0000000004B40000-0x0000000004B50000-memory.dmp family_redline behavioral1/memory/3268-200-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/3268-203-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/3268-205-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/3268-207-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/3268-209-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/3268-211-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/3268-213-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/3268-215-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/3268-217-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/3268-219-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/3268-221-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/3268-223-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/3268-225-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/3268-227-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un442932.exepro6299.exequ6666.exesi552683.exepid process 1856 un442932.exe 1544 pro6299.exe 3268 qu6666.exe 2016 si552683.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro6299.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro6299.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro6299.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
fd09d8d6f1c056bd439f8349d70f79d95b06eda5c2a89f27fb09592f97686b59.exeun442932.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce fd09d8d6f1c056bd439f8349d70f79d95b06eda5c2a89f27fb09592f97686b59.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" fd09d8d6f1c056bd439f8349d70f79d95b06eda5c2a89f27fb09592f97686b59.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un442932.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un442932.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4652 1544 WerFault.exe pro6299.exe 4972 3268 WerFault.exe qu6666.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro6299.exequ6666.exesi552683.exepid process 1544 pro6299.exe 1544 pro6299.exe 3268 qu6666.exe 3268 qu6666.exe 2016 si552683.exe 2016 si552683.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro6299.exequ6666.exesi552683.exedescription pid process Token: SeDebugPrivilege 1544 pro6299.exe Token: SeDebugPrivilege 3268 qu6666.exe Token: SeDebugPrivilege 2016 si552683.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
fd09d8d6f1c056bd439f8349d70f79d95b06eda5c2a89f27fb09592f97686b59.exeun442932.exedescription pid process target process PID 1508 wrote to memory of 1856 1508 fd09d8d6f1c056bd439f8349d70f79d95b06eda5c2a89f27fb09592f97686b59.exe un442932.exe PID 1508 wrote to memory of 1856 1508 fd09d8d6f1c056bd439f8349d70f79d95b06eda5c2a89f27fb09592f97686b59.exe un442932.exe PID 1508 wrote to memory of 1856 1508 fd09d8d6f1c056bd439f8349d70f79d95b06eda5c2a89f27fb09592f97686b59.exe un442932.exe PID 1856 wrote to memory of 1544 1856 un442932.exe pro6299.exe PID 1856 wrote to memory of 1544 1856 un442932.exe pro6299.exe PID 1856 wrote to memory of 1544 1856 un442932.exe pro6299.exe PID 1856 wrote to memory of 3268 1856 un442932.exe qu6666.exe PID 1856 wrote to memory of 3268 1856 un442932.exe qu6666.exe PID 1856 wrote to memory of 3268 1856 un442932.exe qu6666.exe PID 1508 wrote to memory of 2016 1508 fd09d8d6f1c056bd439f8349d70f79d95b06eda5c2a89f27fb09592f97686b59.exe si552683.exe PID 1508 wrote to memory of 2016 1508 fd09d8d6f1c056bd439f8349d70f79d95b06eda5c2a89f27fb09592f97686b59.exe si552683.exe PID 1508 wrote to memory of 2016 1508 fd09d8d6f1c056bd439f8349d70f79d95b06eda5c2a89f27fb09592f97686b59.exe si552683.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd09d8d6f1c056bd439f8349d70f79d95b06eda5c2a89f27fb09592f97686b59.exe"C:\Users\Admin\AppData\Local\Temp\fd09d8d6f1c056bd439f8349d70f79d95b06eda5c2a89f27fb09592f97686b59.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un442932.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un442932.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6299.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6299.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 10804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6666.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6666.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3268 -s 19364⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si552683.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si552683.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1544 -ip 15441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3268 -ip 32681⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si552683.exeFilesize
175KB
MD501b53252ae16860618c15cb9375ae776
SHA17ad9b0b7d3634c11ddf63cf456e806ed8289f822
SHA256313999710c149e33768b6a699c7da68b17f0f7318e738d88bd0f14b63b869a71
SHA512754a9b2cf9518c1cf72797cf00a1ac88124c1db0e25d888c30330dfacba456b1cdafcffc6b7dbf8aad0cfc94e380a80595e9088ed80ae86bbfd5a6c8876e9d7e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si552683.exeFilesize
175KB
MD501b53252ae16860618c15cb9375ae776
SHA17ad9b0b7d3634c11ddf63cf456e806ed8289f822
SHA256313999710c149e33768b6a699c7da68b17f0f7318e738d88bd0f14b63b869a71
SHA512754a9b2cf9518c1cf72797cf00a1ac88124c1db0e25d888c30330dfacba456b1cdafcffc6b7dbf8aad0cfc94e380a80595e9088ed80ae86bbfd5a6c8876e9d7e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un442932.exeFilesize
517KB
MD532fd411ed0cc4df2ee2570781608cd8a
SHA1bb19bed75c49a708c8477e95baebd857a388bad8
SHA2566403f760979b912c665992a881da26d4747bff9e6fcb5bf71368e393a5128e43
SHA512ea8bdad46ce57075edd6497ab5c202a8c836e43c29022ad3e45ed721b832cedd3e90a6ace4749f10e7b15c6f09f38bb3ee1369b33907edfd85fc25f5f1706927
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un442932.exeFilesize
517KB
MD532fd411ed0cc4df2ee2570781608cd8a
SHA1bb19bed75c49a708c8477e95baebd857a388bad8
SHA2566403f760979b912c665992a881da26d4747bff9e6fcb5bf71368e393a5128e43
SHA512ea8bdad46ce57075edd6497ab5c202a8c836e43c29022ad3e45ed721b832cedd3e90a6ace4749f10e7b15c6f09f38bb3ee1369b33907edfd85fc25f5f1706927
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6299.exeFilesize
237KB
MD5374dd7b0bd1e75f36de5b46d7a45579c
SHA1f51c45ef8f3e17a6017804fa04f196b9d3cc700a
SHA2568483bd97a1c702368c5fdfee4aecab830753e4bcce0b4412d195e0164758747e
SHA51225fe5d2b8cf5c1a86d5da49a8dea195926f19965bd6cee2bf0182253c6c0d50bbfce78ac1e61058a856480c285ba79000f9616165a09f3c16ed4c925338fa373
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6299.exeFilesize
237KB
MD5374dd7b0bd1e75f36de5b46d7a45579c
SHA1f51c45ef8f3e17a6017804fa04f196b9d3cc700a
SHA2568483bd97a1c702368c5fdfee4aecab830753e4bcce0b4412d195e0164758747e
SHA51225fe5d2b8cf5c1a86d5da49a8dea195926f19965bd6cee2bf0182253c6c0d50bbfce78ac1e61058a856480c285ba79000f9616165a09f3c16ed4c925338fa373
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6666.exeFilesize
295KB
MD50c82e219a99a81f159cee693c576f3e7
SHA19b3193496241c7b641727be00500d1e57a2b846e
SHA25665e4125d7d752ab47873654f869267276fc2aa5afd78b70394d8502577a1f7a3
SHA512c9aee2c1b95b4240d36b1a59817c477901ff7e324d0633927d31b861305fbf6a33e2e590ba042efafda34f05617389edc517b9a8a8fe7ee5b3a6537528e3833b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6666.exeFilesize
295KB
MD50c82e219a99a81f159cee693c576f3e7
SHA19b3193496241c7b641727be00500d1e57a2b846e
SHA25665e4125d7d752ab47873654f869267276fc2aa5afd78b70394d8502577a1f7a3
SHA512c9aee2c1b95b4240d36b1a59817c477901ff7e324d0633927d31b861305fbf6a33e2e590ba042efafda34f05617389edc517b9a8a8fe7ee5b3a6537528e3833b
-
memory/1544-148-0x0000000000600000-0x000000000062D000-memory.dmpFilesize
180KB
-
memory/1544-149-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/1544-150-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/1544-151-0x0000000004B40000-0x00000000050E4000-memory.dmpFilesize
5.6MB
-
memory/1544-152-0x00000000026C0000-0x00000000026D2000-memory.dmpFilesize
72KB
-
memory/1544-153-0x00000000026C0000-0x00000000026D2000-memory.dmpFilesize
72KB
-
memory/1544-155-0x00000000026C0000-0x00000000026D2000-memory.dmpFilesize
72KB
-
memory/1544-157-0x00000000026C0000-0x00000000026D2000-memory.dmpFilesize
72KB
-
memory/1544-159-0x00000000026C0000-0x00000000026D2000-memory.dmpFilesize
72KB
-
memory/1544-161-0x00000000026C0000-0x00000000026D2000-memory.dmpFilesize
72KB
-
memory/1544-163-0x00000000026C0000-0x00000000026D2000-memory.dmpFilesize
72KB
-
memory/1544-165-0x00000000026C0000-0x00000000026D2000-memory.dmpFilesize
72KB
-
memory/1544-167-0x00000000026C0000-0x00000000026D2000-memory.dmpFilesize
72KB
-
memory/1544-169-0x00000000026C0000-0x00000000026D2000-memory.dmpFilesize
72KB
-
memory/1544-171-0x00000000026C0000-0x00000000026D2000-memory.dmpFilesize
72KB
-
memory/1544-173-0x00000000026C0000-0x00000000026D2000-memory.dmpFilesize
72KB
-
memory/1544-175-0x00000000026C0000-0x00000000026D2000-memory.dmpFilesize
72KB
-
memory/1544-177-0x00000000026C0000-0x00000000026D2000-memory.dmpFilesize
72KB
-
memory/1544-179-0x00000000026C0000-0x00000000026D2000-memory.dmpFilesize
72KB
-
memory/1544-180-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1544-181-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/1544-182-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/1544-183-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/1544-185-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2016-1122-0x00000000005A0000-0x00000000005D2000-memory.dmpFilesize
200KB
-
memory/2016-1124-0x0000000004EC0000-0x0000000004ED0000-memory.dmpFilesize
64KB
-
memory/2016-1123-0x0000000004EC0000-0x0000000004ED0000-memory.dmpFilesize
64KB
-
memory/3268-196-0x0000000000770000-0x00000000007BB000-memory.dmpFilesize
300KB
-
memory/3268-227-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/3268-195-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/3268-198-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/3268-200-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/3268-203-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/3268-202-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/3268-199-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/3268-205-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/3268-207-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/3268-209-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/3268-211-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/3268-213-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/3268-215-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/3268-217-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/3268-219-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/3268-221-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/3268-223-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/3268-225-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/3268-193-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/3268-1100-0x0000000005100000-0x0000000005718000-memory.dmpFilesize
6.1MB
-
memory/3268-1101-0x0000000005760000-0x000000000586A000-memory.dmpFilesize
1.0MB
-
memory/3268-1102-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/3268-1103-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/3268-1104-0x00000000058C0000-0x00000000058FC000-memory.dmpFilesize
240KB
-
memory/3268-1106-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/3268-1107-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/3268-1108-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/3268-1109-0x0000000005BB0000-0x0000000005C42000-memory.dmpFilesize
584KB
-
memory/3268-1110-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/3268-1111-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/3268-1112-0x00000000064C0000-0x0000000006682000-memory.dmpFilesize
1.8MB
-
memory/3268-191-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/3268-190-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/3268-1113-0x0000000006690000-0x0000000006BBC000-memory.dmpFilesize
5.2MB
-
memory/3268-1114-0x0000000006F30000-0x0000000006FA6000-memory.dmpFilesize
472KB
-
memory/3268-1115-0x0000000006FC0000-0x0000000007010000-memory.dmpFilesize
320KB