Analysis
-
max time kernel
52s -
max time network
139s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
03-04-2023 22:22
Static task
static1
Behavioral task
behavioral1
Sample
2bb097d6d8e5d256a14e471298d744a2bbe0673614ff0a015367da25fc913005.exe
Resource
win10-20230220-en
General
-
Target
2bb097d6d8e5d256a14e471298d744a2bbe0673614ff0a015367da25fc913005.exe
-
Size
522KB
-
MD5
6a31e572c857bb968d9ed58f91e817eb
-
SHA1
a378cb19b17ebfaf61d25c825f86ec9700da9c82
-
SHA256
2bb097d6d8e5d256a14e471298d744a2bbe0673614ff0a015367da25fc913005
-
SHA512
92c5a9fd9e1c3a6d10c823b5f53dc71683bc55ee75aad03d70b3a1db1b631af6d078ef71d38104faa7a321d7aec51fa52f5e447cb62128bd17d6fb7659c4fd16
-
SSDEEP
12288:fMrhy90vvEUT7fSYCvuyrwXxhCSJOcBvdg:+yUcU/v28xYSNTg
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr118918.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr118918.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr118918.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr118918.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr118918.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr118918.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
Processes:
resource yara_rule behavioral1/memory/5116-136-0x0000000004A00000-0x0000000004A46000-memory.dmp family_redline behavioral1/memory/5116-140-0x0000000004FC0000-0x0000000005004000-memory.dmp family_redline behavioral1/memory/5116-143-0x0000000004FC0000-0x0000000004FFF000-memory.dmp family_redline behavioral1/memory/5116-144-0x0000000004FC0000-0x0000000004FFF000-memory.dmp family_redline behavioral1/memory/5116-146-0x0000000004FC0000-0x0000000004FFF000-memory.dmp family_redline behavioral1/memory/5116-148-0x0000000004FC0000-0x0000000004FFF000-memory.dmp family_redline behavioral1/memory/5116-150-0x0000000004FC0000-0x0000000004FFF000-memory.dmp family_redline behavioral1/memory/5116-152-0x0000000004FC0000-0x0000000004FFF000-memory.dmp family_redline behavioral1/memory/5116-154-0x0000000004FC0000-0x0000000004FFF000-memory.dmp family_redline behavioral1/memory/5116-156-0x0000000004FC0000-0x0000000004FFF000-memory.dmp family_redline behavioral1/memory/5116-158-0x0000000004FC0000-0x0000000004FFF000-memory.dmp family_redline behavioral1/memory/5116-160-0x0000000004FC0000-0x0000000004FFF000-memory.dmp family_redline behavioral1/memory/5116-162-0x0000000004FC0000-0x0000000004FFF000-memory.dmp family_redline behavioral1/memory/5116-164-0x0000000004FC0000-0x0000000004FFF000-memory.dmp family_redline behavioral1/memory/5116-166-0x0000000004FC0000-0x0000000004FFF000-memory.dmp family_redline behavioral1/memory/5116-168-0x0000000004FC0000-0x0000000004FFF000-memory.dmp family_redline behavioral1/memory/5116-170-0x0000000004FC0000-0x0000000004FFF000-memory.dmp family_redline behavioral1/memory/5116-172-0x0000000004FC0000-0x0000000004FFF000-memory.dmp family_redline behavioral1/memory/5116-174-0x0000000004FC0000-0x0000000004FFF000-memory.dmp family_redline behavioral1/memory/5116-176-0x0000000004FC0000-0x0000000004FFF000-memory.dmp family_redline behavioral1/memory/5116-178-0x0000000004FC0000-0x0000000004FFF000-memory.dmp family_redline behavioral1/memory/5116-182-0x0000000004FC0000-0x0000000004FFF000-memory.dmp family_redline behavioral1/memory/5116-180-0x0000000004FC0000-0x0000000004FFF000-memory.dmp family_redline behavioral1/memory/5116-184-0x0000000004FC0000-0x0000000004FFF000-memory.dmp family_redline behavioral1/memory/5116-186-0x0000000004FC0000-0x0000000004FFF000-memory.dmp family_redline behavioral1/memory/5116-188-0x0000000004FC0000-0x0000000004FFF000-memory.dmp family_redline behavioral1/memory/5116-190-0x0000000004FC0000-0x0000000004FFF000-memory.dmp family_redline behavioral1/memory/5116-192-0x0000000004FC0000-0x0000000004FFF000-memory.dmp family_redline behavioral1/memory/5116-194-0x0000000004FC0000-0x0000000004FFF000-memory.dmp family_redline behavioral1/memory/5116-196-0x0000000004FC0000-0x0000000004FFF000-memory.dmp family_redline behavioral1/memory/5116-198-0x0000000004FC0000-0x0000000004FFF000-memory.dmp family_redline behavioral1/memory/5116-200-0x0000000004FC0000-0x0000000004FFF000-memory.dmp family_redline behavioral1/memory/5116-202-0x0000000004FC0000-0x0000000004FFF000-memory.dmp family_redline behavioral1/memory/5116-204-0x0000000004FC0000-0x0000000004FFF000-memory.dmp family_redline behavioral1/memory/5116-206-0x0000000004FC0000-0x0000000004FFF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
ziPZ9949.exejr118918.exeku759201.exelr867616.exepid process 3600 ziPZ9949.exe 2352 jr118918.exe 5116 ku759201.exe 4648 lr867616.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr118918.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr118918.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
2bb097d6d8e5d256a14e471298d744a2bbe0673614ff0a015367da25fc913005.exeziPZ9949.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 2bb097d6d8e5d256a14e471298d744a2bbe0673614ff0a015367da25fc913005.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 2bb097d6d8e5d256a14e471298d744a2bbe0673614ff0a015367da25fc913005.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziPZ9949.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziPZ9949.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr118918.exeku759201.exelr867616.exepid process 2352 jr118918.exe 2352 jr118918.exe 5116 ku759201.exe 5116 ku759201.exe 4648 lr867616.exe 4648 lr867616.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr118918.exeku759201.exelr867616.exedescription pid process Token: SeDebugPrivilege 2352 jr118918.exe Token: SeDebugPrivilege 5116 ku759201.exe Token: SeDebugPrivilege 4648 lr867616.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
2bb097d6d8e5d256a14e471298d744a2bbe0673614ff0a015367da25fc913005.exeziPZ9949.exedescription pid process target process PID 4148 wrote to memory of 3600 4148 2bb097d6d8e5d256a14e471298d744a2bbe0673614ff0a015367da25fc913005.exe ziPZ9949.exe PID 4148 wrote to memory of 3600 4148 2bb097d6d8e5d256a14e471298d744a2bbe0673614ff0a015367da25fc913005.exe ziPZ9949.exe PID 4148 wrote to memory of 3600 4148 2bb097d6d8e5d256a14e471298d744a2bbe0673614ff0a015367da25fc913005.exe ziPZ9949.exe PID 3600 wrote to memory of 2352 3600 ziPZ9949.exe jr118918.exe PID 3600 wrote to memory of 2352 3600 ziPZ9949.exe jr118918.exe PID 3600 wrote to memory of 5116 3600 ziPZ9949.exe ku759201.exe PID 3600 wrote to memory of 5116 3600 ziPZ9949.exe ku759201.exe PID 3600 wrote to memory of 5116 3600 ziPZ9949.exe ku759201.exe PID 4148 wrote to memory of 4648 4148 2bb097d6d8e5d256a14e471298d744a2bbe0673614ff0a015367da25fc913005.exe lr867616.exe PID 4148 wrote to memory of 4648 4148 2bb097d6d8e5d256a14e471298d744a2bbe0673614ff0a015367da25fc913005.exe lr867616.exe PID 4148 wrote to memory of 4648 4148 2bb097d6d8e5d256a14e471298d744a2bbe0673614ff0a015367da25fc913005.exe lr867616.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bb097d6d8e5d256a14e471298d744a2bbe0673614ff0a015367da25fc913005.exe"C:\Users\Admin\AppData\Local\Temp\2bb097d6d8e5d256a14e471298d744a2bbe0673614ff0a015367da25fc913005.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPZ9949.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPZ9949.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr118918.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr118918.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku759201.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku759201.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr867616.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr867616.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4648
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr867616.exeFilesize
175KB
MD5d418531be27a5211b2b0d7f8a2d75e0b
SHA188b7d7784e44a1892d7491c6188deec800742fc4
SHA256dc2f222908fed11043bb4a2c84156672c876389e70e2da1ca5e382861ec4154b
SHA5128f622f8d9881ad3673f712c362aeff6286b80c2cb83e37851587be0e18fe9175c9178e04a14602fd15219d1c66d50b2d83382bd04365aa0afe8daa98ee6da9a3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr867616.exeFilesize
175KB
MD5d418531be27a5211b2b0d7f8a2d75e0b
SHA188b7d7784e44a1892d7491c6188deec800742fc4
SHA256dc2f222908fed11043bb4a2c84156672c876389e70e2da1ca5e382861ec4154b
SHA5128f622f8d9881ad3673f712c362aeff6286b80c2cb83e37851587be0e18fe9175c9178e04a14602fd15219d1c66d50b2d83382bd04365aa0afe8daa98ee6da9a3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPZ9949.exeFilesize
380KB
MD50692941e37c313130beff6bfe319836f
SHA1d6c2208f2dbfc370213f6ab365554706d555aa90
SHA2569cd7d60da4607a517fe476fc1ab4ab6d70174f2dd691f657afc7ae9d0c859f97
SHA512fbf5ce7f578f0cd95cc3ce2368cfcc73bb0a52e429d931016da7b3499dc3d735e191ceb16e594374ca6731ef549f096d78d1e4425bdd9152ae2282c1796b16d9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPZ9949.exeFilesize
380KB
MD50692941e37c313130beff6bfe319836f
SHA1d6c2208f2dbfc370213f6ab365554706d555aa90
SHA2569cd7d60da4607a517fe476fc1ab4ab6d70174f2dd691f657afc7ae9d0c859f97
SHA512fbf5ce7f578f0cd95cc3ce2368cfcc73bb0a52e429d931016da7b3499dc3d735e191ceb16e594374ca6731ef549f096d78d1e4425bdd9152ae2282c1796b16d9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr118918.exeFilesize
15KB
MD58d2e0a5bec14439475596047871a7110
SHA1dca2eeb5a385409db4faa8e8bca5545123bbdead
SHA256bcf44192a233a45603db0d8dbfd7c08234f6dde50cf9923a24c8e86b6fe01dfa
SHA5125bcde2b2cb37dc157987dcfc8bfc144d483fdf0d995587fb774222fff6bbd8cd5b6cfe37494f09d450cded5ab670c3f5bf698cc5d685656a402d6b3ccaef63f3
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr118918.exeFilesize
15KB
MD58d2e0a5bec14439475596047871a7110
SHA1dca2eeb5a385409db4faa8e8bca5545123bbdead
SHA256bcf44192a233a45603db0d8dbfd7c08234f6dde50cf9923a24c8e86b6fe01dfa
SHA5125bcde2b2cb37dc157987dcfc8bfc144d483fdf0d995587fb774222fff6bbd8cd5b6cfe37494f09d450cded5ab670c3f5bf698cc5d685656a402d6b3ccaef63f3
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku759201.exeFilesize
295KB
MD560920156a044f0622f5abf73d1c0b80e
SHA13861b995f1fdfffde451d82ceb20cfcf65589a52
SHA256045de6d7b8c624e7b59f36432c2ff97a13c52fe03d578b60dc3703dc3f825a43
SHA512c259ef7f09a8d8c3092ddcee2d9cc9fb8fab2477a4e56b2e9503a6493cc2522b26baf248a576798e4dcfae6b0d567b4c0116d7d5008acd1a02aeab039d964907
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku759201.exeFilesize
295KB
MD560920156a044f0622f5abf73d1c0b80e
SHA13861b995f1fdfffde451d82ceb20cfcf65589a52
SHA256045de6d7b8c624e7b59f36432c2ff97a13c52fe03d578b60dc3703dc3f825a43
SHA512c259ef7f09a8d8c3092ddcee2d9cc9fb8fab2477a4e56b2e9503a6493cc2522b26baf248a576798e4dcfae6b0d567b4c0116d7d5008acd1a02aeab039d964907
-
memory/2352-130-0x0000000000590000-0x000000000059A000-memory.dmpFilesize
40KB
-
memory/4648-1071-0x0000000000800000-0x0000000000832000-memory.dmpFilesize
200KB
-
memory/4648-1072-0x0000000005340000-0x0000000005350000-memory.dmpFilesize
64KB
-
memory/4648-1074-0x0000000005340000-0x0000000005350000-memory.dmpFilesize
64KB
-
memory/4648-1073-0x0000000005240000-0x000000000528B000-memory.dmpFilesize
300KB
-
memory/5116-174-0x0000000004FC0000-0x0000000004FFF000-memory.dmpFilesize
252KB
-
memory/5116-186-0x0000000004FC0000-0x0000000004FFF000-memory.dmpFilesize
252KB
-
memory/5116-140-0x0000000004FC0000-0x0000000005004000-memory.dmpFilesize
272KB
-
memory/5116-141-0x0000000004AB0000-0x0000000004AC0000-memory.dmpFilesize
64KB
-
memory/5116-142-0x0000000004AB0000-0x0000000004AC0000-memory.dmpFilesize
64KB
-
memory/5116-143-0x0000000004FC0000-0x0000000004FFF000-memory.dmpFilesize
252KB
-
memory/5116-144-0x0000000004FC0000-0x0000000004FFF000-memory.dmpFilesize
252KB
-
memory/5116-146-0x0000000004FC0000-0x0000000004FFF000-memory.dmpFilesize
252KB
-
memory/5116-148-0x0000000004FC0000-0x0000000004FFF000-memory.dmpFilesize
252KB
-
memory/5116-150-0x0000000004FC0000-0x0000000004FFF000-memory.dmpFilesize
252KB
-
memory/5116-152-0x0000000004FC0000-0x0000000004FFF000-memory.dmpFilesize
252KB
-
memory/5116-154-0x0000000004FC0000-0x0000000004FFF000-memory.dmpFilesize
252KB
-
memory/5116-156-0x0000000004FC0000-0x0000000004FFF000-memory.dmpFilesize
252KB
-
memory/5116-158-0x0000000004FC0000-0x0000000004FFF000-memory.dmpFilesize
252KB
-
memory/5116-160-0x0000000004FC0000-0x0000000004FFF000-memory.dmpFilesize
252KB
-
memory/5116-162-0x0000000004FC0000-0x0000000004FFF000-memory.dmpFilesize
252KB
-
memory/5116-164-0x0000000004FC0000-0x0000000004FFF000-memory.dmpFilesize
252KB
-
memory/5116-166-0x0000000004FC0000-0x0000000004FFF000-memory.dmpFilesize
252KB
-
memory/5116-168-0x0000000004FC0000-0x0000000004FFF000-memory.dmpFilesize
252KB
-
memory/5116-170-0x0000000004FC0000-0x0000000004FFF000-memory.dmpFilesize
252KB
-
memory/5116-172-0x0000000004FC0000-0x0000000004FFF000-memory.dmpFilesize
252KB
-
memory/5116-139-0x0000000004AB0000-0x0000000004AC0000-memory.dmpFilesize
64KB
-
memory/5116-176-0x0000000004FC0000-0x0000000004FFF000-memory.dmpFilesize
252KB
-
memory/5116-178-0x0000000004FC0000-0x0000000004FFF000-memory.dmpFilesize
252KB
-
memory/5116-182-0x0000000004FC0000-0x0000000004FFF000-memory.dmpFilesize
252KB
-
memory/5116-180-0x0000000004FC0000-0x0000000004FFF000-memory.dmpFilesize
252KB
-
memory/5116-184-0x0000000004FC0000-0x0000000004FFF000-memory.dmpFilesize
252KB
-
memory/5116-138-0x0000000001EA0000-0x0000000001EEB000-memory.dmpFilesize
300KB
-
memory/5116-188-0x0000000004FC0000-0x0000000004FFF000-memory.dmpFilesize
252KB
-
memory/5116-190-0x0000000004FC0000-0x0000000004FFF000-memory.dmpFilesize
252KB
-
memory/5116-192-0x0000000004FC0000-0x0000000004FFF000-memory.dmpFilesize
252KB
-
memory/5116-194-0x0000000004FC0000-0x0000000004FFF000-memory.dmpFilesize
252KB
-
memory/5116-196-0x0000000004FC0000-0x0000000004FFF000-memory.dmpFilesize
252KB
-
memory/5116-198-0x0000000004FC0000-0x0000000004FFF000-memory.dmpFilesize
252KB
-
memory/5116-200-0x0000000004FC0000-0x0000000004FFF000-memory.dmpFilesize
252KB
-
memory/5116-202-0x0000000004FC0000-0x0000000004FFF000-memory.dmpFilesize
252KB
-
memory/5116-204-0x0000000004FC0000-0x0000000004FFF000-memory.dmpFilesize
252KB
-
memory/5116-206-0x0000000004FC0000-0x0000000004FFF000-memory.dmpFilesize
252KB
-
memory/5116-1049-0x0000000005140000-0x0000000005746000-memory.dmpFilesize
6.0MB
-
memory/5116-1050-0x00000000057A0000-0x00000000058AA000-memory.dmpFilesize
1.0MB
-
memory/5116-1051-0x00000000058E0000-0x00000000058F2000-memory.dmpFilesize
72KB
-
memory/5116-1052-0x0000000005900000-0x000000000593E000-memory.dmpFilesize
248KB
-
memory/5116-1053-0x0000000004AB0000-0x0000000004AC0000-memory.dmpFilesize
64KB
-
memory/5116-1054-0x0000000005A50000-0x0000000005A9B000-memory.dmpFilesize
300KB
-
memory/5116-1056-0x0000000004AB0000-0x0000000004AC0000-memory.dmpFilesize
64KB
-
memory/5116-1057-0x0000000004AB0000-0x0000000004AC0000-memory.dmpFilesize
64KB
-
memory/5116-1058-0x0000000004AB0000-0x0000000004AC0000-memory.dmpFilesize
64KB
-
memory/5116-1059-0x0000000005BE0000-0x0000000005C46000-memory.dmpFilesize
408KB
-
memory/5116-1060-0x00000000062A0000-0x0000000006332000-memory.dmpFilesize
584KB
-
memory/5116-1061-0x0000000006340000-0x00000000063B6000-memory.dmpFilesize
472KB
-
memory/5116-137-0x0000000004AC0000-0x0000000004FBE000-memory.dmpFilesize
5.0MB
-
memory/5116-136-0x0000000004A00000-0x0000000004A46000-memory.dmpFilesize
280KB
-
memory/5116-1062-0x00000000063E0000-0x0000000006430000-memory.dmpFilesize
320KB
-
memory/5116-1063-0x0000000004AB0000-0x0000000004AC0000-memory.dmpFilesize
64KB
-
memory/5116-1064-0x0000000006580000-0x0000000006742000-memory.dmpFilesize
1.8MB
-
memory/5116-1065-0x0000000006750000-0x0000000006C7C000-memory.dmpFilesize
5.2MB