Analysis
-
max time kernel
83s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 22:22
Static task
static1
Behavioral task
behavioral1
Sample
6ac8403b2a50486af460bf68075d707f2a0c5be6e4e181d4af7b17411cf1cb69.exe
Resource
win10v2004-20230220-en
General
-
Target
6ac8403b2a50486af460bf68075d707f2a0c5be6e4e181d4af7b17411cf1cb69.exe
-
Size
659KB
-
MD5
1a481ef2fd43a06ba9b66fedc7caa015
-
SHA1
23107057f21dfb2e1f808797f18b137aa21b3607
-
SHA256
6ac8403b2a50486af460bf68075d707f2a0c5be6e4e181d4af7b17411cf1cb69
-
SHA512
f1800f1e5336ad18aa3de75ae8c018b0d7471f581811a27663c198e608d7414dde5da619253f3f261ccf092d1ffb33d3e84a3b4fc5317837e51cab65bf75b0f2
-
SSDEEP
12288:rMroy90z0+YKrIKz0gPVnazmIt597rw7VjCleUft/juynzbuCm:zyJUUKgyKmIt5FYVelFBfHC
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro0960.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro0960.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro0960.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro0960.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro0960.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro0960.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro0960.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/3140-188-0x0000000002660000-0x000000000269F000-memory.dmp family_redline behavioral1/memory/3140-189-0x0000000002660000-0x000000000269F000-memory.dmp family_redline behavioral1/memory/3140-191-0x0000000002660000-0x000000000269F000-memory.dmp family_redline behavioral1/memory/3140-195-0x0000000002660000-0x000000000269F000-memory.dmp family_redline behavioral1/memory/3140-197-0x0000000002660000-0x000000000269F000-memory.dmp family_redline behavioral1/memory/3140-199-0x0000000002660000-0x000000000269F000-memory.dmp family_redline behavioral1/memory/3140-193-0x0000000002660000-0x000000000269F000-memory.dmp family_redline behavioral1/memory/3140-201-0x0000000002660000-0x000000000269F000-memory.dmp family_redline behavioral1/memory/3140-203-0x0000000002660000-0x000000000269F000-memory.dmp family_redline behavioral1/memory/3140-205-0x0000000002660000-0x000000000269F000-memory.dmp family_redline behavioral1/memory/3140-207-0x0000000002660000-0x000000000269F000-memory.dmp family_redline behavioral1/memory/3140-209-0x0000000002660000-0x000000000269F000-memory.dmp family_redline behavioral1/memory/3140-215-0x00000000026B0000-0x00000000026C0000-memory.dmp family_redline behavioral1/memory/3140-212-0x0000000002660000-0x000000000269F000-memory.dmp family_redline behavioral1/memory/3140-216-0x0000000002660000-0x000000000269F000-memory.dmp family_redline behavioral1/memory/3140-220-0x0000000002660000-0x000000000269F000-memory.dmp family_redline behavioral1/memory/3140-218-0x0000000002660000-0x000000000269F000-memory.dmp family_redline behavioral1/memory/3140-222-0x0000000002660000-0x000000000269F000-memory.dmp family_redline behavioral1/memory/3140-224-0x0000000002660000-0x000000000269F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un806287.exepro0960.exequ1380.exesi164048.exepid process 4640 un806287.exe 764 pro0960.exe 3140 qu1380.exe 952 si164048.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro0960.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro0960.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro0960.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
6ac8403b2a50486af460bf68075d707f2a0c5be6e4e181d4af7b17411cf1cb69.exeun806287.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 6ac8403b2a50486af460bf68075d707f2a0c5be6e4e181d4af7b17411cf1cb69.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 6ac8403b2a50486af460bf68075d707f2a0c5be6e4e181d4af7b17411cf1cb69.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un806287.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un806287.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 324 764 WerFault.exe pro0960.exe 2348 3140 WerFault.exe qu1380.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro0960.exequ1380.exesi164048.exepid process 764 pro0960.exe 764 pro0960.exe 3140 qu1380.exe 3140 qu1380.exe 952 si164048.exe 952 si164048.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro0960.exequ1380.exesi164048.exedescription pid process Token: SeDebugPrivilege 764 pro0960.exe Token: SeDebugPrivilege 3140 qu1380.exe Token: SeDebugPrivilege 952 si164048.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
6ac8403b2a50486af460bf68075d707f2a0c5be6e4e181d4af7b17411cf1cb69.exeun806287.exedescription pid process target process PID 3584 wrote to memory of 4640 3584 6ac8403b2a50486af460bf68075d707f2a0c5be6e4e181d4af7b17411cf1cb69.exe un806287.exe PID 3584 wrote to memory of 4640 3584 6ac8403b2a50486af460bf68075d707f2a0c5be6e4e181d4af7b17411cf1cb69.exe un806287.exe PID 3584 wrote to memory of 4640 3584 6ac8403b2a50486af460bf68075d707f2a0c5be6e4e181d4af7b17411cf1cb69.exe un806287.exe PID 4640 wrote to memory of 764 4640 un806287.exe pro0960.exe PID 4640 wrote to memory of 764 4640 un806287.exe pro0960.exe PID 4640 wrote to memory of 764 4640 un806287.exe pro0960.exe PID 4640 wrote to memory of 3140 4640 un806287.exe qu1380.exe PID 4640 wrote to memory of 3140 4640 un806287.exe qu1380.exe PID 4640 wrote to memory of 3140 4640 un806287.exe qu1380.exe PID 3584 wrote to memory of 952 3584 6ac8403b2a50486af460bf68075d707f2a0c5be6e4e181d4af7b17411cf1cb69.exe si164048.exe PID 3584 wrote to memory of 952 3584 6ac8403b2a50486af460bf68075d707f2a0c5be6e4e181d4af7b17411cf1cb69.exe si164048.exe PID 3584 wrote to memory of 952 3584 6ac8403b2a50486af460bf68075d707f2a0c5be6e4e181d4af7b17411cf1cb69.exe si164048.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ac8403b2a50486af460bf68075d707f2a0c5be6e4e181d4af7b17411cf1cb69.exe"C:\Users\Admin\AppData\Local\Temp\6ac8403b2a50486af460bf68075d707f2a0c5be6e4e181d4af7b17411cf1cb69.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un806287.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un806287.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0960.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0960.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 10844⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1380.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1380.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 18164⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si164048.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si164048.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 764 -ip 7641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3140 -ip 31401⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si164048.exeFilesize
175KB
MD50bfa2e7835b376934c1ca6ea595a1299
SHA1d50dc9eee4109248f4d4cdcab2da5acee1952a42
SHA2563c7621809818774a65a4485fd3a59aadcea0c8a3d79f50d428d76ae943909205
SHA512b12c2fd4e4a48bbe7ad0b21ae669b38f23350261b78fa4d00ed6e08f044268071a88aac26c21fb621a55e33b515ed5c849e966c1c3e50a0c9013b34fda5c4442
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si164048.exeFilesize
175KB
MD50bfa2e7835b376934c1ca6ea595a1299
SHA1d50dc9eee4109248f4d4cdcab2da5acee1952a42
SHA2563c7621809818774a65a4485fd3a59aadcea0c8a3d79f50d428d76ae943909205
SHA512b12c2fd4e4a48bbe7ad0b21ae669b38f23350261b78fa4d00ed6e08f044268071a88aac26c21fb621a55e33b515ed5c849e966c1c3e50a0c9013b34fda5c4442
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un806287.exeFilesize
517KB
MD54421c0ddacf18c8c9502b305bc43cfac
SHA14d8e171089cc3a581049f4f795814b5704f002a5
SHA2565988e996757a2a38414d43cd3195656aa7d6a3a703fbc57febabd0c2866acc01
SHA512b9d87890df7e3f81be5a7d36245307171dcc4ca1a0bfe05d8d4fd9b074aa7a25524c2f75b57932530b616001f6224943361628c1e61680308d16330dc2e4b4dc
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un806287.exeFilesize
517KB
MD54421c0ddacf18c8c9502b305bc43cfac
SHA14d8e171089cc3a581049f4f795814b5704f002a5
SHA2565988e996757a2a38414d43cd3195656aa7d6a3a703fbc57febabd0c2866acc01
SHA512b9d87890df7e3f81be5a7d36245307171dcc4ca1a0bfe05d8d4fd9b074aa7a25524c2f75b57932530b616001f6224943361628c1e61680308d16330dc2e4b4dc
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0960.exeFilesize
237KB
MD54c6259e56777c352c62fe5d314a5dafe
SHA137e1c20a08ca10d84e51d25886a035ef28a8d6d9
SHA2560a46b7a0041298832a685e6b0d7d95ef23ca23f8627c6b0da00a09120f735e68
SHA51228a785a5cf11dcc0ada7e8df3fc12c71cc7f03fcb4b4f6c9b2f0c6bd9ab3d09dea859bc6e12e0af8615bd944d5e17d48e68db9aedc2c277e4311f8e94548f09b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0960.exeFilesize
237KB
MD54c6259e56777c352c62fe5d314a5dafe
SHA137e1c20a08ca10d84e51d25886a035ef28a8d6d9
SHA2560a46b7a0041298832a685e6b0d7d95ef23ca23f8627c6b0da00a09120f735e68
SHA51228a785a5cf11dcc0ada7e8df3fc12c71cc7f03fcb4b4f6c9b2f0c6bd9ab3d09dea859bc6e12e0af8615bd944d5e17d48e68db9aedc2c277e4311f8e94548f09b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1380.exeFilesize
295KB
MD5c6e4ecf146e38c932c80eed7ad962626
SHA1d210a35aaaf712283f98b5b1931da5be5ed6668f
SHA2561aa172aae359af42c1417591f1cfc95f53ae342186038d9d04ad46a32f77b292
SHA5123588d2388d683e5f13ca79b7994e72494f84aab94ead21f1378efe4db471018f8c46d61ebd69fbb9ced542487df70ba68abe8fb01073e765e23234ff69e5214a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1380.exeFilesize
295KB
MD5c6e4ecf146e38c932c80eed7ad962626
SHA1d210a35aaaf712283f98b5b1931da5be5ed6668f
SHA2561aa172aae359af42c1417591f1cfc95f53ae342186038d9d04ad46a32f77b292
SHA5123588d2388d683e5f13ca79b7994e72494f84aab94ead21f1378efe4db471018f8c46d61ebd69fbb9ced542487df70ba68abe8fb01073e765e23234ff69e5214a
-
memory/764-148-0x0000000000650000-0x000000000067D000-memory.dmpFilesize
180KB
-
memory/764-149-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/764-150-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/764-151-0x0000000004B80000-0x0000000005124000-memory.dmpFilesize
5.6MB
-
memory/764-152-0x0000000002460000-0x0000000002472000-memory.dmpFilesize
72KB
-
memory/764-153-0x0000000002460000-0x0000000002472000-memory.dmpFilesize
72KB
-
memory/764-155-0x0000000002460000-0x0000000002472000-memory.dmpFilesize
72KB
-
memory/764-157-0x0000000002460000-0x0000000002472000-memory.dmpFilesize
72KB
-
memory/764-159-0x0000000002460000-0x0000000002472000-memory.dmpFilesize
72KB
-
memory/764-161-0x0000000002460000-0x0000000002472000-memory.dmpFilesize
72KB
-
memory/764-163-0x0000000002460000-0x0000000002472000-memory.dmpFilesize
72KB
-
memory/764-165-0x0000000002460000-0x0000000002472000-memory.dmpFilesize
72KB
-
memory/764-167-0x0000000002460000-0x0000000002472000-memory.dmpFilesize
72KB
-
memory/764-169-0x0000000002460000-0x0000000002472000-memory.dmpFilesize
72KB
-
memory/764-173-0x0000000002460000-0x0000000002472000-memory.dmpFilesize
72KB
-
memory/764-171-0x0000000002460000-0x0000000002472000-memory.dmpFilesize
72KB
-
memory/764-175-0x0000000002460000-0x0000000002472000-memory.dmpFilesize
72KB
-
memory/764-177-0x0000000002460000-0x0000000002472000-memory.dmpFilesize
72KB
-
memory/764-179-0x0000000002460000-0x0000000002472000-memory.dmpFilesize
72KB
-
memory/764-180-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/764-181-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/764-183-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/952-1119-0x0000000000750000-0x0000000000782000-memory.dmpFilesize
200KB
-
memory/952-1121-0x0000000005380000-0x0000000005390000-memory.dmpFilesize
64KB
-
memory/952-1120-0x0000000005380000-0x0000000005390000-memory.dmpFilesize
64KB
-
memory/3140-195-0x0000000002660000-0x000000000269F000-memory.dmpFilesize
252KB
-
memory/3140-222-0x0000000002660000-0x000000000269F000-memory.dmpFilesize
252KB
-
memory/3140-197-0x0000000002660000-0x000000000269F000-memory.dmpFilesize
252KB
-
memory/3140-199-0x0000000002660000-0x000000000269F000-memory.dmpFilesize
252KB
-
memory/3140-193-0x0000000002660000-0x000000000269F000-memory.dmpFilesize
252KB
-
memory/3140-201-0x0000000002660000-0x000000000269F000-memory.dmpFilesize
252KB
-
memory/3140-203-0x0000000002660000-0x000000000269F000-memory.dmpFilesize
252KB
-
memory/3140-205-0x0000000002660000-0x000000000269F000-memory.dmpFilesize
252KB
-
memory/3140-207-0x0000000002660000-0x000000000269F000-memory.dmpFilesize
252KB
-
memory/3140-209-0x0000000002660000-0x000000000269F000-memory.dmpFilesize
252KB
-
memory/3140-211-0x0000000002010000-0x000000000205B000-memory.dmpFilesize
300KB
-
memory/3140-213-0x00000000026B0000-0x00000000026C0000-memory.dmpFilesize
64KB
-
memory/3140-215-0x00000000026B0000-0x00000000026C0000-memory.dmpFilesize
64KB
-
memory/3140-212-0x0000000002660000-0x000000000269F000-memory.dmpFilesize
252KB
-
memory/3140-216-0x0000000002660000-0x000000000269F000-memory.dmpFilesize
252KB
-
memory/3140-220-0x0000000002660000-0x000000000269F000-memory.dmpFilesize
252KB
-
memory/3140-218-0x0000000002660000-0x000000000269F000-memory.dmpFilesize
252KB
-
memory/3140-191-0x0000000002660000-0x000000000269F000-memory.dmpFilesize
252KB
-
memory/3140-224-0x0000000002660000-0x000000000269F000-memory.dmpFilesize
252KB
-
memory/3140-1097-0x0000000005200000-0x0000000005818000-memory.dmpFilesize
6.1MB
-
memory/3140-1098-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/3140-1100-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/3140-1101-0x00000000026B0000-0x00000000026C0000-memory.dmpFilesize
64KB
-
memory/3140-1102-0x00000000026B0000-0x00000000026C0000-memory.dmpFilesize
64KB
-
memory/3140-1103-0x00000000026B0000-0x00000000026C0000-memory.dmpFilesize
64KB
-
memory/3140-1104-0x00000000026B0000-0x00000000026C0000-memory.dmpFilesize
64KB
-
memory/3140-1105-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/3140-1106-0x0000000005CF0000-0x0000000005D56000-memory.dmpFilesize
408KB
-
memory/3140-1108-0x00000000063A0000-0x0000000006432000-memory.dmpFilesize
584KB
-
memory/3140-1109-0x0000000006490000-0x0000000006506000-memory.dmpFilesize
472KB
-
memory/3140-1110-0x0000000006520000-0x0000000006570000-memory.dmpFilesize
320KB
-
memory/3140-189-0x0000000002660000-0x000000000269F000-memory.dmpFilesize
252KB
-
memory/3140-188-0x0000000002660000-0x000000000269F000-memory.dmpFilesize
252KB
-
memory/3140-1111-0x00000000026B0000-0x00000000026C0000-memory.dmpFilesize
64KB
-
memory/3140-1112-0x0000000007940000-0x0000000007B02000-memory.dmpFilesize
1.8MB
-
memory/3140-1113-0x0000000007B20000-0x000000000804C000-memory.dmpFilesize
5.2MB