Analysis
-
max time kernel
53s -
max time network
74s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
03-04-2023 22:26
Static task
static1
Behavioral task
behavioral1
Sample
8bfa84d952ad70b90a3ac352c80949b83dc4af1ab5571ec9774f00ce41f965c5.exe
Resource
win10-20230220-en
General
-
Target
8bfa84d952ad70b90a3ac352c80949b83dc4af1ab5571ec9774f00ce41f965c5.exe
-
Size
660KB
-
MD5
857e34f22dbe32e8f9046bda15a877c0
-
SHA1
4dfc57646d790022c83bd6bda1d927896d4fd321
-
SHA256
8bfa84d952ad70b90a3ac352c80949b83dc4af1ab5571ec9774f00ce41f965c5
-
SHA512
910e09ae93b5279e5d4d7bd4da5d66e70828cf1de8e1f158498bcb2c0a03c78a6605aefa16b0721dbc385ed5026134ca908ba69cec9c5cfa9c1e34e79a5b2b97
-
SSDEEP
12288:6MrOy90eMaqSuy/rYKQhfCltnN8PnXzlIUlifyoQCFvAft/juH/+ySA:QyEa9uyUMtN4XinrdFIB+/+yD
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro6457.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro6457.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro6457.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro6457.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro6457.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro6457.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/1140-178-0x00000000049B0000-0x00000000049F6000-memory.dmp family_redline behavioral1/memory/1140-179-0x0000000004A30000-0x0000000004A74000-memory.dmp family_redline behavioral1/memory/1140-180-0x0000000004A30000-0x0000000004A6F000-memory.dmp family_redline behavioral1/memory/1140-181-0x0000000004A30000-0x0000000004A6F000-memory.dmp family_redline behavioral1/memory/1140-183-0x0000000004A30000-0x0000000004A6F000-memory.dmp family_redline behavioral1/memory/1140-185-0x0000000004A30000-0x0000000004A6F000-memory.dmp family_redline behavioral1/memory/1140-187-0x0000000004A30000-0x0000000004A6F000-memory.dmp family_redline behavioral1/memory/1140-189-0x0000000004A30000-0x0000000004A6F000-memory.dmp family_redline behavioral1/memory/1140-191-0x0000000004A30000-0x0000000004A6F000-memory.dmp family_redline behavioral1/memory/1140-195-0x0000000004A30000-0x0000000004A6F000-memory.dmp family_redline behavioral1/memory/1140-199-0x0000000004A30000-0x0000000004A6F000-memory.dmp family_redline behavioral1/memory/1140-201-0x0000000004A30000-0x0000000004A6F000-memory.dmp family_redline behavioral1/memory/1140-203-0x0000000004A30000-0x0000000004A6F000-memory.dmp family_redline behavioral1/memory/1140-205-0x0000000004A30000-0x0000000004A6F000-memory.dmp family_redline behavioral1/memory/1140-207-0x0000000004A30000-0x0000000004A6F000-memory.dmp family_redline behavioral1/memory/1140-209-0x0000000004A30000-0x0000000004A6F000-memory.dmp family_redline behavioral1/memory/1140-211-0x0000000004A30000-0x0000000004A6F000-memory.dmp family_redline behavioral1/memory/1140-213-0x0000000004A30000-0x0000000004A6F000-memory.dmp family_redline behavioral1/memory/1140-215-0x0000000004A30000-0x0000000004A6F000-memory.dmp family_redline behavioral1/memory/1140-217-0x0000000004A30000-0x0000000004A6F000-memory.dmp family_redline behavioral1/memory/1140-1098-0x0000000004A80000-0x0000000004A90000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un147691.exepro6457.exequ5958.exesi762094.exepid process 4036 un147691.exe 2088 pro6457.exe 1140 qu5958.exe 4496 si762094.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro6457.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro6457.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro6457.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
8bfa84d952ad70b90a3ac352c80949b83dc4af1ab5571ec9774f00ce41f965c5.exeun147691.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 8bfa84d952ad70b90a3ac352c80949b83dc4af1ab5571ec9774f00ce41f965c5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 8bfa84d952ad70b90a3ac352c80949b83dc4af1ab5571ec9774f00ce41f965c5.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un147691.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un147691.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro6457.exequ5958.exesi762094.exepid process 2088 pro6457.exe 2088 pro6457.exe 1140 qu5958.exe 1140 qu5958.exe 4496 si762094.exe 4496 si762094.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro6457.exequ5958.exesi762094.exedescription pid process Token: SeDebugPrivilege 2088 pro6457.exe Token: SeDebugPrivilege 1140 qu5958.exe Token: SeDebugPrivilege 4496 si762094.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
8bfa84d952ad70b90a3ac352c80949b83dc4af1ab5571ec9774f00ce41f965c5.exeun147691.exedescription pid process target process PID 4048 wrote to memory of 4036 4048 8bfa84d952ad70b90a3ac352c80949b83dc4af1ab5571ec9774f00ce41f965c5.exe un147691.exe PID 4048 wrote to memory of 4036 4048 8bfa84d952ad70b90a3ac352c80949b83dc4af1ab5571ec9774f00ce41f965c5.exe un147691.exe PID 4048 wrote to memory of 4036 4048 8bfa84d952ad70b90a3ac352c80949b83dc4af1ab5571ec9774f00ce41f965c5.exe un147691.exe PID 4036 wrote to memory of 2088 4036 un147691.exe pro6457.exe PID 4036 wrote to memory of 2088 4036 un147691.exe pro6457.exe PID 4036 wrote to memory of 2088 4036 un147691.exe pro6457.exe PID 4036 wrote to memory of 1140 4036 un147691.exe qu5958.exe PID 4036 wrote to memory of 1140 4036 un147691.exe qu5958.exe PID 4036 wrote to memory of 1140 4036 un147691.exe qu5958.exe PID 4048 wrote to memory of 4496 4048 8bfa84d952ad70b90a3ac352c80949b83dc4af1ab5571ec9774f00ce41f965c5.exe si762094.exe PID 4048 wrote to memory of 4496 4048 8bfa84d952ad70b90a3ac352c80949b83dc4af1ab5571ec9774f00ce41f965c5.exe si762094.exe PID 4048 wrote to memory of 4496 4048 8bfa84d952ad70b90a3ac352c80949b83dc4af1ab5571ec9774f00ce41f965c5.exe si762094.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8bfa84d952ad70b90a3ac352c80949b83dc4af1ab5571ec9774f00ce41f965c5.exe"C:\Users\Admin\AppData\Local\Temp\8bfa84d952ad70b90a3ac352c80949b83dc4af1ab5571ec9774f00ce41f965c5.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un147691.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un147691.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6457.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6457.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5958.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5958.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si762094.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si762094.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si762094.exeFilesize
175KB
MD5a7ffa1429f6f6f1b7fc982eda01341e0
SHA1758ec26f7adcb1ebf527439d4b889f85406e37dd
SHA2567635291dc41b028f951409d86af737b47dfc2422829637a5394b18b61222a14c
SHA512b9d10ec62a57cda6b43a65ffe0c93cf6e7608be213535d8086c5169c7a448dd298986e34961f9279b5aa122d056d22197098a92b82d737bd3d860688bbf6c269
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si762094.exeFilesize
175KB
MD5a7ffa1429f6f6f1b7fc982eda01341e0
SHA1758ec26f7adcb1ebf527439d4b889f85406e37dd
SHA2567635291dc41b028f951409d86af737b47dfc2422829637a5394b18b61222a14c
SHA512b9d10ec62a57cda6b43a65ffe0c93cf6e7608be213535d8086c5169c7a448dd298986e34961f9279b5aa122d056d22197098a92b82d737bd3d860688bbf6c269
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un147691.exeFilesize
517KB
MD5febcd113b20d59157f9b7fba64932fb8
SHA133fb29fc980360d847e57b5ec86235e8db2e3d7d
SHA25641433b498eae7254bc7971fb58183adaccf0a8cfdf64acc03c24dcff3a10e939
SHA5126a185515b5dc615a1e4e43db6fd11ae6b3aacf2e02797f5b320bddea17fc17df24089adbba8bb5f4d74a8c61d5e36ce82405578c932a00ff6ddb658d43bc03c4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un147691.exeFilesize
517KB
MD5febcd113b20d59157f9b7fba64932fb8
SHA133fb29fc980360d847e57b5ec86235e8db2e3d7d
SHA25641433b498eae7254bc7971fb58183adaccf0a8cfdf64acc03c24dcff3a10e939
SHA5126a185515b5dc615a1e4e43db6fd11ae6b3aacf2e02797f5b320bddea17fc17df24089adbba8bb5f4d74a8c61d5e36ce82405578c932a00ff6ddb658d43bc03c4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6457.exeFilesize
237KB
MD59fd656b7cb57b6c9cd5a1bb187663b32
SHA1e4b27789dfd2dd54280a5a7768de2b21fdcce357
SHA256b831c7895fbf2d6cbe98435cc75ec6cfa532d2e1dafe0a85db4c7c03a64d0ceb
SHA512c778ceba3578ded7cafab08427cb1bb62d8127062ddb40bcade6ee47e090083875f642440b74613a672db243f4df03ccadd9573e77ef4e2049451f9f95ea782a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6457.exeFilesize
237KB
MD59fd656b7cb57b6c9cd5a1bb187663b32
SHA1e4b27789dfd2dd54280a5a7768de2b21fdcce357
SHA256b831c7895fbf2d6cbe98435cc75ec6cfa532d2e1dafe0a85db4c7c03a64d0ceb
SHA512c778ceba3578ded7cafab08427cb1bb62d8127062ddb40bcade6ee47e090083875f642440b74613a672db243f4df03ccadd9573e77ef4e2049451f9f95ea782a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5958.exeFilesize
295KB
MD5d96b5d103a5c26afa358a46e68fe3996
SHA1e1f00a11b1265faf7684f062ebba858d85d56565
SHA256912d959605b529c35abf94813f5da5cb7c8d28378e251169c37650832afa2fce
SHA5121a433773e9fabb14faaa0a4ac8b5637d1fa17c1fcacc6f4ae9a97a2c76b213b9d56a7b16128eb004f4a1ecdde5b96b2623c4a614831fee55252a8de393ac4fe3
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5958.exeFilesize
295KB
MD5d96b5d103a5c26afa358a46e68fe3996
SHA1e1f00a11b1265faf7684f062ebba858d85d56565
SHA256912d959605b529c35abf94813f5da5cb7c8d28378e251169c37650832afa2fce
SHA5121a433773e9fabb14faaa0a4ac8b5637d1fa17c1fcacc6f4ae9a97a2c76b213b9d56a7b16128eb004f4a1ecdde5b96b2623c4a614831fee55252a8de393ac4fe3
-
memory/1140-1092-0x00000000058E0000-0x00000000058F2000-memory.dmpFilesize
72KB
-
memory/1140-1093-0x0000000004A80000-0x0000000004A90000-memory.dmpFilesize
64KB
-
memory/1140-1106-0x0000000004A80000-0x0000000004A90000-memory.dmpFilesize
64KB
-
memory/1140-1105-0x0000000006650000-0x0000000006B7C000-memory.dmpFilesize
5.2MB
-
memory/1140-1104-0x0000000006480000-0x0000000006642000-memory.dmpFilesize
1.8MB
-
memory/1140-1103-0x00000000063F0000-0x0000000006440000-memory.dmpFilesize
320KB
-
memory/1140-1102-0x0000000006360000-0x00000000063D6000-memory.dmpFilesize
472KB
-
memory/1140-1101-0x00000000062A0000-0x0000000006332000-memory.dmpFilesize
584KB
-
memory/1140-1099-0x0000000004A80000-0x0000000004A90000-memory.dmpFilesize
64KB
-
memory/1140-1100-0x0000000004A80000-0x0000000004A90000-memory.dmpFilesize
64KB
-
memory/1140-1098-0x0000000004A80000-0x0000000004A90000-memory.dmpFilesize
64KB
-
memory/1140-1097-0x0000000005BE0000-0x0000000005C46000-memory.dmpFilesize
408KB
-
memory/1140-1095-0x0000000005A50000-0x0000000005A9B000-memory.dmpFilesize
300KB
-
memory/1140-195-0x0000000004A30000-0x0000000004A6F000-memory.dmpFilesize
252KB
-
memory/1140-1094-0x0000000005900000-0x000000000593E000-memory.dmpFilesize
248KB
-
memory/1140-1091-0x00000000057A0000-0x00000000058AA000-memory.dmpFilesize
1.0MB
-
memory/1140-1090-0x0000000005110000-0x0000000005716000-memory.dmpFilesize
6.0MB
-
memory/1140-217-0x0000000004A30000-0x0000000004A6F000-memory.dmpFilesize
252KB
-
memory/1140-215-0x0000000004A30000-0x0000000004A6F000-memory.dmpFilesize
252KB
-
memory/1140-213-0x0000000004A30000-0x0000000004A6F000-memory.dmpFilesize
252KB
-
memory/1140-211-0x0000000004A30000-0x0000000004A6F000-memory.dmpFilesize
252KB
-
memory/1140-209-0x0000000004A30000-0x0000000004A6F000-memory.dmpFilesize
252KB
-
memory/1140-207-0x0000000004A30000-0x0000000004A6F000-memory.dmpFilesize
252KB
-
memory/1140-178-0x00000000049B0000-0x00000000049F6000-memory.dmpFilesize
280KB
-
memory/1140-193-0x0000000004A80000-0x0000000004A90000-memory.dmpFilesize
64KB
-
memory/1140-180-0x0000000004A30000-0x0000000004A6F000-memory.dmpFilesize
252KB
-
memory/1140-181-0x0000000004A30000-0x0000000004A6F000-memory.dmpFilesize
252KB
-
memory/1140-183-0x0000000004A30000-0x0000000004A6F000-memory.dmpFilesize
252KB
-
memory/1140-185-0x0000000004A30000-0x0000000004A6F000-memory.dmpFilesize
252KB
-
memory/1140-187-0x0000000004A30000-0x0000000004A6F000-memory.dmpFilesize
252KB
-
memory/1140-189-0x0000000004A30000-0x0000000004A6F000-memory.dmpFilesize
252KB
-
memory/1140-191-0x0000000004A30000-0x0000000004A6F000-memory.dmpFilesize
252KB
-
memory/1140-205-0x0000000004A30000-0x0000000004A6F000-memory.dmpFilesize
252KB
-
memory/1140-192-0x00000000005C0000-0x000000000060B000-memory.dmpFilesize
300KB
-
memory/1140-179-0x0000000004A30000-0x0000000004A74000-memory.dmpFilesize
272KB
-
memory/1140-198-0x0000000004A80000-0x0000000004A90000-memory.dmpFilesize
64KB
-
memory/1140-199-0x0000000004A30000-0x0000000004A6F000-memory.dmpFilesize
252KB
-
memory/1140-196-0x0000000004A80000-0x0000000004A90000-memory.dmpFilesize
64KB
-
memory/1140-201-0x0000000004A30000-0x0000000004A6F000-memory.dmpFilesize
252KB
-
memory/1140-203-0x0000000004A30000-0x0000000004A6F000-memory.dmpFilesize
252KB
-
memory/2088-173-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2088-147-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/2088-139-0x00000000024F0000-0x0000000002508000-memory.dmpFilesize
96KB
-
memory/2088-157-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/2088-171-0x00000000006E0000-0x00000000006F0000-memory.dmpFilesize
64KB
-
memory/2088-170-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2088-169-0x00000000006E0000-0x00000000006F0000-memory.dmpFilesize
64KB
-
memory/2088-168-0x00000000006E0000-0x00000000006F0000-memory.dmpFilesize
64KB
-
memory/2088-167-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/2088-137-0x00000000006E0000-0x00000000006F0000-memory.dmpFilesize
64KB
-
memory/2088-155-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/2088-165-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/2088-161-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/2088-138-0x0000000004A60000-0x0000000004F5E000-memory.dmpFilesize
5.0MB
-
memory/2088-149-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/2088-140-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/2088-153-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/2088-151-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/2088-163-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/2088-159-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/2088-145-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/2088-143-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/2088-141-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/2088-136-0x00000000001D0000-0x00000000001FD000-memory.dmpFilesize
180KB
-
memory/2088-135-0x0000000000990000-0x00000000009AA000-memory.dmpFilesize
104KB
-
memory/4496-1112-0x0000000000140000-0x0000000000172000-memory.dmpFilesize
200KB
-
memory/4496-1113-0x0000000004B80000-0x0000000004BCB000-memory.dmpFilesize
300KB
-
memory/4496-1114-0x0000000004D30000-0x0000000004D40000-memory.dmpFilesize
64KB