Analysis
-
max time kernel
105s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 22:26
Static task
static1
Behavioral task
behavioral1
Sample
9ff9f2815e5e47c3eb6bd8c7c9eba02558b51f862e1ad3877029efab57e97c0f.exe
Resource
win10v2004-20230220-en
General
-
Target
9ff9f2815e5e47c3eb6bd8c7c9eba02558b51f862e1ad3877029efab57e97c0f.exe
-
Size
522KB
-
MD5
b820f3443cb7fdf2de750899ced17e90
-
SHA1
bde9d692f895e4b2ee86957f23e1f394fc550291
-
SHA256
9ff9f2815e5e47c3eb6bd8c7c9eba02558b51f862e1ad3877029efab57e97c0f
-
SHA512
614be10c268a7773ff1f0b523dd9c23cb6d348b8adc87c76c49e927afeb470cfac0d6266e66909f45dbc7d23c836dad999e296b5f8e9cc5625111cbdda450b1f
-
SSDEEP
6144:K2y+bnr+cp0yN90QERe8Q9kWWnZN2j6qW0YlIrABWD0320IhCWqClzxzF11l4d64:aMr8y90vnSm4rwWphC+JxFM68C7X4sa
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr868296.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr868296.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr868296.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr868296.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr868296.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr868296.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr868296.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 34 IoCs
Processes:
resource yara_rule behavioral1/memory/2840-155-0x0000000002750000-0x000000000278F000-memory.dmp family_redline behavioral1/memory/2840-156-0x0000000002750000-0x000000000278F000-memory.dmp family_redline behavioral1/memory/2840-158-0x0000000002750000-0x000000000278F000-memory.dmp family_redline behavioral1/memory/2840-160-0x0000000002750000-0x000000000278F000-memory.dmp family_redline behavioral1/memory/2840-162-0x0000000002750000-0x000000000278F000-memory.dmp family_redline behavioral1/memory/2840-164-0x0000000002750000-0x000000000278F000-memory.dmp family_redline behavioral1/memory/2840-167-0x0000000002750000-0x000000000278F000-memory.dmp family_redline behavioral1/memory/2840-170-0x0000000002750000-0x000000000278F000-memory.dmp family_redline behavioral1/memory/2840-173-0x0000000002750000-0x000000000278F000-memory.dmp family_redline behavioral1/memory/2840-171-0x0000000004C90000-0x0000000004CA0000-memory.dmp family_redline behavioral1/memory/2840-175-0x0000000002750000-0x000000000278F000-memory.dmp family_redline behavioral1/memory/2840-177-0x0000000002750000-0x000000000278F000-memory.dmp family_redline behavioral1/memory/2840-179-0x0000000002750000-0x000000000278F000-memory.dmp family_redline behavioral1/memory/2840-181-0x0000000002750000-0x000000000278F000-memory.dmp family_redline behavioral1/memory/2840-183-0x0000000002750000-0x000000000278F000-memory.dmp family_redline behavioral1/memory/2840-185-0x0000000002750000-0x000000000278F000-memory.dmp family_redline behavioral1/memory/2840-187-0x0000000002750000-0x000000000278F000-memory.dmp family_redline behavioral1/memory/2840-189-0x0000000002750000-0x000000000278F000-memory.dmp family_redline behavioral1/memory/2840-191-0x0000000002750000-0x000000000278F000-memory.dmp family_redline behavioral1/memory/2840-193-0x0000000002750000-0x000000000278F000-memory.dmp family_redline behavioral1/memory/2840-195-0x0000000002750000-0x000000000278F000-memory.dmp family_redline behavioral1/memory/2840-197-0x0000000002750000-0x000000000278F000-memory.dmp family_redline behavioral1/memory/2840-199-0x0000000002750000-0x000000000278F000-memory.dmp family_redline behavioral1/memory/2840-201-0x0000000002750000-0x000000000278F000-memory.dmp family_redline behavioral1/memory/2840-203-0x0000000002750000-0x000000000278F000-memory.dmp family_redline behavioral1/memory/2840-205-0x0000000002750000-0x000000000278F000-memory.dmp family_redline behavioral1/memory/2840-207-0x0000000002750000-0x000000000278F000-memory.dmp family_redline behavioral1/memory/2840-209-0x0000000002750000-0x000000000278F000-memory.dmp family_redline behavioral1/memory/2840-211-0x0000000002750000-0x000000000278F000-memory.dmp family_redline behavioral1/memory/2840-213-0x0000000002750000-0x000000000278F000-memory.dmp family_redline behavioral1/memory/2840-215-0x0000000002750000-0x000000000278F000-memory.dmp family_redline behavioral1/memory/2840-217-0x0000000002750000-0x000000000278F000-memory.dmp family_redline behavioral1/memory/2840-219-0x0000000002750000-0x000000000278F000-memory.dmp family_redline behavioral1/memory/2840-221-0x0000000002750000-0x000000000278F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
ziiU6475.exejr868296.exeku520931.exelr879579.exepid process 1944 ziiU6475.exe 3028 jr868296.exe 2840 ku520931.exe 4428 lr879579.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr868296.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr868296.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
9ff9f2815e5e47c3eb6bd8c7c9eba02558b51f862e1ad3877029efab57e97c0f.exeziiU6475.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 9ff9f2815e5e47c3eb6bd8c7c9eba02558b51f862e1ad3877029efab57e97c0f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 9ff9f2815e5e47c3eb6bd8c7c9eba02558b51f862e1ad3877029efab57e97c0f.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziiU6475.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziiU6475.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 5068 2840 WerFault.exe ku520931.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr868296.exeku520931.exelr879579.exepid process 3028 jr868296.exe 3028 jr868296.exe 2840 ku520931.exe 2840 ku520931.exe 4428 lr879579.exe 4428 lr879579.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr868296.exeku520931.exelr879579.exedescription pid process Token: SeDebugPrivilege 3028 jr868296.exe Token: SeDebugPrivilege 2840 ku520931.exe Token: SeDebugPrivilege 4428 lr879579.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
9ff9f2815e5e47c3eb6bd8c7c9eba02558b51f862e1ad3877029efab57e97c0f.exeziiU6475.exedescription pid process target process PID 4156 wrote to memory of 1944 4156 9ff9f2815e5e47c3eb6bd8c7c9eba02558b51f862e1ad3877029efab57e97c0f.exe ziiU6475.exe PID 4156 wrote to memory of 1944 4156 9ff9f2815e5e47c3eb6bd8c7c9eba02558b51f862e1ad3877029efab57e97c0f.exe ziiU6475.exe PID 4156 wrote to memory of 1944 4156 9ff9f2815e5e47c3eb6bd8c7c9eba02558b51f862e1ad3877029efab57e97c0f.exe ziiU6475.exe PID 1944 wrote to memory of 3028 1944 ziiU6475.exe jr868296.exe PID 1944 wrote to memory of 3028 1944 ziiU6475.exe jr868296.exe PID 1944 wrote to memory of 2840 1944 ziiU6475.exe ku520931.exe PID 1944 wrote to memory of 2840 1944 ziiU6475.exe ku520931.exe PID 1944 wrote to memory of 2840 1944 ziiU6475.exe ku520931.exe PID 4156 wrote to memory of 4428 4156 9ff9f2815e5e47c3eb6bd8c7c9eba02558b51f862e1ad3877029efab57e97c0f.exe lr879579.exe PID 4156 wrote to memory of 4428 4156 9ff9f2815e5e47c3eb6bd8c7c9eba02558b51f862e1ad3877029efab57e97c0f.exe lr879579.exe PID 4156 wrote to memory of 4428 4156 9ff9f2815e5e47c3eb6bd8c7c9eba02558b51f862e1ad3877029efab57e97c0f.exe lr879579.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ff9f2815e5e47c3eb6bd8c7c9eba02558b51f862e1ad3877029efab57e97c0f.exe"C:\Users\Admin\AppData\Local\Temp\9ff9f2815e5e47c3eb6bd8c7c9eba02558b51f862e1ad3877029efab57e97c0f.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziiU6475.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziiU6475.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr868296.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr868296.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku520931.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku520931.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 15564⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr879579.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr879579.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2840 -ip 28401⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr879579.exeFilesize
175KB
MD553d5cdd81125ecf3910dbed1f0aa3bb9
SHA1a90bf67e1cfee79009f74cec763914b1950f5957
SHA2560694a4d4218a6707ac8fee56a99a518269860026e5c3486030fa229f5de27698
SHA51298f8456e8b189dbc88407d083234ac6ed8fe11e63ea52beff3dd203d5a68859eda4d1904d7956b8db157e148d9f6cd8dd824e6249de3a57a22d21841d2ad6f5d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr879579.exeFilesize
175KB
MD553d5cdd81125ecf3910dbed1f0aa3bb9
SHA1a90bf67e1cfee79009f74cec763914b1950f5957
SHA2560694a4d4218a6707ac8fee56a99a518269860026e5c3486030fa229f5de27698
SHA51298f8456e8b189dbc88407d083234ac6ed8fe11e63ea52beff3dd203d5a68859eda4d1904d7956b8db157e148d9f6cd8dd824e6249de3a57a22d21841d2ad6f5d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziiU6475.exeFilesize
380KB
MD59512b239d2b8ffd6f167aa06890fa9b2
SHA16b50c2502503fcf334a9749fadda6f75ac0c3f00
SHA25653e088f64e6bff23ad85bc158cb418ccbc1e649f0cb0cc93211ce5ea2f358574
SHA512a05093df02e65494579bb920a7a80bcb3387f66643fe0e24dc38846fc320384feae6092c36589784252e2bed95777fde23ea0a785d93a3c4e6509a92e15c87db
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziiU6475.exeFilesize
380KB
MD59512b239d2b8ffd6f167aa06890fa9b2
SHA16b50c2502503fcf334a9749fadda6f75ac0c3f00
SHA25653e088f64e6bff23ad85bc158cb418ccbc1e649f0cb0cc93211ce5ea2f358574
SHA512a05093df02e65494579bb920a7a80bcb3387f66643fe0e24dc38846fc320384feae6092c36589784252e2bed95777fde23ea0a785d93a3c4e6509a92e15c87db
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr868296.exeFilesize
15KB
MD5edbc7fbfe034541cf3839acba689af0b
SHA16607bc99b1534556f7281368bd6cc8ba718eb410
SHA256fde8d7587bad0fea0a575867326ddafd8c00d2e7313c8ff00d1b5d9a99bf14e3
SHA5128e1dfc673e7f267418fdf1f8877cd452d8b232ba4fbb559724d6befc41b3ee4eb723f5286c37f51ef8179fad4d1899d3fb958fcb6587319bce39d7f680af6362
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr868296.exeFilesize
15KB
MD5edbc7fbfe034541cf3839acba689af0b
SHA16607bc99b1534556f7281368bd6cc8ba718eb410
SHA256fde8d7587bad0fea0a575867326ddafd8c00d2e7313c8ff00d1b5d9a99bf14e3
SHA5128e1dfc673e7f267418fdf1f8877cd452d8b232ba4fbb559724d6befc41b3ee4eb723f5286c37f51ef8179fad4d1899d3fb958fcb6587319bce39d7f680af6362
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku520931.exeFilesize
295KB
MD5888cc777a281d08d6d56167959d8103e
SHA1e2bbe65a614774c54c54e1cf0444915d16ef5e01
SHA2568bd18d8f0eb5cf09e4d5bdcc51723f88e5ba16a0cea18555f94c76c9b2e485bb
SHA512cecf699a32a844dbafbfba59c457fe315895270bd8ee23f84bc48f9bf88da429e18b827241b211308e8b6e4d570660abcd08f62e82d1f3fda0415d0412faede8
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku520931.exeFilesize
295KB
MD5888cc777a281d08d6d56167959d8103e
SHA1e2bbe65a614774c54c54e1cf0444915d16ef5e01
SHA2568bd18d8f0eb5cf09e4d5bdcc51723f88e5ba16a0cea18555f94c76c9b2e485bb
SHA512cecf699a32a844dbafbfba59c457fe315895270bd8ee23f84bc48f9bf88da429e18b827241b211308e8b6e4d570660abcd08f62e82d1f3fda0415d0412faede8
-
memory/2840-153-0x0000000002140000-0x000000000218B000-memory.dmpFilesize
300KB
-
memory/2840-154-0x0000000004CA0000-0x0000000005244000-memory.dmpFilesize
5.6MB
-
memory/2840-155-0x0000000002750000-0x000000000278F000-memory.dmpFilesize
252KB
-
memory/2840-156-0x0000000002750000-0x000000000278F000-memory.dmpFilesize
252KB
-
memory/2840-158-0x0000000002750000-0x000000000278F000-memory.dmpFilesize
252KB
-
memory/2840-160-0x0000000002750000-0x000000000278F000-memory.dmpFilesize
252KB
-
memory/2840-162-0x0000000002750000-0x000000000278F000-memory.dmpFilesize
252KB
-
memory/2840-164-0x0000000002750000-0x000000000278F000-memory.dmpFilesize
252KB
-
memory/2840-166-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/2840-167-0x0000000002750000-0x000000000278F000-memory.dmpFilesize
252KB
-
memory/2840-170-0x0000000002750000-0x000000000278F000-memory.dmpFilesize
252KB
-
memory/2840-168-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/2840-173-0x0000000002750000-0x000000000278F000-memory.dmpFilesize
252KB
-
memory/2840-171-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/2840-175-0x0000000002750000-0x000000000278F000-memory.dmpFilesize
252KB
-
memory/2840-177-0x0000000002750000-0x000000000278F000-memory.dmpFilesize
252KB
-
memory/2840-179-0x0000000002750000-0x000000000278F000-memory.dmpFilesize
252KB
-
memory/2840-181-0x0000000002750000-0x000000000278F000-memory.dmpFilesize
252KB
-
memory/2840-183-0x0000000002750000-0x000000000278F000-memory.dmpFilesize
252KB
-
memory/2840-185-0x0000000002750000-0x000000000278F000-memory.dmpFilesize
252KB
-
memory/2840-187-0x0000000002750000-0x000000000278F000-memory.dmpFilesize
252KB
-
memory/2840-189-0x0000000002750000-0x000000000278F000-memory.dmpFilesize
252KB
-
memory/2840-191-0x0000000002750000-0x000000000278F000-memory.dmpFilesize
252KB
-
memory/2840-193-0x0000000002750000-0x000000000278F000-memory.dmpFilesize
252KB
-
memory/2840-195-0x0000000002750000-0x000000000278F000-memory.dmpFilesize
252KB
-
memory/2840-197-0x0000000002750000-0x000000000278F000-memory.dmpFilesize
252KB
-
memory/2840-199-0x0000000002750000-0x000000000278F000-memory.dmpFilesize
252KB
-
memory/2840-201-0x0000000002750000-0x000000000278F000-memory.dmpFilesize
252KB
-
memory/2840-203-0x0000000002750000-0x000000000278F000-memory.dmpFilesize
252KB
-
memory/2840-205-0x0000000002750000-0x000000000278F000-memory.dmpFilesize
252KB
-
memory/2840-207-0x0000000002750000-0x000000000278F000-memory.dmpFilesize
252KB
-
memory/2840-209-0x0000000002750000-0x000000000278F000-memory.dmpFilesize
252KB
-
memory/2840-211-0x0000000002750000-0x000000000278F000-memory.dmpFilesize
252KB
-
memory/2840-213-0x0000000002750000-0x000000000278F000-memory.dmpFilesize
252KB
-
memory/2840-215-0x0000000002750000-0x000000000278F000-memory.dmpFilesize
252KB
-
memory/2840-217-0x0000000002750000-0x000000000278F000-memory.dmpFilesize
252KB
-
memory/2840-219-0x0000000002750000-0x000000000278F000-memory.dmpFilesize
252KB
-
memory/2840-221-0x0000000002750000-0x000000000278F000-memory.dmpFilesize
252KB
-
memory/2840-1064-0x0000000005250000-0x0000000005868000-memory.dmpFilesize
6.1MB
-
memory/2840-1065-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/2840-1066-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/2840-1067-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/2840-1068-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/2840-1070-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/2840-1071-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/2840-1072-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/2840-1073-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/2840-1074-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/2840-1075-0x0000000006490000-0x0000000006506000-memory.dmpFilesize
472KB
-
memory/2840-1076-0x0000000006520000-0x0000000006570000-memory.dmpFilesize
320KB
-
memory/2840-1077-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/2840-1078-0x00000000067F0000-0x00000000069B2000-memory.dmpFilesize
1.8MB
-
memory/2840-1079-0x00000000069C0000-0x0000000006EEC000-memory.dmpFilesize
5.2MB
-
memory/3028-147-0x0000000000310000-0x000000000031A000-memory.dmpFilesize
40KB
-
memory/4428-1087-0x0000000000F00000-0x0000000000F32000-memory.dmpFilesize
200KB
-
memory/4428-1088-0x0000000005780000-0x0000000005790000-memory.dmpFilesize
64KB