Analysis
-
max time kernel
104s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 22:28
Static task
static1
Behavioral task
behavioral1
Sample
d394d0348a02f02356c5ddf6e0a05016c55a1b663d784b999bd7d75287301f32.exe
Resource
win10v2004-20230220-en
General
-
Target
d394d0348a02f02356c5ddf6e0a05016c55a1b663d784b999bd7d75287301f32.exe
-
Size
659KB
-
MD5
72e566cdbfbac0f1594673727194bf6e
-
SHA1
0f365c3902f4ae7340a16c105465ee53f362ae64
-
SHA256
d394d0348a02f02356c5ddf6e0a05016c55a1b663d784b999bd7d75287301f32
-
SHA512
f5777ea8515587471f23f44c3ee3b02bb43549c5ca425211bbad4cd3ce39315bbf7fe4083dbf761a06c4b8d74bfdf3e6b5174f4e3b00ac50ab52987da5eb9362
-
SSDEEP
12288:ZMrQy90EqikwOr3ow1mbdW2GUdQ1KNt59lrwAVmCoDlft/ju+znBlI:9y7kwc3Vms8Ht5vTVXoRBxBC
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro4195.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro4195.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro4195.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro4195.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro4195.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro4195.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro4195.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/3856-188-0x0000000005180000-0x00000000051BF000-memory.dmp family_redline behavioral1/memory/3856-189-0x0000000005180000-0x00000000051BF000-memory.dmp family_redline behavioral1/memory/3856-191-0x0000000005180000-0x00000000051BF000-memory.dmp family_redline behavioral1/memory/3856-193-0x0000000005180000-0x00000000051BF000-memory.dmp family_redline behavioral1/memory/3856-195-0x0000000005180000-0x00000000051BF000-memory.dmp family_redline behavioral1/memory/3856-197-0x0000000005180000-0x00000000051BF000-memory.dmp family_redline behavioral1/memory/3856-199-0x0000000005180000-0x00000000051BF000-memory.dmp family_redline behavioral1/memory/3856-201-0x0000000005180000-0x00000000051BF000-memory.dmp family_redline behavioral1/memory/3856-203-0x0000000005180000-0x00000000051BF000-memory.dmp family_redline behavioral1/memory/3856-205-0x0000000005180000-0x00000000051BF000-memory.dmp family_redline behavioral1/memory/3856-207-0x0000000005180000-0x00000000051BF000-memory.dmp family_redline behavioral1/memory/3856-209-0x0000000005180000-0x00000000051BF000-memory.dmp family_redline behavioral1/memory/3856-211-0x0000000005180000-0x00000000051BF000-memory.dmp family_redline behavioral1/memory/3856-213-0x0000000005180000-0x00000000051BF000-memory.dmp family_redline behavioral1/memory/3856-215-0x0000000005180000-0x00000000051BF000-memory.dmp family_redline behavioral1/memory/3856-217-0x0000000005180000-0x00000000051BF000-memory.dmp family_redline behavioral1/memory/3856-219-0x0000000005180000-0x00000000051BF000-memory.dmp family_redline behavioral1/memory/3856-224-0x0000000005180000-0x00000000051BF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un714355.exepro4195.exequ2525.exesi981613.exepid process 3932 un714355.exe 1340 pro4195.exe 3856 qu2525.exe 4824 si981613.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro4195.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro4195.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro4195.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
d394d0348a02f02356c5ddf6e0a05016c55a1b663d784b999bd7d75287301f32.exeun714355.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce d394d0348a02f02356c5ddf6e0a05016c55a1b663d784b999bd7d75287301f32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" d394d0348a02f02356c5ddf6e0a05016c55a1b663d784b999bd7d75287301f32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un714355.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un714355.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4688 1340 WerFault.exe pro4195.exe 432 3856 WerFault.exe qu2525.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro4195.exequ2525.exesi981613.exepid process 1340 pro4195.exe 1340 pro4195.exe 3856 qu2525.exe 3856 qu2525.exe 4824 si981613.exe 4824 si981613.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro4195.exequ2525.exesi981613.exedescription pid process Token: SeDebugPrivilege 1340 pro4195.exe Token: SeDebugPrivilege 3856 qu2525.exe Token: SeDebugPrivilege 4824 si981613.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
d394d0348a02f02356c5ddf6e0a05016c55a1b663d784b999bd7d75287301f32.exeun714355.exedescription pid process target process PID 1916 wrote to memory of 3932 1916 d394d0348a02f02356c5ddf6e0a05016c55a1b663d784b999bd7d75287301f32.exe un714355.exe PID 1916 wrote to memory of 3932 1916 d394d0348a02f02356c5ddf6e0a05016c55a1b663d784b999bd7d75287301f32.exe un714355.exe PID 1916 wrote to memory of 3932 1916 d394d0348a02f02356c5ddf6e0a05016c55a1b663d784b999bd7d75287301f32.exe un714355.exe PID 3932 wrote to memory of 1340 3932 un714355.exe pro4195.exe PID 3932 wrote to memory of 1340 3932 un714355.exe pro4195.exe PID 3932 wrote to memory of 1340 3932 un714355.exe pro4195.exe PID 3932 wrote to memory of 3856 3932 un714355.exe qu2525.exe PID 3932 wrote to memory of 3856 3932 un714355.exe qu2525.exe PID 3932 wrote to memory of 3856 3932 un714355.exe qu2525.exe PID 1916 wrote to memory of 4824 1916 d394d0348a02f02356c5ddf6e0a05016c55a1b663d784b999bd7d75287301f32.exe si981613.exe PID 1916 wrote to memory of 4824 1916 d394d0348a02f02356c5ddf6e0a05016c55a1b663d784b999bd7d75287301f32.exe si981613.exe PID 1916 wrote to memory of 4824 1916 d394d0348a02f02356c5ddf6e0a05016c55a1b663d784b999bd7d75287301f32.exe si981613.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d394d0348a02f02356c5ddf6e0a05016c55a1b663d784b999bd7d75287301f32.exe"C:\Users\Admin\AppData\Local\Temp\d394d0348a02f02356c5ddf6e0a05016c55a1b663d784b999bd7d75287301f32.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un714355.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un714355.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4195.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4195.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 10844⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2525.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2525.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 15524⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si981613.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si981613.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1340 -ip 13401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3856 -ip 38561⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si981613.exeFilesize
175KB
MD542392b833651be71534ff5d92d4705c8
SHA1f3c2c98b95d11d401a1dbdc230cd560bb49d2208
SHA2568f11b964d4bb9d0138dfd52456c1908c37b1526ef863384893a07fdc3f03250d
SHA51251a96363dc17779c40684d3383bff8b2ee76605750df561d0f25221fa02e3d60641e9ec643ade1aa716553394528773c5516e9715c6c9dfc72b2401eb7a45d0f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si981613.exeFilesize
175KB
MD542392b833651be71534ff5d92d4705c8
SHA1f3c2c98b95d11d401a1dbdc230cd560bb49d2208
SHA2568f11b964d4bb9d0138dfd52456c1908c37b1526ef863384893a07fdc3f03250d
SHA51251a96363dc17779c40684d3383bff8b2ee76605750df561d0f25221fa02e3d60641e9ec643ade1aa716553394528773c5516e9715c6c9dfc72b2401eb7a45d0f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un714355.exeFilesize
517KB
MD5f2b1e5e09c834eb67dcb86a19e416892
SHA1aed2b05f8ea980d11e1d6823d10a527aa0a443ba
SHA256b5888df5eaf5508a44bab6f70f9f4f82c750672e1138532a64df784024eb8488
SHA5125f513656b10fe177ea41d5b6e1090b8a9b6224503f0becfd47bf92133a9709ec2ed44488c158038bb69eee993dc4e5f8a5be080eebf7c57745338248efd69a59
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un714355.exeFilesize
517KB
MD5f2b1e5e09c834eb67dcb86a19e416892
SHA1aed2b05f8ea980d11e1d6823d10a527aa0a443ba
SHA256b5888df5eaf5508a44bab6f70f9f4f82c750672e1138532a64df784024eb8488
SHA5125f513656b10fe177ea41d5b6e1090b8a9b6224503f0becfd47bf92133a9709ec2ed44488c158038bb69eee993dc4e5f8a5be080eebf7c57745338248efd69a59
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4195.exeFilesize
237KB
MD507aebc13537b7aabdbd05cdecfa40e48
SHA14024d22931367f4f5fc3fe9148fc50d3bb4dcadd
SHA256a58b3a87bb77bbd0cf6c05735be32480e1378be82b158d4a51eccc36f0081797
SHA512fe215d29c208f14943c5284a7ac7fef408df3cf82a857942605b2c272fd43f408b738c4f5ae1f8215efc66f9c1becd8444b51181c976cff8248d144f8976fe1f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4195.exeFilesize
237KB
MD507aebc13537b7aabdbd05cdecfa40e48
SHA14024d22931367f4f5fc3fe9148fc50d3bb4dcadd
SHA256a58b3a87bb77bbd0cf6c05735be32480e1378be82b158d4a51eccc36f0081797
SHA512fe215d29c208f14943c5284a7ac7fef408df3cf82a857942605b2c272fd43f408b738c4f5ae1f8215efc66f9c1becd8444b51181c976cff8248d144f8976fe1f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2525.exeFilesize
295KB
MD5601a7096a1c85e2b27b30fffc9e38da8
SHA1ee2416365bea269a395c5225197568bd858dada9
SHA256834060fefcc0b3fc1be738afdd9f7a5f56615ac56d41372523468ad98f0b72cb
SHA5121e07a39e80402cea4bcfe01f02ef778c6964f2ee9113862da0137e34285aee3289acebeffdd199b87a458357f71ecd6fdb1ba3f6c42a9d80c044caed6ec24d52
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2525.exeFilesize
295KB
MD5601a7096a1c85e2b27b30fffc9e38da8
SHA1ee2416365bea269a395c5225197568bd858dada9
SHA256834060fefcc0b3fc1be738afdd9f7a5f56615ac56d41372523468ad98f0b72cb
SHA5121e07a39e80402cea4bcfe01f02ef778c6964f2ee9113862da0137e34285aee3289acebeffdd199b87a458357f71ecd6fdb1ba3f6c42a9d80c044caed6ec24d52
-
memory/1340-148-0x00000000005C0000-0x00000000005ED000-memory.dmpFilesize
180KB
-
memory/1340-149-0x0000000004DD0000-0x0000000004DE0000-memory.dmpFilesize
64KB
-
memory/1340-150-0x0000000004DD0000-0x0000000004DE0000-memory.dmpFilesize
64KB
-
memory/1340-151-0x0000000004DE0000-0x0000000005384000-memory.dmpFilesize
5.6MB
-
memory/1340-152-0x00000000024A0000-0x00000000024B2000-memory.dmpFilesize
72KB
-
memory/1340-153-0x00000000024A0000-0x00000000024B2000-memory.dmpFilesize
72KB
-
memory/1340-155-0x00000000024A0000-0x00000000024B2000-memory.dmpFilesize
72KB
-
memory/1340-157-0x00000000024A0000-0x00000000024B2000-memory.dmpFilesize
72KB
-
memory/1340-159-0x00000000024A0000-0x00000000024B2000-memory.dmpFilesize
72KB
-
memory/1340-161-0x00000000024A0000-0x00000000024B2000-memory.dmpFilesize
72KB
-
memory/1340-163-0x00000000024A0000-0x00000000024B2000-memory.dmpFilesize
72KB
-
memory/1340-165-0x00000000024A0000-0x00000000024B2000-memory.dmpFilesize
72KB
-
memory/1340-167-0x00000000024A0000-0x00000000024B2000-memory.dmpFilesize
72KB
-
memory/1340-169-0x00000000024A0000-0x00000000024B2000-memory.dmpFilesize
72KB
-
memory/1340-171-0x00000000024A0000-0x00000000024B2000-memory.dmpFilesize
72KB
-
memory/1340-173-0x00000000024A0000-0x00000000024B2000-memory.dmpFilesize
72KB
-
memory/1340-175-0x00000000024A0000-0x00000000024B2000-memory.dmpFilesize
72KB
-
memory/1340-177-0x00000000024A0000-0x00000000024B2000-memory.dmpFilesize
72KB
-
memory/1340-179-0x00000000024A0000-0x00000000024B2000-memory.dmpFilesize
72KB
-
memory/1340-180-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1340-181-0x0000000004DD0000-0x0000000004DE0000-memory.dmpFilesize
64KB
-
memory/1340-183-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/3856-188-0x0000000005180000-0x00000000051BF000-memory.dmpFilesize
252KB
-
memory/3856-189-0x0000000005180000-0x00000000051BF000-memory.dmpFilesize
252KB
-
memory/3856-191-0x0000000005180000-0x00000000051BF000-memory.dmpFilesize
252KB
-
memory/3856-193-0x0000000005180000-0x00000000051BF000-memory.dmpFilesize
252KB
-
memory/3856-195-0x0000000005180000-0x00000000051BF000-memory.dmpFilesize
252KB
-
memory/3856-197-0x0000000005180000-0x00000000051BF000-memory.dmpFilesize
252KB
-
memory/3856-199-0x0000000005180000-0x00000000051BF000-memory.dmpFilesize
252KB
-
memory/3856-201-0x0000000005180000-0x00000000051BF000-memory.dmpFilesize
252KB
-
memory/3856-203-0x0000000005180000-0x00000000051BF000-memory.dmpFilesize
252KB
-
memory/3856-205-0x0000000005180000-0x00000000051BF000-memory.dmpFilesize
252KB
-
memory/3856-207-0x0000000005180000-0x00000000051BF000-memory.dmpFilesize
252KB
-
memory/3856-209-0x0000000005180000-0x00000000051BF000-memory.dmpFilesize
252KB
-
memory/3856-211-0x0000000005180000-0x00000000051BF000-memory.dmpFilesize
252KB
-
memory/3856-213-0x0000000005180000-0x00000000051BF000-memory.dmpFilesize
252KB
-
memory/3856-215-0x0000000005180000-0x00000000051BF000-memory.dmpFilesize
252KB
-
memory/3856-217-0x0000000005180000-0x00000000051BF000-memory.dmpFilesize
252KB
-
memory/3856-220-0x0000000002110000-0x000000000215B000-memory.dmpFilesize
300KB
-
memory/3856-219-0x0000000005180000-0x00000000051BF000-memory.dmpFilesize
252KB
-
memory/3856-222-0x0000000002750000-0x0000000002760000-memory.dmpFilesize
64KB
-
memory/3856-226-0x0000000002750000-0x0000000002760000-memory.dmpFilesize
64KB
-
memory/3856-224-0x0000000005180000-0x00000000051BF000-memory.dmpFilesize
252KB
-
memory/3856-223-0x0000000002750000-0x0000000002760000-memory.dmpFilesize
64KB
-
memory/3856-1098-0x0000000005200000-0x0000000005818000-memory.dmpFilesize
6.1MB
-
memory/3856-1099-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/3856-1100-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/3856-1101-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/3856-1102-0x0000000002750000-0x0000000002760000-memory.dmpFilesize
64KB
-
memory/3856-1104-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/3856-1105-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/3856-1106-0x00000000065F0000-0x00000000067B2000-memory.dmpFilesize
1.8MB
-
memory/3856-1108-0x0000000002750000-0x0000000002760000-memory.dmpFilesize
64KB
-
memory/3856-1109-0x0000000002750000-0x0000000002760000-memory.dmpFilesize
64KB
-
memory/3856-1107-0x00000000067C0000-0x0000000006CEC000-memory.dmpFilesize
5.2MB
-
memory/3856-1110-0x0000000002750000-0x0000000002760000-memory.dmpFilesize
64KB
-
memory/3856-1111-0x0000000002750000-0x0000000002760000-memory.dmpFilesize
64KB
-
memory/3856-1112-0x0000000006E40000-0x0000000006EB6000-memory.dmpFilesize
472KB
-
memory/3856-1113-0x0000000006EC0000-0x0000000006F10000-memory.dmpFilesize
320KB
-
memory/4824-1120-0x0000000000040000-0x0000000000072000-memory.dmpFilesize
200KB
-
memory/4824-1121-0x0000000004BE0000-0x0000000004BF0000-memory.dmpFilesize
64KB
-
memory/4824-1122-0x0000000004BE0000-0x0000000004BF0000-memory.dmpFilesize
64KB