Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 22:30
Static task
static1
Behavioral task
behavioral1
Sample
fc2ab597a2cafa0f7dbd2a18675afac9c8134a2c47d9bccbead656f064f6651f.exe
Resource
win10v2004-20230220-en
General
-
Target
fc2ab597a2cafa0f7dbd2a18675afac9c8134a2c47d9bccbead656f064f6651f.exe
-
Size
522KB
-
MD5
a3bd01de09ded7a077cbc3dd9890b724
-
SHA1
139154d4c7f9457f27f68e2fa6224272685a06fd
-
SHA256
fc2ab597a2cafa0f7dbd2a18675afac9c8134a2c47d9bccbead656f064f6651f
-
SHA512
1c6abd527ecd9547843b3968888b31249b7bc7e2ed44b2acff5f0efd6555ad6c4753a2828752493f96557ba0a8ed1ce2037fb4ebd3acd383aa5e4ffce21796e5
-
SSDEEP
12288:DMrty90eiK8J+cmVCEO0KMNrwPOhC7J6OdFdCCeeeD:CyKB+OVMNwOY7wmybn
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr983587.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr983587.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr983587.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr983587.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr983587.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr983587.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr983587.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/4708-158-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/4708-159-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/4708-161-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/4708-163-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/4708-165-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/4708-167-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/4708-169-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/4708-171-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/4708-173-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/4708-175-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/4708-177-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/4708-179-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/4708-181-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/4708-183-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/4708-185-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/4708-187-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/4708-189-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/4708-191-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/4708-193-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/4708-195-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/4708-197-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/4708-199-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/4708-201-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/4708-203-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/4708-205-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/4708-207-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/4708-209-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/4708-211-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/4708-213-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/4708-215-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/4708-217-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/4708-219-0x0000000005040000-0x000000000507F000-memory.dmp family_redline behavioral1/memory/4708-221-0x0000000005040000-0x000000000507F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
zijp5457.exejr983587.exeku023415.exelr115359.exepid process 2844 zijp5457.exe 4456 jr983587.exe 4708 ku023415.exe 5084 lr115359.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr983587.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr983587.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
fc2ab597a2cafa0f7dbd2a18675afac9c8134a2c47d9bccbead656f064f6651f.exezijp5457.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce fc2ab597a2cafa0f7dbd2a18675afac9c8134a2c47d9bccbead656f064f6651f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" fc2ab597a2cafa0f7dbd2a18675afac9c8134a2c47d9bccbead656f064f6651f.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zijp5457.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zijp5457.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4408 4708 WerFault.exe ku023415.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr983587.exeku023415.exelr115359.exepid process 4456 jr983587.exe 4456 jr983587.exe 4708 ku023415.exe 4708 ku023415.exe 5084 lr115359.exe 5084 lr115359.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr983587.exeku023415.exelr115359.exedescription pid process Token: SeDebugPrivilege 4456 jr983587.exe Token: SeDebugPrivilege 4708 ku023415.exe Token: SeDebugPrivilege 5084 lr115359.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
fc2ab597a2cafa0f7dbd2a18675afac9c8134a2c47d9bccbead656f064f6651f.exezijp5457.exedescription pid process target process PID 4712 wrote to memory of 2844 4712 fc2ab597a2cafa0f7dbd2a18675afac9c8134a2c47d9bccbead656f064f6651f.exe zijp5457.exe PID 4712 wrote to memory of 2844 4712 fc2ab597a2cafa0f7dbd2a18675afac9c8134a2c47d9bccbead656f064f6651f.exe zijp5457.exe PID 4712 wrote to memory of 2844 4712 fc2ab597a2cafa0f7dbd2a18675afac9c8134a2c47d9bccbead656f064f6651f.exe zijp5457.exe PID 2844 wrote to memory of 4456 2844 zijp5457.exe jr983587.exe PID 2844 wrote to memory of 4456 2844 zijp5457.exe jr983587.exe PID 2844 wrote to memory of 4708 2844 zijp5457.exe ku023415.exe PID 2844 wrote to memory of 4708 2844 zijp5457.exe ku023415.exe PID 2844 wrote to memory of 4708 2844 zijp5457.exe ku023415.exe PID 4712 wrote to memory of 5084 4712 fc2ab597a2cafa0f7dbd2a18675afac9c8134a2c47d9bccbead656f064f6651f.exe lr115359.exe PID 4712 wrote to memory of 5084 4712 fc2ab597a2cafa0f7dbd2a18675afac9c8134a2c47d9bccbead656f064f6651f.exe lr115359.exe PID 4712 wrote to memory of 5084 4712 fc2ab597a2cafa0f7dbd2a18675afac9c8134a2c47d9bccbead656f064f6651f.exe lr115359.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc2ab597a2cafa0f7dbd2a18675afac9c8134a2c47d9bccbead656f064f6651f.exe"C:\Users\Admin\AppData\Local\Temp\fc2ab597a2cafa0f7dbd2a18675afac9c8134a2c47d9bccbead656f064f6651f.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zijp5457.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zijp5457.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr983587.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr983587.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku023415.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku023415.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4708 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 17684⤵
- Program crash
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr115359.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr115359.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5084
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4708 -ip 47081⤵PID:1616
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr115359.exeFilesize
175KB
MD56e9dc2d39befa7ba0bd9f440a86147b5
SHA1cb5bc8a33f2401ce25ad801004cbc108e6dd09f0
SHA2568b9d62095f5843dfa70c4948443b7a3056244cb4655534a87544a00cd580d04e
SHA512565be8c8ba06ba9ca0037e955b92859d2290f8b12d70b86181bd33c805193294e02930343c1b1b88dc990d964ac5e7dab3e8212a3ab591d5520a33e9e59debb1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr115359.exeFilesize
175KB
MD56e9dc2d39befa7ba0bd9f440a86147b5
SHA1cb5bc8a33f2401ce25ad801004cbc108e6dd09f0
SHA2568b9d62095f5843dfa70c4948443b7a3056244cb4655534a87544a00cd580d04e
SHA512565be8c8ba06ba9ca0037e955b92859d2290f8b12d70b86181bd33c805193294e02930343c1b1b88dc990d964ac5e7dab3e8212a3ab591d5520a33e9e59debb1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zijp5457.exeFilesize
380KB
MD51904afeb815147ce6fd95cc813f6ae11
SHA1e982063628128d20884cab82658e9d266d802424
SHA256dca4938770164371aa107bebbe0f624d859f5384573aa4f623f7b27a021a015b
SHA5124135bd6bbdb7ad6753197f6855fa388abbe9de709bab614cf731d370413aface4d7bddbd17a73112d99df293ba499bc6138523d87e336674cb252943bd139702
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zijp5457.exeFilesize
380KB
MD51904afeb815147ce6fd95cc813f6ae11
SHA1e982063628128d20884cab82658e9d266d802424
SHA256dca4938770164371aa107bebbe0f624d859f5384573aa4f623f7b27a021a015b
SHA5124135bd6bbdb7ad6753197f6855fa388abbe9de709bab614cf731d370413aface4d7bddbd17a73112d99df293ba499bc6138523d87e336674cb252943bd139702
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr983587.exeFilesize
15KB
MD5a870103746c359c115ac0a16d915948b
SHA115c05220a95ae9ac6b963e0d2ca3fb14ef5c63d7
SHA256ef54cfce7843347f69148cf6e4db46da2c3ce1e33b522ca256f574637ada1b50
SHA512d7efbc4e72c1b7ac54e76d82afe9903236b07a22b504ffdb8d8637d2aec854570dd61ecd8e45b1e4307eb5ef11763b95f444ef18f991ffdc6016d4b7a96bd98a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr983587.exeFilesize
15KB
MD5a870103746c359c115ac0a16d915948b
SHA115c05220a95ae9ac6b963e0d2ca3fb14ef5c63d7
SHA256ef54cfce7843347f69148cf6e4db46da2c3ce1e33b522ca256f574637ada1b50
SHA512d7efbc4e72c1b7ac54e76d82afe9903236b07a22b504ffdb8d8637d2aec854570dd61ecd8e45b1e4307eb5ef11763b95f444ef18f991ffdc6016d4b7a96bd98a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku023415.exeFilesize
295KB
MD5c565246f7c19aa840142ce2a78bf67d1
SHA1949cb1eaf75357221e667747ecad20881f6d7d5a
SHA256a156db13490ca0a9350c2b84ea4d199edaf4b3d05006dfefcb591ed62cd4eafb
SHA51224fe5b91ed8d8c8c56c1d071f876efbda7840d02388b1eed88c51b8227044c3597f561f81ecd801a9ab56d05da813c695bcac8e3476ab81dd1f8b845943fe9c0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku023415.exeFilesize
295KB
MD5c565246f7c19aa840142ce2a78bf67d1
SHA1949cb1eaf75357221e667747ecad20881f6d7d5a
SHA256a156db13490ca0a9350c2b84ea4d199edaf4b3d05006dfefcb591ed62cd4eafb
SHA51224fe5b91ed8d8c8c56c1d071f876efbda7840d02388b1eed88c51b8227044c3597f561f81ecd801a9ab56d05da813c695bcac8e3476ab81dd1f8b845943fe9c0
-
memory/4456-147-0x0000000000710000-0x000000000071A000-memory.dmpFilesize
40KB
-
memory/4708-153-0x0000000004A50000-0x0000000004FF4000-memory.dmpFilesize
5.6MB
-
memory/4708-154-0x0000000000630000-0x000000000067B000-memory.dmpFilesize
300KB
-
memory/4708-156-0x0000000004A40000-0x0000000004A50000-memory.dmpFilesize
64KB
-
memory/4708-157-0x0000000004A40000-0x0000000004A50000-memory.dmpFilesize
64KB
-
memory/4708-155-0x0000000004A40000-0x0000000004A50000-memory.dmpFilesize
64KB
-
memory/4708-158-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/4708-159-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/4708-161-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/4708-163-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/4708-165-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/4708-167-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/4708-169-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/4708-171-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/4708-173-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/4708-175-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/4708-177-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/4708-179-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/4708-181-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/4708-183-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/4708-185-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/4708-187-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/4708-189-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/4708-191-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/4708-193-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/4708-195-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/4708-197-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/4708-199-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/4708-201-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/4708-203-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/4708-205-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/4708-207-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/4708-209-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/4708-211-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/4708-213-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/4708-215-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/4708-217-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/4708-219-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/4708-221-0x0000000005040000-0x000000000507F000-memory.dmpFilesize
252KB
-
memory/4708-1064-0x0000000005200000-0x0000000005818000-memory.dmpFilesize
6.1MB
-
memory/4708-1065-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/4708-1066-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/4708-1067-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/4708-1068-0x0000000004A40000-0x0000000004A50000-memory.dmpFilesize
64KB
-
memory/4708-1070-0x0000000004A40000-0x0000000004A50000-memory.dmpFilesize
64KB
-
memory/4708-1071-0x0000000004A40000-0x0000000004A50000-memory.dmpFilesize
64KB
-
memory/4708-1072-0x0000000004A40000-0x0000000004A50000-memory.dmpFilesize
64KB
-
memory/4708-1073-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/4708-1074-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/4708-1075-0x00000000065F0000-0x0000000006666000-memory.dmpFilesize
472KB
-
memory/4708-1076-0x0000000006690000-0x00000000066E0000-memory.dmpFilesize
320KB
-
memory/4708-1077-0x0000000006810000-0x00000000069D2000-memory.dmpFilesize
1.8MB
-
memory/4708-1079-0x00000000069E0000-0x0000000006F0C000-memory.dmpFilesize
5.2MB
-
memory/5084-1085-0x0000000000ED0000-0x0000000000F02000-memory.dmpFilesize
200KB
-
memory/5084-1086-0x0000000005820000-0x0000000005830000-memory.dmpFilesize
64KB
-
memory/5084-1087-0x0000000005820000-0x0000000005830000-memory.dmpFilesize
64KB