Analysis
-
max time kernel
51s -
max time network
73s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
03-04-2023 22:30
Static task
static1
Behavioral task
behavioral1
Sample
3a1e621ab5c803c8f9deef974155c7bf75dfa597a034ad853adbc5dfd979dcb0.exe
Resource
win10-20230220-en
General
-
Target
3a1e621ab5c803c8f9deef974155c7bf75dfa597a034ad853adbc5dfd979dcb0.exe
-
Size
660KB
-
MD5
848614867f7c177c87cbbf923a884f5c
-
SHA1
da60b8c29f0456204f4e8112700954dc5eb5a5bd
-
SHA256
3a1e621ab5c803c8f9deef974155c7bf75dfa597a034ad853adbc5dfd979dcb0
-
SHA512
9167c1a95cdd486310688e5aec4622c8b960fca03c0cd16e22e9bd9ad735ce74723565ee4538cec5f64808d3ff3e9a19111fd8eecc5512c0ae4ade5364675e6e
-
SSDEEP
12288:YMrOy90qeQe6bPhfpdC2OxyqHVd0k1C+X3lBEUCZHHft/juZSo7E1y5:GyaqbPf4OEC+X3ABZnBGHwc
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro9977.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro9977.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro9977.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro9977.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro9977.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro9977.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/4876-176-0x0000000002270000-0x00000000022B6000-memory.dmp family_redline behavioral1/memory/4876-177-0x0000000004A40000-0x0000000004A84000-memory.dmp family_redline behavioral1/memory/4876-178-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/4876-179-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/4876-181-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/4876-183-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/4876-185-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/4876-187-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/4876-189-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/4876-191-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/4876-193-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/4876-195-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/4876-197-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/4876-199-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/4876-201-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/4876-204-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/4876-208-0x0000000004B50000-0x0000000004B60000-memory.dmp family_redline behavioral1/memory/4876-207-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/4876-211-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/4876-213-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/4876-215-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un444940.exepro9977.exequ7057.exesi815423.exepid process 2512 un444940.exe 4960 pro9977.exe 4876 qu7057.exe 3592 si815423.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro9977.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro9977.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro9977.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
3a1e621ab5c803c8f9deef974155c7bf75dfa597a034ad853adbc5dfd979dcb0.exeun444940.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 3a1e621ab5c803c8f9deef974155c7bf75dfa597a034ad853adbc5dfd979dcb0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 3a1e621ab5c803c8f9deef974155c7bf75dfa597a034ad853adbc5dfd979dcb0.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un444940.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un444940.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro9977.exequ7057.exesi815423.exepid process 4960 pro9977.exe 4960 pro9977.exe 4876 qu7057.exe 4876 qu7057.exe 3592 si815423.exe 3592 si815423.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro9977.exequ7057.exesi815423.exedescription pid process Token: SeDebugPrivilege 4960 pro9977.exe Token: SeDebugPrivilege 4876 qu7057.exe Token: SeDebugPrivilege 3592 si815423.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
3a1e621ab5c803c8f9deef974155c7bf75dfa597a034ad853adbc5dfd979dcb0.exeun444940.exedescription pid process target process PID 4140 wrote to memory of 2512 4140 3a1e621ab5c803c8f9deef974155c7bf75dfa597a034ad853adbc5dfd979dcb0.exe un444940.exe PID 4140 wrote to memory of 2512 4140 3a1e621ab5c803c8f9deef974155c7bf75dfa597a034ad853adbc5dfd979dcb0.exe un444940.exe PID 4140 wrote to memory of 2512 4140 3a1e621ab5c803c8f9deef974155c7bf75dfa597a034ad853adbc5dfd979dcb0.exe un444940.exe PID 2512 wrote to memory of 4960 2512 un444940.exe pro9977.exe PID 2512 wrote to memory of 4960 2512 un444940.exe pro9977.exe PID 2512 wrote to memory of 4960 2512 un444940.exe pro9977.exe PID 2512 wrote to memory of 4876 2512 un444940.exe qu7057.exe PID 2512 wrote to memory of 4876 2512 un444940.exe qu7057.exe PID 2512 wrote to memory of 4876 2512 un444940.exe qu7057.exe PID 4140 wrote to memory of 3592 4140 3a1e621ab5c803c8f9deef974155c7bf75dfa597a034ad853adbc5dfd979dcb0.exe si815423.exe PID 4140 wrote to memory of 3592 4140 3a1e621ab5c803c8f9deef974155c7bf75dfa597a034ad853adbc5dfd979dcb0.exe si815423.exe PID 4140 wrote to memory of 3592 4140 3a1e621ab5c803c8f9deef974155c7bf75dfa597a034ad853adbc5dfd979dcb0.exe si815423.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a1e621ab5c803c8f9deef974155c7bf75dfa597a034ad853adbc5dfd979dcb0.exe"C:\Users\Admin\AppData\Local\Temp\3a1e621ab5c803c8f9deef974155c7bf75dfa597a034ad853adbc5dfd979dcb0.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un444940.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un444940.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9977.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9977.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7057.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7057.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si815423.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si815423.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si815423.exeFilesize
175KB
MD507d6106504205cf1505756d769f422df
SHA16b78bf2b7f0834c16c0fcf27f0c019f09c3de2a3
SHA2560a60510e122625e7a49ab37d09282736dea0e136f479c72494b44ac60b812110
SHA5129f7726980362e83030e1face9d4a00768d778c5a774066b46d9680667b9287011a2bfd7b14852dbd70de13e54973c02d9433b66a3352ab672231d4df03fd1eb4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si815423.exeFilesize
175KB
MD507d6106504205cf1505756d769f422df
SHA16b78bf2b7f0834c16c0fcf27f0c019f09c3de2a3
SHA2560a60510e122625e7a49ab37d09282736dea0e136f479c72494b44ac60b812110
SHA5129f7726980362e83030e1face9d4a00768d778c5a774066b46d9680667b9287011a2bfd7b14852dbd70de13e54973c02d9433b66a3352ab672231d4df03fd1eb4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un444940.exeFilesize
517KB
MD55a4284cd866f481f6c50f65992005b43
SHA1db12aac997aebe4af446396d9c744947f76ffb93
SHA25606822be72e6326a3dff037b57518c2ad78899a534c84326b431078a71f30d4f3
SHA512f8caf734890d0831a46ab2c3e10810af069cfd6ba91890df30b3143cc8ee8a6c2d64922ac1a3a958c2049c65e2e6c51f1a600b1371e9596db457df5766472570
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un444940.exeFilesize
517KB
MD55a4284cd866f481f6c50f65992005b43
SHA1db12aac997aebe4af446396d9c744947f76ffb93
SHA25606822be72e6326a3dff037b57518c2ad78899a534c84326b431078a71f30d4f3
SHA512f8caf734890d0831a46ab2c3e10810af069cfd6ba91890df30b3143cc8ee8a6c2d64922ac1a3a958c2049c65e2e6c51f1a600b1371e9596db457df5766472570
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9977.exeFilesize
237KB
MD5f412bf5b3ff2fb7d64a91a1928897907
SHA1b1f4aded0156a49314eec136379d6af60b56057a
SHA25697a5c529de9cb6a299370cc8218ab8d363a314a8f1351eb7576b71d0a32bbbe8
SHA5120a5b009bd03bb7347af9b7b68dc78cc5ec654fcf623e387a8d71dcc0a1883f74f4e89f21c8b69fff6e3c4809149842a5434a8819b731a51b3a9d137aada7a805
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9977.exeFilesize
237KB
MD5f412bf5b3ff2fb7d64a91a1928897907
SHA1b1f4aded0156a49314eec136379d6af60b56057a
SHA25697a5c529de9cb6a299370cc8218ab8d363a314a8f1351eb7576b71d0a32bbbe8
SHA5120a5b009bd03bb7347af9b7b68dc78cc5ec654fcf623e387a8d71dcc0a1883f74f4e89f21c8b69fff6e3c4809149842a5434a8819b731a51b3a9d137aada7a805
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7057.exeFilesize
295KB
MD537cae12d5a9c6f481d89bf192f144f2c
SHA10b3796be181f3afb40d3fc5e2c8e4ebbe1e6cdf5
SHA2563de7bcfb323a5d0051dc1abcbba511e68acc332d69f52ab57c5974fd5e06863c
SHA5125c5c4925194d13ab96f82d347c66ec05555a8eb6bff1d0a139534f9eec1a817cc0f437068ee662c25f8480b8bfa537c95458da3198f398a696a791f421bd9ee8
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7057.exeFilesize
295KB
MD537cae12d5a9c6f481d89bf192f144f2c
SHA10b3796be181f3afb40d3fc5e2c8e4ebbe1e6cdf5
SHA2563de7bcfb323a5d0051dc1abcbba511e68acc332d69f52ab57c5974fd5e06863c
SHA5125c5c4925194d13ab96f82d347c66ec05555a8eb6bff1d0a139534f9eec1a817cc0f437068ee662c25f8480b8bfa537c95458da3198f398a696a791f421bd9ee8
-
memory/3592-1113-0x00000000050D0000-0x00000000050E0000-memory.dmpFilesize
64KB
-
memory/3592-1112-0x0000000004FB0000-0x0000000004FFB000-memory.dmpFilesize
300KB
-
memory/3592-1111-0x0000000000570000-0x00000000005A2000-memory.dmpFilesize
200KB
-
memory/4876-1088-0x0000000005160000-0x0000000005766000-memory.dmpFilesize
6.0MB
-
memory/4876-1091-0x0000000005900000-0x000000000593E000-memory.dmpFilesize
248KB
-
memory/4876-1104-0x0000000006890000-0x0000000006DBC000-memory.dmpFilesize
5.2MB
-
memory/4876-1103-0x00000000066C0000-0x0000000006882000-memory.dmpFilesize
1.8MB
-
memory/4876-1102-0x0000000004B50000-0x0000000004B60000-memory.dmpFilesize
64KB
-
memory/4876-1101-0x00000000063E0000-0x0000000006430000-memory.dmpFilesize
320KB
-
memory/4876-1100-0x0000000006340000-0x00000000063B6000-memory.dmpFilesize
472KB
-
memory/4876-1099-0x00000000062A0000-0x0000000006332000-memory.dmpFilesize
584KB
-
memory/4876-1098-0x0000000004B50000-0x0000000004B60000-memory.dmpFilesize
64KB
-
memory/4876-1096-0x0000000004B50000-0x0000000004B60000-memory.dmpFilesize
64KB
-
memory/4876-1097-0x0000000004B50000-0x0000000004B60000-memory.dmpFilesize
64KB
-
memory/4876-1095-0x0000000005BE0000-0x0000000005C46000-memory.dmpFilesize
408KB
-
memory/4876-1093-0x0000000005A50000-0x0000000005A9B000-memory.dmpFilesize
300KB
-
memory/4876-1092-0x0000000004B50000-0x0000000004B60000-memory.dmpFilesize
64KB
-
memory/4876-1090-0x00000000058E0000-0x00000000058F2000-memory.dmpFilesize
72KB
-
memory/4876-1089-0x00000000057A0000-0x00000000058AA000-memory.dmpFilesize
1.0MB
-
memory/4876-215-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/4876-213-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/4876-211-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/4876-210-0x0000000004B50000-0x0000000004B60000-memory.dmpFilesize
64KB
-
memory/4876-207-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/4876-208-0x0000000004B50000-0x0000000004B60000-memory.dmpFilesize
64KB
-
memory/4876-176-0x0000000002270000-0x00000000022B6000-memory.dmpFilesize
280KB
-
memory/4876-177-0x0000000004A40000-0x0000000004A84000-memory.dmpFilesize
272KB
-
memory/4876-178-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/4876-179-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/4876-181-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/4876-183-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/4876-185-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/4876-187-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/4876-189-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/4876-191-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/4876-193-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/4876-195-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/4876-197-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/4876-199-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/4876-201-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/4876-204-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/4876-203-0x0000000000590000-0x00000000005DB000-memory.dmpFilesize
300KB
-
memory/4876-205-0x0000000004B50000-0x0000000004B60000-memory.dmpFilesize
64KB
-
memory/4960-159-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4960-131-0x0000000002330000-0x000000000234A000-memory.dmpFilesize
104KB
-
memory/4960-137-0x0000000004A60000-0x0000000004A70000-memory.dmpFilesize
64KB
-
memory/4960-169-0x0000000004A60000-0x0000000004A70000-memory.dmpFilesize
64KB
-
memory/4960-168-0x0000000004A60000-0x0000000004A70000-memory.dmpFilesize
64KB
-
memory/4960-167-0x0000000004A60000-0x0000000004A70000-memory.dmpFilesize
64KB
-
memory/4960-136-0x00000000049E0000-0x00000000049F8000-memory.dmpFilesize
96KB
-
memory/4960-166-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4960-165-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4960-139-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4960-163-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4960-161-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4960-171-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4960-138-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4960-141-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4960-153-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4960-151-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4960-149-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4960-147-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4960-145-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4960-143-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4960-155-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB
-
memory/4960-135-0x0000000004A60000-0x0000000004A70000-memory.dmpFilesize
64KB
-
memory/4960-134-0x0000000004A60000-0x0000000004A70000-memory.dmpFilesize
64KB
-
memory/4960-133-0x0000000000580000-0x00000000005AD000-memory.dmpFilesize
180KB
-
memory/4960-132-0x0000000004A70000-0x0000000004F6E000-memory.dmpFilesize
5.0MB
-
memory/4960-157-0x00000000049E0000-0x00000000049F2000-memory.dmpFilesize
72KB