Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 22:33
Static task
static1
Behavioral task
behavioral1
Sample
df09d7ff335d4a89b812adc1914e3095257d5ff3264a4112cdcd9f4226a48a1d.exe
Resource
win10v2004-20230220-en
General
-
Target
df09d7ff335d4a89b812adc1914e3095257d5ff3264a4112cdcd9f4226a48a1d.exe
-
Size
659KB
-
MD5
4bf90f94a9d5b4fe7a22a872cb708301
-
SHA1
8755c6b67a0bc0cc55e8439e604c4e8d1221c8c9
-
SHA256
df09d7ff335d4a89b812adc1914e3095257d5ff3264a4112cdcd9f4226a48a1d
-
SHA512
8d14e5590511154953d1e1a210365e4821a07ed4652560886e8d7c9d117e06288d63117800a2d38eae23212ec0db34a79afe3ba5abe45a8cd5edddf665c904ee
-
SSDEEP
12288:fMrsy90cgM1CY7KE4w9be8lO8UcgVrEwdTt599rwJtQCzARft/ju0bEHMw:Py9xH4COzxBt5PutdzOBDbnw
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro9567.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro9567.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro9567.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro9567.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro9567.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro9567.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro9567.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 17 IoCs
Processes:
resource yara_rule behavioral1/memory/1040-191-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1040-192-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1040-194-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1040-196-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1040-198-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1040-200-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1040-202-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1040-204-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1040-206-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1040-208-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1040-210-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1040-213-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1040-220-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1040-222-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1040-217-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1040-226-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline behavioral1/memory/1040-224-0x0000000005070000-0x00000000050AF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un890821.exepro9567.exequ3748.exesi826485.exepid process 3300 un890821.exe 3812 pro9567.exe 1040 qu3748.exe 2128 si826485.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro9567.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro9567.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro9567.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
df09d7ff335d4a89b812adc1914e3095257d5ff3264a4112cdcd9f4226a48a1d.exeun890821.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" df09d7ff335d4a89b812adc1914e3095257d5ff3264a4112cdcd9f4226a48a1d.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un890821.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un890821.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce df09d7ff335d4a89b812adc1914e3095257d5ff3264a4112cdcd9f4226a48a1d.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4736 3812 WerFault.exe pro9567.exe 4464 1040 WerFault.exe qu3748.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro9567.exequ3748.exesi826485.exepid process 3812 pro9567.exe 3812 pro9567.exe 1040 qu3748.exe 1040 qu3748.exe 2128 si826485.exe 2128 si826485.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro9567.exequ3748.exesi826485.exedescription pid process Token: SeDebugPrivilege 3812 pro9567.exe Token: SeDebugPrivilege 1040 qu3748.exe Token: SeDebugPrivilege 2128 si826485.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
df09d7ff335d4a89b812adc1914e3095257d5ff3264a4112cdcd9f4226a48a1d.exeun890821.exedescription pid process target process PID 4712 wrote to memory of 3300 4712 df09d7ff335d4a89b812adc1914e3095257d5ff3264a4112cdcd9f4226a48a1d.exe un890821.exe PID 4712 wrote to memory of 3300 4712 df09d7ff335d4a89b812adc1914e3095257d5ff3264a4112cdcd9f4226a48a1d.exe un890821.exe PID 4712 wrote to memory of 3300 4712 df09d7ff335d4a89b812adc1914e3095257d5ff3264a4112cdcd9f4226a48a1d.exe un890821.exe PID 3300 wrote to memory of 3812 3300 un890821.exe pro9567.exe PID 3300 wrote to memory of 3812 3300 un890821.exe pro9567.exe PID 3300 wrote to memory of 3812 3300 un890821.exe pro9567.exe PID 3300 wrote to memory of 1040 3300 un890821.exe qu3748.exe PID 3300 wrote to memory of 1040 3300 un890821.exe qu3748.exe PID 3300 wrote to memory of 1040 3300 un890821.exe qu3748.exe PID 4712 wrote to memory of 2128 4712 df09d7ff335d4a89b812adc1914e3095257d5ff3264a4112cdcd9f4226a48a1d.exe si826485.exe PID 4712 wrote to memory of 2128 4712 df09d7ff335d4a89b812adc1914e3095257d5ff3264a4112cdcd9f4226a48a1d.exe si826485.exe PID 4712 wrote to memory of 2128 4712 df09d7ff335d4a89b812adc1914e3095257d5ff3264a4112cdcd9f4226a48a1d.exe si826485.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\df09d7ff335d4a89b812adc1914e3095257d5ff3264a4112cdcd9f4226a48a1d.exe"C:\Users\Admin\AppData\Local\Temp\df09d7ff335d4a89b812adc1914e3095257d5ff3264a4112cdcd9f4226a48a1d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un890821.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un890821.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9567.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9567.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3812 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 10804⤵
- Program crash
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3748.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3748.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1040 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 14884⤵
- Program crash
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si826485.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si826485.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2128
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 3812 -ip 38121⤵PID:1636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1040 -ip 10401⤵PID:4680
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si826485.exeFilesize
175KB
MD52a25cb4cee8febdb677ef6c94ff7c620
SHA1fc807e8e5389e90c506f8aad5133d7549ffdde51
SHA256d39f3ce54706c8ba7bccd2e2c5325218fbc4c476e7b3bf1a655eac2f295c0bf3
SHA512f8787a813d38ecd7c6952d04f82b1fd3882a293859f3bf87b3bd7fd9768e6b679bee44955c588f30836f79e2994849c1c030897aa3fe7ce79632972288f3f19d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si826485.exeFilesize
175KB
MD52a25cb4cee8febdb677ef6c94ff7c620
SHA1fc807e8e5389e90c506f8aad5133d7549ffdde51
SHA256d39f3ce54706c8ba7bccd2e2c5325218fbc4c476e7b3bf1a655eac2f295c0bf3
SHA512f8787a813d38ecd7c6952d04f82b1fd3882a293859f3bf87b3bd7fd9768e6b679bee44955c588f30836f79e2994849c1c030897aa3fe7ce79632972288f3f19d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un890821.exeFilesize
517KB
MD5cd200a3cc026a1deca0d8971a3a1a940
SHA1991ea486a60a46e1a3733f5b17e056d781e3a6ea
SHA2561461ee9bb42dd8a0fd15e9ee17f5291d344b9b46737c04e67de1835a6e1fec70
SHA5128e8d98b9dc02e2a32ac6ee01bfc5ad14532ee497e3d5083d684a4775eb519c0dd15db23146f6ae8f621dd6cffb7cfaa8b5b3c66aadd2e9a2b4482801a3849454
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un890821.exeFilesize
517KB
MD5cd200a3cc026a1deca0d8971a3a1a940
SHA1991ea486a60a46e1a3733f5b17e056d781e3a6ea
SHA2561461ee9bb42dd8a0fd15e9ee17f5291d344b9b46737c04e67de1835a6e1fec70
SHA5128e8d98b9dc02e2a32ac6ee01bfc5ad14532ee497e3d5083d684a4775eb519c0dd15db23146f6ae8f621dd6cffb7cfaa8b5b3c66aadd2e9a2b4482801a3849454
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9567.exeFilesize
237KB
MD54a742c9a3b495a710e3eea2c288798bf
SHA1b311430cef13468c07812695f90356b0930919c4
SHA2561ccda4689c65196d9b92985b611acda71e654ec0cd1fdc4fccb7f5fbfd5e0a44
SHA512dcb063acf9fc568ffa4f49a7e601ad1d7919143dead36d3aa662bd2999c1104b68c37fcabe59ebaeae1f0ac89de9d3c4617b8e50710f73243bec0b6c011d91dc
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9567.exeFilesize
237KB
MD54a742c9a3b495a710e3eea2c288798bf
SHA1b311430cef13468c07812695f90356b0930919c4
SHA2561ccda4689c65196d9b92985b611acda71e654ec0cd1fdc4fccb7f5fbfd5e0a44
SHA512dcb063acf9fc568ffa4f49a7e601ad1d7919143dead36d3aa662bd2999c1104b68c37fcabe59ebaeae1f0ac89de9d3c4617b8e50710f73243bec0b6c011d91dc
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3748.exeFilesize
295KB
MD5dca4db44d2d0136c87f7f33ab22b3eed
SHA19b4dc917781ba218786ec489cc1d886729204111
SHA2561d3e55552c63e914eb30481968058548b0190124aec24582c9dd280c2dc0b097
SHA512b64786c3dcc9dd82daa7f158095767f4758ccf98ca218cc01ddfac93d5f7db2f141aea779daaf40febe1ff52a9615129c84dd800cdf355dbbbf5e80ae5aab920
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3748.exeFilesize
295KB
MD5dca4db44d2d0136c87f7f33ab22b3eed
SHA19b4dc917781ba218786ec489cc1d886729204111
SHA2561d3e55552c63e914eb30481968058548b0190124aec24582c9dd280c2dc0b097
SHA512b64786c3dcc9dd82daa7f158095767f4758ccf98ca218cc01ddfac93d5f7db2f141aea779daaf40febe1ff52a9615129c84dd800cdf355dbbbf5e80ae5aab920
-
memory/1040-1101-0x0000000005200000-0x0000000005818000-memory.dmpFilesize
6.1MB
-
memory/1040-1104-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/1040-1116-0x00000000024E0000-0x00000000024F0000-memory.dmpFilesize
64KB
-
memory/1040-1115-0x0000000006770000-0x0000000006C9C000-memory.dmpFilesize
5.2MB
-
memory/1040-1114-0x0000000006590000-0x0000000006752000-memory.dmpFilesize
1.8MB
-
memory/1040-1113-0x0000000006520000-0x0000000006570000-memory.dmpFilesize
320KB
-
memory/1040-1112-0x0000000006480000-0x00000000064F6000-memory.dmpFilesize
472KB
-
memory/1040-1111-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/1040-1110-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/1040-1109-0x00000000024E0000-0x00000000024F0000-memory.dmpFilesize
64KB
-
memory/1040-1108-0x00000000024E0000-0x00000000024F0000-memory.dmpFilesize
64KB
-
memory/1040-1107-0x00000000024E0000-0x00000000024F0000-memory.dmpFilesize
64KB
-
memory/1040-1105-0x00000000024E0000-0x00000000024F0000-memory.dmpFilesize
64KB
-
memory/1040-1103-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/1040-1102-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/1040-224-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1040-226-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1040-217-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1040-222-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1040-218-0x00000000024E0000-0x00000000024F0000-memory.dmpFilesize
64KB
-
memory/1040-220-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1040-216-0x00000000024E0000-0x00000000024F0000-memory.dmpFilesize
64KB
-
memory/1040-191-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1040-192-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1040-194-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1040-196-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1040-198-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1040-200-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1040-202-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1040-204-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1040-206-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1040-208-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1040-210-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1040-212-0x0000000002130000-0x000000000217B000-memory.dmpFilesize
300KB
-
memory/1040-213-0x0000000005070000-0x00000000050AF000-memory.dmpFilesize
252KB
-
memory/1040-214-0x00000000024E0000-0x00000000024F0000-memory.dmpFilesize
64KB
-
memory/2128-1123-0x0000000000220000-0x0000000000252000-memory.dmpFilesize
200KB
-
memory/2128-1125-0x0000000004DD0000-0x0000000004DE0000-memory.dmpFilesize
64KB
-
memory/2128-1124-0x0000000004DD0000-0x0000000004DE0000-memory.dmpFilesize
64KB
-
memory/3812-172-0x00000000024C0000-0x00000000024D2000-memory.dmpFilesize
72KB
-
memory/3812-168-0x00000000024C0000-0x00000000024D2000-memory.dmpFilesize
72KB
-
memory/3812-181-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/3812-180-0x00000000024C0000-0x00000000024D2000-memory.dmpFilesize
72KB
-
memory/3812-150-0x0000000004C80000-0x0000000005224000-memory.dmpFilesize
5.6MB
-
memory/3812-178-0x00000000024C0000-0x00000000024D2000-memory.dmpFilesize
72KB
-
memory/3812-176-0x00000000024C0000-0x00000000024D2000-memory.dmpFilesize
72KB
-
memory/3812-154-0x00000000024C0000-0x00000000024D2000-memory.dmpFilesize
72KB
-
memory/3812-174-0x00000000024C0000-0x00000000024D2000-memory.dmpFilesize
72KB
-
memory/3812-151-0x00000000024C0000-0x00000000024D2000-memory.dmpFilesize
72KB
-
memory/3812-170-0x00000000024C0000-0x00000000024D2000-memory.dmpFilesize
72KB
-
memory/3812-182-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/3812-166-0x00000000024C0000-0x00000000024D2000-memory.dmpFilesize
72KB
-
memory/3812-163-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/3812-164-0x00000000024C0000-0x00000000024D2000-memory.dmpFilesize
72KB
-
memory/3812-162-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/3812-160-0x00000000024C0000-0x00000000024D2000-memory.dmpFilesize
72KB
-
memory/3812-158-0x00000000024C0000-0x00000000024D2000-memory.dmpFilesize
72KB
-
memory/3812-156-0x00000000024C0000-0x00000000024D2000-memory.dmpFilesize
72KB
-
memory/3812-149-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/3812-148-0x0000000000710000-0x000000000073D000-memory.dmpFilesize
180KB
-
memory/3812-183-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/3812-185-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/3812-152-0x00000000024C0000-0x00000000024D2000-memory.dmpFilesize
72KB