Analysis
-
max time kernel
92s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 22:35
Static task
static1
Behavioral task
behavioral1
Sample
3b9a5b4c3b67e515d610e6f00240eb5d884142af2ac0148936b3f1fe2a290ae0.exe
Resource
win10v2004-20230220-en
General
-
Target
3b9a5b4c3b67e515d610e6f00240eb5d884142af2ac0148936b3f1fe2a290ae0.exe
-
Size
659KB
-
MD5
5005c9ed5cdb80d997a3d5bdb18ec16d
-
SHA1
12814d94b13f8bc060f56eae6907048ba6f181ec
-
SHA256
3b9a5b4c3b67e515d610e6f00240eb5d884142af2ac0148936b3f1fe2a290ae0
-
SHA512
c55ed7e1d9f87419359c46db8b43f2ca51a4d788385d9db9e87ca4aa2549fe66fccc84ffb694e9c27e15423cdf005363b3bb6d7044fd24ee72a75d6643b8f48e
-
SSDEEP
12288:lMruy902YpSmnKPNb6pgHVsOnVPJct59vrwFnyCCaJft/juF0Fk8jU:jyH6SfPZ6ijVP+t5FSnzCcBUp8g
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro1908.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro1908.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro1908.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro1908.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro1908.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro1908.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro1908.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/2224-189-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2224-190-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2224-192-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2224-194-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2224-196-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2224-198-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2224-200-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2224-202-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2224-204-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2224-206-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2224-208-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2224-210-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2224-212-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2224-214-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2224-216-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2224-218-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2224-220-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2224-222-0x0000000002710000-0x000000000274F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un113167.exepro1908.exequ2137.exesi100213.exepid process 2764 un113167.exe 5104 pro1908.exe 2224 qu2137.exe 4488 si100213.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro1908.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro1908.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro1908.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
3b9a5b4c3b67e515d610e6f00240eb5d884142af2ac0148936b3f1fe2a290ae0.exeun113167.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 3b9a5b4c3b67e515d610e6f00240eb5d884142af2ac0148936b3f1fe2a290ae0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 3b9a5b4c3b67e515d610e6f00240eb5d884142af2ac0148936b3f1fe2a290ae0.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un113167.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un113167.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2428 5104 WerFault.exe pro1908.exe 1112 2224 WerFault.exe qu2137.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro1908.exequ2137.exesi100213.exepid process 5104 pro1908.exe 5104 pro1908.exe 2224 qu2137.exe 2224 qu2137.exe 4488 si100213.exe 4488 si100213.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro1908.exequ2137.exesi100213.exedescription pid process Token: SeDebugPrivilege 5104 pro1908.exe Token: SeDebugPrivilege 2224 qu2137.exe Token: SeDebugPrivilege 4488 si100213.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
3b9a5b4c3b67e515d610e6f00240eb5d884142af2ac0148936b3f1fe2a290ae0.exeun113167.exedescription pid process target process PID 5048 wrote to memory of 2764 5048 3b9a5b4c3b67e515d610e6f00240eb5d884142af2ac0148936b3f1fe2a290ae0.exe un113167.exe PID 5048 wrote to memory of 2764 5048 3b9a5b4c3b67e515d610e6f00240eb5d884142af2ac0148936b3f1fe2a290ae0.exe un113167.exe PID 5048 wrote to memory of 2764 5048 3b9a5b4c3b67e515d610e6f00240eb5d884142af2ac0148936b3f1fe2a290ae0.exe un113167.exe PID 2764 wrote to memory of 5104 2764 un113167.exe pro1908.exe PID 2764 wrote to memory of 5104 2764 un113167.exe pro1908.exe PID 2764 wrote to memory of 5104 2764 un113167.exe pro1908.exe PID 2764 wrote to memory of 2224 2764 un113167.exe qu2137.exe PID 2764 wrote to memory of 2224 2764 un113167.exe qu2137.exe PID 2764 wrote to memory of 2224 2764 un113167.exe qu2137.exe PID 5048 wrote to memory of 4488 5048 3b9a5b4c3b67e515d610e6f00240eb5d884142af2ac0148936b3f1fe2a290ae0.exe si100213.exe PID 5048 wrote to memory of 4488 5048 3b9a5b4c3b67e515d610e6f00240eb5d884142af2ac0148936b3f1fe2a290ae0.exe si100213.exe PID 5048 wrote to memory of 4488 5048 3b9a5b4c3b67e515d610e6f00240eb5d884142af2ac0148936b3f1fe2a290ae0.exe si100213.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b9a5b4c3b67e515d610e6f00240eb5d884142af2ac0148936b3f1fe2a290ae0.exe"C:\Users\Admin\AppData\Local\Temp\3b9a5b4c3b67e515d610e6f00240eb5d884142af2ac0148936b3f1fe2a290ae0.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un113167.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un113167.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1908.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1908.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 10844⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2137.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2137.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 13364⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si100213.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si100213.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5104 -ip 51041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2224 -ip 22241⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si100213.exeFilesize
175KB
MD5959ac543f3cfccc3c1af5bd59b2e85e1
SHA1d57875ebaa8e54d6dcdb61c2e2bae51a4ff4198d
SHA256bd8c23e92f370416532c186ab7ee3923d9902201f0ecbe158d6b900df1e0f919
SHA51226ea76b112af4eac31d74f72c943dc3e19e7d7f72fa92f00b704f7e1c941c0ace77be00c63d5681ce45db7c52ae565c913cbdc569b78293c954db94dc69cfb84
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si100213.exeFilesize
175KB
MD5959ac543f3cfccc3c1af5bd59b2e85e1
SHA1d57875ebaa8e54d6dcdb61c2e2bae51a4ff4198d
SHA256bd8c23e92f370416532c186ab7ee3923d9902201f0ecbe158d6b900df1e0f919
SHA51226ea76b112af4eac31d74f72c943dc3e19e7d7f72fa92f00b704f7e1c941c0ace77be00c63d5681ce45db7c52ae565c913cbdc569b78293c954db94dc69cfb84
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un113167.exeFilesize
517KB
MD57cb8ceed3850c873dfbb44e04201b34a
SHA1e3cb0eef4ee56154665b3ba9807191e04679f9ae
SHA2567668c5ac4f5ce03b7c661bcb851ec76332bee5e80d9f0411ae385553f929f849
SHA5127bb569d64e6a0b5d7fb0837c9541055b44d08da62c5c57fdb5295b39272ab3c2fde250394d02ba999b4305a00d50b80c5b025d0fdf7259a1651fbeff14bddfa9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un113167.exeFilesize
517KB
MD57cb8ceed3850c873dfbb44e04201b34a
SHA1e3cb0eef4ee56154665b3ba9807191e04679f9ae
SHA2567668c5ac4f5ce03b7c661bcb851ec76332bee5e80d9f0411ae385553f929f849
SHA5127bb569d64e6a0b5d7fb0837c9541055b44d08da62c5c57fdb5295b39272ab3c2fde250394d02ba999b4305a00d50b80c5b025d0fdf7259a1651fbeff14bddfa9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1908.exeFilesize
237KB
MD55ae84e349d38ff71a56410b4a7ecb22f
SHA1519d0315f3445232c976ca4c39d55e026f903779
SHA256e794503be96642b3a1d35f90b05d8e2a462dc96a2269c2077937338dabafb2be
SHA512af278522d44703db1b031169e6da93c9dd1edc2dbe56df4e5217054075a1d35aac59ff1c3db4fd03b1ae709f0bfa7771cd1d6f1335e8373f84197b339cdf0137
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1908.exeFilesize
237KB
MD55ae84e349d38ff71a56410b4a7ecb22f
SHA1519d0315f3445232c976ca4c39d55e026f903779
SHA256e794503be96642b3a1d35f90b05d8e2a462dc96a2269c2077937338dabafb2be
SHA512af278522d44703db1b031169e6da93c9dd1edc2dbe56df4e5217054075a1d35aac59ff1c3db4fd03b1ae709f0bfa7771cd1d6f1335e8373f84197b339cdf0137
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2137.exeFilesize
295KB
MD584c71ef84a3aba93370192ccec1fecf7
SHA1db1c73013ffa51c418ba2ef67b5433f829f38937
SHA256a7be23b255e9c58fcc9f9df2adea65022e643cd5a51e545d048e80db3746f241
SHA512117712873f78ce0678eaf943830dd9a7f401e88e3c183cd0fa804f334f4dda947a205b1511a64a6a7aed4e37ca3894d27d7772e4b50cdba4e4d6c64ee1d63379
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2137.exeFilesize
295KB
MD584c71ef84a3aba93370192ccec1fecf7
SHA1db1c73013ffa51c418ba2ef67b5433f829f38937
SHA256a7be23b255e9c58fcc9f9df2adea65022e643cd5a51e545d048e80db3746f241
SHA512117712873f78ce0678eaf943830dd9a7f401e88e3c183cd0fa804f334f4dda947a205b1511a64a6a7aed4e37ca3894d27d7772e4b50cdba4e4d6c64ee1d63379
-
memory/2224-1099-0x00000000052A0000-0x00000000058B8000-memory.dmpFilesize
6.1MB
-
memory/2224-1102-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/2224-1114-0x0000000006770000-0x0000000006C9C000-memory.dmpFilesize
5.2MB
-
memory/2224-1113-0x00000000065A0000-0x0000000006762000-memory.dmpFilesize
1.8MB
-
memory/2224-1112-0x0000000006520000-0x0000000006570000-memory.dmpFilesize
320KB
-
memory/2224-1111-0x00000000064A0000-0x0000000006516000-memory.dmpFilesize
472KB
-
memory/2224-1110-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/2224-1109-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/2224-1108-0x0000000004BE0000-0x0000000004BF0000-memory.dmpFilesize
64KB
-
memory/2224-1107-0x0000000004BE0000-0x0000000004BF0000-memory.dmpFilesize
64KB
-
memory/2224-1106-0x0000000004BE0000-0x0000000004BF0000-memory.dmpFilesize
64KB
-
memory/2224-1105-0x0000000004BE0000-0x0000000004BF0000-memory.dmpFilesize
64KB
-
memory/2224-1103-0x0000000004BE0000-0x0000000004BF0000-memory.dmpFilesize
64KB
-
memory/2224-1101-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/2224-1100-0x00000000058C0000-0x00000000059CA000-memory.dmpFilesize
1.0MB
-
memory/2224-294-0x0000000004BE0000-0x0000000004BF0000-memory.dmpFilesize
64KB
-
memory/2224-292-0x0000000004BE0000-0x0000000004BF0000-memory.dmpFilesize
64KB
-
memory/2224-290-0x0000000004BE0000-0x0000000004BF0000-memory.dmpFilesize
64KB
-
memory/2224-288-0x0000000002140000-0x000000000218B000-memory.dmpFilesize
300KB
-
memory/2224-222-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2224-220-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2224-189-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2224-190-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2224-192-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2224-194-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2224-196-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2224-198-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2224-200-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2224-202-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2224-204-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2224-206-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2224-208-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2224-210-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2224-212-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2224-214-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2224-216-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2224-218-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/4488-1122-0x0000000000BC0000-0x0000000000BF2000-memory.dmpFilesize
200KB
-
memory/4488-1123-0x00000000054A0000-0x00000000054B0000-memory.dmpFilesize
64KB
-
memory/5104-171-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/5104-152-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/5104-151-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/5104-180-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/5104-148-0x0000000000720000-0x000000000074D000-memory.dmpFilesize
180KB
-
memory/5104-179-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/5104-177-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/5104-155-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/5104-175-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/5104-167-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/5104-181-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/5104-182-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/5104-173-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/5104-165-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/5104-163-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/5104-161-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/5104-159-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/5104-153-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/5104-157-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/5104-150-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/5104-149-0x0000000004C20000-0x00000000051C4000-memory.dmpFilesize
5.6MB
-
memory/5104-184-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/5104-169-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB