Analysis
-
max time kernel
50s -
max time network
76s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
03-04-2023 22:39
Static task
static1
Behavioral task
behavioral1
Sample
8cc38a777f5969650c4ad3ac8a4df24077d556289ed3a0986d1c56e23923669a.exe
Resource
win10-20230220-en
General
-
Target
8cc38a777f5969650c4ad3ac8a4df24077d556289ed3a0986d1c56e23923669a.exe
-
Size
659KB
-
MD5
5fcc56d6b49d96895d413bce5852e88a
-
SHA1
ea1de6a5e37994b64f08548ece568a51eb535a4d
-
SHA256
8cc38a777f5969650c4ad3ac8a4df24077d556289ed3a0986d1c56e23923669a
-
SHA512
e9c181119bacf4f8aba2e674f695f884f8eb12e3e30366ff94afa00a79928cf5fcecfc4d74ece0053eefa6f66bed8bf5cf3a372683275aeffccb411d9c74ace2
-
SSDEEP
12288:iMrzy90UTIahRfNWLH+N4FXgagkcwzIQYVDgRmCxKkft/ju0ExfBBavBqv:NyHIa/lWLeclgOU9VDgRXx7BFwf7avBg
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro6819.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro6819.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro6819.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro6819.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro6819.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro6819.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/3532-180-0x0000000002200000-0x0000000002246000-memory.dmp family_redline behavioral1/memory/3532-182-0x00000000024D0000-0x0000000002514000-memory.dmp family_redline behavioral1/memory/3532-186-0x00000000024D0000-0x000000000250F000-memory.dmp family_redline behavioral1/memory/3532-187-0x00000000024D0000-0x000000000250F000-memory.dmp family_redline behavioral1/memory/3532-189-0x00000000024D0000-0x000000000250F000-memory.dmp family_redline behavioral1/memory/3532-191-0x00000000024D0000-0x000000000250F000-memory.dmp family_redline behavioral1/memory/3532-193-0x00000000024D0000-0x000000000250F000-memory.dmp family_redline behavioral1/memory/3532-195-0x00000000024D0000-0x000000000250F000-memory.dmp family_redline behavioral1/memory/3532-197-0x00000000024D0000-0x000000000250F000-memory.dmp family_redline behavioral1/memory/3532-199-0x00000000024D0000-0x000000000250F000-memory.dmp family_redline behavioral1/memory/3532-201-0x00000000024D0000-0x000000000250F000-memory.dmp family_redline behavioral1/memory/3532-203-0x00000000024D0000-0x000000000250F000-memory.dmp family_redline behavioral1/memory/3532-205-0x00000000024D0000-0x000000000250F000-memory.dmp family_redline behavioral1/memory/3532-207-0x00000000024D0000-0x000000000250F000-memory.dmp family_redline behavioral1/memory/3532-209-0x00000000024D0000-0x000000000250F000-memory.dmp family_redline behavioral1/memory/3532-211-0x00000000024D0000-0x000000000250F000-memory.dmp family_redline behavioral1/memory/3532-213-0x00000000024D0000-0x000000000250F000-memory.dmp family_redline behavioral1/memory/3532-215-0x00000000024D0000-0x000000000250F000-memory.dmp family_redline behavioral1/memory/3532-217-0x00000000024D0000-0x000000000250F000-memory.dmp family_redline behavioral1/memory/3532-219-0x00000000024D0000-0x000000000250F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un454820.exepro6819.exequ5424.exesi326464.exepid process 5048 un454820.exe 3560 pro6819.exe 3532 qu5424.exe 4364 si326464.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro6819.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro6819.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro6819.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un454820.exe8cc38a777f5969650c4ad3ac8a4df24077d556289ed3a0986d1c56e23923669a.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un454820.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 8cc38a777f5969650c4ad3ac8a4df24077d556289ed3a0986d1c56e23923669a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 8cc38a777f5969650c4ad3ac8a4df24077d556289ed3a0986d1c56e23923669a.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un454820.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro6819.exequ5424.exesi326464.exepid process 3560 pro6819.exe 3560 pro6819.exe 3532 qu5424.exe 3532 qu5424.exe 4364 si326464.exe 4364 si326464.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro6819.exequ5424.exesi326464.exedescription pid process Token: SeDebugPrivilege 3560 pro6819.exe Token: SeDebugPrivilege 3532 qu5424.exe Token: SeDebugPrivilege 4364 si326464.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
8cc38a777f5969650c4ad3ac8a4df24077d556289ed3a0986d1c56e23923669a.exeun454820.exedescription pid process target process PID 3944 wrote to memory of 5048 3944 8cc38a777f5969650c4ad3ac8a4df24077d556289ed3a0986d1c56e23923669a.exe un454820.exe PID 3944 wrote to memory of 5048 3944 8cc38a777f5969650c4ad3ac8a4df24077d556289ed3a0986d1c56e23923669a.exe un454820.exe PID 3944 wrote to memory of 5048 3944 8cc38a777f5969650c4ad3ac8a4df24077d556289ed3a0986d1c56e23923669a.exe un454820.exe PID 5048 wrote to memory of 3560 5048 un454820.exe pro6819.exe PID 5048 wrote to memory of 3560 5048 un454820.exe pro6819.exe PID 5048 wrote to memory of 3560 5048 un454820.exe pro6819.exe PID 5048 wrote to memory of 3532 5048 un454820.exe qu5424.exe PID 5048 wrote to memory of 3532 5048 un454820.exe qu5424.exe PID 5048 wrote to memory of 3532 5048 un454820.exe qu5424.exe PID 3944 wrote to memory of 4364 3944 8cc38a777f5969650c4ad3ac8a4df24077d556289ed3a0986d1c56e23923669a.exe si326464.exe PID 3944 wrote to memory of 4364 3944 8cc38a777f5969650c4ad3ac8a4df24077d556289ed3a0986d1c56e23923669a.exe si326464.exe PID 3944 wrote to memory of 4364 3944 8cc38a777f5969650c4ad3ac8a4df24077d556289ed3a0986d1c56e23923669a.exe si326464.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8cc38a777f5969650c4ad3ac8a4df24077d556289ed3a0986d1c56e23923669a.exe"C:\Users\Admin\AppData\Local\Temp\8cc38a777f5969650c4ad3ac8a4df24077d556289ed3a0986d1c56e23923669a.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un454820.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un454820.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6819.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6819.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5424.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5424.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si326464.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si326464.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si326464.exeFilesize
175KB
MD55c57e6327f89552c7a1156e97bbb4cb2
SHA18642bb788e213dfd78c7c1d3e03ff928ab2882c8
SHA2569941d1b6f393ca25778d0a35bd72ba393f2736a30c289dc7b2096f3f35743486
SHA51220069e979d286e64345868d9b0d3b4eb70ad4bdf7539bf35bd1aa5d71cf11238f95c10476050bb6ceaff03f059b3343ad023edc5211a4a2f9d482db6b992cbaa
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si326464.exeFilesize
175KB
MD55c57e6327f89552c7a1156e97bbb4cb2
SHA18642bb788e213dfd78c7c1d3e03ff928ab2882c8
SHA2569941d1b6f393ca25778d0a35bd72ba393f2736a30c289dc7b2096f3f35743486
SHA51220069e979d286e64345868d9b0d3b4eb70ad4bdf7539bf35bd1aa5d71cf11238f95c10476050bb6ceaff03f059b3343ad023edc5211a4a2f9d482db6b992cbaa
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un454820.exeFilesize
517KB
MD5c2b9c896a831241328cff162e8c8a23b
SHA102d3843543e1f88715c2fee5b69f24c5c43db24c
SHA256a69708f45a7d70aa544575f50572920cede14e3706cc06554dae758f23feee1b
SHA5121167e692a9ff2d5af885b475b432e841bcdbebab51922d38984ec426fd33c753898c5c3be6d50e83202f51a70b45e61071e8d7cf62ca3c42636b3f5ace1c7d7c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un454820.exeFilesize
517KB
MD5c2b9c896a831241328cff162e8c8a23b
SHA102d3843543e1f88715c2fee5b69f24c5c43db24c
SHA256a69708f45a7d70aa544575f50572920cede14e3706cc06554dae758f23feee1b
SHA5121167e692a9ff2d5af885b475b432e841bcdbebab51922d38984ec426fd33c753898c5c3be6d50e83202f51a70b45e61071e8d7cf62ca3c42636b3f5ace1c7d7c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6819.exeFilesize
237KB
MD5c78fb394d0235f31046c3fb3052aa52e
SHA102fc1603daccc79677591a31464ed558deba3cfd
SHA2567314e34f962ca01e1910364615994819bf8a3f46c2d9c20abba70884cd2974f5
SHA5120a2c078bbcd12338243de3dabc5d50c93970a4bf04ce62c083d1aa27e48775896608d1ccdd0b0eb18a6a63ff54f7d796776b4ab5d3f6c5643337c0ad8f7a385d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6819.exeFilesize
237KB
MD5c78fb394d0235f31046c3fb3052aa52e
SHA102fc1603daccc79677591a31464ed558deba3cfd
SHA2567314e34f962ca01e1910364615994819bf8a3f46c2d9c20abba70884cd2974f5
SHA5120a2c078bbcd12338243de3dabc5d50c93970a4bf04ce62c083d1aa27e48775896608d1ccdd0b0eb18a6a63ff54f7d796776b4ab5d3f6c5643337c0ad8f7a385d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5424.exeFilesize
295KB
MD5ad3d489e73395557e6d5ad777366c6c3
SHA118d4278d3e7b16d6d02ace28823725cfd01e1213
SHA2562766355ced362e1c88d83837efdfd6d841d212f6c9c12043275a2417fbc3afb5
SHA51262fed4f0239d3d5a2ae2012669fc57996cf24d70980f1e3c0fe603bafa708c5cb503b6eef788cf77cac7f513b14a6f5394745afe12e42d174c5eb3a72a4acdb2
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5424.exeFilesize
295KB
MD5ad3d489e73395557e6d5ad777366c6c3
SHA118d4278d3e7b16d6d02ace28823725cfd01e1213
SHA2562766355ced362e1c88d83837efdfd6d841d212f6c9c12043275a2417fbc3afb5
SHA51262fed4f0239d3d5a2ae2012669fc57996cf24d70980f1e3c0fe603bafa708c5cb503b6eef788cf77cac7f513b14a6f5394745afe12e42d174c5eb3a72a4acdb2
-
memory/3532-1092-0x00000000057E0000-0x0000000005DE6000-memory.dmpFilesize
6.0MB
-
memory/3532-219-0x00000000024D0000-0x000000000250F000-memory.dmpFilesize
252KB
-
memory/3532-1108-0x0000000006D50000-0x0000000006DA0000-memory.dmpFilesize
320KB
-
memory/3532-1107-0x0000000006CD0000-0x0000000006D46000-memory.dmpFilesize
472KB
-
memory/3532-1106-0x0000000006670000-0x0000000006B9C000-memory.dmpFilesize
5.2MB
-
memory/3532-193-0x00000000024D0000-0x000000000250F000-memory.dmpFilesize
252KB
-
memory/3532-1105-0x0000000006490000-0x0000000006652000-memory.dmpFilesize
1.8MB
-
memory/3532-1104-0x0000000004CC0000-0x0000000004CD0000-memory.dmpFilesize
64KB
-
memory/3532-1103-0x0000000004CC0000-0x0000000004CD0000-memory.dmpFilesize
64KB
-
memory/3532-1102-0x0000000004CC0000-0x0000000004CD0000-memory.dmpFilesize
64KB
-
memory/3532-195-0x00000000024D0000-0x000000000250F000-memory.dmpFilesize
252KB
-
memory/3532-1101-0x0000000004CC0000-0x0000000004CD0000-memory.dmpFilesize
64KB
-
memory/3532-1099-0x00000000062A0000-0x0000000006332000-memory.dmpFilesize
584KB
-
memory/3532-1098-0x00000000055D0000-0x0000000005636000-memory.dmpFilesize
408KB
-
memory/3532-1097-0x0000000005440000-0x000000000548B000-memory.dmpFilesize
300KB
-
memory/3532-1096-0x0000000005300000-0x000000000533E000-memory.dmpFilesize
248KB
-
memory/3532-1095-0x0000000004CC0000-0x0000000004CD0000-memory.dmpFilesize
64KB
-
memory/3532-1094-0x00000000052E0000-0x00000000052F2000-memory.dmpFilesize
72KB
-
memory/3532-1093-0x00000000051D0000-0x00000000052DA000-memory.dmpFilesize
1.0MB
-
memory/3532-203-0x00000000024D0000-0x000000000250F000-memory.dmpFilesize
252KB
-
memory/3532-217-0x00000000024D0000-0x000000000250F000-memory.dmpFilesize
252KB
-
memory/3532-215-0x00000000024D0000-0x000000000250F000-memory.dmpFilesize
252KB
-
memory/3532-213-0x00000000024D0000-0x000000000250F000-memory.dmpFilesize
252KB
-
memory/3532-211-0x00000000024D0000-0x000000000250F000-memory.dmpFilesize
252KB
-
memory/3532-209-0x00000000024D0000-0x000000000250F000-memory.dmpFilesize
252KB
-
memory/3532-180-0x0000000002200000-0x0000000002246000-memory.dmpFilesize
280KB
-
memory/3532-182-0x00000000024D0000-0x0000000002514000-memory.dmpFilesize
272KB
-
memory/3532-183-0x0000000004CC0000-0x0000000004CD0000-memory.dmpFilesize
64KB
-
memory/3532-181-0x00000000005E0000-0x000000000062B000-memory.dmpFilesize
300KB
-
memory/3532-191-0x00000000024D0000-0x000000000250F000-memory.dmpFilesize
252KB
-
memory/3532-185-0x0000000004CC0000-0x0000000004CD0000-memory.dmpFilesize
64KB
-
memory/3532-186-0x00000000024D0000-0x000000000250F000-memory.dmpFilesize
252KB
-
memory/3532-187-0x00000000024D0000-0x000000000250F000-memory.dmpFilesize
252KB
-
memory/3532-189-0x00000000024D0000-0x000000000250F000-memory.dmpFilesize
252KB
-
memory/3532-184-0x0000000004CC0000-0x0000000004CD0000-memory.dmpFilesize
64KB
-
memory/3532-207-0x00000000024D0000-0x000000000250F000-memory.dmpFilesize
252KB
-
memory/3532-205-0x00000000024D0000-0x000000000250F000-memory.dmpFilesize
252KB
-
memory/3532-197-0x00000000024D0000-0x000000000250F000-memory.dmpFilesize
252KB
-
memory/3532-199-0x00000000024D0000-0x000000000250F000-memory.dmpFilesize
252KB
-
memory/3532-201-0x00000000024D0000-0x000000000250F000-memory.dmpFilesize
252KB
-
memory/3560-170-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/3560-155-0x0000000002150000-0x0000000002162000-memory.dmpFilesize
72KB
-
memory/3560-145-0x0000000002150000-0x0000000002162000-memory.dmpFilesize
72KB
-
memory/3560-138-0x00000000001D0000-0x00000000001FD000-memory.dmpFilesize
180KB
-
memory/3560-141-0x00000000006F0000-0x0000000000700000-memory.dmpFilesize
64KB
-
memory/3560-175-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/3560-173-0x00000000006F0000-0x0000000000700000-memory.dmpFilesize
64KB
-
memory/3560-172-0x00000000006F0000-0x0000000000700000-memory.dmpFilesize
64KB
-
memory/3560-171-0x00000000006F0000-0x0000000000700000-memory.dmpFilesize
64KB
-
memory/3560-137-0x0000000002150000-0x0000000002168000-memory.dmpFilesize
96KB
-
memory/3560-140-0x00000000006F0000-0x0000000000700000-memory.dmpFilesize
64KB
-
memory/3560-169-0x0000000002150000-0x0000000002162000-memory.dmpFilesize
72KB
-
memory/3560-167-0x0000000002150000-0x0000000002162000-memory.dmpFilesize
72KB
-
memory/3560-165-0x0000000002150000-0x0000000002162000-memory.dmpFilesize
72KB
-
memory/3560-163-0x0000000002150000-0x0000000002162000-memory.dmpFilesize
72KB
-
memory/3560-161-0x0000000002150000-0x0000000002162000-memory.dmpFilesize
72KB
-
memory/3560-159-0x0000000002150000-0x0000000002162000-memory.dmpFilesize
72KB
-
memory/3560-157-0x0000000002150000-0x0000000002162000-memory.dmpFilesize
72KB
-
memory/3560-153-0x0000000002150000-0x0000000002162000-memory.dmpFilesize
72KB
-
memory/3560-151-0x0000000002150000-0x0000000002162000-memory.dmpFilesize
72KB
-
memory/3560-149-0x0000000002150000-0x0000000002162000-memory.dmpFilesize
72KB
-
memory/3560-147-0x0000000002150000-0x0000000002162000-memory.dmpFilesize
72KB
-
memory/3560-143-0x0000000002150000-0x0000000002162000-memory.dmpFilesize
72KB
-
memory/3560-142-0x0000000002150000-0x0000000002162000-memory.dmpFilesize
72KB
-
memory/3560-139-0x00000000006F0000-0x0000000000700000-memory.dmpFilesize
64KB
-
memory/3560-136-0x0000000004A80000-0x0000000004F7E000-memory.dmpFilesize
5.0MB
-
memory/3560-135-0x00000000006D0000-0x00000000006EA000-memory.dmpFilesize
104KB
-
memory/4364-1114-0x0000000000F20000-0x0000000000F52000-memory.dmpFilesize
200KB
-
memory/4364-1115-0x0000000005960000-0x00000000059AB000-memory.dmpFilesize
300KB
-
memory/4364-1116-0x0000000005AF0000-0x0000000005B00000-memory.dmpFilesize
64KB