Analysis
-
max time kernel
127s -
max time network
185s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 22:38
Static task
static1
Behavioral task
behavioral1
Sample
788f286a0c8686a02cd65c2a97631e0ea3e37023029666cf6e97f3882cc9959c.exe
Resource
win10v2004-20230220-en
General
-
Target
788f286a0c8686a02cd65c2a97631e0ea3e37023029666cf6e97f3882cc9959c.exe
-
Size
659KB
-
MD5
743ccf9bf95989514cef22c8c7df5be7
-
SHA1
78e2af932792781937b22822e8d8ce0aa981ca92
-
SHA256
788f286a0c8686a02cd65c2a97631e0ea3e37023029666cf6e97f3882cc9959c
-
SHA512
7bfd9caceb374110ebb35aa940ae464276de83547029adcf825f85b0886329fa1bf202dfb70389642e3620c36de6b5b2b5a937f8459dd425de68dce762bd37d2
-
SSDEEP
12288:lMrRy90GyD7KI4H7tb2IIWOLSVMCt592rwB6eCZanft/juHTFl:UyMGI45Dp4kt5YW6vZyB+H
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro3668.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro3668.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro3668.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro3668.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro3668.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro3668.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro3668.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/1528-192-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1528-193-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1528-195-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1528-197-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1528-199-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1528-201-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1528-203-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1528-207-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1528-211-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1528-213-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1528-215-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1528-217-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1528-219-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1528-221-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1528-223-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1528-225-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1528-227-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1528-1108-0x0000000004BF0000-0x0000000004C00000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un902547.exepro3668.exequ2335.exesi366824.exepid process 3148 un902547.exe 436 pro3668.exe 1528 qu2335.exe 536 si366824.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro3668.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro3668.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro3668.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
788f286a0c8686a02cd65c2a97631e0ea3e37023029666cf6e97f3882cc9959c.exeun902547.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 788f286a0c8686a02cd65c2a97631e0ea3e37023029666cf6e97f3882cc9959c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 788f286a0c8686a02cd65c2a97631e0ea3e37023029666cf6e97f3882cc9959c.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un902547.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un902547.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4988 436 WerFault.exe pro3668.exe 4860 1528 WerFault.exe qu2335.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro3668.exequ2335.exesi366824.exepid process 436 pro3668.exe 436 pro3668.exe 1528 qu2335.exe 1528 qu2335.exe 536 si366824.exe 536 si366824.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro3668.exequ2335.exesi366824.exedescription pid process Token: SeDebugPrivilege 436 pro3668.exe Token: SeDebugPrivilege 1528 qu2335.exe Token: SeDebugPrivilege 536 si366824.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
788f286a0c8686a02cd65c2a97631e0ea3e37023029666cf6e97f3882cc9959c.exeun902547.exedescription pid process target process PID 1392 wrote to memory of 3148 1392 788f286a0c8686a02cd65c2a97631e0ea3e37023029666cf6e97f3882cc9959c.exe un902547.exe PID 1392 wrote to memory of 3148 1392 788f286a0c8686a02cd65c2a97631e0ea3e37023029666cf6e97f3882cc9959c.exe un902547.exe PID 1392 wrote to memory of 3148 1392 788f286a0c8686a02cd65c2a97631e0ea3e37023029666cf6e97f3882cc9959c.exe un902547.exe PID 3148 wrote to memory of 436 3148 un902547.exe pro3668.exe PID 3148 wrote to memory of 436 3148 un902547.exe pro3668.exe PID 3148 wrote to memory of 436 3148 un902547.exe pro3668.exe PID 3148 wrote to memory of 1528 3148 un902547.exe qu2335.exe PID 3148 wrote to memory of 1528 3148 un902547.exe qu2335.exe PID 3148 wrote to memory of 1528 3148 un902547.exe qu2335.exe PID 1392 wrote to memory of 536 1392 788f286a0c8686a02cd65c2a97631e0ea3e37023029666cf6e97f3882cc9959c.exe si366824.exe PID 1392 wrote to memory of 536 1392 788f286a0c8686a02cd65c2a97631e0ea3e37023029666cf6e97f3882cc9959c.exe si366824.exe PID 1392 wrote to memory of 536 1392 788f286a0c8686a02cd65c2a97631e0ea3e37023029666cf6e97f3882cc9959c.exe si366824.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\788f286a0c8686a02cd65c2a97631e0ea3e37023029666cf6e97f3882cc9959c.exe"C:\Users\Admin\AppData\Local\Temp\788f286a0c8686a02cd65c2a97631e0ea3e37023029666cf6e97f3882cc9959c.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un902547.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un902547.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3668.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3668.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 10844⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2335.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2335.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 16924⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si366824.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si366824.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 436 -ip 4361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1528 -ip 15281⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si366824.exeFilesize
175KB
MD527e3b0c08665300eb8747874f19a72a0
SHA185db5bbcd558a49ca108cf9655c034204e46bb0a
SHA256e462d744efe519bdf22d96a2826381c46f3994cf10e2ce516fa255d0b6a19f93
SHA5123b23b7c90a98636252f08fc05a2b0e212e4d5322b3ccc112bec8b2ffdb5ace2e0d40b2cb9bb80ab66b8ced6cde5a59a3a419e65374aca17b8ea9fa6bb592bef4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si366824.exeFilesize
175KB
MD527e3b0c08665300eb8747874f19a72a0
SHA185db5bbcd558a49ca108cf9655c034204e46bb0a
SHA256e462d744efe519bdf22d96a2826381c46f3994cf10e2ce516fa255d0b6a19f93
SHA5123b23b7c90a98636252f08fc05a2b0e212e4d5322b3ccc112bec8b2ffdb5ace2e0d40b2cb9bb80ab66b8ced6cde5a59a3a419e65374aca17b8ea9fa6bb592bef4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un902547.exeFilesize
517KB
MD5ecb81151d1833b24f57e7de79baf194d
SHA1d07425f3cb666a57e68a736f72df626815c9df7d
SHA256b02a1d86d74a789106c0d6ceabe48c2e92f6f7290f088b3ebc55b8576698aed1
SHA51237adb79e910a37e86a5c812207fca60601c69c58273e6debf20b726212b670836a7eb1d1da84a85c8ee76e346196a6e3b45e160e71dee5b61df1ab73181ea7c5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un902547.exeFilesize
517KB
MD5ecb81151d1833b24f57e7de79baf194d
SHA1d07425f3cb666a57e68a736f72df626815c9df7d
SHA256b02a1d86d74a789106c0d6ceabe48c2e92f6f7290f088b3ebc55b8576698aed1
SHA51237adb79e910a37e86a5c812207fca60601c69c58273e6debf20b726212b670836a7eb1d1da84a85c8ee76e346196a6e3b45e160e71dee5b61df1ab73181ea7c5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3668.exeFilesize
237KB
MD5f510945f5b99517e49b8b78d0e29b8d5
SHA152693db2274a259f78e886a9deff2f792941d2e5
SHA2562e0de49511e2c76559219290d35810eff9907da3f0f94d578d8cdd511ccf8ba9
SHA5121d9a16becf8b28fdb58595ee35c2c56f48e7d97a05b2e7337bbd754c06a1d5de5886f27ed6d6128f790c16770bce9e30084ba332c4c07c635feed2bc5f14cf90
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3668.exeFilesize
237KB
MD5f510945f5b99517e49b8b78d0e29b8d5
SHA152693db2274a259f78e886a9deff2f792941d2e5
SHA2562e0de49511e2c76559219290d35810eff9907da3f0f94d578d8cdd511ccf8ba9
SHA5121d9a16becf8b28fdb58595ee35c2c56f48e7d97a05b2e7337bbd754c06a1d5de5886f27ed6d6128f790c16770bce9e30084ba332c4c07c635feed2bc5f14cf90
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2335.exeFilesize
295KB
MD57a407a87f2f1c7fd6b485d748bdaa1ee
SHA15e1efc63fa2d2a22c953af4cde1bc99fc559bb7d
SHA256dd7eb8f284d52a0348c70a1f9537df7c5e5d80fc1733852cabc99d4cd06f794a
SHA51273eb1247fe4d67772a4460efdd2ca406776c8bc6bfaae1d76380b757b514923bd380f5282dfaa61d5afe1d4ee06874d9d2dc1e2f050a8a6321d7f465cfd24e32
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2335.exeFilesize
295KB
MD57a407a87f2f1c7fd6b485d748bdaa1ee
SHA15e1efc63fa2d2a22c953af4cde1bc99fc559bb7d
SHA256dd7eb8f284d52a0348c70a1f9537df7c5e5d80fc1733852cabc99d4cd06f794a
SHA51273eb1247fe4d67772a4460efdd2ca406776c8bc6bfaae1d76380b757b514923bd380f5282dfaa61d5afe1d4ee06874d9d2dc1e2f050a8a6321d7f465cfd24e32
-
memory/436-164-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/436-168-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/436-150-0x0000000004A30000-0x0000000004A40000-memory.dmpFilesize
64KB
-
memory/436-151-0x0000000004A30000-0x0000000004A40000-memory.dmpFilesize
64KB
-
memory/436-152-0x0000000004A40000-0x0000000004FE4000-memory.dmpFilesize
5.6MB
-
memory/436-153-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/436-154-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/436-156-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/436-158-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/436-160-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/436-148-0x0000000000630000-0x000000000065D000-memory.dmpFilesize
180KB
-
memory/436-162-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/436-166-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/436-149-0x0000000004A30000-0x0000000004A40000-memory.dmpFilesize
64KB
-
memory/436-170-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/436-172-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/436-174-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/436-176-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/436-178-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/436-180-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/436-181-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/436-182-0x0000000004A30000-0x0000000004A40000-memory.dmpFilesize
64KB
-
memory/436-183-0x0000000004A30000-0x0000000004A40000-memory.dmpFilesize
64KB
-
memory/436-184-0x0000000004A30000-0x0000000004A40000-memory.dmpFilesize
64KB
-
memory/436-186-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/536-1127-0x0000000000F20000-0x0000000000F52000-memory.dmpFilesize
200KB
-
memory/536-1129-0x0000000005AF0000-0x0000000005B00000-memory.dmpFilesize
64KB
-
memory/536-1128-0x0000000005AF0000-0x0000000005B00000-memory.dmpFilesize
64KB
-
memory/1528-195-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1528-197-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1528-199-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1528-201-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1528-204-0x00000000020F0000-0x000000000213B000-memory.dmpFilesize
300KB
-
memory/1528-203-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1528-208-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/1528-205-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/1528-207-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1528-209-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/1528-211-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1528-213-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1528-215-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1528-217-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1528-219-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1528-221-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1528-223-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1528-225-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1528-227-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1528-1102-0x00000000052B0000-0x00000000058C8000-memory.dmpFilesize
6.1MB
-
memory/1528-1103-0x00000000058D0000-0x00000000059DA000-memory.dmpFilesize
1.0MB
-
memory/1528-1104-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/1528-1105-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/1528-1106-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/1528-1108-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/1528-1109-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/1528-1110-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/1528-1111-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/1528-1114-0x0000000005F70000-0x0000000006002000-memory.dmpFilesize
584KB
-
memory/1528-1115-0x0000000006010000-0x0000000006076000-memory.dmpFilesize
408KB
-
memory/1528-1117-0x0000000007860000-0x0000000007A22000-memory.dmpFilesize
1.8MB
-
memory/1528-193-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1528-192-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1528-1118-0x0000000007A30000-0x0000000007F5C000-memory.dmpFilesize
5.2MB
-
memory/1528-1120-0x0000000008000000-0x0000000008076000-memory.dmpFilesize
472KB
-
memory/1528-1121-0x00000000080A0000-0x00000000080F0000-memory.dmpFilesize
320KB