Analysis
-
max time kernel
53s -
max time network
66s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
03-04-2023 17:36
Static task
static1
Behavioral task
behavioral1
Sample
113c12c7de1ef19c740b138f7d8d4cba36571d55e64b24647ee9a0e141798ae6.exe
Resource
win10-20230220-en
General
-
Target
113c12c7de1ef19c740b138f7d8d4cba36571d55e64b24647ee9a0e141798ae6.exe
-
Size
660KB
-
MD5
08fe22a71d36305a0ad6a23137fcfed3
-
SHA1
7b3a38473101a6fa74169c631eddc4dbaf6e0f09
-
SHA256
113c12c7de1ef19c740b138f7d8d4cba36571d55e64b24647ee9a0e141798ae6
-
SHA512
5d284e34e10d1e1aec69981e78ba525860e048ad2a8048bad9d38d9909e1e34dcf666053c3d35a98730052019ef8977148095b22dd592f9da0002db0482a28da
-
SSDEEP
12288:+MrWy90mr9kVxw30vSThLRPALUcv649rPZIKoCY0jsyrLiuiXaWPPc2AhA:cyfrwBshLRk6GtFYysy6uiX5EPK
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro5387.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro5387.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro5387.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro5387.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro5387.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro5387.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/3880-178-0x0000000002460000-0x00000000024A6000-memory.dmp family_redline behavioral1/memory/3880-179-0x0000000004A50000-0x0000000004A94000-memory.dmp family_redline behavioral1/memory/3880-180-0x0000000004A50000-0x0000000004A8F000-memory.dmp family_redline behavioral1/memory/3880-181-0x0000000004A50000-0x0000000004A8F000-memory.dmp family_redline behavioral1/memory/3880-183-0x0000000004A50000-0x0000000004A8F000-memory.dmp family_redline behavioral1/memory/3880-188-0x0000000004A50000-0x0000000004A8F000-memory.dmp family_redline behavioral1/memory/3880-191-0x0000000004A50000-0x0000000004A8F000-memory.dmp family_redline behavioral1/memory/3880-193-0x0000000004A50000-0x0000000004A8F000-memory.dmp family_redline behavioral1/memory/3880-195-0x0000000004A50000-0x0000000004A8F000-memory.dmp family_redline behavioral1/memory/3880-197-0x0000000004A50000-0x0000000004A8F000-memory.dmp family_redline behavioral1/memory/3880-199-0x0000000004A50000-0x0000000004A8F000-memory.dmp family_redline behavioral1/memory/3880-201-0x0000000004A50000-0x0000000004A8F000-memory.dmp family_redline behavioral1/memory/3880-203-0x0000000004A50000-0x0000000004A8F000-memory.dmp family_redline behavioral1/memory/3880-205-0x0000000004A50000-0x0000000004A8F000-memory.dmp family_redline behavioral1/memory/3880-207-0x0000000004A50000-0x0000000004A8F000-memory.dmp family_redline behavioral1/memory/3880-209-0x0000000004A50000-0x0000000004A8F000-memory.dmp family_redline behavioral1/memory/3880-211-0x0000000004A50000-0x0000000004A8F000-memory.dmp family_redline behavioral1/memory/3880-213-0x0000000004A50000-0x0000000004A8F000-memory.dmp family_redline behavioral1/memory/3880-215-0x0000000004A50000-0x0000000004A8F000-memory.dmp family_redline behavioral1/memory/3880-217-0x0000000004A50000-0x0000000004A8F000-memory.dmp family_redline behavioral1/memory/3880-1101-0x0000000004BA0000-0x0000000004BB0000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un923042.exepro5387.exequ0903.exesi167184.exepid process 2544 un923042.exe 2604 pro5387.exe 3880 qu0903.exe 3628 si167184.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro5387.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro5387.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro5387.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
113c12c7de1ef19c740b138f7d8d4cba36571d55e64b24647ee9a0e141798ae6.exeun923042.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 113c12c7de1ef19c740b138f7d8d4cba36571d55e64b24647ee9a0e141798ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 113c12c7de1ef19c740b138f7d8d4cba36571d55e64b24647ee9a0e141798ae6.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un923042.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un923042.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro5387.exequ0903.exesi167184.exepid process 2604 pro5387.exe 2604 pro5387.exe 3880 qu0903.exe 3880 qu0903.exe 3628 si167184.exe 3628 si167184.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro5387.exequ0903.exesi167184.exedescription pid process Token: SeDebugPrivilege 2604 pro5387.exe Token: SeDebugPrivilege 3880 qu0903.exe Token: SeDebugPrivilege 3628 si167184.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
113c12c7de1ef19c740b138f7d8d4cba36571d55e64b24647ee9a0e141798ae6.exeun923042.exedescription pid process target process PID 2484 wrote to memory of 2544 2484 113c12c7de1ef19c740b138f7d8d4cba36571d55e64b24647ee9a0e141798ae6.exe un923042.exe PID 2484 wrote to memory of 2544 2484 113c12c7de1ef19c740b138f7d8d4cba36571d55e64b24647ee9a0e141798ae6.exe un923042.exe PID 2484 wrote to memory of 2544 2484 113c12c7de1ef19c740b138f7d8d4cba36571d55e64b24647ee9a0e141798ae6.exe un923042.exe PID 2544 wrote to memory of 2604 2544 un923042.exe pro5387.exe PID 2544 wrote to memory of 2604 2544 un923042.exe pro5387.exe PID 2544 wrote to memory of 2604 2544 un923042.exe pro5387.exe PID 2544 wrote to memory of 3880 2544 un923042.exe qu0903.exe PID 2544 wrote to memory of 3880 2544 un923042.exe qu0903.exe PID 2544 wrote to memory of 3880 2544 un923042.exe qu0903.exe PID 2484 wrote to memory of 3628 2484 113c12c7de1ef19c740b138f7d8d4cba36571d55e64b24647ee9a0e141798ae6.exe si167184.exe PID 2484 wrote to memory of 3628 2484 113c12c7de1ef19c740b138f7d8d4cba36571d55e64b24647ee9a0e141798ae6.exe si167184.exe PID 2484 wrote to memory of 3628 2484 113c12c7de1ef19c740b138f7d8d4cba36571d55e64b24647ee9a0e141798ae6.exe si167184.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\113c12c7de1ef19c740b138f7d8d4cba36571d55e64b24647ee9a0e141798ae6.exe"C:\Users\Admin\AppData\Local\Temp\113c12c7de1ef19c740b138f7d8d4cba36571d55e64b24647ee9a0e141798ae6.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un923042.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un923042.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5387.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5387.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0903.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0903.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si167184.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si167184.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3628
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si167184.exeFilesize
175KB
MD5bb6d43fa4ebafe62b98ec4dea4ff49d9
SHA1d8188e664ac977f59d3ec26589e3cf67b1fab23b
SHA2561d1cdf01afc38fc6784a41fe8aa2f308ec44606d2d16c4edd9445813af33fe89
SHA512679a0e394c5751020c38ceaba6a1bd1a33c558b8c9142fc796fa3570baa0ac082d099891451fde50249e165625b9738ead7321dccf2b2da567f3f7e3d4ee4644
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si167184.exeFilesize
175KB
MD5bb6d43fa4ebafe62b98ec4dea4ff49d9
SHA1d8188e664ac977f59d3ec26589e3cf67b1fab23b
SHA2561d1cdf01afc38fc6784a41fe8aa2f308ec44606d2d16c4edd9445813af33fe89
SHA512679a0e394c5751020c38ceaba6a1bd1a33c558b8c9142fc796fa3570baa0ac082d099891451fde50249e165625b9738ead7321dccf2b2da567f3f7e3d4ee4644
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un923042.exeFilesize
518KB
MD5b405cac21bc34fc767b2663ed2784c3e
SHA158bff647a406defca2ae439d722dc27cb7022043
SHA256354dc0d4afd3dda945fd58bcf578426d7f55c83943e5293ae81fd44d60618a4c
SHA51252065e92dddedc28afb0ff6b73fba58b9d1c2d68e351437c8b9a9a60c3fa0672e9ebf5bb1a55db690264f473a0559683434e8a0c52030d5e2147a31760bee1a9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un923042.exeFilesize
518KB
MD5b405cac21bc34fc767b2663ed2784c3e
SHA158bff647a406defca2ae439d722dc27cb7022043
SHA256354dc0d4afd3dda945fd58bcf578426d7f55c83943e5293ae81fd44d60618a4c
SHA51252065e92dddedc28afb0ff6b73fba58b9d1c2d68e351437c8b9a9a60c3fa0672e9ebf5bb1a55db690264f473a0559683434e8a0c52030d5e2147a31760bee1a9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5387.exeFilesize
236KB
MD518a38eb1adee54159f81e0358553864d
SHA18c9593a9db4356586bfc43100c0c5ea7ff0f66cb
SHA2568082e0747e7246c858fe4599884a6fae3f2db4f2cfad445cbf6e00ccf5b5329d
SHA5124ccace2627ff2673bd5b862938dd412886acd41c0ba755119e03ec1dbb0cb08ad0c63068abc37a218036e5e29231682980c979a2ad1453f1cb59481c7f30420b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5387.exeFilesize
236KB
MD518a38eb1adee54159f81e0358553864d
SHA18c9593a9db4356586bfc43100c0c5ea7ff0f66cb
SHA2568082e0747e7246c858fe4599884a6fae3f2db4f2cfad445cbf6e00ccf5b5329d
SHA5124ccace2627ff2673bd5b862938dd412886acd41c0ba755119e03ec1dbb0cb08ad0c63068abc37a218036e5e29231682980c979a2ad1453f1cb59481c7f30420b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0903.exeFilesize
295KB
MD59a7307d861658d06316756192569b1a3
SHA12a940aaa495ead8c1df1f023de0dc8aef9d86bb6
SHA256384aad9741c0ca8cc02644df47cc85a8ce321729de255e0673d59602e9a98da1
SHA5123735cc0dc70fb735bf11d335470a6818b6905bc8cf7ab1c5a78c5dd69c057e7c43086132713a4a477a3e82c2e3358f1c0756c5a9e4cfde6cc22230cfb142a0de
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0903.exeFilesize
295KB
MD59a7307d861658d06316756192569b1a3
SHA12a940aaa495ead8c1df1f023de0dc8aef9d86bb6
SHA256384aad9741c0ca8cc02644df47cc85a8ce321729de255e0673d59602e9a98da1
SHA5123735cc0dc70fb735bf11d335470a6818b6905bc8cf7ab1c5a78c5dd69c057e7c43086132713a4a477a3e82c2e3358f1c0756c5a9e4cfde6cc22230cfb142a0de
-
memory/2604-136-0x00000000001D0000-0x00000000001FD000-memory.dmpFilesize
180KB
-
memory/2604-137-0x0000000002330000-0x000000000234A000-memory.dmpFilesize
104KB
-
memory/2604-138-0x0000000004A00000-0x0000000004EFE000-memory.dmpFilesize
5.0MB
-
memory/2604-139-0x0000000002540000-0x0000000002558000-memory.dmpFilesize
96KB
-
memory/2604-140-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/2604-141-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/2604-143-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/2604-145-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/2604-147-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/2604-149-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/2604-151-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/2604-153-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/2604-155-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/2604-157-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/2604-159-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/2604-161-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/2604-163-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/2604-165-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/2604-167-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/2604-168-0x00000000049F0000-0x0000000004A00000-memory.dmpFilesize
64KB
-
memory/2604-169-0x00000000049F0000-0x0000000004A00000-memory.dmpFilesize
64KB
-
memory/2604-170-0x00000000049F0000-0x0000000004A00000-memory.dmpFilesize
64KB
-
memory/2604-171-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/2604-173-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/3628-1112-0x0000000000AA0000-0x0000000000AD2000-memory.dmpFilesize
200KB
-
memory/3628-1114-0x0000000005370000-0x0000000005380000-memory.dmpFilesize
64KB
-
memory/3628-1113-0x0000000005320000-0x000000000536B000-memory.dmpFilesize
300KB
-
memory/3880-181-0x0000000004A50000-0x0000000004A8F000-memory.dmpFilesize
252KB
-
memory/3880-213-0x0000000004A50000-0x0000000004A8F000-memory.dmpFilesize
252KB
-
memory/3880-183-0x0000000004A50000-0x0000000004A8F000-memory.dmpFilesize
252KB
-
memory/3880-184-0x0000000001EE0000-0x0000000001F2B000-memory.dmpFilesize
300KB
-
memory/3880-185-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/3880-188-0x0000000004A50000-0x0000000004A8F000-memory.dmpFilesize
252KB
-
memory/3880-187-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/3880-189-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/3880-191-0x0000000004A50000-0x0000000004A8F000-memory.dmpFilesize
252KB
-
memory/3880-193-0x0000000004A50000-0x0000000004A8F000-memory.dmpFilesize
252KB
-
memory/3880-195-0x0000000004A50000-0x0000000004A8F000-memory.dmpFilesize
252KB
-
memory/3880-197-0x0000000004A50000-0x0000000004A8F000-memory.dmpFilesize
252KB
-
memory/3880-199-0x0000000004A50000-0x0000000004A8F000-memory.dmpFilesize
252KB
-
memory/3880-201-0x0000000004A50000-0x0000000004A8F000-memory.dmpFilesize
252KB
-
memory/3880-203-0x0000000004A50000-0x0000000004A8F000-memory.dmpFilesize
252KB
-
memory/3880-205-0x0000000004A50000-0x0000000004A8F000-memory.dmpFilesize
252KB
-
memory/3880-207-0x0000000004A50000-0x0000000004A8F000-memory.dmpFilesize
252KB
-
memory/3880-209-0x0000000004A50000-0x0000000004A8F000-memory.dmpFilesize
252KB
-
memory/3880-211-0x0000000004A50000-0x0000000004A8F000-memory.dmpFilesize
252KB
-
memory/3880-180-0x0000000004A50000-0x0000000004A8F000-memory.dmpFilesize
252KB
-
memory/3880-215-0x0000000004A50000-0x0000000004A8F000-memory.dmpFilesize
252KB
-
memory/3880-217-0x0000000004A50000-0x0000000004A8F000-memory.dmpFilesize
252KB
-
memory/3880-1090-0x00000000050B0000-0x00000000056B6000-memory.dmpFilesize
6.0MB
-
memory/3880-1091-0x00000000056C0000-0x00000000057CA000-memory.dmpFilesize
1.0MB
-
memory/3880-1092-0x0000000004B70000-0x0000000004B82000-memory.dmpFilesize
72KB
-
memory/3880-1093-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/3880-1094-0x00000000057D0000-0x000000000580E000-memory.dmpFilesize
248KB
-
memory/3880-1095-0x0000000005950000-0x000000000599B000-memory.dmpFilesize
300KB
-
memory/3880-1097-0x0000000005AA0000-0x0000000005B06000-memory.dmpFilesize
408KB
-
memory/3880-1098-0x0000000006160000-0x00000000061F2000-memory.dmpFilesize
584KB
-
memory/3880-1099-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/3880-1100-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/3880-1101-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/3880-1102-0x0000000006260000-0x0000000006422000-memory.dmpFilesize
1.8MB
-
memory/3880-1103-0x0000000006430000-0x000000000695C000-memory.dmpFilesize
5.2MB
-
memory/3880-179-0x0000000004A50000-0x0000000004A94000-memory.dmpFilesize
272KB
-
memory/3880-178-0x0000000002460000-0x00000000024A6000-memory.dmpFilesize
280KB
-
memory/3880-1104-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/3880-1105-0x0000000007F90000-0x0000000008006000-memory.dmpFilesize
472KB
-
memory/3880-1106-0x0000000008010000-0x0000000008060000-memory.dmpFilesize
320KB