Analysis
-
max time kernel
96s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 18:23
Static task
static1
Behavioral task
behavioral1
Sample
8d90c62eac96cafa0fbcf16a12938a28114ee58b8963e8cb47c8530a6c2877cf.exe
Resource
win10v2004-20230220-en
General
-
Target
8d90c62eac96cafa0fbcf16a12938a28114ee58b8963e8cb47c8530a6c2877cf.exe
-
Size
521KB
-
MD5
a630f9b78a63349384d74055b01cf18d
-
SHA1
6bded63e004bfc4bce4f0c68cab8126fa91983a8
-
SHA256
8d90c62eac96cafa0fbcf16a12938a28114ee58b8963e8cb47c8530a6c2877cf
-
SHA512
0379e35873922be20ee18c2f3f8e8726f89e34aa5c50fee72fb958cbd16ec83ed8c8ef4e2dccf81a34deba48193392be920379b5c5379a802949417e8197daf0
-
SSDEEP
12288:zMrYy90q/GEYvZuIF6pjwMvbO3l6RseyxUDE:Dy6jvn5MvisRsmE
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr284671.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr284671.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr284671.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr284671.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr284671.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr284671.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr284671.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/3556-157-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3556-158-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3556-160-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3556-162-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3556-164-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3556-166-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3556-168-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3556-170-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3556-172-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3556-174-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3556-176-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3556-178-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3556-180-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3556-183-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3556-185-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3556-187-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3556-189-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3556-191-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3556-193-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3556-195-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3556-197-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3556-199-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3556-201-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3556-203-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3556-205-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3556-207-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3556-209-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3556-211-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3556-213-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3556-215-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3556-219-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3556-217-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/3556-221-0x0000000002620000-0x000000000265F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
ziwp3402.exejr284671.exeku968377.exelr674985.exepid process 4568 ziwp3402.exe 1300 jr284671.exe 3556 ku968377.exe 1764 lr674985.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr284671.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr284671.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
8d90c62eac96cafa0fbcf16a12938a28114ee58b8963e8cb47c8530a6c2877cf.exeziwp3402.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 8d90c62eac96cafa0fbcf16a12938a28114ee58b8963e8cb47c8530a6c2877cf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziwp3402.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziwp3402.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 8d90c62eac96cafa0fbcf16a12938a28114ee58b8963e8cb47c8530a6c2877cf.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1940 3556 WerFault.exe ku968377.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr284671.exeku968377.exelr674985.exepid process 1300 jr284671.exe 1300 jr284671.exe 3556 ku968377.exe 3556 ku968377.exe 1764 lr674985.exe 1764 lr674985.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr284671.exeku968377.exelr674985.exedescription pid process Token: SeDebugPrivilege 1300 jr284671.exe Token: SeDebugPrivilege 3556 ku968377.exe Token: SeDebugPrivilege 1764 lr674985.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
8d90c62eac96cafa0fbcf16a12938a28114ee58b8963e8cb47c8530a6c2877cf.exeziwp3402.exedescription pid process target process PID 4236 wrote to memory of 4568 4236 8d90c62eac96cafa0fbcf16a12938a28114ee58b8963e8cb47c8530a6c2877cf.exe ziwp3402.exe PID 4236 wrote to memory of 4568 4236 8d90c62eac96cafa0fbcf16a12938a28114ee58b8963e8cb47c8530a6c2877cf.exe ziwp3402.exe PID 4236 wrote to memory of 4568 4236 8d90c62eac96cafa0fbcf16a12938a28114ee58b8963e8cb47c8530a6c2877cf.exe ziwp3402.exe PID 4568 wrote to memory of 1300 4568 ziwp3402.exe jr284671.exe PID 4568 wrote to memory of 1300 4568 ziwp3402.exe jr284671.exe PID 4568 wrote to memory of 3556 4568 ziwp3402.exe ku968377.exe PID 4568 wrote to memory of 3556 4568 ziwp3402.exe ku968377.exe PID 4568 wrote to memory of 3556 4568 ziwp3402.exe ku968377.exe PID 4236 wrote to memory of 1764 4236 8d90c62eac96cafa0fbcf16a12938a28114ee58b8963e8cb47c8530a6c2877cf.exe lr674985.exe PID 4236 wrote to memory of 1764 4236 8d90c62eac96cafa0fbcf16a12938a28114ee58b8963e8cb47c8530a6c2877cf.exe lr674985.exe PID 4236 wrote to memory of 1764 4236 8d90c62eac96cafa0fbcf16a12938a28114ee58b8963e8cb47c8530a6c2877cf.exe lr674985.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d90c62eac96cafa0fbcf16a12938a28114ee58b8963e8cb47c8530a6c2877cf.exe"C:\Users\Admin\AppData\Local\Temp\8d90c62eac96cafa0fbcf16a12938a28114ee58b8963e8cb47c8530a6c2877cf.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziwp3402.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziwp3402.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr284671.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr284671.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku968377.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku968377.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3556 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3556 -s 16284⤵
- Program crash
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr674985.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr674985.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1764
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3556 -ip 35561⤵PID:684
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr674985.exeFilesize
175KB
MD5958dc12ca250d2ffa3efbe09b64b5d43
SHA13ea5a00fea4a834efe746f5240aaaabb9a2e4e31
SHA2567a476df8272805225fbdae6f03f924589e45a940c2d414c729a8801701f55924
SHA512756902e0d2a747dd0b35968612e6a07b877ab9bface7dabc9931cae115c32a24293c13bcab9a4bb64ce29566ef8df4197dad3e646425b8fb42cb0234143e1aa5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr674985.exeFilesize
175KB
MD5958dc12ca250d2ffa3efbe09b64b5d43
SHA13ea5a00fea4a834efe746f5240aaaabb9a2e4e31
SHA2567a476df8272805225fbdae6f03f924589e45a940c2d414c729a8801701f55924
SHA512756902e0d2a747dd0b35968612e6a07b877ab9bface7dabc9931cae115c32a24293c13bcab9a4bb64ce29566ef8df4197dad3e646425b8fb42cb0234143e1aa5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziwp3402.exeFilesize
379KB
MD5570f65c26ebbe492ab765ecb16580027
SHA18552e2995fbdeaea79c5222ff5943910d779a534
SHA256fc70c60284c9ea5a795c998172ab71d6480cd1b2bb97e320e47cfc404e833ab5
SHA51270d671c360d225a71a8b380669d210dce0bc41421f81b3ee2f85768478d5940196c8dcc953ae609fc12446bc5673ad09d91af3c4140a25109935816493e4ea38
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziwp3402.exeFilesize
379KB
MD5570f65c26ebbe492ab765ecb16580027
SHA18552e2995fbdeaea79c5222ff5943910d779a534
SHA256fc70c60284c9ea5a795c998172ab71d6480cd1b2bb97e320e47cfc404e833ab5
SHA51270d671c360d225a71a8b380669d210dce0bc41421f81b3ee2f85768478d5940196c8dcc953ae609fc12446bc5673ad09d91af3c4140a25109935816493e4ea38
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr284671.exeFilesize
11KB
MD5fe6c4c3d8d8109e1be5d14cde18708f7
SHA10531532260a8157755d6518195b73533b560f580
SHA25640a0c41ec2a7b40e3f8b63014cc86676eaaafa2b7c96be23ce087e9d9ec25246
SHA5122255a4879d88bb1e305459a7d591e1ae0664b5775e7ff1a115594b7f4e17ad4b6895ddb827c7afc2e01f40fc4d32073dbc803a626a68c271327ec08f37488493
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr284671.exeFilesize
11KB
MD5fe6c4c3d8d8109e1be5d14cde18708f7
SHA10531532260a8157755d6518195b73533b560f580
SHA25640a0c41ec2a7b40e3f8b63014cc86676eaaafa2b7c96be23ce087e9d9ec25246
SHA5122255a4879d88bb1e305459a7d591e1ae0664b5775e7ff1a115594b7f4e17ad4b6895ddb827c7afc2e01f40fc4d32073dbc803a626a68c271327ec08f37488493
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku968377.exeFilesize
294KB
MD50778478075af842356abb5b0d10bcdc4
SHA1ab66d60f39cffc3ef8c8bd0f312c719153d27cf0
SHA256411d5796a1166edf3daa6dc53975fe636c89e685fddef6e1b72c9d36d4aacf30
SHA5123044b7238da460485f2cfa4d1767820effc2ed0d1c90095d2161df79b7bedf1b86d4c2f020f44c241292f91a343682f3ae7e9d2c16cb5eac956f513c6e808dfa
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku968377.exeFilesize
294KB
MD50778478075af842356abb5b0d10bcdc4
SHA1ab66d60f39cffc3ef8c8bd0f312c719153d27cf0
SHA256411d5796a1166edf3daa6dc53975fe636c89e685fddef6e1b72c9d36d4aacf30
SHA5123044b7238da460485f2cfa4d1767820effc2ed0d1c90095d2161df79b7bedf1b86d4c2f020f44c241292f91a343682f3ae7e9d2c16cb5eac956f513c6e808dfa
-
memory/1300-147-0x0000000000030000-0x000000000003A000-memory.dmpFilesize
40KB
-
memory/1764-1085-0x0000000000E10000-0x0000000000E42000-memory.dmpFilesize
200KB
-
memory/1764-1086-0x0000000005A20000-0x0000000005A30000-memory.dmpFilesize
64KB
-
memory/3556-189-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3556-201-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3556-155-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/3556-156-0x0000000004C80000-0x0000000005224000-memory.dmpFilesize
5.6MB
-
memory/3556-157-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3556-158-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3556-160-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3556-162-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3556-164-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3556-166-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3556-168-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3556-170-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3556-172-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3556-174-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3556-176-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3556-178-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3556-180-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3556-182-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/3556-183-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3556-185-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3556-187-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3556-153-0x0000000000590000-0x00000000005DB000-memory.dmpFilesize
300KB
-
memory/3556-191-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3556-193-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3556-195-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3556-197-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3556-199-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3556-154-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/3556-203-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3556-205-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3556-207-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3556-209-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3556-211-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3556-213-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3556-215-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3556-219-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3556-217-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3556-221-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/3556-1064-0x0000000005230000-0x0000000005848000-memory.dmpFilesize
6.1MB
-
memory/3556-1065-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/3556-1066-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/3556-1067-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/3556-1068-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/3556-1070-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/3556-1071-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/3556-1072-0x0000000005CF0000-0x0000000005D56000-memory.dmpFilesize
408KB
-
memory/3556-1073-0x00000000063C0000-0x0000000006452000-memory.dmpFilesize
584KB
-
memory/3556-1074-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/3556-1075-0x00000000064B0000-0x0000000006526000-memory.dmpFilesize
472KB
-
memory/3556-1076-0x0000000006540000-0x0000000006590000-memory.dmpFilesize
320KB
-
memory/3556-1077-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/3556-1078-0x00000000065A0000-0x0000000006762000-memory.dmpFilesize
1.8MB
-
memory/3556-1079-0x0000000006780000-0x0000000006CAC000-memory.dmpFilesize
5.2MB