Analysis
-
max time kernel
59s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 18:31
Static task
static1
Behavioral task
behavioral1
Sample
7e44d182f5eaf84abfd25a600d3566c836db308172c1bbcaf96ecfa11230d1cf.exe
Resource
win10v2004-20230221-en
General
-
Target
7e44d182f5eaf84abfd25a600d3566c836db308172c1bbcaf96ecfa11230d1cf.exe
-
Size
522KB
-
MD5
718c0fbb4951cc347d9358e3983a2fa2
-
SHA1
5be3d5f474dbad2eabfc498b910142a3b6270dbc
-
SHA256
7e44d182f5eaf84abfd25a600d3566c836db308172c1bbcaf96ecfa11230d1cf
-
SHA512
c4ec76aa0d98e93168befa0108bf1619d97ad4aa7d780ceb6031a6af6839a2cbe8e6ef6cf966eee1498aeb103035177c2b6f7fd135c587d17bf3674857dc1dda
-
SSDEEP
12288:KMrJy90E7DwMNCz0c0McyI9/6m+trhVuCy9kqb86N5Uhd:LydITT0McyI9/s/uCrm58d
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr416650.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr416650.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr416650.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr416650.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr416650.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr416650.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr416650.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/5016-157-0x0000000002480000-0x00000000024BF000-memory.dmp family_redline behavioral1/memory/5016-158-0x0000000002480000-0x00000000024BF000-memory.dmp family_redline behavioral1/memory/5016-160-0x0000000002480000-0x00000000024BF000-memory.dmp family_redline behavioral1/memory/5016-162-0x0000000002480000-0x00000000024BF000-memory.dmp family_redline behavioral1/memory/5016-164-0x0000000002480000-0x00000000024BF000-memory.dmp family_redline behavioral1/memory/5016-166-0x0000000002480000-0x00000000024BF000-memory.dmp family_redline behavioral1/memory/5016-168-0x0000000002480000-0x00000000024BF000-memory.dmp family_redline behavioral1/memory/5016-170-0x0000000002480000-0x00000000024BF000-memory.dmp family_redline behavioral1/memory/5016-172-0x0000000002480000-0x00000000024BF000-memory.dmp family_redline behavioral1/memory/5016-174-0x0000000002480000-0x00000000024BF000-memory.dmp family_redline behavioral1/memory/5016-176-0x0000000002480000-0x00000000024BF000-memory.dmp family_redline behavioral1/memory/5016-178-0x0000000002480000-0x00000000024BF000-memory.dmp family_redline behavioral1/memory/5016-180-0x0000000002480000-0x00000000024BF000-memory.dmp family_redline behavioral1/memory/5016-182-0x0000000002480000-0x00000000024BF000-memory.dmp family_redline behavioral1/memory/5016-185-0x0000000002480000-0x00000000024BF000-memory.dmp family_redline behavioral1/memory/5016-187-0x0000000002480000-0x00000000024BF000-memory.dmp family_redline behavioral1/memory/5016-189-0x0000000002480000-0x00000000024BF000-memory.dmp family_redline behavioral1/memory/5016-191-0x0000000002480000-0x00000000024BF000-memory.dmp family_redline behavioral1/memory/5016-193-0x0000000002480000-0x00000000024BF000-memory.dmp family_redline behavioral1/memory/5016-195-0x0000000002480000-0x00000000024BF000-memory.dmp family_redline behavioral1/memory/5016-197-0x0000000002480000-0x00000000024BF000-memory.dmp family_redline behavioral1/memory/5016-199-0x0000000002480000-0x00000000024BF000-memory.dmp family_redline behavioral1/memory/5016-201-0x0000000002480000-0x00000000024BF000-memory.dmp family_redline behavioral1/memory/5016-203-0x0000000002480000-0x00000000024BF000-memory.dmp family_redline behavioral1/memory/5016-205-0x0000000002480000-0x00000000024BF000-memory.dmp family_redline behavioral1/memory/5016-207-0x0000000002480000-0x00000000024BF000-memory.dmp family_redline behavioral1/memory/5016-209-0x0000000002480000-0x00000000024BF000-memory.dmp family_redline behavioral1/memory/5016-211-0x0000000002480000-0x00000000024BF000-memory.dmp family_redline behavioral1/memory/5016-213-0x0000000002480000-0x00000000024BF000-memory.dmp family_redline behavioral1/memory/5016-215-0x0000000002480000-0x00000000024BF000-memory.dmp family_redline behavioral1/memory/5016-217-0x0000000002480000-0x00000000024BF000-memory.dmp family_redline behavioral1/memory/5016-219-0x0000000002480000-0x00000000024BF000-memory.dmp family_redline behavioral1/memory/5016-221-0x0000000002480000-0x00000000024BF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
ziIw9543.exejr416650.exeku630268.exelr772207.exepid process 1136 ziIw9543.exe 4480 jr416650.exe 5016 ku630268.exe 3664 lr772207.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr416650.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr416650.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
7e44d182f5eaf84abfd25a600d3566c836db308172c1bbcaf96ecfa11230d1cf.exeziIw9543.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 7e44d182f5eaf84abfd25a600d3566c836db308172c1bbcaf96ecfa11230d1cf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziIw9543.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziIw9543.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 7e44d182f5eaf84abfd25a600d3566c836db308172c1bbcaf96ecfa11230d1cf.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 576 5016 WerFault.exe ku630268.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr416650.exeku630268.exelr772207.exepid process 4480 jr416650.exe 4480 jr416650.exe 5016 ku630268.exe 5016 ku630268.exe 3664 lr772207.exe 3664 lr772207.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr416650.exeku630268.exelr772207.exedescription pid process Token: SeDebugPrivilege 4480 jr416650.exe Token: SeDebugPrivilege 5016 ku630268.exe Token: SeDebugPrivilege 3664 lr772207.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
7e44d182f5eaf84abfd25a600d3566c836db308172c1bbcaf96ecfa11230d1cf.exeziIw9543.exedescription pid process target process PID 1404 wrote to memory of 1136 1404 7e44d182f5eaf84abfd25a600d3566c836db308172c1bbcaf96ecfa11230d1cf.exe ziIw9543.exe PID 1404 wrote to memory of 1136 1404 7e44d182f5eaf84abfd25a600d3566c836db308172c1bbcaf96ecfa11230d1cf.exe ziIw9543.exe PID 1404 wrote to memory of 1136 1404 7e44d182f5eaf84abfd25a600d3566c836db308172c1bbcaf96ecfa11230d1cf.exe ziIw9543.exe PID 1136 wrote to memory of 4480 1136 ziIw9543.exe jr416650.exe PID 1136 wrote to memory of 4480 1136 ziIw9543.exe jr416650.exe PID 1136 wrote to memory of 5016 1136 ziIw9543.exe ku630268.exe PID 1136 wrote to memory of 5016 1136 ziIw9543.exe ku630268.exe PID 1136 wrote to memory of 5016 1136 ziIw9543.exe ku630268.exe PID 1404 wrote to memory of 3664 1404 7e44d182f5eaf84abfd25a600d3566c836db308172c1bbcaf96ecfa11230d1cf.exe lr772207.exe PID 1404 wrote to memory of 3664 1404 7e44d182f5eaf84abfd25a600d3566c836db308172c1bbcaf96ecfa11230d1cf.exe lr772207.exe PID 1404 wrote to memory of 3664 1404 7e44d182f5eaf84abfd25a600d3566c836db308172c1bbcaf96ecfa11230d1cf.exe lr772207.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e44d182f5eaf84abfd25a600d3566c836db308172c1bbcaf96ecfa11230d1cf.exe"C:\Users\Admin\AppData\Local\Temp\7e44d182f5eaf84abfd25a600d3566c836db308172c1bbcaf96ecfa11230d1cf.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziIw9543.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziIw9543.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr416650.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr416650.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku630268.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku630268.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5016 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 13564⤵
- Program crash
PID:576 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr772207.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr772207.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3664
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 5016 -ip 50161⤵PID:1348
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr772207.exeFilesize
175KB
MD58ca055fb43e5f33226084ebf069050b4
SHA1f7e670095d289388122a4a35fa1a4af66d3d0596
SHA25671836eb153fbfc74365ac45131cbb85e44db840dc0fe96537020075f5b2acbcb
SHA5123538b18fb1997c3943ee37b5947666413fff303657a7a398d302c9b4ba0fbc531b5507cfc87dd1446b204595605862e72efef8328504c99449a95864d67919b6
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr772207.exeFilesize
175KB
MD58ca055fb43e5f33226084ebf069050b4
SHA1f7e670095d289388122a4a35fa1a4af66d3d0596
SHA25671836eb153fbfc74365ac45131cbb85e44db840dc0fe96537020075f5b2acbcb
SHA5123538b18fb1997c3943ee37b5947666413fff303657a7a398d302c9b4ba0fbc531b5507cfc87dd1446b204595605862e72efef8328504c99449a95864d67919b6
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziIw9543.exeFilesize
380KB
MD5d6b9c554ff1e264875303751137b1308
SHA1c320e7cfbd8086fc08f74838b3dec04ba67e3749
SHA256a5b42d3b2dbcd81623a8bbe3450474dbbe3c34f25e3dedb793861e1392cf49c0
SHA512ab272543188700915caacd3c6ec2976b6e4b1b28deb018da2aae6cb7fc8a4acce055b0ab4da2430f239e3257760bc75dd63c11b38e701b0aa0e3086336b67f32
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziIw9543.exeFilesize
380KB
MD5d6b9c554ff1e264875303751137b1308
SHA1c320e7cfbd8086fc08f74838b3dec04ba67e3749
SHA256a5b42d3b2dbcd81623a8bbe3450474dbbe3c34f25e3dedb793861e1392cf49c0
SHA512ab272543188700915caacd3c6ec2976b6e4b1b28deb018da2aae6cb7fc8a4acce055b0ab4da2430f239e3257760bc75dd63c11b38e701b0aa0e3086336b67f32
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr416650.exeFilesize
11KB
MD56636ec7aa9b2d3187ccfd61add9d8215
SHA11bdb29ac65279fb8f91ad3533452ddc4abf0b3c8
SHA25609453b3ce01f930d0f2e73564c1c269b2995a5a8322f1a846013a97d4f90be8b
SHA512826a0b8fa185aac5231d2156170f2a5e1e4f496f11e2d3d88c717d34d5fbad2fa423bbf51bc32340de8e914b9a9662ecdd6512d592821f64f8c8ee584bb49cb5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr416650.exeFilesize
11KB
MD56636ec7aa9b2d3187ccfd61add9d8215
SHA11bdb29ac65279fb8f91ad3533452ddc4abf0b3c8
SHA25609453b3ce01f930d0f2e73564c1c269b2995a5a8322f1a846013a97d4f90be8b
SHA512826a0b8fa185aac5231d2156170f2a5e1e4f496f11e2d3d88c717d34d5fbad2fa423bbf51bc32340de8e914b9a9662ecdd6512d592821f64f8c8ee584bb49cb5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku630268.exeFilesize
294KB
MD5ad297e24efc661795e90ae4eb48535ad
SHA14921b63dff673a91c45ef7af5f02e0c0d2aed334
SHA256e085e7471cd8058e3133949382b65bd776246d4a6e69f33e4ad8a7a096cecaaf
SHA5121e47bac59cd777e06f068014e64bc0a0c6f069f83dea75d734896f441aad9c588455edc14fa4a00ca7d4842cd92fbc90f90fb2c596444e314cdba516ddef111b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku630268.exeFilesize
294KB
MD5ad297e24efc661795e90ae4eb48535ad
SHA14921b63dff673a91c45ef7af5f02e0c0d2aed334
SHA256e085e7471cd8058e3133949382b65bd776246d4a6e69f33e4ad8a7a096cecaaf
SHA5121e47bac59cd777e06f068014e64bc0a0c6f069f83dea75d734896f441aad9c588455edc14fa4a00ca7d4842cd92fbc90f90fb2c596444e314cdba516ddef111b
-
memory/3664-1085-0x0000000000960000-0x0000000000992000-memory.dmpFilesize
200KB
-
memory/3664-1086-0x00000000051F0000-0x0000000005200000-memory.dmpFilesize
64KB
-
memory/3664-1087-0x00000000051F0000-0x0000000005200000-memory.dmpFilesize
64KB
-
memory/4480-147-0x0000000000C30000-0x0000000000C3A000-memory.dmpFilesize
40KB
-
memory/5016-189-0x0000000002480000-0x00000000024BF000-memory.dmpFilesize
252KB
-
memory/5016-203-0x0000000002480000-0x00000000024BF000-memory.dmpFilesize
252KB
-
memory/5016-156-0x0000000004C60000-0x0000000005204000-memory.dmpFilesize
5.6MB
-
memory/5016-157-0x0000000002480000-0x00000000024BF000-memory.dmpFilesize
252KB
-
memory/5016-158-0x0000000002480000-0x00000000024BF000-memory.dmpFilesize
252KB
-
memory/5016-160-0x0000000002480000-0x00000000024BF000-memory.dmpFilesize
252KB
-
memory/5016-162-0x0000000002480000-0x00000000024BF000-memory.dmpFilesize
252KB
-
memory/5016-164-0x0000000002480000-0x00000000024BF000-memory.dmpFilesize
252KB
-
memory/5016-166-0x0000000002480000-0x00000000024BF000-memory.dmpFilesize
252KB
-
memory/5016-168-0x0000000002480000-0x00000000024BF000-memory.dmpFilesize
252KB
-
memory/5016-170-0x0000000002480000-0x00000000024BF000-memory.dmpFilesize
252KB
-
memory/5016-172-0x0000000002480000-0x00000000024BF000-memory.dmpFilesize
252KB
-
memory/5016-174-0x0000000002480000-0x00000000024BF000-memory.dmpFilesize
252KB
-
memory/5016-176-0x0000000002480000-0x00000000024BF000-memory.dmpFilesize
252KB
-
memory/5016-178-0x0000000002480000-0x00000000024BF000-memory.dmpFilesize
252KB
-
memory/5016-180-0x0000000002480000-0x00000000024BF000-memory.dmpFilesize
252KB
-
memory/5016-182-0x0000000002480000-0x00000000024BF000-memory.dmpFilesize
252KB
-
memory/5016-184-0x0000000004C50000-0x0000000004C60000-memory.dmpFilesize
64KB
-
memory/5016-185-0x0000000002480000-0x00000000024BF000-memory.dmpFilesize
252KB
-
memory/5016-187-0x0000000002480000-0x00000000024BF000-memory.dmpFilesize
252KB
-
memory/5016-154-0x0000000004C50000-0x0000000004C60000-memory.dmpFilesize
64KB
-
memory/5016-191-0x0000000002480000-0x00000000024BF000-memory.dmpFilesize
252KB
-
memory/5016-193-0x0000000002480000-0x00000000024BF000-memory.dmpFilesize
252KB
-
memory/5016-195-0x0000000002480000-0x00000000024BF000-memory.dmpFilesize
252KB
-
memory/5016-197-0x0000000002480000-0x00000000024BF000-memory.dmpFilesize
252KB
-
memory/5016-199-0x0000000002480000-0x00000000024BF000-memory.dmpFilesize
252KB
-
memory/5016-201-0x0000000002480000-0x00000000024BF000-memory.dmpFilesize
252KB
-
memory/5016-155-0x0000000004C50000-0x0000000004C60000-memory.dmpFilesize
64KB
-
memory/5016-205-0x0000000002480000-0x00000000024BF000-memory.dmpFilesize
252KB
-
memory/5016-207-0x0000000002480000-0x00000000024BF000-memory.dmpFilesize
252KB
-
memory/5016-209-0x0000000002480000-0x00000000024BF000-memory.dmpFilesize
252KB
-
memory/5016-211-0x0000000002480000-0x00000000024BF000-memory.dmpFilesize
252KB
-
memory/5016-213-0x0000000002480000-0x00000000024BF000-memory.dmpFilesize
252KB
-
memory/5016-215-0x0000000002480000-0x00000000024BF000-memory.dmpFilesize
252KB
-
memory/5016-217-0x0000000002480000-0x00000000024BF000-memory.dmpFilesize
252KB
-
memory/5016-219-0x0000000002480000-0x00000000024BF000-memory.dmpFilesize
252KB
-
memory/5016-221-0x0000000002480000-0x00000000024BF000-memory.dmpFilesize
252KB
-
memory/5016-1064-0x0000000005210000-0x0000000005828000-memory.dmpFilesize
6.1MB
-
memory/5016-1065-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/5016-1066-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/5016-1067-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/5016-1068-0x0000000004C50000-0x0000000004C60000-memory.dmpFilesize
64KB
-
memory/5016-1070-0x0000000004C50000-0x0000000004C60000-memory.dmpFilesize
64KB
-
memory/5016-1071-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/5016-1072-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/5016-1073-0x0000000004C50000-0x0000000004C60000-memory.dmpFilesize
64KB
-
memory/5016-1074-0x0000000004C50000-0x0000000004C60000-memory.dmpFilesize
64KB
-
memory/5016-1075-0x00000000066F0000-0x00000000068B2000-memory.dmpFilesize
1.8MB
-
memory/5016-153-0x0000000000790000-0x00000000007DB000-memory.dmpFilesize
300KB
-
memory/5016-1076-0x00000000068D0000-0x0000000006DFC000-memory.dmpFilesize
5.2MB
-
memory/5016-1077-0x0000000006F40000-0x0000000006FB6000-memory.dmpFilesize
472KB
-
memory/5016-1078-0x0000000006FD0000-0x0000000007020000-memory.dmpFilesize
320KB
-
memory/5016-1079-0x0000000004C50000-0x0000000004C60000-memory.dmpFilesize
64KB