Analysis
-
max time kernel
96s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 18:37
Static task
static1
Behavioral task
behavioral1
Sample
9ba434ae7f6c33b19492e4eb3fe0cdcf8916e1c3f19780980966bba4787041ef.exe
Resource
win10v2004-20230220-en
General
-
Target
9ba434ae7f6c33b19492e4eb3fe0cdcf8916e1c3f19780980966bba4787041ef.exe
-
Size
521KB
-
MD5
cb6455c3da41072b9e0abddac0983fb9
-
SHA1
9e359f11ae89d1988d222fd7c6274c7bccab82ad
-
SHA256
9ba434ae7f6c33b19492e4eb3fe0cdcf8916e1c3f19780980966bba4787041ef
-
SHA512
92223a045b65cb2fb3e6d6db3b0da287497d667d5cf0b61eadfb5f5bb201bece59a13b2d840580562ea92bddca974edc0e4491bb864019fe9f61fa36d91dd1d5
-
SSDEEP
12288:hMrLy90DZ6ZjE4p6qEgCrNdBk7zUjYk0hAn:uytjEC6fhdBOUcnhC
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr156414.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr156414.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr156414.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr156414.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr156414.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr156414.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr156414.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/3556-158-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/3556-159-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/3556-161-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/3556-163-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/3556-165-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/3556-167-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/3556-169-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/3556-171-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/3556-173-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/3556-175-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/3556-177-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/3556-179-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/3556-181-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/3556-183-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/3556-185-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/3556-187-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/3556-189-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/3556-191-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/3556-193-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/3556-195-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/3556-197-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/3556-199-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/3556-201-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/3556-205-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/3556-207-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/3556-203-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/3556-209-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/3556-211-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/3556-213-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/3556-215-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/3556-217-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/3556-219-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/3556-221-0x0000000002510000-0x000000000254F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
ziVP4095.exejr156414.exeku594270.exelr980989.exepid process 4564 ziVP4095.exe 1300 jr156414.exe 3556 ku594270.exe 2656 lr980989.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr156414.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr156414.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
9ba434ae7f6c33b19492e4eb3fe0cdcf8916e1c3f19780980966bba4787041ef.exeziVP4095.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 9ba434ae7f6c33b19492e4eb3fe0cdcf8916e1c3f19780980966bba4787041ef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 9ba434ae7f6c33b19492e4eb3fe0cdcf8916e1c3f19780980966bba4787041ef.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziVP4095.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziVP4095.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4308 3556 WerFault.exe ku594270.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr156414.exeku594270.exelr980989.exepid process 1300 jr156414.exe 1300 jr156414.exe 3556 ku594270.exe 3556 ku594270.exe 2656 lr980989.exe 2656 lr980989.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr156414.exeku594270.exelr980989.exedescription pid process Token: SeDebugPrivilege 1300 jr156414.exe Token: SeDebugPrivilege 3556 ku594270.exe Token: SeDebugPrivilege 2656 lr980989.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
9ba434ae7f6c33b19492e4eb3fe0cdcf8916e1c3f19780980966bba4787041ef.exeziVP4095.exedescription pid process target process PID 4680 wrote to memory of 4564 4680 9ba434ae7f6c33b19492e4eb3fe0cdcf8916e1c3f19780980966bba4787041ef.exe ziVP4095.exe PID 4680 wrote to memory of 4564 4680 9ba434ae7f6c33b19492e4eb3fe0cdcf8916e1c3f19780980966bba4787041ef.exe ziVP4095.exe PID 4680 wrote to memory of 4564 4680 9ba434ae7f6c33b19492e4eb3fe0cdcf8916e1c3f19780980966bba4787041ef.exe ziVP4095.exe PID 4564 wrote to memory of 1300 4564 ziVP4095.exe jr156414.exe PID 4564 wrote to memory of 1300 4564 ziVP4095.exe jr156414.exe PID 4564 wrote to memory of 3556 4564 ziVP4095.exe ku594270.exe PID 4564 wrote to memory of 3556 4564 ziVP4095.exe ku594270.exe PID 4564 wrote to memory of 3556 4564 ziVP4095.exe ku594270.exe PID 4680 wrote to memory of 2656 4680 9ba434ae7f6c33b19492e4eb3fe0cdcf8916e1c3f19780980966bba4787041ef.exe lr980989.exe PID 4680 wrote to memory of 2656 4680 9ba434ae7f6c33b19492e4eb3fe0cdcf8916e1c3f19780980966bba4787041ef.exe lr980989.exe PID 4680 wrote to memory of 2656 4680 9ba434ae7f6c33b19492e4eb3fe0cdcf8916e1c3f19780980966bba4787041ef.exe lr980989.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ba434ae7f6c33b19492e4eb3fe0cdcf8916e1c3f19780980966bba4787041ef.exe"C:\Users\Admin\AppData\Local\Temp\9ba434ae7f6c33b19492e4eb3fe0cdcf8916e1c3f19780980966bba4787041ef.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziVP4095.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziVP4095.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr156414.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr156414.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku594270.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku594270.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3556 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3556 -s 17804⤵
- Program crash
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr980989.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr980989.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2656
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3556 -ip 35561⤵PID:4556
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr980989.exeFilesize
175KB
MD54cb8b702969b52067091f17b4babb948
SHA185618b465886c3406c6b7facde0c06641a2f49eb
SHA256ef14523f0f482b08cb441c75dce637a1e355703078f960d2c1d1e431baa5e8a4
SHA512ff62ce5805a5e29c7e550e9360251b45264557b7ee4c3df65ee5712b04b6dbc9ebc9d8aa90fa5f5c28b79bc319ed5de2d0ee8d9545e1532239fe6d5f7dd3b6c5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr980989.exeFilesize
175KB
MD54cb8b702969b52067091f17b4babb948
SHA185618b465886c3406c6b7facde0c06641a2f49eb
SHA256ef14523f0f482b08cb441c75dce637a1e355703078f960d2c1d1e431baa5e8a4
SHA512ff62ce5805a5e29c7e550e9360251b45264557b7ee4c3df65ee5712b04b6dbc9ebc9d8aa90fa5f5c28b79bc319ed5de2d0ee8d9545e1532239fe6d5f7dd3b6c5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziVP4095.exeFilesize
379KB
MD5140730f646828d505ff0bae149743a80
SHA1192e56d469e54c692b69d48b3035c79e038f7fbb
SHA256a62a243622bb7e120eccaf3e2b10302a821de20210ba2db62da5ae344b9693fb
SHA512b820b77626fb185a456ae9f3c3e9eb4fc4da92be624e8e1a49402559206f6dc339e8f1c32cb6c948153c9ab657b815bbaf7f089ae5306e3bb9595910fc90dcd1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziVP4095.exeFilesize
379KB
MD5140730f646828d505ff0bae149743a80
SHA1192e56d469e54c692b69d48b3035c79e038f7fbb
SHA256a62a243622bb7e120eccaf3e2b10302a821de20210ba2db62da5ae344b9693fb
SHA512b820b77626fb185a456ae9f3c3e9eb4fc4da92be624e8e1a49402559206f6dc339e8f1c32cb6c948153c9ab657b815bbaf7f089ae5306e3bb9595910fc90dcd1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr156414.exeFilesize
11KB
MD5052a487cda6c42d427a0d5f8331a1756
SHA1a3e88c03d19d0f716642cc6dcf034c3258e8de08
SHA256dc61186366fa6f8a0c7966f61698ae31fea3d8512ada1542c8a41afffffa73d6
SHA5124cd6c77949ce8ce8183c453e01b1d28a7d0cdeb2344d402adfbe6fc1fc1a324090ec562affbad5a35abc110b2b69c6ca0395dc599415d6d7a5554bea891dc7b3
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr156414.exeFilesize
11KB
MD5052a487cda6c42d427a0d5f8331a1756
SHA1a3e88c03d19d0f716642cc6dcf034c3258e8de08
SHA256dc61186366fa6f8a0c7966f61698ae31fea3d8512ada1542c8a41afffffa73d6
SHA5124cd6c77949ce8ce8183c453e01b1d28a7d0cdeb2344d402adfbe6fc1fc1a324090ec562affbad5a35abc110b2b69c6ca0395dc599415d6d7a5554bea891dc7b3
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku594270.exeFilesize
294KB
MD54e9420f703e98d01e9b512c9f5bcdaa3
SHA16b4d6b7cd255f81e6917e111bad1cd3e4a6f6a37
SHA2560d9aaa418f9b5355f4b564e39f7cc6ed12748105ed401f53c2841a3dd959f74c
SHA51240669372cca3855f8a4c3fd9788039ab848565da5b8f98877d26ed8a18c888c1ab61a965893b8d9a4efface175971216bb9731b91e684974832cabd3cd6a064d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku594270.exeFilesize
294KB
MD54e9420f703e98d01e9b512c9f5bcdaa3
SHA16b4d6b7cd255f81e6917e111bad1cd3e4a6f6a37
SHA2560d9aaa418f9b5355f4b564e39f7cc6ed12748105ed401f53c2841a3dd959f74c
SHA51240669372cca3855f8a4c3fd9788039ab848565da5b8f98877d26ed8a18c888c1ab61a965893b8d9a4efface175971216bb9731b91e684974832cabd3cd6a064d
-
memory/1300-147-0x0000000000D70000-0x0000000000D7A000-memory.dmpFilesize
40KB
-
memory/2656-1084-0x00000000000D0000-0x0000000000102000-memory.dmpFilesize
200KB
-
memory/2656-1085-0x00000000049E0000-0x00000000049F0000-memory.dmpFilesize
64KB
-
memory/3556-187-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/3556-199-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/3556-156-0x0000000004B60000-0x0000000004B70000-memory.dmpFilesize
64KB
-
memory/3556-157-0x0000000004B70000-0x0000000005114000-memory.dmpFilesize
5.6MB
-
memory/3556-158-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/3556-159-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/3556-161-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/3556-163-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/3556-165-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/3556-167-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/3556-169-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/3556-171-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/3556-173-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/3556-175-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/3556-177-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/3556-179-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/3556-181-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/3556-183-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/3556-185-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/3556-154-0x0000000002130000-0x000000000217B000-memory.dmpFilesize
300KB
-
memory/3556-189-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/3556-191-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/3556-193-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/3556-195-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/3556-197-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/3556-155-0x0000000004B60000-0x0000000004B70000-memory.dmpFilesize
64KB
-
memory/3556-201-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/3556-205-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/3556-207-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/3556-203-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/3556-209-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/3556-211-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/3556-213-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/3556-215-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/3556-217-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/3556-219-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/3556-221-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/3556-1064-0x0000000005120000-0x0000000005738000-memory.dmpFilesize
6.1MB
-
memory/3556-1065-0x0000000005760000-0x000000000586A000-memory.dmpFilesize
1.0MB
-
memory/3556-1066-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/3556-1067-0x00000000058C0000-0x00000000058FC000-memory.dmpFilesize
240KB
-
memory/3556-1068-0x0000000004B60000-0x0000000004B70000-memory.dmpFilesize
64KB
-
memory/3556-1070-0x0000000005BB0000-0x0000000005C42000-memory.dmpFilesize
584KB
-
memory/3556-1071-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/3556-1072-0x0000000004B60000-0x0000000004B70000-memory.dmpFilesize
64KB
-
memory/3556-1073-0x0000000004B60000-0x0000000004B70000-memory.dmpFilesize
64KB
-
memory/3556-1074-0x0000000006470000-0x0000000006632000-memory.dmpFilesize
1.8MB
-
memory/3556-1075-0x0000000006650000-0x0000000006B7C000-memory.dmpFilesize
5.2MB
-
memory/3556-1076-0x0000000004B60000-0x0000000004B70000-memory.dmpFilesize
64KB
-
memory/3556-1077-0x0000000006CC0000-0x0000000006D36000-memory.dmpFilesize
472KB
-
memory/3556-1078-0x0000000006D50000-0x0000000006DA0000-memory.dmpFilesize
320KB