Analysis
-
max time kernel
103s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 17:44
Static task
static1
Behavioral task
behavioral1
Sample
bd72e2e73eea3e27e6210588a1df68135ab286fff7d8df20089238d86191ae3f.exe
Resource
win10v2004-20230221-en
General
-
Target
bd72e2e73eea3e27e6210588a1df68135ab286fff7d8df20089238d86191ae3f.exe
-
Size
521KB
-
MD5
ec78ffa7d930f0294d35f4d2d05dc339
-
SHA1
365292bd0ef1af3f320170beffe4e2ea71d28b8e
-
SHA256
bd72e2e73eea3e27e6210588a1df68135ab286fff7d8df20089238d86191ae3f
-
SHA512
f552821ec8b5a449f3125d84a4fd518f1f3c3a7f65bed0b80db7eae25f5f0d93481322287af28ffeb733f3fc6137c773fc67104d4ced5c9fc0ac7bd6c35e84f8
-
SSDEEP
12288:qMrBy902V5p5B7PINc1EP/zscrLifNuMobah:jyrPTBDIZPLsc612W
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr035788.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr035788.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr035788.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr035788.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr035788.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr035788.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr035788.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/5036-158-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/5036-163-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/5036-161-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/5036-159-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/5036-165-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/5036-167-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/5036-169-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/5036-171-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/5036-173-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/5036-175-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/5036-177-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/5036-179-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/5036-181-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/5036-183-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/5036-185-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/5036-187-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/5036-189-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/5036-191-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/5036-193-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/5036-195-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/5036-197-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/5036-199-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/5036-201-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/5036-203-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/5036-205-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/5036-207-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/5036-209-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/5036-211-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/5036-213-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/5036-215-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/5036-217-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/5036-219-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/5036-221-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
ziGc8445.exejr035788.exeku354585.exelr988408.exepid process 644 ziGc8445.exe 2120 jr035788.exe 5036 ku354585.exe 5028 lr988408.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr035788.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr035788.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
bd72e2e73eea3e27e6210588a1df68135ab286fff7d8df20089238d86191ae3f.exeziGc8445.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce bd72e2e73eea3e27e6210588a1df68135ab286fff7d8df20089238d86191ae3f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" bd72e2e73eea3e27e6210588a1df68135ab286fff7d8df20089238d86191ae3f.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziGc8445.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziGc8445.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4116 5036 WerFault.exe ku354585.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr035788.exeku354585.exelr988408.exepid process 2120 jr035788.exe 2120 jr035788.exe 5036 ku354585.exe 5036 ku354585.exe 5028 lr988408.exe 5028 lr988408.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr035788.exeku354585.exelr988408.exedescription pid process Token: SeDebugPrivilege 2120 jr035788.exe Token: SeDebugPrivilege 5036 ku354585.exe Token: SeDebugPrivilege 5028 lr988408.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
bd72e2e73eea3e27e6210588a1df68135ab286fff7d8df20089238d86191ae3f.exeziGc8445.exedescription pid process target process PID 4624 wrote to memory of 644 4624 bd72e2e73eea3e27e6210588a1df68135ab286fff7d8df20089238d86191ae3f.exe ziGc8445.exe PID 4624 wrote to memory of 644 4624 bd72e2e73eea3e27e6210588a1df68135ab286fff7d8df20089238d86191ae3f.exe ziGc8445.exe PID 4624 wrote to memory of 644 4624 bd72e2e73eea3e27e6210588a1df68135ab286fff7d8df20089238d86191ae3f.exe ziGc8445.exe PID 644 wrote to memory of 2120 644 ziGc8445.exe jr035788.exe PID 644 wrote to memory of 2120 644 ziGc8445.exe jr035788.exe PID 644 wrote to memory of 5036 644 ziGc8445.exe ku354585.exe PID 644 wrote to memory of 5036 644 ziGc8445.exe ku354585.exe PID 644 wrote to memory of 5036 644 ziGc8445.exe ku354585.exe PID 4624 wrote to memory of 5028 4624 bd72e2e73eea3e27e6210588a1df68135ab286fff7d8df20089238d86191ae3f.exe lr988408.exe PID 4624 wrote to memory of 5028 4624 bd72e2e73eea3e27e6210588a1df68135ab286fff7d8df20089238d86191ae3f.exe lr988408.exe PID 4624 wrote to memory of 5028 4624 bd72e2e73eea3e27e6210588a1df68135ab286fff7d8df20089238d86191ae3f.exe lr988408.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd72e2e73eea3e27e6210588a1df68135ab286fff7d8df20089238d86191ae3f.exe"C:\Users\Admin\AppData\Local\Temp\bd72e2e73eea3e27e6210588a1df68135ab286fff7d8df20089238d86191ae3f.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziGc8445.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziGc8445.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr035788.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr035788.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku354585.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku354585.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5036 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 13284⤵
- Program crash
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr988408.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr988408.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5028
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5036 -ip 50361⤵PID:4444
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr988408.exeFilesize
175KB
MD5bb6d43fa4ebafe62b98ec4dea4ff49d9
SHA1d8188e664ac977f59d3ec26589e3cf67b1fab23b
SHA2561d1cdf01afc38fc6784a41fe8aa2f308ec44606d2d16c4edd9445813af33fe89
SHA512679a0e394c5751020c38ceaba6a1bd1a33c558b8c9142fc796fa3570baa0ac082d099891451fde50249e165625b9738ead7321dccf2b2da567f3f7e3d4ee4644
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr988408.exeFilesize
175KB
MD5bb6d43fa4ebafe62b98ec4dea4ff49d9
SHA1d8188e664ac977f59d3ec26589e3cf67b1fab23b
SHA2561d1cdf01afc38fc6784a41fe8aa2f308ec44606d2d16c4edd9445813af33fe89
SHA512679a0e394c5751020c38ceaba6a1bd1a33c558b8c9142fc796fa3570baa0ac082d099891451fde50249e165625b9738ead7321dccf2b2da567f3f7e3d4ee4644
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziGc8445.exeFilesize
379KB
MD5ac065dfd71086f89b661a1bdb8082bc3
SHA129f8358f7edd704d0fe7c2652c3a215481f01aca
SHA256960041ea0ff767baf01a8cfab0c2ceaa71b42a5bc23c8a6d7de52ba7a4b7f5de
SHA512b5b782a72bf096820fc78340701f134d2de0bbb25b4ec60afecd39c96289ef53e67d8407f5f3dc13d322dc8c876a0426e2b247c9ba449fac5b2a1d96a49524ee
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziGc8445.exeFilesize
379KB
MD5ac065dfd71086f89b661a1bdb8082bc3
SHA129f8358f7edd704d0fe7c2652c3a215481f01aca
SHA256960041ea0ff767baf01a8cfab0c2ceaa71b42a5bc23c8a6d7de52ba7a4b7f5de
SHA512b5b782a72bf096820fc78340701f134d2de0bbb25b4ec60afecd39c96289ef53e67d8407f5f3dc13d322dc8c876a0426e2b247c9ba449fac5b2a1d96a49524ee
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr035788.exeFilesize
15KB
MD52bbd0c9f235ebff0c1cff6f399ecd498
SHA1a12f7ae6b84db5ab18b600e441542a1070516ceb
SHA2569a7619f1864c9a0a112dcbcd346207575ce98fa176046ffb7f7f5681415b3386
SHA512ca839d1d7237d81f8279d3ab0d80aa901b4015a1a2650f5aeabf668b24a9e2d8ac858df53e0a1eb1038d80e7e54bf4a4cb09fe6e2499737b8cc336d53901e97e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr035788.exeFilesize
15KB
MD52bbd0c9f235ebff0c1cff6f399ecd498
SHA1a12f7ae6b84db5ab18b600e441542a1070516ceb
SHA2569a7619f1864c9a0a112dcbcd346207575ce98fa176046ffb7f7f5681415b3386
SHA512ca839d1d7237d81f8279d3ab0d80aa901b4015a1a2650f5aeabf668b24a9e2d8ac858df53e0a1eb1038d80e7e54bf4a4cb09fe6e2499737b8cc336d53901e97e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku354585.exeFilesize
295KB
MD536c6216ad011fc666c6ff509b310c207
SHA17b4d45f92af2592bc371a610ed7825664f48bbdd
SHA25690d839c1db57d7b04cbb1dfb10b45eb11039eefd876f22eac1823375f005776d
SHA512c53045d8198b1f5d8cc77caac2952d0870aa1d547aa5cf3c80cadd242d9d38a5dc30328481855b43451fd6dade81ff626a6fe183ce24023844b36e038015552e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku354585.exeFilesize
295KB
MD536c6216ad011fc666c6ff509b310c207
SHA17b4d45f92af2592bc371a610ed7825664f48bbdd
SHA25690d839c1db57d7b04cbb1dfb10b45eb11039eefd876f22eac1823375f005776d
SHA512c53045d8198b1f5d8cc77caac2952d0870aa1d547aa5cf3c80cadd242d9d38a5dc30328481855b43451fd6dade81ff626a6fe183ce24023844b36e038015552e
-
memory/2120-147-0x00000000005F0000-0x00000000005FA000-memory.dmpFilesize
40KB
-
memory/5028-1085-0x0000000000540000-0x0000000000572000-memory.dmpFilesize
200KB
-
memory/5028-1086-0x0000000004E80000-0x0000000004E90000-memory.dmpFilesize
64KB
-
memory/5028-1087-0x0000000004E80000-0x0000000004E90000-memory.dmpFilesize
64KB
-
memory/5036-189-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/5036-203-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/5036-155-0x0000000004AE0000-0x0000000004AF0000-memory.dmpFilesize
64KB
-
memory/5036-157-0x0000000004AE0000-0x0000000004AF0000-memory.dmpFilesize
64KB
-
memory/5036-158-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/5036-163-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/5036-161-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/5036-159-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/5036-165-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/5036-167-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/5036-169-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/5036-171-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/5036-173-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/5036-175-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/5036-177-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/5036-179-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/5036-181-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/5036-183-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/5036-185-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/5036-187-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/5036-153-0x0000000004AF0000-0x0000000005094000-memory.dmpFilesize
5.6MB
-
memory/5036-191-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/5036-193-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/5036-195-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/5036-197-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/5036-199-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/5036-201-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/5036-156-0x0000000004AE0000-0x0000000004AF0000-memory.dmpFilesize
64KB
-
memory/5036-205-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/5036-207-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/5036-209-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/5036-211-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/5036-213-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/5036-215-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/5036-217-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/5036-219-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/5036-221-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/5036-1064-0x00000000050C0000-0x00000000056D8000-memory.dmpFilesize
6.1MB
-
memory/5036-1065-0x0000000005760000-0x000000000586A000-memory.dmpFilesize
1.0MB
-
memory/5036-1066-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/5036-1067-0x00000000058C0000-0x00000000058FC000-memory.dmpFilesize
240KB
-
memory/5036-1068-0x0000000004AE0000-0x0000000004AF0000-memory.dmpFilesize
64KB
-
memory/5036-1071-0x0000000004AE0000-0x0000000004AF0000-memory.dmpFilesize
64KB
-
memory/5036-1072-0x0000000004AE0000-0x0000000004AF0000-memory.dmpFilesize
64KB
-
memory/5036-1070-0x0000000005BB0000-0x0000000005C16000-memory.dmpFilesize
408KB
-
memory/5036-1073-0x0000000004AE0000-0x0000000004AF0000-memory.dmpFilesize
64KB
-
memory/5036-1074-0x0000000006270000-0x0000000006302000-memory.dmpFilesize
584KB
-
memory/5036-1075-0x0000000006370000-0x0000000006532000-memory.dmpFilesize
1.8MB
-
memory/5036-154-0x0000000000610000-0x000000000065B000-memory.dmpFilesize
300KB
-
memory/5036-1076-0x0000000006540000-0x0000000006A6C000-memory.dmpFilesize
5.2MB
-
memory/5036-1077-0x0000000006B90000-0x0000000006C06000-memory.dmpFilesize
472KB
-
memory/5036-1078-0x0000000006C30000-0x0000000006C80000-memory.dmpFilesize
320KB
-
memory/5036-1079-0x0000000004AE0000-0x0000000004AF0000-memory.dmpFilesize
64KB