Analysis
-
max time kernel
61s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 17:46
Static task
static1
Behavioral task
behavioral1
Sample
416b1e9f5867a40555a9d57e7ab351a28322951464adec4c92d6b918d9d8a0fd.exe
Resource
win10v2004-20230220-en
General
-
Target
416b1e9f5867a40555a9d57e7ab351a28322951464adec4c92d6b918d9d8a0fd.exe
-
Size
660KB
-
MD5
e602a3aabfc22fde729163857ce87459
-
SHA1
53fdd2b05903ee960f14247a23a24d8cf06a7fca
-
SHA256
416b1e9f5867a40555a9d57e7ab351a28322951464adec4c92d6b918d9d8a0fd
-
SHA512
404fddebdecf8f041020fecb6f68cb05c2cd209053c02019acba2e4183c7e589c30eefb308dde7a5c423dc9b038c3b7aa574fb0a199bbefb5bf570a0e0d3a3b5
-
SSDEEP
12288:gMrYy90d/5tKX+Q5gBjshzvZtwTeHg0PswrLiSiFaWPSET2cD6:oy86XxgBjshLwkg2sw6SiF553O
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro4846.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro4846.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro4846.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro4846.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro4846.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro4846.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro4846.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/2628-189-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/2628-190-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/2628-192-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/2628-194-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/2628-196-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/2628-198-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/2628-200-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/2628-202-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/2628-204-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/2628-206-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/2628-208-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/2628-210-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/2628-212-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/2628-214-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/2628-216-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/2628-218-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/2628-224-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/2628-221-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/2628-1109-0x0000000004AF0000-0x0000000004B00000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un389651.exepro4846.exequ0841.exesi571736.exepid process 2152 un389651.exe 4432 pro4846.exe 2628 qu0841.exe 4188 si571736.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro4846.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro4846.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro4846.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un389651.exe416b1e9f5867a40555a9d57e7ab351a28322951464adec4c92d6b918d9d8a0fd.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un389651.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un389651.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 416b1e9f5867a40555a9d57e7ab351a28322951464adec4c92d6b918d9d8a0fd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 416b1e9f5867a40555a9d57e7ab351a28322951464adec4c92d6b918d9d8a0fd.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4780 4432 WerFault.exe pro4846.exe 2600 2628 WerFault.exe qu0841.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro4846.exequ0841.exesi571736.exepid process 4432 pro4846.exe 4432 pro4846.exe 2628 qu0841.exe 2628 qu0841.exe 4188 si571736.exe 4188 si571736.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro4846.exequ0841.exesi571736.exedescription pid process Token: SeDebugPrivilege 4432 pro4846.exe Token: SeDebugPrivilege 2628 qu0841.exe Token: SeDebugPrivilege 4188 si571736.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
416b1e9f5867a40555a9d57e7ab351a28322951464adec4c92d6b918d9d8a0fd.exeun389651.exedescription pid process target process PID 1452 wrote to memory of 2152 1452 416b1e9f5867a40555a9d57e7ab351a28322951464adec4c92d6b918d9d8a0fd.exe un389651.exe PID 1452 wrote to memory of 2152 1452 416b1e9f5867a40555a9d57e7ab351a28322951464adec4c92d6b918d9d8a0fd.exe un389651.exe PID 1452 wrote to memory of 2152 1452 416b1e9f5867a40555a9d57e7ab351a28322951464adec4c92d6b918d9d8a0fd.exe un389651.exe PID 2152 wrote to memory of 4432 2152 un389651.exe pro4846.exe PID 2152 wrote to memory of 4432 2152 un389651.exe pro4846.exe PID 2152 wrote to memory of 4432 2152 un389651.exe pro4846.exe PID 2152 wrote to memory of 2628 2152 un389651.exe qu0841.exe PID 2152 wrote to memory of 2628 2152 un389651.exe qu0841.exe PID 2152 wrote to memory of 2628 2152 un389651.exe qu0841.exe PID 1452 wrote to memory of 4188 1452 416b1e9f5867a40555a9d57e7ab351a28322951464adec4c92d6b918d9d8a0fd.exe si571736.exe PID 1452 wrote to memory of 4188 1452 416b1e9f5867a40555a9d57e7ab351a28322951464adec4c92d6b918d9d8a0fd.exe si571736.exe PID 1452 wrote to memory of 4188 1452 416b1e9f5867a40555a9d57e7ab351a28322951464adec4c92d6b918d9d8a0fd.exe si571736.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\416b1e9f5867a40555a9d57e7ab351a28322951464adec4c92d6b918d9d8a0fd.exe"C:\Users\Admin\AppData\Local\Temp\416b1e9f5867a40555a9d57e7ab351a28322951464adec4c92d6b918d9d8a0fd.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un389651.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un389651.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4846.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4846.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 10884⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0841.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0841.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 17164⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si571736.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si571736.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4432 -ip 44321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2628 -ip 26281⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si571736.exeFilesize
175KB
MD5bb6d43fa4ebafe62b98ec4dea4ff49d9
SHA1d8188e664ac977f59d3ec26589e3cf67b1fab23b
SHA2561d1cdf01afc38fc6784a41fe8aa2f308ec44606d2d16c4edd9445813af33fe89
SHA512679a0e394c5751020c38ceaba6a1bd1a33c558b8c9142fc796fa3570baa0ac082d099891451fde50249e165625b9738ead7321dccf2b2da567f3f7e3d4ee4644
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si571736.exeFilesize
175KB
MD5bb6d43fa4ebafe62b98ec4dea4ff49d9
SHA1d8188e664ac977f59d3ec26589e3cf67b1fab23b
SHA2561d1cdf01afc38fc6784a41fe8aa2f308ec44606d2d16c4edd9445813af33fe89
SHA512679a0e394c5751020c38ceaba6a1bd1a33c558b8c9142fc796fa3570baa0ac082d099891451fde50249e165625b9738ead7321dccf2b2da567f3f7e3d4ee4644
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un389651.exeFilesize
518KB
MD5d9db55595dd4d153bdfb000a6440c861
SHA1df2c02e85c7e60e08a7e1898dd60f60f12aaf709
SHA25627cc9a80a22b0f814bf860351faf617b71b9f70ec76001e8bb87b7fadadf1b52
SHA5121c50ff7921c26df6bf3cb83ee78051f0a988b0582550e62fbd49e3bf5c0d3cda4eaf56354f8f2854cbdf85ea32ef227f98667290f028c64c81be125561bb7d46
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un389651.exeFilesize
518KB
MD5d9db55595dd4d153bdfb000a6440c861
SHA1df2c02e85c7e60e08a7e1898dd60f60f12aaf709
SHA25627cc9a80a22b0f814bf860351faf617b71b9f70ec76001e8bb87b7fadadf1b52
SHA5121c50ff7921c26df6bf3cb83ee78051f0a988b0582550e62fbd49e3bf5c0d3cda4eaf56354f8f2854cbdf85ea32ef227f98667290f028c64c81be125561bb7d46
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4846.exeFilesize
236KB
MD592924d39be014b2a080c12b8d71a553e
SHA1a87855caeb879dae63e3f89e4fae4ca799cdce8e
SHA256c22ec2924bfcd78a622b1dd7f18d6bc4bf9e4e1be4632ad433456c3945aeb7f5
SHA5129e68dda3d4777f7c38937723d7cf7424c296518f6d9aecbaa14d85937281089895650cd80fa1bfbf8c6df08a792d175b3c56527d0345595de3f122c32a80a2db
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4846.exeFilesize
236KB
MD592924d39be014b2a080c12b8d71a553e
SHA1a87855caeb879dae63e3f89e4fae4ca799cdce8e
SHA256c22ec2924bfcd78a622b1dd7f18d6bc4bf9e4e1be4632ad433456c3945aeb7f5
SHA5129e68dda3d4777f7c38937723d7cf7424c296518f6d9aecbaa14d85937281089895650cd80fa1bfbf8c6df08a792d175b3c56527d0345595de3f122c32a80a2db
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0841.exeFilesize
295KB
MD572097e4bd200622789a0710062fdea7a
SHA13a47b0c4ae7620538ec87eae3241294312f79906
SHA2566328c960babcbf2368e74101d45e27dc6b241748062bdd7ca05685982896e024
SHA512e62d2b5fae433799efe8e27af1b67c19f42e95de8458b703c9540af9a21553ccfe1778a5f1c3b2d39c31cc750859377580b4849870c4e8fa90a7b9e11c0c8332
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0841.exeFilesize
295KB
MD572097e4bd200622789a0710062fdea7a
SHA13a47b0c4ae7620538ec87eae3241294312f79906
SHA2566328c960babcbf2368e74101d45e27dc6b241748062bdd7ca05685982896e024
SHA512e62d2b5fae433799efe8e27af1b67c19f42e95de8458b703c9540af9a21553ccfe1778a5f1c3b2d39c31cc750859377580b4849870c4e8fa90a7b9e11c0c8332
-
memory/2628-1099-0x00000000050C0000-0x00000000056D8000-memory.dmpFilesize
6.1MB
-
memory/2628-1102-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/2628-1114-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/2628-1113-0x0000000006E80000-0x0000000006ED0000-memory.dmpFilesize
320KB
-
memory/2628-1112-0x0000000006E00000-0x0000000006E76000-memory.dmpFilesize
472KB
-
memory/2628-1111-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/2628-1110-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/2628-1109-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/2628-1108-0x0000000006550000-0x0000000006A7C000-memory.dmpFilesize
5.2MB
-
memory/2628-1107-0x0000000006370000-0x0000000006532000-memory.dmpFilesize
1.8MB
-
memory/2628-1105-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/2628-1104-0x0000000005BB0000-0x0000000005C42000-memory.dmpFilesize
584KB
-
memory/2628-1103-0x00000000058C0000-0x00000000058FC000-memory.dmpFilesize
240KB
-
memory/2628-1101-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/2628-1100-0x0000000005760000-0x000000000586A000-memory.dmpFilesize
1.0MB
-
memory/2628-227-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/2628-220-0x0000000002110000-0x000000000215B000-memory.dmpFilesize
300KB
-
memory/2628-221-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/2628-225-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/2628-224-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/2628-223-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/2628-189-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/2628-190-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/2628-192-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/2628-194-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/2628-196-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/2628-198-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/2628-200-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/2628-202-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/2628-204-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/2628-206-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/2628-208-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/2628-210-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/2628-212-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/2628-214-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/2628-216-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/2628-218-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/4188-1120-0x0000000000BC0000-0x0000000000BF2000-memory.dmpFilesize
200KB
-
memory/4188-1121-0x00000000054A0000-0x00000000054B0000-memory.dmpFilesize
64KB
-
memory/4432-171-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/4432-152-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/4432-151-0x0000000004AF0000-0x0000000005094000-memory.dmpFilesize
5.6MB
-
memory/4432-180-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/4432-150-0x0000000004AE0000-0x0000000004AF0000-memory.dmpFilesize
64KB
-
memory/4432-179-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/4432-177-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/4432-153-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/4432-175-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/4432-167-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/4432-181-0x0000000004AE0000-0x0000000004AF0000-memory.dmpFilesize
64KB
-
memory/4432-182-0x0000000004AE0000-0x0000000004AF0000-memory.dmpFilesize
64KB
-
memory/4432-173-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/4432-165-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/4432-163-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/4432-161-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/4432-159-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/4432-157-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/4432-155-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/4432-149-0x0000000004AE0000-0x0000000004AF0000-memory.dmpFilesize
64KB
-
memory/4432-148-0x0000000000710000-0x000000000073D000-memory.dmpFilesize
180KB
-
memory/4432-184-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/4432-169-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB