Analysis
-
max time kernel
61s -
max time network
69s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 17:59
Static task
static1
Behavioral task
behavioral1
Sample
4f7a7223ab789d2a3c98b71a20c12d395ba05fa6daa64d83e1499cabb9bf40c7.exe
Resource
win10v2004-20230220-en
General
-
Target
4f7a7223ab789d2a3c98b71a20c12d395ba05fa6daa64d83e1499cabb9bf40c7.exe
-
Size
659KB
-
MD5
b47c5d3c4d1514a26127ff0819c7ad94
-
SHA1
86819f30a22efc50b850fc230128edf5cc881524
-
SHA256
4f7a7223ab789d2a3c98b71a20c12d395ba05fa6daa64d83e1499cabb9bf40c7
-
SHA512
54c85480fa9a799e32b1338ecd9c8ed96550101058a8f85df95514e42fd81a7c05ed91dcd3c567c7689cb80816adc72f60b06381518cb5f61c4c8d5bfc568f52
-
SSDEEP
12288:lMr4y90juc0jTLTsY/AaN6RdWteFVzC70jswrLiqi6aWPq2QCZ7/:Vym0jT/AaN6rVFVW7msw6qi65mMD
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro3583.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro3583.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro3583.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro3583.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro3583.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro3583.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro3583.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/1384-194-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/1384-197-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/1384-199-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/1384-201-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/1384-195-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/1384-203-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/1384-205-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/1384-207-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/1384-209-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/1384-211-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/1384-213-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/1384-215-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/1384-217-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/1384-219-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/1384-221-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/1384-223-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/1384-225-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/1384-227-0x0000000002430000-0x000000000246F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un575658.exepro3583.exequ8406.exesi137815.exepid process 4796 un575658.exe 3920 pro3583.exe 1384 qu8406.exe 3720 si137815.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro3583.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro3583.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro3583.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un575658.exe4f7a7223ab789d2a3c98b71a20c12d395ba05fa6daa64d83e1499cabb9bf40c7.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un575658.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 4f7a7223ab789d2a3c98b71a20c12d395ba05fa6daa64d83e1499cabb9bf40c7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 4f7a7223ab789d2a3c98b71a20c12d395ba05fa6daa64d83e1499cabb9bf40c7.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un575658.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3348 3920 WerFault.exe pro3583.exe 2920 1384 WerFault.exe qu8406.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro3583.exequ8406.exesi137815.exepid process 3920 pro3583.exe 3920 pro3583.exe 1384 qu8406.exe 1384 qu8406.exe 3720 si137815.exe 3720 si137815.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro3583.exequ8406.exesi137815.exedescription pid process Token: SeDebugPrivilege 3920 pro3583.exe Token: SeDebugPrivilege 1384 qu8406.exe Token: SeDebugPrivilege 3720 si137815.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
4f7a7223ab789d2a3c98b71a20c12d395ba05fa6daa64d83e1499cabb9bf40c7.exeun575658.exedescription pid process target process PID 5060 wrote to memory of 4796 5060 4f7a7223ab789d2a3c98b71a20c12d395ba05fa6daa64d83e1499cabb9bf40c7.exe un575658.exe PID 5060 wrote to memory of 4796 5060 4f7a7223ab789d2a3c98b71a20c12d395ba05fa6daa64d83e1499cabb9bf40c7.exe un575658.exe PID 5060 wrote to memory of 4796 5060 4f7a7223ab789d2a3c98b71a20c12d395ba05fa6daa64d83e1499cabb9bf40c7.exe un575658.exe PID 4796 wrote to memory of 3920 4796 un575658.exe pro3583.exe PID 4796 wrote to memory of 3920 4796 un575658.exe pro3583.exe PID 4796 wrote to memory of 3920 4796 un575658.exe pro3583.exe PID 4796 wrote to memory of 1384 4796 un575658.exe qu8406.exe PID 4796 wrote to memory of 1384 4796 un575658.exe qu8406.exe PID 4796 wrote to memory of 1384 4796 un575658.exe qu8406.exe PID 5060 wrote to memory of 3720 5060 4f7a7223ab789d2a3c98b71a20c12d395ba05fa6daa64d83e1499cabb9bf40c7.exe si137815.exe PID 5060 wrote to memory of 3720 5060 4f7a7223ab789d2a3c98b71a20c12d395ba05fa6daa64d83e1499cabb9bf40c7.exe si137815.exe PID 5060 wrote to memory of 3720 5060 4f7a7223ab789d2a3c98b71a20c12d395ba05fa6daa64d83e1499cabb9bf40c7.exe si137815.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f7a7223ab789d2a3c98b71a20c12d395ba05fa6daa64d83e1499cabb9bf40c7.exe"C:\Users\Admin\AppData\Local\Temp\4f7a7223ab789d2a3c98b71a20c12d395ba05fa6daa64d83e1499cabb9bf40c7.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un575658.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un575658.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3583.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3583.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3920 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 10884⤵
- Program crash
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8406.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8406.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1384 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 13364⤵
- Program crash
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si137815.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si137815.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3720
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3920 -ip 39201⤵PID:776
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1384 -ip 13841⤵PID:1592
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si137815.exeFilesize
175KB
MD5bb6d43fa4ebafe62b98ec4dea4ff49d9
SHA1d8188e664ac977f59d3ec26589e3cf67b1fab23b
SHA2561d1cdf01afc38fc6784a41fe8aa2f308ec44606d2d16c4edd9445813af33fe89
SHA512679a0e394c5751020c38ceaba6a1bd1a33c558b8c9142fc796fa3570baa0ac082d099891451fde50249e165625b9738ead7321dccf2b2da567f3f7e3d4ee4644
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si137815.exeFilesize
175KB
MD5bb6d43fa4ebafe62b98ec4dea4ff49d9
SHA1d8188e664ac977f59d3ec26589e3cf67b1fab23b
SHA2561d1cdf01afc38fc6784a41fe8aa2f308ec44606d2d16c4edd9445813af33fe89
SHA512679a0e394c5751020c38ceaba6a1bd1a33c558b8c9142fc796fa3570baa0ac082d099891451fde50249e165625b9738ead7321dccf2b2da567f3f7e3d4ee4644
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un575658.exeFilesize
517KB
MD5e7d3eeee05554ef489edbcbcc2e824d9
SHA1450b83927bad9d9287c71ea9ca83dcec2adc7fc4
SHA2567c7de82027d2b86f8b742230db0c722780ce13579dce36498fc4627c3d23d8b0
SHA5128f7dcb9b461b076d1578f47a262c32937cb07a00d2fd6abbb56a2cb4c5bf7b35cfd92b5fe4f45c104830dc311ea5b5350c6e7af6e5a7194bda57156646265b6f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un575658.exeFilesize
517KB
MD5e7d3eeee05554ef489edbcbcc2e824d9
SHA1450b83927bad9d9287c71ea9ca83dcec2adc7fc4
SHA2567c7de82027d2b86f8b742230db0c722780ce13579dce36498fc4627c3d23d8b0
SHA5128f7dcb9b461b076d1578f47a262c32937cb07a00d2fd6abbb56a2cb4c5bf7b35cfd92b5fe4f45c104830dc311ea5b5350c6e7af6e5a7194bda57156646265b6f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3583.exeFilesize
236KB
MD57dbd73f2cea9e5619de6feca5ce1f03b
SHA1c59c116504487f73ed6e08bb17fdf1ac3d59dd4e
SHA256c2bf7897a4309767cbe176d24ab20b6a2eedccfb34a209e1e2134296c73c34ca
SHA5129a8fcf43263a876a9be0144fda339a2198f27871b5ef0522ed2b9545d7d2fedfc69e15b0594f616eab98019217f9caad45fdaddf12c79a04cdd85262a9203cd0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3583.exeFilesize
236KB
MD57dbd73f2cea9e5619de6feca5ce1f03b
SHA1c59c116504487f73ed6e08bb17fdf1ac3d59dd4e
SHA256c2bf7897a4309767cbe176d24ab20b6a2eedccfb34a209e1e2134296c73c34ca
SHA5129a8fcf43263a876a9be0144fda339a2198f27871b5ef0522ed2b9545d7d2fedfc69e15b0594f616eab98019217f9caad45fdaddf12c79a04cdd85262a9203cd0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8406.exeFilesize
295KB
MD5cff89fad9c851e0fc568a03bd67829a6
SHA11904a548e581e7cb2b84fd06fea9836814522101
SHA256c7f2fb2c29aa18c9132c695ae8a3788fbf4518c0e0df108105aab26f032ed2c1
SHA5124d4b973e72f28dc2f3c83f0b5b4b745ecdcff71b7e0b78d767e9130b2c0dff7038aaad430acc01dc13e74500057fc436ef5b205d7e362c3462a0d341222ea96f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8406.exeFilesize
295KB
MD5cff89fad9c851e0fc568a03bd67829a6
SHA11904a548e581e7cb2b84fd06fea9836814522101
SHA256c7f2fb2c29aa18c9132c695ae8a3788fbf4518c0e0df108105aab26f032ed2c1
SHA5124d4b973e72f28dc2f3c83f0b5b4b745ecdcff71b7e0b78d767e9130b2c0dff7038aaad430acc01dc13e74500057fc436ef5b205d7e362c3462a0d341222ea96f
-
memory/1384-1102-0x0000000002790000-0x00000000027A2000-memory.dmpFilesize
72KB
-
memory/1384-1101-0x00000000059A0000-0x0000000005AAA000-memory.dmpFilesize
1.0MB
-
memory/1384-219-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/1384-217-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/1384-195-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/1384-203-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/1384-1115-0x00000000027C0000-0x00000000027D0000-memory.dmpFilesize
64KB
-
memory/1384-1114-0x0000000006D80000-0x0000000006DD0000-memory.dmpFilesize
320KB
-
memory/1384-1113-0x0000000006D00000-0x0000000006D76000-memory.dmpFilesize
472KB
-
memory/1384-1112-0x0000000006690000-0x0000000006BBC000-memory.dmpFilesize
5.2MB
-
memory/1384-205-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/1384-1111-0x00000000064B0000-0x0000000006672000-memory.dmpFilesize
1.8MB
-
memory/1384-1110-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/1384-1109-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/1384-1108-0x00000000027C0000-0x00000000027D0000-memory.dmpFilesize
64KB
-
memory/1384-1107-0x00000000027C0000-0x00000000027D0000-memory.dmpFilesize
64KB
-
memory/1384-1106-0x00000000027C0000-0x00000000027D0000-memory.dmpFilesize
64KB
-
memory/1384-1104-0x00000000027D0000-0x000000000280C000-memory.dmpFilesize
240KB
-
memory/1384-1103-0x00000000027C0000-0x00000000027D0000-memory.dmpFilesize
64KB
-
memory/1384-221-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/1384-1100-0x0000000005380000-0x0000000005998000-memory.dmpFilesize
6.1MB
-
memory/1384-227-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/1384-190-0x0000000000650000-0x000000000069B000-memory.dmpFilesize
300KB
-
memory/1384-191-0x00000000027C0000-0x00000000027D0000-memory.dmpFilesize
64KB
-
memory/1384-193-0x00000000027C0000-0x00000000027D0000-memory.dmpFilesize
64KB
-
memory/1384-192-0x00000000027C0000-0x00000000027D0000-memory.dmpFilesize
64KB
-
memory/1384-194-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/1384-197-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/1384-199-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/1384-201-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/1384-215-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/1384-225-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/1384-223-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/1384-207-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/1384-209-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/1384-211-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/1384-213-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/3720-1122-0x0000000000F90000-0x0000000000FC2000-memory.dmpFilesize
200KB
-
memory/3720-1123-0x0000000005850000-0x0000000005860000-memory.dmpFilesize
64KB
-
memory/3720-1124-0x0000000005850000-0x0000000005860000-memory.dmpFilesize
64KB
-
memory/3920-181-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/3920-170-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/3920-149-0x0000000002100000-0x000000000212D000-memory.dmpFilesize
180KB
-
memory/3920-151-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/3920-152-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/3920-185-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/3920-150-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/3920-183-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/3920-182-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/3920-153-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/3920-180-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/3920-178-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/3920-176-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/3920-174-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/3920-172-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/3920-168-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/3920-166-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/3920-164-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/3920-162-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/3920-160-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/3920-148-0x0000000004CB0000-0x0000000005254000-memory.dmpFilesize
5.6MB
-
memory/3920-158-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/3920-156-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/3920-154-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB