Analysis
-
max time kernel
94s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 18:05
Static task
static1
Behavioral task
behavioral1
Sample
e7fb582dbbce2bda628b730ee38e1a98492cc6e236161332ce9ecd386f4e9b08.exe
Resource
win10v2004-20230221-en
General
-
Target
e7fb582dbbce2bda628b730ee38e1a98492cc6e236161332ce9ecd386f4e9b08.exe
-
Size
521KB
-
MD5
7428ec413d289a39c9ebb14286cdb137
-
SHA1
937aeef48050a4a34eeb1f3601adf785ac6d5859
-
SHA256
e7fb582dbbce2bda628b730ee38e1a98492cc6e236161332ce9ecd386f4e9b08
-
SHA512
448c1f72ed50907528d22bc13a96f39f804d846743090671cf4fb0462462f8bd48dfe7db4fe3d4f7c55755e435f9cdcd53d23bb799629d82ceb4df391619074c
-
SSDEEP
12288:9MrZy90yWOzLKO9+TfqH/QZ533aEFQvradY:AyJWRs+EQZ53RQvWdY
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr896444.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr896444.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr896444.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr896444.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr896444.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr896444.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr896444.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 34 IoCs
Processes:
resource yara_rule behavioral1/memory/3488-156-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/3488-157-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/3488-159-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/3488-161-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/3488-163-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/3488-165-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/3488-167-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/3488-169-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/3488-171-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/3488-173-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/3488-175-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/3488-177-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/3488-179-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/3488-181-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/3488-183-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/3488-186-0x0000000004C30000-0x0000000004C40000-memory.dmp family_redline behavioral1/memory/3488-185-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/3488-189-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/3488-191-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/3488-193-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/3488-195-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/3488-197-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/3488-199-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/3488-201-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/3488-203-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/3488-205-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/3488-207-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/3488-209-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/3488-211-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/3488-213-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/3488-217-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/3488-215-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/3488-219-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/3488-221-0x0000000002730000-0x000000000276F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
ziSE4660.exejr896444.exeku560688.exelr770674.exepid process 2124 ziSE4660.exe 868 jr896444.exe 3488 ku560688.exe 3312 lr770674.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr896444.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr896444.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
e7fb582dbbce2bda628b730ee38e1a98492cc6e236161332ce9ecd386f4e9b08.exeziSE4660.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce e7fb582dbbce2bda628b730ee38e1a98492cc6e236161332ce9ecd386f4e9b08.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" e7fb582dbbce2bda628b730ee38e1a98492cc6e236161332ce9ecd386f4e9b08.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziSE4660.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziSE4660.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3456 3488 WerFault.exe ku560688.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr896444.exeku560688.exelr770674.exepid process 868 jr896444.exe 868 jr896444.exe 3488 ku560688.exe 3488 ku560688.exe 3312 lr770674.exe 3312 lr770674.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr896444.exeku560688.exelr770674.exedescription pid process Token: SeDebugPrivilege 868 jr896444.exe Token: SeDebugPrivilege 3488 ku560688.exe Token: SeDebugPrivilege 3312 lr770674.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
e7fb582dbbce2bda628b730ee38e1a98492cc6e236161332ce9ecd386f4e9b08.exeziSE4660.exedescription pid process target process PID 2136 wrote to memory of 2124 2136 e7fb582dbbce2bda628b730ee38e1a98492cc6e236161332ce9ecd386f4e9b08.exe ziSE4660.exe PID 2136 wrote to memory of 2124 2136 e7fb582dbbce2bda628b730ee38e1a98492cc6e236161332ce9ecd386f4e9b08.exe ziSE4660.exe PID 2136 wrote to memory of 2124 2136 e7fb582dbbce2bda628b730ee38e1a98492cc6e236161332ce9ecd386f4e9b08.exe ziSE4660.exe PID 2124 wrote to memory of 868 2124 ziSE4660.exe jr896444.exe PID 2124 wrote to memory of 868 2124 ziSE4660.exe jr896444.exe PID 2124 wrote to memory of 3488 2124 ziSE4660.exe ku560688.exe PID 2124 wrote to memory of 3488 2124 ziSE4660.exe ku560688.exe PID 2124 wrote to memory of 3488 2124 ziSE4660.exe ku560688.exe PID 2136 wrote to memory of 3312 2136 e7fb582dbbce2bda628b730ee38e1a98492cc6e236161332ce9ecd386f4e9b08.exe lr770674.exe PID 2136 wrote to memory of 3312 2136 e7fb582dbbce2bda628b730ee38e1a98492cc6e236161332ce9ecd386f4e9b08.exe lr770674.exe PID 2136 wrote to memory of 3312 2136 e7fb582dbbce2bda628b730ee38e1a98492cc6e236161332ce9ecd386f4e9b08.exe lr770674.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7fb582dbbce2bda628b730ee38e1a98492cc6e236161332ce9ecd386f4e9b08.exe"C:\Users\Admin\AppData\Local\Temp\e7fb582dbbce2bda628b730ee38e1a98492cc6e236161332ce9ecd386f4e9b08.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziSE4660.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziSE4660.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr896444.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr896444.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku560688.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku560688.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 13404⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr770674.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr770674.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3488 -ip 34881⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr770674.exeFilesize
175KB
MD5103ec0a7580462ff97671ded35762ad9
SHA1e5ab597b77d1ea2821c356cf2de623702414d874
SHA25676d21e641516e4c9c8ce0662a438eaa8f86d49a35e847016e684b4b87ae14be1
SHA51253d662f9078fdabb1b8568ea0d433d7fed486adf74781dbcbaee2f5e66cb3efd8bf90e3ecb6c7079360e01862c04ee9f8c7de7b0d3a5157db3196d5076a039c9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr770674.exeFilesize
175KB
MD5103ec0a7580462ff97671ded35762ad9
SHA1e5ab597b77d1ea2821c356cf2de623702414d874
SHA25676d21e641516e4c9c8ce0662a438eaa8f86d49a35e847016e684b4b87ae14be1
SHA51253d662f9078fdabb1b8568ea0d433d7fed486adf74781dbcbaee2f5e66cb3efd8bf90e3ecb6c7079360e01862c04ee9f8c7de7b0d3a5157db3196d5076a039c9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziSE4660.exeFilesize
379KB
MD51087436f15ed91b6e6e36231361728a0
SHA1b6f2cda7769c7ceb68d6a64f5d46fca21c816fa6
SHA256a466c7d32708f1ad3eb58d52376be407b0b66c7b55108149eca8604d640b5bcb
SHA5126ad1f74f522e0dbb8ae320a38ad7279a62461506f6b0f834f1230631ceb1e4fb2c76b288692d35ce2e9c2de207bae7c802578b97065000f7c144cc2cbf25c85a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziSE4660.exeFilesize
379KB
MD51087436f15ed91b6e6e36231361728a0
SHA1b6f2cda7769c7ceb68d6a64f5d46fca21c816fa6
SHA256a466c7d32708f1ad3eb58d52376be407b0b66c7b55108149eca8604d640b5bcb
SHA5126ad1f74f522e0dbb8ae320a38ad7279a62461506f6b0f834f1230631ceb1e4fb2c76b288692d35ce2e9c2de207bae7c802578b97065000f7c144cc2cbf25c85a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr896444.exeFilesize
15KB
MD51bed6d60e8b576b8dd3ea0012fdff92f
SHA15d4ec942793b41d0794d57abd1f4fac1fd31cef5
SHA256cf97f62fe35b90e01fe904d97a40be05b1301d355652293b1e8eaca194773bd3
SHA512e28bb1abdc9805357093ae2d2fb2a29fb4e10c7d7c95e4d8ff3abb12cf37fb5fa84db5be78107a1212b83f720ba6aa05705ccdd2ef64f98ebfc13f1271065f9c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr896444.exeFilesize
15KB
MD51bed6d60e8b576b8dd3ea0012fdff92f
SHA15d4ec942793b41d0794d57abd1f4fac1fd31cef5
SHA256cf97f62fe35b90e01fe904d97a40be05b1301d355652293b1e8eaca194773bd3
SHA512e28bb1abdc9805357093ae2d2fb2a29fb4e10c7d7c95e4d8ff3abb12cf37fb5fa84db5be78107a1212b83f720ba6aa05705ccdd2ef64f98ebfc13f1271065f9c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku560688.exeFilesize
294KB
MD57afa981499f39cebc84600ec1767cb6b
SHA13cc13e0381a17f9a41c7de57607aa9a0d81a5aaf
SHA25613bf834942957ec108a87540b4d9ee1c453822f2be93ad4e599bfe461625fe00
SHA51287922e0730e9d075dcfdbe5b516d3c67e7627e6d6131de366f390d8b0ab567ae532a17cf20df76746293f250d2f9c8da54f09163d1bc3346fe87754e4eaab9e7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku560688.exeFilesize
294KB
MD57afa981499f39cebc84600ec1767cb6b
SHA13cc13e0381a17f9a41c7de57607aa9a0d81a5aaf
SHA25613bf834942957ec108a87540b4d9ee1c453822f2be93ad4e599bfe461625fe00
SHA51287922e0730e9d075dcfdbe5b516d3c67e7627e6d6131de366f390d8b0ab567ae532a17cf20df76746293f250d2f9c8da54f09163d1bc3346fe87754e4eaab9e7
-
memory/868-147-0x00000000008B0000-0x00000000008BA000-memory.dmpFilesize
40KB
-
memory/3312-1085-0x0000000000F10000-0x0000000000F42000-memory.dmpFilesize
200KB
-
memory/3312-1086-0x0000000005AE0000-0x0000000005AF0000-memory.dmpFilesize
64KB
-
memory/3312-1087-0x0000000005AE0000-0x0000000005AF0000-memory.dmpFilesize
64KB
-
memory/3488-187-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/3488-203-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/3488-156-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/3488-157-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/3488-159-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/3488-161-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/3488-163-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/3488-165-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/3488-167-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/3488-169-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/3488-171-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/3488-173-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/3488-175-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/3488-177-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/3488-179-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/3488-181-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/3488-183-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/3488-186-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/3488-185-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/3488-189-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/3488-154-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/3488-191-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/3488-193-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/3488-195-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/3488-197-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/3488-199-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/3488-201-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/3488-155-0x0000000004C40000-0x00000000051E4000-memory.dmpFilesize
5.6MB
-
memory/3488-205-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/3488-207-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/3488-209-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/3488-211-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/3488-213-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/3488-217-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/3488-215-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/3488-219-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/3488-221-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/3488-1064-0x00000000051F0000-0x0000000005808000-memory.dmpFilesize
6.1MB
-
memory/3488-1065-0x0000000005810000-0x000000000591A000-memory.dmpFilesize
1.0MB
-
memory/3488-1066-0x0000000004BB0000-0x0000000004BC2000-memory.dmpFilesize
72KB
-
memory/3488-1067-0x0000000004BD0000-0x0000000004C0C000-memory.dmpFilesize
240KB
-
memory/3488-1068-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/3488-1070-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/3488-1071-0x0000000005BB0000-0x0000000005C16000-memory.dmpFilesize
408KB
-
memory/3488-1072-0x0000000006260000-0x00000000062F2000-memory.dmpFilesize
584KB
-
memory/3488-1073-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/3488-1074-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/3488-1075-0x0000000006370000-0x0000000006532000-memory.dmpFilesize
1.8MB
-
memory/3488-153-0x0000000000740000-0x000000000078B000-memory.dmpFilesize
300KB
-
memory/3488-1076-0x0000000006540000-0x0000000006A6C000-memory.dmpFilesize
5.2MB
-
memory/3488-1077-0x0000000007E80000-0x0000000007EF6000-memory.dmpFilesize
472KB
-
memory/3488-1078-0x0000000007F00000-0x0000000007F50000-memory.dmpFilesize
320KB
-
memory/3488-1079-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB