Analysis
-
max time kernel
61s -
max time network
82s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 18:19
Static task
static1
Behavioral task
behavioral1
Sample
7d9b5143bd1c7832e32cb88ad5faba88e4e76ae129fc8c1a0233c9ce60a2b4dc.exe
Resource
win10v2004-20230220-en
General
-
Target
7d9b5143bd1c7832e32cb88ad5faba88e4e76ae129fc8c1a0233c9ce60a2b4dc.exe
-
Size
521KB
-
MD5
3a1abcbb8ed80e6691ab99eadcb4d779
-
SHA1
31c9409dc7b1f0d88dc3608c7d3ef924d37c413b
-
SHA256
7d9b5143bd1c7832e32cb88ad5faba88e4e76ae129fc8c1a0233c9ce60a2b4dc
-
SHA512
ebeaefd6accd76a94cc095e45f5b0e15356ee3e539310d02f45a564d66a4256c23db0138e7fcaa626850971be01e5d546e3629e3ab9e39b33f92426dbecec606
-
SSDEEP
12288:IMrLy90jjxt/4ZxOsWyk0sdyj6RwV4b/:jyUL/4Zw+k0lu/
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr963543.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr963543.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr963543.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr963543.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr963543.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr963543.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr963543.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/384-158-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/384-159-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/384-161-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/384-163-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/384-165-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/384-167-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/384-169-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/384-171-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/384-173-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/384-175-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/384-177-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/384-179-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/384-181-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/384-183-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/384-185-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/384-187-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/384-189-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/384-193-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/384-195-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/384-191-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/384-197-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/384-199-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/384-201-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/384-203-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/384-205-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/384-207-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/384-209-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/384-211-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/384-213-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/384-215-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/384-217-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/384-219-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/384-221-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
zimc8001.exejr963543.exeku523040.exelr167000.exepid process 1176 zimc8001.exe 3260 jr963543.exe 384 ku523040.exe 3520 lr167000.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr963543.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr963543.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
zimc8001.exe7d9b5143bd1c7832e32cb88ad5faba88e4e76ae129fc8c1a0233c9ce60a2b4dc.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zimc8001.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zimc8001.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 7d9b5143bd1c7832e32cb88ad5faba88e4e76ae129fc8c1a0233c9ce60a2b4dc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 7d9b5143bd1c7832e32cb88ad5faba88e4e76ae129fc8c1a0233c9ce60a2b4dc.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3592 384 WerFault.exe ku523040.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr963543.exeku523040.exelr167000.exepid process 3260 jr963543.exe 3260 jr963543.exe 384 ku523040.exe 384 ku523040.exe 3520 lr167000.exe 3520 lr167000.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr963543.exeku523040.exelr167000.exedescription pid process Token: SeDebugPrivilege 3260 jr963543.exe Token: SeDebugPrivilege 384 ku523040.exe Token: SeDebugPrivilege 3520 lr167000.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
7d9b5143bd1c7832e32cb88ad5faba88e4e76ae129fc8c1a0233c9ce60a2b4dc.exezimc8001.exedescription pid process target process PID 3924 wrote to memory of 1176 3924 7d9b5143bd1c7832e32cb88ad5faba88e4e76ae129fc8c1a0233c9ce60a2b4dc.exe zimc8001.exe PID 3924 wrote to memory of 1176 3924 7d9b5143bd1c7832e32cb88ad5faba88e4e76ae129fc8c1a0233c9ce60a2b4dc.exe zimc8001.exe PID 3924 wrote to memory of 1176 3924 7d9b5143bd1c7832e32cb88ad5faba88e4e76ae129fc8c1a0233c9ce60a2b4dc.exe zimc8001.exe PID 1176 wrote to memory of 3260 1176 zimc8001.exe jr963543.exe PID 1176 wrote to memory of 3260 1176 zimc8001.exe jr963543.exe PID 1176 wrote to memory of 384 1176 zimc8001.exe ku523040.exe PID 1176 wrote to memory of 384 1176 zimc8001.exe ku523040.exe PID 1176 wrote to memory of 384 1176 zimc8001.exe ku523040.exe PID 3924 wrote to memory of 3520 3924 7d9b5143bd1c7832e32cb88ad5faba88e4e76ae129fc8c1a0233c9ce60a2b4dc.exe lr167000.exe PID 3924 wrote to memory of 3520 3924 7d9b5143bd1c7832e32cb88ad5faba88e4e76ae129fc8c1a0233c9ce60a2b4dc.exe lr167000.exe PID 3924 wrote to memory of 3520 3924 7d9b5143bd1c7832e32cb88ad5faba88e4e76ae129fc8c1a0233c9ce60a2b4dc.exe lr167000.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d9b5143bd1c7832e32cb88ad5faba88e4e76ae129fc8c1a0233c9ce60a2b4dc.exe"C:\Users\Admin\AppData\Local\Temp\7d9b5143bd1c7832e32cb88ad5faba88e4e76ae129fc8c1a0233c9ce60a2b4dc.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zimc8001.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zimc8001.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr963543.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr963543.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku523040.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku523040.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:384 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 384 -s 15764⤵
- Program crash
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr167000.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr167000.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3520
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 384 -ip 3841⤵PID:3860
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr167000.exeFilesize
175KB
MD5f026676afea1ae988c4d186e370e763c
SHA12b096ee4881b947b105096e5252807892eccd1e4
SHA2568c0f5394fe59e54ee79b90759d809c4ef2428ca39ca44939f75b0bea62989619
SHA512fbc5bd24d764a0c173d2f5731fcab68570270ff9f1d634f716ef8c424bdfea4033193b8e9702429cfd479486d898957f30b6bbc8b81c97d3e7d0936ff487b65c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr167000.exeFilesize
175KB
MD5f026676afea1ae988c4d186e370e763c
SHA12b096ee4881b947b105096e5252807892eccd1e4
SHA2568c0f5394fe59e54ee79b90759d809c4ef2428ca39ca44939f75b0bea62989619
SHA512fbc5bd24d764a0c173d2f5731fcab68570270ff9f1d634f716ef8c424bdfea4033193b8e9702429cfd479486d898957f30b6bbc8b81c97d3e7d0936ff487b65c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zimc8001.exeFilesize
379KB
MD5adbfc2caf3f016c1c24b81af03ebde3a
SHA11d95513ea057f786cb9f075a2d44abbb220d35b4
SHA256f9915b425cb60e672c9fcdf31393c2b34d2a03b5716ca2fa0ac879bee1f553b8
SHA51211dc4c90ca4f9ca662ecaa70b977b9aaadbce7de307fd9923854b32ff7884b320ace303bc357d062d74ccebd222a0bd86b5c2c63d79aa7b26ed2619ea4f1d31d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zimc8001.exeFilesize
379KB
MD5adbfc2caf3f016c1c24b81af03ebde3a
SHA11d95513ea057f786cb9f075a2d44abbb220d35b4
SHA256f9915b425cb60e672c9fcdf31393c2b34d2a03b5716ca2fa0ac879bee1f553b8
SHA51211dc4c90ca4f9ca662ecaa70b977b9aaadbce7de307fd9923854b32ff7884b320ace303bc357d062d74ccebd222a0bd86b5c2c63d79aa7b26ed2619ea4f1d31d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr963543.exeFilesize
11KB
MD5daa8dbddbca6d077a7fc234496923cf1
SHA14df2b6327e8e75ed71c0e3055c9d17a043ff6b65
SHA25617528baacf916fa9379bb2df7a9cb98e87f6759a74a3dccd565a04c671d67b56
SHA512b8c878f507ad26dfee4caa5f37ad8f6e909ce5354f9aa4df8535fcdeb75e654afbd179ca2c16eedfc4c2ba9d4de13b58e1fdb23424a72c9da893f6b1f5f4890a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr963543.exeFilesize
11KB
MD5daa8dbddbca6d077a7fc234496923cf1
SHA14df2b6327e8e75ed71c0e3055c9d17a043ff6b65
SHA25617528baacf916fa9379bb2df7a9cb98e87f6759a74a3dccd565a04c671d67b56
SHA512b8c878f507ad26dfee4caa5f37ad8f6e909ce5354f9aa4df8535fcdeb75e654afbd179ca2c16eedfc4c2ba9d4de13b58e1fdb23424a72c9da893f6b1f5f4890a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku523040.exeFilesize
294KB
MD579b6492cd278a87b16b7ffadf019d0f2
SHA19912e0c29405b1381619b25d82f9b1eace293b69
SHA256422cf90e9d77bf0147b434ace17f1f023fbf60ff790ee1f7fc13285633d62048
SHA512f37a4dde88183f4527c853dff88011a664e516b10d83d51bb721e320e77acacd003dfcf25c2d2d65daf28a0832b47ad6dcdd8a7e8d443a873eb211d1bbf29595
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku523040.exeFilesize
294KB
MD579b6492cd278a87b16b7ffadf019d0f2
SHA19912e0c29405b1381619b25d82f9b1eace293b69
SHA256422cf90e9d77bf0147b434ace17f1f023fbf60ff790ee1f7fc13285633d62048
SHA512f37a4dde88183f4527c853dff88011a664e516b10d83d51bb721e320e77acacd003dfcf25c2d2d65daf28a0832b47ad6dcdd8a7e8d443a873eb211d1bbf29595
-
memory/384-153-0x0000000004AE0000-0x0000000005084000-memory.dmpFilesize
5.6MB
-
memory/384-154-0x0000000000560000-0x00000000005AB000-memory.dmpFilesize
300KB
-
memory/384-156-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/384-157-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/384-155-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/384-158-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/384-159-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/384-161-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/384-163-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/384-165-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/384-167-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/384-169-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/384-171-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/384-173-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/384-175-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/384-177-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/384-179-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/384-181-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/384-183-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/384-185-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/384-187-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/384-189-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/384-193-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/384-195-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/384-191-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/384-197-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/384-199-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/384-201-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/384-203-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/384-205-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/384-207-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/384-209-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/384-211-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/384-213-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/384-215-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/384-217-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/384-219-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/384-221-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/384-1064-0x0000000005210000-0x0000000005828000-memory.dmpFilesize
6.1MB
-
memory/384-1065-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/384-1066-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/384-1067-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/384-1068-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/384-1070-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/384-1071-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/384-1073-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/384-1072-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/384-1074-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/384-1075-0x00000000066F0000-0x0000000006766000-memory.dmpFilesize
472KB
-
memory/384-1076-0x0000000006780000-0x00000000067D0000-memory.dmpFilesize
320KB
-
memory/384-1077-0x00000000067E0000-0x00000000069A2000-memory.dmpFilesize
1.8MB
-
memory/384-1078-0x00000000069C0000-0x0000000006EEC000-memory.dmpFilesize
5.2MB
-
memory/384-1079-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/3260-147-0x0000000000E70000-0x0000000000E7A000-memory.dmpFilesize
40KB
-
memory/3520-1085-0x0000000000CD0000-0x0000000000D02000-memory.dmpFilesize
200KB
-
memory/3520-1086-0x0000000005900000-0x0000000005910000-memory.dmpFilesize
64KB