Analysis
-
max time kernel
52s -
max time network
63s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
03-04-2023 19:21
Static task
static1
Behavioral task
behavioral1
Sample
050236270f95f132b00834db5c054280d3e1552593a023b18bfb59dd8e6f118c.exe
Resource
win10-20230220-en
General
-
Target
050236270f95f132b00834db5c054280d3e1552593a023b18bfb59dd8e6f118c.exe
-
Size
522KB
-
MD5
6862d673f0e9250f8e6e8383b5a85e47
-
SHA1
43344caa8286fd2bf445a6738e482912ed93e93d
-
SHA256
050236270f95f132b00834db5c054280d3e1552593a023b18bfb59dd8e6f118c
-
SHA512
9f844a20bc28e5f642cd935ae4525d841b2c234942126c88eabfaa842d85257f8cedc37df2ae47e6faf6893f0ae264394b56fc0cb8f09318166dca206302e652
-
SSDEEP
12288:uMrJy905R6l9SYMG6MXqPAfOvB2N7b42l6B0Bz/:XyQRu9ZPaofO8N77sB0B
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr184569.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr184569.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr184569.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr184569.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr184569.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr184569.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
Processes:
resource yara_rule behavioral1/memory/4092-142-0x00000000023A0000-0x00000000023E6000-memory.dmp family_redline behavioral1/memory/4092-144-0x0000000002610000-0x0000000002654000-memory.dmp family_redline behavioral1/memory/4092-148-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4092-151-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4092-149-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4092-153-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4092-155-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4092-157-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4092-159-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4092-161-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4092-163-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4092-165-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4092-167-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4092-169-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4092-171-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4092-173-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4092-175-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4092-177-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4092-179-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4092-181-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4092-183-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4092-185-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4092-187-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4092-189-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4092-191-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4092-193-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4092-195-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4092-197-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4092-199-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4092-201-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4092-203-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4092-205-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4092-207-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4092-209-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4092-211-0x0000000002610000-0x000000000264F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
zivS3464.exejr184569.exeku962921.exelr555346.exepid process 2680 zivS3464.exe 3412 jr184569.exe 4092 ku962921.exe 4840 lr555346.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr184569.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr184569.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
050236270f95f132b00834db5c054280d3e1552593a023b18bfb59dd8e6f118c.exezivS3464.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 050236270f95f132b00834db5c054280d3e1552593a023b18bfb59dd8e6f118c.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zivS3464.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zivS3464.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 050236270f95f132b00834db5c054280d3e1552593a023b18bfb59dd8e6f118c.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr184569.exeku962921.exelr555346.exepid process 3412 jr184569.exe 3412 jr184569.exe 4092 ku962921.exe 4092 ku962921.exe 4840 lr555346.exe 4840 lr555346.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr184569.exeku962921.exelr555346.exedescription pid process Token: SeDebugPrivilege 3412 jr184569.exe Token: SeDebugPrivilege 4092 ku962921.exe Token: SeDebugPrivilege 4840 lr555346.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
050236270f95f132b00834db5c054280d3e1552593a023b18bfb59dd8e6f118c.exezivS3464.exedescription pid process target process PID 1012 wrote to memory of 2680 1012 050236270f95f132b00834db5c054280d3e1552593a023b18bfb59dd8e6f118c.exe zivS3464.exe PID 1012 wrote to memory of 2680 1012 050236270f95f132b00834db5c054280d3e1552593a023b18bfb59dd8e6f118c.exe zivS3464.exe PID 1012 wrote to memory of 2680 1012 050236270f95f132b00834db5c054280d3e1552593a023b18bfb59dd8e6f118c.exe zivS3464.exe PID 2680 wrote to memory of 3412 2680 zivS3464.exe jr184569.exe PID 2680 wrote to memory of 3412 2680 zivS3464.exe jr184569.exe PID 2680 wrote to memory of 4092 2680 zivS3464.exe ku962921.exe PID 2680 wrote to memory of 4092 2680 zivS3464.exe ku962921.exe PID 2680 wrote to memory of 4092 2680 zivS3464.exe ku962921.exe PID 1012 wrote to memory of 4840 1012 050236270f95f132b00834db5c054280d3e1552593a023b18bfb59dd8e6f118c.exe lr555346.exe PID 1012 wrote to memory of 4840 1012 050236270f95f132b00834db5c054280d3e1552593a023b18bfb59dd8e6f118c.exe lr555346.exe PID 1012 wrote to memory of 4840 1012 050236270f95f132b00834db5c054280d3e1552593a023b18bfb59dd8e6f118c.exe lr555346.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\050236270f95f132b00834db5c054280d3e1552593a023b18bfb59dd8e6f118c.exe"C:\Users\Admin\AppData\Local\Temp\050236270f95f132b00834db5c054280d3e1552593a023b18bfb59dd8e6f118c.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zivS3464.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zivS3464.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr184569.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr184569.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku962921.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku962921.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr555346.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr555346.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr555346.exeFilesize
175KB
MD56994a95f2b4f5a115560bf23a1c477de
SHA12f296e2551c8362aff2b9c2f26b9737b3de37e0e
SHA2568cfb35d4cc565d57ba573910a59710058122eab4aa53d02d2b30201963d73975
SHA512b6572363f322219e46a513337e36085d248ee599165fe383b8bbfd24a7b7e51b9d8dbcec6a1a20de9c903ee5dbe1b1bab5523f264a5f731c4e104e5bf643f3ef
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr555346.exeFilesize
175KB
MD56994a95f2b4f5a115560bf23a1c477de
SHA12f296e2551c8362aff2b9c2f26b9737b3de37e0e
SHA2568cfb35d4cc565d57ba573910a59710058122eab4aa53d02d2b30201963d73975
SHA512b6572363f322219e46a513337e36085d248ee599165fe383b8bbfd24a7b7e51b9d8dbcec6a1a20de9c903ee5dbe1b1bab5523f264a5f731c4e104e5bf643f3ef
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zivS3464.exeFilesize
379KB
MD59faf83a92d68bf34584828a6519762aa
SHA1d12a0529cad9303dd469ac88cbfc8baf9e615f1a
SHA25645ca710df0f697e4b4bcaae863b807204bf142684e0fcfc1885f8a0c7073053c
SHA512d3102db1aaf23c30154e0452d2ab6191da984dcbc3b7cda153173d4110ad705541b725b2329c54d32e39174f0f8b24f36693671ce64c48aa94f944431ad91ff1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zivS3464.exeFilesize
379KB
MD59faf83a92d68bf34584828a6519762aa
SHA1d12a0529cad9303dd469ac88cbfc8baf9e615f1a
SHA25645ca710df0f697e4b4bcaae863b807204bf142684e0fcfc1885f8a0c7073053c
SHA512d3102db1aaf23c30154e0452d2ab6191da984dcbc3b7cda153173d4110ad705541b725b2329c54d32e39174f0f8b24f36693671ce64c48aa94f944431ad91ff1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr184569.exeFilesize
11KB
MD59f6f894f28c49d8b23913539aa186baa
SHA10368d75e4be14fe5199c313197341a5895c8c177
SHA25604fd844840c0b0ba71606f6a7b45f08db11f09c6e5edbd0b2b4d721380d10368
SHA5129757b094129caaba542ccf04879053135fe3a1e19ea5192ff30dd750d4d1e67f3bd566398670f958693c7310140738c24e757f8d2d561e9b40139b221791717c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr184569.exeFilesize
11KB
MD59f6f894f28c49d8b23913539aa186baa
SHA10368d75e4be14fe5199c313197341a5895c8c177
SHA25604fd844840c0b0ba71606f6a7b45f08db11f09c6e5edbd0b2b4d721380d10368
SHA5129757b094129caaba542ccf04879053135fe3a1e19ea5192ff30dd750d4d1e67f3bd566398670f958693c7310140738c24e757f8d2d561e9b40139b221791717c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku962921.exeFilesize
294KB
MD54415f256ea356d0c95d61c4d212ce7fa
SHA138d690460fd784b733161e275ea07d36e44b857b
SHA25677573c49e7539fe0512c5d4dfad7dd53c8130dec7ccd99414e2f638e26818f81
SHA512924188b3f3c974bbc623ee07309e75efe80c1b1653616a472f5f0ab70cdf65b85fb041b29ad5efa18691788a53419d7eeaa6de67be1cff57ae11198ebc48445e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku962921.exeFilesize
294KB
MD54415f256ea356d0c95d61c4d212ce7fa
SHA138d690460fd784b733161e275ea07d36e44b857b
SHA25677573c49e7539fe0512c5d4dfad7dd53c8130dec7ccd99414e2f638e26818f81
SHA512924188b3f3c974bbc623ee07309e75efe80c1b1653616a472f5f0ab70cdf65b85fb041b29ad5efa18691788a53419d7eeaa6de67be1cff57ae11198ebc48445e
-
memory/3412-135-0x00000000007F0000-0x00000000007FA000-memory.dmpFilesize
40KB
-
memory/4092-141-0x00000000005E0000-0x000000000062B000-memory.dmpFilesize
300KB
-
memory/4092-142-0x00000000023A0000-0x00000000023E6000-memory.dmpFilesize
280KB
-
memory/4092-143-0x0000000004B90000-0x000000000508E000-memory.dmpFilesize
5.0MB
-
memory/4092-144-0x0000000002610000-0x0000000002654000-memory.dmpFilesize
272KB
-
memory/4092-145-0x0000000004B80000-0x0000000004B90000-memory.dmpFilesize
64KB
-
memory/4092-146-0x0000000004B80000-0x0000000004B90000-memory.dmpFilesize
64KB
-
memory/4092-147-0x0000000004B80000-0x0000000004B90000-memory.dmpFilesize
64KB
-
memory/4092-148-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4092-151-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4092-149-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4092-153-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4092-155-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4092-157-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4092-159-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4092-161-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4092-163-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4092-165-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4092-167-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4092-169-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4092-171-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4092-173-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4092-175-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4092-177-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4092-179-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4092-181-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4092-183-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4092-185-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4092-187-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4092-189-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4092-191-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4092-193-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4092-195-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4092-197-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4092-199-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4092-201-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4092-203-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4092-205-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4092-207-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4092-209-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4092-211-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4092-1054-0x00000000056A0000-0x0000000005CA6000-memory.dmpFilesize
6.0MB
-
memory/4092-1055-0x0000000005090000-0x000000000519A000-memory.dmpFilesize
1.0MB
-
memory/4092-1056-0x00000000051A0000-0x00000000051B2000-memory.dmpFilesize
72KB
-
memory/4092-1057-0x00000000051C0000-0x00000000051FE000-memory.dmpFilesize
248KB
-
memory/4092-1059-0x0000000005300000-0x000000000534B000-memory.dmpFilesize
300KB
-
memory/4092-1058-0x0000000004B80000-0x0000000004B90000-memory.dmpFilesize
64KB
-
memory/4092-1061-0x0000000004B80000-0x0000000004B90000-memory.dmpFilesize
64KB
-
memory/4092-1062-0x0000000004B80000-0x0000000004B90000-memory.dmpFilesize
64KB
-
memory/4092-1063-0x0000000005490000-0x0000000005522000-memory.dmpFilesize
584KB
-
memory/4092-1064-0x0000000005530000-0x0000000005596000-memory.dmpFilesize
408KB
-
memory/4092-1065-0x0000000006200000-0x0000000006276000-memory.dmpFilesize
472KB
-
memory/4092-1066-0x00000000062A0000-0x00000000062F0000-memory.dmpFilesize
320KB
-
memory/4092-1067-0x0000000004B80000-0x0000000004B90000-memory.dmpFilesize
64KB
-
memory/4092-1068-0x0000000008B00000-0x0000000008CC2000-memory.dmpFilesize
1.8MB
-
memory/4092-1069-0x0000000008CD0000-0x00000000091FC000-memory.dmpFilesize
5.2MB
-
memory/4840-1075-0x0000000000DC0000-0x0000000000DF2000-memory.dmpFilesize
200KB
-
memory/4840-1076-0x00000000056C0000-0x000000000570B000-memory.dmpFilesize
300KB
-
memory/4840-1077-0x00000000059A0000-0x00000000059B0000-memory.dmpFilesize
64KB