Analysis
-
max time kernel
135s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 19:26
Static task
static1
Behavioral task
behavioral1
Sample
7431387e71dad27accaacae638cfab121ff5b9909f8685a983ccb42a5626875a.exe
Resource
win10v2004-20230220-en
General
-
Target
7431387e71dad27accaacae638cfab121ff5b9909f8685a983ccb42a5626875a.exe
-
Size
663KB
-
MD5
be085753bb2e63c4f06cd5637d48af62
-
SHA1
5dffce4eaad9fe7a2e134e2f56ae5587757dad8d
-
SHA256
7431387e71dad27accaacae638cfab121ff5b9909f8685a983ccb42a5626875a
-
SHA512
6f788a26a5533b538d4a1dea1221f4ec456be639eb9291a36de32e41f0eddd2255c86d034e4ceaac5f822af5c0c21001f7e271e56bb00130467068e07a7a2cdb
-
SSDEEP
12288:vMrey90LA3X81JlypN8IKDW1HldjdO/kanLh8i/0L0v444zWKhBqHe4k0:dyIA+2NoK1HHjdOpVhq0w4xKhB2
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro9176.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro9176.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro9176.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro9176.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro9176.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro9176.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro9176.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/2220-191-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2220-192-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2220-194-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2220-196-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2220-198-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2220-200-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2220-205-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2220-208-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2220-210-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2220-212-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2220-214-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2220-216-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2220-218-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2220-220-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2220-222-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2220-224-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2220-226-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2220-228-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un761096.exepro9176.exequ3148.exesi499279.exepid process 1304 un761096.exe 1100 pro9176.exe 2220 qu3148.exe 1404 si499279.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro9176.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro9176.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro9176.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
7431387e71dad27accaacae638cfab121ff5b9909f8685a983ccb42a5626875a.exeun761096.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 7431387e71dad27accaacae638cfab121ff5b9909f8685a983ccb42a5626875a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 7431387e71dad27accaacae638cfab121ff5b9909f8685a983ccb42a5626875a.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un761096.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un761096.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 652 1100 WerFault.exe pro9176.exe 1148 2220 WerFault.exe qu3148.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro9176.exequ3148.exesi499279.exepid process 1100 pro9176.exe 1100 pro9176.exe 2220 qu3148.exe 2220 qu3148.exe 1404 si499279.exe 1404 si499279.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro9176.exequ3148.exesi499279.exedescription pid process Token: SeDebugPrivilege 1100 pro9176.exe Token: SeDebugPrivilege 2220 qu3148.exe Token: SeDebugPrivilege 1404 si499279.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
7431387e71dad27accaacae638cfab121ff5b9909f8685a983ccb42a5626875a.exeun761096.exedescription pid process target process PID 1428 wrote to memory of 1304 1428 7431387e71dad27accaacae638cfab121ff5b9909f8685a983ccb42a5626875a.exe un761096.exe PID 1428 wrote to memory of 1304 1428 7431387e71dad27accaacae638cfab121ff5b9909f8685a983ccb42a5626875a.exe un761096.exe PID 1428 wrote to memory of 1304 1428 7431387e71dad27accaacae638cfab121ff5b9909f8685a983ccb42a5626875a.exe un761096.exe PID 1304 wrote to memory of 1100 1304 un761096.exe pro9176.exe PID 1304 wrote to memory of 1100 1304 un761096.exe pro9176.exe PID 1304 wrote to memory of 1100 1304 un761096.exe pro9176.exe PID 1304 wrote to memory of 2220 1304 un761096.exe qu3148.exe PID 1304 wrote to memory of 2220 1304 un761096.exe qu3148.exe PID 1304 wrote to memory of 2220 1304 un761096.exe qu3148.exe PID 1428 wrote to memory of 1404 1428 7431387e71dad27accaacae638cfab121ff5b9909f8685a983ccb42a5626875a.exe si499279.exe PID 1428 wrote to memory of 1404 1428 7431387e71dad27accaacae638cfab121ff5b9909f8685a983ccb42a5626875a.exe si499279.exe PID 1428 wrote to memory of 1404 1428 7431387e71dad27accaacae638cfab121ff5b9909f8685a983ccb42a5626875a.exe si499279.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7431387e71dad27accaacae638cfab121ff5b9909f8685a983ccb42a5626875a.exe"C:\Users\Admin\AppData\Local\Temp\7431387e71dad27accaacae638cfab121ff5b9909f8685a983ccb42a5626875a.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un761096.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un761096.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9176.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9176.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1100 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 10804⤵
- Program crash
PID:652 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3148.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3148.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2220 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 19764⤵
- Program crash
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si499279.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si499279.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1404
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1100 -ip 11001⤵PID:2152
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2220 -ip 22201⤵PID:1128
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si499279.exeFilesize
175KB
MD5029b360c657d0dee6930a88473976fe6
SHA100f0c461222eab3a9f080c67389610f6c84b3553
SHA256c3f3f200da83a970cd4d82f03fb29661373e2893d9fe67b24138fba6a982ce2a
SHA512699a43650999a426d5ead653f10f07c0b0229446a9b2f926706fa9376275d872e6376ce4a0daf7d6fe1a9bf04b97024a18b3d3c921fbfe6a0bbd43742f906080
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si499279.exeFilesize
175KB
MD5029b360c657d0dee6930a88473976fe6
SHA100f0c461222eab3a9f080c67389610f6c84b3553
SHA256c3f3f200da83a970cd4d82f03fb29661373e2893d9fe67b24138fba6a982ce2a
SHA512699a43650999a426d5ead653f10f07c0b0229446a9b2f926706fa9376275d872e6376ce4a0daf7d6fe1a9bf04b97024a18b3d3c921fbfe6a0bbd43742f906080
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un761096.exeFilesize
521KB
MD56d149feb94e8fc7f2999c8877926ecb8
SHA155b31a684a1e2e8189141c3833619a5071659967
SHA25696b1a222e2d90f25fef4649535357851870136ea04936347095f53e6a32cf84a
SHA512e2d66d9f0abb11d307331bc24ab3400cbdb5c748f5f3f1d3c769dd7f7f16ee94b23bf44134d5023820f9a39971b5eff24fc66ebfa01466b38f8741ec15d8a9af
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un761096.exeFilesize
521KB
MD56d149feb94e8fc7f2999c8877926ecb8
SHA155b31a684a1e2e8189141c3833619a5071659967
SHA25696b1a222e2d90f25fef4649535357851870136ea04936347095f53e6a32cf84a
SHA512e2d66d9f0abb11d307331bc24ab3400cbdb5c748f5f3f1d3c769dd7f7f16ee94b23bf44134d5023820f9a39971b5eff24fc66ebfa01466b38f8741ec15d8a9af
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9176.exeFilesize
236KB
MD558d5bdfcb8105d48cf7afda4a97aedda
SHA139feb9a86e7681c2e415b8bc2e43bfcf9fe79858
SHA2562b63576952b8e844b80cbe6e5c594c23a639bbc4f973cdbf1c893d4946420f63
SHA5128d0de6b01e3cafdab6b5d892250eea4f649c0a6b7bf6976ff1390ad7a350ae2668bd5d4eb33939ac1555b8b7002ef3b11122f982d2152bee40f5abbddbdff42d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9176.exeFilesize
236KB
MD558d5bdfcb8105d48cf7afda4a97aedda
SHA139feb9a86e7681c2e415b8bc2e43bfcf9fe79858
SHA2562b63576952b8e844b80cbe6e5c594c23a639bbc4f973cdbf1c893d4946420f63
SHA5128d0de6b01e3cafdab6b5d892250eea4f649c0a6b7bf6976ff1390ad7a350ae2668bd5d4eb33939ac1555b8b7002ef3b11122f982d2152bee40f5abbddbdff42d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3148.exeFilesize
294KB
MD569cbcf634fa12adc90baca3052315180
SHA1d3c8fd4e22805e67a24991c6ddce53da3f0adfac
SHA256cbaa3efb1e820c70f3746d982723df077cba47fbcf9ad7c4dafb9fdd0714792e
SHA512dd3403e0a1053d206c2d11f344bf1cbcedd0ce82eee303f70ec12ec14c91b37bf71671b1bc46e6fa32d172118d0a94e206541d84095206302f73376f02505464
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3148.exeFilesize
294KB
MD569cbcf634fa12adc90baca3052315180
SHA1d3c8fd4e22805e67a24991c6ddce53da3f0adfac
SHA256cbaa3efb1e820c70f3746d982723df077cba47fbcf9ad7c4dafb9fdd0714792e
SHA512dd3403e0a1053d206c2d11f344bf1cbcedd0ce82eee303f70ec12ec14c91b37bf71671b1bc46e6fa32d172118d0a94e206541d84095206302f73376f02505464
-
memory/1100-148-0x00000000005E0000-0x000000000060D000-memory.dmpFilesize
180KB
-
memory/1100-149-0x0000000004BC0000-0x0000000005164000-memory.dmpFilesize
5.6MB
-
memory/1100-150-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/1100-151-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/1100-152-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/1100-153-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/1100-154-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/1100-156-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/1100-158-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/1100-160-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/1100-162-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/1100-164-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/1100-166-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/1100-168-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/1100-170-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/1100-172-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/1100-174-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/1100-176-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/1100-178-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/1100-180-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/1100-181-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1100-182-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/1100-183-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/1100-184-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/1100-186-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1404-1122-0x0000000000830000-0x0000000000862000-memory.dmpFilesize
200KB
-
memory/1404-1123-0x00000000050F0000-0x0000000005100000-memory.dmpFilesize
64KB
-
memory/2220-194-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2220-226-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2220-196-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2220-198-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2220-200-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2220-201-0x00000000020D0000-0x000000000211B000-memory.dmpFilesize
300KB
-
memory/2220-202-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/2220-206-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/2220-205-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2220-204-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/2220-208-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2220-210-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2220-212-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2220-214-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2220-216-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2220-218-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2220-220-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2220-222-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2220-224-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2220-192-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2220-228-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2220-1101-0x0000000005190000-0x00000000057A8000-memory.dmpFilesize
6.1MB
-
memory/2220-1102-0x00000000057B0000-0x00000000058BA000-memory.dmpFilesize
1.0MB
-
memory/2220-1103-0x0000000004BB0000-0x0000000004BC2000-memory.dmpFilesize
72KB
-
memory/2220-1104-0x00000000058C0000-0x00000000058FC000-memory.dmpFilesize
240KB
-
memory/2220-1105-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/2220-1106-0x0000000005BB0000-0x0000000005C16000-memory.dmpFilesize
408KB
-
memory/2220-1108-0x0000000006260000-0x00000000062F2000-memory.dmpFilesize
584KB
-
memory/2220-1109-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/2220-1110-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/2220-1111-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/2220-1112-0x0000000006470000-0x00000000064E6000-memory.dmpFilesize
472KB
-
memory/2220-1113-0x0000000006500000-0x0000000006550000-memory.dmpFilesize
320KB
-
memory/2220-191-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2220-1114-0x0000000006560000-0x0000000006722000-memory.dmpFilesize
1.8MB
-
memory/2220-1115-0x0000000006740000-0x0000000006C6C000-memory.dmpFilesize
5.2MB
-
memory/2220-1116-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB