Analysis
-
max time kernel
62s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 19:27
Static task
static1
Behavioral task
behavioral1
Sample
7fdbb82dd086bfa12770757eceafd8dd42f3cff46fb2772ffe9a3b1de04385a3.exe
Resource
win10v2004-20230220-en
General
-
Target
7fdbb82dd086bfa12770757eceafd8dd42f3cff46fb2772ffe9a3b1de04385a3.exe
-
Size
522KB
-
MD5
c94919e707efdc5122022e2effe0ac19
-
SHA1
157109d986956264c79229122828e54dcaf4fe4c
-
SHA256
7fdbb82dd086bfa12770757eceafd8dd42f3cff46fb2772ffe9a3b1de04385a3
-
SHA512
d9fcc8a827532ddb8d8b6ffe2128a4e86663d308b46c761135c5150c03caea3f36a1519cc47d4dc6f830ffd656fd5083b624da8b35a2a6e93c6c16f8bb96920e
-
SSDEEP
12288:eMrHy90x13BGAsqt6C+dEKw1LHv8uv4uvzWK3eIvZmRLevfm:5ya+5CCeR0uwu6KQheW
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr267023.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr267023.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr267023.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr267023.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr267023.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr267023.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr267023.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/4672-158-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/4672-159-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/4672-161-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/4672-163-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/4672-165-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/4672-167-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/4672-169-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/4672-171-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/4672-173-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/4672-175-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/4672-177-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/4672-179-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/4672-181-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/4672-183-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/4672-185-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/4672-187-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/4672-189-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/4672-191-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/4672-193-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/4672-195-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/4672-199-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/4672-197-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/4672-203-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/4672-205-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/4672-201-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/4672-207-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/4672-209-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/4672-211-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/4672-213-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/4672-215-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/4672-217-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/4672-219-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/4672-221-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
zipH6972.exejr267023.exeku369176.exelr832226.exepid process 1760 zipH6972.exe 1708 jr267023.exe 4672 ku369176.exe 4012 lr832226.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr267023.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr267023.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
7fdbb82dd086bfa12770757eceafd8dd42f3cff46fb2772ffe9a3b1de04385a3.exezipH6972.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 7fdbb82dd086bfa12770757eceafd8dd42f3cff46fb2772ffe9a3b1de04385a3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 7fdbb82dd086bfa12770757eceafd8dd42f3cff46fb2772ffe9a3b1de04385a3.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zipH6972.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zipH6972.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3252 4672 WerFault.exe ku369176.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr267023.exeku369176.exelr832226.exepid process 1708 jr267023.exe 1708 jr267023.exe 4672 ku369176.exe 4672 ku369176.exe 4012 lr832226.exe 4012 lr832226.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr267023.exeku369176.exelr832226.exedescription pid process Token: SeDebugPrivilege 1708 jr267023.exe Token: SeDebugPrivilege 4672 ku369176.exe Token: SeDebugPrivilege 4012 lr832226.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
7fdbb82dd086bfa12770757eceafd8dd42f3cff46fb2772ffe9a3b1de04385a3.exezipH6972.exedescription pid process target process PID 2604 wrote to memory of 1760 2604 7fdbb82dd086bfa12770757eceafd8dd42f3cff46fb2772ffe9a3b1de04385a3.exe zipH6972.exe PID 2604 wrote to memory of 1760 2604 7fdbb82dd086bfa12770757eceafd8dd42f3cff46fb2772ffe9a3b1de04385a3.exe zipH6972.exe PID 2604 wrote to memory of 1760 2604 7fdbb82dd086bfa12770757eceafd8dd42f3cff46fb2772ffe9a3b1de04385a3.exe zipH6972.exe PID 1760 wrote to memory of 1708 1760 zipH6972.exe jr267023.exe PID 1760 wrote to memory of 1708 1760 zipH6972.exe jr267023.exe PID 1760 wrote to memory of 4672 1760 zipH6972.exe ku369176.exe PID 1760 wrote to memory of 4672 1760 zipH6972.exe ku369176.exe PID 1760 wrote to memory of 4672 1760 zipH6972.exe ku369176.exe PID 2604 wrote to memory of 4012 2604 7fdbb82dd086bfa12770757eceafd8dd42f3cff46fb2772ffe9a3b1de04385a3.exe lr832226.exe PID 2604 wrote to memory of 4012 2604 7fdbb82dd086bfa12770757eceafd8dd42f3cff46fb2772ffe9a3b1de04385a3.exe lr832226.exe PID 2604 wrote to memory of 4012 2604 7fdbb82dd086bfa12770757eceafd8dd42f3cff46fb2772ffe9a3b1de04385a3.exe lr832226.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7fdbb82dd086bfa12770757eceafd8dd42f3cff46fb2772ffe9a3b1de04385a3.exe"C:\Users\Admin\AppData\Local\Temp\7fdbb82dd086bfa12770757eceafd8dd42f3cff46fb2772ffe9a3b1de04385a3.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zipH6972.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zipH6972.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr267023.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr267023.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku369176.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku369176.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 16244⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr832226.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr832226.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4672 -ip 46721⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr832226.exeFilesize
175KB
MD56cb143b7c93771669ccb13278d98ff8e
SHA10fab7bf3faae7ab8f2c50dc7a89b280a84a0513a
SHA2562d9e15d67b8cf9a620704528951513596ba0e4410cfd1f311e32ecfc4f2266aa
SHA5128627e89475f2d723ca7619b77f2b078868bcc37a9fe1100c569e579af25ef9e5b875fd0e7d3aa5129cfca4ead60b9036455882fc879184dd53dc51b3f071eb94
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr832226.exeFilesize
175KB
MD56cb143b7c93771669ccb13278d98ff8e
SHA10fab7bf3faae7ab8f2c50dc7a89b280a84a0513a
SHA2562d9e15d67b8cf9a620704528951513596ba0e4410cfd1f311e32ecfc4f2266aa
SHA5128627e89475f2d723ca7619b77f2b078868bcc37a9fe1100c569e579af25ef9e5b875fd0e7d3aa5129cfca4ead60b9036455882fc879184dd53dc51b3f071eb94
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zipH6972.exeFilesize
380KB
MD572c0c47095f77c4e6cefafb14ffaa5a4
SHA1e7e6c33ed1ef1c2deb9dde5b1e6ebb78303c1f61
SHA2563f9bae5f6298d5eb5eccd038b46ea506dde0b4b03e36225e323c79686e223b1a
SHA512312cb1397c9153b26f65817a2db44696fbd574820a50ed2dca8e57249ab16f3c4038b83aa1614a4cb5c3e542462ac30587247e5a8b78c15cda1456c83700e209
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zipH6972.exeFilesize
380KB
MD572c0c47095f77c4e6cefafb14ffaa5a4
SHA1e7e6c33ed1ef1c2deb9dde5b1e6ebb78303c1f61
SHA2563f9bae5f6298d5eb5eccd038b46ea506dde0b4b03e36225e323c79686e223b1a
SHA512312cb1397c9153b26f65817a2db44696fbd574820a50ed2dca8e57249ab16f3c4038b83aa1614a4cb5c3e542462ac30587247e5a8b78c15cda1456c83700e209
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr267023.exeFilesize
11KB
MD5735392b5ba2f302b72ca06f4c72d4057
SHA1089afec2fe1cb8a3b9d193a0bef38e3b88993552
SHA256044bf5205fe13bc0849bdaba21ae3caa330f397189c501df11b4866946859cd7
SHA5126e0da3392f42005378673d0512130af10137bb1938487ffd9866ae9b5d2cb2d625047709e7c3e8c64426885c09894cf84b3b311f5546bdf4ff11120be1158bc6
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr267023.exeFilesize
11KB
MD5735392b5ba2f302b72ca06f4c72d4057
SHA1089afec2fe1cb8a3b9d193a0bef38e3b88993552
SHA256044bf5205fe13bc0849bdaba21ae3caa330f397189c501df11b4866946859cd7
SHA5126e0da3392f42005378673d0512130af10137bb1938487ffd9866ae9b5d2cb2d625047709e7c3e8c64426885c09894cf84b3b311f5546bdf4ff11120be1158bc6
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku369176.exeFilesize
294KB
MD58ad9e1e6d26b17b91d6b1ad57384f82d
SHA139d369e523fa72127a55d0f308ea038713bdb02b
SHA256514c61861a7d759674afbbdd564e42b3b2ea968e0bad250a90a13f7489c9e943
SHA5129619d3f267c36c22d8e8b68d8a4a784ac7792b42cb896152a922c0469404fec152bf4b015496192abba3e3400ac6f1ef5ded349bf20b3c3f2badb2db4db1cea4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku369176.exeFilesize
294KB
MD58ad9e1e6d26b17b91d6b1ad57384f82d
SHA139d369e523fa72127a55d0f308ea038713bdb02b
SHA256514c61861a7d759674afbbdd564e42b3b2ea968e0bad250a90a13f7489c9e943
SHA5129619d3f267c36c22d8e8b68d8a4a784ac7792b42cb896152a922c0469404fec152bf4b015496192abba3e3400ac6f1ef5ded349bf20b3c3f2badb2db4db1cea4
-
memory/1708-147-0x0000000000990000-0x000000000099A000-memory.dmpFilesize
40KB
-
memory/4012-1085-0x0000000000DE0000-0x0000000000E12000-memory.dmpFilesize
200KB
-
memory/4012-1088-0x00000000059E0000-0x00000000059F0000-memory.dmpFilesize
64KB
-
memory/4012-1086-0x00000000059E0000-0x00000000059F0000-memory.dmpFilesize
64KB
-
memory/4672-191-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/4672-201-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/4672-157-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/4672-158-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/4672-159-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/4672-161-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/4672-163-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/4672-165-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/4672-167-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/4672-169-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/4672-171-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/4672-173-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/4672-175-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/4672-177-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/4672-179-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/4672-181-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/4672-183-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/4672-185-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/4672-187-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/4672-189-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/4672-154-0x0000000004AA0000-0x0000000005044000-memory.dmpFilesize
5.6MB
-
memory/4672-193-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/4672-195-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/4672-199-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/4672-197-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/4672-203-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/4672-205-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/4672-156-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/4672-207-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/4672-209-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/4672-211-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/4672-213-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/4672-215-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/4672-217-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/4672-219-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/4672-221-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/4672-1064-0x00000000050D0000-0x00000000056E8000-memory.dmpFilesize
6.1MB
-
memory/4672-1065-0x0000000005760000-0x000000000586A000-memory.dmpFilesize
1.0MB
-
memory/4672-1066-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/4672-1067-0x00000000058C0000-0x00000000058FC000-memory.dmpFilesize
240KB
-
memory/4672-1068-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/4672-1070-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/4672-1071-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/4672-1072-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/4672-1073-0x0000000005BB0000-0x0000000005C42000-memory.dmpFilesize
584KB
-
memory/4672-1074-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/4672-1075-0x0000000006450000-0x00000000064C6000-memory.dmpFilesize
472KB
-
memory/4672-1076-0x00000000064E0000-0x0000000006530000-memory.dmpFilesize
320KB
-
memory/4672-155-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/4672-153-0x0000000000720000-0x000000000076B000-memory.dmpFilesize
300KB
-
memory/4672-1077-0x0000000006560000-0x0000000006722000-memory.dmpFilesize
1.8MB
-
memory/4672-1078-0x0000000006730000-0x0000000006C5C000-memory.dmpFilesize
5.2MB
-
memory/4672-1079-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB