Analysis
-
max time kernel
81s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 19:33
Static task
static1
Behavioral task
behavioral1
Sample
e92b0cc092c9c7914b83763e94a21012475de714fe75e598180b0ff102750cbf.exe
Resource
win10v2004-20230220-en
General
-
Target
e92b0cc092c9c7914b83763e94a21012475de714fe75e598180b0ff102750cbf.exe
-
Size
522KB
-
MD5
c2fd105f680a1c217cee5bb092a99651
-
SHA1
276c75cfb2505e98346226edd0d302c41188d0aa
-
SHA256
e92b0cc092c9c7914b83763e94a21012475de714fe75e598180b0ff102750cbf
-
SHA512
6b58f9df5b0ce8d7e1926a022cf145055284080f8c218087b593bd80b46e54e692603609e91e18f71c66b66108e6e61b2644a55c575a759eda789d4a4bfe9bc1
-
SSDEEP
12288:lMrVy903BBzPZFO2pbi5YpNJp8AO4eyzWK2OgvlKLMmc:cygB1TLKYp2AnerKfpc
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr309729.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr309729.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr309729.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr309729.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr309729.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr309729.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr309729.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/1404-157-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1404-158-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1404-160-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1404-162-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1404-164-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1404-166-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1404-168-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1404-170-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1404-172-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1404-174-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1404-176-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1404-178-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1404-180-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1404-182-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1404-184-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1404-186-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1404-188-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1404-190-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1404-192-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1404-194-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1404-196-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1404-198-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1404-200-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1404-202-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1404-204-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1404-206-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1404-208-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1404-210-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1404-214-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1404-216-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1404-212-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1404-218-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/1404-220-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
zijp1884.exejr309729.exeku682206.exelr463218.exepid process 3832 zijp1884.exe 3076 jr309729.exe 1404 ku682206.exe 1296 lr463218.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr309729.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr309729.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
e92b0cc092c9c7914b83763e94a21012475de714fe75e598180b0ff102750cbf.exezijp1884.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce e92b0cc092c9c7914b83763e94a21012475de714fe75e598180b0ff102750cbf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" e92b0cc092c9c7914b83763e94a21012475de714fe75e598180b0ff102750cbf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zijp1884.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zijp1884.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4488 1404 WerFault.exe ku682206.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr309729.exeku682206.exelr463218.exepid process 3076 jr309729.exe 3076 jr309729.exe 1404 ku682206.exe 1404 ku682206.exe 1296 lr463218.exe 1296 lr463218.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr309729.exeku682206.exelr463218.exedescription pid process Token: SeDebugPrivilege 3076 jr309729.exe Token: SeDebugPrivilege 1404 ku682206.exe Token: SeDebugPrivilege 1296 lr463218.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
e92b0cc092c9c7914b83763e94a21012475de714fe75e598180b0ff102750cbf.exezijp1884.exedescription pid process target process PID 5084 wrote to memory of 3832 5084 e92b0cc092c9c7914b83763e94a21012475de714fe75e598180b0ff102750cbf.exe zijp1884.exe PID 5084 wrote to memory of 3832 5084 e92b0cc092c9c7914b83763e94a21012475de714fe75e598180b0ff102750cbf.exe zijp1884.exe PID 5084 wrote to memory of 3832 5084 e92b0cc092c9c7914b83763e94a21012475de714fe75e598180b0ff102750cbf.exe zijp1884.exe PID 3832 wrote to memory of 3076 3832 zijp1884.exe jr309729.exe PID 3832 wrote to memory of 3076 3832 zijp1884.exe jr309729.exe PID 3832 wrote to memory of 1404 3832 zijp1884.exe ku682206.exe PID 3832 wrote to memory of 1404 3832 zijp1884.exe ku682206.exe PID 3832 wrote to memory of 1404 3832 zijp1884.exe ku682206.exe PID 5084 wrote to memory of 1296 5084 e92b0cc092c9c7914b83763e94a21012475de714fe75e598180b0ff102750cbf.exe lr463218.exe PID 5084 wrote to memory of 1296 5084 e92b0cc092c9c7914b83763e94a21012475de714fe75e598180b0ff102750cbf.exe lr463218.exe PID 5084 wrote to memory of 1296 5084 e92b0cc092c9c7914b83763e94a21012475de714fe75e598180b0ff102750cbf.exe lr463218.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e92b0cc092c9c7914b83763e94a21012475de714fe75e598180b0ff102750cbf.exe"C:\Users\Admin\AppData\Local\Temp\e92b0cc092c9c7914b83763e94a21012475de714fe75e598180b0ff102750cbf.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zijp1884.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zijp1884.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr309729.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr309729.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku682206.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku682206.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 11444⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr463218.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr463218.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1404 -ip 14041⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr463218.exeFilesize
175KB
MD57d84d3e2e541917d584eb781d639e15e
SHA15b6c5e50e4acb8f3beb4e368f482c70b90f9f818
SHA2563c720e64fd38017e44161a8c6d332365cb569a174301eaf6e5b462a01c1cf50a
SHA5122c45afbd8ef3b435eb77af1426896aae8641c179bcb428e09770a89f5c5b07cd93ab8ee498ab9e7dab0cee534d484f36ace88bb6b90f27e1240cc9f3c0d3d8a2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr463218.exeFilesize
175KB
MD57d84d3e2e541917d584eb781d639e15e
SHA15b6c5e50e4acb8f3beb4e368f482c70b90f9f818
SHA2563c720e64fd38017e44161a8c6d332365cb569a174301eaf6e5b462a01c1cf50a
SHA5122c45afbd8ef3b435eb77af1426896aae8641c179bcb428e09770a89f5c5b07cd93ab8ee498ab9e7dab0cee534d484f36ace88bb6b90f27e1240cc9f3c0d3d8a2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zijp1884.exeFilesize
380KB
MD5e12f45295033aa2007e59d4bf31a51a6
SHA1acd178dcbd2461e2e83a01ae641efdfeb94cee6a
SHA2563a65179939162f832f06a482160b9f564d0cdf93f8e59c924eb746a79c35c4c1
SHA512442b8326a790fa3d0c2654d152320c1886c0397eb85b3a5d3c029082d7fe7740321a0ebeee8e18d62d3d48b44a2c9a5437dd0fd67d16c288ed63b295a97a3f8b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zijp1884.exeFilesize
380KB
MD5e12f45295033aa2007e59d4bf31a51a6
SHA1acd178dcbd2461e2e83a01ae641efdfeb94cee6a
SHA2563a65179939162f832f06a482160b9f564d0cdf93f8e59c924eb746a79c35c4c1
SHA512442b8326a790fa3d0c2654d152320c1886c0397eb85b3a5d3c029082d7fe7740321a0ebeee8e18d62d3d48b44a2c9a5437dd0fd67d16c288ed63b295a97a3f8b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr309729.exeFilesize
11KB
MD5843a4b4080d9062ca96d15a213f527f8
SHA19b006f7e2407b8590979a2ac018853d04755dd51
SHA2561986118c05a1ecdf7c340a707113d9d24707bed0205a572a7bc99108f39773a6
SHA512425f0a98d3f82d0beb0d76eb096071572dd38391384ec77580661794966f866d6a9576442e808360c37e8323662310e5c459a6b5682e91d27f0abb7d0ab78651
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr309729.exeFilesize
11KB
MD5843a4b4080d9062ca96d15a213f527f8
SHA19b006f7e2407b8590979a2ac018853d04755dd51
SHA2561986118c05a1ecdf7c340a707113d9d24707bed0205a572a7bc99108f39773a6
SHA512425f0a98d3f82d0beb0d76eb096071572dd38391384ec77580661794966f866d6a9576442e808360c37e8323662310e5c459a6b5682e91d27f0abb7d0ab78651
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku682206.exeFilesize
294KB
MD529a376cc9a1c55cef9abd46795cbe4ad
SHA1afb15173445ae6c4f4f147f461ebc298e58c99d2
SHA256ca99d470814a5b6d2be4137ade45331492cf790ba55a38f3df5da42d4edf3d5c
SHA512a5542d3a2e11e183c7f07a5b7da89f8a2f65bc7f3434b6e35caf6f5cb5ca8b3e0c6c04bce5c1bea4e48e790a3583b642180a9049e5a0a3716b146c8a6c884d2c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku682206.exeFilesize
294KB
MD529a376cc9a1c55cef9abd46795cbe4ad
SHA1afb15173445ae6c4f4f147f461ebc298e58c99d2
SHA256ca99d470814a5b6d2be4137ade45331492cf790ba55a38f3df5da42d4edf3d5c
SHA512a5542d3a2e11e183c7f07a5b7da89f8a2f65bc7f3434b6e35caf6f5cb5ca8b3e0c6c04bce5c1bea4e48e790a3583b642180a9049e5a0a3716b146c8a6c884d2c
-
memory/1296-1082-0x0000000000340000-0x0000000000372000-memory.dmpFilesize
200KB
-
memory/1296-1083-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/1404-188-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1404-198-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1404-155-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/1404-156-0x0000000004B00000-0x00000000050A4000-memory.dmpFilesize
5.6MB
-
memory/1404-157-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1404-158-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1404-160-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1404-162-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1404-164-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1404-166-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1404-168-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1404-170-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1404-172-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1404-174-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1404-176-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1404-178-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1404-180-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1404-182-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1404-184-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1404-186-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1404-153-0x0000000000590000-0x00000000005DB000-memory.dmpFilesize
300KB
-
memory/1404-190-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1404-192-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1404-194-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1404-196-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1404-154-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/1404-200-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1404-202-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1404-204-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1404-206-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1404-208-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1404-210-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1404-214-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1404-216-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1404-212-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1404-218-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1404-220-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/1404-1063-0x0000000005200000-0x0000000005818000-memory.dmpFilesize
6.1MB
-
memory/1404-1064-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/1404-1065-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/1404-1066-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/1404-1067-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/1404-1069-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/1404-1070-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/1404-1071-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/1404-1072-0x00000000064B0000-0x0000000006672000-memory.dmpFilesize
1.8MB
-
memory/1404-1073-0x0000000006680000-0x0000000006BAC000-memory.dmpFilesize
5.2MB
-
memory/1404-1074-0x0000000002550000-0x00000000025C6000-memory.dmpFilesize
472KB
-
memory/1404-1075-0x00000000080E0000-0x0000000008130000-memory.dmpFilesize
320KB
-
memory/1404-1076-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/3076-147-0x0000000000A60000-0x0000000000A6A000-memory.dmpFilesize
40KB