Analysis
-
max time kernel
80s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 18:45
Static task
static1
Behavioral task
behavioral1
Sample
90eeac9f4ddfc60a5038a0c1dd3ebb77580ece1a0c140829cb5c75260cab7eb2.exe
Resource
win10v2004-20230221-en
General
-
Target
90eeac9f4ddfc60a5038a0c1dd3ebb77580ece1a0c140829cb5c75260cab7eb2.exe
-
Size
521KB
-
MD5
540b33fdba2426c621f48e081548c316
-
SHA1
3c50af2db979f0240bfe06552912837de6839bcf
-
SHA256
90eeac9f4ddfc60a5038a0c1dd3ebb77580ece1a0c140829cb5c75260cab7eb2
-
SHA512
f33524209679547facca6e4ebac73bb51606a546d579cdad4893817878ebf3bb065be1c489d8479dad4628407243714adaf2321093bbc197e7ff4f6afa859599
-
SSDEEP
12288:mMr3y90x2H4Szc9buQpssvoM9/bnel6cPj0Mhce:RyXHBzo9/yssjv
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr465630.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr465630.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr465630.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr465630.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr465630.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr465630.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr465630.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 34 IoCs
Processes:
resource yara_rule behavioral1/memory/2824-155-0x0000000002450000-0x000000000248F000-memory.dmp family_redline behavioral1/memory/2824-156-0x0000000002450000-0x000000000248F000-memory.dmp family_redline behavioral1/memory/2824-158-0x0000000002450000-0x000000000248F000-memory.dmp family_redline behavioral1/memory/2824-160-0x0000000002450000-0x000000000248F000-memory.dmp family_redline behavioral1/memory/2824-164-0x0000000002450000-0x000000000248F000-memory.dmp family_redline behavioral1/memory/2824-162-0x0000000002450000-0x000000000248F000-memory.dmp family_redline behavioral1/memory/2824-166-0x0000000002450000-0x000000000248F000-memory.dmp family_redline behavioral1/memory/2824-168-0x0000000002450000-0x000000000248F000-memory.dmp family_redline behavioral1/memory/2824-170-0x0000000004DA0000-0x0000000004DB0000-memory.dmp family_redline behavioral1/memory/2824-174-0x0000000002450000-0x000000000248F000-memory.dmp family_redline behavioral1/memory/2824-171-0x0000000002450000-0x000000000248F000-memory.dmp family_redline behavioral1/memory/2824-177-0x0000000002450000-0x000000000248F000-memory.dmp family_redline behavioral1/memory/2824-179-0x0000000002450000-0x000000000248F000-memory.dmp family_redline behavioral1/memory/2824-181-0x0000000002450000-0x000000000248F000-memory.dmp family_redline behavioral1/memory/2824-183-0x0000000002450000-0x000000000248F000-memory.dmp family_redline behavioral1/memory/2824-185-0x0000000002450000-0x000000000248F000-memory.dmp family_redline behavioral1/memory/2824-187-0x0000000002450000-0x000000000248F000-memory.dmp family_redline behavioral1/memory/2824-189-0x0000000002450000-0x000000000248F000-memory.dmp family_redline behavioral1/memory/2824-191-0x0000000002450000-0x000000000248F000-memory.dmp family_redline behavioral1/memory/2824-193-0x0000000002450000-0x000000000248F000-memory.dmp family_redline behavioral1/memory/2824-195-0x0000000002450000-0x000000000248F000-memory.dmp family_redline behavioral1/memory/2824-197-0x0000000002450000-0x000000000248F000-memory.dmp family_redline behavioral1/memory/2824-199-0x0000000002450000-0x000000000248F000-memory.dmp family_redline behavioral1/memory/2824-201-0x0000000002450000-0x000000000248F000-memory.dmp family_redline behavioral1/memory/2824-203-0x0000000002450000-0x000000000248F000-memory.dmp family_redline behavioral1/memory/2824-205-0x0000000002450000-0x000000000248F000-memory.dmp family_redline behavioral1/memory/2824-207-0x0000000002450000-0x000000000248F000-memory.dmp family_redline behavioral1/memory/2824-209-0x0000000002450000-0x000000000248F000-memory.dmp family_redline behavioral1/memory/2824-211-0x0000000002450000-0x000000000248F000-memory.dmp family_redline behavioral1/memory/2824-213-0x0000000002450000-0x000000000248F000-memory.dmp family_redline behavioral1/memory/2824-215-0x0000000002450000-0x000000000248F000-memory.dmp family_redline behavioral1/memory/2824-217-0x0000000002450000-0x000000000248F000-memory.dmp family_redline behavioral1/memory/2824-219-0x0000000002450000-0x000000000248F000-memory.dmp family_redline behavioral1/memory/2824-221-0x0000000002450000-0x000000000248F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
zilB7551.exejr465630.exeku636872.exelr124358.exepid process 988 zilB7551.exe 1576 jr465630.exe 2824 ku636872.exe 1228 lr124358.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr465630.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr465630.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
90eeac9f4ddfc60a5038a0c1dd3ebb77580ece1a0c140829cb5c75260cab7eb2.exezilB7551.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 90eeac9f4ddfc60a5038a0c1dd3ebb77580ece1a0c140829cb5c75260cab7eb2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 90eeac9f4ddfc60a5038a0c1dd3ebb77580ece1a0c140829cb5c75260cab7eb2.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zilB7551.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zilB7551.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 904 2824 WerFault.exe ku636872.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr465630.exeku636872.exelr124358.exepid process 1576 jr465630.exe 1576 jr465630.exe 2824 ku636872.exe 2824 ku636872.exe 1228 lr124358.exe 1228 lr124358.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr465630.exeku636872.exelr124358.exedescription pid process Token: SeDebugPrivilege 1576 jr465630.exe Token: SeDebugPrivilege 2824 ku636872.exe Token: SeDebugPrivilege 1228 lr124358.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
90eeac9f4ddfc60a5038a0c1dd3ebb77580ece1a0c140829cb5c75260cab7eb2.exezilB7551.exedescription pid process target process PID 2884 wrote to memory of 988 2884 90eeac9f4ddfc60a5038a0c1dd3ebb77580ece1a0c140829cb5c75260cab7eb2.exe zilB7551.exe PID 2884 wrote to memory of 988 2884 90eeac9f4ddfc60a5038a0c1dd3ebb77580ece1a0c140829cb5c75260cab7eb2.exe zilB7551.exe PID 2884 wrote to memory of 988 2884 90eeac9f4ddfc60a5038a0c1dd3ebb77580ece1a0c140829cb5c75260cab7eb2.exe zilB7551.exe PID 988 wrote to memory of 1576 988 zilB7551.exe jr465630.exe PID 988 wrote to memory of 1576 988 zilB7551.exe jr465630.exe PID 988 wrote to memory of 2824 988 zilB7551.exe ku636872.exe PID 988 wrote to memory of 2824 988 zilB7551.exe ku636872.exe PID 988 wrote to memory of 2824 988 zilB7551.exe ku636872.exe PID 2884 wrote to memory of 1228 2884 90eeac9f4ddfc60a5038a0c1dd3ebb77580ece1a0c140829cb5c75260cab7eb2.exe lr124358.exe PID 2884 wrote to memory of 1228 2884 90eeac9f4ddfc60a5038a0c1dd3ebb77580ece1a0c140829cb5c75260cab7eb2.exe lr124358.exe PID 2884 wrote to memory of 1228 2884 90eeac9f4ddfc60a5038a0c1dd3ebb77580ece1a0c140829cb5c75260cab7eb2.exe lr124358.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\90eeac9f4ddfc60a5038a0c1dd3ebb77580ece1a0c140829cb5c75260cab7eb2.exe"C:\Users\Admin\AppData\Local\Temp\90eeac9f4ddfc60a5038a0c1dd3ebb77580ece1a0c140829cb5c75260cab7eb2.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zilB7551.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zilB7551.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr465630.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr465630.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku636872.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku636872.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2824 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 18484⤵
- Program crash
PID:904 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr124358.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr124358.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1228
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2824 -ip 28241⤵PID:956
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr124358.exeFilesize
175KB
MD53b738422edb62e51ccf4d1c299f717aa
SHA1bd5a204a877f28f031a06006e39b8717147821a1
SHA256bdc50b7a510375e40aff8f42ee5c0b8b309e137b995df9da2773895da620e8c5
SHA5129013e2580fffce5664ac5cac1c9f1aa922936120171c6cf19f288356feea0cbdf6b213388f8770d8fe2f554492a5c0dc9fcc1b50e06a24c09688679e00e23c03
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr124358.exeFilesize
175KB
MD53b738422edb62e51ccf4d1c299f717aa
SHA1bd5a204a877f28f031a06006e39b8717147821a1
SHA256bdc50b7a510375e40aff8f42ee5c0b8b309e137b995df9da2773895da620e8c5
SHA5129013e2580fffce5664ac5cac1c9f1aa922936120171c6cf19f288356feea0cbdf6b213388f8770d8fe2f554492a5c0dc9fcc1b50e06a24c09688679e00e23c03
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zilB7551.exeFilesize
379KB
MD5f9c5048b4e4e50be4274cc5f9cad6104
SHA19e12120501466e3b0402a39c4c43eea0163aae6e
SHA25638dd9b5186868cc99b3a86a434035181b718a551ef2f918e96e8d7fc64244b47
SHA5126d531a31886405168fec897c49b50f36ea34cd061089fd0a3314a5c1d04fdd8d36a32b14576593d0b1b70072003c7860f14659f34e0b0b949a0c201dfc0452dd
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zilB7551.exeFilesize
379KB
MD5f9c5048b4e4e50be4274cc5f9cad6104
SHA19e12120501466e3b0402a39c4c43eea0163aae6e
SHA25638dd9b5186868cc99b3a86a434035181b718a551ef2f918e96e8d7fc64244b47
SHA5126d531a31886405168fec897c49b50f36ea34cd061089fd0a3314a5c1d04fdd8d36a32b14576593d0b1b70072003c7860f14659f34e0b0b949a0c201dfc0452dd
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr465630.exeFilesize
11KB
MD5cf613c5e0327d1b0a8439d681c613469
SHA1d22be906d44bc3ac386d61f186b77ec963bdb311
SHA256748b83d0ceff671bba3f339a707c7d547731ffeb93f3ba0dcd753026ece1bb44
SHA5123505b4bba56428794dc1281143fb190832009d72579b613fe7f063129055a286a3865bf035c23a84bcb878536801aa3e98516adcd1dbcd3518190f7aab46b0e9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr465630.exeFilesize
11KB
MD5cf613c5e0327d1b0a8439d681c613469
SHA1d22be906d44bc3ac386d61f186b77ec963bdb311
SHA256748b83d0ceff671bba3f339a707c7d547731ffeb93f3ba0dcd753026ece1bb44
SHA5123505b4bba56428794dc1281143fb190832009d72579b613fe7f063129055a286a3865bf035c23a84bcb878536801aa3e98516adcd1dbcd3518190f7aab46b0e9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku636872.exeFilesize
294KB
MD545f634309c62b31656c694ab5b346947
SHA17913c387e57b92387cadd2c1e15926aa24bd0ece
SHA25608274ca23c384460941eab3fc583709159223c49e53fd3fa8785b49bdb60339d
SHA51239ab31e5eac3873e11e602d09a2431bb532c058cc64d43f403afc382885aed21d33c126ee205eb42ccba1d9028b5570d3b55f622dad997639119d636bcabb138
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku636872.exeFilesize
294KB
MD545f634309c62b31656c694ab5b346947
SHA17913c387e57b92387cadd2c1e15926aa24bd0ece
SHA25608274ca23c384460941eab3fc583709159223c49e53fd3fa8785b49bdb60339d
SHA51239ab31e5eac3873e11e602d09a2431bb532c058cc64d43f403afc382885aed21d33c126ee205eb42ccba1d9028b5570d3b55f622dad997639119d636bcabb138
-
memory/1228-1084-0x0000000000A50000-0x0000000000A82000-memory.dmpFilesize
200KB
-
memory/1228-1085-0x0000000005300000-0x0000000005310000-memory.dmpFilesize
64KB
-
memory/1576-147-0x0000000000F00000-0x0000000000F0A000-memory.dmpFilesize
40KB
-
memory/2824-187-0x0000000002450000-0x000000000248F000-memory.dmpFilesize
252KB
-
memory/2824-199-0x0000000002450000-0x000000000248F000-memory.dmpFilesize
252KB
-
memory/2824-156-0x0000000002450000-0x000000000248F000-memory.dmpFilesize
252KB
-
memory/2824-158-0x0000000002450000-0x000000000248F000-memory.dmpFilesize
252KB
-
memory/2824-160-0x0000000002450000-0x000000000248F000-memory.dmpFilesize
252KB
-
memory/2824-164-0x0000000002450000-0x000000000248F000-memory.dmpFilesize
252KB
-
memory/2824-162-0x0000000002450000-0x000000000248F000-memory.dmpFilesize
252KB
-
memory/2824-166-0x0000000002450000-0x000000000248F000-memory.dmpFilesize
252KB
-
memory/2824-168-0x0000000002450000-0x000000000248F000-memory.dmpFilesize
252KB
-
memory/2824-170-0x0000000004DA0000-0x0000000004DB0000-memory.dmpFilesize
64KB
-
memory/2824-172-0x0000000004DA0000-0x0000000004DB0000-memory.dmpFilesize
64KB
-
memory/2824-174-0x0000000002450000-0x000000000248F000-memory.dmpFilesize
252KB
-
memory/2824-171-0x0000000002450000-0x000000000248F000-memory.dmpFilesize
252KB
-
memory/2824-175-0x0000000004DA0000-0x0000000004DB0000-memory.dmpFilesize
64KB
-
memory/2824-177-0x0000000002450000-0x000000000248F000-memory.dmpFilesize
252KB
-
memory/2824-179-0x0000000002450000-0x000000000248F000-memory.dmpFilesize
252KB
-
memory/2824-181-0x0000000002450000-0x000000000248F000-memory.dmpFilesize
252KB
-
memory/2824-183-0x0000000002450000-0x000000000248F000-memory.dmpFilesize
252KB
-
memory/2824-185-0x0000000002450000-0x000000000248F000-memory.dmpFilesize
252KB
-
memory/2824-154-0x0000000004DB0000-0x0000000005354000-memory.dmpFilesize
5.6MB
-
memory/2824-189-0x0000000002450000-0x000000000248F000-memory.dmpFilesize
252KB
-
memory/2824-191-0x0000000002450000-0x000000000248F000-memory.dmpFilesize
252KB
-
memory/2824-193-0x0000000002450000-0x000000000248F000-memory.dmpFilesize
252KB
-
memory/2824-195-0x0000000002450000-0x000000000248F000-memory.dmpFilesize
252KB
-
memory/2824-197-0x0000000002450000-0x000000000248F000-memory.dmpFilesize
252KB
-
memory/2824-155-0x0000000002450000-0x000000000248F000-memory.dmpFilesize
252KB
-
memory/2824-201-0x0000000002450000-0x000000000248F000-memory.dmpFilesize
252KB
-
memory/2824-203-0x0000000002450000-0x000000000248F000-memory.dmpFilesize
252KB
-
memory/2824-205-0x0000000002450000-0x000000000248F000-memory.dmpFilesize
252KB
-
memory/2824-207-0x0000000002450000-0x000000000248F000-memory.dmpFilesize
252KB
-
memory/2824-209-0x0000000002450000-0x000000000248F000-memory.dmpFilesize
252KB
-
memory/2824-211-0x0000000002450000-0x000000000248F000-memory.dmpFilesize
252KB
-
memory/2824-213-0x0000000002450000-0x000000000248F000-memory.dmpFilesize
252KB
-
memory/2824-215-0x0000000002450000-0x000000000248F000-memory.dmpFilesize
252KB
-
memory/2824-217-0x0000000002450000-0x000000000248F000-memory.dmpFilesize
252KB
-
memory/2824-219-0x0000000002450000-0x000000000248F000-memory.dmpFilesize
252KB
-
memory/2824-221-0x0000000002450000-0x000000000248F000-memory.dmpFilesize
252KB
-
memory/2824-1064-0x0000000005360000-0x0000000005978000-memory.dmpFilesize
6.1MB
-
memory/2824-1065-0x0000000004C00000-0x0000000004D0A000-memory.dmpFilesize
1.0MB
-
memory/2824-1066-0x0000000002660000-0x0000000002672000-memory.dmpFilesize
72KB
-
memory/2824-1067-0x0000000004D10000-0x0000000004D4C000-memory.dmpFilesize
240KB
-
memory/2824-1068-0x0000000004DA0000-0x0000000004DB0000-memory.dmpFilesize
64KB
-
memory/2824-1070-0x0000000005BB0000-0x0000000005C16000-memory.dmpFilesize
408KB
-
memory/2824-1071-0x0000000006270000-0x0000000006302000-memory.dmpFilesize
584KB
-
memory/2824-1072-0x0000000004DA0000-0x0000000004DB0000-memory.dmpFilesize
64KB
-
memory/2824-1073-0x0000000004DA0000-0x0000000004DB0000-memory.dmpFilesize
64KB
-
memory/2824-1074-0x0000000006470000-0x00000000064E6000-memory.dmpFilesize
472KB
-
memory/2824-1075-0x00000000064F0000-0x0000000006540000-memory.dmpFilesize
320KB
-
memory/2824-153-0x0000000000610000-0x000000000065B000-memory.dmpFilesize
300KB
-
memory/2824-1076-0x0000000006560000-0x0000000006722000-memory.dmpFilesize
1.8MB
-
memory/2824-1077-0x0000000006730000-0x0000000006C5C000-memory.dmpFilesize
5.2MB
-
memory/2824-1078-0x0000000004DA0000-0x0000000004DB0000-memory.dmpFilesize
64KB