Analysis
-
max time kernel
57s -
max time network
82s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 19:00
Static task
static1
Behavioral task
behavioral1
Sample
8b65d3a5f4b88531f63739b53787c6c8219c38856677e3397bf32353e035c340.exe
Resource
win10v2004-20230221-en
General
-
Target
8b65d3a5f4b88531f63739b53787c6c8219c38856677e3397bf32353e035c340.exe
-
Size
521KB
-
MD5
017958dd2cfaf38ebe313a0178579ebc
-
SHA1
d1d0e6c79ddf864f36da299b124bb0ee0db4127f
-
SHA256
8b65d3a5f4b88531f63739b53787c6c8219c38856677e3397bf32353e035c340
-
SHA512
33280fd7177ae38965fd4088a8d908bf5f884f9d6ce3b49bef06efd8313bf5a86d9a58eb730c80365dc64b1e7242e3863f0a327b2d9aae3e0de1ab35c8d61c0f
-
SSDEEP
12288:QMr+y90lVBw7Nap0bv8kCGCsgdad6161hhhLuzNrl4t:+y8PnrkCWi6bXSzBl4t
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr232318.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr232318.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr232318.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr232318.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr232318.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr232318.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr232318.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/1516-158-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1516-161-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1516-159-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1516-163-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1516-165-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1516-167-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1516-169-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1516-171-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1516-173-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1516-175-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1516-177-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1516-179-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1516-181-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1516-183-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1516-185-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1516-187-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1516-189-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1516-191-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1516-193-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1516-195-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1516-197-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1516-199-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1516-201-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1516-203-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1516-205-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1516-207-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1516-209-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1516-211-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1516-213-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1516-215-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1516-217-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1516-219-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/1516-221-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
ziOC2938.exejr232318.exeku514166.exelr100548.exepid process 4760 ziOC2938.exe 3228 jr232318.exe 1516 ku514166.exe 1792 lr100548.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr232318.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr232318.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
ziOC2938.exe8b65d3a5f4b88531f63739b53787c6c8219c38856677e3397bf32353e035c340.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziOC2938.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziOC2938.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 8b65d3a5f4b88531f63739b53787c6c8219c38856677e3397bf32353e035c340.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 8b65d3a5f4b88531f63739b53787c6c8219c38856677e3397bf32353e035c340.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3944 1516 WerFault.exe ku514166.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr232318.exeku514166.exelr100548.exepid process 3228 jr232318.exe 3228 jr232318.exe 1516 ku514166.exe 1516 ku514166.exe 1792 lr100548.exe 1792 lr100548.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr232318.exeku514166.exelr100548.exedescription pid process Token: SeDebugPrivilege 3228 jr232318.exe Token: SeDebugPrivilege 1516 ku514166.exe Token: SeDebugPrivilege 1792 lr100548.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
8b65d3a5f4b88531f63739b53787c6c8219c38856677e3397bf32353e035c340.exeziOC2938.exedescription pid process target process PID 2592 wrote to memory of 4760 2592 8b65d3a5f4b88531f63739b53787c6c8219c38856677e3397bf32353e035c340.exe ziOC2938.exe PID 2592 wrote to memory of 4760 2592 8b65d3a5f4b88531f63739b53787c6c8219c38856677e3397bf32353e035c340.exe ziOC2938.exe PID 2592 wrote to memory of 4760 2592 8b65d3a5f4b88531f63739b53787c6c8219c38856677e3397bf32353e035c340.exe ziOC2938.exe PID 4760 wrote to memory of 3228 4760 ziOC2938.exe jr232318.exe PID 4760 wrote to memory of 3228 4760 ziOC2938.exe jr232318.exe PID 4760 wrote to memory of 1516 4760 ziOC2938.exe ku514166.exe PID 4760 wrote to memory of 1516 4760 ziOC2938.exe ku514166.exe PID 4760 wrote to memory of 1516 4760 ziOC2938.exe ku514166.exe PID 2592 wrote to memory of 1792 2592 8b65d3a5f4b88531f63739b53787c6c8219c38856677e3397bf32353e035c340.exe lr100548.exe PID 2592 wrote to memory of 1792 2592 8b65d3a5f4b88531f63739b53787c6c8219c38856677e3397bf32353e035c340.exe lr100548.exe PID 2592 wrote to memory of 1792 2592 8b65d3a5f4b88531f63739b53787c6c8219c38856677e3397bf32353e035c340.exe lr100548.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b65d3a5f4b88531f63739b53787c6c8219c38856677e3397bf32353e035c340.exe"C:\Users\Admin\AppData\Local\Temp\8b65d3a5f4b88531f63739b53787c6c8219c38856677e3397bf32353e035c340.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziOC2938.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziOC2938.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr232318.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr232318.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku514166.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku514166.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1516 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 15884⤵
- Program crash
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr100548.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr100548.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1792
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1516 -ip 15161⤵PID:4140
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr100548.exeFilesize
175KB
MD56cc515e87dcc47fb7a22adf519ee78a3
SHA1001b620c46a81199d197e9cbebbe316004b2d7f4
SHA256116739abf6789481517d4c1830ff32e61021981ef7ec2262afe7ff36a3fb0f4f
SHA512b24bf63ad54544fa6b89deeebe3cc1e4ce308a84a125506c9052d42c485b49047aa23015eabfa0ab40b335f7b201ec00cd70114c135f2a2cf036bf4375d818a5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr100548.exeFilesize
175KB
MD56cc515e87dcc47fb7a22adf519ee78a3
SHA1001b620c46a81199d197e9cbebbe316004b2d7f4
SHA256116739abf6789481517d4c1830ff32e61021981ef7ec2262afe7ff36a3fb0f4f
SHA512b24bf63ad54544fa6b89deeebe3cc1e4ce308a84a125506c9052d42c485b49047aa23015eabfa0ab40b335f7b201ec00cd70114c135f2a2cf036bf4375d818a5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziOC2938.exeFilesize
379KB
MD58130044302aee73f7c8f9e4af9809dca
SHA14d47732c7a5033f47c306091d6a20e7f736c9563
SHA25602d5e5008de423ee43a0aaca9931260f9a5888eb6439640e34da7dd9f81fd1eb
SHA51236a5b8202c596c74346ac45453c3439af447184d26d8787915d72a1889bda0e8fcadebef5f73ac47fb995f3b2e37ffa6a0d3d1cba22f434d5b007c8a3a41925b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziOC2938.exeFilesize
379KB
MD58130044302aee73f7c8f9e4af9809dca
SHA14d47732c7a5033f47c306091d6a20e7f736c9563
SHA25602d5e5008de423ee43a0aaca9931260f9a5888eb6439640e34da7dd9f81fd1eb
SHA51236a5b8202c596c74346ac45453c3439af447184d26d8787915d72a1889bda0e8fcadebef5f73ac47fb995f3b2e37ffa6a0d3d1cba22f434d5b007c8a3a41925b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr232318.exeFilesize
11KB
MD52fcca21537c2964f528bb4c3972f4c74
SHA1586e5fe69648165dfac7a2db3934da725a7442ca
SHA2566c686dc69975ce11b19e924260fbc6daea1eb633ed906622dbdca225eec71978
SHA5129ee2023659f2905885af2b31107eba81e9da33e2f971cd4a20252ccb99b59e9cd3a4e2253836411e8701b437c3fc275cd80e84affedc0df9eec586f3d1e97554
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr232318.exeFilesize
11KB
MD52fcca21537c2964f528bb4c3972f4c74
SHA1586e5fe69648165dfac7a2db3934da725a7442ca
SHA2566c686dc69975ce11b19e924260fbc6daea1eb633ed906622dbdca225eec71978
SHA5129ee2023659f2905885af2b31107eba81e9da33e2f971cd4a20252ccb99b59e9cd3a4e2253836411e8701b437c3fc275cd80e84affedc0df9eec586f3d1e97554
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku514166.exeFilesize
294KB
MD501cbd39c1298d1589ec43c4958ad1877
SHA1e19da91311060c6e12ce7cc9ceaceae2f6a00073
SHA25634538722cdf7f0c44fbb5e94696c4e51b00214b0186e877871568af7fc443174
SHA5121d275883b24d8cecc86d8203e29afbeed0223a1cb82d07947eaa8b313f85c557f79970f32312330f1e3c8dd920f4d28efb23d159796b563b34cc0085b7427a80
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku514166.exeFilesize
294KB
MD501cbd39c1298d1589ec43c4958ad1877
SHA1e19da91311060c6e12ce7cc9ceaceae2f6a00073
SHA25634538722cdf7f0c44fbb5e94696c4e51b00214b0186e877871568af7fc443174
SHA5121d275883b24d8cecc86d8203e29afbeed0223a1cb82d07947eaa8b313f85c557f79970f32312330f1e3c8dd920f4d28efb23d159796b563b34cc0085b7427a80
-
memory/1516-153-0x0000000000610000-0x000000000065B000-memory.dmpFilesize
300KB
-
memory/1516-154-0x0000000004BD0000-0x0000000005174000-memory.dmpFilesize
5.6MB
-
memory/1516-155-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/1516-156-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/1516-157-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/1516-158-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1516-161-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1516-159-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1516-163-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1516-165-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1516-167-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1516-169-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1516-171-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1516-173-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1516-175-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1516-177-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1516-179-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1516-181-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1516-183-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1516-185-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1516-187-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1516-189-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1516-191-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1516-193-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1516-195-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1516-197-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1516-199-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1516-201-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1516-203-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1516-205-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1516-207-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1516-209-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1516-211-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1516-213-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1516-215-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1516-217-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1516-219-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1516-221-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/1516-1064-0x0000000005180000-0x0000000005798000-memory.dmpFilesize
6.1MB
-
memory/1516-1065-0x00000000057A0000-0x00000000058AA000-memory.dmpFilesize
1.0MB
-
memory/1516-1066-0x00000000058B0000-0x00000000058C2000-memory.dmpFilesize
72KB
-
memory/1516-1067-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/1516-1068-0x00000000058D0000-0x000000000590C000-memory.dmpFilesize
240KB
-
memory/1516-1070-0x0000000005BB0000-0x0000000005C42000-memory.dmpFilesize
584KB
-
memory/1516-1071-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/1516-1072-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/1516-1073-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/1516-1074-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/1516-1075-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/1516-1076-0x0000000007860000-0x0000000007A22000-memory.dmpFilesize
1.8MB
-
memory/1516-1077-0x0000000007A30000-0x0000000007F5C000-memory.dmpFilesize
5.2MB
-
memory/1516-1078-0x0000000008010000-0x0000000008086000-memory.dmpFilesize
472KB
-
memory/1516-1079-0x00000000080A0000-0x00000000080F0000-memory.dmpFilesize
320KB
-
memory/1792-1087-0x0000000000B50000-0x0000000000B82000-memory.dmpFilesize
200KB
-
memory/1792-1088-0x0000000005790000-0x00000000057A0000-memory.dmpFilesize
64KB
-
memory/1792-1089-0x0000000005790000-0x00000000057A0000-memory.dmpFilesize
64KB
-
memory/3228-147-0x0000000000610000-0x000000000061A000-memory.dmpFilesize
40KB