Analysis
-
max time kernel
111s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 19:01
Static task
static1
Behavioral task
behavioral1
Sample
accf37a414e0ea67399c8f87806adf1c67986b01e3c02ac8ce31d38087a768c3.exe
Resource
win10v2004-20230220-en
General
-
Target
accf37a414e0ea67399c8f87806adf1c67986b01e3c02ac8ce31d38087a768c3.exe
-
Size
521KB
-
MD5
7253957c787a6353c93c293a61e2e2c2
-
SHA1
29d16a2e094c3a5968fe495136043886122a1723
-
SHA256
accf37a414e0ea67399c8f87806adf1c67986b01e3c02ac8ce31d38087a768c3
-
SHA512
93b77d5a15454ad7939dcacb8cf65a147eec9a9b62044819d0e2e501729ac37adf60e8323aa018620b01adeaa72f71f920e8adb447672d1a65a2e33d33e341b8
-
SSDEEP
12288:dMr5y90lhl1BP0YiW/owRkkFm//b5sl6ZlP6OAG/:YyAdQ8q//isZ5Vf
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr573101.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr573101.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr573101.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr573101.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr573101.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr573101.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr573101.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/748-158-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/748-159-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/748-161-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/748-163-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/748-165-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/748-167-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/748-169-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/748-171-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/748-173-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/748-175-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/748-177-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/748-179-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/748-181-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/748-183-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/748-185-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/748-187-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/748-189-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/748-191-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/748-193-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/748-195-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/748-197-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/748-199-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/748-201-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/748-203-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/748-205-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/748-207-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/748-209-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/748-211-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/748-213-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/748-215-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/748-217-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/748-219-0x0000000002730000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/748-221-0x0000000002730000-0x000000000276F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
ziLv3000.exejr573101.exeku690676.exelr294243.exepid process 3152 ziLv3000.exe 1400 jr573101.exe 748 ku690676.exe 3800 lr294243.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr573101.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr573101.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
accf37a414e0ea67399c8f87806adf1c67986b01e3c02ac8ce31d38087a768c3.exeziLv3000.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce accf37a414e0ea67399c8f87806adf1c67986b01e3c02ac8ce31d38087a768c3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" accf37a414e0ea67399c8f87806adf1c67986b01e3c02ac8ce31d38087a768c3.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziLv3000.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziLv3000.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3048 748 WerFault.exe ku690676.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr573101.exeku690676.exelr294243.exepid process 1400 jr573101.exe 1400 jr573101.exe 748 ku690676.exe 748 ku690676.exe 3800 lr294243.exe 3800 lr294243.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr573101.exeku690676.exelr294243.exedescription pid process Token: SeDebugPrivilege 1400 jr573101.exe Token: SeDebugPrivilege 748 ku690676.exe Token: SeDebugPrivilege 3800 lr294243.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
accf37a414e0ea67399c8f87806adf1c67986b01e3c02ac8ce31d38087a768c3.exeziLv3000.exedescription pid process target process PID 644 wrote to memory of 3152 644 accf37a414e0ea67399c8f87806adf1c67986b01e3c02ac8ce31d38087a768c3.exe ziLv3000.exe PID 644 wrote to memory of 3152 644 accf37a414e0ea67399c8f87806adf1c67986b01e3c02ac8ce31d38087a768c3.exe ziLv3000.exe PID 644 wrote to memory of 3152 644 accf37a414e0ea67399c8f87806adf1c67986b01e3c02ac8ce31d38087a768c3.exe ziLv3000.exe PID 3152 wrote to memory of 1400 3152 ziLv3000.exe jr573101.exe PID 3152 wrote to memory of 1400 3152 ziLv3000.exe jr573101.exe PID 3152 wrote to memory of 748 3152 ziLv3000.exe ku690676.exe PID 3152 wrote to memory of 748 3152 ziLv3000.exe ku690676.exe PID 3152 wrote to memory of 748 3152 ziLv3000.exe ku690676.exe PID 644 wrote to memory of 3800 644 accf37a414e0ea67399c8f87806adf1c67986b01e3c02ac8ce31d38087a768c3.exe lr294243.exe PID 644 wrote to memory of 3800 644 accf37a414e0ea67399c8f87806adf1c67986b01e3c02ac8ce31d38087a768c3.exe lr294243.exe PID 644 wrote to memory of 3800 644 accf37a414e0ea67399c8f87806adf1c67986b01e3c02ac8ce31d38087a768c3.exe lr294243.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\accf37a414e0ea67399c8f87806adf1c67986b01e3c02ac8ce31d38087a768c3.exe"C:\Users\Admin\AppData\Local\Temp\accf37a414e0ea67399c8f87806adf1c67986b01e3c02ac8ce31d38087a768c3.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziLv3000.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziLv3000.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr573101.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr573101.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku690676.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku690676.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:748 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 13484⤵
- Program crash
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr294243.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr294243.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3800
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 748 -ip 7481⤵PID:2372
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr294243.exeFilesize
175KB
MD566cc3d39c590a734b43e525dd8ae3b1b
SHA1e779e316c7950b95959c99d27bac49448516b384
SHA256539d0cd6e82ca93b2ca7ed05d71f5a23fee39070b096339297bf00603cb2f580
SHA512c246785374da6df80066cb2dc54647bcb361d02709352759c5f7d961efb7c68b1677414322a017c2ff95f9eb0307059b8b7aecb62783786b782c09c2a9bfe8a2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr294243.exeFilesize
175KB
MD566cc3d39c590a734b43e525dd8ae3b1b
SHA1e779e316c7950b95959c99d27bac49448516b384
SHA256539d0cd6e82ca93b2ca7ed05d71f5a23fee39070b096339297bf00603cb2f580
SHA512c246785374da6df80066cb2dc54647bcb361d02709352759c5f7d961efb7c68b1677414322a017c2ff95f9eb0307059b8b7aecb62783786b782c09c2a9bfe8a2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziLv3000.exeFilesize
379KB
MD5b007e299e411de92460769825b1c0eb0
SHA15946406a0f191d8bc85b54c8b4a577c9442dd017
SHA256be4d55036cfc4574dd9de9d49578f4e9b248484003d6495ab872e3baa55c5aa1
SHA5120146e71f310182ea293c64a501cca1070e998ee301a26f70634a0f077588d7f84cfddb91a555cd9c06551deb38044c4cd961c930c2f6d804fd9fbdb9414b243d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziLv3000.exeFilesize
379KB
MD5b007e299e411de92460769825b1c0eb0
SHA15946406a0f191d8bc85b54c8b4a577c9442dd017
SHA256be4d55036cfc4574dd9de9d49578f4e9b248484003d6495ab872e3baa55c5aa1
SHA5120146e71f310182ea293c64a501cca1070e998ee301a26f70634a0f077588d7f84cfddb91a555cd9c06551deb38044c4cd961c930c2f6d804fd9fbdb9414b243d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr573101.exeFilesize
11KB
MD5ff4c50fcc5f6c49276d73e7f12f92094
SHA1dcfda58da70d1fba8ec56c8ee8d6a61ef8d777ed
SHA256235d759bf216f020ed234bf5ba325eb08521a65faa639bc263b63a56261dfd24
SHA512bbcc29e7f93e5c19c78a3b0735f59286fd1dbcc7e7aac90e04c5a8e193261726d7b332fc55178d71576a86eb403017f2efe81d93bc3ef7f7c068919531298909
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr573101.exeFilesize
11KB
MD5ff4c50fcc5f6c49276d73e7f12f92094
SHA1dcfda58da70d1fba8ec56c8ee8d6a61ef8d777ed
SHA256235d759bf216f020ed234bf5ba325eb08521a65faa639bc263b63a56261dfd24
SHA512bbcc29e7f93e5c19c78a3b0735f59286fd1dbcc7e7aac90e04c5a8e193261726d7b332fc55178d71576a86eb403017f2efe81d93bc3ef7f7c068919531298909
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku690676.exeFilesize
294KB
MD5b8322dbcc506a2861afc1ff687d1764f
SHA12b19d462a539026f83c3bfc398e8ede3e85231b0
SHA2564b3d6b1f47bfd65ed423ed45433cbb18462704caa88ba06e8e0ce35aecfb76ab
SHA5125d0a50e796d843ffd2d12d4e97ff4497eb22546a0525f9f26a8f8fd60d9d898cca68c9023df79df578a52b210aaf59585ffa3ca853d0c7e4228251ecfeae67ed
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku690676.exeFilesize
294KB
MD5b8322dbcc506a2861afc1ff687d1764f
SHA12b19d462a539026f83c3bfc398e8ede3e85231b0
SHA2564b3d6b1f47bfd65ed423ed45433cbb18462704caa88ba06e8e0ce35aecfb76ab
SHA5125d0a50e796d843ffd2d12d4e97ff4497eb22546a0525f9f26a8f8fd60d9d898cca68c9023df79df578a52b210aaf59585ffa3ca853d0c7e4228251ecfeae67ed
-
memory/748-153-0x0000000002130000-0x000000000217B000-memory.dmpFilesize
300KB
-
memory/748-154-0x0000000002830000-0x0000000002840000-memory.dmpFilesize
64KB
-
memory/748-155-0x0000000002830000-0x0000000002840000-memory.dmpFilesize
64KB
-
memory/748-156-0x0000000002830000-0x0000000002840000-memory.dmpFilesize
64KB
-
memory/748-157-0x0000000004C60000-0x0000000005204000-memory.dmpFilesize
5.6MB
-
memory/748-158-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/748-159-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/748-161-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/748-163-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/748-165-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/748-167-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/748-169-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/748-171-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/748-173-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/748-175-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/748-177-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/748-179-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/748-181-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/748-183-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/748-185-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/748-187-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/748-189-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/748-191-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/748-193-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/748-195-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/748-197-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/748-199-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/748-201-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/748-203-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/748-205-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/748-207-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/748-209-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/748-211-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/748-213-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/748-215-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/748-217-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/748-219-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/748-221-0x0000000002730000-0x000000000276F000-memory.dmpFilesize
252KB
-
memory/748-1064-0x0000000005310000-0x0000000005928000-memory.dmpFilesize
6.1MB
-
memory/748-1065-0x0000000005930000-0x0000000005A3A000-memory.dmpFilesize
1.0MB
-
memory/748-1066-0x00000000028B0000-0x00000000028C2000-memory.dmpFilesize
72KB
-
memory/748-1067-0x00000000028D0000-0x000000000290C000-memory.dmpFilesize
240KB
-
memory/748-1068-0x0000000002830000-0x0000000002840000-memory.dmpFilesize
64KB
-
memory/748-1070-0x0000000002830000-0x0000000002840000-memory.dmpFilesize
64KB
-
memory/748-1071-0x0000000002830000-0x0000000002840000-memory.dmpFilesize
64KB
-
memory/748-1072-0x0000000002830000-0x0000000002840000-memory.dmpFilesize
64KB
-
memory/748-1073-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/748-1074-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/748-1075-0x0000000006490000-0x0000000006506000-memory.dmpFilesize
472KB
-
memory/748-1076-0x0000000006520000-0x0000000006570000-memory.dmpFilesize
320KB
-
memory/748-1077-0x0000000002830000-0x0000000002840000-memory.dmpFilesize
64KB
-
memory/748-1079-0x0000000007930000-0x0000000007AF2000-memory.dmpFilesize
1.8MB
-
memory/748-1080-0x0000000007B20000-0x000000000804C000-memory.dmpFilesize
5.2MB
-
memory/1400-147-0x00000000005C0000-0x00000000005CA000-memory.dmpFilesize
40KB
-
memory/3800-1086-0x0000000000F30000-0x0000000000F62000-memory.dmpFilesize
200KB
-
memory/3800-1087-0x0000000005800000-0x0000000005810000-memory.dmpFilesize
64KB