Analysis
-
max time kernel
84s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 19:07
Static task
static1
Behavioral task
behavioral1
Sample
5b44f39f7e7db56b9c89a11b98ed383c88135548ba606622b2dc8c9ac8a577dc.exe
Resource
win10v2004-20230220-en
General
-
Target
5b44f39f7e7db56b9c89a11b98ed383c88135548ba606622b2dc8c9ac8a577dc.exe
-
Size
521KB
-
MD5
5ee291ed7ec6653112d5e1616bedc410
-
SHA1
ff92c6c99091712388e5433cfb8c644e40879ce1
-
SHA256
5b44f39f7e7db56b9c89a11b98ed383c88135548ba606622b2dc8c9ac8a577dc
-
SHA512
e5b758a37f4d7f0f88f6dcf575b3db36b0d800b82f49a1b68d7cbd57739ec55b2feba551bd21cf6057451aeab1851db213d0016a14e8533ee61a5344e6902a8d
-
SSDEEP
12288:ZMrny90n3k3DMAqBuDUCt6rub+gl644WhFSJhZ:6yFQUgzruDseEJf
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr447523.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr447523.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr447523.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr447523.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr447523.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr447523.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr447523.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/3560-158-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/3560-159-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/3560-161-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/3560-163-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/3560-165-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/3560-167-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/3560-169-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/3560-171-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/3560-173-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/3560-175-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/3560-177-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/3560-179-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/3560-181-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/3560-183-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/3560-185-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/3560-187-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/3560-189-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/3560-191-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/3560-193-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/3560-195-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/3560-197-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/3560-199-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/3560-201-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/3560-203-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/3560-205-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/3560-207-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/3560-209-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/3560-211-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/3560-213-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/3560-215-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/3560-217-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/3560-219-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/3560-221-0x0000000002650000-0x000000000268F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
zizM2673.exejr447523.exeku412032.exelr179199.exepid process 4460 zizM2673.exe 4380 jr447523.exe 3560 ku412032.exe 1688 lr179199.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr447523.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr447523.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
5b44f39f7e7db56b9c89a11b98ed383c88135548ba606622b2dc8c9ac8a577dc.exezizM2673.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 5b44f39f7e7db56b9c89a11b98ed383c88135548ba606622b2dc8c9ac8a577dc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5b44f39f7e7db56b9c89a11b98ed383c88135548ba606622b2dc8c9ac8a577dc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zizM2673.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zizM2673.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4680 3560 WerFault.exe ku412032.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr447523.exeku412032.exelr179199.exepid process 4380 jr447523.exe 4380 jr447523.exe 3560 ku412032.exe 3560 ku412032.exe 1688 lr179199.exe 1688 lr179199.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr447523.exeku412032.exelr179199.exedescription pid process Token: SeDebugPrivilege 4380 jr447523.exe Token: SeDebugPrivilege 3560 ku412032.exe Token: SeDebugPrivilege 1688 lr179199.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
5b44f39f7e7db56b9c89a11b98ed383c88135548ba606622b2dc8c9ac8a577dc.exezizM2673.exedescription pid process target process PID 1236 wrote to memory of 4460 1236 5b44f39f7e7db56b9c89a11b98ed383c88135548ba606622b2dc8c9ac8a577dc.exe zizM2673.exe PID 1236 wrote to memory of 4460 1236 5b44f39f7e7db56b9c89a11b98ed383c88135548ba606622b2dc8c9ac8a577dc.exe zizM2673.exe PID 1236 wrote to memory of 4460 1236 5b44f39f7e7db56b9c89a11b98ed383c88135548ba606622b2dc8c9ac8a577dc.exe zizM2673.exe PID 4460 wrote to memory of 4380 4460 zizM2673.exe jr447523.exe PID 4460 wrote to memory of 4380 4460 zizM2673.exe jr447523.exe PID 4460 wrote to memory of 3560 4460 zizM2673.exe ku412032.exe PID 4460 wrote to memory of 3560 4460 zizM2673.exe ku412032.exe PID 4460 wrote to memory of 3560 4460 zizM2673.exe ku412032.exe PID 1236 wrote to memory of 1688 1236 5b44f39f7e7db56b9c89a11b98ed383c88135548ba606622b2dc8c9ac8a577dc.exe lr179199.exe PID 1236 wrote to memory of 1688 1236 5b44f39f7e7db56b9c89a11b98ed383c88135548ba606622b2dc8c9ac8a577dc.exe lr179199.exe PID 1236 wrote to memory of 1688 1236 5b44f39f7e7db56b9c89a11b98ed383c88135548ba606622b2dc8c9ac8a577dc.exe lr179199.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b44f39f7e7db56b9c89a11b98ed383c88135548ba606622b2dc8c9ac8a577dc.exe"C:\Users\Admin\AppData\Local\Temp\5b44f39f7e7db56b9c89a11b98ed383c88135548ba606622b2dc8c9ac8a577dc.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zizM2673.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zizM2673.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr447523.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr447523.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku412032.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku412032.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 14804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr179199.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr179199.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3560 -ip 35601⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr179199.exeFilesize
175KB
MD5e79aa0a014c97b0c1ed0a69bab710648
SHA1330ea2b2f0dcad3d93cc1a943f1b3090338c04ff
SHA25677ee850fc66a2fc7fc090b9848effd34be93752f8dc046ce7069a542babc422b
SHA512c5a63aa7af249b7d3602a9f47cdef6254831c65700a23799f4e7e0a1fb2bd132aeffac59197b23b6d371d59bedcb787188d364180edbf174bd995653bb21ffd0
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr179199.exeFilesize
175KB
MD5e79aa0a014c97b0c1ed0a69bab710648
SHA1330ea2b2f0dcad3d93cc1a943f1b3090338c04ff
SHA25677ee850fc66a2fc7fc090b9848effd34be93752f8dc046ce7069a542babc422b
SHA512c5a63aa7af249b7d3602a9f47cdef6254831c65700a23799f4e7e0a1fb2bd132aeffac59197b23b6d371d59bedcb787188d364180edbf174bd995653bb21ffd0
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zizM2673.exeFilesize
379KB
MD5138348c7796991671b21c2b5a86fa97b
SHA1b947e2947a84af6e8486670263a395fc90a204ca
SHA2560e3040040b3fb9764b166690bf4c28aabaebbdc2a468816c49940b6b600deb23
SHA51231e424225a8942f9571479a7a990cda9e74c9c86070a18577cee78a9c48fae109d84c56238e2b6a035b664917a8eb344cfa07676e650bf221d92481bc9c5d5be
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zizM2673.exeFilesize
379KB
MD5138348c7796991671b21c2b5a86fa97b
SHA1b947e2947a84af6e8486670263a395fc90a204ca
SHA2560e3040040b3fb9764b166690bf4c28aabaebbdc2a468816c49940b6b600deb23
SHA51231e424225a8942f9571479a7a990cda9e74c9c86070a18577cee78a9c48fae109d84c56238e2b6a035b664917a8eb344cfa07676e650bf221d92481bc9c5d5be
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr447523.exeFilesize
11KB
MD565a35c35de1b904d19d2d7ede10d1b6c
SHA14829537e8206903a714dc065d2284b15d17facaf
SHA2564b70787001a95abe95f6b79b9f1835c31c05a729e1cb92a652ed640d662a344e
SHA512e2c8021f2bc1d4f67bc134269ec89d449e5f6216fc9fb50506209546bb2444d65872c3490c14f4efed319256df0070c01e366c2e5d64166177c5c1b8a79ab893
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr447523.exeFilesize
11KB
MD565a35c35de1b904d19d2d7ede10d1b6c
SHA14829537e8206903a714dc065d2284b15d17facaf
SHA2564b70787001a95abe95f6b79b9f1835c31c05a729e1cb92a652ed640d662a344e
SHA512e2c8021f2bc1d4f67bc134269ec89d449e5f6216fc9fb50506209546bb2444d65872c3490c14f4efed319256df0070c01e366c2e5d64166177c5c1b8a79ab893
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku412032.exeFilesize
294KB
MD5e7dca5d1cd05b0d8652f1d8052f821a2
SHA10dd300cb13bc0dfe76eb7540d17e5e57d9bcc75b
SHA2568adcdf492f5463da4d6139c8cbb6f97720b773e5c3d4f48a14cf055a3cb50a65
SHA5125fac9d2f4a0311f0946e04caca9eb855bb147bebaf089e37fd022a2547d0c266c7662b01b9b2ad6840c3b93dbd610abc0c9248547ba256b896c99f98894bdaf7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku412032.exeFilesize
294KB
MD5e7dca5d1cd05b0d8652f1d8052f821a2
SHA10dd300cb13bc0dfe76eb7540d17e5e57d9bcc75b
SHA2568adcdf492f5463da4d6139c8cbb6f97720b773e5c3d4f48a14cf055a3cb50a65
SHA5125fac9d2f4a0311f0946e04caca9eb855bb147bebaf089e37fd022a2547d0c266c7662b01b9b2ad6840c3b93dbd610abc0c9248547ba256b896c99f98894bdaf7
-
memory/1688-1086-0x0000000000260000-0x0000000000292000-memory.dmpFilesize
200KB
-
memory/1688-1087-0x0000000004B50000-0x0000000004B60000-memory.dmpFilesize
64KB
-
memory/1688-1088-0x0000000004B50000-0x0000000004B60000-memory.dmpFilesize
64KB
-
memory/3560-191-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/3560-203-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/3560-156-0x0000000002500000-0x0000000002510000-memory.dmpFilesize
64KB
-
memory/3560-157-0x0000000002500000-0x0000000002510000-memory.dmpFilesize
64KB
-
memory/3560-158-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/3560-159-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/3560-161-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/3560-163-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/3560-165-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/3560-167-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/3560-169-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/3560-171-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/3560-173-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/3560-175-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/3560-177-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/3560-179-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/3560-181-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/3560-183-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/3560-185-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/3560-187-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/3560-189-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/3560-154-0x0000000004B40000-0x00000000050E4000-memory.dmpFilesize
5.6MB
-
memory/3560-193-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/3560-195-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/3560-197-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/3560-199-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/3560-201-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/3560-155-0x0000000002500000-0x0000000002510000-memory.dmpFilesize
64KB
-
memory/3560-205-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/3560-207-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/3560-209-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/3560-211-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/3560-213-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/3560-215-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/3560-217-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/3560-219-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/3560-221-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/3560-1064-0x00000000050F0000-0x0000000005708000-memory.dmpFilesize
6.1MB
-
memory/3560-1065-0x0000000005760000-0x000000000586A000-memory.dmpFilesize
1.0MB
-
memory/3560-1066-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/3560-1067-0x00000000058C0000-0x00000000058FC000-memory.dmpFilesize
240KB
-
memory/3560-1068-0x0000000002500000-0x0000000002510000-memory.dmpFilesize
64KB
-
memory/3560-1070-0x0000000002500000-0x0000000002510000-memory.dmpFilesize
64KB
-
memory/3560-1071-0x0000000002500000-0x0000000002510000-memory.dmpFilesize
64KB
-
memory/3560-1072-0x0000000002500000-0x0000000002510000-memory.dmpFilesize
64KB
-
memory/3560-1073-0x0000000005BB0000-0x0000000005C42000-memory.dmpFilesize
584KB
-
memory/3560-1074-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/3560-1075-0x00000000023D0000-0x0000000002446000-memory.dmpFilesize
472KB
-
memory/3560-153-0x0000000000650000-0x000000000069B000-memory.dmpFilesize
300KB
-
memory/3560-1076-0x0000000007620000-0x0000000007670000-memory.dmpFilesize
320KB
-
memory/3560-1077-0x0000000007770000-0x0000000007932000-memory.dmpFilesize
1.8MB
-
memory/3560-1078-0x0000000002500000-0x0000000002510000-memory.dmpFilesize
64KB
-
memory/3560-1079-0x0000000007940000-0x0000000007E6C000-memory.dmpFilesize
5.2MB
-
memory/4380-147-0x0000000000FB0000-0x0000000000FBA000-memory.dmpFilesize
40KB