Analysis
-
max time kernel
97s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 20:17
Static task
static1
Behavioral task
behavioral1
Sample
5db3c651f0eee37c8bbac69164b46ebe7d28e3307ffc68cb879126b7f65c4097.exe
Resource
win10v2004-20230220-en
General
-
Target
5db3c651f0eee37c8bbac69164b46ebe7d28e3307ffc68cb879126b7f65c4097.exe
-
Size
521KB
-
MD5
bc63f4e29e93ca3fb9978b1f404cc15a
-
SHA1
90a1c26820f8237135d244320ce8ea5c5be2b424
-
SHA256
5db3c651f0eee37c8bbac69164b46ebe7d28e3307ffc68cb879126b7f65c4097
-
SHA512
e23d55e1623ed1591fac7ea0353f08ca706059257417b1a67d0de049f453d17345c529fbb2f19ff192f462ed9ed635a1f3a3a28b7502db347ea730c5539c6ae1
-
SSDEEP
12288:vMrby90HV/vL+N2ZJ6lypJ9O8e94fIzWKIW1vw9QQ2AO/:QyuVXlZElyBHeefBKw9QgO/
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr597949.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr597949.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr597949.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr597949.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr597949.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr597949.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr597949.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/2340-158-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2340-161-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2340-159-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2340-163-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2340-165-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2340-167-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2340-169-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2340-171-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2340-173-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2340-175-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2340-177-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2340-179-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2340-181-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2340-183-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2340-185-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2340-187-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2340-189-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2340-191-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2340-193-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2340-195-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2340-197-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2340-199-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2340-201-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2340-203-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2340-205-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2340-207-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2340-209-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2340-211-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2340-213-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2340-215-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2340-217-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2340-219-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/2340-221-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
ziFk9382.exejr597949.exeku448354.exelr957582.exepid process 4200 ziFk9382.exe 3404 jr597949.exe 2340 ku448354.exe 2852 lr957582.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr597949.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr597949.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
5db3c651f0eee37c8bbac69164b46ebe7d28e3307ffc68cb879126b7f65c4097.exeziFk9382.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 5db3c651f0eee37c8bbac69164b46ebe7d28e3307ffc68cb879126b7f65c4097.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5db3c651f0eee37c8bbac69164b46ebe7d28e3307ffc68cb879126b7f65c4097.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziFk9382.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziFk9382.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4476 2340 WerFault.exe ku448354.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr597949.exeku448354.exelr957582.exepid process 3404 jr597949.exe 3404 jr597949.exe 2340 ku448354.exe 2340 ku448354.exe 2852 lr957582.exe 2852 lr957582.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr597949.exeku448354.exelr957582.exedescription pid process Token: SeDebugPrivilege 3404 jr597949.exe Token: SeDebugPrivilege 2340 ku448354.exe Token: SeDebugPrivilege 2852 lr957582.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
5db3c651f0eee37c8bbac69164b46ebe7d28e3307ffc68cb879126b7f65c4097.exeziFk9382.exedescription pid process target process PID 4432 wrote to memory of 4200 4432 5db3c651f0eee37c8bbac69164b46ebe7d28e3307ffc68cb879126b7f65c4097.exe ziFk9382.exe PID 4432 wrote to memory of 4200 4432 5db3c651f0eee37c8bbac69164b46ebe7d28e3307ffc68cb879126b7f65c4097.exe ziFk9382.exe PID 4432 wrote to memory of 4200 4432 5db3c651f0eee37c8bbac69164b46ebe7d28e3307ffc68cb879126b7f65c4097.exe ziFk9382.exe PID 4200 wrote to memory of 3404 4200 ziFk9382.exe jr597949.exe PID 4200 wrote to memory of 3404 4200 ziFk9382.exe jr597949.exe PID 4200 wrote to memory of 2340 4200 ziFk9382.exe ku448354.exe PID 4200 wrote to memory of 2340 4200 ziFk9382.exe ku448354.exe PID 4200 wrote to memory of 2340 4200 ziFk9382.exe ku448354.exe PID 4432 wrote to memory of 2852 4432 5db3c651f0eee37c8bbac69164b46ebe7d28e3307ffc68cb879126b7f65c4097.exe lr957582.exe PID 4432 wrote to memory of 2852 4432 5db3c651f0eee37c8bbac69164b46ebe7d28e3307ffc68cb879126b7f65c4097.exe lr957582.exe PID 4432 wrote to memory of 2852 4432 5db3c651f0eee37c8bbac69164b46ebe7d28e3307ffc68cb879126b7f65c4097.exe lr957582.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5db3c651f0eee37c8bbac69164b46ebe7d28e3307ffc68cb879126b7f65c4097.exe"C:\Users\Admin\AppData\Local\Temp\5db3c651f0eee37c8bbac69164b46ebe7d28e3307ffc68cb879126b7f65c4097.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziFk9382.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziFk9382.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr597949.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr597949.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku448354.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku448354.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 13564⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr957582.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr957582.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2340 -ip 23401⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr957582.exeFilesize
175KB
MD5303d68c1d44f14038951a79500c5bfb2
SHA132825b80f9f86736b0f314e7e7b06632060f63ef
SHA256ddbf804bff47b9f762dd8036fc2900ad35592bb5fc159e00937281d0d0b57a0a
SHA51213575b2f26ee555f909f3aaade0ec317888c23fc126e73af5b367076082ebfbf88c849d1829bf57498e274fd76102ede47bc9f52adfde698740dbf3530a813ba
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr957582.exeFilesize
175KB
MD5303d68c1d44f14038951a79500c5bfb2
SHA132825b80f9f86736b0f314e7e7b06632060f63ef
SHA256ddbf804bff47b9f762dd8036fc2900ad35592bb5fc159e00937281d0d0b57a0a
SHA51213575b2f26ee555f909f3aaade0ec317888c23fc126e73af5b367076082ebfbf88c849d1829bf57498e274fd76102ede47bc9f52adfde698740dbf3530a813ba
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziFk9382.exeFilesize
379KB
MD56d5b78034832af8b975dca7eaea3a66b
SHA1c8ae4cac452ebb29f17b6bc9684858c1c63a1ac3
SHA256573c3e0052cc1617fe25cd801f4db66151426c2869db533f6dc4a0e709b76b88
SHA5127105705230c28bbd159b7199685876c86c394576664e77c31d87bcba1675af3915841481ff3541ac978daa9b1947addac1f2863409eb8ac34e71619ad416206e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziFk9382.exeFilesize
379KB
MD56d5b78034832af8b975dca7eaea3a66b
SHA1c8ae4cac452ebb29f17b6bc9684858c1c63a1ac3
SHA256573c3e0052cc1617fe25cd801f4db66151426c2869db533f6dc4a0e709b76b88
SHA5127105705230c28bbd159b7199685876c86c394576664e77c31d87bcba1675af3915841481ff3541ac978daa9b1947addac1f2863409eb8ac34e71619ad416206e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr597949.exeFilesize
15KB
MD53618a2a435f82da63f80a3e60fe191e2
SHA1b2f20cae79be9cf03890e786918c64854f34471b
SHA25623c0da75011a68fa7c33c4d486ab2e664f9b98601854076ab517e01c693794a2
SHA512fb20ac8b48817bfb68ea9bc953e0880c0281606ca9b0742d128673cff6b2c1b76a78ba3a5299ed65be309f8839c5ffb30a7fcb180fffe23a2b527cafee4bae58
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr597949.exeFilesize
15KB
MD53618a2a435f82da63f80a3e60fe191e2
SHA1b2f20cae79be9cf03890e786918c64854f34471b
SHA25623c0da75011a68fa7c33c4d486ab2e664f9b98601854076ab517e01c693794a2
SHA512fb20ac8b48817bfb68ea9bc953e0880c0281606ca9b0742d128673cff6b2c1b76a78ba3a5299ed65be309f8839c5ffb30a7fcb180fffe23a2b527cafee4bae58
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku448354.exeFilesize
294KB
MD5b7c5e1edfc96bf646667b9e561eb546e
SHA103cacd659bdbf5bf6154ff9c941d2e4f1de2b430
SHA256fbc4c2244a6ee22b420e13b93dac3103e0b13f9bef01066f6f7b6412510c873e
SHA512f17df9e01db6e98ca8fce2b3a890af25ff35a4f574d260330e0f8af21ec47fb91800a8550c649890062cd2ef460f0bc8a4cab5ed08128b60d8752cf764e08625
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku448354.exeFilesize
294KB
MD5b7c5e1edfc96bf646667b9e561eb546e
SHA103cacd659bdbf5bf6154ff9c941d2e4f1de2b430
SHA256fbc4c2244a6ee22b420e13b93dac3103e0b13f9bef01066f6f7b6412510c873e
SHA512f17df9e01db6e98ca8fce2b3a890af25ff35a4f574d260330e0f8af21ec47fb91800a8550c649890062cd2ef460f0bc8a4cab5ed08128b60d8752cf764e08625
-
memory/2340-153-0x0000000002120000-0x000000000216B000-memory.dmpFilesize
300KB
-
memory/2340-154-0x0000000004AE0000-0x0000000005084000-memory.dmpFilesize
5.6MB
-
memory/2340-155-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/2340-156-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/2340-157-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/2340-158-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2340-161-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2340-159-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2340-163-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2340-165-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2340-167-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2340-169-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2340-171-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2340-173-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2340-175-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2340-177-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2340-179-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2340-181-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2340-183-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2340-185-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2340-187-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2340-189-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2340-191-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2340-193-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2340-195-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2340-197-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2340-199-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2340-201-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2340-203-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2340-205-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2340-207-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2340-209-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2340-211-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2340-213-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2340-215-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2340-217-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2340-219-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2340-221-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2340-1064-0x0000000005200000-0x0000000005818000-memory.dmpFilesize
6.1MB
-
memory/2340-1065-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/2340-1066-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/2340-1067-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/2340-1068-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/2340-1070-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/2340-1071-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/2340-1072-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/2340-1073-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/2340-1074-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/2340-1075-0x00000000065F0000-0x00000000067B2000-memory.dmpFilesize
1.8MB
-
memory/2340-1076-0x00000000067D0000-0x0000000006CFC000-memory.dmpFilesize
5.2MB
-
memory/2340-1077-0x0000000006E20000-0x0000000006E96000-memory.dmpFilesize
472KB
-
memory/2340-1078-0x0000000006EC0000-0x0000000006F10000-memory.dmpFilesize
320KB
-
memory/2340-1079-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/2852-1085-0x0000000000940000-0x0000000000972000-memory.dmpFilesize
200KB
-
memory/2852-1086-0x00000000052A0000-0x00000000052B0000-memory.dmpFilesize
64KB
-
memory/3404-147-0x0000000000610000-0x000000000061A000-memory.dmpFilesize
40KB