Analysis
-
max time kernel
60s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 20:20
Static task
static1
Behavioral task
behavioral1
Sample
a54e312e555024221876455b2bf3ac0f39fd325a7306828bf24e466454ee6349.exe
Resource
win10v2004-20230220-en
General
-
Target
a54e312e555024221876455b2bf3ac0f39fd325a7306828bf24e466454ee6349.exe
-
Size
522KB
-
MD5
f46407c6dd767210d49b5d6326076f95
-
SHA1
d2b70fa78de760394bb2790b5a37088b41c5a20d
-
SHA256
a54e312e555024221876455b2bf3ac0f39fd325a7306828bf24e466454ee6349
-
SHA512
0444e672070d619d8a3dbe59963f83645e6ca120a5746741d1d1463fa9f38485c136b40773301db2ae5df0b9c4961f17dce270306f2ba4d826e88801cc99efa2
-
SSDEEP
12288:VMrhy90HziQ/JjyGcns1Umv0ue8LL4nezW0CGBknr:wyAi4j+SB0KLUnn0Cnr
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr052203.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr052203.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr052203.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr052203.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr052203.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr052203.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr052203.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 34 IoCs
Processes:
resource yara_rule behavioral1/memory/4612-156-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4612-155-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4612-160-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4612-161-0x0000000002450000-0x0000000002460000-memory.dmp family_redline behavioral1/memory/4612-163-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4612-165-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4612-167-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4612-169-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4612-171-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4612-173-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4612-175-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4612-177-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4612-179-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4612-181-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4612-183-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4612-185-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4612-187-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4612-189-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4612-191-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4612-193-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4612-195-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4612-197-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4612-199-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4612-201-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4612-203-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4612-205-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4612-207-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4612-209-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4612-211-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4612-213-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4612-215-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4612-217-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4612-219-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4612-221-0x0000000005050000-0x000000000508F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
ziPc7767.exejr052203.exeku751532.exelr714497.exepid process 4904 ziPc7767.exe 4360 jr052203.exe 4612 ku751532.exe 1756 lr714497.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr052203.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr052203.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
ziPc7767.exea54e312e555024221876455b2bf3ac0f39fd325a7306828bf24e466454ee6349.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziPc7767.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce a54e312e555024221876455b2bf3ac0f39fd325a7306828bf24e466454ee6349.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a54e312e555024221876455b2bf3ac0f39fd325a7306828bf24e466454ee6349.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziPc7767.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1252 4612 WerFault.exe ku751532.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr052203.exeku751532.exelr714497.exepid process 4360 jr052203.exe 4360 jr052203.exe 4612 ku751532.exe 4612 ku751532.exe 1756 lr714497.exe 1756 lr714497.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr052203.exeku751532.exelr714497.exedescription pid process Token: SeDebugPrivilege 4360 jr052203.exe Token: SeDebugPrivilege 4612 ku751532.exe Token: SeDebugPrivilege 1756 lr714497.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
a54e312e555024221876455b2bf3ac0f39fd325a7306828bf24e466454ee6349.exeziPc7767.exedescription pid process target process PID 1236 wrote to memory of 4904 1236 a54e312e555024221876455b2bf3ac0f39fd325a7306828bf24e466454ee6349.exe ziPc7767.exe PID 1236 wrote to memory of 4904 1236 a54e312e555024221876455b2bf3ac0f39fd325a7306828bf24e466454ee6349.exe ziPc7767.exe PID 1236 wrote to memory of 4904 1236 a54e312e555024221876455b2bf3ac0f39fd325a7306828bf24e466454ee6349.exe ziPc7767.exe PID 4904 wrote to memory of 4360 4904 ziPc7767.exe jr052203.exe PID 4904 wrote to memory of 4360 4904 ziPc7767.exe jr052203.exe PID 4904 wrote to memory of 4612 4904 ziPc7767.exe ku751532.exe PID 4904 wrote to memory of 4612 4904 ziPc7767.exe ku751532.exe PID 4904 wrote to memory of 4612 4904 ziPc7767.exe ku751532.exe PID 1236 wrote to memory of 1756 1236 a54e312e555024221876455b2bf3ac0f39fd325a7306828bf24e466454ee6349.exe lr714497.exe PID 1236 wrote to memory of 1756 1236 a54e312e555024221876455b2bf3ac0f39fd325a7306828bf24e466454ee6349.exe lr714497.exe PID 1236 wrote to memory of 1756 1236 a54e312e555024221876455b2bf3ac0f39fd325a7306828bf24e466454ee6349.exe lr714497.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a54e312e555024221876455b2bf3ac0f39fd325a7306828bf24e466454ee6349.exe"C:\Users\Admin\AppData\Local\Temp\a54e312e555024221876455b2bf3ac0f39fd325a7306828bf24e466454ee6349.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPc7767.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPc7767.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr052203.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr052203.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku751532.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku751532.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 18124⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr714497.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr714497.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4612 -ip 46121⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr714497.exeFilesize
175KB
MD50accd8931ea4727fde0fb88c312aec3f
SHA1d4981c2a5e3b2103c9cd8935975b5903ac447127
SHA2568ce8e777f4dd94be7f0d91f5d60512e2c3f01b7bcb151c80d3db7ece34e9be68
SHA512d4ba068055e54f03e7e6eb715eebbdf71b9ac586cf4e510fd4a29a0909236d986bdb5202922e0159f1a32872bb938518cae6ed9201b97db044ba4bc11e97cb5e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr714497.exeFilesize
175KB
MD50accd8931ea4727fde0fb88c312aec3f
SHA1d4981c2a5e3b2103c9cd8935975b5903ac447127
SHA2568ce8e777f4dd94be7f0d91f5d60512e2c3f01b7bcb151c80d3db7ece34e9be68
SHA512d4ba068055e54f03e7e6eb715eebbdf71b9ac586cf4e510fd4a29a0909236d986bdb5202922e0159f1a32872bb938518cae6ed9201b97db044ba4bc11e97cb5e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPc7767.exeFilesize
379KB
MD5107b04204557efa958c28b666ecdb77c
SHA1c613083663a4c7d5ff452ad1933b1cf77628ce81
SHA25698464119f15eedab51bc8f8850cd198297075879d0f4a88d3fa6bfdfd4561fc7
SHA5126a0f3f7375098b8e3a0e2351b4de5bc514788d2f635d4d11c93f923b6c82cde1cd08b1cb9035a60cd947c13b3ac97c91c20ec3748bc78ddec647341407ceb318
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPc7767.exeFilesize
379KB
MD5107b04204557efa958c28b666ecdb77c
SHA1c613083663a4c7d5ff452ad1933b1cf77628ce81
SHA25698464119f15eedab51bc8f8850cd198297075879d0f4a88d3fa6bfdfd4561fc7
SHA5126a0f3f7375098b8e3a0e2351b4de5bc514788d2f635d4d11c93f923b6c82cde1cd08b1cb9035a60cd947c13b3ac97c91c20ec3748bc78ddec647341407ceb318
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr052203.exeFilesize
15KB
MD59e91a64044e1afc5e3092e28e16d85dd
SHA1395f4e5aededa7fe8a582ab24cd73027c24015ad
SHA2563c3585d11f13b2fb1d6391dfd827209ec16f0bd4afb16015985c57f29e0eb1d9
SHA512e1e468b4db7b9a2891d8ca1d45d4dc6b2ed93cb2a14ef81be04e48ce1943952718660091973b4a7668a461c3657ae5f1b844bb62c67e1b42afac583ef294ee0a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr052203.exeFilesize
15KB
MD59e91a64044e1afc5e3092e28e16d85dd
SHA1395f4e5aededa7fe8a582ab24cd73027c24015ad
SHA2563c3585d11f13b2fb1d6391dfd827209ec16f0bd4afb16015985c57f29e0eb1d9
SHA512e1e468b4db7b9a2891d8ca1d45d4dc6b2ed93cb2a14ef81be04e48ce1943952718660091973b4a7668a461c3657ae5f1b844bb62c67e1b42afac583ef294ee0a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku751532.exeFilesize
294KB
MD5e169cfeb9d00f6110c8563d26db93cbd
SHA119aedd56a8bc80cb6a129fd2b3bce9dfb7e8089a
SHA256c80068d3d04ebf426756e790f64b505bc32e063845be403cbc4d3aa6f7e071f6
SHA5122a1b142533d7b0d1d2a2a77f42f94448ee41b2d16788b209b40f5ce9e2b1e1a9aafec0672dd7db4f9ea1cc5c5d507b02fcc2517ad19243ee894002044abf1a23
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku751532.exeFilesize
294KB
MD5e169cfeb9d00f6110c8563d26db93cbd
SHA119aedd56a8bc80cb6a129fd2b3bce9dfb7e8089a
SHA256c80068d3d04ebf426756e790f64b505bc32e063845be403cbc4d3aa6f7e071f6
SHA5122a1b142533d7b0d1d2a2a77f42f94448ee41b2d16788b209b40f5ce9e2b1e1a9aafec0672dd7db4f9ea1cc5c5d507b02fcc2517ad19243ee894002044abf1a23
-
memory/1756-1085-0x0000000000DB0000-0x0000000000DE2000-memory.dmpFilesize
200KB
-
memory/1756-1086-0x0000000005960000-0x0000000005970000-memory.dmpFilesize
64KB
-
memory/4360-147-0x0000000000180000-0x000000000018A000-memory.dmpFilesize
40KB
-
memory/4612-189-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4612-201-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4612-156-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4612-155-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4612-159-0x0000000002450000-0x0000000002460000-memory.dmpFilesize
64KB
-
memory/4612-157-0x0000000002450000-0x0000000002460000-memory.dmpFilesize
64KB
-
memory/4612-160-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4612-161-0x0000000002450000-0x0000000002460000-memory.dmpFilesize
64KB
-
memory/4612-163-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4612-165-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4612-167-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4612-169-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4612-171-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4612-173-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4612-175-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4612-177-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4612-179-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4612-181-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4612-183-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4612-185-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4612-187-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4612-153-0x00000000020E0000-0x000000000212B000-memory.dmpFilesize
300KB
-
memory/4612-191-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4612-193-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4612-195-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4612-197-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4612-199-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4612-154-0x0000000004AA0000-0x0000000005044000-memory.dmpFilesize
5.6MB
-
memory/4612-203-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4612-205-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4612-207-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4612-209-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4612-211-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4612-213-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4612-215-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4612-217-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4612-219-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4612-221-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4612-1064-0x0000000005200000-0x0000000005818000-memory.dmpFilesize
6.1MB
-
memory/4612-1065-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/4612-1066-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/4612-1067-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/4612-1068-0x0000000002450000-0x0000000002460000-memory.dmpFilesize
64KB
-
memory/4612-1070-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/4612-1071-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/4612-1072-0x00000000064B0000-0x0000000006672000-memory.dmpFilesize
1.8MB
-
memory/4612-1073-0x0000000002450000-0x0000000002460000-memory.dmpFilesize
64KB
-
memory/4612-1074-0x0000000002450000-0x0000000002460000-memory.dmpFilesize
64KB
-
memory/4612-1075-0x0000000002450000-0x0000000002460000-memory.dmpFilesize
64KB
-
memory/4612-1076-0x0000000006690000-0x0000000006BBC000-memory.dmpFilesize
5.2MB
-
memory/4612-1077-0x0000000002450000-0x0000000002460000-memory.dmpFilesize
64KB
-
memory/4612-1078-0x00000000080F0000-0x0000000008166000-memory.dmpFilesize
472KB
-
memory/4612-1079-0x0000000008170000-0x00000000081C0000-memory.dmpFilesize
320KB