Analysis
-
max time kernel
61s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 20:22
Static task
static1
Behavioral task
behavioral1
Sample
7eaba713e4b805324fba85c45c16554c61c71e36b4f4a924b39fa42bf614bb5b.exe
Resource
win10v2004-20230221-en
General
-
Target
7eaba713e4b805324fba85c45c16554c61c71e36b4f4a924b39fa42bf614bb5b.exe
-
Size
522KB
-
MD5
e4d85054d33e515f1cb1c7611b37abe3
-
SHA1
bca26906a0f5c7849a8459c08162617bf7b323f1
-
SHA256
7eaba713e4b805324fba85c45c16554c61c71e36b4f4a924b39fa42bf614bb5b
-
SHA512
bcb36afc0ded730c8fabc661d7c90375f6131a7ce98c56b58c198a9468066358204271b2f82d9b228ef0c211a9a729e9ef615c0e33f3a6da90436054336b36ab
-
SSDEEP
12288:kMr/y90cso7BdWGDEkWFTH/Q718O54pXzWK8IT48LrmDI:zy57BdWAv4THnOypSK8IFMI
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr798197.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr798197.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr798197.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr798197.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr798197.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr798197.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr798197.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/5092-154-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/5092-155-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/5092-157-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/5092-159-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/5092-161-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/5092-163-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/5092-165-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/5092-169-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/5092-175-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/5092-172-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/5092-177-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/5092-179-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/5092-181-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/5092-183-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/5092-185-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/5092-187-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/5092-189-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/5092-191-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/5092-193-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/5092-195-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/5092-197-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/5092-199-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/5092-201-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/5092-203-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/5092-205-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/5092-207-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/5092-209-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/5092-211-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/5092-213-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/5092-217-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/5092-215-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/5092-219-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/5092-221-0x0000000002720000-0x000000000275F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
zicJ3161.exejr798197.exeku543310.exelr596762.exepid process 4364 zicJ3161.exe 5060 jr798197.exe 5092 ku543310.exe 4776 lr596762.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr798197.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr798197.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
7eaba713e4b805324fba85c45c16554c61c71e36b4f4a924b39fa42bf614bb5b.exezicJ3161.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 7eaba713e4b805324fba85c45c16554c61c71e36b4f4a924b39fa42bf614bb5b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 7eaba713e4b805324fba85c45c16554c61c71e36b4f4a924b39fa42bf614bb5b.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zicJ3161.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zicJ3161.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4240 5092 WerFault.exe ku543310.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr798197.exeku543310.exelr596762.exepid process 5060 jr798197.exe 5060 jr798197.exe 5092 ku543310.exe 5092 ku543310.exe 4776 lr596762.exe 4776 lr596762.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr798197.exeku543310.exelr596762.exedescription pid process Token: SeDebugPrivilege 5060 jr798197.exe Token: SeDebugPrivilege 5092 ku543310.exe Token: SeDebugPrivilege 4776 lr596762.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
7eaba713e4b805324fba85c45c16554c61c71e36b4f4a924b39fa42bf614bb5b.exezicJ3161.exedescription pid process target process PID 2436 wrote to memory of 4364 2436 7eaba713e4b805324fba85c45c16554c61c71e36b4f4a924b39fa42bf614bb5b.exe zicJ3161.exe PID 2436 wrote to memory of 4364 2436 7eaba713e4b805324fba85c45c16554c61c71e36b4f4a924b39fa42bf614bb5b.exe zicJ3161.exe PID 2436 wrote to memory of 4364 2436 7eaba713e4b805324fba85c45c16554c61c71e36b4f4a924b39fa42bf614bb5b.exe zicJ3161.exe PID 4364 wrote to memory of 5060 4364 zicJ3161.exe jr798197.exe PID 4364 wrote to memory of 5060 4364 zicJ3161.exe jr798197.exe PID 4364 wrote to memory of 5092 4364 zicJ3161.exe ku543310.exe PID 4364 wrote to memory of 5092 4364 zicJ3161.exe ku543310.exe PID 4364 wrote to memory of 5092 4364 zicJ3161.exe ku543310.exe PID 2436 wrote to memory of 4776 2436 7eaba713e4b805324fba85c45c16554c61c71e36b4f4a924b39fa42bf614bb5b.exe lr596762.exe PID 2436 wrote to memory of 4776 2436 7eaba713e4b805324fba85c45c16554c61c71e36b4f4a924b39fa42bf614bb5b.exe lr596762.exe PID 2436 wrote to memory of 4776 2436 7eaba713e4b805324fba85c45c16554c61c71e36b4f4a924b39fa42bf614bb5b.exe lr596762.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7eaba713e4b805324fba85c45c16554c61c71e36b4f4a924b39fa42bf614bb5b.exe"C:\Users\Admin\AppData\Local\Temp\7eaba713e4b805324fba85c45c16554c61c71e36b4f4a924b39fa42bf614bb5b.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zicJ3161.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zicJ3161.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr798197.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr798197.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku543310.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku543310.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 13564⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr596762.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr596762.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5092 -ip 50921⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr596762.exeFilesize
175KB
MD5898b9b5c39486d4a70530ee9083a3bda
SHA1a85eb4a3e36dad0849e532f58faee54bb26ebc51
SHA256084a43e2351956d8a31d4938ef4f98b8b9ff99e54c6683500563d8106e92d0bb
SHA51241a0380eec1553508c84b60055a1cac31048db5ddeee50d064334cf04fa922a9eab2d66f1279621e9fc9ce126ee51c8ba55573db597d7707c3e98a97e5432ec7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr596762.exeFilesize
175KB
MD5898b9b5c39486d4a70530ee9083a3bda
SHA1a85eb4a3e36dad0849e532f58faee54bb26ebc51
SHA256084a43e2351956d8a31d4938ef4f98b8b9ff99e54c6683500563d8106e92d0bb
SHA51241a0380eec1553508c84b60055a1cac31048db5ddeee50d064334cf04fa922a9eab2d66f1279621e9fc9ce126ee51c8ba55573db597d7707c3e98a97e5432ec7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zicJ3161.exeFilesize
379KB
MD5be967de8fbff2a09617b58356c0af5c2
SHA1337c72be0dc79f720ef46e76b4281601736149df
SHA256e13111a1aab8ec2f5fb2f44c76c471d6e0cd122d777cb0a7c9027af9f40f551c
SHA5127a18c73127f7d0e7ccbf54338939531d2aff7f2eb338b0c8a02b33b6b4ff0527d151a2f6c584c3b38162f36421712c4aba08e05615b851013bad7e4a078e7d62
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zicJ3161.exeFilesize
379KB
MD5be967de8fbff2a09617b58356c0af5c2
SHA1337c72be0dc79f720ef46e76b4281601736149df
SHA256e13111a1aab8ec2f5fb2f44c76c471d6e0cd122d777cb0a7c9027af9f40f551c
SHA5127a18c73127f7d0e7ccbf54338939531d2aff7f2eb338b0c8a02b33b6b4ff0527d151a2f6c584c3b38162f36421712c4aba08e05615b851013bad7e4a078e7d62
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr798197.exeFilesize
15KB
MD58d794ec6788ec9977612c5af8a92e54f
SHA1ad6df589c13c8cb32a1b8181044eef1e74efa00b
SHA256747320658b08f63fbda639aba46168dcce108c0c128e8547433323164321b776
SHA5120a8b05518cef01bbc118e3a8ca055990a6c8f5cd2ae1a5ac6e2158e7370fd9c3cb5913ca222997b3fd259e04a24b92fb31b9bcf2591229626146ce47e0c7dc61
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr798197.exeFilesize
15KB
MD58d794ec6788ec9977612c5af8a92e54f
SHA1ad6df589c13c8cb32a1b8181044eef1e74efa00b
SHA256747320658b08f63fbda639aba46168dcce108c0c128e8547433323164321b776
SHA5120a8b05518cef01bbc118e3a8ca055990a6c8f5cd2ae1a5ac6e2158e7370fd9c3cb5913ca222997b3fd259e04a24b92fb31b9bcf2591229626146ce47e0c7dc61
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku543310.exeFilesize
294KB
MD51e2a0264118362ab9d8010a765c798b7
SHA1c8868daf64bfaa03b7a179f86aafccd4b6f83af1
SHA256d3fbc671fd160ac20709a7c338602571ec1f0141773af575c0421bec35242723
SHA51239d126075756afb069b15d1d079a9e708c2eb85dabcde391100a85eff51163ee623c1f884a46226279b49d55b659d98ebf65759677869b35a13498854a32abef
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku543310.exeFilesize
294KB
MD51e2a0264118362ab9d8010a765c798b7
SHA1c8868daf64bfaa03b7a179f86aafccd4b6f83af1
SHA256d3fbc671fd160ac20709a7c338602571ec1f0141773af575c0421bec35242723
SHA51239d126075756afb069b15d1d079a9e708c2eb85dabcde391100a85eff51163ee623c1f884a46226279b49d55b659d98ebf65759677869b35a13498854a32abef
-
memory/4776-1085-0x0000000000C40000-0x0000000000C72000-memory.dmpFilesize
200KB
-
memory/4776-1086-0x0000000005580000-0x0000000005590000-memory.dmpFilesize
64KB
-
memory/5060-147-0x0000000000FC0000-0x0000000000FCA000-memory.dmpFilesize
40KB
-
memory/5092-189-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/5092-201-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/5092-155-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/5092-157-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/5092-159-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/5092-161-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/5092-163-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/5092-166-0x0000000000640000-0x000000000068B000-memory.dmpFilesize
300KB
-
memory/5092-165-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/5092-168-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/5092-169-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/5092-171-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/5092-173-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/5092-175-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/5092-172-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/5092-177-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/5092-179-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/5092-181-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/5092-183-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/5092-185-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/5092-187-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/5092-153-0x0000000004C80000-0x0000000005224000-memory.dmpFilesize
5.6MB
-
memory/5092-191-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/5092-193-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/5092-195-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/5092-197-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/5092-199-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/5092-154-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/5092-203-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/5092-205-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/5092-207-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/5092-209-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/5092-211-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/5092-213-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/5092-217-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/5092-215-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/5092-219-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/5092-221-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/5092-1064-0x0000000005230000-0x0000000005848000-memory.dmpFilesize
6.1MB
-
memory/5092-1065-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/5092-1066-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/5092-1068-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/5092-1067-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/5092-1070-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/5092-1071-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/5092-1072-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/5092-1073-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/5092-1074-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/5092-1075-0x00000000065F0000-0x00000000067B2000-memory.dmpFilesize
1.8MB
-
memory/5092-1076-0x00000000067D0000-0x0000000006CFC000-memory.dmpFilesize
5.2MB
-
memory/5092-1077-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/5092-1078-0x0000000007080000-0x00000000070F6000-memory.dmpFilesize
472KB
-
memory/5092-1079-0x0000000007110000-0x0000000007160000-memory.dmpFilesize
320KB