Analysis
-
max time kernel
99s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 20:26
Static task
static1
Behavioral task
behavioral1
Sample
f828e75c4d04ffd742565983937ffa0917a29b7e0d09bbd83fa116680325eb51.exe
Resource
win10v2004-20230220-en
General
-
Target
f828e75c4d04ffd742565983937ffa0917a29b7e0d09bbd83fa116680325eb51.exe
-
Size
657KB
-
MD5
0c67a547e642d9553484044d9923d5f1
-
SHA1
6538c35e3afec0a5cfddc8e2c216c69cbd2c8583
-
SHA256
f828e75c4d04ffd742565983937ffa0917a29b7e0d09bbd83fa116680325eb51
-
SHA512
9d6d13f6e4403648bf70733b13e3b128f4d8f69e6320df1057fe41de143792d1e49ed6f2c7bc731d40756f90d16ed420d1c64a8a029dd4472fdbf45515192ef1
-
SSDEEP
12288:xMrOy90ZwZFrqvenh4n72VRft4qWHfi063FBLt8LO3Wno44OzWKpP8vjrN:XyiwZIenooftNgf963FBhVmnh4XKorN
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro7371.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro7371.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro7371.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro7371.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro7371.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro7371.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro7371.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/5020-190-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/5020-191-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/5020-193-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/5020-195-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/5020-197-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/5020-199-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/5020-201-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/5020-203-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/5020-205-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/5020-207-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/5020-209-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/5020-211-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/5020-213-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/5020-217-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/5020-215-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/5020-219-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/5020-221-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/5020-223-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un533980.exepro7371.exequ0893.exesi988328.exepid process 4788 un533980.exe 1160 pro7371.exe 5020 qu0893.exe 4608 si988328.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro7371.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro7371.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro7371.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un533980.exef828e75c4d04ffd742565983937ffa0917a29b7e0d09bbd83fa116680325eb51.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un533980.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce f828e75c4d04ffd742565983937ffa0917a29b7e0d09bbd83fa116680325eb51.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" f828e75c4d04ffd742565983937ffa0917a29b7e0d09bbd83fa116680325eb51.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un533980.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3028 1160 WerFault.exe pro7371.exe 1228 5020 WerFault.exe qu0893.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro7371.exequ0893.exesi988328.exepid process 1160 pro7371.exe 1160 pro7371.exe 5020 qu0893.exe 5020 qu0893.exe 4608 si988328.exe 4608 si988328.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro7371.exequ0893.exesi988328.exedescription pid process Token: SeDebugPrivilege 1160 pro7371.exe Token: SeDebugPrivilege 5020 qu0893.exe Token: SeDebugPrivilege 4608 si988328.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
f828e75c4d04ffd742565983937ffa0917a29b7e0d09bbd83fa116680325eb51.exeun533980.exedescription pid process target process PID 4852 wrote to memory of 4788 4852 f828e75c4d04ffd742565983937ffa0917a29b7e0d09bbd83fa116680325eb51.exe un533980.exe PID 4852 wrote to memory of 4788 4852 f828e75c4d04ffd742565983937ffa0917a29b7e0d09bbd83fa116680325eb51.exe un533980.exe PID 4852 wrote to memory of 4788 4852 f828e75c4d04ffd742565983937ffa0917a29b7e0d09bbd83fa116680325eb51.exe un533980.exe PID 4788 wrote to memory of 1160 4788 un533980.exe pro7371.exe PID 4788 wrote to memory of 1160 4788 un533980.exe pro7371.exe PID 4788 wrote to memory of 1160 4788 un533980.exe pro7371.exe PID 4788 wrote to memory of 5020 4788 un533980.exe qu0893.exe PID 4788 wrote to memory of 5020 4788 un533980.exe qu0893.exe PID 4788 wrote to memory of 5020 4788 un533980.exe qu0893.exe PID 4852 wrote to memory of 4608 4852 f828e75c4d04ffd742565983937ffa0917a29b7e0d09bbd83fa116680325eb51.exe si988328.exe PID 4852 wrote to memory of 4608 4852 f828e75c4d04ffd742565983937ffa0917a29b7e0d09bbd83fa116680325eb51.exe si988328.exe PID 4852 wrote to memory of 4608 4852 f828e75c4d04ffd742565983937ffa0917a29b7e0d09bbd83fa116680325eb51.exe si988328.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f828e75c4d04ffd742565983937ffa0917a29b7e0d09bbd83fa116680325eb51.exe"C:\Users\Admin\AppData\Local\Temp\f828e75c4d04ffd742565983937ffa0917a29b7e0d09bbd83fa116680325eb51.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un533980.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un533980.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7371.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7371.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 10844⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0893.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0893.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 13404⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si988328.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si988328.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1160 -ip 11601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5020 -ip 50201⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si988328.exeFilesize
175KB
MD5ac20caf20d2a61df557c9498b1f2cf72
SHA163041c91a51a0b992fec0b259370ba03c461b395
SHA25648b86dd3dc5432765dd95499a1cb39a587b273408eafee448127c05886d781ed
SHA512c1472e1ca08065e972b6e886385ba0e3e18ead092fac4a3f3b00636c655c899f2ea6f543f1d88f60db16c0b563c295af95e580ce404c8669ea7fd3322e7f884d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si988328.exeFilesize
175KB
MD5ac20caf20d2a61df557c9498b1f2cf72
SHA163041c91a51a0b992fec0b259370ba03c461b395
SHA25648b86dd3dc5432765dd95499a1cb39a587b273408eafee448127c05886d781ed
SHA512c1472e1ca08065e972b6e886385ba0e3e18ead092fac4a3f3b00636c655c899f2ea6f543f1d88f60db16c0b563c295af95e580ce404c8669ea7fd3322e7f884d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un533980.exeFilesize
515KB
MD5ba4469ded74b345f2aa6a05ad5fe290f
SHA1ade01785e9e8662326ae7951cf49b8916bf267e8
SHA256ea7e29c1767a5e45c9459a8a0645d9c33f76c36143815e052533c6c693003cfe
SHA5121f3a273380660f5a78d2c97548bdd588cd941811de31f35b6dd9aed0dda21ace6003c3db84df87a49bb67277fad0e94645ab1af652475b00eaadda37f3ff2b29
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un533980.exeFilesize
515KB
MD5ba4469ded74b345f2aa6a05ad5fe290f
SHA1ade01785e9e8662326ae7951cf49b8916bf267e8
SHA256ea7e29c1767a5e45c9459a8a0645d9c33f76c36143815e052533c6c693003cfe
SHA5121f3a273380660f5a78d2c97548bdd588cd941811de31f35b6dd9aed0dda21ace6003c3db84df87a49bb67277fad0e94645ab1af652475b00eaadda37f3ff2b29
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7371.exeFilesize
235KB
MD55b44144e54b1c95ca723243202b5814d
SHA1f3f01a609e082f6a70f44bfb40789b7c7fe9baec
SHA256d5b85a516ebda5d813b978702841cd15d461cd31423f0877daec4cb50b610d8a
SHA5129d0944bde77264a5421bc5dec740fcadce70cd7d31d186c177ccebee61ccfd641ba4cf74c1cb85041cf26f7d26ce05df7382525f5368a7d1530fa750feb24fd2
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7371.exeFilesize
235KB
MD55b44144e54b1c95ca723243202b5814d
SHA1f3f01a609e082f6a70f44bfb40789b7c7fe9baec
SHA256d5b85a516ebda5d813b978702841cd15d461cd31423f0877daec4cb50b610d8a
SHA5129d0944bde77264a5421bc5dec740fcadce70cd7d31d186c177ccebee61ccfd641ba4cf74c1cb85041cf26f7d26ce05df7382525f5368a7d1530fa750feb24fd2
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0893.exeFilesize
294KB
MD52c9275ae4410a9ebefddd09940ec53c9
SHA1574e68e0b880e455750e19d73a42c8b965e76c4c
SHA25687d3d0180b83aab61dca2344c36b72a1efcd8fe14e51d1e062de6ade2c30a74d
SHA512eeded7bd104e119e4beb30b4ec5159dfbed1a0f6bd374cba3d9579fec3996a9054bd6cbac2bfbc2b50dd27d2aedb2f93d60f4c4516ce4f3232d240d721e0697a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0893.exeFilesize
294KB
MD52c9275ae4410a9ebefddd09940ec53c9
SHA1574e68e0b880e455750e19d73a42c8b965e76c4c
SHA25687d3d0180b83aab61dca2344c36b72a1efcd8fe14e51d1e062de6ade2c30a74d
SHA512eeded7bd104e119e4beb30b4ec5159dfbed1a0f6bd374cba3d9579fec3996a9054bd6cbac2bfbc2b50dd27d2aedb2f93d60f4c4516ce4f3232d240d721e0697a
-
memory/1160-148-0x0000000004B90000-0x0000000005134000-memory.dmpFilesize
5.6MB
-
memory/1160-149-0x00000000020D0000-0x00000000020FD000-memory.dmpFilesize
180KB
-
memory/1160-150-0x0000000004B80000-0x0000000004B90000-memory.dmpFilesize
64KB
-
memory/1160-151-0x0000000004B80000-0x0000000004B90000-memory.dmpFilesize
64KB
-
memory/1160-152-0x0000000004B80000-0x0000000004B90000-memory.dmpFilesize
64KB
-
memory/1160-153-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/1160-154-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/1160-156-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/1160-158-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/1160-160-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/1160-162-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/1160-164-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/1160-166-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/1160-168-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/1160-170-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/1160-172-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/1160-174-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/1160-176-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/1160-178-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/1160-180-0x00000000024F0000-0x0000000002502000-memory.dmpFilesize
72KB
-
memory/1160-181-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1160-182-0x0000000004B80000-0x0000000004B90000-memory.dmpFilesize
64KB
-
memory/1160-183-0x0000000004B80000-0x0000000004B90000-memory.dmpFilesize
64KB
-
memory/1160-185-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4608-1121-0x0000000000D80000-0x0000000000DB2000-memory.dmpFilesize
200KB
-
memory/4608-1122-0x0000000005670000-0x0000000005680000-memory.dmpFilesize
64KB
-
memory/5020-191-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/5020-405-0x00000000021D0000-0x00000000021E0000-memory.dmpFilesize
64KB
-
memory/5020-195-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/5020-197-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/5020-199-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/5020-201-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/5020-203-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/5020-205-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/5020-207-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/5020-209-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/5020-211-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/5020-213-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/5020-217-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/5020-215-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/5020-219-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/5020-221-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/5020-223-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/5020-402-0x0000000002120000-0x000000000216B000-memory.dmpFilesize
300KB
-
memory/5020-403-0x00000000021D0000-0x00000000021E0000-memory.dmpFilesize
64KB
-
memory/5020-193-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/5020-407-0x00000000021D0000-0x00000000021E0000-memory.dmpFilesize
64KB
-
memory/5020-1100-0x0000000005210000-0x0000000005828000-memory.dmpFilesize
6.1MB
-
memory/5020-1101-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/5020-1102-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/5020-1103-0x00000000021D0000-0x00000000021E0000-memory.dmpFilesize
64KB
-
memory/5020-1104-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/5020-1105-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/5020-1106-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/5020-1109-0x00000000021D0000-0x00000000021E0000-memory.dmpFilesize
64KB
-
memory/5020-1108-0x00000000021D0000-0x00000000021E0000-memory.dmpFilesize
64KB
-
memory/5020-1110-0x00000000021D0000-0x00000000021E0000-memory.dmpFilesize
64KB
-
memory/5020-1111-0x0000000006790000-0x0000000006806000-memory.dmpFilesize
472KB
-
memory/5020-1112-0x0000000006830000-0x0000000006880000-memory.dmpFilesize
320KB
-
memory/5020-190-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/5020-1113-0x00000000021D0000-0x00000000021E0000-memory.dmpFilesize
64KB
-
memory/5020-1114-0x00000000068B0000-0x0000000006A72000-memory.dmpFilesize
1.8MB
-
memory/5020-1115-0x0000000006A80000-0x0000000006FAC000-memory.dmpFilesize
5.2MB