Analysis
-
max time kernel
102s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 19:36
Static task
static1
Behavioral task
behavioral1
Sample
ddb89cd8277fe66a12ee4d7ef7cae5e80ac8eb81b4345b76ca569ea55128520d.exe
Resource
win10v2004-20230220-en
General
-
Target
ddb89cd8277fe66a12ee4d7ef7cae5e80ac8eb81b4345b76ca569ea55128520d.exe
-
Size
663KB
-
MD5
caf9195b791c514db3032f5580c16e76
-
SHA1
6a45d18fc93d0fcac1e64f7de369faf0a24dc461
-
SHA256
ddb89cd8277fe66a12ee4d7ef7cae5e80ac8eb81b4345b76ca569ea55128520d
-
SHA512
d3becff7f78da4be7feeb17e900165499a8df320695fd19d9a9bf611368dcf85e348408a5801880590ad1d3cccc82c58dfe12602318eb166b06050f5fb2bdf56
-
SSDEEP
12288:MMr+y90/viuU1cgXLgDvDycPocBE449zWKigZtRL2uFeF5m:Syy+dcFBV4AKF9L2meF5m
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro9654.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro9654.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro9654.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro9654.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro9654.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro9654.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro9654.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/392-191-0x0000000002780000-0x00000000027BF000-memory.dmp family_redline behavioral1/memory/392-192-0x0000000002780000-0x00000000027BF000-memory.dmp family_redline behavioral1/memory/392-194-0x0000000002780000-0x00000000027BF000-memory.dmp family_redline behavioral1/memory/392-196-0x0000000002780000-0x00000000027BF000-memory.dmp family_redline behavioral1/memory/392-198-0x0000000002780000-0x00000000027BF000-memory.dmp family_redline behavioral1/memory/392-200-0x0000000002780000-0x00000000027BF000-memory.dmp family_redline behavioral1/memory/392-202-0x0000000002780000-0x00000000027BF000-memory.dmp family_redline behavioral1/memory/392-204-0x0000000002780000-0x00000000027BF000-memory.dmp family_redline behavioral1/memory/392-206-0x0000000002780000-0x00000000027BF000-memory.dmp family_redline behavioral1/memory/392-208-0x0000000002780000-0x00000000027BF000-memory.dmp family_redline behavioral1/memory/392-210-0x0000000002780000-0x00000000027BF000-memory.dmp family_redline behavioral1/memory/392-212-0x0000000002780000-0x00000000027BF000-memory.dmp family_redline behavioral1/memory/392-214-0x0000000002780000-0x00000000027BF000-memory.dmp family_redline behavioral1/memory/392-216-0x0000000002780000-0x00000000027BF000-memory.dmp family_redline behavioral1/memory/392-218-0x0000000002780000-0x00000000027BF000-memory.dmp family_redline behavioral1/memory/392-220-0x0000000002780000-0x00000000027BF000-memory.dmp family_redline behavioral1/memory/392-222-0x0000000002780000-0x00000000027BF000-memory.dmp family_redline behavioral1/memory/392-224-0x0000000002780000-0x00000000027BF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un007254.exepro9654.exequ2580.exesi157710.exepid process 4624 un007254.exe 4996 pro9654.exe 392 qu2580.exe 2700 si157710.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro9654.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro9654.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro9654.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
ddb89cd8277fe66a12ee4d7ef7cae5e80ac8eb81b4345b76ca569ea55128520d.exeun007254.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" ddb89cd8277fe66a12ee4d7ef7cae5e80ac8eb81b4345b76ca569ea55128520d.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un007254.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un007254.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ddb89cd8277fe66a12ee4d7ef7cae5e80ac8eb81b4345b76ca569ea55128520d.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3540 4996 WerFault.exe pro9654.exe 1816 392 WerFault.exe qu2580.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro9654.exequ2580.exesi157710.exepid process 4996 pro9654.exe 4996 pro9654.exe 392 qu2580.exe 392 qu2580.exe 2700 si157710.exe 2700 si157710.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro9654.exequ2580.exesi157710.exedescription pid process Token: SeDebugPrivilege 4996 pro9654.exe Token: SeDebugPrivilege 392 qu2580.exe Token: SeDebugPrivilege 2700 si157710.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
ddb89cd8277fe66a12ee4d7ef7cae5e80ac8eb81b4345b76ca569ea55128520d.exeun007254.exedescription pid process target process PID 4464 wrote to memory of 4624 4464 ddb89cd8277fe66a12ee4d7ef7cae5e80ac8eb81b4345b76ca569ea55128520d.exe un007254.exe PID 4464 wrote to memory of 4624 4464 ddb89cd8277fe66a12ee4d7ef7cae5e80ac8eb81b4345b76ca569ea55128520d.exe un007254.exe PID 4464 wrote to memory of 4624 4464 ddb89cd8277fe66a12ee4d7ef7cae5e80ac8eb81b4345b76ca569ea55128520d.exe un007254.exe PID 4624 wrote to memory of 4996 4624 un007254.exe pro9654.exe PID 4624 wrote to memory of 4996 4624 un007254.exe pro9654.exe PID 4624 wrote to memory of 4996 4624 un007254.exe pro9654.exe PID 4624 wrote to memory of 392 4624 un007254.exe qu2580.exe PID 4624 wrote to memory of 392 4624 un007254.exe qu2580.exe PID 4624 wrote to memory of 392 4624 un007254.exe qu2580.exe PID 4464 wrote to memory of 2700 4464 ddb89cd8277fe66a12ee4d7ef7cae5e80ac8eb81b4345b76ca569ea55128520d.exe si157710.exe PID 4464 wrote to memory of 2700 4464 ddb89cd8277fe66a12ee4d7ef7cae5e80ac8eb81b4345b76ca569ea55128520d.exe si157710.exe PID 4464 wrote to memory of 2700 4464 ddb89cd8277fe66a12ee4d7ef7cae5e80ac8eb81b4345b76ca569ea55128520d.exe si157710.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddb89cd8277fe66a12ee4d7ef7cae5e80ac8eb81b4345b76ca569ea55128520d.exe"C:\Users\Admin\AppData\Local\Temp\ddb89cd8277fe66a12ee4d7ef7cae5e80ac8eb81b4345b76ca569ea55128520d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un007254.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un007254.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9654.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9654.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 10804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2580.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2580.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 392 -s 13364⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si157710.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si157710.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4996 -ip 49961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 392 -ip 3921⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si157710.exeFilesize
175KB
MD5a56ec82cbe4f215e9a745a42ca6403f0
SHA1e29751624749e95f6b5a64e34ece93c3c325e049
SHA2562b0a7a4f825d865604d072647909afd437c3a1481ce5fd838eb5c752ef9b31ab
SHA512326c57472a36986ceccedea335ec2ebd5f39e83bc488301dc4f090357ff48a62e5c1a5cb9d2c00ef0259d283d49b53ad14dd70a09b137ecf2886e1e7c92ff51c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si157710.exeFilesize
175KB
MD5a56ec82cbe4f215e9a745a42ca6403f0
SHA1e29751624749e95f6b5a64e34ece93c3c325e049
SHA2562b0a7a4f825d865604d072647909afd437c3a1481ce5fd838eb5c752ef9b31ab
SHA512326c57472a36986ceccedea335ec2ebd5f39e83bc488301dc4f090357ff48a62e5c1a5cb9d2c00ef0259d283d49b53ad14dd70a09b137ecf2886e1e7c92ff51c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un007254.exeFilesize
521KB
MD500bac3da669072a7a8658eec20896023
SHA1b6debf4242faaa080da7fc24ce5924cd26d714ee
SHA2561f8d8ccf23b4e2536e5d03c62a818e1bf65208f99ee393f93fafeae290927ed0
SHA512f65ae6aa41693d387f118de3242b3cf7df53cd534ed1718b301e5ac21c8e8faacbad8bdbfe20fe4df145f5c7f6777bc15c4f180601c2477fc16c31d4d1f81e0f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un007254.exeFilesize
521KB
MD500bac3da669072a7a8658eec20896023
SHA1b6debf4242faaa080da7fc24ce5924cd26d714ee
SHA2561f8d8ccf23b4e2536e5d03c62a818e1bf65208f99ee393f93fafeae290927ed0
SHA512f65ae6aa41693d387f118de3242b3cf7df53cd534ed1718b301e5ac21c8e8faacbad8bdbfe20fe4df145f5c7f6777bc15c4f180601c2477fc16c31d4d1f81e0f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9654.exeFilesize
236KB
MD5f75e5e463c45b7c40a69eab9c5fc7f00
SHA114a6228677aa5b1ad38156737b55f519ed192238
SHA256be0a80a531b86da8b63ac3bb0018c4f42e16c69d9617abd87b6187b34d9eac70
SHA512c7d86179d1a313bc9aa9d42a72f74cca92b3f81ac3df47ce0d5e6a03c76d86878c36b44ea737d746c40e603397e41224c645600c7ed8eead5622362e6582a006
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9654.exeFilesize
236KB
MD5f75e5e463c45b7c40a69eab9c5fc7f00
SHA114a6228677aa5b1ad38156737b55f519ed192238
SHA256be0a80a531b86da8b63ac3bb0018c4f42e16c69d9617abd87b6187b34d9eac70
SHA512c7d86179d1a313bc9aa9d42a72f74cca92b3f81ac3df47ce0d5e6a03c76d86878c36b44ea737d746c40e603397e41224c645600c7ed8eead5622362e6582a006
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2580.exeFilesize
294KB
MD56e260c0d2bc71e610de93cadd8e7cc3b
SHA1a2cfed66a0aa34fb2c115675eabd31c4a2e826fc
SHA256e87f20c64c40cec88ec178988432d5b58debd9349cbe93e8d75a56ba230b51b4
SHA512587a6d5f62dc6e1c2f150e817fb6b011b554a23c83061eb8bfa57ff165e49977bfebdd6dd4d335514de00b9c97cf24418ec83f28d858dc7f4bbbb2951866797f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2580.exeFilesize
294KB
MD56e260c0d2bc71e610de93cadd8e7cc3b
SHA1a2cfed66a0aa34fb2c115675eabd31c4a2e826fc
SHA256e87f20c64c40cec88ec178988432d5b58debd9349cbe93e8d75a56ba230b51b4
SHA512587a6d5f62dc6e1c2f150e817fb6b011b554a23c83061eb8bfa57ff165e49977bfebdd6dd4d335514de00b9c97cf24418ec83f28d858dc7f4bbbb2951866797f
-
memory/392-1102-0x0000000004BF0000-0x0000000004C02000-memory.dmpFilesize
72KB
-
memory/392-1101-0x00000000058F0000-0x00000000059FA000-memory.dmpFilesize
1.0MB
-
memory/392-220-0x0000000002780000-0x00000000027BF000-memory.dmpFilesize
252KB
-
memory/392-218-0x0000000002780000-0x00000000027BF000-memory.dmpFilesize
252KB
-
memory/392-204-0x0000000002780000-0x00000000027BF000-memory.dmpFilesize
252KB
-
memory/392-206-0x0000000002780000-0x00000000027BF000-memory.dmpFilesize
252KB
-
memory/392-1115-0x00000000082A0000-0x00000000082F0000-memory.dmpFilesize
320KB
-
memory/392-1114-0x0000000008210000-0x0000000008286000-memory.dmpFilesize
472KB
-
memory/392-1113-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/392-1112-0x00000000068D0000-0x0000000006DFC000-memory.dmpFilesize
5.2MB
-
memory/392-208-0x0000000002780000-0x00000000027BF000-memory.dmpFilesize
252KB
-
memory/392-1111-0x00000000066F0000-0x00000000068B2000-memory.dmpFilesize
1.8MB
-
memory/392-1110-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/392-1109-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/392-1108-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/392-1106-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/392-1105-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/392-1104-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/392-1103-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/392-222-0x0000000002780000-0x00000000027BF000-memory.dmpFilesize
252KB
-
memory/392-1100-0x00000000052D0000-0x00000000058E8000-memory.dmpFilesize
6.1MB
-
memory/392-272-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/392-270-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/392-191-0x0000000002780000-0x00000000027BF000-memory.dmpFilesize
252KB
-
memory/392-192-0x0000000002780000-0x00000000027BF000-memory.dmpFilesize
252KB
-
memory/392-194-0x0000000002780000-0x00000000027BF000-memory.dmpFilesize
252KB
-
memory/392-196-0x0000000002780000-0x00000000027BF000-memory.dmpFilesize
252KB
-
memory/392-198-0x0000000002780000-0x00000000027BF000-memory.dmpFilesize
252KB
-
memory/392-200-0x0000000002780000-0x00000000027BF000-memory.dmpFilesize
252KB
-
memory/392-202-0x0000000002780000-0x00000000027BF000-memory.dmpFilesize
252KB
-
memory/392-216-0x0000000002780000-0x00000000027BF000-memory.dmpFilesize
252KB
-
memory/392-268-0x0000000000740000-0x000000000078B000-memory.dmpFilesize
300KB
-
memory/392-224-0x0000000002780000-0x00000000027BF000-memory.dmpFilesize
252KB
-
memory/392-210-0x0000000002780000-0x00000000027BF000-memory.dmpFilesize
252KB
-
memory/392-212-0x0000000002780000-0x00000000027BF000-memory.dmpFilesize
252KB
-
memory/392-214-0x0000000002780000-0x00000000027BF000-memory.dmpFilesize
252KB
-
memory/2700-1121-0x0000000000380000-0x00000000003B2000-memory.dmpFilesize
200KB
-
memory/2700-1122-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/2700-1123-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/4996-181-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4996-170-0x00000000025E0000-0x00000000025F2000-memory.dmpFilesize
72KB
-
memory/4996-149-0x0000000004C80000-0x0000000005224000-memory.dmpFilesize
5.6MB
-
memory/4996-151-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/4996-152-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/4996-186-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4996-184-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/4996-150-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/4996-183-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/4996-182-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/4996-153-0x00000000025E0000-0x00000000025F2000-memory.dmpFilesize
72KB
-
memory/4996-180-0x00000000025E0000-0x00000000025F2000-memory.dmpFilesize
72KB
-
memory/4996-178-0x00000000025E0000-0x00000000025F2000-memory.dmpFilesize
72KB
-
memory/4996-176-0x00000000025E0000-0x00000000025F2000-memory.dmpFilesize
72KB
-
memory/4996-174-0x00000000025E0000-0x00000000025F2000-memory.dmpFilesize
72KB
-
memory/4996-172-0x00000000025E0000-0x00000000025F2000-memory.dmpFilesize
72KB
-
memory/4996-168-0x00000000025E0000-0x00000000025F2000-memory.dmpFilesize
72KB
-
memory/4996-166-0x00000000025E0000-0x00000000025F2000-memory.dmpFilesize
72KB
-
memory/4996-164-0x00000000025E0000-0x00000000025F2000-memory.dmpFilesize
72KB
-
memory/4996-162-0x00000000025E0000-0x00000000025F2000-memory.dmpFilesize
72KB
-
memory/4996-160-0x00000000025E0000-0x00000000025F2000-memory.dmpFilesize
72KB
-
memory/4996-148-0x00000000005C0000-0x00000000005ED000-memory.dmpFilesize
180KB
-
memory/4996-158-0x00000000025E0000-0x00000000025F2000-memory.dmpFilesize
72KB
-
memory/4996-156-0x00000000025E0000-0x00000000025F2000-memory.dmpFilesize
72KB
-
memory/4996-154-0x00000000025E0000-0x00000000025F2000-memory.dmpFilesize
72KB