Analysis
-
max time kernel
53s -
max time network
66s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
03-04-2023 19:44
Static task
static1
Behavioral task
behavioral1
Sample
4c04dc456997fcd63d04f6d1d54fbea79f4bf6b87dba046620d21144fa3f1702.exe
Resource
win10-20230220-en
General
-
Target
4c04dc456997fcd63d04f6d1d54fbea79f4bf6b87dba046620d21144fa3f1702.exe
-
Size
658KB
-
MD5
62857586c646686e7f87be0ec1e492e8
-
SHA1
dc6938e20cbeaf7f0fe804807875328c9319aedd
-
SHA256
4c04dc456997fcd63d04f6d1d54fbea79f4bf6b87dba046620d21144fa3f1702
-
SHA512
a455fc98cf051889aac80764bd67f1bd9323b25f74e7941adb6ab550419fd05a704bacbcf4c3862ed9b557d0de51450195542700b302078efc664ffc5fac16a9
-
SSDEEP
12288:hMrMy903FwqDru6ExE8tNFGQjAz9NQTQX449zWKq58vNycTUG2:VyiKquQ8tDzjAz9+QI4AKQ62
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro6691.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro6691.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro6691.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro6691.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro6691.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro6691.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/4884-181-0x0000000002180000-0x00000000021C6000-memory.dmp family_redline behavioral1/memory/4884-184-0x0000000004A50000-0x0000000004A94000-memory.dmp family_redline behavioral1/memory/4884-187-0x0000000004A50000-0x0000000004A8F000-memory.dmp family_redline behavioral1/memory/4884-188-0x0000000004A50000-0x0000000004A8F000-memory.dmp family_redline behavioral1/memory/4884-190-0x0000000004A50000-0x0000000004A8F000-memory.dmp family_redline behavioral1/memory/4884-192-0x0000000004A50000-0x0000000004A8F000-memory.dmp family_redline behavioral1/memory/4884-194-0x0000000004A50000-0x0000000004A8F000-memory.dmp family_redline behavioral1/memory/4884-196-0x0000000004A50000-0x0000000004A8F000-memory.dmp family_redline behavioral1/memory/4884-198-0x0000000004A50000-0x0000000004A8F000-memory.dmp family_redline behavioral1/memory/4884-200-0x0000000004A50000-0x0000000004A8F000-memory.dmp family_redline behavioral1/memory/4884-202-0x0000000004A50000-0x0000000004A8F000-memory.dmp family_redline behavioral1/memory/4884-204-0x0000000004A50000-0x0000000004A8F000-memory.dmp family_redline behavioral1/memory/4884-206-0x0000000004A50000-0x0000000004A8F000-memory.dmp family_redline behavioral1/memory/4884-208-0x0000000004A50000-0x0000000004A8F000-memory.dmp family_redline behavioral1/memory/4884-210-0x0000000004A50000-0x0000000004A8F000-memory.dmp family_redline behavioral1/memory/4884-212-0x0000000004A50000-0x0000000004A8F000-memory.dmp family_redline behavioral1/memory/4884-214-0x0000000004A50000-0x0000000004A8F000-memory.dmp family_redline behavioral1/memory/4884-216-0x0000000004A50000-0x0000000004A8F000-memory.dmp family_redline behavioral1/memory/4884-218-0x0000000004A50000-0x0000000004A8F000-memory.dmp family_redline behavioral1/memory/4884-220-0x0000000004A50000-0x0000000004A8F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un588402.exepro6691.exequ2747.exesi061836.exepid process 2544 un588402.exe 2604 pro6691.exe 4884 qu2747.exe 3724 si061836.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro6691.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro6691.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro6691.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un588402.exe4c04dc456997fcd63d04f6d1d54fbea79f4bf6b87dba046620d21144fa3f1702.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un588402.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un588402.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 4c04dc456997fcd63d04f6d1d54fbea79f4bf6b87dba046620d21144fa3f1702.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 4c04dc456997fcd63d04f6d1d54fbea79f4bf6b87dba046620d21144fa3f1702.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro6691.exequ2747.exesi061836.exepid process 2604 pro6691.exe 2604 pro6691.exe 4884 qu2747.exe 4884 qu2747.exe 3724 si061836.exe 3724 si061836.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro6691.exequ2747.exesi061836.exedescription pid process Token: SeDebugPrivilege 2604 pro6691.exe Token: SeDebugPrivilege 4884 qu2747.exe Token: SeDebugPrivilege 3724 si061836.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
4c04dc456997fcd63d04f6d1d54fbea79f4bf6b87dba046620d21144fa3f1702.exeun588402.exedescription pid process target process PID 2484 wrote to memory of 2544 2484 4c04dc456997fcd63d04f6d1d54fbea79f4bf6b87dba046620d21144fa3f1702.exe un588402.exe PID 2484 wrote to memory of 2544 2484 4c04dc456997fcd63d04f6d1d54fbea79f4bf6b87dba046620d21144fa3f1702.exe un588402.exe PID 2484 wrote to memory of 2544 2484 4c04dc456997fcd63d04f6d1d54fbea79f4bf6b87dba046620d21144fa3f1702.exe un588402.exe PID 2544 wrote to memory of 2604 2544 un588402.exe pro6691.exe PID 2544 wrote to memory of 2604 2544 un588402.exe pro6691.exe PID 2544 wrote to memory of 2604 2544 un588402.exe pro6691.exe PID 2544 wrote to memory of 4884 2544 un588402.exe qu2747.exe PID 2544 wrote to memory of 4884 2544 un588402.exe qu2747.exe PID 2544 wrote to memory of 4884 2544 un588402.exe qu2747.exe PID 2484 wrote to memory of 3724 2484 4c04dc456997fcd63d04f6d1d54fbea79f4bf6b87dba046620d21144fa3f1702.exe si061836.exe PID 2484 wrote to memory of 3724 2484 4c04dc456997fcd63d04f6d1d54fbea79f4bf6b87dba046620d21144fa3f1702.exe si061836.exe PID 2484 wrote to memory of 3724 2484 4c04dc456997fcd63d04f6d1d54fbea79f4bf6b87dba046620d21144fa3f1702.exe si061836.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c04dc456997fcd63d04f6d1d54fbea79f4bf6b87dba046620d21144fa3f1702.exe"C:\Users\Admin\AppData\Local\Temp\4c04dc456997fcd63d04f6d1d54fbea79f4bf6b87dba046620d21144fa3f1702.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un588402.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un588402.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6691.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6691.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2747.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2747.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si061836.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si061836.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si061836.exeFilesize
175KB
MD58c7563c78ccd1f89251dc543b5ba6b07
SHA1f9ddcdedb9edb1d872ba64dcd28cb8d622ef1dd0
SHA256d2f46cde5e02a130938a0a4c4db3e07780e41fb326c4dec78c2fefd094a4d9a4
SHA51239bf861c0043fbf22dd824811df85f831bddbc512dd0269e690694dc41b7aeff39255b624eb26e83447a3c48759feea9d62005997b7767d6db48a9e070a9fd1a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si061836.exeFilesize
175KB
MD58c7563c78ccd1f89251dc543b5ba6b07
SHA1f9ddcdedb9edb1d872ba64dcd28cb8d622ef1dd0
SHA256d2f46cde5e02a130938a0a4c4db3e07780e41fb326c4dec78c2fefd094a4d9a4
SHA51239bf861c0043fbf22dd824811df85f831bddbc512dd0269e690694dc41b7aeff39255b624eb26e83447a3c48759feea9d62005997b7767d6db48a9e070a9fd1a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un588402.exeFilesize
516KB
MD57fdb3a14adc79349974d2666bbbaa44a
SHA129479c43f3ea6c94c2620dec14172ab2c8807d96
SHA2566369275ff25710e2328d09eade8662d0a78475fbb707ca31440d2809bbf0714d
SHA5127f0f41714923da6085630be1e6c226bcec19c8c7c147ad22b3f649c4c6fbd12881c4ff86d5808b5628197de4b1c6c8242ab1c5fe5bada30eaa63dba2bcac5ad7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un588402.exeFilesize
516KB
MD57fdb3a14adc79349974d2666bbbaa44a
SHA129479c43f3ea6c94c2620dec14172ab2c8807d96
SHA2566369275ff25710e2328d09eade8662d0a78475fbb707ca31440d2809bbf0714d
SHA5127f0f41714923da6085630be1e6c226bcec19c8c7c147ad22b3f649c4c6fbd12881c4ff86d5808b5628197de4b1c6c8242ab1c5fe5bada30eaa63dba2bcac5ad7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6691.exeFilesize
235KB
MD5c608d1f378f4cc10d18ed8365b0a3020
SHA1cfd6288198f94b872762b8c88b482b097eec998f
SHA256a2021b9aa91463501abe6ac9a8a22eb43a9068b1d3576283a39fcc62dc8df423
SHA5123979a4660b4f20af729404bccae90049065446d5c79892b5678c2aa8847305cd1def6dd1f0bcdc7c2684959c9a968234c4de5d07cf90ddcda13aa18639555eaa
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6691.exeFilesize
235KB
MD5c608d1f378f4cc10d18ed8365b0a3020
SHA1cfd6288198f94b872762b8c88b482b097eec998f
SHA256a2021b9aa91463501abe6ac9a8a22eb43a9068b1d3576283a39fcc62dc8df423
SHA5123979a4660b4f20af729404bccae90049065446d5c79892b5678c2aa8847305cd1def6dd1f0bcdc7c2684959c9a968234c4de5d07cf90ddcda13aa18639555eaa
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2747.exeFilesize
294KB
MD5cc79c83f2bcd48bfd1bdb27a23e2dad3
SHA1d1832c8a1da768c3748b3714e9daab92c6a030f9
SHA25697de967f1be84b7921d30d4504d419027eff115b7a2e2e996eeb5a04e803a3e4
SHA512e6acfc66ea757aa99b2501c91662d2efaf7428b1642f19b11f9dd5867424c2af7b01289b1811efe331b4bcd9cc352d3ba8d5f8be715f4be80aae06605c275955
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2747.exeFilesize
294KB
MD5cc79c83f2bcd48bfd1bdb27a23e2dad3
SHA1d1832c8a1da768c3748b3714e9daab92c6a030f9
SHA25697de967f1be84b7921d30d4504d419027eff115b7a2e2e996eeb5a04e803a3e4
SHA512e6acfc66ea757aa99b2501c91662d2efaf7428b1642f19b11f9dd5867424c2af7b01289b1811efe331b4bcd9cc352d3ba8d5f8be715f4be80aae06605c275955
-
memory/2604-136-0x00000000001D0000-0x00000000001FD000-memory.dmpFilesize
180KB
-
memory/2604-137-0x0000000002150000-0x000000000216A000-memory.dmpFilesize
104KB
-
memory/2604-138-0x0000000004A50000-0x0000000004F4E000-memory.dmpFilesize
5.0MB
-
memory/2604-139-0x00000000049D0000-0x00000000049E8000-memory.dmpFilesize
96KB
-
memory/2604-140-0x00000000049D0000-0x00000000049E2000-memory.dmpFilesize
72KB
-
memory/2604-141-0x00000000049D0000-0x00000000049E2000-memory.dmpFilesize
72KB
-
memory/2604-143-0x00000000049D0000-0x00000000049E2000-memory.dmpFilesize
72KB
-
memory/2604-145-0x00000000049D0000-0x00000000049E2000-memory.dmpFilesize
72KB
-
memory/2604-147-0x00000000049D0000-0x00000000049E2000-memory.dmpFilesize
72KB
-
memory/2604-149-0x00000000049D0000-0x00000000049E2000-memory.dmpFilesize
72KB
-
memory/2604-151-0x00000000049D0000-0x00000000049E2000-memory.dmpFilesize
72KB
-
memory/2604-153-0x00000000049D0000-0x00000000049E2000-memory.dmpFilesize
72KB
-
memory/2604-155-0x00000000049D0000-0x00000000049E2000-memory.dmpFilesize
72KB
-
memory/2604-157-0x0000000004A40000-0x0000000004A50000-memory.dmpFilesize
64KB
-
memory/2604-159-0x00000000049D0000-0x00000000049E2000-memory.dmpFilesize
72KB
-
memory/2604-158-0x0000000004A40000-0x0000000004A50000-memory.dmpFilesize
64KB
-
memory/2604-161-0x0000000004A40000-0x0000000004A50000-memory.dmpFilesize
64KB
-
memory/2604-162-0x00000000049D0000-0x00000000049E2000-memory.dmpFilesize
72KB
-
memory/2604-164-0x00000000049D0000-0x00000000049E2000-memory.dmpFilesize
72KB
-
memory/2604-166-0x00000000049D0000-0x00000000049E2000-memory.dmpFilesize
72KB
-
memory/2604-168-0x00000000049D0000-0x00000000049E2000-memory.dmpFilesize
72KB
-
memory/2604-170-0x00000000049D0000-0x00000000049E2000-memory.dmpFilesize
72KB
-
memory/2604-171-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2604-172-0x0000000004A40000-0x0000000004A50000-memory.dmpFilesize
64KB
-
memory/2604-173-0x0000000004A40000-0x0000000004A50000-memory.dmpFilesize
64KB
-
memory/2604-174-0x0000000004A40000-0x0000000004A50000-memory.dmpFilesize
64KB
-
memory/2604-176-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/3724-1114-0x0000000000760000-0x0000000000792000-memory.dmpFilesize
200KB
-
memory/3724-1116-0x00000000052E0000-0x00000000052F0000-memory.dmpFilesize
64KB
-
memory/3724-1115-0x00000000051A0000-0x00000000051EB000-memory.dmpFilesize
300KB
-
memory/4884-182-0x0000000000590000-0x00000000005DB000-memory.dmpFilesize
300KB
-
memory/4884-216-0x0000000004A50000-0x0000000004A8F000-memory.dmpFilesize
252KB
-
memory/4884-184-0x0000000004A50000-0x0000000004A94000-memory.dmpFilesize
272KB
-
memory/4884-186-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/4884-187-0x0000000004A50000-0x0000000004A8F000-memory.dmpFilesize
252KB
-
memory/4884-188-0x0000000004A50000-0x0000000004A8F000-memory.dmpFilesize
252KB
-
memory/4884-190-0x0000000004A50000-0x0000000004A8F000-memory.dmpFilesize
252KB
-
memory/4884-192-0x0000000004A50000-0x0000000004A8F000-memory.dmpFilesize
252KB
-
memory/4884-194-0x0000000004A50000-0x0000000004A8F000-memory.dmpFilesize
252KB
-
memory/4884-196-0x0000000004A50000-0x0000000004A8F000-memory.dmpFilesize
252KB
-
memory/4884-198-0x0000000004A50000-0x0000000004A8F000-memory.dmpFilesize
252KB
-
memory/4884-200-0x0000000004A50000-0x0000000004A8F000-memory.dmpFilesize
252KB
-
memory/4884-202-0x0000000004A50000-0x0000000004A8F000-memory.dmpFilesize
252KB
-
memory/4884-204-0x0000000004A50000-0x0000000004A8F000-memory.dmpFilesize
252KB
-
memory/4884-206-0x0000000004A50000-0x0000000004A8F000-memory.dmpFilesize
252KB
-
memory/4884-208-0x0000000004A50000-0x0000000004A8F000-memory.dmpFilesize
252KB
-
memory/4884-210-0x0000000004A50000-0x0000000004A8F000-memory.dmpFilesize
252KB
-
memory/4884-212-0x0000000004A50000-0x0000000004A8F000-memory.dmpFilesize
252KB
-
memory/4884-214-0x0000000004A50000-0x0000000004A8F000-memory.dmpFilesize
252KB
-
memory/4884-185-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/4884-218-0x0000000004A50000-0x0000000004A8F000-memory.dmpFilesize
252KB
-
memory/4884-220-0x0000000004A50000-0x0000000004A8F000-memory.dmpFilesize
252KB
-
memory/4884-1093-0x0000000005080000-0x0000000005686000-memory.dmpFilesize
6.0MB
-
memory/4884-1094-0x0000000005690000-0x000000000579A000-memory.dmpFilesize
1.0MB
-
memory/4884-1095-0x00000000057A0000-0x00000000057B2000-memory.dmpFilesize
72KB
-
memory/4884-1096-0x00000000057C0000-0x00000000057FE000-memory.dmpFilesize
248KB
-
memory/4884-1097-0x0000000005910000-0x000000000595B000-memory.dmpFilesize
300KB
-
memory/4884-1098-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/4884-1100-0x0000000005AA0000-0x0000000005B32000-memory.dmpFilesize
584KB
-
memory/4884-1101-0x0000000005B40000-0x0000000005BA6000-memory.dmpFilesize
408KB
-
memory/4884-1102-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/4884-1103-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/4884-1104-0x0000000006250000-0x0000000006412000-memory.dmpFilesize
1.8MB
-
memory/4884-1105-0x0000000006420000-0x000000000694C000-memory.dmpFilesize
5.2MB
-
memory/4884-183-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/4884-181-0x0000000002180000-0x00000000021C6000-memory.dmpFilesize
280KB
-
memory/4884-1106-0x0000000002440000-0x00000000024B6000-memory.dmpFilesize
472KB
-
memory/4884-1107-0x0000000007E40000-0x0000000007E90000-memory.dmpFilesize
320KB
-
memory/4884-1108-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB