Analysis
-
max time kernel
106s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 19:48
Static task
static1
Behavioral task
behavioral1
Sample
182394346113ce0608593b3a9caa541b5d958dbd6906137af85b3e996b0fa0bf.exe
Resource
win10v2004-20230220-en
General
-
Target
182394346113ce0608593b3a9caa541b5d958dbd6906137af85b3e996b0fa0bf.exe
-
Size
658KB
-
MD5
ca11b95a0aecfd8a2d8a43e921578e72
-
SHA1
1c4b57eeaf2e1605370f1405f17e966d6108222a
-
SHA256
182394346113ce0608593b3a9caa541b5d958dbd6906137af85b3e996b0fa0bf
-
SHA512
15ad340add5630c748aa34c99eb41648e4ab346e0b2c639c6d92e7ef8ad72709ad42f44810369c9ba694eeb1b81d72f85ba076f31c4d704454ced775e89907a5
-
SSDEEP
12288:GMrvy90Z0Vy9jksT5RWActeTfQQqHorAU44fzWKs98vGlMw5NDx8Y:FyzQ6sLvctUoQqHAAF4qKslMOb
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro1274.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro1274.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro1274.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro1274.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro1274.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro1274.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro1274.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/3836-191-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/3836-192-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/3836-194-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/3836-196-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/3836-198-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/3836-200-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/3836-202-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/3836-204-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/3836-206-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/3836-208-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/3836-210-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/3836-212-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/3836-214-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/3836-216-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/3836-218-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/3836-220-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/3836-222-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/3836-224-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/3836-1109-0x0000000004B00000-0x0000000004B10000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un194135.exepro1274.exequ7505.exesi707141.exepid process 1632 un194135.exe 2132 pro1274.exe 3836 qu7505.exe 3276 si707141.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro1274.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro1274.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro1274.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
182394346113ce0608593b3a9caa541b5d958dbd6906137af85b3e996b0fa0bf.exeun194135.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 182394346113ce0608593b3a9caa541b5d958dbd6906137af85b3e996b0fa0bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 182394346113ce0608593b3a9caa541b5d958dbd6906137af85b3e996b0fa0bf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un194135.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un194135.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2804 2132 WerFault.exe pro1274.exe 4220 3836 WerFault.exe qu7505.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro1274.exequ7505.exesi707141.exepid process 2132 pro1274.exe 2132 pro1274.exe 3836 qu7505.exe 3836 qu7505.exe 3276 si707141.exe 3276 si707141.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro1274.exequ7505.exesi707141.exedescription pid process Token: SeDebugPrivilege 2132 pro1274.exe Token: SeDebugPrivilege 3836 qu7505.exe Token: SeDebugPrivilege 3276 si707141.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
182394346113ce0608593b3a9caa541b5d958dbd6906137af85b3e996b0fa0bf.exeun194135.exedescription pid process target process PID 4408 wrote to memory of 1632 4408 182394346113ce0608593b3a9caa541b5d958dbd6906137af85b3e996b0fa0bf.exe un194135.exe PID 4408 wrote to memory of 1632 4408 182394346113ce0608593b3a9caa541b5d958dbd6906137af85b3e996b0fa0bf.exe un194135.exe PID 4408 wrote to memory of 1632 4408 182394346113ce0608593b3a9caa541b5d958dbd6906137af85b3e996b0fa0bf.exe un194135.exe PID 1632 wrote to memory of 2132 1632 un194135.exe pro1274.exe PID 1632 wrote to memory of 2132 1632 un194135.exe pro1274.exe PID 1632 wrote to memory of 2132 1632 un194135.exe pro1274.exe PID 1632 wrote to memory of 3836 1632 un194135.exe qu7505.exe PID 1632 wrote to memory of 3836 1632 un194135.exe qu7505.exe PID 1632 wrote to memory of 3836 1632 un194135.exe qu7505.exe PID 4408 wrote to memory of 3276 4408 182394346113ce0608593b3a9caa541b5d958dbd6906137af85b3e996b0fa0bf.exe si707141.exe PID 4408 wrote to memory of 3276 4408 182394346113ce0608593b3a9caa541b5d958dbd6906137af85b3e996b0fa0bf.exe si707141.exe PID 4408 wrote to memory of 3276 4408 182394346113ce0608593b3a9caa541b5d958dbd6906137af85b3e996b0fa0bf.exe si707141.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\182394346113ce0608593b3a9caa541b5d958dbd6906137af85b3e996b0fa0bf.exe"C:\Users\Admin\AppData\Local\Temp\182394346113ce0608593b3a9caa541b5d958dbd6906137af85b3e996b0fa0bf.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un194135.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un194135.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1274.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1274.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 10884⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7505.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7505.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 18484⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si707141.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si707141.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2132 -ip 21321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3836 -ip 38361⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si707141.exeFilesize
175KB
MD535dddcf57f1b2252b881606d644839de
SHA1c9a5bb72beca91ffd5d2e74fd3d37a217013e81d
SHA2565709ea184dbee944005fd29ba50f48d1d074c5e4d727be819dd585e265e60590
SHA51225a5c6b86e892f8c475f35a71fb52a7ac7326d47bbfaaff592c3119716b289501c59e1552916836ad6b5fd5f1060051988025518aea0caf858d3c78d1022d170
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si707141.exeFilesize
175KB
MD535dddcf57f1b2252b881606d644839de
SHA1c9a5bb72beca91ffd5d2e74fd3d37a217013e81d
SHA2565709ea184dbee944005fd29ba50f48d1d074c5e4d727be819dd585e265e60590
SHA51225a5c6b86e892f8c475f35a71fb52a7ac7326d47bbfaaff592c3119716b289501c59e1552916836ad6b5fd5f1060051988025518aea0caf858d3c78d1022d170
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un194135.exeFilesize
516KB
MD57524bb2ab77b41b6817155e233695524
SHA1149595bc9953f7b5a0b146eedd8e29459a7b5e4c
SHA25603209fdcab11e07b3cdf827b9ca732ee44dd367b9e878ee8c9cedb8d73e1b961
SHA5124e1062978cee9891c2b3c6d73e160f56398f69fe76916f4c8b91c0684cb594eda44977b7d01b225df7d65580e5aef0f09aa0d0049a4534d476d1f4f8e195a805
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un194135.exeFilesize
516KB
MD57524bb2ab77b41b6817155e233695524
SHA1149595bc9953f7b5a0b146eedd8e29459a7b5e4c
SHA25603209fdcab11e07b3cdf827b9ca732ee44dd367b9e878ee8c9cedb8d73e1b961
SHA5124e1062978cee9891c2b3c6d73e160f56398f69fe76916f4c8b91c0684cb594eda44977b7d01b225df7d65580e5aef0f09aa0d0049a4534d476d1f4f8e195a805
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1274.exeFilesize
235KB
MD5fc6379c24be9b49caf03f48bd13f19f0
SHA1143b78916e6815d1b3a6c45fd342794f1b6984a0
SHA2568aee7cab7b8fa833a19cbe12ed9f7dd48c6c0996fa5e9d7024c501f87722b71c
SHA5120cd92db3cbe80c969c5458648fe5e1f822d793f3644c5a4476aa1c3f3712bf60dbad20356a5598362c26bf4957617c6a8d50bd1c5d140b21ef44095e93544ce3
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1274.exeFilesize
235KB
MD5fc6379c24be9b49caf03f48bd13f19f0
SHA1143b78916e6815d1b3a6c45fd342794f1b6984a0
SHA2568aee7cab7b8fa833a19cbe12ed9f7dd48c6c0996fa5e9d7024c501f87722b71c
SHA5120cd92db3cbe80c969c5458648fe5e1f822d793f3644c5a4476aa1c3f3712bf60dbad20356a5598362c26bf4957617c6a8d50bd1c5d140b21ef44095e93544ce3
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7505.exeFilesize
294KB
MD5a910d2f4cbc3ac955f20d4a7ec063281
SHA115b894d819ff633deb96d175c0dfb965d8cafc70
SHA256ebaa9aafcc1eb6007b5df783681c34c15b895f55a9cdaac69d4b6b43447e39c9
SHA512e36ba3afb9c1a843302938befdf1844ae6185947eed0b2f702f843743bbd423ba93c2c34e96362573d3d1f7873d227ffadd2f464e832e33990bad1220756263e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7505.exeFilesize
294KB
MD5a910d2f4cbc3ac955f20d4a7ec063281
SHA115b894d819ff633deb96d175c0dfb965d8cafc70
SHA256ebaa9aafcc1eb6007b5df783681c34c15b895f55a9cdaac69d4b6b43447e39c9
SHA512e36ba3afb9c1a843302938befdf1844ae6185947eed0b2f702f843743bbd423ba93c2c34e96362573d3d1f7873d227ffadd2f464e832e33990bad1220756263e
-
memory/2132-148-0x0000000002100000-0x000000000212D000-memory.dmpFilesize
180KB
-
memory/2132-149-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/2132-150-0x0000000004BB0000-0x0000000005154000-memory.dmpFilesize
5.6MB
-
memory/2132-151-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/2132-152-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/2132-154-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/2132-156-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/2132-158-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/2132-160-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/2132-162-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/2132-164-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/2132-166-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/2132-169-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/2132-168-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/2132-170-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/2132-172-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/2132-174-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/2132-176-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/2132-178-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/2132-180-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/2132-181-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2132-182-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/2132-183-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/2132-184-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/2132-186-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/3276-1122-0x0000000000820000-0x0000000000852000-memory.dmpFilesize
200KB
-
memory/3276-1123-0x0000000005410000-0x0000000005420000-memory.dmpFilesize
64KB
-
memory/3836-194-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/3836-328-0x0000000004B00000-0x0000000004B10000-memory.dmpFilesize
64KB
-
memory/3836-196-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/3836-198-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/3836-200-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/3836-202-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/3836-204-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/3836-206-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/3836-208-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/3836-210-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/3836-212-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/3836-214-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/3836-216-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/3836-218-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/3836-220-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/3836-222-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/3836-224-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/3836-327-0x0000000000690000-0x00000000006DB000-memory.dmpFilesize
300KB
-
memory/3836-331-0x0000000004B00000-0x0000000004B10000-memory.dmpFilesize
64KB
-
memory/3836-192-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/3836-332-0x0000000004B00000-0x0000000004B10000-memory.dmpFilesize
64KB
-
memory/3836-1101-0x0000000005200000-0x0000000005818000-memory.dmpFilesize
6.1MB
-
memory/3836-1102-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/3836-1103-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/3836-1104-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/3836-1105-0x0000000004B00000-0x0000000004B10000-memory.dmpFilesize
64KB
-
memory/3836-1107-0x0000000005CF0000-0x0000000005D56000-memory.dmpFilesize
408KB
-
memory/3836-1108-0x0000000004B00000-0x0000000004B10000-memory.dmpFilesize
64KB
-
memory/3836-1109-0x0000000004B00000-0x0000000004B10000-memory.dmpFilesize
64KB
-
memory/3836-1110-0x0000000004B00000-0x0000000004B10000-memory.dmpFilesize
64KB
-
memory/3836-1111-0x00000000063C0000-0x0000000006452000-memory.dmpFilesize
584KB
-
memory/3836-1112-0x0000000006590000-0x0000000006606000-memory.dmpFilesize
472KB
-
memory/3836-1113-0x0000000006620000-0x0000000006670000-memory.dmpFilesize
320KB
-
memory/3836-191-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/3836-1114-0x0000000006810000-0x00000000069D2000-memory.dmpFilesize
1.8MB
-
memory/3836-1115-0x00000000069E0000-0x0000000006F0C000-memory.dmpFilesize
5.2MB
-
memory/3836-1116-0x0000000004B00000-0x0000000004B10000-memory.dmpFilesize
64KB