Analysis
-
max time kernel
66s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 19:46
Static task
static1
Behavioral task
behavioral1
Sample
d6a63b3730d8e3503cd7eb29b0a5e290392cb1c9e456ac1b97a0b7e59a8bde73.exe
Resource
win10v2004-20230220-en
General
-
Target
d6a63b3730d8e3503cd7eb29b0a5e290392cb1c9e456ac1b97a0b7e59a8bde73.exe
-
Size
658KB
-
MD5
49c87be25c5d9ef35aa92820ca4dffab
-
SHA1
289eeaf4c4fcb03e5ae18c1930727bfab8704a5b
-
SHA256
d6a63b3730d8e3503cd7eb29b0a5e290392cb1c9e456ac1b97a0b7e59a8bde73
-
SHA512
058b420076ee5832a9d421f9783b700fa66782d45e69307d36e9c8bbbe64b68b578140effa1251d8908f45c595e8774a8cb06017e714d6cf536ad10785034aaf
-
SSDEEP
12288:mMr8y90fZ0JrC1VRntyExNqLt8VMP8CH447zWKLm8voV2CD:GyW0JrEnt7xNqhB0CY4mKC28
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro1339.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro1339.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro1339.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro1339.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro1339.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro1339.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro1339.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/1812-191-0x0000000002550000-0x000000000258F000-memory.dmp family_redline behavioral1/memory/1812-192-0x0000000002550000-0x000000000258F000-memory.dmp family_redline behavioral1/memory/1812-194-0x0000000002550000-0x000000000258F000-memory.dmp family_redline behavioral1/memory/1812-196-0x0000000002550000-0x000000000258F000-memory.dmp family_redline behavioral1/memory/1812-198-0x0000000002550000-0x000000000258F000-memory.dmp family_redline behavioral1/memory/1812-200-0x0000000002550000-0x000000000258F000-memory.dmp family_redline behavioral1/memory/1812-202-0x0000000002550000-0x000000000258F000-memory.dmp family_redline behavioral1/memory/1812-204-0x0000000002550000-0x000000000258F000-memory.dmp family_redline behavioral1/memory/1812-206-0x0000000002550000-0x000000000258F000-memory.dmp family_redline behavioral1/memory/1812-208-0x0000000002550000-0x000000000258F000-memory.dmp family_redline behavioral1/memory/1812-210-0x0000000002550000-0x000000000258F000-memory.dmp family_redline behavioral1/memory/1812-212-0x0000000002550000-0x000000000258F000-memory.dmp family_redline behavioral1/memory/1812-214-0x0000000002550000-0x000000000258F000-memory.dmp family_redline behavioral1/memory/1812-218-0x0000000004C50000-0x0000000004C60000-memory.dmp family_redline behavioral1/memory/1812-217-0x0000000002550000-0x000000000258F000-memory.dmp family_redline behavioral1/memory/1812-222-0x0000000002550000-0x000000000258F000-memory.dmp family_redline behavioral1/memory/1812-224-0x0000000002550000-0x000000000258F000-memory.dmp family_redline behavioral1/memory/1812-226-0x0000000002550000-0x000000000258F000-memory.dmp family_redline behavioral1/memory/1812-228-0x0000000002550000-0x000000000258F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un685416.exepro1339.exequ1479.exesi057924.exepid process 3280 un685416.exe 1696 pro1339.exe 1812 qu1479.exe 2836 si057924.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro1339.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro1339.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro1339.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
d6a63b3730d8e3503cd7eb29b0a5e290392cb1c9e456ac1b97a0b7e59a8bde73.exeun685416.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce d6a63b3730d8e3503cd7eb29b0a5e290392cb1c9e456ac1b97a0b7e59a8bde73.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" d6a63b3730d8e3503cd7eb29b0a5e290392cb1c9e456ac1b97a0b7e59a8bde73.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un685416.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un685416.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 816 1696 WerFault.exe pro1339.exe 2492 1812 WerFault.exe qu1479.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro1339.exequ1479.exesi057924.exepid process 1696 pro1339.exe 1696 pro1339.exe 1812 qu1479.exe 1812 qu1479.exe 2836 si057924.exe 2836 si057924.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro1339.exequ1479.exesi057924.exedescription pid process Token: SeDebugPrivilege 1696 pro1339.exe Token: SeDebugPrivilege 1812 qu1479.exe Token: SeDebugPrivilege 2836 si057924.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
d6a63b3730d8e3503cd7eb29b0a5e290392cb1c9e456ac1b97a0b7e59a8bde73.exeun685416.exedescription pid process target process PID 3704 wrote to memory of 3280 3704 d6a63b3730d8e3503cd7eb29b0a5e290392cb1c9e456ac1b97a0b7e59a8bde73.exe un685416.exe PID 3704 wrote to memory of 3280 3704 d6a63b3730d8e3503cd7eb29b0a5e290392cb1c9e456ac1b97a0b7e59a8bde73.exe un685416.exe PID 3704 wrote to memory of 3280 3704 d6a63b3730d8e3503cd7eb29b0a5e290392cb1c9e456ac1b97a0b7e59a8bde73.exe un685416.exe PID 3280 wrote to memory of 1696 3280 un685416.exe pro1339.exe PID 3280 wrote to memory of 1696 3280 un685416.exe pro1339.exe PID 3280 wrote to memory of 1696 3280 un685416.exe pro1339.exe PID 3280 wrote to memory of 1812 3280 un685416.exe qu1479.exe PID 3280 wrote to memory of 1812 3280 un685416.exe qu1479.exe PID 3280 wrote to memory of 1812 3280 un685416.exe qu1479.exe PID 3704 wrote to memory of 2836 3704 d6a63b3730d8e3503cd7eb29b0a5e290392cb1c9e456ac1b97a0b7e59a8bde73.exe si057924.exe PID 3704 wrote to memory of 2836 3704 d6a63b3730d8e3503cd7eb29b0a5e290392cb1c9e456ac1b97a0b7e59a8bde73.exe si057924.exe PID 3704 wrote to memory of 2836 3704 d6a63b3730d8e3503cd7eb29b0a5e290392cb1c9e456ac1b97a0b7e59a8bde73.exe si057924.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6a63b3730d8e3503cd7eb29b0a5e290392cb1c9e456ac1b97a0b7e59a8bde73.exe"C:\Users\Admin\AppData\Local\Temp\d6a63b3730d8e3503cd7eb29b0a5e290392cb1c9e456ac1b97a0b7e59a8bde73.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un685416.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un685416.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1339.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1339.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 10884⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1479.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1479.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 19004⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si057924.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si057924.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1696 -ip 16961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1812 -ip 18121⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si057924.exeFilesize
175KB
MD549429eb1fd50ce7861164fbe92a75de9
SHA1432c443d438ffa5303c629dd04667b6a72247f35
SHA256bd4d44de3b5be1c3ef857fb119c7835590721b3168b81e6ea335783d759b1517
SHA512f88f528a94687990e19dbce01bbe374e277ceca6b1213729e22585ff4c511aafab91a36266f974c2d6fbfe3aa00d5dc66e5bb1ac80ae91d60f68493291611383
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si057924.exeFilesize
175KB
MD549429eb1fd50ce7861164fbe92a75de9
SHA1432c443d438ffa5303c629dd04667b6a72247f35
SHA256bd4d44de3b5be1c3ef857fb119c7835590721b3168b81e6ea335783d759b1517
SHA512f88f528a94687990e19dbce01bbe374e277ceca6b1213729e22585ff4c511aafab91a36266f974c2d6fbfe3aa00d5dc66e5bb1ac80ae91d60f68493291611383
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un685416.exeFilesize
515KB
MD5f50c06d0bf4510c07358c0838fc9eac1
SHA1150698ea6cfce7ae99860872e6152f038e2a4117
SHA256a2589a6f559367dba52fc6f03161c3b739c70d6807e084c333e83c18985a51b5
SHA512e1412c7372fc9f9748b198b19b2b7d0a96369ddb004c6ce8a3094af414efe710d91a009a79dc3320a4b5eb62c799a02a801bbeae166d434f9e8916d7113ab844
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un685416.exeFilesize
515KB
MD5f50c06d0bf4510c07358c0838fc9eac1
SHA1150698ea6cfce7ae99860872e6152f038e2a4117
SHA256a2589a6f559367dba52fc6f03161c3b739c70d6807e084c333e83c18985a51b5
SHA512e1412c7372fc9f9748b198b19b2b7d0a96369ddb004c6ce8a3094af414efe710d91a009a79dc3320a4b5eb62c799a02a801bbeae166d434f9e8916d7113ab844
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1339.exeFilesize
235KB
MD58b8d0d21cc957ea339d3ab1ab7e95d71
SHA15dbd76dcfdc860f6faa9ad3627d1f9476e1446c8
SHA2562077bdddf9208abf6e811cfc28e0403f5f45ff69896f000a78293d7a4e3874fc
SHA5124ceb210c7a4493221717f29e6e1a59d0695c3e055940c5f75a6dcc5dd61b74d4599d1d2733b4605bd58f67dfbce9d7e8c93d6866839db726345197c887f29ed8
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1339.exeFilesize
235KB
MD58b8d0d21cc957ea339d3ab1ab7e95d71
SHA15dbd76dcfdc860f6faa9ad3627d1f9476e1446c8
SHA2562077bdddf9208abf6e811cfc28e0403f5f45ff69896f000a78293d7a4e3874fc
SHA5124ceb210c7a4493221717f29e6e1a59d0695c3e055940c5f75a6dcc5dd61b74d4599d1d2733b4605bd58f67dfbce9d7e8c93d6866839db726345197c887f29ed8
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1479.exeFilesize
294KB
MD5f40d49cc1c68b15954fccef2b6c841e1
SHA15c8311d7beefe96eaac9b25aee07b76cb68b928a
SHA25659d7d9ce17a7867779c821d4235f033cc26d0337f7ec958b9b92743d82ebf0eb
SHA5126b66fb61f161d0621218a29d61fb82475329d80359b1adc9c056eee7aff7c444aa6bb32dd498eab53212fa621e573de087243a49e2b3307e44bff2c3ab9d0902
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1479.exeFilesize
294KB
MD5f40d49cc1c68b15954fccef2b6c841e1
SHA15c8311d7beefe96eaac9b25aee07b76cb68b928a
SHA25659d7d9ce17a7867779c821d4235f033cc26d0337f7ec958b9b92743d82ebf0eb
SHA5126b66fb61f161d0621218a29d61fb82475329d80359b1adc9c056eee7aff7c444aa6bb32dd498eab53212fa621e573de087243a49e2b3307e44bff2c3ab9d0902
-
memory/1696-148-0x0000000000640000-0x000000000066D000-memory.dmpFilesize
180KB
-
memory/1696-149-0x0000000004D10000-0x00000000052B4000-memory.dmpFilesize
5.6MB
-
memory/1696-150-0x0000000004D00000-0x0000000004D10000-memory.dmpFilesize
64KB
-
memory/1696-151-0x0000000004D00000-0x0000000004D10000-memory.dmpFilesize
64KB
-
memory/1696-152-0x0000000004D00000-0x0000000004D10000-memory.dmpFilesize
64KB
-
memory/1696-153-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1696-154-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1696-156-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1696-158-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1696-160-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1696-162-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1696-164-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1696-166-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1696-168-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1696-170-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1696-172-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1696-174-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1696-176-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1696-178-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1696-180-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1696-181-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1696-182-0x0000000004D00000-0x0000000004D10000-memory.dmpFilesize
64KB
-
memory/1696-183-0x0000000004D00000-0x0000000004D10000-memory.dmpFilesize
64KB
-
memory/1696-184-0x0000000004D00000-0x0000000004D10000-memory.dmpFilesize
64KB
-
memory/1696-186-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1812-191-0x0000000002550000-0x000000000258F000-memory.dmpFilesize
252KB
-
memory/1812-192-0x0000000002550000-0x000000000258F000-memory.dmpFilesize
252KB
-
memory/1812-194-0x0000000002550000-0x000000000258F000-memory.dmpFilesize
252KB
-
memory/1812-196-0x0000000002550000-0x000000000258F000-memory.dmpFilesize
252KB
-
memory/1812-198-0x0000000002550000-0x000000000258F000-memory.dmpFilesize
252KB
-
memory/1812-200-0x0000000002550000-0x000000000258F000-memory.dmpFilesize
252KB
-
memory/1812-202-0x0000000002550000-0x000000000258F000-memory.dmpFilesize
252KB
-
memory/1812-204-0x0000000002550000-0x000000000258F000-memory.dmpFilesize
252KB
-
memory/1812-206-0x0000000002550000-0x000000000258F000-memory.dmpFilesize
252KB
-
memory/1812-208-0x0000000002550000-0x000000000258F000-memory.dmpFilesize
252KB
-
memory/1812-210-0x0000000002550000-0x000000000258F000-memory.dmpFilesize
252KB
-
memory/1812-212-0x0000000002550000-0x000000000258F000-memory.dmpFilesize
252KB
-
memory/1812-214-0x0000000002550000-0x000000000258F000-memory.dmpFilesize
252KB
-
memory/1812-215-0x0000000002100000-0x000000000214B000-memory.dmpFilesize
300KB
-
memory/1812-218-0x0000000004C50000-0x0000000004C60000-memory.dmpFilesize
64KB
-
memory/1812-220-0x0000000004C50000-0x0000000004C60000-memory.dmpFilesize
64KB
-
memory/1812-221-0x0000000004C50000-0x0000000004C60000-memory.dmpFilesize
64KB
-
memory/1812-217-0x0000000002550000-0x000000000258F000-memory.dmpFilesize
252KB
-
memory/1812-222-0x0000000002550000-0x000000000258F000-memory.dmpFilesize
252KB
-
memory/1812-224-0x0000000002550000-0x000000000258F000-memory.dmpFilesize
252KB
-
memory/1812-226-0x0000000002550000-0x000000000258F000-memory.dmpFilesize
252KB
-
memory/1812-228-0x0000000002550000-0x000000000258F000-memory.dmpFilesize
252KB
-
memory/1812-1101-0x0000000005210000-0x0000000005828000-memory.dmpFilesize
6.1MB
-
memory/1812-1102-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/1812-1103-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/1812-1104-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/1812-1105-0x0000000004C50000-0x0000000004C60000-memory.dmpFilesize
64KB
-
memory/1812-1107-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/1812-1108-0x0000000004C50000-0x0000000004C60000-memory.dmpFilesize
64KB
-
memory/1812-1109-0x0000000004C50000-0x0000000004C60000-memory.dmpFilesize
64KB
-
memory/1812-1110-0x0000000004C50000-0x0000000004C60000-memory.dmpFilesize
64KB
-
memory/1812-1111-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/1812-1112-0x0000000004C50000-0x0000000004C60000-memory.dmpFilesize
64KB
-
memory/1812-1113-0x00000000065D0000-0x0000000006792000-memory.dmpFilesize
1.8MB
-
memory/1812-1114-0x00000000067A0000-0x0000000006CCC000-memory.dmpFilesize
5.2MB
-
memory/1812-1115-0x0000000006F30000-0x0000000006FA6000-memory.dmpFilesize
472KB
-
memory/1812-1116-0x0000000006FD0000-0x0000000007020000-memory.dmpFilesize
320KB
-
memory/2836-1123-0x0000000000E40000-0x0000000000E72000-memory.dmpFilesize
200KB
-
memory/2836-1124-0x0000000005780000-0x0000000005790000-memory.dmpFilesize
64KB