Analysis
-
max time kernel
53s -
max time network
152s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
03-04-2023 19:47
Static task
static1
Behavioral task
behavioral1
Sample
152c16c9812f4399210185ee3f1cda0e6c4d33ebad98617f3b648e8c710b0d4c.exe
Resource
win10-20230220-en
General
-
Target
152c16c9812f4399210185ee3f1cda0e6c4d33ebad98617f3b648e8c710b0d4c.exe
-
Size
522KB
-
MD5
3980f586c591f5ddef6d4a7be5548b2c
-
SHA1
b949b299d5c24a62d273ae9a27e9baabc87fb47c
-
SHA256
152c16c9812f4399210185ee3f1cda0e6c4d33ebad98617f3b648e8c710b0d4c
-
SHA512
c9da6b90b7348d29273d1939933d2bddb95615b5d543757c2a0aa92089f914909d627b26a68a2c01db978abd604a8255a2519024938c1dd4864d7052e7e48ea4
-
SSDEEP
12288:MMr9y90cR88h6IXyva24ii9St8rt4okzWKMRxUK1+1runbQ8FZIOc:ByzRVYFUieruoNKKF13bQ8bC
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr167809.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr167809.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr167809.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr167809.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr167809.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr167809.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
Processes:
resource yara_rule behavioral1/memory/4408-136-0x0000000002300000-0x0000000002346000-memory.dmp family_redline behavioral1/memory/4408-142-0x00000000026D0000-0x0000000002714000-memory.dmp family_redline behavioral1/memory/4408-143-0x00000000026D0000-0x000000000270F000-memory.dmp family_redline behavioral1/memory/4408-144-0x00000000026D0000-0x000000000270F000-memory.dmp family_redline behavioral1/memory/4408-146-0x00000000026D0000-0x000000000270F000-memory.dmp family_redline behavioral1/memory/4408-148-0x00000000026D0000-0x000000000270F000-memory.dmp family_redline behavioral1/memory/4408-150-0x00000000026D0000-0x000000000270F000-memory.dmp family_redline behavioral1/memory/4408-152-0x00000000026D0000-0x000000000270F000-memory.dmp family_redline behavioral1/memory/4408-154-0x00000000026D0000-0x000000000270F000-memory.dmp family_redline behavioral1/memory/4408-156-0x00000000026D0000-0x000000000270F000-memory.dmp family_redline behavioral1/memory/4408-158-0x00000000026D0000-0x000000000270F000-memory.dmp family_redline behavioral1/memory/4408-160-0x00000000026D0000-0x000000000270F000-memory.dmp family_redline behavioral1/memory/4408-162-0x00000000026D0000-0x000000000270F000-memory.dmp family_redline behavioral1/memory/4408-166-0x00000000026D0000-0x000000000270F000-memory.dmp family_redline behavioral1/memory/4408-164-0x00000000026D0000-0x000000000270F000-memory.dmp family_redline behavioral1/memory/4408-168-0x00000000026D0000-0x000000000270F000-memory.dmp family_redline behavioral1/memory/4408-170-0x00000000026D0000-0x000000000270F000-memory.dmp family_redline behavioral1/memory/4408-172-0x00000000026D0000-0x000000000270F000-memory.dmp family_redline behavioral1/memory/4408-174-0x00000000026D0000-0x000000000270F000-memory.dmp family_redline behavioral1/memory/4408-178-0x00000000026D0000-0x000000000270F000-memory.dmp family_redline behavioral1/memory/4408-180-0x00000000026D0000-0x000000000270F000-memory.dmp family_redline behavioral1/memory/4408-176-0x00000000026D0000-0x000000000270F000-memory.dmp family_redline behavioral1/memory/4408-182-0x00000000026D0000-0x000000000270F000-memory.dmp family_redline behavioral1/memory/4408-184-0x00000000026D0000-0x000000000270F000-memory.dmp family_redline behavioral1/memory/4408-188-0x00000000026D0000-0x000000000270F000-memory.dmp family_redline behavioral1/memory/4408-186-0x00000000026D0000-0x000000000270F000-memory.dmp family_redline behavioral1/memory/4408-190-0x00000000026D0000-0x000000000270F000-memory.dmp family_redline behavioral1/memory/4408-192-0x00000000026D0000-0x000000000270F000-memory.dmp family_redline behavioral1/memory/4408-194-0x00000000026D0000-0x000000000270F000-memory.dmp family_redline behavioral1/memory/4408-196-0x00000000026D0000-0x000000000270F000-memory.dmp family_redline behavioral1/memory/4408-198-0x00000000026D0000-0x000000000270F000-memory.dmp family_redline behavioral1/memory/4408-200-0x00000000026D0000-0x000000000270F000-memory.dmp family_redline behavioral1/memory/4408-202-0x00000000026D0000-0x000000000270F000-memory.dmp family_redline behavioral1/memory/4408-204-0x00000000026D0000-0x000000000270F000-memory.dmp family_redline behavioral1/memory/4408-206-0x00000000026D0000-0x000000000270F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
zimD1298.exejr167809.exeku282027.exelr357004.exepid process 2240 zimD1298.exe 4596 jr167809.exe 4408 ku282027.exe 3032 lr357004.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr167809.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr167809.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
zimD1298.exe152c16c9812f4399210185ee3f1cda0e6c4d33ebad98617f3b648e8c710b0d4c.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zimD1298.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zimD1298.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 152c16c9812f4399210185ee3f1cda0e6c4d33ebad98617f3b648e8c710b0d4c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 152c16c9812f4399210185ee3f1cda0e6c4d33ebad98617f3b648e8c710b0d4c.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr167809.exeku282027.exelr357004.exepid process 4596 jr167809.exe 4596 jr167809.exe 4408 ku282027.exe 4408 ku282027.exe 3032 lr357004.exe 3032 lr357004.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr167809.exeku282027.exelr357004.exedescription pid process Token: SeDebugPrivilege 4596 jr167809.exe Token: SeDebugPrivilege 4408 ku282027.exe Token: SeDebugPrivilege 3032 lr357004.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
152c16c9812f4399210185ee3f1cda0e6c4d33ebad98617f3b648e8c710b0d4c.exezimD1298.exedescription pid process target process PID 3144 wrote to memory of 2240 3144 152c16c9812f4399210185ee3f1cda0e6c4d33ebad98617f3b648e8c710b0d4c.exe zimD1298.exe PID 3144 wrote to memory of 2240 3144 152c16c9812f4399210185ee3f1cda0e6c4d33ebad98617f3b648e8c710b0d4c.exe zimD1298.exe PID 3144 wrote to memory of 2240 3144 152c16c9812f4399210185ee3f1cda0e6c4d33ebad98617f3b648e8c710b0d4c.exe zimD1298.exe PID 2240 wrote to memory of 4596 2240 zimD1298.exe jr167809.exe PID 2240 wrote to memory of 4596 2240 zimD1298.exe jr167809.exe PID 2240 wrote to memory of 4408 2240 zimD1298.exe ku282027.exe PID 2240 wrote to memory of 4408 2240 zimD1298.exe ku282027.exe PID 2240 wrote to memory of 4408 2240 zimD1298.exe ku282027.exe PID 3144 wrote to memory of 3032 3144 152c16c9812f4399210185ee3f1cda0e6c4d33ebad98617f3b648e8c710b0d4c.exe lr357004.exe PID 3144 wrote to memory of 3032 3144 152c16c9812f4399210185ee3f1cda0e6c4d33ebad98617f3b648e8c710b0d4c.exe lr357004.exe PID 3144 wrote to memory of 3032 3144 152c16c9812f4399210185ee3f1cda0e6c4d33ebad98617f3b648e8c710b0d4c.exe lr357004.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\152c16c9812f4399210185ee3f1cda0e6c4d33ebad98617f3b648e8c710b0d4c.exe"C:\Users\Admin\AppData\Local\Temp\152c16c9812f4399210185ee3f1cda0e6c4d33ebad98617f3b648e8c710b0d4c.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zimD1298.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zimD1298.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr167809.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr167809.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku282027.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku282027.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr357004.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr357004.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr357004.exeFilesize
175KB
MD54c45ca31ece7c22f78d1ea4f4bba9ab9
SHA1154d7753a7f252507c123b2acfbffadbbf249778
SHA256e1385c5bad43614b91963e7e0cb7db7a08feff21ffb5c1a1e43146fd20b51557
SHA512e789aeae5832b8dabf773ac8c61a8429214fc2be49d85916efecf0c4c5ec4486ffe0dd68b6842e5d0d004cf94e72e721a49d51d52ebba4df35907b68b57650a8
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr357004.exeFilesize
175KB
MD54c45ca31ece7c22f78d1ea4f4bba9ab9
SHA1154d7753a7f252507c123b2acfbffadbbf249778
SHA256e1385c5bad43614b91963e7e0cb7db7a08feff21ffb5c1a1e43146fd20b51557
SHA512e789aeae5832b8dabf773ac8c61a8429214fc2be49d85916efecf0c4c5ec4486ffe0dd68b6842e5d0d004cf94e72e721a49d51d52ebba4df35907b68b57650a8
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zimD1298.exeFilesize
380KB
MD5426b79e9e8e91496d0e3aa344c9ba14b
SHA11a22358653420a24c5d475f224abb5ca66037891
SHA2566a7947a6af0b428ee051ddffd9db9a0ca370861a63c860e28e5072d713cf36a6
SHA5125290726460665382f61bba28fa623ee4ff80cf30f9757878201b96853c59776419b786799999114b8abe5dee933d162558e43d7ad59aa09c2e03ce7417dca4e3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zimD1298.exeFilesize
380KB
MD5426b79e9e8e91496d0e3aa344c9ba14b
SHA11a22358653420a24c5d475f224abb5ca66037891
SHA2566a7947a6af0b428ee051ddffd9db9a0ca370861a63c860e28e5072d713cf36a6
SHA5125290726460665382f61bba28fa623ee4ff80cf30f9757878201b96853c59776419b786799999114b8abe5dee933d162558e43d7ad59aa09c2e03ce7417dca4e3
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr167809.exeFilesize
11KB
MD5c7aaadd3c5a95545168c78034e38ad43
SHA183bcb7c55598e0c2bff7d7784304bdd9171d82ca
SHA25633324323524e53016d55a728a612dca9f26b763cd11c4ddc824b8b90b67dde30
SHA512cd48fdae998db3248afef926a9ea355a763cf7f33cd1be21275af7725ea8afac4791d9ced928d6c71c8e4ade195c0e090dc3d8ca113a2cc35fec01a6cf266752
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr167809.exeFilesize
11KB
MD5c7aaadd3c5a95545168c78034e38ad43
SHA183bcb7c55598e0c2bff7d7784304bdd9171d82ca
SHA25633324323524e53016d55a728a612dca9f26b763cd11c4ddc824b8b90b67dde30
SHA512cd48fdae998db3248afef926a9ea355a763cf7f33cd1be21275af7725ea8afac4791d9ced928d6c71c8e4ade195c0e090dc3d8ca113a2cc35fec01a6cf266752
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku282027.exeFilesize
294KB
MD5a87fb7f072f533a9ef7d56d3c3dca9c7
SHA19027cf9e5e030ef0c690bceb898a2d477d2ca0fe
SHA256c3a632b55e6f3061d38693eaf5d35f882fa5d35267226fd50e066bdfea0bd163
SHA5129f3ead1de9f7b93e3aecbfdbaad44291d9f2ce6e65da2ef0b28212bd31db2d117b19f3ebca5f75fbd98341e1f661456c4c7d56870520560b131965f66c715f8f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku282027.exeFilesize
294KB
MD5a87fb7f072f533a9ef7d56d3c3dca9c7
SHA19027cf9e5e030ef0c690bceb898a2d477d2ca0fe
SHA256c3a632b55e6f3061d38693eaf5d35f882fa5d35267226fd50e066bdfea0bd163
SHA5129f3ead1de9f7b93e3aecbfdbaad44291d9f2ce6e65da2ef0b28212bd31db2d117b19f3ebca5f75fbd98341e1f661456c4c7d56870520560b131965f66c715f8f
-
memory/3032-1070-0x0000000000A20000-0x0000000000A52000-memory.dmpFilesize
200KB
-
memory/3032-1071-0x0000000005460000-0x00000000054AB000-memory.dmpFilesize
300KB
-
memory/3032-1072-0x00000000055E0000-0x00000000055F0000-memory.dmpFilesize
64KB
-
memory/4408-172-0x00000000026D0000-0x000000000270F000-memory.dmpFilesize
252KB
-
memory/4408-184-0x00000000026D0000-0x000000000270F000-memory.dmpFilesize
252KB
-
memory/4408-140-0x0000000004C10000-0x000000000510E000-memory.dmpFilesize
5.0MB
-
memory/4408-139-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/4408-141-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/4408-142-0x00000000026D0000-0x0000000002714000-memory.dmpFilesize
272KB
-
memory/4408-143-0x00000000026D0000-0x000000000270F000-memory.dmpFilesize
252KB
-
memory/4408-144-0x00000000026D0000-0x000000000270F000-memory.dmpFilesize
252KB
-
memory/4408-146-0x00000000026D0000-0x000000000270F000-memory.dmpFilesize
252KB
-
memory/4408-148-0x00000000026D0000-0x000000000270F000-memory.dmpFilesize
252KB
-
memory/4408-150-0x00000000026D0000-0x000000000270F000-memory.dmpFilesize
252KB
-
memory/4408-152-0x00000000026D0000-0x000000000270F000-memory.dmpFilesize
252KB
-
memory/4408-154-0x00000000026D0000-0x000000000270F000-memory.dmpFilesize
252KB
-
memory/4408-156-0x00000000026D0000-0x000000000270F000-memory.dmpFilesize
252KB
-
memory/4408-158-0x00000000026D0000-0x000000000270F000-memory.dmpFilesize
252KB
-
memory/4408-160-0x00000000026D0000-0x000000000270F000-memory.dmpFilesize
252KB
-
memory/4408-162-0x00000000026D0000-0x000000000270F000-memory.dmpFilesize
252KB
-
memory/4408-166-0x00000000026D0000-0x000000000270F000-memory.dmpFilesize
252KB
-
memory/4408-164-0x00000000026D0000-0x000000000270F000-memory.dmpFilesize
252KB
-
memory/4408-168-0x00000000026D0000-0x000000000270F000-memory.dmpFilesize
252KB
-
memory/4408-170-0x00000000026D0000-0x000000000270F000-memory.dmpFilesize
252KB
-
memory/4408-137-0x00000000005C0000-0x000000000060B000-memory.dmpFilesize
300KB
-
memory/4408-174-0x00000000026D0000-0x000000000270F000-memory.dmpFilesize
252KB
-
memory/4408-178-0x00000000026D0000-0x000000000270F000-memory.dmpFilesize
252KB
-
memory/4408-180-0x00000000026D0000-0x000000000270F000-memory.dmpFilesize
252KB
-
memory/4408-176-0x00000000026D0000-0x000000000270F000-memory.dmpFilesize
252KB
-
memory/4408-182-0x00000000026D0000-0x000000000270F000-memory.dmpFilesize
252KB
-
memory/4408-138-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/4408-188-0x00000000026D0000-0x000000000270F000-memory.dmpFilesize
252KB
-
memory/4408-186-0x00000000026D0000-0x000000000270F000-memory.dmpFilesize
252KB
-
memory/4408-190-0x00000000026D0000-0x000000000270F000-memory.dmpFilesize
252KB
-
memory/4408-192-0x00000000026D0000-0x000000000270F000-memory.dmpFilesize
252KB
-
memory/4408-194-0x00000000026D0000-0x000000000270F000-memory.dmpFilesize
252KB
-
memory/4408-196-0x00000000026D0000-0x000000000270F000-memory.dmpFilesize
252KB
-
memory/4408-198-0x00000000026D0000-0x000000000270F000-memory.dmpFilesize
252KB
-
memory/4408-200-0x00000000026D0000-0x000000000270F000-memory.dmpFilesize
252KB
-
memory/4408-202-0x00000000026D0000-0x000000000270F000-memory.dmpFilesize
252KB
-
memory/4408-204-0x00000000026D0000-0x000000000270F000-memory.dmpFilesize
252KB
-
memory/4408-206-0x00000000026D0000-0x000000000270F000-memory.dmpFilesize
252KB
-
memory/4408-1049-0x0000000005720000-0x0000000005D26000-memory.dmpFilesize
6.0MB
-
memory/4408-1050-0x0000000005190000-0x000000000529A000-memory.dmpFilesize
1.0MB
-
memory/4408-1051-0x00000000052D0000-0x00000000052E2000-memory.dmpFilesize
72KB
-
memory/4408-1052-0x00000000052F0000-0x000000000532E000-memory.dmpFilesize
248KB
-
memory/4408-1053-0x0000000005440000-0x000000000548B000-memory.dmpFilesize
300KB
-
memory/4408-1054-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/4408-1056-0x00000000055D0000-0x0000000005636000-memory.dmpFilesize
408KB
-
memory/4408-1057-0x00000000062A0000-0x0000000006332000-memory.dmpFilesize
584KB
-
memory/4408-1059-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/4408-1058-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/4408-1060-0x00000000065E0000-0x00000000067A2000-memory.dmpFilesize
1.8MB
-
memory/4408-136-0x0000000002300000-0x0000000002346000-memory.dmpFilesize
280KB
-
memory/4408-1061-0x00000000067B0000-0x0000000006CDC000-memory.dmpFilesize
5.2MB
-
memory/4408-1062-0x0000000006E00000-0x0000000006E76000-memory.dmpFilesize
472KB
-
memory/4408-1063-0x0000000006E80000-0x0000000006ED0000-memory.dmpFilesize
320KB
-
memory/4408-1064-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/4596-130-0x0000000000420000-0x000000000042A000-memory.dmpFilesize
40KB