Analysis
-
max time kernel
95s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 19:49
Static task
static1
Behavioral task
behavioral1
Sample
cac859f35b9d629e2cb6ee6ae0e98ec7d4d9f37c15452c30bc44752b44895f3b.exe
Resource
win10v2004-20230221-en
General
-
Target
cac859f35b9d629e2cb6ee6ae0e98ec7d4d9f37c15452c30bc44752b44895f3b.exe
-
Size
522KB
-
MD5
7d6d469a15d1581ef6f66a399fbc0bb8
-
SHA1
bd4adcdd81327ae1e7282f4da8cc73b34c45b891
-
SHA256
cac859f35b9d629e2cb6ee6ae0e98ec7d4d9f37c15452c30bc44752b44895f3b
-
SHA512
9938dd6371100413fcfac8023dc887bb4e4c4e9901553c24dbb33795a061707891cd2c4281c80883db66cb3354717381eb4d1863a367b4817f9f0cb0554e25b0
-
SSDEEP
12288:lMrVy90+umHiPqYYuG9bq849eg8UZ4XlzWKUad13y+s:QyumHhup8+kUSXYKUad1C+s
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr787097.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr787097.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr787097.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr787097.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr787097.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr787097.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr787097.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/232-158-0x0000000005080000-0x00000000050BF000-memory.dmp family_redline behavioral1/memory/232-159-0x0000000005080000-0x00000000050BF000-memory.dmp family_redline behavioral1/memory/232-161-0x0000000005080000-0x00000000050BF000-memory.dmp family_redline behavioral1/memory/232-163-0x0000000005080000-0x00000000050BF000-memory.dmp family_redline behavioral1/memory/232-165-0x0000000005080000-0x00000000050BF000-memory.dmp family_redline behavioral1/memory/232-167-0x0000000005080000-0x00000000050BF000-memory.dmp family_redline behavioral1/memory/232-169-0x0000000005080000-0x00000000050BF000-memory.dmp family_redline behavioral1/memory/232-171-0x0000000005080000-0x00000000050BF000-memory.dmp family_redline behavioral1/memory/232-173-0x0000000005080000-0x00000000050BF000-memory.dmp family_redline behavioral1/memory/232-175-0x0000000005080000-0x00000000050BF000-memory.dmp family_redline behavioral1/memory/232-177-0x0000000005080000-0x00000000050BF000-memory.dmp family_redline behavioral1/memory/232-179-0x0000000005080000-0x00000000050BF000-memory.dmp family_redline behavioral1/memory/232-181-0x0000000005080000-0x00000000050BF000-memory.dmp family_redline behavioral1/memory/232-183-0x0000000005080000-0x00000000050BF000-memory.dmp family_redline behavioral1/memory/232-185-0x0000000005080000-0x00000000050BF000-memory.dmp family_redline behavioral1/memory/232-187-0x0000000005080000-0x00000000050BF000-memory.dmp family_redline behavioral1/memory/232-189-0x0000000005080000-0x00000000050BF000-memory.dmp family_redline behavioral1/memory/232-191-0x0000000005080000-0x00000000050BF000-memory.dmp family_redline behavioral1/memory/232-193-0x0000000005080000-0x00000000050BF000-memory.dmp family_redline behavioral1/memory/232-195-0x0000000005080000-0x00000000050BF000-memory.dmp family_redline behavioral1/memory/232-197-0x0000000005080000-0x00000000050BF000-memory.dmp family_redline behavioral1/memory/232-199-0x0000000005080000-0x00000000050BF000-memory.dmp family_redline behavioral1/memory/232-201-0x0000000005080000-0x00000000050BF000-memory.dmp family_redline behavioral1/memory/232-203-0x0000000005080000-0x00000000050BF000-memory.dmp family_redline behavioral1/memory/232-205-0x0000000005080000-0x00000000050BF000-memory.dmp family_redline behavioral1/memory/232-207-0x0000000005080000-0x00000000050BF000-memory.dmp family_redline behavioral1/memory/232-209-0x0000000005080000-0x00000000050BF000-memory.dmp family_redline behavioral1/memory/232-211-0x0000000005080000-0x00000000050BF000-memory.dmp family_redline behavioral1/memory/232-213-0x0000000005080000-0x00000000050BF000-memory.dmp family_redline behavioral1/memory/232-215-0x0000000005080000-0x00000000050BF000-memory.dmp family_redline behavioral1/memory/232-217-0x0000000005080000-0x00000000050BF000-memory.dmp family_redline behavioral1/memory/232-219-0x0000000005080000-0x00000000050BF000-memory.dmp family_redline behavioral1/memory/232-221-0x0000000005080000-0x00000000050BF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
ziah6235.exejr787097.exeku148714.exelr814606.exepid process 2092 ziah6235.exe 1204 jr787097.exe 232 ku148714.exe 772 lr814606.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr787097.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr787097.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
ziah6235.execac859f35b9d629e2cb6ee6ae0e98ec7d4d9f37c15452c30bc44752b44895f3b.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziah6235.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce cac859f35b9d629e2cb6ee6ae0e98ec7d4d9f37c15452c30bc44752b44895f3b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" cac859f35b9d629e2cb6ee6ae0e98ec7d4d9f37c15452c30bc44752b44895f3b.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziah6235.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1616 232 WerFault.exe ku148714.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr787097.exeku148714.exelr814606.exepid process 1204 jr787097.exe 1204 jr787097.exe 232 ku148714.exe 232 ku148714.exe 772 lr814606.exe 772 lr814606.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr787097.exeku148714.exelr814606.exedescription pid process Token: SeDebugPrivilege 1204 jr787097.exe Token: SeDebugPrivilege 232 ku148714.exe Token: SeDebugPrivilege 772 lr814606.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
cac859f35b9d629e2cb6ee6ae0e98ec7d4d9f37c15452c30bc44752b44895f3b.exeziah6235.exedescription pid process target process PID 1728 wrote to memory of 2092 1728 cac859f35b9d629e2cb6ee6ae0e98ec7d4d9f37c15452c30bc44752b44895f3b.exe ziah6235.exe PID 1728 wrote to memory of 2092 1728 cac859f35b9d629e2cb6ee6ae0e98ec7d4d9f37c15452c30bc44752b44895f3b.exe ziah6235.exe PID 1728 wrote to memory of 2092 1728 cac859f35b9d629e2cb6ee6ae0e98ec7d4d9f37c15452c30bc44752b44895f3b.exe ziah6235.exe PID 2092 wrote to memory of 1204 2092 ziah6235.exe jr787097.exe PID 2092 wrote to memory of 1204 2092 ziah6235.exe jr787097.exe PID 2092 wrote to memory of 232 2092 ziah6235.exe ku148714.exe PID 2092 wrote to memory of 232 2092 ziah6235.exe ku148714.exe PID 2092 wrote to memory of 232 2092 ziah6235.exe ku148714.exe PID 1728 wrote to memory of 772 1728 cac859f35b9d629e2cb6ee6ae0e98ec7d4d9f37c15452c30bc44752b44895f3b.exe lr814606.exe PID 1728 wrote to memory of 772 1728 cac859f35b9d629e2cb6ee6ae0e98ec7d4d9f37c15452c30bc44752b44895f3b.exe lr814606.exe PID 1728 wrote to memory of 772 1728 cac859f35b9d629e2cb6ee6ae0e98ec7d4d9f37c15452c30bc44752b44895f3b.exe lr814606.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cac859f35b9d629e2cb6ee6ae0e98ec7d4d9f37c15452c30bc44752b44895f3b.exe"C:\Users\Admin\AppData\Local\Temp\cac859f35b9d629e2cb6ee6ae0e98ec7d4d9f37c15452c30bc44752b44895f3b.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziah6235.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziah6235.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr787097.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr787097.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku148714.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku148714.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 232 -s 11324⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr814606.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr814606.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 232 -ip 2321⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr814606.exeFilesize
175KB
MD56608c960b04ecf75c027a9896f7af600
SHA1a19d0d8f2ef134802fc57803f62d57d7699ab72b
SHA25639b7c73816565c0a572a61f51b996a854b119daed29e8bd37ebe78958d0a88af
SHA5122e41c84bf2f40cc1b3a493924ed05bd3bcdf5e057bf61ad94fc273e68af677681e8c3e09780dda5b0dc0fd61d341d01133dee105e7a8fde33769065938ce4a8a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr814606.exeFilesize
175KB
MD56608c960b04ecf75c027a9896f7af600
SHA1a19d0d8f2ef134802fc57803f62d57d7699ab72b
SHA25639b7c73816565c0a572a61f51b996a854b119daed29e8bd37ebe78958d0a88af
SHA5122e41c84bf2f40cc1b3a493924ed05bd3bcdf5e057bf61ad94fc273e68af677681e8c3e09780dda5b0dc0fd61d341d01133dee105e7a8fde33769065938ce4a8a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziah6235.exeFilesize
380KB
MD535038c2b62b5e11143dcddf5a9ae20d5
SHA1799f4732c097487e7079a9f9630c79d2c833a910
SHA25657ba635d83eefcf7973f1577654a8903a8c9599121177a64d17305a550a60ee4
SHA5127702c4efd5ac8e9d252bb7eae2aa4c6de0f3255c2a43d0c9d994f07eb4fd13899a309b0cca0f6c631f44dea30a1d2193729b92534c2fb4d57071e82615e1f6d9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziah6235.exeFilesize
380KB
MD535038c2b62b5e11143dcddf5a9ae20d5
SHA1799f4732c097487e7079a9f9630c79d2c833a910
SHA25657ba635d83eefcf7973f1577654a8903a8c9599121177a64d17305a550a60ee4
SHA5127702c4efd5ac8e9d252bb7eae2aa4c6de0f3255c2a43d0c9d994f07eb4fd13899a309b0cca0f6c631f44dea30a1d2193729b92534c2fb4d57071e82615e1f6d9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr787097.exeFilesize
11KB
MD5bf068aeca9ea379558e224a0f883fec3
SHA1f840c42c488d64471c974ae7021740c2ca1288fd
SHA256fe7835ea828f56bfb8c2000ad894d2b1090922f4ecc8d3facd735301fda40e5c
SHA512166e3d773bf1f93d1b0115ea8e0a0d32b43432766fe648f5065532127bef467a5947a1a5fe8c6765e660073f978406f41fb88613e6795e04a479442e79cb1e60
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr787097.exeFilesize
11KB
MD5bf068aeca9ea379558e224a0f883fec3
SHA1f840c42c488d64471c974ae7021740c2ca1288fd
SHA256fe7835ea828f56bfb8c2000ad894d2b1090922f4ecc8d3facd735301fda40e5c
SHA512166e3d773bf1f93d1b0115ea8e0a0d32b43432766fe648f5065532127bef467a5947a1a5fe8c6765e660073f978406f41fb88613e6795e04a479442e79cb1e60
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku148714.exeFilesize
294KB
MD5a575f8473c632a680f7ddff282769440
SHA1357bbfc35fdae19069d533a31cc00122ce0c6a12
SHA256110b6abffab4470c236ca56fd17a476151a47c147afc2b8aa7edd0438061cab1
SHA512233082a61b30223051f579920a06f6b33831ab0a1360ffe0a29f69b647b1166be391a74657237088d216afdce88838e9068f9a713650593144fce39876d5e92e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku148714.exeFilesize
294KB
MD5a575f8473c632a680f7ddff282769440
SHA1357bbfc35fdae19069d533a31cc00122ce0c6a12
SHA256110b6abffab4470c236ca56fd17a476151a47c147afc2b8aa7edd0438061cab1
SHA512233082a61b30223051f579920a06f6b33831ab0a1360ffe0a29f69b647b1166be391a74657237088d216afdce88838e9068f9a713650593144fce39876d5e92e
-
memory/232-153-0x0000000004AD0000-0x0000000005074000-memory.dmpFilesize
5.6MB
-
memory/232-154-0x0000000002020000-0x000000000206B000-memory.dmpFilesize
300KB
-
memory/232-155-0x00000000023F0000-0x0000000002400000-memory.dmpFilesize
64KB
-
memory/232-156-0x00000000023F0000-0x0000000002400000-memory.dmpFilesize
64KB
-
memory/232-157-0x00000000023F0000-0x0000000002400000-memory.dmpFilesize
64KB
-
memory/232-158-0x0000000005080000-0x00000000050BF000-memory.dmpFilesize
252KB
-
memory/232-159-0x0000000005080000-0x00000000050BF000-memory.dmpFilesize
252KB
-
memory/232-161-0x0000000005080000-0x00000000050BF000-memory.dmpFilesize
252KB
-
memory/232-163-0x0000000005080000-0x00000000050BF000-memory.dmpFilesize
252KB
-
memory/232-165-0x0000000005080000-0x00000000050BF000-memory.dmpFilesize
252KB
-
memory/232-167-0x0000000005080000-0x00000000050BF000-memory.dmpFilesize
252KB
-
memory/232-169-0x0000000005080000-0x00000000050BF000-memory.dmpFilesize
252KB
-
memory/232-171-0x0000000005080000-0x00000000050BF000-memory.dmpFilesize
252KB
-
memory/232-173-0x0000000005080000-0x00000000050BF000-memory.dmpFilesize
252KB
-
memory/232-175-0x0000000005080000-0x00000000050BF000-memory.dmpFilesize
252KB
-
memory/232-177-0x0000000005080000-0x00000000050BF000-memory.dmpFilesize
252KB
-
memory/232-179-0x0000000005080000-0x00000000050BF000-memory.dmpFilesize
252KB
-
memory/232-181-0x0000000005080000-0x00000000050BF000-memory.dmpFilesize
252KB
-
memory/232-183-0x0000000005080000-0x00000000050BF000-memory.dmpFilesize
252KB
-
memory/232-185-0x0000000005080000-0x00000000050BF000-memory.dmpFilesize
252KB
-
memory/232-187-0x0000000005080000-0x00000000050BF000-memory.dmpFilesize
252KB
-
memory/232-189-0x0000000005080000-0x00000000050BF000-memory.dmpFilesize
252KB
-
memory/232-191-0x0000000005080000-0x00000000050BF000-memory.dmpFilesize
252KB
-
memory/232-193-0x0000000005080000-0x00000000050BF000-memory.dmpFilesize
252KB
-
memory/232-195-0x0000000005080000-0x00000000050BF000-memory.dmpFilesize
252KB
-
memory/232-197-0x0000000005080000-0x00000000050BF000-memory.dmpFilesize
252KB
-
memory/232-199-0x0000000005080000-0x00000000050BF000-memory.dmpFilesize
252KB
-
memory/232-201-0x0000000005080000-0x00000000050BF000-memory.dmpFilesize
252KB
-
memory/232-203-0x0000000005080000-0x00000000050BF000-memory.dmpFilesize
252KB
-
memory/232-205-0x0000000005080000-0x00000000050BF000-memory.dmpFilesize
252KB
-
memory/232-207-0x0000000005080000-0x00000000050BF000-memory.dmpFilesize
252KB
-
memory/232-209-0x0000000005080000-0x00000000050BF000-memory.dmpFilesize
252KB
-
memory/232-211-0x0000000005080000-0x00000000050BF000-memory.dmpFilesize
252KB
-
memory/232-213-0x0000000005080000-0x00000000050BF000-memory.dmpFilesize
252KB
-
memory/232-215-0x0000000005080000-0x00000000050BF000-memory.dmpFilesize
252KB
-
memory/232-217-0x0000000005080000-0x00000000050BF000-memory.dmpFilesize
252KB
-
memory/232-219-0x0000000005080000-0x00000000050BF000-memory.dmpFilesize
252KB
-
memory/232-221-0x0000000005080000-0x00000000050BF000-memory.dmpFilesize
252KB
-
memory/232-1064-0x00000000050C0000-0x00000000056D8000-memory.dmpFilesize
6.1MB
-
memory/232-1065-0x0000000005760000-0x000000000586A000-memory.dmpFilesize
1.0MB
-
memory/232-1066-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/232-1067-0x00000000023F0000-0x0000000002400000-memory.dmpFilesize
64KB
-
memory/232-1068-0x00000000058C0000-0x00000000058FC000-memory.dmpFilesize
240KB
-
memory/232-1070-0x0000000005BB0000-0x0000000005C42000-memory.dmpFilesize
584KB
-
memory/232-1071-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/232-1072-0x0000000006350000-0x00000000063C6000-memory.dmpFilesize
472KB
-
memory/232-1073-0x00000000063E0000-0x0000000006430000-memory.dmpFilesize
320KB
-
memory/232-1074-0x00000000023F0000-0x0000000002400000-memory.dmpFilesize
64KB
-
memory/232-1075-0x00000000023F0000-0x0000000002400000-memory.dmpFilesize
64KB
-
memory/232-1076-0x00000000023F0000-0x0000000002400000-memory.dmpFilesize
64KB
-
memory/232-1077-0x00000000023F0000-0x0000000002400000-memory.dmpFilesize
64KB
-
memory/232-1078-0x00000000066A0000-0x0000000006862000-memory.dmpFilesize
1.8MB
-
memory/232-1079-0x0000000006880000-0x0000000006DAC000-memory.dmpFilesize
5.2MB
-
memory/772-1085-0x0000000000B10000-0x0000000000B42000-memory.dmpFilesize
200KB
-
memory/772-1086-0x0000000005740000-0x0000000005750000-memory.dmpFilesize
64KB
-
memory/1204-147-0x0000000000EA0000-0x0000000000EAA000-memory.dmpFilesize
40KB