Analysis
-
max time kernel
50s -
max time network
141s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
03-04-2023 19:51
Static task
static1
Behavioral task
behavioral1
Sample
cb7ca3a83a4319ac2d2301f93c385f72516f03f0ba52e046a602563b1702aa06.exe
Resource
win10-20230220-en
General
-
Target
cb7ca3a83a4319ac2d2301f93c385f72516f03f0ba52e046a602563b1702aa06.exe
-
Size
658KB
-
MD5
c51f7312b971cec5b469ec61ab6d3d0e
-
SHA1
7491731866f7b7c6061427e43bb7ba27c642090c
-
SHA256
cb7ca3a83a4319ac2d2301f93c385f72516f03f0ba52e046a602563b1702aa06
-
SHA512
3ffaa5cbb299c49fbfd9dd599e3fd46e48f0c7bc9a3f3c6ec1c2715c1570928f15a1129eb1f8c8e4edcff91eb796d81ed17bf888fa3fd9579ea4cfbd26ad4be4
-
SSDEEP
12288:cMrGy90mUMq26Fg9VgV7gHVOt1nDQS8K5IBjm744ezWKNc8vLhwE:6yPUxBoaIOt1MTmk4nK3t
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro3220.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro3220.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro3220.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro3220.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro3220.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro3220.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/2912-181-0x00000000049A0000-0x00000000049E6000-memory.dmp family_redline behavioral1/memory/2912-182-0x0000000004A20000-0x0000000004A64000-memory.dmp family_redline behavioral1/memory/2912-183-0x0000000004A20000-0x0000000004A5F000-memory.dmp family_redline behavioral1/memory/2912-184-0x0000000004A20000-0x0000000004A5F000-memory.dmp family_redline behavioral1/memory/2912-186-0x0000000004A20000-0x0000000004A5F000-memory.dmp family_redline behavioral1/memory/2912-188-0x0000000004A20000-0x0000000004A5F000-memory.dmp family_redline behavioral1/memory/2912-190-0x0000000004A20000-0x0000000004A5F000-memory.dmp family_redline behavioral1/memory/2912-192-0x0000000004A20000-0x0000000004A5F000-memory.dmp family_redline behavioral1/memory/2912-194-0x0000000004A20000-0x0000000004A5F000-memory.dmp family_redline behavioral1/memory/2912-196-0x0000000004A20000-0x0000000004A5F000-memory.dmp family_redline behavioral1/memory/2912-198-0x0000000004A20000-0x0000000004A5F000-memory.dmp family_redline behavioral1/memory/2912-200-0x0000000004A20000-0x0000000004A5F000-memory.dmp family_redline behavioral1/memory/2912-202-0x0000000004A20000-0x0000000004A5F000-memory.dmp family_redline behavioral1/memory/2912-206-0x0000000004A20000-0x0000000004A5F000-memory.dmp family_redline behavioral1/memory/2912-210-0x0000000004A20000-0x0000000004A5F000-memory.dmp family_redline behavioral1/memory/2912-212-0x0000000004A20000-0x0000000004A5F000-memory.dmp family_redline behavioral1/memory/2912-214-0x0000000004A20000-0x0000000004A5F000-memory.dmp family_redline behavioral1/memory/2912-216-0x0000000004A20000-0x0000000004A5F000-memory.dmp family_redline behavioral1/memory/2912-218-0x0000000004A20000-0x0000000004A5F000-memory.dmp family_redline behavioral1/memory/2912-220-0x0000000004A20000-0x0000000004A5F000-memory.dmp family_redline behavioral1/memory/2912-1101-0x0000000004AD0000-0x0000000004AE0000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un760358.exepro3220.exequ7551.exesi363406.exepid process 3260 un760358.exe 2736 pro3220.exe 2912 qu7551.exe 3972 si363406.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro3220.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro3220.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro3220.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un760358.execb7ca3a83a4319ac2d2301f93c385f72516f03f0ba52e046a602563b1702aa06.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un760358.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un760358.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce cb7ca3a83a4319ac2d2301f93c385f72516f03f0ba52e046a602563b1702aa06.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" cb7ca3a83a4319ac2d2301f93c385f72516f03f0ba52e046a602563b1702aa06.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro3220.exequ7551.exesi363406.exepid process 2736 pro3220.exe 2736 pro3220.exe 2912 qu7551.exe 2912 qu7551.exe 3972 si363406.exe 3972 si363406.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro3220.exequ7551.exesi363406.exedescription pid process Token: SeDebugPrivilege 2736 pro3220.exe Token: SeDebugPrivilege 2912 qu7551.exe Token: SeDebugPrivilege 3972 si363406.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
cb7ca3a83a4319ac2d2301f93c385f72516f03f0ba52e046a602563b1702aa06.exeun760358.exedescription pid process target process PID 2572 wrote to memory of 3260 2572 cb7ca3a83a4319ac2d2301f93c385f72516f03f0ba52e046a602563b1702aa06.exe un760358.exe PID 2572 wrote to memory of 3260 2572 cb7ca3a83a4319ac2d2301f93c385f72516f03f0ba52e046a602563b1702aa06.exe un760358.exe PID 2572 wrote to memory of 3260 2572 cb7ca3a83a4319ac2d2301f93c385f72516f03f0ba52e046a602563b1702aa06.exe un760358.exe PID 3260 wrote to memory of 2736 3260 un760358.exe pro3220.exe PID 3260 wrote to memory of 2736 3260 un760358.exe pro3220.exe PID 3260 wrote to memory of 2736 3260 un760358.exe pro3220.exe PID 3260 wrote to memory of 2912 3260 un760358.exe qu7551.exe PID 3260 wrote to memory of 2912 3260 un760358.exe qu7551.exe PID 3260 wrote to memory of 2912 3260 un760358.exe qu7551.exe PID 2572 wrote to memory of 3972 2572 cb7ca3a83a4319ac2d2301f93c385f72516f03f0ba52e046a602563b1702aa06.exe si363406.exe PID 2572 wrote to memory of 3972 2572 cb7ca3a83a4319ac2d2301f93c385f72516f03f0ba52e046a602563b1702aa06.exe si363406.exe PID 2572 wrote to memory of 3972 2572 cb7ca3a83a4319ac2d2301f93c385f72516f03f0ba52e046a602563b1702aa06.exe si363406.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb7ca3a83a4319ac2d2301f93c385f72516f03f0ba52e046a602563b1702aa06.exe"C:\Users\Admin\AppData\Local\Temp\cb7ca3a83a4319ac2d2301f93c385f72516f03f0ba52e046a602563b1702aa06.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un760358.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un760358.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3220.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3220.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7551.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7551.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si363406.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si363406.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si363406.exeFilesize
175KB
MD5f0c04caf11f79e1ba4e7f26e404dad3e
SHA1bb0d7ec1cad0bb78a16fda2630b81b6424efa737
SHA256c4ee6354d7ba06971fd546d0e8af49ed85d800ac65da3bc7e558dd5c3be0c7d2
SHA512cba90e59f607fe033f5796d9c2fd729aae65253e41d2aba064d70f5f04bc0dc08bf800ded3714910fedf411fc81661ce116e89adeec250236dbf3f0c070621ab
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si363406.exeFilesize
175KB
MD5f0c04caf11f79e1ba4e7f26e404dad3e
SHA1bb0d7ec1cad0bb78a16fda2630b81b6424efa737
SHA256c4ee6354d7ba06971fd546d0e8af49ed85d800ac65da3bc7e558dd5c3be0c7d2
SHA512cba90e59f607fe033f5796d9c2fd729aae65253e41d2aba064d70f5f04bc0dc08bf800ded3714910fedf411fc81661ce116e89adeec250236dbf3f0c070621ab
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un760358.exeFilesize
516KB
MD5af5c7f696dbc085bdf3c4c370dc6bc44
SHA1e713ab2161d018c72c5a50ae19e65deef175483b
SHA256affa1813c9592e31dc81c722d46b357b9f6d95b70c85511875de0e4da798104b
SHA5125a71fac5c106fdb396ed5b855e07245faebe6805c4085f8e93f67ae129c8b4b8ab6a49d53cdd4f01b70a0de7bab62f29e456e6d02bd6460d48a45cca2e0f256f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un760358.exeFilesize
516KB
MD5af5c7f696dbc085bdf3c4c370dc6bc44
SHA1e713ab2161d018c72c5a50ae19e65deef175483b
SHA256affa1813c9592e31dc81c722d46b357b9f6d95b70c85511875de0e4da798104b
SHA5125a71fac5c106fdb396ed5b855e07245faebe6805c4085f8e93f67ae129c8b4b8ab6a49d53cdd4f01b70a0de7bab62f29e456e6d02bd6460d48a45cca2e0f256f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3220.exeFilesize
235KB
MD5a1165fb3d9a8468e24603b3d76189825
SHA1562a06f29bc49673692cf45bd009a87d7d0630b6
SHA256c83a291411e307361034cfe6ce8175a8f1e00f69c79a90b4df4b28c0f22869ff
SHA512981f8e93e39fc3f854f2e8ac4e9b438b6018e6114c3d59ed0e6f50294f47bb353dae19f841532aebac1984ff2f8eb6fef8cd45209a9dd205f138318bd175ee32
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3220.exeFilesize
235KB
MD5a1165fb3d9a8468e24603b3d76189825
SHA1562a06f29bc49673692cf45bd009a87d7d0630b6
SHA256c83a291411e307361034cfe6ce8175a8f1e00f69c79a90b4df4b28c0f22869ff
SHA512981f8e93e39fc3f854f2e8ac4e9b438b6018e6114c3d59ed0e6f50294f47bb353dae19f841532aebac1984ff2f8eb6fef8cd45209a9dd205f138318bd175ee32
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7551.exeFilesize
294KB
MD5afc29a40615e20e63b379e49be6c992c
SHA1150063706c7ad39ae69ede084e3335b55e8707f8
SHA256301cf012474660becb53a8e8dd4e0ed292b7172af61223bd69dacb486d9aad58
SHA512f27118cef3d234acfc7a81e3a765144cf4491eca6bc0a9ed57a34ca8c6dba2bb4c46469cc73f69c70945d7911843d2dcad90321e564158765970a0e655d2a0b9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7551.exeFilesize
294KB
MD5afc29a40615e20e63b379e49be6c992c
SHA1150063706c7ad39ae69ede084e3335b55e8707f8
SHA256301cf012474660becb53a8e8dd4e0ed292b7172af61223bd69dacb486d9aad58
SHA512f27118cef3d234acfc7a81e3a765144cf4491eca6bc0a9ed57a34ca8c6dba2bb4c46469cc73f69c70945d7911843d2dcad90321e564158765970a0e655d2a0b9
-
memory/2736-136-0x00000000001D0000-0x00000000001FD000-memory.dmpFilesize
180KB
-
memory/2736-137-0x0000000002130000-0x000000000214A000-memory.dmpFilesize
104KB
-
memory/2736-138-0x0000000004B20000-0x000000000501E000-memory.dmpFilesize
5.0MB
-
memory/2736-139-0x0000000000850000-0x0000000000860000-memory.dmpFilesize
64KB
-
memory/2736-140-0x0000000000850000-0x0000000000860000-memory.dmpFilesize
64KB
-
memory/2736-141-0x0000000000850000-0x0000000000860000-memory.dmpFilesize
64KB
-
memory/2736-142-0x00000000022C0000-0x00000000022D8000-memory.dmpFilesize
96KB
-
memory/2736-143-0x00000000022C0000-0x00000000022D2000-memory.dmpFilesize
72KB
-
memory/2736-144-0x00000000022C0000-0x00000000022D2000-memory.dmpFilesize
72KB
-
memory/2736-146-0x00000000022C0000-0x00000000022D2000-memory.dmpFilesize
72KB
-
memory/2736-148-0x00000000022C0000-0x00000000022D2000-memory.dmpFilesize
72KB
-
memory/2736-150-0x00000000022C0000-0x00000000022D2000-memory.dmpFilesize
72KB
-
memory/2736-152-0x00000000022C0000-0x00000000022D2000-memory.dmpFilesize
72KB
-
memory/2736-154-0x00000000022C0000-0x00000000022D2000-memory.dmpFilesize
72KB
-
memory/2736-156-0x00000000022C0000-0x00000000022D2000-memory.dmpFilesize
72KB
-
memory/2736-158-0x00000000022C0000-0x00000000022D2000-memory.dmpFilesize
72KB
-
memory/2736-160-0x00000000022C0000-0x00000000022D2000-memory.dmpFilesize
72KB
-
memory/2736-162-0x00000000022C0000-0x00000000022D2000-memory.dmpFilesize
72KB
-
memory/2736-164-0x00000000022C0000-0x00000000022D2000-memory.dmpFilesize
72KB
-
memory/2736-166-0x00000000022C0000-0x00000000022D2000-memory.dmpFilesize
72KB
-
memory/2736-168-0x00000000022C0000-0x00000000022D2000-memory.dmpFilesize
72KB
-
memory/2736-170-0x00000000022C0000-0x00000000022D2000-memory.dmpFilesize
72KB
-
memory/2736-171-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2736-172-0x0000000000850000-0x0000000000860000-memory.dmpFilesize
64KB
-
memory/2736-173-0x0000000000850000-0x0000000000860000-memory.dmpFilesize
64KB
-
memory/2736-174-0x0000000000850000-0x0000000000860000-memory.dmpFilesize
64KB
-
memory/2736-176-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2912-181-0x00000000049A0000-0x00000000049E6000-memory.dmpFilesize
280KB
-
memory/2912-182-0x0000000004A20000-0x0000000004A64000-memory.dmpFilesize
272KB
-
memory/2912-183-0x0000000004A20000-0x0000000004A5F000-memory.dmpFilesize
252KB
-
memory/2912-184-0x0000000004A20000-0x0000000004A5F000-memory.dmpFilesize
252KB
-
memory/2912-186-0x0000000004A20000-0x0000000004A5F000-memory.dmpFilesize
252KB
-
memory/2912-188-0x0000000004A20000-0x0000000004A5F000-memory.dmpFilesize
252KB
-
memory/2912-190-0x0000000004A20000-0x0000000004A5F000-memory.dmpFilesize
252KB
-
memory/2912-192-0x0000000004A20000-0x0000000004A5F000-memory.dmpFilesize
252KB
-
memory/2912-194-0x0000000004A20000-0x0000000004A5F000-memory.dmpFilesize
252KB
-
memory/2912-196-0x0000000004A20000-0x0000000004A5F000-memory.dmpFilesize
252KB
-
memory/2912-198-0x0000000004A20000-0x0000000004A5F000-memory.dmpFilesize
252KB
-
memory/2912-200-0x0000000004A20000-0x0000000004A5F000-memory.dmpFilesize
252KB
-
memory/2912-202-0x0000000004A20000-0x0000000004A5F000-memory.dmpFilesize
252KB
-
memory/2912-203-0x0000000001E50000-0x0000000001E9B000-memory.dmpFilesize
300KB
-
memory/2912-206-0x0000000004A20000-0x0000000004A5F000-memory.dmpFilesize
252KB
-
memory/2912-205-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/2912-207-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/2912-209-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/2912-210-0x0000000004A20000-0x0000000004A5F000-memory.dmpFilesize
252KB
-
memory/2912-212-0x0000000004A20000-0x0000000004A5F000-memory.dmpFilesize
252KB
-
memory/2912-214-0x0000000004A20000-0x0000000004A5F000-memory.dmpFilesize
252KB
-
memory/2912-216-0x0000000004A20000-0x0000000004A5F000-memory.dmpFilesize
252KB
-
memory/2912-218-0x0000000004A20000-0x0000000004A5F000-memory.dmpFilesize
252KB
-
memory/2912-220-0x0000000004A20000-0x0000000004A5F000-memory.dmpFilesize
252KB
-
memory/2912-1093-0x0000000004FE0000-0x00000000055E6000-memory.dmpFilesize
6.0MB
-
memory/2912-1094-0x0000000005660000-0x000000000576A000-memory.dmpFilesize
1.0MB
-
memory/2912-1095-0x00000000057A0000-0x00000000057B2000-memory.dmpFilesize
72KB
-
memory/2912-1096-0x00000000057C0000-0x00000000057FE000-memory.dmpFilesize
248KB
-
memory/2912-1097-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/2912-1098-0x0000000005910000-0x000000000595B000-memory.dmpFilesize
300KB
-
memory/2912-1100-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/2912-1101-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/2912-1102-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/2912-1103-0x0000000005AA0000-0x0000000005B32000-memory.dmpFilesize
584KB
-
memory/2912-1104-0x0000000005B40000-0x0000000005BA6000-memory.dmpFilesize
408KB
-
memory/2912-1105-0x0000000006200000-0x0000000006276000-memory.dmpFilesize
472KB
-
memory/2912-1106-0x00000000062A0000-0x00000000062F0000-memory.dmpFilesize
320KB
-
memory/2912-1107-0x0000000006420000-0x00000000065E2000-memory.dmpFilesize
1.8MB
-
memory/2912-1108-0x0000000006600000-0x0000000006B2C000-memory.dmpFilesize
5.2MB
-
memory/2912-1109-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/3972-1115-0x0000000000A30000-0x0000000000A62000-memory.dmpFilesize
200KB
-
memory/3972-1116-0x00000000055E0000-0x00000000055F0000-memory.dmpFilesize
64KB
-
memory/3972-1117-0x0000000005470000-0x00000000054BB000-memory.dmpFilesize
300KB