Analysis
-
max time kernel
95s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 19:55
Static task
static1
Behavioral task
behavioral1
Sample
f7e791e18d73b82ff4311ed0e42631f1eae064adfa3885281b1580db2b02b669.exe
Resource
win10v2004-20230220-en
General
-
Target
f7e791e18d73b82ff4311ed0e42631f1eae064adfa3885281b1580db2b02b669.exe
-
Size
658KB
-
MD5
c6637cad71072dcd58d169d88f9f3302
-
SHA1
1fc79eac8edf17092be4e78601efeb4d2ff80b7f
-
SHA256
f7e791e18d73b82ff4311ed0e42631f1eae064adfa3885281b1580db2b02b669
-
SHA512
89a037a21bea5180607242e50dd1a9877f0a1d1694d04d054e6f6c09593e1099378a5bae077162bbda471857c1d84a9169785a5dd4ba4936756bf9292746b125
-
SSDEEP
12288:GMrMy90mI7y2w0x9WoDQIFSsntln1tonwborBmLt8QC6OmQ447zWKB68vl2uXvDb:uyahScbFBntt1mnhBmhK1m54mKkuXvP
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro9581.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro9581.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro9581.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro9581.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro9581.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro9581.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro9581.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/4140-193-0x0000000002520000-0x000000000255F000-memory.dmp family_redline behavioral1/memory/4140-192-0x0000000002520000-0x000000000255F000-memory.dmp family_redline behavioral1/memory/4140-195-0x0000000002520000-0x000000000255F000-memory.dmp family_redline behavioral1/memory/4140-197-0x0000000002520000-0x000000000255F000-memory.dmp family_redline behavioral1/memory/4140-199-0x0000000002520000-0x000000000255F000-memory.dmp family_redline behavioral1/memory/4140-201-0x0000000002520000-0x000000000255F000-memory.dmp family_redline behavioral1/memory/4140-203-0x0000000002520000-0x000000000255F000-memory.dmp family_redline behavioral1/memory/4140-205-0x0000000002520000-0x000000000255F000-memory.dmp family_redline behavioral1/memory/4140-207-0x0000000002520000-0x000000000255F000-memory.dmp family_redline behavioral1/memory/4140-209-0x0000000002520000-0x000000000255F000-memory.dmp family_redline behavioral1/memory/4140-211-0x0000000002520000-0x000000000255F000-memory.dmp family_redline behavioral1/memory/4140-213-0x0000000002520000-0x000000000255F000-memory.dmp family_redline behavioral1/memory/4140-215-0x0000000002520000-0x000000000255F000-memory.dmp family_redline behavioral1/memory/4140-217-0x0000000002520000-0x000000000255F000-memory.dmp family_redline behavioral1/memory/4140-219-0x0000000002520000-0x000000000255F000-memory.dmp family_redline behavioral1/memory/4140-221-0x0000000002520000-0x000000000255F000-memory.dmp family_redline behavioral1/memory/4140-223-0x0000000002520000-0x000000000255F000-memory.dmp family_redline behavioral1/memory/4140-225-0x0000000002520000-0x000000000255F000-memory.dmp family_redline behavioral1/memory/4140-1110-0x0000000004C20000-0x0000000004C30000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un417903.exepro9581.exequ2843.exesi502862.exepid process 4156 un417903.exe 1196 pro9581.exe 4140 qu2843.exe 3308 si502862.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro9581.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro9581.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro9581.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
f7e791e18d73b82ff4311ed0e42631f1eae064adfa3885281b1580db2b02b669.exeun417903.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce f7e791e18d73b82ff4311ed0e42631f1eae064adfa3885281b1580db2b02b669.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" f7e791e18d73b82ff4311ed0e42631f1eae064adfa3885281b1580db2b02b669.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un417903.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un417903.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4344 1196 WerFault.exe pro9581.exe 2888 4140 WerFault.exe qu2843.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro9581.exequ2843.exesi502862.exepid process 1196 pro9581.exe 1196 pro9581.exe 4140 qu2843.exe 4140 qu2843.exe 3308 si502862.exe 3308 si502862.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro9581.exequ2843.exesi502862.exedescription pid process Token: SeDebugPrivilege 1196 pro9581.exe Token: SeDebugPrivilege 4140 qu2843.exe Token: SeDebugPrivilege 3308 si502862.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
f7e791e18d73b82ff4311ed0e42631f1eae064adfa3885281b1580db2b02b669.exeun417903.exedescription pid process target process PID 1728 wrote to memory of 4156 1728 f7e791e18d73b82ff4311ed0e42631f1eae064adfa3885281b1580db2b02b669.exe un417903.exe PID 1728 wrote to memory of 4156 1728 f7e791e18d73b82ff4311ed0e42631f1eae064adfa3885281b1580db2b02b669.exe un417903.exe PID 1728 wrote to memory of 4156 1728 f7e791e18d73b82ff4311ed0e42631f1eae064adfa3885281b1580db2b02b669.exe un417903.exe PID 4156 wrote to memory of 1196 4156 un417903.exe pro9581.exe PID 4156 wrote to memory of 1196 4156 un417903.exe pro9581.exe PID 4156 wrote to memory of 1196 4156 un417903.exe pro9581.exe PID 4156 wrote to memory of 4140 4156 un417903.exe qu2843.exe PID 4156 wrote to memory of 4140 4156 un417903.exe qu2843.exe PID 4156 wrote to memory of 4140 4156 un417903.exe qu2843.exe PID 1728 wrote to memory of 3308 1728 f7e791e18d73b82ff4311ed0e42631f1eae064adfa3885281b1580db2b02b669.exe si502862.exe PID 1728 wrote to memory of 3308 1728 f7e791e18d73b82ff4311ed0e42631f1eae064adfa3885281b1580db2b02b669.exe si502862.exe PID 1728 wrote to memory of 3308 1728 f7e791e18d73b82ff4311ed0e42631f1eae064adfa3885281b1580db2b02b669.exe si502862.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f7e791e18d73b82ff4311ed0e42631f1eae064adfa3885281b1580db2b02b669.exe"C:\Users\Admin\AppData\Local\Temp\f7e791e18d73b82ff4311ed0e42631f1eae064adfa3885281b1580db2b02b669.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un417903.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un417903.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9581.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9581.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 10724⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2843.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2843.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 13564⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si502862.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si502862.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1196 -ip 11961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4140 -ip 41401⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si502862.exeFilesize
175KB
MD5d70aaebf40f405e80fe40791b0bfbaf7
SHA196c54b069d7b8f528fdccfa0480ba058cf0f3473
SHA256afe002aee3e3721a4d2011d7a44dda002098e273e7bccc48986ef365caf314ee
SHA512a7801517942ef63b49cc3bcd421e99d4ea9b96a202595712858a9c5780290961b41bf3306eb35b49b7ec18e016c22b7645324a4fa963700c34479940c48bbba0
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si502862.exeFilesize
175KB
MD5d70aaebf40f405e80fe40791b0bfbaf7
SHA196c54b069d7b8f528fdccfa0480ba058cf0f3473
SHA256afe002aee3e3721a4d2011d7a44dda002098e273e7bccc48986ef365caf314ee
SHA512a7801517942ef63b49cc3bcd421e99d4ea9b96a202595712858a9c5780290961b41bf3306eb35b49b7ec18e016c22b7645324a4fa963700c34479940c48bbba0
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un417903.exeFilesize
516KB
MD5668f1ffd60d2bb09121847873740c00a
SHA100bc5dde4e962c8aa1e50a04f9df119d0e834020
SHA25685f89c496cdc2779e518f6aed204738e86f73ed1d324120b207c3eae20815525
SHA5121ab11a1829a933622b6729309156902a55b168f9ca468f2ae85857d625286bdf14770383891dd0a62129a76276caf8dcc5e56177e1b4839f780e0ed083ff1bf8
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un417903.exeFilesize
516KB
MD5668f1ffd60d2bb09121847873740c00a
SHA100bc5dde4e962c8aa1e50a04f9df119d0e834020
SHA25685f89c496cdc2779e518f6aed204738e86f73ed1d324120b207c3eae20815525
SHA5121ab11a1829a933622b6729309156902a55b168f9ca468f2ae85857d625286bdf14770383891dd0a62129a76276caf8dcc5e56177e1b4839f780e0ed083ff1bf8
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9581.exeFilesize
235KB
MD5e5dfaf1ee07a1721f7ccdfc8f30cd52c
SHA13b234d4d402583eeb778c7a9dd837bfeb1cc180a
SHA256a563eec6ce0985fb0fbd7983daaa3590d276458c32e436d1fb555382326df6f8
SHA512dee4f88d0e9bfebbac5756d7039c26ab2ef1f234a1404f004a430940d51e9b53a998bd8c955aa688e303d2e021011aa58c70d746a6a4314a8dec830e69253672
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9581.exeFilesize
235KB
MD5e5dfaf1ee07a1721f7ccdfc8f30cd52c
SHA13b234d4d402583eeb778c7a9dd837bfeb1cc180a
SHA256a563eec6ce0985fb0fbd7983daaa3590d276458c32e436d1fb555382326df6f8
SHA512dee4f88d0e9bfebbac5756d7039c26ab2ef1f234a1404f004a430940d51e9b53a998bd8c955aa688e303d2e021011aa58c70d746a6a4314a8dec830e69253672
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2843.exeFilesize
294KB
MD58c35d8d2cf0ee2ac22f7add1a32c32db
SHA1547a7ecf034008f29fdc822dcea863df75f7dc13
SHA25690b2523f3fd82a5154820650aeb11573e45b5df00d4691e1c4651898328071c7
SHA512bf488f396af47adecec4318b6cd991d36398ea136b3618047f9999b263b0afa0f68ec747886383e1e82233df401ff41920ea21a60f9dbc3d2a0f4e32df7c03be
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2843.exeFilesize
294KB
MD58c35d8d2cf0ee2ac22f7add1a32c32db
SHA1547a7ecf034008f29fdc822dcea863df75f7dc13
SHA25690b2523f3fd82a5154820650aeb11573e45b5df00d4691e1c4651898328071c7
SHA512bf488f396af47adecec4318b6cd991d36398ea136b3618047f9999b263b0afa0f68ec747886383e1e82233df401ff41920ea21a60f9dbc3d2a0f4e32df7c03be
-
memory/1196-148-0x0000000000610000-0x000000000063D000-memory.dmpFilesize
180KB
-
memory/1196-149-0x0000000004C50000-0x00000000051F4000-memory.dmpFilesize
5.6MB
-
memory/1196-150-0x0000000004C40000-0x0000000004C50000-memory.dmpFilesize
64KB
-
memory/1196-151-0x0000000004C40000-0x0000000004C50000-memory.dmpFilesize
64KB
-
memory/1196-152-0x0000000004C40000-0x0000000004C50000-memory.dmpFilesize
64KB
-
memory/1196-153-0x0000000002300000-0x0000000002312000-memory.dmpFilesize
72KB
-
memory/1196-154-0x0000000002300000-0x0000000002312000-memory.dmpFilesize
72KB
-
memory/1196-156-0x0000000002300000-0x0000000002312000-memory.dmpFilesize
72KB
-
memory/1196-158-0x0000000002300000-0x0000000002312000-memory.dmpFilesize
72KB
-
memory/1196-160-0x0000000002300000-0x0000000002312000-memory.dmpFilesize
72KB
-
memory/1196-162-0x0000000002300000-0x0000000002312000-memory.dmpFilesize
72KB
-
memory/1196-164-0x0000000002300000-0x0000000002312000-memory.dmpFilesize
72KB
-
memory/1196-166-0x0000000002300000-0x0000000002312000-memory.dmpFilesize
72KB
-
memory/1196-168-0x0000000002300000-0x0000000002312000-memory.dmpFilesize
72KB
-
memory/1196-170-0x0000000002300000-0x0000000002312000-memory.dmpFilesize
72KB
-
memory/1196-172-0x0000000002300000-0x0000000002312000-memory.dmpFilesize
72KB
-
memory/1196-174-0x0000000002300000-0x0000000002312000-memory.dmpFilesize
72KB
-
memory/1196-176-0x0000000002300000-0x0000000002312000-memory.dmpFilesize
72KB
-
memory/1196-178-0x0000000002300000-0x0000000002312000-memory.dmpFilesize
72KB
-
memory/1196-180-0x0000000002300000-0x0000000002312000-memory.dmpFilesize
72KB
-
memory/1196-181-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1196-182-0x0000000000610000-0x000000000063D000-memory.dmpFilesize
180KB
-
memory/1196-183-0x0000000004C40000-0x0000000004C50000-memory.dmpFilesize
64KB
-
memory/1196-184-0x0000000004C40000-0x0000000004C50000-memory.dmpFilesize
64KB
-
memory/1196-185-0x0000000004C40000-0x0000000004C50000-memory.dmpFilesize
64KB
-
memory/1196-187-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/3308-1123-0x0000000000F10000-0x0000000000F42000-memory.dmpFilesize
200KB
-
memory/3308-1124-0x0000000005AD0000-0x0000000005AE0000-memory.dmpFilesize
64KB
-
memory/4140-192-0x0000000002520000-0x000000000255F000-memory.dmpFilesize
252KB
-
memory/4140-399-0x0000000004C20000-0x0000000004C30000-memory.dmpFilesize
64KB
-
memory/4140-197-0x0000000002520000-0x000000000255F000-memory.dmpFilesize
252KB
-
memory/4140-199-0x0000000002520000-0x000000000255F000-memory.dmpFilesize
252KB
-
memory/4140-201-0x0000000002520000-0x000000000255F000-memory.dmpFilesize
252KB
-
memory/4140-203-0x0000000002520000-0x000000000255F000-memory.dmpFilesize
252KB
-
memory/4140-205-0x0000000002520000-0x000000000255F000-memory.dmpFilesize
252KB
-
memory/4140-207-0x0000000002520000-0x000000000255F000-memory.dmpFilesize
252KB
-
memory/4140-209-0x0000000002520000-0x000000000255F000-memory.dmpFilesize
252KB
-
memory/4140-211-0x0000000002520000-0x000000000255F000-memory.dmpFilesize
252KB
-
memory/4140-213-0x0000000002520000-0x000000000255F000-memory.dmpFilesize
252KB
-
memory/4140-215-0x0000000002520000-0x000000000255F000-memory.dmpFilesize
252KB
-
memory/4140-217-0x0000000002520000-0x000000000255F000-memory.dmpFilesize
252KB
-
memory/4140-219-0x0000000002520000-0x000000000255F000-memory.dmpFilesize
252KB
-
memory/4140-221-0x0000000002520000-0x000000000255F000-memory.dmpFilesize
252KB
-
memory/4140-223-0x0000000002520000-0x000000000255F000-memory.dmpFilesize
252KB
-
memory/4140-225-0x0000000002520000-0x000000000255F000-memory.dmpFilesize
252KB
-
memory/4140-395-0x0000000002120000-0x000000000216B000-memory.dmpFilesize
300KB
-
memory/4140-396-0x0000000004C20000-0x0000000004C30000-memory.dmpFilesize
64KB
-
memory/4140-195-0x0000000002520000-0x000000000255F000-memory.dmpFilesize
252KB
-
memory/4140-400-0x0000000004C20000-0x0000000004C30000-memory.dmpFilesize
64KB
-
memory/4140-1102-0x00000000052E0000-0x00000000058F8000-memory.dmpFilesize
6.1MB
-
memory/4140-1103-0x0000000005900000-0x0000000005A0A000-memory.dmpFilesize
1.0MB
-
memory/4140-1104-0x0000000004BF0000-0x0000000004C02000-memory.dmpFilesize
72KB
-
memory/4140-1105-0x0000000004C20000-0x0000000004C30000-memory.dmpFilesize
64KB
-
memory/4140-1106-0x0000000005A10000-0x0000000005A4C000-memory.dmpFilesize
240KB
-
memory/4140-1107-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/4140-1108-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/4140-1110-0x0000000004C20000-0x0000000004C30000-memory.dmpFilesize
64KB
-
memory/4140-1111-0x0000000004C20000-0x0000000004C30000-memory.dmpFilesize
64KB
-
memory/4140-1112-0x0000000004C20000-0x0000000004C30000-memory.dmpFilesize
64KB
-
memory/4140-1113-0x00000000064B0000-0x0000000006672000-memory.dmpFilesize
1.8MB
-
memory/4140-1114-0x0000000006690000-0x0000000006BBC000-memory.dmpFilesize
5.2MB
-
memory/4140-193-0x0000000002520000-0x000000000255F000-memory.dmpFilesize
252KB
-
memory/4140-1115-0x0000000004C20000-0x0000000004C30000-memory.dmpFilesize
64KB
-
memory/4140-1116-0x0000000006DF0000-0x0000000006E66000-memory.dmpFilesize
472KB
-
memory/4140-1117-0x0000000006E80000-0x0000000006ED0000-memory.dmpFilesize
320KB