Analysis
-
max time kernel
61s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 19:59
Static task
static1
Behavioral task
behavioral1
Sample
b108d266ff040cd345157a87ee564cbdafee33b26fca6c4a185c493a36f902dd.exe
Resource
win10v2004-20230221-en
General
-
Target
b108d266ff040cd345157a87ee564cbdafee33b26fca6c4a185c493a36f902dd.exe
-
Size
658KB
-
MD5
e5cf6c077a2b515db2b551a52d1fb1b4
-
SHA1
33afe11fe73b246478b8be3d8efa30b62ae6c887
-
SHA256
b108d266ff040cd345157a87ee564cbdafee33b26fca6c4a185c493a36f902dd
-
SHA512
67c8dd4e44fcc68cab8029c2bcf71308816d8ae7b1fe3b0797f0bb322ed238ff98196366442b6f2d5d5e1fd6c8e96f245e678133e3ad4627fb071e4856819b74
-
SSDEEP
12288:hMrey90TkeGAU4SzbEs0PtuXyQEulYsLBsz44bzWKD/8v00ctZ:LyukxHxos0PtW/EulYUsM4GKvh
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro1235.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro1235.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro1235.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro1235.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro1235.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro1235.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro1235.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/4524-194-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4524-196-0x0000000004CD0000-0x0000000004CE0000-memory.dmp family_redline behavioral1/memory/4524-198-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4524-195-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4524-200-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4524-202-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4524-204-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4524-206-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4524-208-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4524-210-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4524-212-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4524-214-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4524-216-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4524-218-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4524-220-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4524-222-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4524-224-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4524-226-0x0000000002610000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/4524-228-0x0000000002610000-0x000000000264F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un011680.exepro1235.exequ9051.exesi918956.exepid process 2696 un011680.exe 4460 pro1235.exe 4524 qu9051.exe 2028 si918956.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro1235.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro1235.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro1235.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un011680.exeb108d266ff040cd345157a87ee564cbdafee33b26fca6c4a185c493a36f902dd.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un011680.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce b108d266ff040cd345157a87ee564cbdafee33b26fca6c4a185c493a36f902dd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" b108d266ff040cd345157a87ee564cbdafee33b26fca6c4a185c493a36f902dd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un011680.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3548 4460 WerFault.exe pro1235.exe 1500 4524 WerFault.exe qu9051.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro1235.exequ9051.exesi918956.exepid process 4460 pro1235.exe 4460 pro1235.exe 4524 qu9051.exe 4524 qu9051.exe 2028 si918956.exe 2028 si918956.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro1235.exequ9051.exesi918956.exedescription pid process Token: SeDebugPrivilege 4460 pro1235.exe Token: SeDebugPrivilege 4524 qu9051.exe Token: SeDebugPrivilege 2028 si918956.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
b108d266ff040cd345157a87ee564cbdafee33b26fca6c4a185c493a36f902dd.exeun011680.exedescription pid process target process PID 4632 wrote to memory of 2696 4632 b108d266ff040cd345157a87ee564cbdafee33b26fca6c4a185c493a36f902dd.exe un011680.exe PID 4632 wrote to memory of 2696 4632 b108d266ff040cd345157a87ee564cbdafee33b26fca6c4a185c493a36f902dd.exe un011680.exe PID 4632 wrote to memory of 2696 4632 b108d266ff040cd345157a87ee564cbdafee33b26fca6c4a185c493a36f902dd.exe un011680.exe PID 2696 wrote to memory of 4460 2696 un011680.exe pro1235.exe PID 2696 wrote to memory of 4460 2696 un011680.exe pro1235.exe PID 2696 wrote to memory of 4460 2696 un011680.exe pro1235.exe PID 2696 wrote to memory of 4524 2696 un011680.exe qu9051.exe PID 2696 wrote to memory of 4524 2696 un011680.exe qu9051.exe PID 2696 wrote to memory of 4524 2696 un011680.exe qu9051.exe PID 4632 wrote to memory of 2028 4632 b108d266ff040cd345157a87ee564cbdafee33b26fca6c4a185c493a36f902dd.exe si918956.exe PID 4632 wrote to memory of 2028 4632 b108d266ff040cd345157a87ee564cbdafee33b26fca6c4a185c493a36f902dd.exe si918956.exe PID 4632 wrote to memory of 2028 4632 b108d266ff040cd345157a87ee564cbdafee33b26fca6c4a185c493a36f902dd.exe si918956.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b108d266ff040cd345157a87ee564cbdafee33b26fca6c4a185c493a36f902dd.exe"C:\Users\Admin\AppData\Local\Temp\b108d266ff040cd345157a87ee564cbdafee33b26fca6c4a185c493a36f902dd.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un011680.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un011680.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1235.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1235.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 10804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9051.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9051.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 17204⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si918956.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si918956.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4460 -ip 44601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4524 -ip 45241⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si918956.exeFilesize
175KB
MD52b1e8e34e4a599595b1782e50b63a353
SHA1a45ac2618842ef9318b151d7d6a7982dc20a1ebf
SHA25655d3852c8108199496a86da98736d0b3dc14f514e9ed590c24dfbf460978aa2f
SHA5129625ba64a124ede3f751693ee4c907e747e7d1433936ca9ab9fa06464070d6d7447a47ecc18f92b6a1a63605883ce5ee09646f88e2d2715f7cfd76d678f4971c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si918956.exeFilesize
175KB
MD52b1e8e34e4a599595b1782e50b63a353
SHA1a45ac2618842ef9318b151d7d6a7982dc20a1ebf
SHA25655d3852c8108199496a86da98736d0b3dc14f514e9ed590c24dfbf460978aa2f
SHA5129625ba64a124ede3f751693ee4c907e747e7d1433936ca9ab9fa06464070d6d7447a47ecc18f92b6a1a63605883ce5ee09646f88e2d2715f7cfd76d678f4971c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un011680.exeFilesize
516KB
MD5ed9dbd6dc43afcece553aadc1dd8c0c6
SHA1599036f06c53e9483a9168d7a93b31673f0906b3
SHA2568fc6d82bd695b62c96c6c9c838e6682eb6ad747a6be9baf868f5703e5af0652a
SHA5120eade6ef358029ef485fa0f432b97fc4d0d9ebd6eaf06e12b242abad128119367abef5e4d6a38358928dcd3aeac0dad11f700ad213ca8331923e2b0269bab8a1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un011680.exeFilesize
516KB
MD5ed9dbd6dc43afcece553aadc1dd8c0c6
SHA1599036f06c53e9483a9168d7a93b31673f0906b3
SHA2568fc6d82bd695b62c96c6c9c838e6682eb6ad747a6be9baf868f5703e5af0652a
SHA5120eade6ef358029ef485fa0f432b97fc4d0d9ebd6eaf06e12b242abad128119367abef5e4d6a38358928dcd3aeac0dad11f700ad213ca8331923e2b0269bab8a1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1235.exeFilesize
235KB
MD516b26c95700c13f4ca5c5ae0ad8c8658
SHA1d1153fb2c68445c6eedba8067931a8a1c49050eb
SHA25699081d86609adc9063ad6b1003a46749680cc445d7473c348ea506c56af95435
SHA512bb3c81bb6086bc482ca49339105eec0e2dc6fd37230bad52c463e42af8e7895aeb4ad3bdab40dff3efe1d499ebf00e8a7de441126336b70584b675441d9d4f83
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1235.exeFilesize
235KB
MD516b26c95700c13f4ca5c5ae0ad8c8658
SHA1d1153fb2c68445c6eedba8067931a8a1c49050eb
SHA25699081d86609adc9063ad6b1003a46749680cc445d7473c348ea506c56af95435
SHA512bb3c81bb6086bc482ca49339105eec0e2dc6fd37230bad52c463e42af8e7895aeb4ad3bdab40dff3efe1d499ebf00e8a7de441126336b70584b675441d9d4f83
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9051.exeFilesize
294KB
MD5c24e592e63b8cf9d792e4437af171f6b
SHA167839381a297a3da2754b0ee9493b0ca815b7e8e
SHA256be62fd8d0c640ebdbf1278569224d4b6d6afce0f1cfe27e0f070b3d64dc5e740
SHA5126c8047a38ca3a33c2ebd9e095d62f4c20c858cdd639c78f09397c25b4d0f82436803d1c1d8df27181c875be0e38ca470c464b2cd41907e69c653d1942cdce2a7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9051.exeFilesize
294KB
MD5c24e592e63b8cf9d792e4437af171f6b
SHA167839381a297a3da2754b0ee9493b0ca815b7e8e
SHA256be62fd8d0c640ebdbf1278569224d4b6d6afce0f1cfe27e0f070b3d64dc5e740
SHA5126c8047a38ca3a33c2ebd9e095d62f4c20c858cdd639c78f09397c25b4d0f82436803d1c1d8df27181c875be0e38ca470c464b2cd41907e69c653d1942cdce2a7
-
memory/2028-1122-0x00000000006A0000-0x00000000006D2000-memory.dmpFilesize
200KB
-
memory/2028-1123-0x0000000005240000-0x0000000005250000-memory.dmpFilesize
64KB
-
memory/4460-156-0x0000000002320000-0x0000000002332000-memory.dmpFilesize
72KB
-
memory/4460-170-0x0000000002320000-0x0000000002332000-memory.dmpFilesize
72KB
-
memory/4460-151-0x0000000004C60000-0x0000000004C70000-memory.dmpFilesize
64KB
-
memory/4460-152-0x0000000004C60000-0x0000000004C70000-memory.dmpFilesize
64KB
-
memory/4460-153-0x0000000002320000-0x0000000002332000-memory.dmpFilesize
72KB
-
memory/4460-154-0x0000000002320000-0x0000000002332000-memory.dmpFilesize
72KB
-
memory/4460-149-0x0000000004C70000-0x0000000005214000-memory.dmpFilesize
5.6MB
-
memory/4460-158-0x0000000002320000-0x0000000002332000-memory.dmpFilesize
72KB
-
memory/4460-160-0x0000000002320000-0x0000000002332000-memory.dmpFilesize
72KB
-
memory/4460-162-0x0000000002320000-0x0000000002332000-memory.dmpFilesize
72KB
-
memory/4460-164-0x0000000002320000-0x0000000002332000-memory.dmpFilesize
72KB
-
memory/4460-166-0x0000000002320000-0x0000000002332000-memory.dmpFilesize
72KB
-
memory/4460-168-0x0000000002320000-0x0000000002332000-memory.dmpFilesize
72KB
-
memory/4460-150-0x0000000004C60000-0x0000000004C70000-memory.dmpFilesize
64KB
-
memory/4460-172-0x0000000002320000-0x0000000002332000-memory.dmpFilesize
72KB
-
memory/4460-174-0x0000000002320000-0x0000000002332000-memory.dmpFilesize
72KB
-
memory/4460-176-0x0000000002320000-0x0000000002332000-memory.dmpFilesize
72KB
-
memory/4460-178-0x0000000002320000-0x0000000002332000-memory.dmpFilesize
72KB
-
memory/4460-180-0x0000000002320000-0x0000000002332000-memory.dmpFilesize
72KB
-
memory/4460-181-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4460-182-0x0000000004C60000-0x0000000004C70000-memory.dmpFilesize
64KB
-
memory/4460-183-0x0000000004C60000-0x0000000004C70000-memory.dmpFilesize
64KB
-
memory/4460-184-0x0000000004C60000-0x0000000004C70000-memory.dmpFilesize
64KB
-
memory/4460-186-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4460-148-0x0000000000600000-0x000000000062D000-memory.dmpFilesize
180KB
-
memory/4524-194-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4524-226-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4524-192-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/4524-196-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/4524-198-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4524-195-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4524-200-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4524-202-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4524-204-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4524-206-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4524-208-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4524-210-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4524-212-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4524-214-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4524-216-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4524-218-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4524-220-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4524-222-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4524-224-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4524-193-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/4524-228-0x0000000002610000-0x000000000264F000-memory.dmpFilesize
252KB
-
memory/4524-1101-0x0000000005290000-0x00000000058A8000-memory.dmpFilesize
6.1MB
-
memory/4524-1102-0x00000000058B0000-0x00000000059BA000-memory.dmpFilesize
1.0MB
-
memory/4524-1103-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/4524-1104-0x0000000005A40000-0x0000000005A7C000-memory.dmpFilesize
240KB
-
memory/4524-1105-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/4524-1106-0x0000000005CF0000-0x0000000005D56000-memory.dmpFilesize
408KB
-
memory/4524-1107-0x00000000063A0000-0x0000000006432000-memory.dmpFilesize
584KB
-
memory/4524-1109-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/4524-1110-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/4524-1111-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/4524-1112-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/4524-1113-0x0000000006830000-0x00000000068A6000-memory.dmpFilesize
472KB
-
memory/4524-191-0x0000000000640000-0x000000000068B000-memory.dmpFilesize
300KB
-
memory/4524-1114-0x00000000068D0000-0x0000000006920000-memory.dmpFilesize
320KB
-
memory/4524-1115-0x0000000006950000-0x0000000006B12000-memory.dmpFilesize
1.8MB
-
memory/4524-1116-0x0000000006B20000-0x000000000704C000-memory.dmpFilesize
5.2MB