Analysis
-
max time kernel
61s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 20:08
Static task
static1
Behavioral task
behavioral1
Sample
111cd60f00db357183832a5428f1e634c74c2ba695b21f5d23d05a8c6f0dfea2.exe
Resource
win10v2004-20230221-en
General
-
Target
111cd60f00db357183832a5428f1e634c74c2ba695b21f5d23d05a8c6f0dfea2.exe
-
Size
657KB
-
MD5
fce79cdfffc83eccc8b71a098995fad0
-
SHA1
a4a2eb613b78d5dc60ea2b2930d6328277601c62
-
SHA256
111cd60f00db357183832a5428f1e634c74c2ba695b21f5d23d05a8c6f0dfea2
-
SHA512
410d1d4432b72ff83a28527795c4fab62d599bed85e8bb69731d61578bb80c74d2cee1c9aca83a50b039e9ad835f9e6da59c3faa2342a932c17efa140100e6dd
-
SSDEEP
12288:XMrKy90cbjygqmGCYfWBtNdwpzPCALt8wVTvys44tzWKdt8vSPkP7h:xyugN3BtXkBh5zyt4wKHsDh
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro8616.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro8616.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro8616.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro8616.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro8616.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro8616.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro8616.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/3736-191-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/3736-192-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/3736-195-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/3736-198-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/3736-202-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/3736-204-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/3736-206-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/3736-208-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/3736-210-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/3736-212-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/3736-214-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/3736-216-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/3736-218-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/3736-220-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/3736-222-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/3736-224-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/3736-228-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/3736-226-0x0000000002430000-0x000000000246F000-memory.dmp family_redline behavioral1/memory/3736-1113-0x0000000004E00000-0x0000000004E10000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un503585.exepro8616.exequ8405.exesi542754.exepid process 1368 un503585.exe 5068 pro8616.exe 3736 qu8405.exe 2272 si542754.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro8616.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro8616.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro8616.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un503585.exe111cd60f00db357183832a5428f1e634c74c2ba695b21f5d23d05a8c6f0dfea2.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un503585.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un503585.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 111cd60f00db357183832a5428f1e634c74c2ba695b21f5d23d05a8c6f0dfea2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 111cd60f00db357183832a5428f1e634c74c2ba695b21f5d23d05a8c6f0dfea2.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1076 5068 WerFault.exe pro8616.exe 3368 3736 WerFault.exe qu8405.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro8616.exequ8405.exesi542754.exepid process 5068 pro8616.exe 5068 pro8616.exe 3736 qu8405.exe 3736 qu8405.exe 2272 si542754.exe 2272 si542754.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro8616.exequ8405.exesi542754.exedescription pid process Token: SeDebugPrivilege 5068 pro8616.exe Token: SeDebugPrivilege 3736 qu8405.exe Token: SeDebugPrivilege 2272 si542754.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
111cd60f00db357183832a5428f1e634c74c2ba695b21f5d23d05a8c6f0dfea2.exeun503585.exedescription pid process target process PID 1628 wrote to memory of 1368 1628 111cd60f00db357183832a5428f1e634c74c2ba695b21f5d23d05a8c6f0dfea2.exe un503585.exe PID 1628 wrote to memory of 1368 1628 111cd60f00db357183832a5428f1e634c74c2ba695b21f5d23d05a8c6f0dfea2.exe un503585.exe PID 1628 wrote to memory of 1368 1628 111cd60f00db357183832a5428f1e634c74c2ba695b21f5d23d05a8c6f0dfea2.exe un503585.exe PID 1368 wrote to memory of 5068 1368 un503585.exe pro8616.exe PID 1368 wrote to memory of 5068 1368 un503585.exe pro8616.exe PID 1368 wrote to memory of 5068 1368 un503585.exe pro8616.exe PID 1368 wrote to memory of 3736 1368 un503585.exe qu8405.exe PID 1368 wrote to memory of 3736 1368 un503585.exe qu8405.exe PID 1368 wrote to memory of 3736 1368 un503585.exe qu8405.exe PID 1628 wrote to memory of 2272 1628 111cd60f00db357183832a5428f1e634c74c2ba695b21f5d23d05a8c6f0dfea2.exe si542754.exe PID 1628 wrote to memory of 2272 1628 111cd60f00db357183832a5428f1e634c74c2ba695b21f5d23d05a8c6f0dfea2.exe si542754.exe PID 1628 wrote to memory of 2272 1628 111cd60f00db357183832a5428f1e634c74c2ba695b21f5d23d05a8c6f0dfea2.exe si542754.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\111cd60f00db357183832a5428f1e634c74c2ba695b21f5d23d05a8c6f0dfea2.exe"C:\Users\Admin\AppData\Local\Temp\111cd60f00db357183832a5428f1e634c74c2ba695b21f5d23d05a8c6f0dfea2.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un503585.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un503585.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8616.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8616.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 10804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8405.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8405.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 15324⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si542754.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si542754.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5068 -ip 50681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3736 -ip 37361⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si542754.exeFilesize
175KB
MD52b1100ae9b40f23f85e850e31a19058b
SHA1b5b67c63bea21ec3e68fbb2e9ab56c42c00dba22
SHA256c6e2d8aa89eeee80df6324777f8874889a3136a66813e97ccfe8a9a3fd9747a2
SHA512af01605daa0f0a9cfc78a93b372095063ee2704eca384c25c69190475272da286a3f882e127100518b4563e544a10c9f4c67b97e19345bc5897fae72225d21e5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si542754.exeFilesize
175KB
MD52b1100ae9b40f23f85e850e31a19058b
SHA1b5b67c63bea21ec3e68fbb2e9ab56c42c00dba22
SHA256c6e2d8aa89eeee80df6324777f8874889a3136a66813e97ccfe8a9a3fd9747a2
SHA512af01605daa0f0a9cfc78a93b372095063ee2704eca384c25c69190475272da286a3f882e127100518b4563e544a10c9f4c67b97e19345bc5897fae72225d21e5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un503585.exeFilesize
515KB
MD5e4a4a1d9ea59a0fcbd4260f38b97abac
SHA17f799b88e3fc0fbaa06f0c919f5185efb5f1149e
SHA2564ff111ab0f10aa2cf05daad16d623df79ab79b25d192ccfb59c040bf98808dc7
SHA5126f02adc4943ca9510f06567b5378df49777896da86c2c077b0c10e72c852a9bc9fc92e3515b8d819cac7ebc3658d543977e468df5232a9f4fdad1e609bcf214b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un503585.exeFilesize
515KB
MD5e4a4a1d9ea59a0fcbd4260f38b97abac
SHA17f799b88e3fc0fbaa06f0c919f5185efb5f1149e
SHA2564ff111ab0f10aa2cf05daad16d623df79ab79b25d192ccfb59c040bf98808dc7
SHA5126f02adc4943ca9510f06567b5378df49777896da86c2c077b0c10e72c852a9bc9fc92e3515b8d819cac7ebc3658d543977e468df5232a9f4fdad1e609bcf214b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8616.exeFilesize
235KB
MD518db9c458f34c1326281108134a186a5
SHA1cf0c9b7ade7bfcf72c17b8739e7e7ddb92b2acec
SHA2564d9661dd5c6931b66a47e92baa17c904311ed5d9b9672adbfed14acb8fdfe8ae
SHA5122f3ffd954514faabd93c1f1deb3fef73ca4012747f7664d1b3547c771e8fa2da7ccaff380fabfeb46c37ec19316483011498f98d309c320c7c8f2fc6327e0fb5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8616.exeFilesize
235KB
MD518db9c458f34c1326281108134a186a5
SHA1cf0c9b7ade7bfcf72c17b8739e7e7ddb92b2acec
SHA2564d9661dd5c6931b66a47e92baa17c904311ed5d9b9672adbfed14acb8fdfe8ae
SHA5122f3ffd954514faabd93c1f1deb3fef73ca4012747f7664d1b3547c771e8fa2da7ccaff380fabfeb46c37ec19316483011498f98d309c320c7c8f2fc6327e0fb5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8405.exeFilesize
294KB
MD5c873e7d61065a74e82ccfff6e6795ec8
SHA1b8b6dddeb840d25b347aec259a6d446e486b780b
SHA256ed153419afb6b863171a17607adb3e902123635dd342012b0eee25a4573ed841
SHA512df65005263805e78bd2d4a52be13207e9cf41998874b3f853c30dad754416fc4f9485fe7ab18e01dc3009106d97dba5a034166020e8279cd7d67aa2f5a614824
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8405.exeFilesize
294KB
MD5c873e7d61065a74e82ccfff6e6795ec8
SHA1b8b6dddeb840d25b347aec259a6d446e486b780b
SHA256ed153419afb6b863171a17607adb3e902123635dd342012b0eee25a4573ed841
SHA512df65005263805e78bd2d4a52be13207e9cf41998874b3f853c30dad754416fc4f9485fe7ab18e01dc3009106d97dba5a034166020e8279cd7d67aa2f5a614824
-
memory/2272-1123-0x00000000056D0000-0x00000000056E0000-memory.dmpFilesize
64KB
-
memory/2272-1122-0x0000000000A90000-0x0000000000AC2000-memory.dmpFilesize
200KB
-
memory/3736-1102-0x00000000059E0000-0x0000000005AEA000-memory.dmpFilesize
1.0MB
-
memory/3736-1104-0x00000000028C0000-0x00000000028FC000-memory.dmpFilesize
240KB
-
memory/3736-1116-0x0000000006FC0000-0x0000000007010000-memory.dmpFilesize
320KB
-
memory/3736-1115-0x0000000006F30000-0x0000000006FA6000-memory.dmpFilesize
472KB
-
memory/3736-1114-0x0000000004E00000-0x0000000004E10000-memory.dmpFilesize
64KB
-
memory/3736-1113-0x0000000004E00000-0x0000000004E10000-memory.dmpFilesize
64KB
-
memory/3736-1112-0x0000000004E00000-0x0000000004E10000-memory.dmpFilesize
64KB
-
memory/3736-1111-0x0000000004E00000-0x0000000004E10000-memory.dmpFilesize
64KB
-
memory/3736-1110-0x0000000006690000-0x0000000006BBC000-memory.dmpFilesize
5.2MB
-
memory/3736-1109-0x00000000064C0000-0x0000000006682000-memory.dmpFilesize
1.8MB
-
memory/3736-1107-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/3736-1106-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/3736-1105-0x0000000004E00000-0x0000000004E10000-memory.dmpFilesize
64KB
-
memory/3736-1103-0x00000000028A0000-0x00000000028B2000-memory.dmpFilesize
72KB
-
memory/3736-1101-0x00000000053C0000-0x00000000059D8000-memory.dmpFilesize
6.1MB
-
memory/3736-226-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/3736-228-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/3736-224-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/3736-222-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/3736-220-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/3736-218-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/3736-191-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/3736-192-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/3736-194-0x0000000000640000-0x000000000068B000-memory.dmpFilesize
300KB
-
memory/3736-196-0x0000000004E00000-0x0000000004E10000-memory.dmpFilesize
64KB
-
memory/3736-195-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/3736-198-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/3736-199-0x0000000004E00000-0x0000000004E10000-memory.dmpFilesize
64KB
-
memory/3736-201-0x0000000004E00000-0x0000000004E10000-memory.dmpFilesize
64KB
-
memory/3736-202-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/3736-204-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/3736-206-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/3736-208-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/3736-210-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/3736-212-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/3736-214-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/3736-216-0x0000000002430000-0x000000000246F000-memory.dmpFilesize
252KB
-
memory/5068-174-0x0000000002490000-0x00000000024A2000-memory.dmpFilesize
72KB
-
memory/5068-183-0x0000000004ED0000-0x0000000004EE0000-memory.dmpFilesize
64KB
-
memory/5068-153-0x0000000002490000-0x00000000024A2000-memory.dmpFilesize
72KB
-
memory/5068-184-0x0000000004ED0000-0x0000000004EE0000-memory.dmpFilesize
64KB
-
memory/5068-172-0x0000000002490000-0x00000000024A2000-memory.dmpFilesize
72KB
-
memory/5068-182-0x0000000004ED0000-0x0000000004EE0000-memory.dmpFilesize
64KB
-
memory/5068-181-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/5068-170-0x0000000002490000-0x00000000024A2000-memory.dmpFilesize
72KB
-
memory/5068-180-0x0000000002490000-0x00000000024A2000-memory.dmpFilesize
72KB
-
memory/5068-156-0x0000000002490000-0x00000000024A2000-memory.dmpFilesize
72KB
-
memory/5068-178-0x0000000002490000-0x00000000024A2000-memory.dmpFilesize
72KB
-
memory/5068-176-0x0000000002490000-0x00000000024A2000-memory.dmpFilesize
72KB
-
memory/5068-186-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/5068-154-0x0000000002490000-0x00000000024A2000-memory.dmpFilesize
72KB
-
memory/5068-152-0x0000000004ED0000-0x0000000004EE0000-memory.dmpFilesize
64KB
-
memory/5068-168-0x0000000002490000-0x00000000024A2000-memory.dmpFilesize
72KB
-
memory/5068-166-0x0000000002490000-0x00000000024A2000-memory.dmpFilesize
72KB
-
memory/5068-164-0x0000000002490000-0x00000000024A2000-memory.dmpFilesize
72KB
-
memory/5068-162-0x0000000002490000-0x00000000024A2000-memory.dmpFilesize
72KB
-
memory/5068-160-0x0000000002490000-0x00000000024A2000-memory.dmpFilesize
72KB
-
memory/5068-158-0x0000000002490000-0x00000000024A2000-memory.dmpFilesize
72KB
-
memory/5068-151-0x0000000004ED0000-0x0000000004EE0000-memory.dmpFilesize
64KB
-
memory/5068-150-0x0000000004EE0000-0x0000000005484000-memory.dmpFilesize
5.6MB
-
memory/5068-149-0x0000000004ED0000-0x0000000004EE0000-memory.dmpFilesize
64KB
-
memory/5068-148-0x0000000000620000-0x000000000064D000-memory.dmpFilesize
180KB