Analysis
-
max time kernel
84s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 20:11
Static task
static1
Behavioral task
behavioral1
Sample
bd17c25a6a6eb64ddfeca61617a756a56e4afb0e2c7f4148b96ecd33c0200042.exe
Resource
win10v2004-20230220-en
General
-
Target
bd17c25a6a6eb64ddfeca61617a756a56e4afb0e2c7f4148b96ecd33c0200042.exe
-
Size
522KB
-
MD5
2b5b436422b4808979b7cc76842260f4
-
SHA1
a214f50e592dc000e5ba19697ed8cfcb4529ba32
-
SHA256
bd17c25a6a6eb64ddfeca61617a756a56e4afb0e2c7f4148b96ecd33c0200042
-
SHA512
dfab438be05b892e81b7400dccd981f34da208014629509a91b62011d4af9326d4ec329b203fe533a180b72b94f51d9cc8a9827f43e4fe766c7313783477d389
-
SSDEEP
12288:qMrHy90djC77ZF0XX6OkYAD28Cp4DuzWrcpgGWaFdrro:1yK2XL0nOCCD3uWaFd/o
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr123556.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr123556.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr123556.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr123556.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr123556.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr123556.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr123556.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/2156-158-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2156-159-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2156-161-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2156-163-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2156-165-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2156-167-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2156-169-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2156-171-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2156-173-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2156-175-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2156-177-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2156-179-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2156-181-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2156-185-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2156-183-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2156-187-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2156-189-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2156-191-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2156-193-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2156-195-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2156-197-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2156-199-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2156-201-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2156-203-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2156-205-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2156-207-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2156-209-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2156-211-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2156-213-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2156-215-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2156-217-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2156-219-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/2156-221-0x0000000002710000-0x000000000274F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
ziVa3944.exejr123556.exeku208211.exelr021472.exepid process 3352 ziVa3944.exe 4204 jr123556.exe 2156 ku208211.exe 4784 lr021472.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr123556.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr123556.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
bd17c25a6a6eb64ddfeca61617a756a56e4afb0e2c7f4148b96ecd33c0200042.exeziVa3944.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce bd17c25a6a6eb64ddfeca61617a756a56e4afb0e2c7f4148b96ecd33c0200042.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" bd17c25a6a6eb64ddfeca61617a756a56e4afb0e2c7f4148b96ecd33c0200042.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziVa3944.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziVa3944.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 5068 2156 WerFault.exe ku208211.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr123556.exeku208211.exelr021472.exepid process 4204 jr123556.exe 4204 jr123556.exe 2156 ku208211.exe 2156 ku208211.exe 4784 lr021472.exe 4784 lr021472.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr123556.exeku208211.exelr021472.exedescription pid process Token: SeDebugPrivilege 4204 jr123556.exe Token: SeDebugPrivilege 2156 ku208211.exe Token: SeDebugPrivilege 4784 lr021472.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
bd17c25a6a6eb64ddfeca61617a756a56e4afb0e2c7f4148b96ecd33c0200042.exeziVa3944.exedescription pid process target process PID 1920 wrote to memory of 3352 1920 bd17c25a6a6eb64ddfeca61617a756a56e4afb0e2c7f4148b96ecd33c0200042.exe ziVa3944.exe PID 1920 wrote to memory of 3352 1920 bd17c25a6a6eb64ddfeca61617a756a56e4afb0e2c7f4148b96ecd33c0200042.exe ziVa3944.exe PID 1920 wrote to memory of 3352 1920 bd17c25a6a6eb64ddfeca61617a756a56e4afb0e2c7f4148b96ecd33c0200042.exe ziVa3944.exe PID 3352 wrote to memory of 4204 3352 ziVa3944.exe jr123556.exe PID 3352 wrote to memory of 4204 3352 ziVa3944.exe jr123556.exe PID 3352 wrote to memory of 2156 3352 ziVa3944.exe ku208211.exe PID 3352 wrote to memory of 2156 3352 ziVa3944.exe ku208211.exe PID 3352 wrote to memory of 2156 3352 ziVa3944.exe ku208211.exe PID 1920 wrote to memory of 4784 1920 bd17c25a6a6eb64ddfeca61617a756a56e4afb0e2c7f4148b96ecd33c0200042.exe lr021472.exe PID 1920 wrote to memory of 4784 1920 bd17c25a6a6eb64ddfeca61617a756a56e4afb0e2c7f4148b96ecd33c0200042.exe lr021472.exe PID 1920 wrote to memory of 4784 1920 bd17c25a6a6eb64ddfeca61617a756a56e4afb0e2c7f4148b96ecd33c0200042.exe lr021472.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd17c25a6a6eb64ddfeca61617a756a56e4afb0e2c7f4148b96ecd33c0200042.exe"C:\Users\Admin\AppData\Local\Temp\bd17c25a6a6eb64ddfeca61617a756a56e4afb0e2c7f4148b96ecd33c0200042.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziVa3944.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziVa3944.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr123556.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr123556.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku208211.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku208211.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 13284⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr021472.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr021472.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2156 -ip 21561⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr021472.exeFilesize
175KB
MD5b3826e545279ebbd30cc5bbb3a9fd3f0
SHA1e4f8f631d3c5420891f942ccf798b970098898cc
SHA256362e82759fb1597bd3e504e9348ea1883bb89427411212abe1c90853d597601c
SHA5120075cbbac983e501fec61694d10f7f7572f0fc63ab4964812d5bb8f5a4182f0d700ecb75641846c330ffa3d26be67a0fd858d561aa2bdd7ba53a6c09bb6fa633
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr021472.exeFilesize
175KB
MD5b3826e545279ebbd30cc5bbb3a9fd3f0
SHA1e4f8f631d3c5420891f942ccf798b970098898cc
SHA256362e82759fb1597bd3e504e9348ea1883bb89427411212abe1c90853d597601c
SHA5120075cbbac983e501fec61694d10f7f7572f0fc63ab4964812d5bb8f5a4182f0d700ecb75641846c330ffa3d26be67a0fd858d561aa2bdd7ba53a6c09bb6fa633
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziVa3944.exeFilesize
379KB
MD570f788fae4cc1a8f2e95e34c51fef71b
SHA12a80241219240fa85f4f5091820f698ee74d89d4
SHA2567a2f104c38d058e136f3bdcab2275828fd26b750686779483ef660148351546d
SHA5121f3eab8c7ae8df081e86ef8ffacf4691b0b28dd7aa0576380b53e75574192098aafb13ed65bef29a90a8c4c7a5953213b80ec1b676921fbf75abf4d3ea964363
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziVa3944.exeFilesize
379KB
MD570f788fae4cc1a8f2e95e34c51fef71b
SHA12a80241219240fa85f4f5091820f698ee74d89d4
SHA2567a2f104c38d058e136f3bdcab2275828fd26b750686779483ef660148351546d
SHA5121f3eab8c7ae8df081e86ef8ffacf4691b0b28dd7aa0576380b53e75574192098aafb13ed65bef29a90a8c4c7a5953213b80ec1b676921fbf75abf4d3ea964363
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr123556.exeFilesize
15KB
MD5dd19df0fa2c6be685585c8f908cfa9d1
SHA1b84a08bb12c8b9002974547120f7f3abc37fea7e
SHA256870c8e524f40c5b5ad5eca9a0594f3c1e6119a4ef12f510f5b7dbe168031c502
SHA512ae9cbd7a0d0dc12cfa6ddd9fd6b25d0332fda5ae52525ab93ec05b5fb3ffcd564e789698186a074d00d69ee63dda1989d9524bd98e0cbd439b7ae42a1827717f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr123556.exeFilesize
15KB
MD5dd19df0fa2c6be685585c8f908cfa9d1
SHA1b84a08bb12c8b9002974547120f7f3abc37fea7e
SHA256870c8e524f40c5b5ad5eca9a0594f3c1e6119a4ef12f510f5b7dbe168031c502
SHA512ae9cbd7a0d0dc12cfa6ddd9fd6b25d0332fda5ae52525ab93ec05b5fb3ffcd564e789698186a074d00d69ee63dda1989d9524bd98e0cbd439b7ae42a1827717f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku208211.exeFilesize
294KB
MD5be464c27cc7359d963e28a421d30c6b7
SHA145e33aa793d50490bc33eb04fd93ac1a4c9c479f
SHA256bf6c9bf445b91955730cd4f9fe2b361e6511f918c9a6974120a98e084195cfbe
SHA5126a2cecf719efe7d92e5616cb5f580acc12a2f4cee0d116cae3efe976e6dedef0a4f67706f382710b37a0674f9b3a382431c14d1d840b38bb4719818bcfd49c92
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku208211.exeFilesize
294KB
MD5be464c27cc7359d963e28a421d30c6b7
SHA145e33aa793d50490bc33eb04fd93ac1a4c9c479f
SHA256bf6c9bf445b91955730cd4f9fe2b361e6511f918c9a6974120a98e084195cfbe
SHA5126a2cecf719efe7d92e5616cb5f580acc12a2f4cee0d116cae3efe976e6dedef0a4f67706f382710b37a0674f9b3a382431c14d1d840b38bb4719818bcfd49c92
-
memory/2156-153-0x0000000004B10000-0x00000000050B4000-memory.dmpFilesize
5.6MB
-
memory/2156-154-0x0000000002170000-0x00000000021BB000-memory.dmpFilesize
300KB
-
memory/2156-155-0x00000000025D0000-0x00000000025E0000-memory.dmpFilesize
64KB
-
memory/2156-156-0x00000000025D0000-0x00000000025E0000-memory.dmpFilesize
64KB
-
memory/2156-158-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2156-157-0x00000000025D0000-0x00000000025E0000-memory.dmpFilesize
64KB
-
memory/2156-159-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2156-161-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2156-163-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2156-165-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2156-167-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2156-169-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2156-171-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2156-173-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2156-175-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2156-177-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2156-179-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2156-181-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2156-185-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2156-183-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2156-187-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2156-189-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2156-191-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2156-193-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2156-195-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2156-197-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2156-199-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2156-201-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2156-203-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2156-205-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2156-207-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2156-209-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2156-211-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2156-213-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2156-215-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2156-217-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2156-219-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2156-221-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/2156-1064-0x00000000050C0000-0x00000000056D8000-memory.dmpFilesize
6.1MB
-
memory/2156-1065-0x0000000005760000-0x000000000586A000-memory.dmpFilesize
1.0MB
-
memory/2156-1066-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/2156-1067-0x00000000058C0000-0x00000000058FC000-memory.dmpFilesize
240KB
-
memory/2156-1068-0x00000000025D0000-0x00000000025E0000-memory.dmpFilesize
64KB
-
memory/2156-1070-0x0000000005BB0000-0x0000000005C16000-memory.dmpFilesize
408KB
-
memory/2156-1071-0x0000000006370000-0x0000000006402000-memory.dmpFilesize
584KB
-
memory/2156-1072-0x00000000025D0000-0x00000000025E0000-memory.dmpFilesize
64KB
-
memory/2156-1073-0x00000000025D0000-0x00000000025E0000-memory.dmpFilesize
64KB
-
memory/2156-1074-0x00000000025D0000-0x00000000025E0000-memory.dmpFilesize
64KB
-
memory/2156-1075-0x0000000006460000-0x00000000064D6000-memory.dmpFilesize
472KB
-
memory/2156-1076-0x00000000064E0000-0x0000000006530000-memory.dmpFilesize
320KB
-
memory/2156-1077-0x00000000068A0000-0x0000000006A62000-memory.dmpFilesize
1.8MB
-
memory/2156-1078-0x0000000006A70000-0x0000000006F9C000-memory.dmpFilesize
5.2MB
-
memory/2156-1079-0x00000000025D0000-0x00000000025E0000-memory.dmpFilesize
64KB
-
memory/4204-147-0x0000000000130000-0x000000000013A000-memory.dmpFilesize
40KB
-
memory/4784-1085-0x0000000000210000-0x0000000000242000-memory.dmpFilesize
200KB
-
memory/4784-1086-0x0000000004B10000-0x0000000004B20000-memory.dmpFilesize
64KB
-
memory/4784-1087-0x0000000004B10000-0x0000000004B20000-memory.dmpFilesize
64KB