Analysis
-
max time kernel
53s -
max time network
74s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
03-04-2023 21:12
Static task
static1
Behavioral task
behavioral1
Sample
57802be7c4e561416251a0333b282169002e5e19ffaf2a8bb4f71e57ee8770cd.exe
Resource
win10-20230220-en
General
-
Target
57802be7c4e561416251a0333b282169002e5e19ffaf2a8bb4f71e57ee8770cd.exe
-
Size
657KB
-
MD5
a5bc95b50df3c19101fe4cdc1af045ab
-
SHA1
eac3b71c1722fcdbf4a3c12c74db92f34fe0f628
-
SHA256
57802be7c4e561416251a0333b282169002e5e19ffaf2a8bb4f71e57ee8770cd
-
SHA512
153a5f34227976d61a8191283b24f624beefb23513104437a8f85cfc2f30164e8fd41730e9f8379b5bc108c763eeeae25d973ff162d8bb18f28dbef1c7a06d88
-
SSDEEP
12288:nMrny90QGMecNuQgsRh97tG5g9peVAUNLt8+5iqy/44czWKLr8v2r:IypGDl09tl7wAUNhTxyg4VKr
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro5439.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro5439.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro5439.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro5439.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro5439.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro5439.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/1388-180-0x00000000022F0000-0x0000000002336000-memory.dmp family_redline behavioral1/memory/1388-181-0x0000000004A40000-0x0000000004A84000-memory.dmp family_redline behavioral1/memory/1388-185-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/1388-187-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/1388-189-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/1388-191-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/1388-193-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/1388-195-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/1388-197-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/1388-199-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/1388-201-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/1388-203-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/1388-205-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/1388-207-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/1388-209-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/1388-211-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/1388-213-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/1388-215-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/1388-217-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/1388-219-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un655366.exepro5439.exequ5416.exesi503101.exepid process 4188 un655366.exe 2188 pro5439.exe 1388 qu5416.exe 1296 si503101.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro5439.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro5439.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro5439.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
57802be7c4e561416251a0333b282169002e5e19ffaf2a8bb4f71e57ee8770cd.exeun655366.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 57802be7c4e561416251a0333b282169002e5e19ffaf2a8bb4f71e57ee8770cd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 57802be7c4e561416251a0333b282169002e5e19ffaf2a8bb4f71e57ee8770cd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un655366.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un655366.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro5439.exequ5416.exesi503101.exepid process 2188 pro5439.exe 2188 pro5439.exe 1388 qu5416.exe 1388 qu5416.exe 1296 si503101.exe 1296 si503101.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro5439.exequ5416.exesi503101.exedescription pid process Token: SeDebugPrivilege 2188 pro5439.exe Token: SeDebugPrivilege 1388 qu5416.exe Token: SeDebugPrivilege 1296 si503101.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
57802be7c4e561416251a0333b282169002e5e19ffaf2a8bb4f71e57ee8770cd.exeun655366.exedescription pid process target process PID 4768 wrote to memory of 4188 4768 57802be7c4e561416251a0333b282169002e5e19ffaf2a8bb4f71e57ee8770cd.exe un655366.exe PID 4768 wrote to memory of 4188 4768 57802be7c4e561416251a0333b282169002e5e19ffaf2a8bb4f71e57ee8770cd.exe un655366.exe PID 4768 wrote to memory of 4188 4768 57802be7c4e561416251a0333b282169002e5e19ffaf2a8bb4f71e57ee8770cd.exe un655366.exe PID 4188 wrote to memory of 2188 4188 un655366.exe pro5439.exe PID 4188 wrote to memory of 2188 4188 un655366.exe pro5439.exe PID 4188 wrote to memory of 2188 4188 un655366.exe pro5439.exe PID 4188 wrote to memory of 1388 4188 un655366.exe qu5416.exe PID 4188 wrote to memory of 1388 4188 un655366.exe qu5416.exe PID 4188 wrote to memory of 1388 4188 un655366.exe qu5416.exe PID 4768 wrote to memory of 1296 4768 57802be7c4e561416251a0333b282169002e5e19ffaf2a8bb4f71e57ee8770cd.exe si503101.exe PID 4768 wrote to memory of 1296 4768 57802be7c4e561416251a0333b282169002e5e19ffaf2a8bb4f71e57ee8770cd.exe si503101.exe PID 4768 wrote to memory of 1296 4768 57802be7c4e561416251a0333b282169002e5e19ffaf2a8bb4f71e57ee8770cd.exe si503101.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\57802be7c4e561416251a0333b282169002e5e19ffaf2a8bb4f71e57ee8770cd.exe"C:\Users\Admin\AppData\Local\Temp\57802be7c4e561416251a0333b282169002e5e19ffaf2a8bb4f71e57ee8770cd.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un655366.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un655366.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5439.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5439.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5416.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5416.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si503101.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si503101.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si503101.exeFilesize
175KB
MD5fcefc286bafed64b722f4b8489cb374a
SHA1bfcb770d93295975805235f94105af52f0e989ae
SHA256a0dff83f81c9f68bac7f39aea0225a199bb4c4b31abe59931d2900fcd31c7a5d
SHA51250a787079a4e98fbdc79e9fc54ad2633281d373751eecdc102616cdb1f820253d87b16a42427367fc852b4e91dba9de85095de4b22e7be243e1267115544db54
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si503101.exeFilesize
175KB
MD5fcefc286bafed64b722f4b8489cb374a
SHA1bfcb770d93295975805235f94105af52f0e989ae
SHA256a0dff83f81c9f68bac7f39aea0225a199bb4c4b31abe59931d2900fcd31c7a5d
SHA51250a787079a4e98fbdc79e9fc54ad2633281d373751eecdc102616cdb1f820253d87b16a42427367fc852b4e91dba9de85095de4b22e7be243e1267115544db54
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un655366.exeFilesize
516KB
MD5611ddba214d41cd218ad68f93ea11389
SHA1623b80c9b696745d9dae86292035ab865c67b6dc
SHA2564a969ba6c1480074c4e349c2fb3452c78ef89e057317eb9da5b8d10444d846da
SHA5126016fc582d475077d39d186853c72b8b1172c68b5e7aa3741ca15dc3dc42fc84457884113dae2dd627a01fccd5d9c5e8d54956dfc57e28ffb0a7611e17ed1f76
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un655366.exeFilesize
516KB
MD5611ddba214d41cd218ad68f93ea11389
SHA1623b80c9b696745d9dae86292035ab865c67b6dc
SHA2564a969ba6c1480074c4e349c2fb3452c78ef89e057317eb9da5b8d10444d846da
SHA5126016fc582d475077d39d186853c72b8b1172c68b5e7aa3741ca15dc3dc42fc84457884113dae2dd627a01fccd5d9c5e8d54956dfc57e28ffb0a7611e17ed1f76
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5439.exeFilesize
235KB
MD5b6359c7510e54dd6649a99e931e39b3d
SHA1f75acc938db7fa5846dc9d9b188efc8691eee0a0
SHA25692528074ec64f504fb03278ba2048ef6a4403868d447de782af46786a88a5eac
SHA512c82ecb9c74ab8e7d65dad7a625c78e3db4a74418f0e49d0659afb2f1034b1441bd47a331d8eed30e758251ed87d2f1a7e42f909515740f43784caa5b1de3fcf7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5439.exeFilesize
235KB
MD5b6359c7510e54dd6649a99e931e39b3d
SHA1f75acc938db7fa5846dc9d9b188efc8691eee0a0
SHA25692528074ec64f504fb03278ba2048ef6a4403868d447de782af46786a88a5eac
SHA512c82ecb9c74ab8e7d65dad7a625c78e3db4a74418f0e49d0659afb2f1034b1441bd47a331d8eed30e758251ed87d2f1a7e42f909515740f43784caa5b1de3fcf7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5416.exeFilesize
294KB
MD5da57431b127eda412d6bf202c7cffbac
SHA1ca0ca9b55713ab17f680d871a34141ed785d539b
SHA2569ba336b9f27da5476f9ca22a00f94845c8433de4bccf13f053f5d5b6796f0b5b
SHA512003a663712f501480a6d599e304f2ceacd1c5924ce1252e7eadb7dcf04b892ab34dfbe185b3b5fc68e67e406eaec38655c353738140296eab864f2127cbbc8ff
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5416.exeFilesize
294KB
MD5da57431b127eda412d6bf202c7cffbac
SHA1ca0ca9b55713ab17f680d871a34141ed785d539b
SHA2569ba336b9f27da5476f9ca22a00f94845c8433de4bccf13f053f5d5b6796f0b5b
SHA512003a663712f501480a6d599e304f2ceacd1c5924ce1252e7eadb7dcf04b892ab34dfbe185b3b5fc68e67e406eaec38655c353738140296eab864f2127cbbc8ff
-
memory/1296-1116-0x0000000005230000-0x0000000005240000-memory.dmpFilesize
64KB
-
memory/1296-1115-0x0000000005100000-0x000000000514B000-memory.dmpFilesize
300KB
-
memory/1296-1114-0x00000000006C0000-0x00000000006F2000-memory.dmpFilesize
200KB
-
memory/1388-1092-0x0000000005130000-0x0000000005736000-memory.dmpFilesize
6.0MB
-
memory/1388-1095-0x0000000005900000-0x000000000593E000-memory.dmpFilesize
248KB
-
memory/1388-1108-0x0000000004B20000-0x0000000004B30000-memory.dmpFilesize
64KB
-
memory/1388-1107-0x0000000006890000-0x0000000006DBC000-memory.dmpFilesize
5.2MB
-
memory/1388-1106-0x00000000066C0000-0x0000000006882000-memory.dmpFilesize
1.8MB
-
memory/1388-1105-0x0000000006660000-0x00000000066B0000-memory.dmpFilesize
320KB
-
memory/1388-1104-0x00000000065E0000-0x0000000006656000-memory.dmpFilesize
472KB
-
memory/1388-1103-0x0000000004B20000-0x0000000004B30000-memory.dmpFilesize
64KB
-
memory/1388-1102-0x0000000004B20000-0x0000000004B30000-memory.dmpFilesize
64KB
-
memory/1388-1101-0x0000000004B20000-0x0000000004B30000-memory.dmpFilesize
64KB
-
memory/1388-1099-0x00000000062B0000-0x0000000006342000-memory.dmpFilesize
584KB
-
memory/1388-1098-0x0000000005BE0000-0x0000000005C46000-memory.dmpFilesize
408KB
-
memory/1388-1097-0x0000000005A50000-0x0000000005A9B000-memory.dmpFilesize
300KB
-
memory/1388-1096-0x0000000004B20000-0x0000000004B30000-memory.dmpFilesize
64KB
-
memory/1388-1094-0x00000000058E0000-0x00000000058F2000-memory.dmpFilesize
72KB
-
memory/1388-1093-0x00000000057A0000-0x00000000058AA000-memory.dmpFilesize
1.0MB
-
memory/1388-219-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/1388-217-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/1388-215-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/1388-213-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/1388-211-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/1388-209-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/1388-180-0x00000000022F0000-0x0000000002336000-memory.dmpFilesize
280KB
-
memory/1388-181-0x0000000004A40000-0x0000000004A84000-memory.dmpFilesize
272KB
-
memory/1388-182-0x0000000000590000-0x00000000005DB000-memory.dmpFilesize
300KB
-
memory/1388-184-0x0000000004B20000-0x0000000004B30000-memory.dmpFilesize
64KB
-
memory/1388-185-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/1388-187-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/1388-186-0x0000000004B20000-0x0000000004B30000-memory.dmpFilesize
64KB
-
memory/1388-183-0x0000000004B20000-0x0000000004B30000-memory.dmpFilesize
64KB
-
memory/1388-189-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/1388-191-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/1388-193-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/1388-195-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/1388-197-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/1388-199-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/1388-201-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/1388-203-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/1388-205-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/1388-207-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/2188-163-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/2188-135-0x00000000021D0000-0x00000000021EA000-memory.dmpFilesize
104KB
-
memory/2188-141-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/2188-173-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/2188-172-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/2188-171-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/2188-139-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/2188-170-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2188-169-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/2188-145-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/2188-167-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/2188-165-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/2188-175-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2188-142-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/2188-143-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/2188-157-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/2188-155-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/2188-153-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/2188-151-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/2188-149-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/2188-147-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/2188-159-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB
-
memory/2188-140-0x0000000002580000-0x0000000002598000-memory.dmpFilesize
96KB
-
memory/2188-138-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/2188-136-0x00000000001D0000-0x00000000001FD000-memory.dmpFilesize
180KB
-
memory/2188-137-0x0000000004B00000-0x0000000004FFE000-memory.dmpFilesize
5.0MB
-
memory/2188-161-0x0000000002580000-0x0000000002592000-memory.dmpFilesize
72KB