Analysis
-
max time kernel
91s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 21:13
Static task
static1
Behavioral task
behavioral1
Sample
0b345e4b716f695b6f654acfa373a2993bf50be5c4cccae3815e93f5316021ed.exe
Resource
win10v2004-20230220-en
General
-
Target
0b345e4b716f695b6f654acfa373a2993bf50be5c4cccae3815e93f5316021ed.exe
-
Size
658KB
-
MD5
2b5fa13c61bd3e2b8b7a4a1f215cce9c
-
SHA1
f86df5048e65e37382e1e1c9468a6cf4ec97ce26
-
SHA256
0b345e4b716f695b6f654acfa373a2993bf50be5c4cccae3815e93f5316021ed
-
SHA512
5600b48524dd703cc8ccf0719650b3431c0c10c0738b630aa2980d90fcd4550e6b3a7d27b9034cc7f70915ec35b7cb7bf5c304d7b88ed3cd337ecc26d15353af
-
SSDEEP
12288:bMrPy90P8AEM7WbcehNoeVRUtqslQWApyJ84c446zWKjr8v9K:cyMVECesAUtvWWApyS494DKt
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro9038.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro9038.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro9038.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro9038.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro9038.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro9038.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro9038.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/1144-191-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/1144-192-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/1144-194-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/1144-196-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/1144-198-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/1144-200-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/1144-202-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/1144-204-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/1144-206-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/1144-208-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/1144-210-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/1144-212-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/1144-214-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/1144-216-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/1144-218-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/1144-220-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/1144-222-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline behavioral1/memory/1144-224-0x0000000005090000-0x00000000050CF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un815156.exepro9038.exequ0307.exesi301838.exepid process 4608 un815156.exe 2968 pro9038.exe 1144 qu0307.exe 1080 si301838.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro9038.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro9038.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro9038.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
0b345e4b716f695b6f654acfa373a2993bf50be5c4cccae3815e93f5316021ed.exeun815156.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 0b345e4b716f695b6f654acfa373a2993bf50be5c4cccae3815e93f5316021ed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 0b345e4b716f695b6f654acfa373a2993bf50be5c4cccae3815e93f5316021ed.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un815156.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un815156.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1008 2968 WerFault.exe pro9038.exe 4624 1144 WerFault.exe qu0307.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro9038.exequ0307.exesi301838.exepid process 2968 pro9038.exe 2968 pro9038.exe 1144 qu0307.exe 1144 qu0307.exe 1080 si301838.exe 1080 si301838.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro9038.exequ0307.exesi301838.exedescription pid process Token: SeDebugPrivilege 2968 pro9038.exe Token: SeDebugPrivilege 1144 qu0307.exe Token: SeDebugPrivilege 1080 si301838.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
0b345e4b716f695b6f654acfa373a2993bf50be5c4cccae3815e93f5316021ed.exeun815156.exedescription pid process target process PID 1072 wrote to memory of 4608 1072 0b345e4b716f695b6f654acfa373a2993bf50be5c4cccae3815e93f5316021ed.exe un815156.exe PID 1072 wrote to memory of 4608 1072 0b345e4b716f695b6f654acfa373a2993bf50be5c4cccae3815e93f5316021ed.exe un815156.exe PID 1072 wrote to memory of 4608 1072 0b345e4b716f695b6f654acfa373a2993bf50be5c4cccae3815e93f5316021ed.exe un815156.exe PID 4608 wrote to memory of 2968 4608 un815156.exe pro9038.exe PID 4608 wrote to memory of 2968 4608 un815156.exe pro9038.exe PID 4608 wrote to memory of 2968 4608 un815156.exe pro9038.exe PID 4608 wrote to memory of 1144 4608 un815156.exe qu0307.exe PID 4608 wrote to memory of 1144 4608 un815156.exe qu0307.exe PID 4608 wrote to memory of 1144 4608 un815156.exe qu0307.exe PID 1072 wrote to memory of 1080 1072 0b345e4b716f695b6f654acfa373a2993bf50be5c4cccae3815e93f5316021ed.exe si301838.exe PID 1072 wrote to memory of 1080 1072 0b345e4b716f695b6f654acfa373a2993bf50be5c4cccae3815e93f5316021ed.exe si301838.exe PID 1072 wrote to memory of 1080 1072 0b345e4b716f695b6f654acfa373a2993bf50be5c4cccae3815e93f5316021ed.exe si301838.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b345e4b716f695b6f654acfa373a2993bf50be5c4cccae3815e93f5316021ed.exe"C:\Users\Admin\AppData\Local\Temp\0b345e4b716f695b6f654acfa373a2993bf50be5c4cccae3815e93f5316021ed.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un815156.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un815156.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9038.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9038.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 10644⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0307.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0307.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1144 -s 13284⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si301838.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si301838.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2968 -ip 29681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1144 -ip 11441⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si301838.exeFilesize
175KB
MD51b32d74b7adef863641c2250852a5add
SHA17cf3214e573ea4e87c683609c9b97eef5246ad76
SHA256adf39b838f1fc242c9e73f03d4bce6a3f9d9c3285590f8e16ba556933904da50
SHA512fc9073e9a9ac98f2f3a3e8e556fb5c4b77705d3346559860c44411a578f43561eeda8026d80121cafa61745dd7f791bdff5438ff261cb5525388170e42593a51
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si301838.exeFilesize
175KB
MD51b32d74b7adef863641c2250852a5add
SHA17cf3214e573ea4e87c683609c9b97eef5246ad76
SHA256adf39b838f1fc242c9e73f03d4bce6a3f9d9c3285590f8e16ba556933904da50
SHA512fc9073e9a9ac98f2f3a3e8e556fb5c4b77705d3346559860c44411a578f43561eeda8026d80121cafa61745dd7f791bdff5438ff261cb5525388170e42593a51
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un815156.exeFilesize
516KB
MD5dcbbce04cc9cbdd2b794f57581ae2a15
SHA1fd28f90ac6a841ce8735e8b79419090d3d1ae6e5
SHA25642d8c8f6696db093ebda3d34ec933810a2641b3200d7ea214ddc1c7c28a7f1d2
SHA512891b0aa5e8fbb4a584c538c642540867fcd1621cedaa6a8afebf95c0837fb68e8c94314e027c8f309a0615fd7ce3c67556875702c3a132ed3a6180902dd5d7b7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un815156.exeFilesize
516KB
MD5dcbbce04cc9cbdd2b794f57581ae2a15
SHA1fd28f90ac6a841ce8735e8b79419090d3d1ae6e5
SHA25642d8c8f6696db093ebda3d34ec933810a2641b3200d7ea214ddc1c7c28a7f1d2
SHA512891b0aa5e8fbb4a584c538c642540867fcd1621cedaa6a8afebf95c0837fb68e8c94314e027c8f309a0615fd7ce3c67556875702c3a132ed3a6180902dd5d7b7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9038.exeFilesize
235KB
MD5202c1f894c6a6374413084e95c76e149
SHA1d63ced22e0f4052a374e7d594ffd135b6d31bfcb
SHA2560c712142b0a4b0568bb11def32cee41caac7de89e92a2c2600bd87b47dca4a7b
SHA512bfe39a20b85cecd24002e537f21c4290587fc70729723ab4f497c7c2bd48ca7009cf21d62652e13eec3e24ce60f35f563133da412456dbb9effac32fa80bf157
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9038.exeFilesize
235KB
MD5202c1f894c6a6374413084e95c76e149
SHA1d63ced22e0f4052a374e7d594ffd135b6d31bfcb
SHA2560c712142b0a4b0568bb11def32cee41caac7de89e92a2c2600bd87b47dca4a7b
SHA512bfe39a20b85cecd24002e537f21c4290587fc70729723ab4f497c7c2bd48ca7009cf21d62652e13eec3e24ce60f35f563133da412456dbb9effac32fa80bf157
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0307.exeFilesize
294KB
MD50c66d59cf9ff0189cfda171119e999bb
SHA1c5c9225315f47c419e567a8700f31f574e4bf372
SHA256e0868cae5a2a61952520106293467f19e4f0dc66ceb24fc85900ba5cb8a59c9d
SHA51275a39ba23291d79cb17139c16646b4e7b0d1b8df9f915b269a1a9428bd9e122d5dbc41cd860ffbeb20d047da5282fcc1b064e35e10f5c98b303ac4f70f1d5696
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0307.exeFilesize
294KB
MD50c66d59cf9ff0189cfda171119e999bb
SHA1c5c9225315f47c419e567a8700f31f574e4bf372
SHA256e0868cae5a2a61952520106293467f19e4f0dc66ceb24fc85900ba5cb8a59c9d
SHA51275a39ba23291d79cb17139c16646b4e7b0d1b8df9f915b269a1a9428bd9e122d5dbc41cd860ffbeb20d047da5282fcc1b064e35e10f5c98b303ac4f70f1d5696
-
memory/1080-1123-0x0000000004EE0000-0x0000000004EF0000-memory.dmpFilesize
64KB
-
memory/1080-1122-0x00000000002F0000-0x0000000000322000-memory.dmpFilesize
200KB
-
memory/1144-1102-0x0000000005760000-0x000000000586A000-memory.dmpFilesize
1.0MB
-
memory/1144-1104-0x00000000058C0000-0x00000000058FC000-memory.dmpFilesize
240KB
-
memory/1144-1116-0x0000000002580000-0x0000000002590000-memory.dmpFilesize
64KB
-
memory/1144-1115-0x0000000006E80000-0x0000000006ED0000-memory.dmpFilesize
320KB
-
memory/1144-1114-0x0000000006E00000-0x0000000006E76000-memory.dmpFilesize
472KB
-
memory/1144-1113-0x0000000006790000-0x0000000006CBC000-memory.dmpFilesize
5.2MB
-
memory/1144-1112-0x00000000065B0000-0x0000000006772000-memory.dmpFilesize
1.8MB
-
memory/1144-1111-0x0000000002580000-0x0000000002590000-memory.dmpFilesize
64KB
-
memory/1144-1110-0x0000000002580000-0x0000000002590000-memory.dmpFilesize
64KB
-
memory/1144-1109-0x0000000002580000-0x0000000002590000-memory.dmpFilesize
64KB
-
memory/1144-1108-0x0000000006280000-0x0000000006312000-memory.dmpFilesize
584KB
-
memory/1144-1106-0x0000000005BB0000-0x0000000005C16000-memory.dmpFilesize
408KB
-
memory/1144-1105-0x0000000002580000-0x0000000002590000-memory.dmpFilesize
64KB
-
memory/1144-1103-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/1144-1101-0x00000000050D0000-0x00000000056E8000-memory.dmpFilesize
6.1MB
-
memory/1144-238-0x0000000002580000-0x0000000002590000-memory.dmpFilesize
64KB
-
memory/1144-236-0x0000000002580000-0x0000000002590000-memory.dmpFilesize
64KB
-
memory/1144-233-0x0000000000550000-0x000000000059B000-memory.dmpFilesize
300KB
-
memory/1144-234-0x0000000002580000-0x0000000002590000-memory.dmpFilesize
64KB
-
memory/1144-224-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/1144-222-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/1144-191-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/1144-192-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/1144-194-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/1144-196-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/1144-198-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/1144-200-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/1144-202-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/1144-204-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/1144-206-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/1144-208-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/1144-210-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/1144-212-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/1144-214-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/1144-216-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/1144-218-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/1144-220-0x0000000005090000-0x00000000050CF000-memory.dmpFilesize
252KB
-
memory/2968-177-0x00000000023E0000-0x00000000023F2000-memory.dmpFilesize
72KB
-
memory/2968-184-0x0000000004AB0000-0x0000000004AC0000-memory.dmpFilesize
64KB
-
memory/2968-155-0x00000000023E0000-0x00000000023F2000-memory.dmpFilesize
72KB
-
memory/2968-185-0x0000000004AB0000-0x0000000004AC0000-memory.dmpFilesize
64KB
-
memory/2968-175-0x00000000023E0000-0x00000000023F2000-memory.dmpFilesize
72KB
-
memory/2968-183-0x0000000004AB0000-0x0000000004AC0000-memory.dmpFilesize
64KB
-
memory/2968-181-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2968-173-0x00000000023E0000-0x00000000023F2000-memory.dmpFilesize
72KB
-
memory/2968-180-0x0000000004AB0000-0x0000000004AC0000-memory.dmpFilesize
64KB
-
memory/2968-159-0x00000000023E0000-0x00000000023F2000-memory.dmpFilesize
72KB
-
memory/2968-179-0x0000000004AB0000-0x0000000004AC0000-memory.dmpFilesize
64KB
-
memory/2968-178-0x0000000004AB0000-0x0000000004AC0000-memory.dmpFilesize
64KB
-
memory/2968-186-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2968-157-0x00000000023E0000-0x00000000023F2000-memory.dmpFilesize
72KB
-
memory/2968-153-0x00000000023E0000-0x00000000023F2000-memory.dmpFilesize
72KB
-
memory/2968-171-0x00000000023E0000-0x00000000023F2000-memory.dmpFilesize
72KB
-
memory/2968-169-0x00000000023E0000-0x00000000023F2000-memory.dmpFilesize
72KB
-
memory/2968-167-0x00000000023E0000-0x00000000023F2000-memory.dmpFilesize
72KB
-
memory/2968-165-0x00000000023E0000-0x00000000023F2000-memory.dmpFilesize
72KB
-
memory/2968-161-0x00000000023E0000-0x00000000023F2000-memory.dmpFilesize
72KB
-
memory/2968-163-0x00000000023E0000-0x00000000023F2000-memory.dmpFilesize
72KB
-
memory/2968-151-0x00000000023E0000-0x00000000023F2000-memory.dmpFilesize
72KB
-
memory/2968-150-0x00000000023E0000-0x00000000023F2000-memory.dmpFilesize
72KB
-
memory/2968-149-0x0000000004AC0000-0x0000000005064000-memory.dmpFilesize
5.6MB
-
memory/2968-148-0x0000000000620000-0x000000000064D000-memory.dmpFilesize
180KB