Analysis
-
max time kernel
86s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 21:12
Static task
static1
Behavioral task
behavioral1
Sample
225645e0b59891552549eae58d89b43d46700b50f5de9b5842cfd97da794af92.exe
Resource
win10v2004-20230220-en
General
-
Target
225645e0b59891552549eae58d89b43d46700b50f5de9b5842cfd97da794af92.exe
-
Size
522KB
-
MD5
dea31a31dde369a5062d5574adfb10e8
-
SHA1
d138e6645ac75a0a8be6c25d5a5c321869be29b5
-
SHA256
225645e0b59891552549eae58d89b43d46700b50f5de9b5842cfd97da794af92
-
SHA512
36fc17729b3c3ed4d21c99f089a62ea0c28d2b17d4ead471710db15312ad6a90c7db7e17edefd9af4c07bc901864fc9c4d4cce9df2d6c4ab7dce263dc4a095f2
-
SSDEEP
12288:0MrPy90gcm8nBYhpt3J0J8Sj44ozWK8zjvgniRWkr9V:TyfOvWSc4hKXMWk7
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr752778.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr752778.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr752778.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr752778.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr752778.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr752778.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr752778.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/1576-155-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/1576-158-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/1576-156-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/1576-160-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/1576-164-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/1576-162-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/1576-166-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/1576-170-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/1576-168-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/1576-172-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/1576-174-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/1576-176-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/1576-180-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/1576-183-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/1576-189-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/1576-187-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/1576-193-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/1576-191-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/1576-185-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/1576-197-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/1576-195-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/1576-201-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/1576-207-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/1576-205-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/1576-203-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/1576-199-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/1576-209-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/1576-211-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/1576-213-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/1576-215-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/1576-221-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/1576-219-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/1576-217-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
zibY1003.exejr752778.exeku705811.exelr849670.exepid process 1524 zibY1003.exe 4340 jr752778.exe 1576 ku705811.exe 3604 lr849670.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr752778.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr752778.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
225645e0b59891552549eae58d89b43d46700b50f5de9b5842cfd97da794af92.exezibY1003.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 225645e0b59891552549eae58d89b43d46700b50f5de9b5842cfd97da794af92.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 225645e0b59891552549eae58d89b43d46700b50f5de9b5842cfd97da794af92.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zibY1003.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zibY1003.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1496 1576 WerFault.exe ku705811.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr752778.exeku705811.exelr849670.exepid process 4340 jr752778.exe 4340 jr752778.exe 1576 ku705811.exe 1576 ku705811.exe 3604 lr849670.exe 3604 lr849670.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr752778.exeku705811.exelr849670.exedescription pid process Token: SeDebugPrivilege 4340 jr752778.exe Token: SeDebugPrivilege 1576 ku705811.exe Token: SeDebugPrivilege 3604 lr849670.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
225645e0b59891552549eae58d89b43d46700b50f5de9b5842cfd97da794af92.exezibY1003.exedescription pid process target process PID 3612 wrote to memory of 1524 3612 225645e0b59891552549eae58d89b43d46700b50f5de9b5842cfd97da794af92.exe zibY1003.exe PID 3612 wrote to memory of 1524 3612 225645e0b59891552549eae58d89b43d46700b50f5de9b5842cfd97da794af92.exe zibY1003.exe PID 3612 wrote to memory of 1524 3612 225645e0b59891552549eae58d89b43d46700b50f5de9b5842cfd97da794af92.exe zibY1003.exe PID 1524 wrote to memory of 4340 1524 zibY1003.exe jr752778.exe PID 1524 wrote to memory of 4340 1524 zibY1003.exe jr752778.exe PID 1524 wrote to memory of 1576 1524 zibY1003.exe ku705811.exe PID 1524 wrote to memory of 1576 1524 zibY1003.exe ku705811.exe PID 1524 wrote to memory of 1576 1524 zibY1003.exe ku705811.exe PID 3612 wrote to memory of 3604 3612 225645e0b59891552549eae58d89b43d46700b50f5de9b5842cfd97da794af92.exe lr849670.exe PID 3612 wrote to memory of 3604 3612 225645e0b59891552549eae58d89b43d46700b50f5de9b5842cfd97da794af92.exe lr849670.exe PID 3612 wrote to memory of 3604 3612 225645e0b59891552549eae58d89b43d46700b50f5de9b5842cfd97da794af92.exe lr849670.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\225645e0b59891552549eae58d89b43d46700b50f5de9b5842cfd97da794af92.exe"C:\Users\Admin\AppData\Local\Temp\225645e0b59891552549eae58d89b43d46700b50f5de9b5842cfd97da794af92.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zibY1003.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zibY1003.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr752778.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr752778.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku705811.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku705811.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 13524⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr849670.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr849670.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1576 -ip 15761⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr849670.exeFilesize
175KB
MD5fe30bb4753087a9cfa58a00b5d95467b
SHA1dd6619ccfe3d4fcc0a9731949a830ea6ea04efbd
SHA256abfdd664ee89ef6335224a8dabf52ec71a4e486a2e9ce15da9d7676febd87bb5
SHA512d97781a94081c409c6d674b63e6bcf5d1cb73aa6a104e62c872b8b05fd29e5775c826af088a578c77a7d2f713312bec2aba67dcffa77636991b526acd494eea2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr849670.exeFilesize
175KB
MD5fe30bb4753087a9cfa58a00b5d95467b
SHA1dd6619ccfe3d4fcc0a9731949a830ea6ea04efbd
SHA256abfdd664ee89ef6335224a8dabf52ec71a4e486a2e9ce15da9d7676febd87bb5
SHA512d97781a94081c409c6d674b63e6bcf5d1cb73aa6a104e62c872b8b05fd29e5775c826af088a578c77a7d2f713312bec2aba67dcffa77636991b526acd494eea2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zibY1003.exeFilesize
380KB
MD5026d710d128e40687d0ce5328285abe5
SHA157bf178cd1b7c054d402e48ec60e8b03bb0117a3
SHA25648de1e4eda8f9fc3c41291a56c4181bc32ffdf879ce3db36b2d0ac5dbb2744c5
SHA512e3c41cf0930da35c933fb1190cee203535ae92ef941eabf373e0695ae38b4140d9fa36cbde00ca83d84998b9e5ddf5d55cab7d3ed0b2b0952e10ac5dbd3d09a2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zibY1003.exeFilesize
380KB
MD5026d710d128e40687d0ce5328285abe5
SHA157bf178cd1b7c054d402e48ec60e8b03bb0117a3
SHA25648de1e4eda8f9fc3c41291a56c4181bc32ffdf879ce3db36b2d0ac5dbb2744c5
SHA512e3c41cf0930da35c933fb1190cee203535ae92ef941eabf373e0695ae38b4140d9fa36cbde00ca83d84998b9e5ddf5d55cab7d3ed0b2b0952e10ac5dbd3d09a2
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr752778.exeFilesize
15KB
MD5d22e1e305d014b6afaf3907ce13627ba
SHA1ef335a90433a5c3c2fd96882524de15e339d0518
SHA2569263e70cff30de13fd6d0d591c8bfa9da0b7eaf7825255a9c248ae6232a0f646
SHA5128d820ad48963add8f02b188c7b85b4c93eea5addf3277727ae741bfc84b44c77e13c869e1037ee7253baf14848838116b20065b78947b981cdcc4241f68c8076
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr752778.exeFilesize
15KB
MD5d22e1e305d014b6afaf3907ce13627ba
SHA1ef335a90433a5c3c2fd96882524de15e339d0518
SHA2569263e70cff30de13fd6d0d591c8bfa9da0b7eaf7825255a9c248ae6232a0f646
SHA5128d820ad48963add8f02b188c7b85b4c93eea5addf3277727ae741bfc84b44c77e13c869e1037ee7253baf14848838116b20065b78947b981cdcc4241f68c8076
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku705811.exeFilesize
294KB
MD53c4b22d4156dd2660f09bd236387b208
SHA168695333f8aa40cb4498eba82ed6e37169f84b6d
SHA256f4c19735d5379fe6dd9da964ab3e0bbe679716d6d4ec1a48f81b917d961eb597
SHA5122812a70aee8ed6422de5cf1b8b55eaaa53375e90c3b8ba63b7b3d532eff4247ac3a97f9f837ec22dd759c0c46b9fc2d51627d74cf5e8bb7f42920f565c093f0c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku705811.exeFilesize
294KB
MD53c4b22d4156dd2660f09bd236387b208
SHA168695333f8aa40cb4498eba82ed6e37169f84b6d
SHA256f4c19735d5379fe6dd9da964ab3e0bbe679716d6d4ec1a48f81b917d961eb597
SHA5122812a70aee8ed6422de5cf1b8b55eaaa53375e90c3b8ba63b7b3d532eff4247ac3a97f9f837ec22dd759c0c46b9fc2d51627d74cf5e8bb7f42920f565c093f0c
-
memory/1576-153-0x0000000000750000-0x000000000079B000-memory.dmpFilesize
300KB
-
memory/1576-154-0x0000000004D30000-0x00000000052D4000-memory.dmpFilesize
5.6MB
-
memory/1576-155-0x0000000004BE0000-0x0000000004C1F000-memory.dmpFilesize
252KB
-
memory/1576-158-0x0000000004BE0000-0x0000000004C1F000-memory.dmpFilesize
252KB
-
memory/1576-156-0x0000000004BE0000-0x0000000004C1F000-memory.dmpFilesize
252KB
-
memory/1576-160-0x0000000004BE0000-0x0000000004C1F000-memory.dmpFilesize
252KB
-
memory/1576-164-0x0000000004BE0000-0x0000000004C1F000-memory.dmpFilesize
252KB
-
memory/1576-162-0x0000000004BE0000-0x0000000004C1F000-memory.dmpFilesize
252KB
-
memory/1576-166-0x0000000004BE0000-0x0000000004C1F000-memory.dmpFilesize
252KB
-
memory/1576-170-0x0000000004BE0000-0x0000000004C1F000-memory.dmpFilesize
252KB
-
memory/1576-168-0x0000000004BE0000-0x0000000004C1F000-memory.dmpFilesize
252KB
-
memory/1576-172-0x0000000004BE0000-0x0000000004C1F000-memory.dmpFilesize
252KB
-
memory/1576-174-0x0000000004BE0000-0x0000000004C1F000-memory.dmpFilesize
252KB
-
memory/1576-177-0x0000000004D20000-0x0000000004D30000-memory.dmpFilesize
64KB
-
memory/1576-176-0x0000000004BE0000-0x0000000004C1F000-memory.dmpFilesize
252KB
-
memory/1576-180-0x0000000004BE0000-0x0000000004C1F000-memory.dmpFilesize
252KB
-
memory/1576-179-0x0000000004D20000-0x0000000004D30000-memory.dmpFilesize
64KB
-
memory/1576-183-0x0000000004BE0000-0x0000000004C1F000-memory.dmpFilesize
252KB
-
memory/1576-189-0x0000000004BE0000-0x0000000004C1F000-memory.dmpFilesize
252KB
-
memory/1576-187-0x0000000004BE0000-0x0000000004C1F000-memory.dmpFilesize
252KB
-
memory/1576-193-0x0000000004BE0000-0x0000000004C1F000-memory.dmpFilesize
252KB
-
memory/1576-191-0x0000000004BE0000-0x0000000004C1F000-memory.dmpFilesize
252KB
-
memory/1576-185-0x0000000004BE0000-0x0000000004C1F000-memory.dmpFilesize
252KB
-
memory/1576-181-0x0000000004D20000-0x0000000004D30000-memory.dmpFilesize
64KB
-
memory/1576-197-0x0000000004BE0000-0x0000000004C1F000-memory.dmpFilesize
252KB
-
memory/1576-195-0x0000000004BE0000-0x0000000004C1F000-memory.dmpFilesize
252KB
-
memory/1576-201-0x0000000004BE0000-0x0000000004C1F000-memory.dmpFilesize
252KB
-
memory/1576-207-0x0000000004BE0000-0x0000000004C1F000-memory.dmpFilesize
252KB
-
memory/1576-205-0x0000000004BE0000-0x0000000004C1F000-memory.dmpFilesize
252KB
-
memory/1576-203-0x0000000004BE0000-0x0000000004C1F000-memory.dmpFilesize
252KB
-
memory/1576-199-0x0000000004BE0000-0x0000000004C1F000-memory.dmpFilesize
252KB
-
memory/1576-209-0x0000000004BE0000-0x0000000004C1F000-memory.dmpFilesize
252KB
-
memory/1576-211-0x0000000004BE0000-0x0000000004C1F000-memory.dmpFilesize
252KB
-
memory/1576-213-0x0000000004BE0000-0x0000000004C1F000-memory.dmpFilesize
252KB
-
memory/1576-215-0x0000000004BE0000-0x0000000004C1F000-memory.dmpFilesize
252KB
-
memory/1576-221-0x0000000004BE0000-0x0000000004C1F000-memory.dmpFilesize
252KB
-
memory/1576-219-0x0000000004BE0000-0x0000000004C1F000-memory.dmpFilesize
252KB
-
memory/1576-217-0x0000000004BE0000-0x0000000004C1F000-memory.dmpFilesize
252KB
-
memory/1576-1064-0x00000000052E0000-0x00000000058F8000-memory.dmpFilesize
6.1MB
-
memory/1576-1065-0x0000000005900000-0x0000000005A0A000-memory.dmpFilesize
1.0MB
-
memory/1576-1066-0x0000000004CF0000-0x0000000004D02000-memory.dmpFilesize
72KB
-
memory/1576-1067-0x0000000005A10000-0x0000000005A4C000-memory.dmpFilesize
240KB
-
memory/1576-1068-0x0000000004D20000-0x0000000004D30000-memory.dmpFilesize
64KB
-
memory/1576-1070-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/1576-1071-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/1576-1072-0x0000000004D20000-0x0000000004D30000-memory.dmpFilesize
64KB
-
memory/1576-1073-0x0000000004D20000-0x0000000004D30000-memory.dmpFilesize
64KB
-
memory/1576-1074-0x00000000066F0000-0x00000000068B2000-memory.dmpFilesize
1.8MB
-
memory/1576-1075-0x00000000068D0000-0x0000000006DFC000-memory.dmpFilesize
5.2MB
-
memory/1576-1076-0x0000000004D20000-0x0000000004D30000-memory.dmpFilesize
64KB
-
memory/1576-1077-0x0000000007090000-0x0000000007106000-memory.dmpFilesize
472KB
-
memory/1576-1078-0x0000000007110000-0x0000000007160000-memory.dmpFilesize
320KB
-
memory/3604-1084-0x00000000006D0000-0x0000000000702000-memory.dmpFilesize
200KB
-
memory/3604-1085-0x00000000052D0000-0x00000000052E0000-memory.dmpFilesize
64KB
-
memory/4340-147-0x0000000000870000-0x000000000087A000-memory.dmpFilesize
40KB