Analysis
-
max time kernel
101s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 21:14
Static task
static1
Behavioral task
behavioral1
Sample
693409efcaf02fa1d2674194aa6ec3c0005f30d83bd094ba7720fefb69b83f73.exe
Resource
win10v2004-20230221-en
General
-
Target
693409efcaf02fa1d2674194aa6ec3c0005f30d83bd094ba7720fefb69b83f73.exe
-
Size
522KB
-
MD5
230c9a842dfd48744df27cb95d12c637
-
SHA1
20a48b902e1e3720ff1d4c70b093b3f7a4124c20
-
SHA256
693409efcaf02fa1d2674194aa6ec3c0005f30d83bd094ba7720fefb69b83f73
-
SHA512
a260363a23053a78955cc85a4e3fe56f7efb0e9b62a7ff941299ce00575434b3e2438952120281db985f69ee5b5a39d1229b8c9c825321f5a66ac7e8ab630cb7
-
SSDEEP
12288:zMrfy902Ji6bV/0dnzVEAT7H8ZE4EzzWK9S9Um1NcOB:cyhJi6VMdnzV1cZVEuK9SHL
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr159851.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr159851.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr159851.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr159851.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr159851.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr159851.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr159851.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
Processes:
resource yara_rule behavioral1/memory/1724-155-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1724-158-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1724-156-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1724-160-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1724-162-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1724-164-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1724-166-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1724-168-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1724-170-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1724-172-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1724-174-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1724-176-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1724-178-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1724-183-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1724-185-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1724-187-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1724-189-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1724-191-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1724-193-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1724-195-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1724-197-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1724-199-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1724-201-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1724-203-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1724-205-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1724-207-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1724-209-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1724-211-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1724-213-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1724-215-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1724-217-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1724-219-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1724-221-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/1724-1074-0x0000000004B70000-0x0000000004B80000-memory.dmp family_redline behavioral1/memory/1724-1075-0x0000000004B70000-0x0000000004B80000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
zifQ7648.exejr159851.exeku031418.exelr105369.exepid process 3772 zifQ7648.exe 2720 jr159851.exe 1724 ku031418.exe 3892 lr105369.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr159851.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr159851.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
693409efcaf02fa1d2674194aa6ec3c0005f30d83bd094ba7720fefb69b83f73.exezifQ7648.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 693409efcaf02fa1d2674194aa6ec3c0005f30d83bd094ba7720fefb69b83f73.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 693409efcaf02fa1d2674194aa6ec3c0005f30d83bd094ba7720fefb69b83f73.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zifQ7648.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zifQ7648.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3100 1724 WerFault.exe ku031418.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr159851.exeku031418.exelr105369.exepid process 2720 jr159851.exe 2720 jr159851.exe 1724 ku031418.exe 1724 ku031418.exe 3892 lr105369.exe 3892 lr105369.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr159851.exeku031418.exelr105369.exedescription pid process Token: SeDebugPrivilege 2720 jr159851.exe Token: SeDebugPrivilege 1724 ku031418.exe Token: SeDebugPrivilege 3892 lr105369.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
693409efcaf02fa1d2674194aa6ec3c0005f30d83bd094ba7720fefb69b83f73.exezifQ7648.exedescription pid process target process PID 3476 wrote to memory of 3772 3476 693409efcaf02fa1d2674194aa6ec3c0005f30d83bd094ba7720fefb69b83f73.exe zifQ7648.exe PID 3476 wrote to memory of 3772 3476 693409efcaf02fa1d2674194aa6ec3c0005f30d83bd094ba7720fefb69b83f73.exe zifQ7648.exe PID 3476 wrote to memory of 3772 3476 693409efcaf02fa1d2674194aa6ec3c0005f30d83bd094ba7720fefb69b83f73.exe zifQ7648.exe PID 3772 wrote to memory of 2720 3772 zifQ7648.exe jr159851.exe PID 3772 wrote to memory of 2720 3772 zifQ7648.exe jr159851.exe PID 3772 wrote to memory of 1724 3772 zifQ7648.exe ku031418.exe PID 3772 wrote to memory of 1724 3772 zifQ7648.exe ku031418.exe PID 3772 wrote to memory of 1724 3772 zifQ7648.exe ku031418.exe PID 3476 wrote to memory of 3892 3476 693409efcaf02fa1d2674194aa6ec3c0005f30d83bd094ba7720fefb69b83f73.exe lr105369.exe PID 3476 wrote to memory of 3892 3476 693409efcaf02fa1d2674194aa6ec3c0005f30d83bd094ba7720fefb69b83f73.exe lr105369.exe PID 3476 wrote to memory of 3892 3476 693409efcaf02fa1d2674194aa6ec3c0005f30d83bd094ba7720fefb69b83f73.exe lr105369.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\693409efcaf02fa1d2674194aa6ec3c0005f30d83bd094ba7720fefb69b83f73.exe"C:\Users\Admin\AppData\Local\Temp\693409efcaf02fa1d2674194aa6ec3c0005f30d83bd094ba7720fefb69b83f73.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zifQ7648.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zifQ7648.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr159851.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr159851.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku031418.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku031418.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 19284⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr105369.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr105369.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1724 -ip 17241⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr105369.exeFilesize
175KB
MD557d9305216508ce34c9bada6569ea7db
SHA1294738f2d1d02df1088a4216b3915529dcc71791
SHA256175168d81f13920b08c1627a327fc45abbdd93597a01f1c3521ae7d2a77204c1
SHA5121558cbf67d0bce63eb1376d03985e2cc58f2af2f1248f9eb16ee176ef904f3d37179b1219fd4ba106fb303f501fe45f2e05a2944cb401306d8b1ce3b20d0348b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr105369.exeFilesize
175KB
MD557d9305216508ce34c9bada6569ea7db
SHA1294738f2d1d02df1088a4216b3915529dcc71791
SHA256175168d81f13920b08c1627a327fc45abbdd93597a01f1c3521ae7d2a77204c1
SHA5121558cbf67d0bce63eb1376d03985e2cc58f2af2f1248f9eb16ee176ef904f3d37179b1219fd4ba106fb303f501fe45f2e05a2944cb401306d8b1ce3b20d0348b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zifQ7648.exeFilesize
379KB
MD58da2b17bf60ba0b1e864be137b0611f6
SHA18513791a7b1c5169c0be0ddcf983afac7527c64d
SHA256152d414987b83d704aa4c6d3cb822d0b39b0c6ac9ad573c2b2d2c87106a78e24
SHA512a51f837f24fce04d8d5dbf90446a6ab753e7c79565557ce00c9c8136c9ba1104e0e16f9fd2a08e2d051c469c2dd6a9602e8fa5cf3887111a7d93182778eecdd9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zifQ7648.exeFilesize
379KB
MD58da2b17bf60ba0b1e864be137b0611f6
SHA18513791a7b1c5169c0be0ddcf983afac7527c64d
SHA256152d414987b83d704aa4c6d3cb822d0b39b0c6ac9ad573c2b2d2c87106a78e24
SHA512a51f837f24fce04d8d5dbf90446a6ab753e7c79565557ce00c9c8136c9ba1104e0e16f9fd2a08e2d051c469c2dd6a9602e8fa5cf3887111a7d93182778eecdd9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr159851.exeFilesize
15KB
MD531ff8cc8d497012818b0f3bf6eeee99d
SHA15fd315c8e42ab674da1949905604edd75f1b0a0c
SHA25610f1f0188b5fe5418f3592724b224269ec2b1e84876bf527eb1a7f56af4a16a9
SHA512de960151e598086c62ac109f11aae996903de3f7b32f3f3ee664ae7e992ad105a9158495aa90d2adf51884768ab7515162e841ffbbf7b8b1c2578fff0218dd12
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr159851.exeFilesize
15KB
MD531ff8cc8d497012818b0f3bf6eeee99d
SHA15fd315c8e42ab674da1949905604edd75f1b0a0c
SHA25610f1f0188b5fe5418f3592724b224269ec2b1e84876bf527eb1a7f56af4a16a9
SHA512de960151e598086c62ac109f11aae996903de3f7b32f3f3ee664ae7e992ad105a9158495aa90d2adf51884768ab7515162e841ffbbf7b8b1c2578fff0218dd12
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku031418.exeFilesize
294KB
MD5cb9f63e49923ab58dd47303bbc89a5ab
SHA127a9c4b1c7112eda4486a2ba1ee9c4806bd23e5c
SHA256e2b0fddcbd9b77aec667bf89d6bdda3f562cc56d0d3938c3e770e561d443501f
SHA512bb9c37917d7608e313784fa3bf891c54ae1c27915590cbed3893f2269934bfaf1402676a47cbecc1f13f78c5653ba32529f73c9087834f2251c9852e567e6eb7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku031418.exeFilesize
294KB
MD5cb9f63e49923ab58dd47303bbc89a5ab
SHA127a9c4b1c7112eda4486a2ba1ee9c4806bd23e5c
SHA256e2b0fddcbd9b77aec667bf89d6bdda3f562cc56d0d3938c3e770e561d443501f
SHA512bb9c37917d7608e313784fa3bf891c54ae1c27915590cbed3893f2269934bfaf1402676a47cbecc1f13f78c5653ba32529f73c9087834f2251c9852e567e6eb7
-
memory/1724-153-0x0000000000830000-0x000000000087B000-memory.dmpFilesize
300KB
-
memory/1724-154-0x0000000004B80000-0x0000000005124000-memory.dmpFilesize
5.6MB
-
memory/1724-155-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1724-158-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1724-156-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1724-160-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1724-162-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1724-164-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1724-166-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1724-168-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1724-170-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1724-172-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1724-174-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1724-176-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1724-179-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/1724-178-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1724-180-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/1724-182-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/1724-183-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1724-185-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1724-187-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1724-189-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1724-191-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1724-193-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1724-195-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1724-197-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1724-199-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1724-201-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1724-203-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1724-205-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1724-207-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1724-209-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1724-211-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1724-213-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1724-215-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1724-217-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1724-219-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1724-221-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/1724-1064-0x0000000005130000-0x0000000005748000-memory.dmpFilesize
6.1MB
-
memory/1724-1065-0x0000000005760000-0x000000000586A000-memory.dmpFilesize
1.0MB
-
memory/1724-1066-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/1724-1067-0x00000000058C0000-0x00000000058FC000-memory.dmpFilesize
240KB
-
memory/1724-1068-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/1724-1069-0x0000000005BB0000-0x0000000005C42000-memory.dmpFilesize
584KB
-
memory/1724-1071-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/1724-1072-0x0000000006350000-0x00000000063C6000-memory.dmpFilesize
472KB
-
memory/1724-1073-0x00000000063E0000-0x0000000006430000-memory.dmpFilesize
320KB
-
memory/1724-1074-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/1724-1075-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/1724-1076-0x0000000006550000-0x0000000006712000-memory.dmpFilesize
1.8MB
-
memory/1724-1077-0x0000000006770000-0x0000000006C9C000-memory.dmpFilesize
5.2MB
-
memory/1724-1078-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/2720-147-0x0000000000EB0000-0x0000000000EBA000-memory.dmpFilesize
40KB
-
memory/3892-1084-0x00000000006D0000-0x0000000000702000-memory.dmpFilesize
200KB
-
memory/3892-1085-0x0000000004FD0000-0x0000000004FE0000-memory.dmpFilesize
64KB