Analysis
-
max time kernel
135s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 21:17
Static task
static1
Behavioral task
behavioral1
Sample
c61d6dd4b108bb8b1067406351aa85e2da533930e3ac6099b32af8fd7529fd26.exe
Resource
win10v2004-20230221-en
General
-
Target
c61d6dd4b108bb8b1067406351aa85e2da533930e3ac6099b32af8fd7529fd26.exe
-
Size
658KB
-
MD5
cfb7e1930e2101aef243e8b8d9001d4c
-
SHA1
dbc2601c3ff367c13e6890bc57548f54a1aff706
-
SHA256
c61d6dd4b108bb8b1067406351aa85e2da533930e3ac6099b32af8fd7529fd26
-
SHA512
1f3751f479748991baa21480d8be390201cd4f1f3febcd14a6ba4b5e451d571ef5d2e50d2195f3c8e5a89f0c0817b1eeaa1a6a35822ced5d65bbbe11f576ae1c
-
SSDEEP
12288:7MrKy90mJ03vlfvRihXtAi5QmLXr+z44PzWKMu8v/FwX1:ByxIihtL6+b+M4aKIwX1
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro4324.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro4324.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro4324.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro4324.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro4324.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro4324.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro4324.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/2660-191-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/2660-192-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/2660-194-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/2660-196-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/2660-198-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/2660-200-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/2660-202-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/2660-204-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/2660-206-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/2660-208-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/2660-210-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/2660-212-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/2660-214-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/2660-216-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/2660-218-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/2660-220-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/2660-224-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/2660-222-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/2660-230-0x00000000024B0000-0x00000000024C0000-memory.dmp family_redline behavioral1/memory/2660-1109-0x00000000024B0000-0x00000000024C0000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un536168.exepro4324.exequ8472.exesi240479.exepid process 432 un536168.exe 4904 pro4324.exe 2660 qu8472.exe 1448 si240479.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro4324.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro4324.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro4324.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
c61d6dd4b108bb8b1067406351aa85e2da533930e3ac6099b32af8fd7529fd26.exeun536168.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce c61d6dd4b108bb8b1067406351aa85e2da533930e3ac6099b32af8fd7529fd26.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c61d6dd4b108bb8b1067406351aa85e2da533930e3ac6099b32af8fd7529fd26.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un536168.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un536168.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2240 4904 WerFault.exe pro4324.exe 2564 2660 WerFault.exe qu8472.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro4324.exequ8472.exesi240479.exepid process 4904 pro4324.exe 4904 pro4324.exe 2660 qu8472.exe 2660 qu8472.exe 1448 si240479.exe 1448 si240479.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro4324.exequ8472.exesi240479.exedescription pid process Token: SeDebugPrivilege 4904 pro4324.exe Token: SeDebugPrivilege 2660 qu8472.exe Token: SeDebugPrivilege 1448 si240479.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
c61d6dd4b108bb8b1067406351aa85e2da533930e3ac6099b32af8fd7529fd26.exeun536168.exedescription pid process target process PID 2200 wrote to memory of 432 2200 c61d6dd4b108bb8b1067406351aa85e2da533930e3ac6099b32af8fd7529fd26.exe un536168.exe PID 2200 wrote to memory of 432 2200 c61d6dd4b108bb8b1067406351aa85e2da533930e3ac6099b32af8fd7529fd26.exe un536168.exe PID 2200 wrote to memory of 432 2200 c61d6dd4b108bb8b1067406351aa85e2da533930e3ac6099b32af8fd7529fd26.exe un536168.exe PID 432 wrote to memory of 4904 432 un536168.exe pro4324.exe PID 432 wrote to memory of 4904 432 un536168.exe pro4324.exe PID 432 wrote to memory of 4904 432 un536168.exe pro4324.exe PID 432 wrote to memory of 2660 432 un536168.exe qu8472.exe PID 432 wrote to memory of 2660 432 un536168.exe qu8472.exe PID 432 wrote to memory of 2660 432 un536168.exe qu8472.exe PID 2200 wrote to memory of 1448 2200 c61d6dd4b108bb8b1067406351aa85e2da533930e3ac6099b32af8fd7529fd26.exe si240479.exe PID 2200 wrote to memory of 1448 2200 c61d6dd4b108bb8b1067406351aa85e2da533930e3ac6099b32af8fd7529fd26.exe si240479.exe PID 2200 wrote to memory of 1448 2200 c61d6dd4b108bb8b1067406351aa85e2da533930e3ac6099b32af8fd7529fd26.exe si240479.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c61d6dd4b108bb8b1067406351aa85e2da533930e3ac6099b32af8fd7529fd26.exe"C:\Users\Admin\AppData\Local\Temp\c61d6dd4b108bb8b1067406351aa85e2da533930e3ac6099b32af8fd7529fd26.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un536168.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un536168.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4324.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4324.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 10844⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8472.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8472.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 13484⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si240479.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si240479.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4904 -ip 49041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2660 -ip 26601⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si240479.exeFilesize
175KB
MD50a24c5ce003adc3db1db805d6e9b2504
SHA107f50ba0406dc6c916e669730457ba6758723493
SHA256448925f5acd9bd8a372bc4eb234accdcf2250e7250672675a728d09843cbecbf
SHA5122c1665e7ffe2d8435bcedf73e645b27c3d361b7c36faaca8277a7364bf88269a3b8dca50a9f63e54f7059185516ff7069fee7728df03ccf0415d2cb9ecd9ae9f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si240479.exeFilesize
175KB
MD50a24c5ce003adc3db1db805d6e9b2504
SHA107f50ba0406dc6c916e669730457ba6758723493
SHA256448925f5acd9bd8a372bc4eb234accdcf2250e7250672675a728d09843cbecbf
SHA5122c1665e7ffe2d8435bcedf73e645b27c3d361b7c36faaca8277a7364bf88269a3b8dca50a9f63e54f7059185516ff7069fee7728df03ccf0415d2cb9ecd9ae9f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un536168.exeFilesize
516KB
MD5dd9c9a950f142495ec8b181b44a10300
SHA1dee262eaaed98bab54d4b4496a0e5a294dae5c5b
SHA2562435fb311f94e3cb40be0a8982e69cc6f6ab05c3333db891faa115cf29dd1c09
SHA512a26d475c0f13a2d12ff0812a840ba8e9c9316bbde6a78689451e45b79edac58615227866a6132c0f993e0a15b7d6e6ab7eec9a07284bea49a09a5e9b6aa1eff5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un536168.exeFilesize
516KB
MD5dd9c9a950f142495ec8b181b44a10300
SHA1dee262eaaed98bab54d4b4496a0e5a294dae5c5b
SHA2562435fb311f94e3cb40be0a8982e69cc6f6ab05c3333db891faa115cf29dd1c09
SHA512a26d475c0f13a2d12ff0812a840ba8e9c9316bbde6a78689451e45b79edac58615227866a6132c0f993e0a15b7d6e6ab7eec9a07284bea49a09a5e9b6aa1eff5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4324.exeFilesize
235KB
MD54ffb9ca74b88b2ae7ace1213e76c90b2
SHA1357d95736d804356121e4bd2e10b0f5acf105df2
SHA256eac59e736ca96307de7e40a1de89806bb3873415eac7b56643118d030437db78
SHA5127411e1335aa072b66b4552121c228236943838cf043598915fd89537d7d0889b3599f4431fc569e5cb8bf61e40e53c0679dc9cd2465b586df5c7cb1e1e470ff1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4324.exeFilesize
235KB
MD54ffb9ca74b88b2ae7ace1213e76c90b2
SHA1357d95736d804356121e4bd2e10b0f5acf105df2
SHA256eac59e736ca96307de7e40a1de89806bb3873415eac7b56643118d030437db78
SHA5127411e1335aa072b66b4552121c228236943838cf043598915fd89537d7d0889b3599f4431fc569e5cb8bf61e40e53c0679dc9cd2465b586df5c7cb1e1e470ff1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8472.exeFilesize
294KB
MD52e8a325944dac00688171a3935e71084
SHA17cba9cd799bfac4caa752c985ae92385c6b8fbc8
SHA25650a59d498cad8b12ba4c0c057d865ccb6673713e8cda0520e5838ed9aad54b59
SHA512bfdeb617b94a89ddbc749a92a617b09a48b8cda953bacf49fad9cb86c1a7c36bbfa140e1170345acbce471d06145080f5d6b8e3e3fd812e5aa90b3e4e994b621
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8472.exeFilesize
294KB
MD52e8a325944dac00688171a3935e71084
SHA17cba9cd799bfac4caa752c985ae92385c6b8fbc8
SHA25650a59d498cad8b12ba4c0c057d865ccb6673713e8cda0520e5838ed9aad54b59
SHA512bfdeb617b94a89ddbc749a92a617b09a48b8cda953bacf49fad9cb86c1a7c36bbfa140e1170345acbce471d06145080f5d6b8e3e3fd812e5aa90b3e4e994b621
-
memory/1448-1122-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/1448-1121-0x0000000000100000-0x0000000000132000-memory.dmpFilesize
200KB
-
memory/2660-231-0x00000000024B0000-0x00000000024C0000-memory.dmpFilesize
64KB
-
memory/2660-1104-0x00000000024B0000-0x00000000024C0000-memory.dmpFilesize
64KB
-
memory/2660-1115-0x00000000024B0000-0x00000000024C0000-memory.dmpFilesize
64KB
-
memory/2660-1114-0x0000000006740000-0x0000000006C6C000-memory.dmpFilesize
5.2MB
-
memory/2660-1113-0x0000000006560000-0x0000000006722000-memory.dmpFilesize
1.8MB
-
memory/2660-1112-0x00000000064E0000-0x0000000006530000-memory.dmpFilesize
320KB
-
memory/2660-1111-0x0000000006450000-0x00000000064C6000-memory.dmpFilesize
472KB
-
memory/2660-1110-0x00000000024B0000-0x00000000024C0000-memory.dmpFilesize
64KB
-
memory/2660-1109-0x00000000024B0000-0x00000000024C0000-memory.dmpFilesize
64KB
-
memory/2660-1107-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/2660-1106-0x0000000005BB0000-0x0000000005C42000-memory.dmpFilesize
584KB
-
memory/2660-1105-0x00000000058C0000-0x00000000058FC000-memory.dmpFilesize
240KB
-
memory/2660-1103-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/2660-1102-0x0000000005760000-0x000000000586A000-memory.dmpFilesize
1.0MB
-
memory/2660-1101-0x0000000005110000-0x0000000005728000-memory.dmpFilesize
6.1MB
-
memory/2660-230-0x00000000024B0000-0x00000000024C0000-memory.dmpFilesize
64KB
-
memory/2660-228-0x00000000024B0000-0x00000000024C0000-memory.dmpFilesize
64KB
-
memory/2660-225-0x0000000002150000-0x000000000219B000-memory.dmpFilesize
300KB
-
memory/2660-222-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/2660-224-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/2660-220-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/2660-191-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/2660-192-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/2660-194-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/2660-196-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/2660-198-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/2660-200-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/2660-202-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/2660-204-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/2660-206-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/2660-208-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/2660-210-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/2660-212-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/2660-214-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/2660-216-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/2660-218-0x0000000002650000-0x000000000268F000-memory.dmpFilesize
252KB
-
memory/4904-176-0x0000000002310000-0x0000000002322000-memory.dmpFilesize
72KB
-
memory/4904-184-0x0000000002350000-0x0000000002360000-memory.dmpFilesize
64KB
-
memory/4904-154-0x0000000002310000-0x0000000002322000-memory.dmpFilesize
72KB
-
memory/4904-185-0x0000000002350000-0x0000000002360000-memory.dmpFilesize
64KB
-
memory/4904-174-0x0000000002310000-0x0000000002322000-memory.dmpFilesize
72KB
-
memory/4904-152-0x0000000002310000-0x0000000002322000-memory.dmpFilesize
72KB
-
memory/4904-182-0x0000000002350000-0x0000000002360000-memory.dmpFilesize
64KB
-
memory/4904-172-0x0000000002310000-0x0000000002322000-memory.dmpFilesize
72KB
-
memory/4904-180-0x0000000002350000-0x0000000002360000-memory.dmpFilesize
64KB
-
memory/4904-179-0x0000000002350000-0x0000000002360000-memory.dmpFilesize
64KB
-
memory/4904-158-0x0000000002310000-0x0000000002322000-memory.dmpFilesize
72KB
-
memory/4904-178-0x0000000002310000-0x0000000002322000-memory.dmpFilesize
72KB
-
memory/4904-186-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4904-156-0x0000000002310000-0x0000000002322000-memory.dmpFilesize
72KB
-
memory/4904-181-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4904-162-0x0000000002310000-0x0000000002322000-memory.dmpFilesize
72KB
-
memory/4904-164-0x0000000002310000-0x0000000002322000-memory.dmpFilesize
72KB
-
memory/4904-166-0x0000000002310000-0x0000000002322000-memory.dmpFilesize
72KB
-
memory/4904-168-0x0000000002310000-0x0000000002322000-memory.dmpFilesize
72KB
-
memory/4904-170-0x0000000002310000-0x0000000002322000-memory.dmpFilesize
72KB
-
memory/4904-160-0x0000000002310000-0x0000000002322000-memory.dmpFilesize
72KB
-
memory/4904-151-0x0000000002310000-0x0000000002322000-memory.dmpFilesize
72KB
-
memory/4904-150-0x0000000004AE0000-0x0000000005084000-memory.dmpFilesize
5.6MB
-
memory/4904-149-0x0000000002350000-0x0000000002360000-memory.dmpFilesize
64KB
-
memory/4904-148-0x0000000000630000-0x000000000065D000-memory.dmpFilesize
180KB