Analysis
-
max time kernel
134s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 20:38
Static task
static1
Behavioral task
behavioral1
Sample
4583fdcecc4cdf70c098ba4c9c546a0195f7f0fc535ee266b0772a01e6c2636d.exe
Resource
win10v2004-20230220-en
General
-
Target
4583fdcecc4cdf70c098ba4c9c546a0195f7f0fc535ee266b0772a01e6c2636d.exe
-
Size
657KB
-
MD5
f7a2d11053dd9a05cf58d2248fb8614e
-
SHA1
677d24f1782eecd47ad5ab6ce5a6402b41f50a14
-
SHA256
4583fdcecc4cdf70c098ba4c9c546a0195f7f0fc535ee266b0772a01e6c2636d
-
SHA512
947bffa090f8e3b4126b9dc488059d5785087e6b851599413a4f47e431050ec874493ae847447f2a4fc8010e952a39e1d07afd5e3ca6359b2bfb3c1505808c94
-
SSDEEP
12288:IMrOy90KoBwLA7TyVRXt4cRK4xH/PupLt8UWOHFO44OzWKs98vtHKgk:GyDlLAv8XtjRxuphiqFn4XKdqP
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro2729.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro2729.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro2729.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro2729.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro2729.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro2729.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro2729.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/4688-190-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4688-191-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4688-193-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4688-195-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4688-197-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4688-199-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4688-201-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4688-203-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4688-205-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4688-207-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4688-209-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4688-211-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4688-213-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4688-215-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4688-217-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4688-219-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4688-221-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4688-223-0x0000000005050000-0x000000000508F000-memory.dmp family_redline behavioral1/memory/4688-484-0x0000000002630000-0x0000000002640000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un889002.exepro2729.exequ7410.exesi672639.exepid process 1056 un889002.exe 1512 pro2729.exe 4688 qu7410.exe 4976 si672639.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro2729.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro2729.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro2729.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
4583fdcecc4cdf70c098ba4c9c546a0195f7f0fc535ee266b0772a01e6c2636d.exeun889002.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 4583fdcecc4cdf70c098ba4c9c546a0195f7f0fc535ee266b0772a01e6c2636d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 4583fdcecc4cdf70c098ba4c9c546a0195f7f0fc535ee266b0772a01e6c2636d.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un889002.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un889002.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 1332 sc.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3116 1512 WerFault.exe pro2729.exe 4444 4688 WerFault.exe qu7410.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro2729.exequ7410.exesi672639.exepid process 1512 pro2729.exe 1512 pro2729.exe 4688 qu7410.exe 4688 qu7410.exe 4976 si672639.exe 4976 si672639.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro2729.exequ7410.exesi672639.exedescription pid process Token: SeDebugPrivilege 1512 pro2729.exe Token: SeDebugPrivilege 4688 qu7410.exe Token: SeDebugPrivilege 4976 si672639.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
4583fdcecc4cdf70c098ba4c9c546a0195f7f0fc535ee266b0772a01e6c2636d.exeun889002.exedescription pid process target process PID 848 wrote to memory of 1056 848 4583fdcecc4cdf70c098ba4c9c546a0195f7f0fc535ee266b0772a01e6c2636d.exe un889002.exe PID 848 wrote to memory of 1056 848 4583fdcecc4cdf70c098ba4c9c546a0195f7f0fc535ee266b0772a01e6c2636d.exe un889002.exe PID 848 wrote to memory of 1056 848 4583fdcecc4cdf70c098ba4c9c546a0195f7f0fc535ee266b0772a01e6c2636d.exe un889002.exe PID 1056 wrote to memory of 1512 1056 un889002.exe pro2729.exe PID 1056 wrote to memory of 1512 1056 un889002.exe pro2729.exe PID 1056 wrote to memory of 1512 1056 un889002.exe pro2729.exe PID 1056 wrote to memory of 4688 1056 un889002.exe qu7410.exe PID 1056 wrote to memory of 4688 1056 un889002.exe qu7410.exe PID 1056 wrote to memory of 4688 1056 un889002.exe qu7410.exe PID 848 wrote to memory of 4976 848 4583fdcecc4cdf70c098ba4c9c546a0195f7f0fc535ee266b0772a01e6c2636d.exe si672639.exe PID 848 wrote to memory of 4976 848 4583fdcecc4cdf70c098ba4c9c546a0195f7f0fc535ee266b0772a01e6c2636d.exe si672639.exe PID 848 wrote to memory of 4976 848 4583fdcecc4cdf70c098ba4c9c546a0195f7f0fc535ee266b0772a01e6c2636d.exe si672639.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4583fdcecc4cdf70c098ba4c9c546a0195f7f0fc535ee266b0772a01e6c2636d.exe"C:\Users\Admin\AppData\Local\Temp\4583fdcecc4cdf70c098ba4c9c546a0195f7f0fc535ee266b0772a01e6c2636d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un889002.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un889002.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2729.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2729.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 10284⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7410.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7410.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 15444⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si672639.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si672639.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1512 -ip 15121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4688 -ip 46881⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si672639.exeFilesize
175KB
MD596a0a0a068d686ec9621f3b0622f61cc
SHA101d7100238ca7db848e9c6f314409f7b0f8b8de8
SHA256b4dec2d608708428a62d8da0af4534e32ab9c86f0639497a93a61a37d46fc5e2
SHA51231130f95a4294623d04d8a107e54ef6ec9764e20ebef9adbbbde9dcf97e5b7d8075b9c6d3b713c44494f3d540ed497d710f8adaf6803cf2d4d5129c6d4933ea3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si672639.exeFilesize
175KB
MD596a0a0a068d686ec9621f3b0622f61cc
SHA101d7100238ca7db848e9c6f314409f7b0f8b8de8
SHA256b4dec2d608708428a62d8da0af4534e32ab9c86f0639497a93a61a37d46fc5e2
SHA51231130f95a4294623d04d8a107e54ef6ec9764e20ebef9adbbbde9dcf97e5b7d8075b9c6d3b713c44494f3d540ed497d710f8adaf6803cf2d4d5129c6d4933ea3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un889002.exeFilesize
515KB
MD5732e75e6cf42f5c5f0bf26bdda36f0e8
SHA17d51cbdfa361d7a5e93b81c471297fcad4ba139f
SHA2568c250d0335f77333db5f0acaf5dcd3db70781cc6be24c9edd4f42358cb6848fd
SHA512a413c047f301a7821fe8c2e7b50fe63ba9d471aebf80619a6022827d1a4fb74ed6d9ff547e6c5c978e7f8a6e51d8f553f9f31eb80cca8aef72d286fb46a0a5c7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un889002.exeFilesize
515KB
MD5732e75e6cf42f5c5f0bf26bdda36f0e8
SHA17d51cbdfa361d7a5e93b81c471297fcad4ba139f
SHA2568c250d0335f77333db5f0acaf5dcd3db70781cc6be24c9edd4f42358cb6848fd
SHA512a413c047f301a7821fe8c2e7b50fe63ba9d471aebf80619a6022827d1a4fb74ed6d9ff547e6c5c978e7f8a6e51d8f553f9f31eb80cca8aef72d286fb46a0a5c7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2729.exeFilesize
235KB
MD560ba6bd9a3b4b33b69a347d1bf12d884
SHA10c02e28cb2c938fbd823877175f3e9ae437070ad
SHA25676d613a1b3aef718359f44b26c7f4715e3f8dca3ded3dd5283109c9dbdd4b01f
SHA5122b1af300bcf6a80f456524eb021183095cb4671a47f66910975bb99d1beecc799d2cb5cb19740831d02b1de0d0364e53250c181e786e62dd1d06bebd121f86cd
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2729.exeFilesize
235KB
MD560ba6bd9a3b4b33b69a347d1bf12d884
SHA10c02e28cb2c938fbd823877175f3e9ae437070ad
SHA25676d613a1b3aef718359f44b26c7f4715e3f8dca3ded3dd5283109c9dbdd4b01f
SHA5122b1af300bcf6a80f456524eb021183095cb4671a47f66910975bb99d1beecc799d2cb5cb19740831d02b1de0d0364e53250c181e786e62dd1d06bebd121f86cd
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7410.exeFilesize
294KB
MD50fb00d6da44ab6bd097177d870828958
SHA1d9f07feba3a857cd09e5406f3fc54bd5e490e4a5
SHA25685c696daa7f8d488b9d63065082813987d8b691387a4cb854fa206be86fb4854
SHA512e3214764ae1557786cfd0773a1bbffefe4aa8bb32f15a8aff2e4c3697de590b3e65bc90369bf4e16435d8f7fb33ac8bc6a3a8bcfacb42eda78f1e5f7bf06d19e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7410.exeFilesize
294KB
MD50fb00d6da44ab6bd097177d870828958
SHA1d9f07feba3a857cd09e5406f3fc54bd5e490e4a5
SHA25685c696daa7f8d488b9d63065082813987d8b691387a4cb854fa206be86fb4854
SHA512e3214764ae1557786cfd0773a1bbffefe4aa8bb32f15a8aff2e4c3697de590b3e65bc90369bf4e16435d8f7fb33ac8bc6a3a8bcfacb42eda78f1e5f7bf06d19e
-
memory/1512-149-0x0000000004A30000-0x0000000004FD4000-memory.dmpFilesize
5.6MB
-
memory/1512-148-0x00000000005F0000-0x000000000061D000-memory.dmpFilesize
180KB
-
memory/1512-150-0x0000000004A20000-0x0000000004A30000-memory.dmpFilesize
64KB
-
memory/1512-151-0x0000000004A20000-0x0000000004A30000-memory.dmpFilesize
64KB
-
memory/1512-152-0x0000000004A20000-0x0000000004A30000-memory.dmpFilesize
64KB
-
memory/1512-153-0x0000000004FE0000-0x0000000004FF2000-memory.dmpFilesize
72KB
-
memory/1512-154-0x0000000004FE0000-0x0000000004FF2000-memory.dmpFilesize
72KB
-
memory/1512-156-0x0000000004FE0000-0x0000000004FF2000-memory.dmpFilesize
72KB
-
memory/1512-158-0x0000000004FE0000-0x0000000004FF2000-memory.dmpFilesize
72KB
-
memory/1512-160-0x0000000004FE0000-0x0000000004FF2000-memory.dmpFilesize
72KB
-
memory/1512-162-0x0000000004FE0000-0x0000000004FF2000-memory.dmpFilesize
72KB
-
memory/1512-164-0x0000000004FE0000-0x0000000004FF2000-memory.dmpFilesize
72KB
-
memory/1512-166-0x0000000004FE0000-0x0000000004FF2000-memory.dmpFilesize
72KB
-
memory/1512-168-0x0000000004FE0000-0x0000000004FF2000-memory.dmpFilesize
72KB
-
memory/1512-170-0x0000000004FE0000-0x0000000004FF2000-memory.dmpFilesize
72KB
-
memory/1512-172-0x0000000004FE0000-0x0000000004FF2000-memory.dmpFilesize
72KB
-
memory/1512-174-0x0000000004FE0000-0x0000000004FF2000-memory.dmpFilesize
72KB
-
memory/1512-176-0x0000000004FE0000-0x0000000004FF2000-memory.dmpFilesize
72KB
-
memory/1512-178-0x0000000004FE0000-0x0000000004FF2000-memory.dmpFilesize
72KB
-
memory/1512-180-0x0000000004FE0000-0x0000000004FF2000-memory.dmpFilesize
72KB
-
memory/1512-181-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1512-182-0x0000000004A20000-0x0000000004A30000-memory.dmpFilesize
64KB
-
memory/1512-183-0x0000000004A20000-0x0000000004A30000-memory.dmpFilesize
64KB
-
memory/1512-185-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4688-190-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4688-191-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4688-193-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4688-195-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4688-197-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4688-199-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4688-201-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4688-203-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4688-205-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4688-207-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4688-209-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4688-211-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4688-213-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4688-215-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4688-217-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4688-219-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4688-221-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4688-223-0x0000000005050000-0x000000000508F000-memory.dmpFilesize
252KB
-
memory/4688-479-0x0000000000620000-0x000000000066B000-memory.dmpFilesize
300KB
-
memory/4688-484-0x0000000002630000-0x0000000002640000-memory.dmpFilesize
64KB
-
memory/4688-482-0x0000000002630000-0x0000000002640000-memory.dmpFilesize
64KB
-
memory/4688-1099-0x00000000050C0000-0x00000000056D8000-memory.dmpFilesize
6.1MB
-
memory/4688-1100-0x0000000005760000-0x000000000586A000-memory.dmpFilesize
1.0MB
-
memory/4688-1101-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/4688-1102-0x0000000002630000-0x0000000002640000-memory.dmpFilesize
64KB
-
memory/4688-1103-0x00000000058C0000-0x00000000058FC000-memory.dmpFilesize
240KB
-
memory/4688-1104-0x0000000005BB0000-0x0000000005C42000-memory.dmpFilesize
584KB
-
memory/4688-1105-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/4688-1106-0x0000000006380000-0x0000000006542000-memory.dmpFilesize
1.8MB
-
memory/4688-1108-0x0000000006550000-0x0000000006A7C000-memory.dmpFilesize
5.2MB
-
memory/4688-1109-0x0000000002630000-0x0000000002640000-memory.dmpFilesize
64KB
-
memory/4688-1110-0x0000000002630000-0x0000000002640000-memory.dmpFilesize
64KB
-
memory/4688-1111-0x0000000002630000-0x0000000002640000-memory.dmpFilesize
64KB
-
memory/4688-1112-0x0000000006DE0000-0x0000000006E56000-memory.dmpFilesize
472KB
-
memory/4688-1113-0x0000000006E70000-0x0000000006EC0000-memory.dmpFilesize
320KB
-
memory/4976-1119-0x0000000000C90000-0x0000000000CC2000-memory.dmpFilesize
200KB
-
memory/4976-1120-0x00000000058B0000-0x00000000058C0000-memory.dmpFilesize
64KB