Analysis
-
max time kernel
53s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
03-04-2023 20:37
Static task
static1
Behavioral task
behavioral1
Sample
fc8f55d2015a3e0a80327f953b2188f05cbc1238756212230d970644f2df235e.exe
Resource
win10-20230220-en
General
-
Target
fc8f55d2015a3e0a80327f953b2188f05cbc1238756212230d970644f2df235e.exe
-
Size
522KB
-
MD5
76be5d2e2c863d49e7be87f5d233066e
-
SHA1
fe8b7546ce30e602d6d23e480b7965d2b7e8b45c
-
SHA256
fc8f55d2015a3e0a80327f953b2188f05cbc1238756212230d970644f2df235e
-
SHA512
95e8c3df38e8f4b922b697ee7d84346b21ba72473cb860779f2cd2a156291682f7afe581a028809e18f6ecf58fd4eccdf27d60a1c357928a9d0d96595eea66b4
-
SSDEEP
12288:NMrHy90NNSLK/aGBocQ8Dc4M2zWKUEEqiuMP+n7r:iyGgKyqoaD9MvKUEnz3r
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr570247.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr570247.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr570247.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr570247.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr570247.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr570247.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
Processes:
resource yara_rule behavioral1/memory/3924-141-0x0000000000790000-0x00000000007D6000-memory.dmp family_redline behavioral1/memory/3924-143-0x0000000002200000-0x0000000002244000-memory.dmp family_redline behavioral1/memory/3924-147-0x0000000002200000-0x000000000223F000-memory.dmp family_redline behavioral1/memory/3924-148-0x0000000002200000-0x000000000223F000-memory.dmp family_redline behavioral1/memory/3924-150-0x0000000002200000-0x000000000223F000-memory.dmp family_redline behavioral1/memory/3924-152-0x0000000002200000-0x000000000223F000-memory.dmp family_redline behavioral1/memory/3924-154-0x0000000002200000-0x000000000223F000-memory.dmp family_redline behavioral1/memory/3924-156-0x0000000002200000-0x000000000223F000-memory.dmp family_redline behavioral1/memory/3924-158-0x0000000002200000-0x000000000223F000-memory.dmp family_redline behavioral1/memory/3924-160-0x0000000002200000-0x000000000223F000-memory.dmp family_redline behavioral1/memory/3924-162-0x0000000002200000-0x000000000223F000-memory.dmp family_redline behavioral1/memory/3924-164-0x0000000002200000-0x000000000223F000-memory.dmp family_redline behavioral1/memory/3924-166-0x0000000002200000-0x000000000223F000-memory.dmp family_redline behavioral1/memory/3924-168-0x0000000002200000-0x000000000223F000-memory.dmp family_redline behavioral1/memory/3924-170-0x0000000002200000-0x000000000223F000-memory.dmp family_redline behavioral1/memory/3924-172-0x0000000002200000-0x000000000223F000-memory.dmp family_redline behavioral1/memory/3924-174-0x0000000002200000-0x000000000223F000-memory.dmp family_redline behavioral1/memory/3924-176-0x0000000002200000-0x000000000223F000-memory.dmp family_redline behavioral1/memory/3924-178-0x0000000002200000-0x000000000223F000-memory.dmp family_redline behavioral1/memory/3924-180-0x0000000002200000-0x000000000223F000-memory.dmp family_redline behavioral1/memory/3924-182-0x0000000002200000-0x000000000223F000-memory.dmp family_redline behavioral1/memory/3924-184-0x0000000002200000-0x000000000223F000-memory.dmp family_redline behavioral1/memory/3924-186-0x0000000002200000-0x000000000223F000-memory.dmp family_redline behavioral1/memory/3924-188-0x0000000002200000-0x000000000223F000-memory.dmp family_redline behavioral1/memory/3924-190-0x0000000002200000-0x000000000223F000-memory.dmp family_redline behavioral1/memory/3924-192-0x0000000002200000-0x000000000223F000-memory.dmp family_redline behavioral1/memory/3924-194-0x0000000002200000-0x000000000223F000-memory.dmp family_redline behavioral1/memory/3924-196-0x0000000002200000-0x000000000223F000-memory.dmp family_redline behavioral1/memory/3924-198-0x0000000002200000-0x000000000223F000-memory.dmp family_redline behavioral1/memory/3924-200-0x0000000002200000-0x000000000223F000-memory.dmp family_redline behavioral1/memory/3924-202-0x0000000002200000-0x000000000223F000-memory.dmp family_redline behavioral1/memory/3924-208-0x0000000002200000-0x000000000223F000-memory.dmp family_redline behavioral1/memory/3924-206-0x0000000002200000-0x000000000223F000-memory.dmp family_redline behavioral1/memory/3924-204-0x0000000002200000-0x000000000223F000-memory.dmp family_redline behavioral1/memory/3924-210-0x0000000002200000-0x000000000223F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
ziCK3457.exejr570247.exeku989265.exelr300221.exepid process 4260 ziCK3457.exe 4616 jr570247.exe 3924 ku989265.exe 5016 lr300221.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr570247.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr570247.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
fc8f55d2015a3e0a80327f953b2188f05cbc1238756212230d970644f2df235e.exeziCK3457.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce fc8f55d2015a3e0a80327f953b2188f05cbc1238756212230d970644f2df235e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" fc8f55d2015a3e0a80327f953b2188f05cbc1238756212230d970644f2df235e.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziCK3457.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziCK3457.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr570247.exeku989265.exelr300221.exepid process 4616 jr570247.exe 4616 jr570247.exe 3924 ku989265.exe 3924 ku989265.exe 5016 lr300221.exe 5016 lr300221.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr570247.exeku989265.exelr300221.exedescription pid process Token: SeDebugPrivilege 4616 jr570247.exe Token: SeDebugPrivilege 3924 ku989265.exe Token: SeDebugPrivilege 5016 lr300221.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
fc8f55d2015a3e0a80327f953b2188f05cbc1238756212230d970644f2df235e.exeziCK3457.exedescription pid process target process PID 4212 wrote to memory of 4260 4212 fc8f55d2015a3e0a80327f953b2188f05cbc1238756212230d970644f2df235e.exe ziCK3457.exe PID 4212 wrote to memory of 4260 4212 fc8f55d2015a3e0a80327f953b2188f05cbc1238756212230d970644f2df235e.exe ziCK3457.exe PID 4212 wrote to memory of 4260 4212 fc8f55d2015a3e0a80327f953b2188f05cbc1238756212230d970644f2df235e.exe ziCK3457.exe PID 4260 wrote to memory of 4616 4260 ziCK3457.exe jr570247.exe PID 4260 wrote to memory of 4616 4260 ziCK3457.exe jr570247.exe PID 4260 wrote to memory of 3924 4260 ziCK3457.exe ku989265.exe PID 4260 wrote to memory of 3924 4260 ziCK3457.exe ku989265.exe PID 4260 wrote to memory of 3924 4260 ziCK3457.exe ku989265.exe PID 4212 wrote to memory of 5016 4212 fc8f55d2015a3e0a80327f953b2188f05cbc1238756212230d970644f2df235e.exe lr300221.exe PID 4212 wrote to memory of 5016 4212 fc8f55d2015a3e0a80327f953b2188f05cbc1238756212230d970644f2df235e.exe lr300221.exe PID 4212 wrote to memory of 5016 4212 fc8f55d2015a3e0a80327f953b2188f05cbc1238756212230d970644f2df235e.exe lr300221.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc8f55d2015a3e0a80327f953b2188f05cbc1238756212230d970644f2df235e.exe"C:\Users\Admin\AppData\Local\Temp\fc8f55d2015a3e0a80327f953b2188f05cbc1238756212230d970644f2df235e.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziCK3457.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziCK3457.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr570247.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr570247.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku989265.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku989265.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr300221.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr300221.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5016
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr300221.exeFilesize
175KB
MD54076571517feb59b81b10a1189f2453c
SHA1bc4c783209f3dd7d8939fdd53c12770bd3cf8d2b
SHA2565e602d26d26a3aeb616222f120024095f21fa1286189ec375ce7f0ccd1f86272
SHA512e6c9407ba3a8a84893a60ef3dd13aae942cd1a97c46b277ac752c3e7afca16eb993e90551e2788208b315df57148a31e59bdd6d702c850d99f1042d682c6e4e4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr300221.exeFilesize
175KB
MD54076571517feb59b81b10a1189f2453c
SHA1bc4c783209f3dd7d8939fdd53c12770bd3cf8d2b
SHA2565e602d26d26a3aeb616222f120024095f21fa1286189ec375ce7f0ccd1f86272
SHA512e6c9407ba3a8a84893a60ef3dd13aae942cd1a97c46b277ac752c3e7afca16eb993e90551e2788208b315df57148a31e59bdd6d702c850d99f1042d682c6e4e4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziCK3457.exeFilesize
379KB
MD52f82afb1f8504413f5080ab463f965e9
SHA1ca4fbfe5f89d98bd8d49e5ebec68dbe7b013a060
SHA25642a22b12b9db504330dbe4c643ac0d845c966c0e9a73a7fb042867777c351154
SHA51234ec0a0695edd306e3bfe2fd75a9c51428c4ec0dc369f833d6443ae76fbb27c9ca82eaa17f000c34abe9b8de26606064da52461a8b46cca67d8f98914b70d23d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziCK3457.exeFilesize
379KB
MD52f82afb1f8504413f5080ab463f965e9
SHA1ca4fbfe5f89d98bd8d49e5ebec68dbe7b013a060
SHA25642a22b12b9db504330dbe4c643ac0d845c966c0e9a73a7fb042867777c351154
SHA51234ec0a0695edd306e3bfe2fd75a9c51428c4ec0dc369f833d6443ae76fbb27c9ca82eaa17f000c34abe9b8de26606064da52461a8b46cca67d8f98914b70d23d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr570247.exeFilesize
15KB
MD572859cc4970a342da99b2d4f918a4333
SHA130cda8608be88a2d36911247db30b2ac48675509
SHA2561c2e410f7bcafc5df8779cbe8c267c704720edc42915b5c12c1f1e4a051f5077
SHA512768ee393f33d70ee8b58c682db5574121b16ba51dfb55dc1f5ee4fae24a3cd4a1c8e8c6889ba2054971f7ba4159f9b303877a5071d05120f65f31fbfd5adca25
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr570247.exeFilesize
15KB
MD572859cc4970a342da99b2d4f918a4333
SHA130cda8608be88a2d36911247db30b2ac48675509
SHA2561c2e410f7bcafc5df8779cbe8c267c704720edc42915b5c12c1f1e4a051f5077
SHA512768ee393f33d70ee8b58c682db5574121b16ba51dfb55dc1f5ee4fae24a3cd4a1c8e8c6889ba2054971f7ba4159f9b303877a5071d05120f65f31fbfd5adca25
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku989265.exeFilesize
294KB
MD534e6825d8db9f89f87a980a7581130b6
SHA16e6eacaae9941f069a77c52828b39d374a131159
SHA256bb74e406915527b42c206db57e95aaffb33381685b26abf1f265ccb7ce78ff12
SHA5125a9e448a7947b5195a06bdd961126c5a518bef00f1a099c924b97e55fe7cffcc7f6f75719113649d058280103176f05e2dfd94815def26693daf6fae92bf837b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku989265.exeFilesize
294KB
MD534e6825d8db9f89f87a980a7581130b6
SHA16e6eacaae9941f069a77c52828b39d374a131159
SHA256bb74e406915527b42c206db57e95aaffb33381685b26abf1f265ccb7ce78ff12
SHA5125a9e448a7947b5195a06bdd961126c5a518bef00f1a099c924b97e55fe7cffcc7f6f75719113649d058280103176f05e2dfd94815def26693daf6fae92bf837b
-
memory/3924-140-0x0000000000590000-0x00000000005DB000-memory.dmpFilesize
300KB
-
memory/3924-141-0x0000000000790000-0x00000000007D6000-memory.dmpFilesize
280KB
-
memory/3924-142-0x0000000004BD0000-0x00000000050CE000-memory.dmpFilesize
5.0MB
-
memory/3924-143-0x0000000002200000-0x0000000002244000-memory.dmpFilesize
272KB
-
memory/3924-144-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/3924-145-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/3924-146-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/3924-147-0x0000000002200000-0x000000000223F000-memory.dmpFilesize
252KB
-
memory/3924-148-0x0000000002200000-0x000000000223F000-memory.dmpFilesize
252KB
-
memory/3924-150-0x0000000002200000-0x000000000223F000-memory.dmpFilesize
252KB
-
memory/3924-152-0x0000000002200000-0x000000000223F000-memory.dmpFilesize
252KB
-
memory/3924-154-0x0000000002200000-0x000000000223F000-memory.dmpFilesize
252KB
-
memory/3924-156-0x0000000002200000-0x000000000223F000-memory.dmpFilesize
252KB
-
memory/3924-158-0x0000000002200000-0x000000000223F000-memory.dmpFilesize
252KB
-
memory/3924-160-0x0000000002200000-0x000000000223F000-memory.dmpFilesize
252KB
-
memory/3924-162-0x0000000002200000-0x000000000223F000-memory.dmpFilesize
252KB
-
memory/3924-164-0x0000000002200000-0x000000000223F000-memory.dmpFilesize
252KB
-
memory/3924-166-0x0000000002200000-0x000000000223F000-memory.dmpFilesize
252KB
-
memory/3924-168-0x0000000002200000-0x000000000223F000-memory.dmpFilesize
252KB
-
memory/3924-170-0x0000000002200000-0x000000000223F000-memory.dmpFilesize
252KB
-
memory/3924-172-0x0000000002200000-0x000000000223F000-memory.dmpFilesize
252KB
-
memory/3924-174-0x0000000002200000-0x000000000223F000-memory.dmpFilesize
252KB
-
memory/3924-176-0x0000000002200000-0x000000000223F000-memory.dmpFilesize
252KB
-
memory/3924-178-0x0000000002200000-0x000000000223F000-memory.dmpFilesize
252KB
-
memory/3924-180-0x0000000002200000-0x000000000223F000-memory.dmpFilesize
252KB
-
memory/3924-182-0x0000000002200000-0x000000000223F000-memory.dmpFilesize
252KB
-
memory/3924-184-0x0000000002200000-0x000000000223F000-memory.dmpFilesize
252KB
-
memory/3924-186-0x0000000002200000-0x000000000223F000-memory.dmpFilesize
252KB
-
memory/3924-188-0x0000000002200000-0x000000000223F000-memory.dmpFilesize
252KB
-
memory/3924-190-0x0000000002200000-0x000000000223F000-memory.dmpFilesize
252KB
-
memory/3924-192-0x0000000002200000-0x000000000223F000-memory.dmpFilesize
252KB
-
memory/3924-194-0x0000000002200000-0x000000000223F000-memory.dmpFilesize
252KB
-
memory/3924-196-0x0000000002200000-0x000000000223F000-memory.dmpFilesize
252KB
-
memory/3924-198-0x0000000002200000-0x000000000223F000-memory.dmpFilesize
252KB
-
memory/3924-200-0x0000000002200000-0x000000000223F000-memory.dmpFilesize
252KB
-
memory/3924-202-0x0000000002200000-0x000000000223F000-memory.dmpFilesize
252KB
-
memory/3924-208-0x0000000002200000-0x000000000223F000-memory.dmpFilesize
252KB
-
memory/3924-206-0x0000000002200000-0x000000000223F000-memory.dmpFilesize
252KB
-
memory/3924-204-0x0000000002200000-0x000000000223F000-memory.dmpFilesize
252KB
-
memory/3924-210-0x0000000002200000-0x000000000223F000-memory.dmpFilesize
252KB
-
memory/3924-1053-0x00000000057E0000-0x0000000005DE6000-memory.dmpFilesize
6.0MB
-
memory/3924-1054-0x00000000051D0000-0x00000000052DA000-memory.dmpFilesize
1.0MB
-
memory/3924-1055-0x00000000052E0000-0x00000000052F2000-memory.dmpFilesize
72KB
-
memory/3924-1056-0x0000000005300000-0x000000000533E000-memory.dmpFilesize
248KB
-
memory/3924-1057-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/3924-1058-0x0000000005440000-0x000000000548B000-memory.dmpFilesize
300KB
-
memory/3924-1060-0x00000000055D0000-0x0000000005662000-memory.dmpFilesize
584KB
-
memory/3924-1061-0x0000000005670000-0x00000000056D6000-memory.dmpFilesize
408KB
-
memory/3924-1062-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/3924-1063-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/3924-1064-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/3924-1065-0x0000000006470000-0x00000000064E6000-memory.dmpFilesize
472KB
-
memory/3924-1066-0x00000000064F0000-0x0000000006540000-memory.dmpFilesize
320KB
-
memory/3924-1067-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/3924-1068-0x0000000006570000-0x0000000006732000-memory.dmpFilesize
1.8MB
-
memory/3924-1069-0x0000000006750000-0x0000000006C7C000-memory.dmpFilesize
5.2MB
-
memory/4616-134-0x0000000000BF0000-0x0000000000BFA000-memory.dmpFilesize
40KB
-
memory/5016-1075-0x0000000000940000-0x0000000000972000-memory.dmpFilesize
200KB
-
memory/5016-1076-0x0000000005380000-0x00000000053CB000-memory.dmpFilesize
300KB
-
memory/5016-1077-0x00000000054A0000-0x00000000054B0000-memory.dmpFilesize
64KB