Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
03-04-2023 20:40
Static task
static1
Behavioral task
behavioral1
Sample
890373f4911c505f0f73fb43898346dadc5acb70cdf3abda7f8de127d767a131.exe
Resource
win10-20230220-en
General
-
Target
890373f4911c505f0f73fb43898346dadc5acb70cdf3abda7f8de127d767a131.exe
-
Size
658KB
-
MD5
b67315d958e41f9fb346b57813d213e7
-
SHA1
978e4bdd00e31bb93eff02f9c472f48c3d1c657f
-
SHA256
890373f4911c505f0f73fb43898346dadc5acb70cdf3abda7f8de127d767a131
-
SHA512
4c618d2ce3ab1014f0014f576c1c1d4905f8d76bc08d11aed1600cfc496d834a6aea4b632e442850f4c8edd86bbeae3ccab051c81b623d78aea8ee7342286fc4
-
SSDEEP
12288:xMrCy90HAXTl1yjKYptQljHdLt8rWFwys44OzWKhe8vrzzV:fyeAXTlEmmtGjHdhVKyt4XKrzB
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro4013.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro4013.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro4013.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro4013.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro4013.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro4013.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/1940-181-0x00000000022C0000-0x0000000002306000-memory.dmp family_redline behavioral1/memory/1940-182-0x0000000002510000-0x0000000002554000-memory.dmp family_redline behavioral1/memory/1940-187-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/1940-188-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/1940-190-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/1940-192-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/1940-194-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/1940-196-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/1940-198-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/1940-200-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/1940-202-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/1940-204-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/1940-206-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/1940-208-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/1940-210-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/1940-212-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/1940-214-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/1940-216-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/1940-218-0x0000000002510000-0x000000000254F000-memory.dmp family_redline behavioral1/memory/1940-220-0x0000000002510000-0x000000000254F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un384794.exepro4013.exequ3322.exesi750308.exepid process 3668 un384794.exe 2544 pro4013.exe 1940 qu3322.exe 4752 si750308.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro4013.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro4013.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro4013.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un384794.exe890373f4911c505f0f73fb43898346dadc5acb70cdf3abda7f8de127d767a131.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un384794.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 890373f4911c505f0f73fb43898346dadc5acb70cdf3abda7f8de127d767a131.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 890373f4911c505f0f73fb43898346dadc5acb70cdf3abda7f8de127d767a131.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un384794.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro4013.exequ3322.exesi750308.exepid process 2544 pro4013.exe 2544 pro4013.exe 1940 qu3322.exe 1940 qu3322.exe 4752 si750308.exe 4752 si750308.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro4013.exequ3322.exesi750308.exedescription pid process Token: SeDebugPrivilege 2544 pro4013.exe Token: SeDebugPrivilege 1940 qu3322.exe Token: SeDebugPrivilege 4752 si750308.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
890373f4911c505f0f73fb43898346dadc5acb70cdf3abda7f8de127d767a131.exeun384794.exedescription pid process target process PID 2908 wrote to memory of 3668 2908 890373f4911c505f0f73fb43898346dadc5acb70cdf3abda7f8de127d767a131.exe un384794.exe PID 2908 wrote to memory of 3668 2908 890373f4911c505f0f73fb43898346dadc5acb70cdf3abda7f8de127d767a131.exe un384794.exe PID 2908 wrote to memory of 3668 2908 890373f4911c505f0f73fb43898346dadc5acb70cdf3abda7f8de127d767a131.exe un384794.exe PID 3668 wrote to memory of 2544 3668 un384794.exe pro4013.exe PID 3668 wrote to memory of 2544 3668 un384794.exe pro4013.exe PID 3668 wrote to memory of 2544 3668 un384794.exe pro4013.exe PID 3668 wrote to memory of 1940 3668 un384794.exe qu3322.exe PID 3668 wrote to memory of 1940 3668 un384794.exe qu3322.exe PID 3668 wrote to memory of 1940 3668 un384794.exe qu3322.exe PID 2908 wrote to memory of 4752 2908 890373f4911c505f0f73fb43898346dadc5acb70cdf3abda7f8de127d767a131.exe si750308.exe PID 2908 wrote to memory of 4752 2908 890373f4911c505f0f73fb43898346dadc5acb70cdf3abda7f8de127d767a131.exe si750308.exe PID 2908 wrote to memory of 4752 2908 890373f4911c505f0f73fb43898346dadc5acb70cdf3abda7f8de127d767a131.exe si750308.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\890373f4911c505f0f73fb43898346dadc5acb70cdf3abda7f8de127d767a131.exe"C:\Users\Admin\AppData\Local\Temp\890373f4911c505f0f73fb43898346dadc5acb70cdf3abda7f8de127d767a131.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un384794.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un384794.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4013.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4013.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3322.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3322.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si750308.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si750308.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si750308.exeFilesize
175KB
MD574932296ad43422703cba856a91f8385
SHA1f0e3f219de75596c0d35ee3f7f631f8c6fc50589
SHA256e8bb83f676681048ff90e833c71db3ae6805db04e6412d5d5cfb815940d3ab5f
SHA5124f041bb3c1b5b5583b3a0293a9e1dd0cada0bbac2f01c271bb7518ec3839b77f2a3e1f382426013d8abb1974e38d669dd0d84eb08a201776643c91896827c543
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si750308.exeFilesize
175KB
MD574932296ad43422703cba856a91f8385
SHA1f0e3f219de75596c0d35ee3f7f631f8c6fc50589
SHA256e8bb83f676681048ff90e833c71db3ae6805db04e6412d5d5cfb815940d3ab5f
SHA5124f041bb3c1b5b5583b3a0293a9e1dd0cada0bbac2f01c271bb7518ec3839b77f2a3e1f382426013d8abb1974e38d669dd0d84eb08a201776643c91896827c543
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un384794.exeFilesize
515KB
MD5a4033a4a940256db04d50e124b6e9c1f
SHA16c118493a808a1b9c38c511fa01ab49b62e628e7
SHA25695058223aa53abeb185b39882a906c49a3930c74137a23cff84cb7c2ca6e5efe
SHA512bcfa10f19707d385341854be6de9f51924dc0fe4de0926b22f0105f0020b9dee5b771c7ec53702331ce0aa483b78530bd0ff067f0cf86039756c2ca40d8e4374
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un384794.exeFilesize
515KB
MD5a4033a4a940256db04d50e124b6e9c1f
SHA16c118493a808a1b9c38c511fa01ab49b62e628e7
SHA25695058223aa53abeb185b39882a906c49a3930c74137a23cff84cb7c2ca6e5efe
SHA512bcfa10f19707d385341854be6de9f51924dc0fe4de0926b22f0105f0020b9dee5b771c7ec53702331ce0aa483b78530bd0ff067f0cf86039756c2ca40d8e4374
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4013.exeFilesize
235KB
MD5312915610835acebc16d87db4c78a50a
SHA1a26641f3d78cc64512a36bd82b91d70e14bac9ef
SHA2563e2d6bf8f47abf642505180413cda85bb8f871e293f113388f0496c6dc599553
SHA512979743dcf83dd9634b475bb668ed47d71e5aacdc003beba983a5051e28fab3710aa2c31fce4a21e7574c24b15228158e2474a4cc20e97d938fb2aa7841663b11
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4013.exeFilesize
235KB
MD5312915610835acebc16d87db4c78a50a
SHA1a26641f3d78cc64512a36bd82b91d70e14bac9ef
SHA2563e2d6bf8f47abf642505180413cda85bb8f871e293f113388f0496c6dc599553
SHA512979743dcf83dd9634b475bb668ed47d71e5aacdc003beba983a5051e28fab3710aa2c31fce4a21e7574c24b15228158e2474a4cc20e97d938fb2aa7841663b11
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3322.exeFilesize
294KB
MD546b7845f490b60bdd947b65ed6ccd061
SHA1958c9ee396ec436d357978e5a1cd631a5e8f17e0
SHA256f0db9d78600bc647a40592d352d00849dbf16d9e9b68cba90553330b845df0ff
SHA512d211b676760c7d7f16c0cfc91a7ca79c9239e720674461acc9ef9bbec07e26380e03e0a78184f591dd0140ebcc70f7be83e3629701537e071f23543eb8912e67
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3322.exeFilesize
294KB
MD546b7845f490b60bdd947b65ed6ccd061
SHA1958c9ee396ec436d357978e5a1cd631a5e8f17e0
SHA256f0db9d78600bc647a40592d352d00849dbf16d9e9b68cba90553330b845df0ff
SHA512d211b676760c7d7f16c0cfc91a7ca79c9239e720674461acc9ef9bbec07e26380e03e0a78184f591dd0140ebcc70f7be83e3629701537e071f23543eb8912e67
-
memory/1940-1093-0x00000000057B0000-0x0000000005DB6000-memory.dmpFilesize
6.0MB
-
memory/1940-220-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/1940-1109-0x0000000006610000-0x0000000006B3C000-memory.dmpFilesize
5.2MB
-
memory/1940-1108-0x0000000006440000-0x0000000006602000-memory.dmpFilesize
1.8MB
-
memory/1940-1107-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/1940-194-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/1940-1106-0x00000000063D0000-0x0000000006420000-memory.dmpFilesize
320KB
-
memory/1940-1105-0x0000000006350000-0x00000000063C6000-memory.dmpFilesize
472KB
-
memory/1940-1104-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/1940-1103-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/1940-196-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/1940-1102-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/1940-1101-0x0000000005530000-0x0000000005596000-memory.dmpFilesize
408KB
-
memory/1940-1100-0x0000000005490000-0x0000000005522000-memory.dmpFilesize
584KB
-
memory/1940-1098-0x0000000005300000-0x000000000534B000-memory.dmpFilesize
300KB
-
memory/1940-1097-0x00000000051C0000-0x00000000051FE000-memory.dmpFilesize
248KB
-
memory/1940-1096-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/1940-1095-0x00000000051A0000-0x00000000051B2000-memory.dmpFilesize
72KB
-
memory/1940-1094-0x0000000004B40000-0x0000000004C4A000-memory.dmpFilesize
1.0MB
-
memory/1940-204-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/1940-218-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/1940-216-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/1940-214-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/1940-212-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/1940-210-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/1940-181-0x00000000022C0000-0x0000000002306000-memory.dmpFilesize
280KB
-
memory/1940-182-0x0000000002510000-0x0000000002554000-memory.dmpFilesize
272KB
-
memory/1940-183-0x0000000000740000-0x000000000078B000-memory.dmpFilesize
300KB
-
memory/1940-184-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/1940-192-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/1940-186-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/1940-187-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/1940-188-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/1940-190-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/1940-185-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/1940-208-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/1940-206-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/1940-198-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/1940-200-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/1940-202-0x0000000002510000-0x000000000254F000-memory.dmpFilesize
252KB
-
memory/2544-171-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2544-158-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/2544-149-0x0000000002190000-0x00000000021A2000-memory.dmpFilesize
72KB
-
memory/2544-139-0x0000000002190000-0x00000000021A8000-memory.dmpFilesize
96KB
-
memory/2544-140-0x0000000002190000-0x00000000021A2000-memory.dmpFilesize
72KB
-
memory/2544-176-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2544-174-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/2544-173-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/2544-172-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/2544-138-0x0000000004BD0000-0x00000000050CE000-memory.dmpFilesize
5.0MB
-
memory/2544-141-0x0000000002190000-0x00000000021A2000-memory.dmpFilesize
72KB
-
memory/2544-170-0x0000000002190000-0x00000000021A2000-memory.dmpFilesize
72KB
-
memory/2544-168-0x0000000002190000-0x00000000021A2000-memory.dmpFilesize
72KB
-
memory/2544-166-0x0000000002190000-0x00000000021A2000-memory.dmpFilesize
72KB
-
memory/2544-164-0x0000000002190000-0x00000000021A2000-memory.dmpFilesize
72KB
-
memory/2544-162-0x0000000002190000-0x00000000021A2000-memory.dmpFilesize
72KB
-
memory/2544-160-0x0000000002190000-0x00000000021A2000-memory.dmpFilesize
72KB
-
memory/2544-157-0x0000000002190000-0x00000000021A2000-memory.dmpFilesize
72KB
-
memory/2544-155-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/2544-153-0x0000000002190000-0x00000000021A2000-memory.dmpFilesize
72KB
-
memory/2544-154-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/2544-151-0x0000000002190000-0x00000000021A2000-memory.dmpFilesize
72KB
-
memory/2544-147-0x0000000002190000-0x00000000021A2000-memory.dmpFilesize
72KB
-
memory/2544-145-0x0000000002190000-0x00000000021A2000-memory.dmpFilesize
72KB
-
memory/2544-143-0x0000000002190000-0x00000000021A2000-memory.dmpFilesize
72KB
-
memory/2544-137-0x0000000000720000-0x000000000073A000-memory.dmpFilesize
104KB
-
memory/2544-136-0x00000000001D0000-0x00000000001FD000-memory.dmpFilesize
180KB
-
memory/4752-1115-0x0000000000E10000-0x0000000000E42000-memory.dmpFilesize
200KB
-
memory/4752-1116-0x0000000005880000-0x00000000058CB000-memory.dmpFilesize
300KB
-
memory/4752-1117-0x00000000056B0000-0x00000000056C0000-memory.dmpFilesize
64KB