Analysis
-
max time kernel
90s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 20:44
Static task
static1
Behavioral task
behavioral1
Sample
1eae666a8237a1ee02950d54ffb50fd463c07f133b5dd9e2541c9ba17f7d4bd2.exe
Resource
win10v2004-20230220-en
General
-
Target
1eae666a8237a1ee02950d54ffb50fd463c07f133b5dd9e2541c9ba17f7d4bd2.exe
-
Size
658KB
-
MD5
a8ca4077961dbb5ecf4dd916aec6487e
-
SHA1
5e7552aea1d52a50a88bf27c26b76e8219625263
-
SHA256
1eae666a8237a1ee02950d54ffb50fd463c07f133b5dd9e2541c9ba17f7d4bd2
-
SHA512
af0ceec16d48d5a87ae0865f66a981a678eeade468a7957669772288d39e730a9fd06ca6e0bc9515a20692f11521b5287911f6585fff17c7b6e962d7f9d66e0e
-
SSDEEP
12288:7Mr2y907yyb043GkjtAZMQHyKekclsQX449zWKQf8vdN4B3M/8:9yF40lkjtsJSKeMQI4AKb4lx
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro5795.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro5795.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro5795.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro5795.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro5795.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro5795.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro5795.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/4740-192-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/4740-195-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/4740-193-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/4740-197-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/4740-199-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/4740-201-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/4740-203-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/4740-205-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/4740-207-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/4740-209-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/4740-211-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/4740-213-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/4740-215-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/4740-217-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/4740-219-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/4740-223-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/4740-221-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/4740-225-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un317131.exepro5795.exequ3757.exesi111514.exepid process 2092 un317131.exe 1508 pro5795.exe 4740 qu3757.exe 4164 si111514.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro5795.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro5795.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro5795.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
1eae666a8237a1ee02950d54ffb50fd463c07f133b5dd9e2541c9ba17f7d4bd2.exeun317131.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 1eae666a8237a1ee02950d54ffb50fd463c07f133b5dd9e2541c9ba17f7d4bd2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1eae666a8237a1ee02950d54ffb50fd463c07f133b5dd9e2541c9ba17f7d4bd2.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un317131.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un317131.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3444 1508 WerFault.exe pro5795.exe 4616 4740 WerFault.exe qu3757.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro5795.exequ3757.exesi111514.exepid process 1508 pro5795.exe 1508 pro5795.exe 4740 qu3757.exe 4740 qu3757.exe 4164 si111514.exe 4164 si111514.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro5795.exequ3757.exesi111514.exedescription pid process Token: SeDebugPrivilege 1508 pro5795.exe Token: SeDebugPrivilege 4740 qu3757.exe Token: SeDebugPrivilege 4164 si111514.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
1eae666a8237a1ee02950d54ffb50fd463c07f133b5dd9e2541c9ba17f7d4bd2.exeun317131.exedescription pid process target process PID 4592 wrote to memory of 2092 4592 1eae666a8237a1ee02950d54ffb50fd463c07f133b5dd9e2541c9ba17f7d4bd2.exe un317131.exe PID 4592 wrote to memory of 2092 4592 1eae666a8237a1ee02950d54ffb50fd463c07f133b5dd9e2541c9ba17f7d4bd2.exe un317131.exe PID 4592 wrote to memory of 2092 4592 1eae666a8237a1ee02950d54ffb50fd463c07f133b5dd9e2541c9ba17f7d4bd2.exe un317131.exe PID 2092 wrote to memory of 1508 2092 un317131.exe pro5795.exe PID 2092 wrote to memory of 1508 2092 un317131.exe pro5795.exe PID 2092 wrote to memory of 1508 2092 un317131.exe pro5795.exe PID 2092 wrote to memory of 4740 2092 un317131.exe qu3757.exe PID 2092 wrote to memory of 4740 2092 un317131.exe qu3757.exe PID 2092 wrote to memory of 4740 2092 un317131.exe qu3757.exe PID 4592 wrote to memory of 4164 4592 1eae666a8237a1ee02950d54ffb50fd463c07f133b5dd9e2541c9ba17f7d4bd2.exe si111514.exe PID 4592 wrote to memory of 4164 4592 1eae666a8237a1ee02950d54ffb50fd463c07f133b5dd9e2541c9ba17f7d4bd2.exe si111514.exe PID 4592 wrote to memory of 4164 4592 1eae666a8237a1ee02950d54ffb50fd463c07f133b5dd9e2541c9ba17f7d4bd2.exe si111514.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1eae666a8237a1ee02950d54ffb50fd463c07f133b5dd9e2541c9ba17f7d4bd2.exe"C:\Users\Admin\AppData\Local\Temp\1eae666a8237a1ee02950d54ffb50fd463c07f133b5dd9e2541c9ba17f7d4bd2.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un317131.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un317131.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5795.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5795.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 10804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3757.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3757.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 13484⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si111514.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si111514.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1508 -ip 15081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4740 -ip 47401⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si111514.exeFilesize
175KB
MD573e9b41191d55c17f5d211fb0b3434e9
SHA1c4de7b8d7587746bb42cecb4e56149c8837da638
SHA256b8b34f743a9d62d9cf8bb3dc91e66c88abf08fa025d793501744cb2775579ad8
SHA5128a9643049be542b78b85f748db1e97486b8f190103557cbe2e27fa0ebe539346b8cb9f2a7abf82819aae2732813b6702801790c520a292d3661f27cad779d858
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si111514.exeFilesize
175KB
MD573e9b41191d55c17f5d211fb0b3434e9
SHA1c4de7b8d7587746bb42cecb4e56149c8837da638
SHA256b8b34f743a9d62d9cf8bb3dc91e66c88abf08fa025d793501744cb2775579ad8
SHA5128a9643049be542b78b85f748db1e97486b8f190103557cbe2e27fa0ebe539346b8cb9f2a7abf82819aae2732813b6702801790c520a292d3661f27cad779d858
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un317131.exeFilesize
516KB
MD5d67bdcc7438828cc2474beb862d29f30
SHA1e8b541f6b8e385767385e6b79b2c02194820f405
SHA25679dc54022508597ddbdc861ab58d2ef3978c3805e4839829dc1870cfd6dc11de
SHA512a9ee192ddfb7d8c0713bea6b17858189a6660e19fec79e10dc1619f1ccd007e05c5639bb9ab157564e776693cb8073a26d6094fa20bbc2c88586a003cbdca170
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un317131.exeFilesize
516KB
MD5d67bdcc7438828cc2474beb862d29f30
SHA1e8b541f6b8e385767385e6b79b2c02194820f405
SHA25679dc54022508597ddbdc861ab58d2ef3978c3805e4839829dc1870cfd6dc11de
SHA512a9ee192ddfb7d8c0713bea6b17858189a6660e19fec79e10dc1619f1ccd007e05c5639bb9ab157564e776693cb8073a26d6094fa20bbc2c88586a003cbdca170
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5795.exeFilesize
235KB
MD5c324c5d166e70edbe3eace1bfbc12d70
SHA103c0e1761834f2e54980f7c18d054b52bc322651
SHA2567904a928368a420d968aebf446271e692905f9c14ddad67d4bfa89622665d45a
SHA512dddfc8df48fc553c92206403e33de08026faeec51566e24b020f5aba80a50d5409765260efcfaa57e6c034badfae0ae68e534bffa2672581a34ea46d9938963a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5795.exeFilesize
235KB
MD5c324c5d166e70edbe3eace1bfbc12d70
SHA103c0e1761834f2e54980f7c18d054b52bc322651
SHA2567904a928368a420d968aebf446271e692905f9c14ddad67d4bfa89622665d45a
SHA512dddfc8df48fc553c92206403e33de08026faeec51566e24b020f5aba80a50d5409765260efcfaa57e6c034badfae0ae68e534bffa2672581a34ea46d9938963a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3757.exeFilesize
294KB
MD53d819f69b6d6c529675913bdb717f3dc
SHA10f748135fbf282cc08cbd015f9c5e483eeeca6cf
SHA256784208cbc529dd76b87cea20834ce13567c24dfb838283c83dcad44d3d49220a
SHA512726faa23f412f1ea1f50873502908e61a684fd93ca8f6ad1fd70ef326538f612ccdccd8e87a8b582867c73aa42896f4848d24c31646ad4313646bbc181a0f991
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3757.exeFilesize
294KB
MD53d819f69b6d6c529675913bdb717f3dc
SHA10f748135fbf282cc08cbd015f9c5e483eeeca6cf
SHA256784208cbc529dd76b87cea20834ce13567c24dfb838283c83dcad44d3d49220a
SHA512726faa23f412f1ea1f50873502908e61a684fd93ca8f6ad1fd70ef326538f612ccdccd8e87a8b582867c73aa42896f4848d24c31646ad4313646bbc181a0f991
-
memory/1508-148-0x0000000001FB0000-0x0000000001FDD000-memory.dmpFilesize
180KB
-
memory/1508-149-0x0000000004C40000-0x00000000051E4000-memory.dmpFilesize
5.6MB
-
memory/1508-150-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/1508-151-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/1508-152-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/1508-153-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1508-154-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1508-156-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1508-158-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1508-160-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1508-162-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1508-164-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1508-166-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1508-168-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1508-170-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1508-172-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1508-174-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1508-176-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1508-178-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1508-180-0x0000000004B50000-0x0000000004B62000-memory.dmpFilesize
72KB
-
memory/1508-181-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1508-182-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/1508-183-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/1508-184-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/1508-186-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4164-1124-0x00000000004C0000-0x00000000004F2000-memory.dmpFilesize
200KB
-
memory/4164-1125-0x0000000004D80000-0x0000000004D90000-memory.dmpFilesize
64KB
-
memory/4740-195-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/4740-244-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/4740-193-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/4740-197-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/4740-199-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/4740-201-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/4740-203-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/4740-205-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/4740-207-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/4740-209-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/4740-211-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/4740-213-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/4740-215-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/4740-217-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/4740-219-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/4740-223-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/4740-221-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/4740-225-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/4740-246-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/4740-192-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/4740-248-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/4740-1101-0x00000000051B0000-0x00000000057C8000-memory.dmpFilesize
6.1MB
-
memory/4740-1102-0x00000000057D0000-0x00000000058DA000-memory.dmpFilesize
1.0MB
-
memory/4740-1104-0x0000000004BB0000-0x0000000004BC2000-memory.dmpFilesize
72KB
-
memory/4740-1103-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/4740-1105-0x00000000058E0000-0x000000000591C000-memory.dmpFilesize
240KB
-
memory/4740-1107-0x0000000002000000-0x000000000204B000-memory.dmpFilesize
300KB
-
memory/4740-1108-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/4740-1109-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/4740-1110-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/4740-1111-0x0000000005BB0000-0x0000000005C42000-memory.dmpFilesize
584KB
-
memory/4740-1112-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/4740-1113-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/4740-1114-0x0000000006470000-0x00000000064E6000-memory.dmpFilesize
472KB
-
memory/4740-191-0x0000000002000000-0x000000000204B000-memory.dmpFilesize
300KB
-
memory/4740-1115-0x00000000064F0000-0x0000000006540000-memory.dmpFilesize
320KB
-
memory/4740-1116-0x0000000006560000-0x0000000006722000-memory.dmpFilesize
1.8MB
-
memory/4740-1117-0x0000000006730000-0x0000000006C5C000-memory.dmpFilesize
5.2MB