Analysis
-
max time kernel
58s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 20:47
Static task
static1
Behavioral task
behavioral1
Sample
e05d3a5e6ddf76c689a7faf1927dce546a6c3f6d22e4a623dc0573e0ceb117e4.exe
Resource
win10v2004-20230221-en
General
-
Target
e05d3a5e6ddf76c689a7faf1927dce546a6c3f6d22e4a623dc0573e0ceb117e4.exe
-
Size
521KB
-
MD5
d61bccbbcd5398345f37ab6de7c3c084
-
SHA1
1a5e2041593f1a9d359fbf24d6992342af8b7137
-
SHA256
e05d3a5e6ddf76c689a7faf1927dce546a6c3f6d22e4a623dc0573e0ceb117e4
-
SHA512
5c40f09ba0dd3983af5587cd8d2ad7883ac79648bd07a7ea96422e25e4b296477fbebe39b5fa878cb76e16cd33202ad79d1197e0b572a926c3ce7bbd7df85ea5
-
SSDEEP
12288:QMr1y90MUKsLjsiSQbhEQtJf8IF4nRzWKAt8hsD2z6DB:1yuLYiSWEQ4IWnkKcso
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr843122.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr843122.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr843122.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr843122.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr843122.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr843122.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr843122.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/4788-158-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/4788-161-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/4788-159-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/4788-163-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/4788-165-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/4788-167-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/4788-169-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/4788-171-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/4788-173-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/4788-175-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/4788-177-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/4788-179-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/4788-181-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/4788-183-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/4788-185-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/4788-187-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/4788-189-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/4788-191-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/4788-193-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/4788-197-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/4788-195-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/4788-199-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/4788-201-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/4788-203-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/4788-207-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/4788-205-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/4788-211-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/4788-209-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/4788-213-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/4788-215-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/4788-217-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/4788-221-0x0000000002710000-0x000000000274F000-memory.dmp family_redline behavioral1/memory/4788-219-0x0000000002710000-0x000000000274F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
zirq9888.exejr843122.exeku328784.exelr762049.exepid process 4696 zirq9888.exe 2688 jr843122.exe 4788 ku328784.exe 1976 lr762049.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr843122.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr843122.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
zirq9888.exee05d3a5e6ddf76c689a7faf1927dce546a6c3f6d22e4a623dc0573e0ceb117e4.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zirq9888.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zirq9888.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce e05d3a5e6ddf76c689a7faf1927dce546a6c3f6d22e4a623dc0573e0ceb117e4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" e05d3a5e6ddf76c689a7faf1927dce546a6c3f6d22e4a623dc0573e0ceb117e4.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3308 4788 WerFault.exe ku328784.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr843122.exeku328784.exelr762049.exepid process 2688 jr843122.exe 2688 jr843122.exe 4788 ku328784.exe 4788 ku328784.exe 1976 lr762049.exe 1976 lr762049.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr843122.exeku328784.exelr762049.exedescription pid process Token: SeDebugPrivilege 2688 jr843122.exe Token: SeDebugPrivilege 4788 ku328784.exe Token: SeDebugPrivilege 1976 lr762049.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
e05d3a5e6ddf76c689a7faf1927dce546a6c3f6d22e4a623dc0573e0ceb117e4.exezirq9888.exedescription pid process target process PID 2320 wrote to memory of 4696 2320 e05d3a5e6ddf76c689a7faf1927dce546a6c3f6d22e4a623dc0573e0ceb117e4.exe zirq9888.exe PID 2320 wrote to memory of 4696 2320 e05d3a5e6ddf76c689a7faf1927dce546a6c3f6d22e4a623dc0573e0ceb117e4.exe zirq9888.exe PID 2320 wrote to memory of 4696 2320 e05d3a5e6ddf76c689a7faf1927dce546a6c3f6d22e4a623dc0573e0ceb117e4.exe zirq9888.exe PID 4696 wrote to memory of 2688 4696 zirq9888.exe jr843122.exe PID 4696 wrote to memory of 2688 4696 zirq9888.exe jr843122.exe PID 4696 wrote to memory of 4788 4696 zirq9888.exe ku328784.exe PID 4696 wrote to memory of 4788 4696 zirq9888.exe ku328784.exe PID 4696 wrote to memory of 4788 4696 zirq9888.exe ku328784.exe PID 2320 wrote to memory of 1976 2320 e05d3a5e6ddf76c689a7faf1927dce546a6c3f6d22e4a623dc0573e0ceb117e4.exe lr762049.exe PID 2320 wrote to memory of 1976 2320 e05d3a5e6ddf76c689a7faf1927dce546a6c3f6d22e4a623dc0573e0ceb117e4.exe lr762049.exe PID 2320 wrote to memory of 1976 2320 e05d3a5e6ddf76c689a7faf1927dce546a6c3f6d22e4a623dc0573e0ceb117e4.exe lr762049.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e05d3a5e6ddf76c689a7faf1927dce546a6c3f6d22e4a623dc0573e0ceb117e4.exe"C:\Users\Admin\AppData\Local\Temp\e05d3a5e6ddf76c689a7faf1927dce546a6c3f6d22e4a623dc0573e0ceb117e4.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zirq9888.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zirq9888.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr843122.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr843122.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku328784.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku328784.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 19044⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr762049.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr762049.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4788 -ip 47881⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr762049.exeFilesize
175KB
MD506392d504f3ee83a618507c84a6f89bc
SHA1a51e4cbec5a504212cf546749e09c30a9d8b7ffe
SHA2564651c874929f8afe398694d66126df3ad6ac7537aa9352384de834303134c4b8
SHA51254cea7f5568e0d1c1e0a9efd9ea2764b1b07197d60b5506a377ac9e1a4c1972c0caa5ea5391183b0109eee4dcf6314105918e46c8672e8bdb95b928386dd199d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr762049.exeFilesize
175KB
MD506392d504f3ee83a618507c84a6f89bc
SHA1a51e4cbec5a504212cf546749e09c30a9d8b7ffe
SHA2564651c874929f8afe398694d66126df3ad6ac7537aa9352384de834303134c4b8
SHA51254cea7f5568e0d1c1e0a9efd9ea2764b1b07197d60b5506a377ac9e1a4c1972c0caa5ea5391183b0109eee4dcf6314105918e46c8672e8bdb95b928386dd199d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zirq9888.exeFilesize
379KB
MD5f95e6497840a51c80f14aa8d38d8feb4
SHA12bc882894e53138310a6dcd70dbad9cdd56c2181
SHA256679de484037b738a7fe04ddcb572f5783a88ba7872421168e790cac374b9cc65
SHA5127a5142a34a4bd356d5408f97e08eee34ce6826c8523fbf477386483086071b9a9cd9f168ddd1779044f5358faa94b1e2f9b99a5ed5621d64f75f8bd7c11c5afd
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zirq9888.exeFilesize
379KB
MD5f95e6497840a51c80f14aa8d38d8feb4
SHA12bc882894e53138310a6dcd70dbad9cdd56c2181
SHA256679de484037b738a7fe04ddcb572f5783a88ba7872421168e790cac374b9cc65
SHA5127a5142a34a4bd356d5408f97e08eee34ce6826c8523fbf477386483086071b9a9cd9f168ddd1779044f5358faa94b1e2f9b99a5ed5621d64f75f8bd7c11c5afd
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr843122.exeFilesize
15KB
MD5c741c3e37303cf102018587bf6d277c2
SHA181ea94c12cc1c23b447d66841de6510b3bacf130
SHA256a9df1d27e452a9cc735b2898326a1c8c320061b81019c5b09dfa645a5f18f2c7
SHA5125c410e2c729f43d68aa04786c8ada01ab7cd9334571f78d26e7753e73e562570669c5853f1ba9881f63bea1c6763edbd034f53e90b1c8be71050eee85e7354fb
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr843122.exeFilesize
15KB
MD5c741c3e37303cf102018587bf6d277c2
SHA181ea94c12cc1c23b447d66841de6510b3bacf130
SHA256a9df1d27e452a9cc735b2898326a1c8c320061b81019c5b09dfa645a5f18f2c7
SHA5125c410e2c729f43d68aa04786c8ada01ab7cd9334571f78d26e7753e73e562570669c5853f1ba9881f63bea1c6763edbd034f53e90b1c8be71050eee85e7354fb
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku328784.exeFilesize
294KB
MD5d9ef50f38db843d87cbbefcd5521136e
SHA16c59ec2c8d5355348c7747da0333b517a378cae8
SHA256e9b499006b289b1a5c8fe1f3c0675207c9008149819bccc3906c3f5db1f179d8
SHA5127e1b16606efffe328c827241f741bc12a9ca225c36143685fd372ae97f6bef1d944b4239b8cc10c7a3d524b73743c5eb212ccfde6c3307c4bc0725a5b8b91bf2
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku328784.exeFilesize
294KB
MD5d9ef50f38db843d87cbbefcd5521136e
SHA16c59ec2c8d5355348c7747da0333b517a378cae8
SHA256e9b499006b289b1a5c8fe1f3c0675207c9008149819bccc3906c3f5db1f179d8
SHA5127e1b16606efffe328c827241f741bc12a9ca225c36143685fd372ae97f6bef1d944b4239b8cc10c7a3d524b73743c5eb212ccfde6c3307c4bc0725a5b8b91bf2
-
memory/1976-1083-0x0000000000AF0000-0x0000000000B22000-memory.dmpFilesize
200KB
-
memory/1976-1085-0x0000000005690000-0x00000000056A0000-memory.dmpFilesize
64KB
-
memory/1976-1084-0x0000000005690000-0x00000000056A0000-memory.dmpFilesize
64KB
-
memory/2688-147-0x0000000000B10000-0x0000000000B1A000-memory.dmpFilesize
40KB
-
memory/4788-187-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/4788-201-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/4788-154-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/4788-158-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/4788-161-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/4788-159-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/4788-163-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/4788-165-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/4788-167-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/4788-169-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/4788-171-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/4788-173-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/4788-175-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/4788-177-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/4788-179-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/4788-181-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/4788-183-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/4788-185-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/4788-157-0x0000000004CE0000-0x0000000005284000-memory.dmpFilesize
5.6MB
-
memory/4788-189-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/4788-191-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/4788-193-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/4788-197-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/4788-195-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/4788-199-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/4788-155-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/4788-203-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/4788-207-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/4788-205-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/4788-211-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/4788-209-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/4788-213-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/4788-215-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/4788-217-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/4788-221-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/4788-219-0x0000000002710000-0x000000000274F000-memory.dmpFilesize
252KB
-
memory/4788-1064-0x0000000005290000-0x00000000058A8000-memory.dmpFilesize
6.1MB
-
memory/4788-1065-0x0000000004B80000-0x0000000004C8A000-memory.dmpFilesize
1.0MB
-
memory/4788-1066-0x00000000058B0000-0x00000000058C2000-memory.dmpFilesize
72KB
-
memory/4788-1067-0x00000000059D0000-0x0000000005A0C000-memory.dmpFilesize
240KB
-
memory/4788-1068-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/4788-1070-0x0000000005BB0000-0x0000000005C16000-memory.dmpFilesize
408KB
-
memory/4788-1071-0x0000000006270000-0x0000000006302000-memory.dmpFilesize
584KB
-
memory/4788-1072-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/4788-1073-0x0000000002500000-0x0000000002576000-memory.dmpFilesize
472KB
-
memory/4788-1074-0x0000000007710000-0x0000000007760000-memory.dmpFilesize
320KB
-
memory/4788-156-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/4788-153-0x0000000002120000-0x000000000216B000-memory.dmpFilesize
300KB
-
memory/4788-1075-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/4788-1076-0x0000000007790000-0x0000000007952000-memory.dmpFilesize
1.8MB
-
memory/4788-1077-0x0000000007960000-0x0000000007E8C000-memory.dmpFilesize
5.2MB