Analysis
-
max time kernel
72s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 20:48
Static task
static1
Behavioral task
behavioral1
Sample
82bb44218c3841628aa6435d458015d05c7f66b34a01f8491ec0a9177f770b7f.exe
Resource
win10v2004-20230220-en
General
-
Target
82bb44218c3841628aa6435d458015d05c7f66b34a01f8491ec0a9177f770b7f.exe
-
Size
522KB
-
MD5
1c5d929b228cf36f06f32f1b248c3b64
-
SHA1
9a4c6accb53eac52ae0e02f41943ca6cbf379017
-
SHA256
82bb44218c3841628aa6435d458015d05c7f66b34a01f8491ec0a9177f770b7f
-
SHA512
f863224b580b1427eeed7bf9807378c0afedc3d01557bc4508152a6544840a4901ef5211c535e78392f68fd2c6577f49649438403037ca45cb85badccd846d4e
-
SSDEEP
12288:uMrqy90WXr0BlDMABsp+U8HW4QwzWKX9fjhiDvIZG:8yCpe+VHfQ5KX91iDp
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr012961.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr012961.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr012961.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr012961.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr012961.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr012961.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr012961.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 34 IoCs
Processes:
resource yara_rule behavioral1/memory/228-155-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/228-156-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/228-160-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/228-162-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/228-158-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/228-164-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/228-166-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/228-170-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/228-168-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/228-172-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/228-174-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/228-176-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/228-178-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/228-180-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/228-183-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/228-184-0x0000000004C30000-0x0000000004C40000-memory.dmp family_redline behavioral1/memory/228-189-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/228-187-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/228-191-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/228-193-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/228-195-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/228-197-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/228-199-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/228-201-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/228-203-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/228-205-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/228-207-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/228-209-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/228-211-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/228-213-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/228-215-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/228-217-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/228-219-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/228-221-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
ziWF3967.exejr012961.exeku418203.exelr795586.exepid process 1336 ziWF3967.exe 2296 jr012961.exe 228 ku418203.exe 2564 lr795586.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr012961.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr012961.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
82bb44218c3841628aa6435d458015d05c7f66b34a01f8491ec0a9177f770b7f.exeziWF3967.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 82bb44218c3841628aa6435d458015d05c7f66b34a01f8491ec0a9177f770b7f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 82bb44218c3841628aa6435d458015d05c7f66b34a01f8491ec0a9177f770b7f.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziWF3967.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziWF3967.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3652 228 WerFault.exe ku418203.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr012961.exeku418203.exelr795586.exepid process 2296 jr012961.exe 2296 jr012961.exe 228 ku418203.exe 228 ku418203.exe 2564 lr795586.exe 2564 lr795586.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr012961.exeku418203.exelr795586.exedescription pid process Token: SeDebugPrivilege 2296 jr012961.exe Token: SeDebugPrivilege 228 ku418203.exe Token: SeDebugPrivilege 2564 lr795586.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
82bb44218c3841628aa6435d458015d05c7f66b34a01f8491ec0a9177f770b7f.exeziWF3967.exedescription pid process target process PID 3344 wrote to memory of 1336 3344 82bb44218c3841628aa6435d458015d05c7f66b34a01f8491ec0a9177f770b7f.exe ziWF3967.exe PID 3344 wrote to memory of 1336 3344 82bb44218c3841628aa6435d458015d05c7f66b34a01f8491ec0a9177f770b7f.exe ziWF3967.exe PID 3344 wrote to memory of 1336 3344 82bb44218c3841628aa6435d458015d05c7f66b34a01f8491ec0a9177f770b7f.exe ziWF3967.exe PID 1336 wrote to memory of 2296 1336 ziWF3967.exe jr012961.exe PID 1336 wrote to memory of 2296 1336 ziWF3967.exe jr012961.exe PID 1336 wrote to memory of 228 1336 ziWF3967.exe ku418203.exe PID 1336 wrote to memory of 228 1336 ziWF3967.exe ku418203.exe PID 1336 wrote to memory of 228 1336 ziWF3967.exe ku418203.exe PID 3344 wrote to memory of 2564 3344 82bb44218c3841628aa6435d458015d05c7f66b34a01f8491ec0a9177f770b7f.exe lr795586.exe PID 3344 wrote to memory of 2564 3344 82bb44218c3841628aa6435d458015d05c7f66b34a01f8491ec0a9177f770b7f.exe lr795586.exe PID 3344 wrote to memory of 2564 3344 82bb44218c3841628aa6435d458015d05c7f66b34a01f8491ec0a9177f770b7f.exe lr795586.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\82bb44218c3841628aa6435d458015d05c7f66b34a01f8491ec0a9177f770b7f.exe"C:\Users\Admin\AppData\Local\Temp\82bb44218c3841628aa6435d458015d05c7f66b34a01f8491ec0a9177f770b7f.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziWF3967.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziWF3967.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr012961.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr012961.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku418203.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku418203.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 13564⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr795586.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr795586.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 228 -ip 2281⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr795586.exeFilesize
175KB
MD5b8be60cb8e3de97e8e9eb423faa8135b
SHA1f32d1bd7e5f8f3fea43f31fd5bf82ca014c8d5de
SHA2569598b5032197a3e9dc240fc42f5436474386cca5866e1bed517a4377cd8963fb
SHA51251f8a056c597447f02923591412a3d63cc078e6d37fe706312968ce4d749171195444e1507e0b2dfc65e1df3674fdfa4c266475de3de3f7d305d40802283791c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr795586.exeFilesize
175KB
MD5b8be60cb8e3de97e8e9eb423faa8135b
SHA1f32d1bd7e5f8f3fea43f31fd5bf82ca014c8d5de
SHA2569598b5032197a3e9dc240fc42f5436474386cca5866e1bed517a4377cd8963fb
SHA51251f8a056c597447f02923591412a3d63cc078e6d37fe706312968ce4d749171195444e1507e0b2dfc65e1df3674fdfa4c266475de3de3f7d305d40802283791c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziWF3967.exeFilesize
379KB
MD5ccd4b23e626c12158886aba4dfdb6bc3
SHA13643cf0bc71cbcfa262c0dbccdb412120c32c1b5
SHA25626203278ab15a7bed83d37a03c6e0dca68fac16b88826b588f64604705b7da7f
SHA51252f2afbfa0b6cc5e489bf93d74b1e580c88944a03f9ca05db8db70e5ea0d884b232cfeb3eca8fa39b2a0110b000f930cf1234fb506b7027801e63fcb9fc75c1e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziWF3967.exeFilesize
379KB
MD5ccd4b23e626c12158886aba4dfdb6bc3
SHA13643cf0bc71cbcfa262c0dbccdb412120c32c1b5
SHA25626203278ab15a7bed83d37a03c6e0dca68fac16b88826b588f64604705b7da7f
SHA51252f2afbfa0b6cc5e489bf93d74b1e580c88944a03f9ca05db8db70e5ea0d884b232cfeb3eca8fa39b2a0110b000f930cf1234fb506b7027801e63fcb9fc75c1e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr012961.exeFilesize
15KB
MD5dac2e561dc272977c9a8bcc9d3a34851
SHA1e9dd1bf22e532b02315bd98d715c62ecf185d37c
SHA256a6d7e4a8c9fc46279528d6a20c575eb8d4d92d088c8f373531a23c0792464ddf
SHA512cf0b55f5fb12f36ecc267d2a6df3e4c3340f67eed1224b76305d08ff971ba5e1635ed2535c6514a4b262412c8d2201269ebde273689e3467017795a30b0278eb
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr012961.exeFilesize
15KB
MD5dac2e561dc272977c9a8bcc9d3a34851
SHA1e9dd1bf22e532b02315bd98d715c62ecf185d37c
SHA256a6d7e4a8c9fc46279528d6a20c575eb8d4d92d088c8f373531a23c0792464ddf
SHA512cf0b55f5fb12f36ecc267d2a6df3e4c3340f67eed1224b76305d08ff971ba5e1635ed2535c6514a4b262412c8d2201269ebde273689e3467017795a30b0278eb
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku418203.exeFilesize
294KB
MD5360c6b8e3fb631ba3f839084ef7f9d93
SHA18aa6f13a6994eca0fca61af2361614f6c31208cc
SHA256dd484b776540a8773c2f42668c29d0b9077cf4002e6b27dc131070f817c21684
SHA512c13522a4fae072874de3357a114ce5f93423e1f3ecb06832612a30aa6adf3f1b8aa6b0fedf21ac3213f4c0e43d821460e505ad56e5cc85481392c40a33612475
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku418203.exeFilesize
294KB
MD5360c6b8e3fb631ba3f839084ef7f9d93
SHA18aa6f13a6994eca0fca61af2361614f6c31208cc
SHA256dd484b776540a8773c2f42668c29d0b9077cf4002e6b27dc131070f817c21684
SHA512c13522a4fae072874de3357a114ce5f93423e1f3ecb06832612a30aa6adf3f1b8aa6b0fedf21ac3213f4c0e43d821460e505ad56e5cc85481392c40a33612475
-
memory/228-153-0x0000000000640000-0x000000000068B000-memory.dmpFilesize
300KB
-
memory/228-154-0x0000000004C40000-0x00000000051E4000-memory.dmpFilesize
5.6MB
-
memory/228-155-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/228-156-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/228-160-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/228-162-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/228-158-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/228-164-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/228-166-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/228-170-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/228-168-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/228-172-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/228-174-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/228-176-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/228-178-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/228-180-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/228-182-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/228-183-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/228-184-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/228-189-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/228-187-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/228-186-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/228-191-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/228-193-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/228-195-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/228-197-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/228-199-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/228-201-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/228-203-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/228-205-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/228-207-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/228-209-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/228-211-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/228-213-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/228-215-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/228-217-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/228-219-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/228-221-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/228-1064-0x0000000005200000-0x0000000005818000-memory.dmpFilesize
6.1MB
-
memory/228-1065-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/228-1066-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/228-1067-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/228-1068-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/228-1070-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/228-1071-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/228-1072-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/228-1073-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/228-1074-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/228-1075-0x00000000065C0000-0x0000000006782000-memory.dmpFilesize
1.8MB
-
memory/228-1076-0x0000000006790000-0x0000000006CBC000-memory.dmpFilesize
5.2MB
-
memory/228-1077-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/228-1078-0x0000000006E00000-0x0000000006E76000-memory.dmpFilesize
472KB
-
memory/228-1079-0x0000000006E90000-0x0000000006EE0000-memory.dmpFilesize
320KB
-
memory/2296-147-0x0000000000440000-0x000000000044A000-memory.dmpFilesize
40KB
-
memory/2564-1085-0x0000000000500000-0x0000000000532000-memory.dmpFilesize
200KB
-
memory/2564-1086-0x00000000050B0000-0x00000000050C0000-memory.dmpFilesize
64KB