Analysis
-
max time kernel
62s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 20:51
Static task
static1
Behavioral task
behavioral1
Sample
57db639ed8374970ec4fbb8ca1df2fb41e92aa13c4ac55e611c1e1c79c639c20.exe
Resource
win10v2004-20230220-en
General
-
Target
57db639ed8374970ec4fbb8ca1df2fb41e92aa13c4ac55e611c1e1c79c639c20.exe
-
Size
521KB
-
MD5
abc75d0e4f86f117119bb2ac8bce2248
-
SHA1
8829da2eb04c50c08e3700e3ed4bc87c86f48def
-
SHA256
57db639ed8374970ec4fbb8ca1df2fb41e92aa13c4ac55e611c1e1c79c639c20
-
SHA512
9a980b8c7fc4dc39876066356b96bbb40563a7cd2245551177bd1fa9564f74944fdb9179053902494c92dbbb77ba734b5940273938995637da58001824c50539
-
SSDEEP
12288:yMrRy90VXSKbnFiBrzNc8ljv8ea447zWKi4YJXNi3J8HPnsEC:jysnFiBrzyyUeb4mKrYJekPn4
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr449358.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr449358.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr449358.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr449358.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr449358.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr449358.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr449358.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 34 IoCs
Processes:
resource yara_rule behavioral1/memory/3604-155-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3604-156-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3604-158-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3604-160-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3604-162-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3604-164-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3604-166-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3604-168-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3604-172-0x0000000004B30000-0x0000000004B40000-memory.dmp family_redline behavioral1/memory/3604-175-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3604-171-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3604-177-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3604-179-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3604-181-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3604-183-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3604-185-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3604-187-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3604-189-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3604-191-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3604-193-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3604-195-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3604-197-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3604-199-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3604-201-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3604-203-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3604-205-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3604-207-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3604-209-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3604-211-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3604-213-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3604-215-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3604-217-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3604-219-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline behavioral1/memory/3604-221-0x0000000004A60000-0x0000000004A9F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
zicB7153.exejr449358.exeku124922.exelr801688.exepid process 4056 zicB7153.exe 4288 jr449358.exe 3604 ku124922.exe 4172 lr801688.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr449358.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr449358.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
57db639ed8374970ec4fbb8ca1df2fb41e92aa13c4ac55e611c1e1c79c639c20.exezicB7153.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 57db639ed8374970ec4fbb8ca1df2fb41e92aa13c4ac55e611c1e1c79c639c20.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 57db639ed8374970ec4fbb8ca1df2fb41e92aa13c4ac55e611c1e1c79c639c20.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zicB7153.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zicB7153.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4612 3604 WerFault.exe ku124922.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr449358.exeku124922.exelr801688.exepid process 4288 jr449358.exe 4288 jr449358.exe 3604 ku124922.exe 3604 ku124922.exe 4172 lr801688.exe 4172 lr801688.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr449358.exeku124922.exelr801688.exedescription pid process Token: SeDebugPrivilege 4288 jr449358.exe Token: SeDebugPrivilege 3604 ku124922.exe Token: SeDebugPrivilege 4172 lr801688.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
57db639ed8374970ec4fbb8ca1df2fb41e92aa13c4ac55e611c1e1c79c639c20.exezicB7153.exedescription pid process target process PID 2192 wrote to memory of 4056 2192 57db639ed8374970ec4fbb8ca1df2fb41e92aa13c4ac55e611c1e1c79c639c20.exe zicB7153.exe PID 2192 wrote to memory of 4056 2192 57db639ed8374970ec4fbb8ca1df2fb41e92aa13c4ac55e611c1e1c79c639c20.exe zicB7153.exe PID 2192 wrote to memory of 4056 2192 57db639ed8374970ec4fbb8ca1df2fb41e92aa13c4ac55e611c1e1c79c639c20.exe zicB7153.exe PID 4056 wrote to memory of 4288 4056 zicB7153.exe jr449358.exe PID 4056 wrote to memory of 4288 4056 zicB7153.exe jr449358.exe PID 4056 wrote to memory of 3604 4056 zicB7153.exe ku124922.exe PID 4056 wrote to memory of 3604 4056 zicB7153.exe ku124922.exe PID 4056 wrote to memory of 3604 4056 zicB7153.exe ku124922.exe PID 2192 wrote to memory of 4172 2192 57db639ed8374970ec4fbb8ca1df2fb41e92aa13c4ac55e611c1e1c79c639c20.exe lr801688.exe PID 2192 wrote to memory of 4172 2192 57db639ed8374970ec4fbb8ca1df2fb41e92aa13c4ac55e611c1e1c79c639c20.exe lr801688.exe PID 2192 wrote to memory of 4172 2192 57db639ed8374970ec4fbb8ca1df2fb41e92aa13c4ac55e611c1e1c79c639c20.exe lr801688.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\57db639ed8374970ec4fbb8ca1df2fb41e92aa13c4ac55e611c1e1c79c639c20.exe"C:\Users\Admin\AppData\Local\Temp\57db639ed8374970ec4fbb8ca1df2fb41e92aa13c4ac55e611c1e1c79c639c20.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zicB7153.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zicB7153.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr449358.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr449358.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku124922.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku124922.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3604 -s 13484⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr801688.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr801688.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3604 -ip 36041⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr801688.exeFilesize
175KB
MD5317432ac22547442916b73abb1ac9391
SHA1a295c636369212933ce7244d93c7e54e09a0c74e
SHA256df113e106c9028deb76daac9b6672a11a525f82e48859bb66acc5b00103efcba
SHA5126c6f21b2312402ec24bd4a3dd9ad1addca52abb4579fff9f0e94dff6efbc275a11c3d345528d62cb46ed999306e2590ce42278a8a51467b824d0561b4462d06e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr801688.exeFilesize
175KB
MD5317432ac22547442916b73abb1ac9391
SHA1a295c636369212933ce7244d93c7e54e09a0c74e
SHA256df113e106c9028deb76daac9b6672a11a525f82e48859bb66acc5b00103efcba
SHA5126c6f21b2312402ec24bd4a3dd9ad1addca52abb4579fff9f0e94dff6efbc275a11c3d345528d62cb46ed999306e2590ce42278a8a51467b824d0561b4462d06e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zicB7153.exeFilesize
379KB
MD5145129847b47b70b74f6aba2e2239aea
SHA1ebf66c2a5de5b09b7653cfae64533956832206a5
SHA2560ac36bf008277f5fc278d742f72dc811c2e80d446f11a319b470f859168b01af
SHA5120ac0abd422af1ec5336c0b3cba4be90482916791c4ed474c8d22040940a40509b52ee6a4a4751713981440a0d7df6645fc081805891d06a7dbd2ecf11e8a3d18
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zicB7153.exeFilesize
379KB
MD5145129847b47b70b74f6aba2e2239aea
SHA1ebf66c2a5de5b09b7653cfae64533956832206a5
SHA2560ac36bf008277f5fc278d742f72dc811c2e80d446f11a319b470f859168b01af
SHA5120ac0abd422af1ec5336c0b3cba4be90482916791c4ed474c8d22040940a40509b52ee6a4a4751713981440a0d7df6645fc081805891d06a7dbd2ecf11e8a3d18
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr449358.exeFilesize
15KB
MD510c4a0815858ed7df75646d37f0602d9
SHA1a969c7f28ec9fb0eab3f9593b92a4b92d01bb067
SHA256e1ec766da1309e73b67d62963be0e753eb5b877672ddac304a48b6a2e3c2e7d6
SHA51242db92c44c0b3bdc3928ed427f82011cefbd68c7806be35b17485288a5943c72c1479e27aef623342926f1e4778d1267f1b5ec859fceca1e869a5e2860f0f5d7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr449358.exeFilesize
15KB
MD510c4a0815858ed7df75646d37f0602d9
SHA1a969c7f28ec9fb0eab3f9593b92a4b92d01bb067
SHA256e1ec766da1309e73b67d62963be0e753eb5b877672ddac304a48b6a2e3c2e7d6
SHA51242db92c44c0b3bdc3928ed427f82011cefbd68c7806be35b17485288a5943c72c1479e27aef623342926f1e4778d1267f1b5ec859fceca1e869a5e2860f0f5d7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku124922.exeFilesize
294KB
MD57dda03bc4d17dd1dfe74ceaf839b4b3a
SHA173697637449437fc278a114d28c8791272f85e32
SHA256f821bcbf8774b47053ff255f1eae223fdbc1aa74e11fee7c35ee0dfcf686f7f9
SHA512ce77736c3912d34df49871e4af9c5313f4d4084325ac0272778f4621d0935ba6499eeb65cc7fe015bb180b2c9aecbc5e315d87328a604914513d265cc09a78cc
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku124922.exeFilesize
294KB
MD57dda03bc4d17dd1dfe74ceaf839b4b3a
SHA173697637449437fc278a114d28c8791272f85e32
SHA256f821bcbf8774b47053ff255f1eae223fdbc1aa74e11fee7c35ee0dfcf686f7f9
SHA512ce77736c3912d34df49871e4af9c5313f4d4084325ac0272778f4621d0935ba6499eeb65cc7fe015bb180b2c9aecbc5e315d87328a604914513d265cc09a78cc
-
memory/3604-153-0x00000000020E0000-0x000000000212B000-memory.dmpFilesize
300KB
-
memory/3604-154-0x0000000004B40000-0x00000000050E4000-memory.dmpFilesize
5.6MB
-
memory/3604-155-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3604-156-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3604-158-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3604-160-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3604-162-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3604-164-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3604-166-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3604-168-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3604-169-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/3604-172-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/3604-174-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/3604-175-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3604-171-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3604-177-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3604-179-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3604-181-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3604-183-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3604-185-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3604-187-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3604-189-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3604-191-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3604-193-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3604-195-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3604-197-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3604-199-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3604-201-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3604-203-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3604-205-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3604-207-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3604-209-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3604-211-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3604-213-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3604-215-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3604-217-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3604-219-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3604-221-0x0000000004A60000-0x0000000004A9F000-memory.dmpFilesize
252KB
-
memory/3604-1064-0x0000000005200000-0x0000000005818000-memory.dmpFilesize
6.1MB
-
memory/3604-1065-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/3604-1066-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/3604-1067-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/3604-1068-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/3604-1071-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/3604-1070-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/3604-1072-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/3604-1073-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/3604-1074-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/3604-1075-0x00000000064B0000-0x0000000006672000-memory.dmpFilesize
1.8MB
-
memory/3604-1076-0x0000000006680000-0x0000000006BAC000-memory.dmpFilesize
5.2MB
-
memory/3604-1077-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/3604-1078-0x0000000006F40000-0x0000000006FB6000-memory.dmpFilesize
472KB
-
memory/3604-1079-0x0000000006FC0000-0x0000000007010000-memory.dmpFilesize
320KB
-
memory/4172-1085-0x0000000000320000-0x0000000000352000-memory.dmpFilesize
200KB
-
memory/4172-1086-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/4288-147-0x0000000000D20000-0x0000000000D2A000-memory.dmpFilesize
40KB