Analysis
-
max time kernel
54s -
max time network
65s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
03-04-2023 20:58
Static task
static1
Behavioral task
behavioral1
Sample
28dfe706f9d3b327dd253451ef888e96ceeb3c2f608dfba2e0e6b519625889e4.exe
Resource
win10-20230220-en
General
-
Target
28dfe706f9d3b327dd253451ef888e96ceeb3c2f608dfba2e0e6b519625889e4.exe
-
Size
522KB
-
MD5
08125e561d244eed78e153bad1452340
-
SHA1
89521d73475525d925e70d21875ee29fe8af4d96
-
SHA256
28dfe706f9d3b327dd253451ef888e96ceeb3c2f608dfba2e0e6b519625889e4
-
SHA512
e1374408cb9c03d7df4cc68a8cc2438cb070b2fd69722bf201f5011a8d484983fe01f9e2e6729ef4ea4ccd529add15ea59d573cd98ffd6ee8a2ffbf5760709ad
-
SSDEEP
12288:KMrTy90wTQUEDhBvmZ9ZR6As10YYCoz8mN46CzWKdAgSZF8x:RyFTQJDhpm1RI1hmO67Kenex
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr994622.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr994622.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr994622.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr994622.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr994622.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr994622.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
Processes:
resource yara_rule behavioral1/memory/2060-140-0x0000000002060000-0x00000000020A6000-memory.dmp family_redline behavioral1/memory/2060-142-0x0000000002720000-0x0000000002764000-memory.dmp family_redline behavioral1/memory/2060-143-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/2060-144-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/2060-146-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/2060-148-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/2060-150-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/2060-152-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/2060-154-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/2060-157-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/2060-160-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/2060-164-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/2060-166-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/2060-168-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/2060-170-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/2060-172-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/2060-174-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/2060-176-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/2060-178-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/2060-180-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/2060-182-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/2060-184-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/2060-186-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/2060-188-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/2060-190-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/2060-192-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/2060-194-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/2060-196-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/2060-198-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/2060-200-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/2060-202-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/2060-204-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/2060-206-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/2060-208-0x0000000002720000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/2060-210-0x0000000002720000-0x000000000275F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
ziPK9492.exejr994622.exeku195452.exelr378868.exepid process 4088 ziPK9492.exe 2036 jr994622.exe 2060 ku195452.exe 4664 lr378868.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr994622.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr994622.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
28dfe706f9d3b327dd253451ef888e96ceeb3c2f608dfba2e0e6b519625889e4.exeziPK9492.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 28dfe706f9d3b327dd253451ef888e96ceeb3c2f608dfba2e0e6b519625889e4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 28dfe706f9d3b327dd253451ef888e96ceeb3c2f608dfba2e0e6b519625889e4.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziPK9492.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziPK9492.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr994622.exeku195452.exelr378868.exepid process 2036 jr994622.exe 2036 jr994622.exe 2060 ku195452.exe 2060 ku195452.exe 4664 lr378868.exe 4664 lr378868.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr994622.exeku195452.exelr378868.exedescription pid process Token: SeDebugPrivilege 2036 jr994622.exe Token: SeDebugPrivilege 2060 ku195452.exe Token: SeDebugPrivilege 4664 lr378868.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
28dfe706f9d3b327dd253451ef888e96ceeb3c2f608dfba2e0e6b519625889e4.exeziPK9492.exedescription pid process target process PID 4308 wrote to memory of 4088 4308 28dfe706f9d3b327dd253451ef888e96ceeb3c2f608dfba2e0e6b519625889e4.exe ziPK9492.exe PID 4308 wrote to memory of 4088 4308 28dfe706f9d3b327dd253451ef888e96ceeb3c2f608dfba2e0e6b519625889e4.exe ziPK9492.exe PID 4308 wrote to memory of 4088 4308 28dfe706f9d3b327dd253451ef888e96ceeb3c2f608dfba2e0e6b519625889e4.exe ziPK9492.exe PID 4088 wrote to memory of 2036 4088 ziPK9492.exe jr994622.exe PID 4088 wrote to memory of 2036 4088 ziPK9492.exe jr994622.exe PID 4088 wrote to memory of 2060 4088 ziPK9492.exe ku195452.exe PID 4088 wrote to memory of 2060 4088 ziPK9492.exe ku195452.exe PID 4088 wrote to memory of 2060 4088 ziPK9492.exe ku195452.exe PID 4308 wrote to memory of 4664 4308 28dfe706f9d3b327dd253451ef888e96ceeb3c2f608dfba2e0e6b519625889e4.exe lr378868.exe PID 4308 wrote to memory of 4664 4308 28dfe706f9d3b327dd253451ef888e96ceeb3c2f608dfba2e0e6b519625889e4.exe lr378868.exe PID 4308 wrote to memory of 4664 4308 28dfe706f9d3b327dd253451ef888e96ceeb3c2f608dfba2e0e6b519625889e4.exe lr378868.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\28dfe706f9d3b327dd253451ef888e96ceeb3c2f608dfba2e0e6b519625889e4.exe"C:\Users\Admin\AppData\Local\Temp\28dfe706f9d3b327dd253451ef888e96ceeb3c2f608dfba2e0e6b519625889e4.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPK9492.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPK9492.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr994622.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr994622.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku195452.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku195452.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr378868.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr378868.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr378868.exeFilesize
175KB
MD565df88c31b0caef7d4d61965a0f629bc
SHA18ad01c8e549e5af5a56437fae66601b5524d243c
SHA25655856b3e2fd6fe6c364297aaec59838787b4964e88c1d0dc5851f88633d48b7a
SHA512b3c2f919e8cc82e8fc1abe90058a2339d0de56893b09fb70f2a53c499989d28c43917f92de957f82c0d564bdde45e94aae956145831cffd9cdb96a65931c25d0
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr378868.exeFilesize
175KB
MD565df88c31b0caef7d4d61965a0f629bc
SHA18ad01c8e549e5af5a56437fae66601b5524d243c
SHA25655856b3e2fd6fe6c364297aaec59838787b4964e88c1d0dc5851f88633d48b7a
SHA512b3c2f919e8cc82e8fc1abe90058a2339d0de56893b09fb70f2a53c499989d28c43917f92de957f82c0d564bdde45e94aae956145831cffd9cdb96a65931c25d0
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPK9492.exeFilesize
379KB
MD52145719c8df48ee93ffcc94961129132
SHA13d8a1a345c5a8633586f949a815a0e312b78f61c
SHA25696a8b64a822baea461eaf71aaf5cdb61465760c16bab2c9edf7b1ce76406b293
SHA512725fe1ad6da10db61394df73754a279c0e9c0dcf67f89e0db93c208170d268cbc7e8be8d6c28a1a52e3e8a5b27ca7c934109224273bfe9d60d7f9901d375a050
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPK9492.exeFilesize
379KB
MD52145719c8df48ee93ffcc94961129132
SHA13d8a1a345c5a8633586f949a815a0e312b78f61c
SHA25696a8b64a822baea461eaf71aaf5cdb61465760c16bab2c9edf7b1ce76406b293
SHA512725fe1ad6da10db61394df73754a279c0e9c0dcf67f89e0db93c208170d268cbc7e8be8d6c28a1a52e3e8a5b27ca7c934109224273bfe9d60d7f9901d375a050
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr994622.exeFilesize
15KB
MD57ff24f9bb4b0dcc5bc325a3b9215b692
SHA1a2a74df8e9d1cd66156fe82f07c9c31a83e235cb
SHA2561466a0eac7850d5bbef7831b1a3628e7859089e6647abc9e9f96ab0de837c7d7
SHA5120b8af222520eb70d7ef37384b6489c33a438fcc0325d3b9e5cd313b6a734f665ffdc405690d31ec221dc3583562befa29e214053b732352af5eddd4733be2734
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr994622.exeFilesize
15KB
MD57ff24f9bb4b0dcc5bc325a3b9215b692
SHA1a2a74df8e9d1cd66156fe82f07c9c31a83e235cb
SHA2561466a0eac7850d5bbef7831b1a3628e7859089e6647abc9e9f96ab0de837c7d7
SHA5120b8af222520eb70d7ef37384b6489c33a438fcc0325d3b9e5cd313b6a734f665ffdc405690d31ec221dc3583562befa29e214053b732352af5eddd4733be2734
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku195452.exeFilesize
294KB
MD56d4736f10db18f610f659f8c799c9392
SHA1b433de01816df02380bc34bc2fe8a0c84859b79d
SHA2566673ac912bc7ca0660715ef4f2935b7fbb8e9d5c1a8ff291f7cf295074034ed7
SHA51295d066b502b8654d2953e8075c116e703cb0f6ef7836f9a98b2b5e79139c15285ce3fde444fb0aeb65cc3680b09667f0dd022c4f747e5d65924e76df49787e41
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku195452.exeFilesize
294KB
MD56d4736f10db18f610f659f8c799c9392
SHA1b433de01816df02380bc34bc2fe8a0c84859b79d
SHA2566673ac912bc7ca0660715ef4f2935b7fbb8e9d5c1a8ff291f7cf295074034ed7
SHA51295d066b502b8654d2953e8075c116e703cb0f6ef7836f9a98b2b5e79139c15285ce3fde444fb0aeb65cc3680b09667f0dd022c4f747e5d65924e76df49787e41
-
memory/2036-134-0x0000000000DD0000-0x0000000000DDA000-memory.dmpFilesize
40KB
-
memory/2060-140-0x0000000002060000-0x00000000020A6000-memory.dmpFilesize
280KB
-
memory/2060-141-0x0000000004C00000-0x00000000050FE000-memory.dmpFilesize
5.0MB
-
memory/2060-142-0x0000000002720000-0x0000000002764000-memory.dmpFilesize
272KB
-
memory/2060-143-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/2060-144-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/2060-146-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/2060-148-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/2060-150-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/2060-152-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/2060-154-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/2060-157-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/2060-156-0x00000000005D0000-0x000000000061B000-memory.dmpFilesize
300KB
-
memory/2060-159-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/2060-161-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/2060-160-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/2060-163-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/2060-164-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/2060-166-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/2060-168-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/2060-170-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/2060-172-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/2060-174-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/2060-176-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/2060-178-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/2060-180-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/2060-182-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/2060-184-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/2060-186-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/2060-188-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/2060-190-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/2060-192-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/2060-194-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/2060-196-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/2060-198-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/2060-200-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/2060-202-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/2060-204-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/2060-206-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/2060-208-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/2060-210-0x0000000002720000-0x000000000275F000-memory.dmpFilesize
252KB
-
memory/2060-1053-0x0000000005810000-0x0000000005E16000-memory.dmpFilesize
6.0MB
-
memory/2060-1054-0x0000000005200000-0x000000000530A000-memory.dmpFilesize
1.0MB
-
memory/2060-1055-0x0000000004BB0000-0x0000000004BC2000-memory.dmpFilesize
72KB
-
memory/2060-1056-0x0000000005310000-0x000000000534E000-memory.dmpFilesize
248KB
-
memory/2060-1057-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/2060-1058-0x0000000005450000-0x000000000549B000-memory.dmpFilesize
300KB
-
memory/2060-1060-0x00000000055D0000-0x0000000005636000-memory.dmpFilesize
408KB
-
memory/2060-1061-0x00000000062A0000-0x0000000006332000-memory.dmpFilesize
584KB
-
memory/2060-1062-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/2060-1063-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/2060-1064-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/2060-1065-0x0000000006380000-0x00000000063F6000-memory.dmpFilesize
472KB
-
memory/2060-1066-0x0000000006410000-0x0000000006460000-memory.dmpFilesize
320KB
-
memory/2060-1067-0x0000000006560000-0x0000000006722000-memory.dmpFilesize
1.8MB
-
memory/2060-1068-0x0000000006750000-0x0000000006C7C000-memory.dmpFilesize
5.2MB
-
memory/2060-1069-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/4664-1075-0x0000000000050000-0x0000000000082000-memory.dmpFilesize
200KB
-
memory/4664-1076-0x00000000048D0000-0x000000000491B000-memory.dmpFilesize
300KB
-
memory/4664-1077-0x0000000004930000-0x0000000004940000-memory.dmpFilesize
64KB