Analysis
-
max time kernel
147s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 21:01
Static task
static1
Behavioral task
behavioral1
Sample
1d283cc040c678119d64518ff3d494b4498cb7191f777cd05c221440a7bb10b8.exe
Resource
win10v2004-20230220-en
General
-
Target
1d283cc040c678119d64518ff3d494b4498cb7191f777cd05c221440a7bb10b8.exe
-
Size
658KB
-
MD5
991abcb1778173580425643d08b21266
-
SHA1
e088315dd5dc813e1399b5026387e9f162281fc8
-
SHA256
1d283cc040c678119d64518ff3d494b4498cb7191f777cd05c221440a7bb10b8
-
SHA512
250ec70994cf6a38329fbb924c3c38db80d4c0d71d8b9098b312302785e4782389b07bee9a8ada8069470165967a0cb1b96b2f7cde6b5366b83541affb84cb43
-
SSDEEP
12288:/Mryy902gYt2ZWon8hBts9FQnqk/0VMTWUIf44CzWK4Q8v98Ec0T:FyOkooBtC2b9IA47Kk8EcC
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro4016.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro4016.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro4016.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro4016.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro4016.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro4016.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro4016.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/2324-190-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2324-191-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2324-194-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2324-197-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2324-200-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2324-201-0x0000000004AC0000-0x0000000004AD0000-memory.dmp family_redline behavioral1/memory/2324-203-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2324-205-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2324-207-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2324-209-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2324-211-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2324-213-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2324-215-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2324-217-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2324-219-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2324-221-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2324-223-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2324-225-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/2324-227-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un355974.exepro4016.exequ5406.exesi105460.exepid process 4772 un355974.exe 4216 pro4016.exe 2324 qu5406.exe 2824 si105460.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro4016.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro4016.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro4016.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un355974.exe1d283cc040c678119d64518ff3d494b4498cb7191f777cd05c221440a7bb10b8.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un355974.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un355974.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 1d283cc040c678119d64518ff3d494b4498cb7191f777cd05c221440a7bb10b8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1d283cc040c678119d64518ff3d494b4498cb7191f777cd05c221440a7bb10b8.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 448 sc.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2228 4216 WerFault.exe pro4016.exe 3992 2324 WerFault.exe qu5406.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro4016.exequ5406.exesi105460.exepid process 4216 pro4016.exe 4216 pro4016.exe 2324 qu5406.exe 2324 qu5406.exe 2824 si105460.exe 2824 si105460.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro4016.exequ5406.exesi105460.exedescription pid process Token: SeDebugPrivilege 4216 pro4016.exe Token: SeDebugPrivilege 2324 qu5406.exe Token: SeDebugPrivilege 2824 si105460.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
1d283cc040c678119d64518ff3d494b4498cb7191f777cd05c221440a7bb10b8.exeun355974.exedescription pid process target process PID 452 wrote to memory of 4772 452 1d283cc040c678119d64518ff3d494b4498cb7191f777cd05c221440a7bb10b8.exe un355974.exe PID 452 wrote to memory of 4772 452 1d283cc040c678119d64518ff3d494b4498cb7191f777cd05c221440a7bb10b8.exe un355974.exe PID 452 wrote to memory of 4772 452 1d283cc040c678119d64518ff3d494b4498cb7191f777cd05c221440a7bb10b8.exe un355974.exe PID 4772 wrote to memory of 4216 4772 un355974.exe pro4016.exe PID 4772 wrote to memory of 4216 4772 un355974.exe pro4016.exe PID 4772 wrote to memory of 4216 4772 un355974.exe pro4016.exe PID 4772 wrote to memory of 2324 4772 un355974.exe qu5406.exe PID 4772 wrote to memory of 2324 4772 un355974.exe qu5406.exe PID 4772 wrote to memory of 2324 4772 un355974.exe qu5406.exe PID 452 wrote to memory of 2824 452 1d283cc040c678119d64518ff3d494b4498cb7191f777cd05c221440a7bb10b8.exe si105460.exe PID 452 wrote to memory of 2824 452 1d283cc040c678119d64518ff3d494b4498cb7191f777cd05c221440a7bb10b8.exe si105460.exe PID 452 wrote to memory of 2824 452 1d283cc040c678119d64518ff3d494b4498cb7191f777cd05c221440a7bb10b8.exe si105460.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d283cc040c678119d64518ff3d494b4498cb7191f777cd05c221440a7bb10b8.exe"C:\Users\Admin\AppData\Local\Temp\1d283cc040c678119d64518ff3d494b4498cb7191f777cd05c221440a7bb10b8.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un355974.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un355974.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4016.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4016.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 10804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5406.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5406.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 15684⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si105460.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si105460.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4216 -ip 42161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2324 -ip 23241⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si105460.exeFilesize
175KB
MD575b2018850d2212d91ccc7ed5529493d
SHA125622cc4ca8a318e3f43c55731878b674f75d6cd
SHA2566f90a1bf26816acb4cbf7fc7074eabecb6880e670f83a8db0616ad1cd3d4f301
SHA51293795ea69069dece2752a5b563855347af5637f62de7f1b9e139aba44d0e072a29df7a52481fc7b7730466c2bd7183e9d4965b84164767920b6fa663be97dc6a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si105460.exeFilesize
175KB
MD575b2018850d2212d91ccc7ed5529493d
SHA125622cc4ca8a318e3f43c55731878b674f75d6cd
SHA2566f90a1bf26816acb4cbf7fc7074eabecb6880e670f83a8db0616ad1cd3d4f301
SHA51293795ea69069dece2752a5b563855347af5637f62de7f1b9e139aba44d0e072a29df7a52481fc7b7730466c2bd7183e9d4965b84164767920b6fa663be97dc6a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un355974.exeFilesize
516KB
MD50b05c0e64e885247555e008bf3bca287
SHA18b5f66110c66d46a053065aade08e3f43cf0ec92
SHA256897a7e46fc70e3a28ea08648772ed283efc7e328435e65afb1f224e0d44acf4f
SHA5125234a9aae1c77aea7e9041f012b0985e66b6abaa06c1247c618dcf4233b6616666689fb90682bb2d780ea033856c20d9ab87b7649a9936db17c24884455147bc
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un355974.exeFilesize
516KB
MD50b05c0e64e885247555e008bf3bca287
SHA18b5f66110c66d46a053065aade08e3f43cf0ec92
SHA256897a7e46fc70e3a28ea08648772ed283efc7e328435e65afb1f224e0d44acf4f
SHA5125234a9aae1c77aea7e9041f012b0985e66b6abaa06c1247c618dcf4233b6616666689fb90682bb2d780ea033856c20d9ab87b7649a9936db17c24884455147bc
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4016.exeFilesize
235KB
MD533756fae58f59e58f6d500d9a56a8a03
SHA1bec161347442b8b89638368b0b4f7de7da73ee7e
SHA2566fb68ec52b7e1a44e5e4f3aa346d7838f89f415cf7dad381e0d2d44b5d448dd6
SHA51235f0172d8ec196f1142d0d0d51b6935f724ad8424aa58713c3ce66c2a7e089c06a8746f792e778059b5e57b12df44e69671962e1909acdf9be91b9336458c9db
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4016.exeFilesize
235KB
MD533756fae58f59e58f6d500d9a56a8a03
SHA1bec161347442b8b89638368b0b4f7de7da73ee7e
SHA2566fb68ec52b7e1a44e5e4f3aa346d7838f89f415cf7dad381e0d2d44b5d448dd6
SHA51235f0172d8ec196f1142d0d0d51b6935f724ad8424aa58713c3ce66c2a7e089c06a8746f792e778059b5e57b12df44e69671962e1909acdf9be91b9336458c9db
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5406.exeFilesize
294KB
MD5b56bed95e3baf18a2007f17915f00355
SHA19458437f65a00dc86cbaa0bbe1159ce1a8e0e1eb
SHA25661c4d3bf85d5f91b1a293af625aca5a1033917b2493522b699e43252b5533da8
SHA51277b52e92c5483c90eff8bffb0c534a12c373ba5de48558eebe5c140cb1180fefd20536aacabdacae25f90f6ac5333101ac2d7d7df6841508013d7160797ef686
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5406.exeFilesize
294KB
MD5b56bed95e3baf18a2007f17915f00355
SHA19458437f65a00dc86cbaa0bbe1159ce1a8e0e1eb
SHA25661c4d3bf85d5f91b1a293af625aca5a1033917b2493522b699e43252b5533da8
SHA51277b52e92c5483c90eff8bffb0c534a12c373ba5de48558eebe5c140cb1180fefd20536aacabdacae25f90f6ac5333101ac2d7d7df6841508013d7160797ef686
-
memory/2324-227-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2324-1102-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/2324-1115-0x0000000004AC0000-0x0000000004AD0000-memory.dmpFilesize
64KB
-
memory/2324-1114-0x0000000007100000-0x0000000007150000-memory.dmpFilesize
320KB
-
memory/2324-1113-0x0000000007080000-0x00000000070F6000-memory.dmpFilesize
472KB
-
memory/2324-1112-0x0000000006790000-0x0000000006CBC000-memory.dmpFilesize
5.2MB
-
memory/2324-1111-0x00000000065B0000-0x0000000006772000-memory.dmpFilesize
1.8MB
-
memory/2324-1110-0x0000000004AC0000-0x0000000004AD0000-memory.dmpFilesize
64KB
-
memory/2324-1109-0x0000000004AC0000-0x0000000004AD0000-memory.dmpFilesize
64KB
-
memory/2324-1108-0x0000000004AC0000-0x0000000004AD0000-memory.dmpFilesize
64KB
-
memory/2324-1107-0x00000000063C0000-0x0000000006452000-memory.dmpFilesize
584KB
-
memory/2324-1106-0x0000000005CF0000-0x0000000005D56000-memory.dmpFilesize
408KB
-
memory/2324-1104-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/2324-1103-0x0000000004AC0000-0x0000000004AD0000-memory.dmpFilesize
64KB
-
memory/2324-1101-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/2324-1100-0x0000000005200000-0x0000000005818000-memory.dmpFilesize
6.1MB
-
memory/2324-225-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2324-223-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2324-221-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2324-219-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2324-217-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2324-215-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2324-190-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2324-191-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2324-194-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2324-193-0x0000000000750000-0x000000000079B000-memory.dmpFilesize
300KB
-
memory/2324-196-0x0000000004AC0000-0x0000000004AD0000-memory.dmpFilesize
64KB
-
memory/2324-199-0x0000000004AC0000-0x0000000004AD0000-memory.dmpFilesize
64KB
-
memory/2324-197-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2324-200-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2324-201-0x0000000004AC0000-0x0000000004AD0000-memory.dmpFilesize
64KB
-
memory/2324-203-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2324-205-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2324-207-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2324-209-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2324-211-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2324-213-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/2824-1121-0x0000000000180000-0x00000000001B2000-memory.dmpFilesize
200KB
-
memory/2824-1122-0x0000000004A70000-0x0000000004A80000-memory.dmpFilesize
64KB
-
memory/4216-175-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/4216-148-0x00000000004B0000-0x00000000004DD000-memory.dmpFilesize
180KB
-
memory/4216-183-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/4216-181-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4216-150-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/4216-180-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/4216-178-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/4216-155-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/4216-179-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/4216-177-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/4216-153-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/4216-184-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/4216-167-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/4216-169-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/4216-171-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/4216-165-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/4216-163-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/4216-161-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/4216-159-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/4216-157-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/4216-149-0x0000000004AA0000-0x0000000005044000-memory.dmpFilesize
5.6MB
-
memory/4216-173-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB
-
memory/4216-185-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4216-151-0x0000000004A20000-0x0000000004A32000-memory.dmpFilesize
72KB