Analysis
-
max time kernel
84s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 21:03
Static task
static1
Behavioral task
behavioral1
Sample
debcab37a08da8ba930f9b2e5b4cc300a9d053f9ba4d5ca73b4bf49280f23a5d.exe
Resource
win10v2004-20230220-en
General
-
Target
debcab37a08da8ba930f9b2e5b4cc300a9d053f9ba4d5ca73b4bf49280f23a5d.exe
-
Size
521KB
-
MD5
4a0c33f7bed52b07055d4f6ef314ed08
-
SHA1
ed83fb5469d51c5110671406acae085753e6ade0
-
SHA256
debcab37a08da8ba930f9b2e5b4cc300a9d053f9ba4d5ca73b4bf49280f23a5d
-
SHA512
4e6db6cf2a1127dbd7ac2f6221b452869e3445c6e762b60710c248378faaadab30df3da9a9e9c13255de4c7c699f1d682ac210ab9276f9d6b134f3919f1bd413
-
SSDEEP
12288:zMrzy90w3mE5SYqaoZzJc8hJP88q44CzWLpFz9N7J:Qy933qaIzWa08L47zT1
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr430842.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr430842.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr430842.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr430842.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr430842.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr430842.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr430842.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/780-158-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/780-159-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/780-161-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/780-163-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/780-165-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/780-167-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/780-169-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/780-171-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/780-173-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/780-175-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/780-177-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/780-179-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/780-181-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/780-183-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/780-185-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/780-187-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/780-189-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/780-191-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/780-193-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/780-195-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/780-197-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/780-199-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/780-201-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/780-203-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/780-205-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/780-207-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/780-209-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/780-211-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/780-213-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/780-215-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/780-217-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/780-219-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/780-221-0x0000000005030000-0x000000000506F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
ziZR3729.exejr430842.exeku285795.exelr578975.exepid process 2932 ziZR3729.exe 3340 jr430842.exe 780 ku285795.exe 2672 lr578975.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr430842.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr430842.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
debcab37a08da8ba930f9b2e5b4cc300a9d053f9ba4d5ca73b4bf49280f23a5d.exeziZR3729.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce debcab37a08da8ba930f9b2e5b4cc300a9d053f9ba4d5ca73b4bf49280f23a5d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" debcab37a08da8ba930f9b2e5b4cc300a9d053f9ba4d5ca73b4bf49280f23a5d.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziZR3729.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziZR3729.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3508 780 WerFault.exe ku285795.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr430842.exeku285795.exelr578975.exepid process 3340 jr430842.exe 3340 jr430842.exe 780 ku285795.exe 780 ku285795.exe 2672 lr578975.exe 2672 lr578975.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr430842.exeku285795.exelr578975.exedescription pid process Token: SeDebugPrivilege 3340 jr430842.exe Token: SeDebugPrivilege 780 ku285795.exe Token: SeDebugPrivilege 2672 lr578975.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
debcab37a08da8ba930f9b2e5b4cc300a9d053f9ba4d5ca73b4bf49280f23a5d.exeziZR3729.exedescription pid process target process PID 2416 wrote to memory of 2932 2416 debcab37a08da8ba930f9b2e5b4cc300a9d053f9ba4d5ca73b4bf49280f23a5d.exe ziZR3729.exe PID 2416 wrote to memory of 2932 2416 debcab37a08da8ba930f9b2e5b4cc300a9d053f9ba4d5ca73b4bf49280f23a5d.exe ziZR3729.exe PID 2416 wrote to memory of 2932 2416 debcab37a08da8ba930f9b2e5b4cc300a9d053f9ba4d5ca73b4bf49280f23a5d.exe ziZR3729.exe PID 2932 wrote to memory of 3340 2932 ziZR3729.exe jr430842.exe PID 2932 wrote to memory of 3340 2932 ziZR3729.exe jr430842.exe PID 2932 wrote to memory of 780 2932 ziZR3729.exe ku285795.exe PID 2932 wrote to memory of 780 2932 ziZR3729.exe ku285795.exe PID 2932 wrote to memory of 780 2932 ziZR3729.exe ku285795.exe PID 2416 wrote to memory of 2672 2416 debcab37a08da8ba930f9b2e5b4cc300a9d053f9ba4d5ca73b4bf49280f23a5d.exe lr578975.exe PID 2416 wrote to memory of 2672 2416 debcab37a08da8ba930f9b2e5b4cc300a9d053f9ba4d5ca73b4bf49280f23a5d.exe lr578975.exe PID 2416 wrote to memory of 2672 2416 debcab37a08da8ba930f9b2e5b4cc300a9d053f9ba4d5ca73b4bf49280f23a5d.exe lr578975.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\debcab37a08da8ba930f9b2e5b4cc300a9d053f9ba4d5ca73b4bf49280f23a5d.exe"C:\Users\Admin\AppData\Local\Temp\debcab37a08da8ba930f9b2e5b4cc300a9d053f9ba4d5ca73b4bf49280f23a5d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziZR3729.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziZR3729.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr430842.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr430842.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku285795.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku285795.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 19284⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr578975.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr578975.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 780 -ip 7801⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr578975.exeFilesize
175KB
MD54ae4e6ce495af0af0b3bb25467e585c9
SHA16d0de52751ffa25bae1d2b1a531a08a9b8f13c7a
SHA256b81cdb896902143de069bd2bbc05cd621d544f1bef560e4f2055ed406e2017ba
SHA512548e99ab748087cb0e743e574e36817d17bedaa23fc200e7d1ef53a27799a806651424398ade1a2e8879c76c5bed721adf120783d528cb9e36a8823cf4213e57
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr578975.exeFilesize
175KB
MD54ae4e6ce495af0af0b3bb25467e585c9
SHA16d0de52751ffa25bae1d2b1a531a08a9b8f13c7a
SHA256b81cdb896902143de069bd2bbc05cd621d544f1bef560e4f2055ed406e2017ba
SHA512548e99ab748087cb0e743e574e36817d17bedaa23fc200e7d1ef53a27799a806651424398ade1a2e8879c76c5bed721adf120783d528cb9e36a8823cf4213e57
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziZR3729.exeFilesize
379KB
MD5e0ea3200d6ba420fe504ef5325ed1d6c
SHA16d92b2ee4ea516418a493ac26c03b842b0782c0d
SHA256553d53058da527b8ebc9e9df626ed8862e21a7be9a1950b720544015c867c61f
SHA51263c66d079e505c8f5e58dd4af5e35bf015ade5e2ce5350ed763ea9607b860c809df74220bd9e2c051caec3a4fb639e60fd473ee1a9a3e6a60962d79cbf425aff
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziZR3729.exeFilesize
379KB
MD5e0ea3200d6ba420fe504ef5325ed1d6c
SHA16d92b2ee4ea516418a493ac26c03b842b0782c0d
SHA256553d53058da527b8ebc9e9df626ed8862e21a7be9a1950b720544015c867c61f
SHA51263c66d079e505c8f5e58dd4af5e35bf015ade5e2ce5350ed763ea9607b860c809df74220bd9e2c051caec3a4fb639e60fd473ee1a9a3e6a60962d79cbf425aff
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr430842.exeFilesize
15KB
MD5c58e9e0f5d245d3ca06bc3dd9b82b9eb
SHA12a19d9b836b50411b2d9b19b277dd4ec19b56902
SHA256ac2301f25f17c81e0c10b27cf9a206c929621b3d36f2da5bc5d8f2579891bbcf
SHA5123724ef0907489a4f8b3f13261c46c0bfb69a348f440aadd4abc2e2ba97bfb5313e145ff3df0b033cbde9b43b707ca603344059db66370d1b8cec0cc4983d27b1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr430842.exeFilesize
15KB
MD5c58e9e0f5d245d3ca06bc3dd9b82b9eb
SHA12a19d9b836b50411b2d9b19b277dd4ec19b56902
SHA256ac2301f25f17c81e0c10b27cf9a206c929621b3d36f2da5bc5d8f2579891bbcf
SHA5123724ef0907489a4f8b3f13261c46c0bfb69a348f440aadd4abc2e2ba97bfb5313e145ff3df0b033cbde9b43b707ca603344059db66370d1b8cec0cc4983d27b1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku285795.exeFilesize
294KB
MD5dc34ada1a12ec13b9c0888560abdc7af
SHA1ceab6aa6eca6291df258cbc1be47c30258e60ad4
SHA256ef048faaacb046f1850a7627391ccd2629ec0802b8328fc2c45018358ebf19e8
SHA51255c5c691eec17e472f7a0c040b9f23593a5f2f84cbcac41230c39381eff36ef940269dde009fd35aa8882bfdd87e9f82ca6c5b8683de63e042fd78c80599f21f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku285795.exeFilesize
294KB
MD5dc34ada1a12ec13b9c0888560abdc7af
SHA1ceab6aa6eca6291df258cbc1be47c30258e60ad4
SHA256ef048faaacb046f1850a7627391ccd2629ec0802b8328fc2c45018358ebf19e8
SHA51255c5c691eec17e472f7a0c040b9f23593a5f2f84cbcac41230c39381eff36ef940269dde009fd35aa8882bfdd87e9f82ca6c5b8683de63e042fd78c80599f21f
-
memory/780-153-0x0000000004A80000-0x0000000005024000-memory.dmpFilesize
5.6MB
-
memory/780-154-0x0000000000680000-0x00000000006CB000-memory.dmpFilesize
300KB
-
memory/780-156-0x0000000004A70000-0x0000000004A80000-memory.dmpFilesize
64KB
-
memory/780-155-0x0000000004A70000-0x0000000004A80000-memory.dmpFilesize
64KB
-
memory/780-157-0x0000000004A70000-0x0000000004A80000-memory.dmpFilesize
64KB
-
memory/780-158-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/780-159-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/780-161-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/780-163-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/780-165-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/780-167-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/780-169-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/780-171-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/780-173-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/780-175-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/780-177-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/780-179-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/780-181-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/780-183-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/780-185-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/780-187-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/780-189-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/780-191-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/780-193-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/780-195-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/780-197-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/780-199-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/780-201-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/780-203-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/780-205-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/780-207-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/780-209-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/780-211-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/780-213-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/780-215-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/780-217-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/780-219-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/780-221-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/780-1064-0x0000000005200000-0x0000000005818000-memory.dmpFilesize
6.1MB
-
memory/780-1065-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/780-1066-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/780-1067-0x0000000004A70000-0x0000000004A80000-memory.dmpFilesize
64KB
-
memory/780-1068-0x0000000005A40000-0x0000000005A7C000-memory.dmpFilesize
240KB
-
memory/780-1070-0x0000000004A70000-0x0000000004A80000-memory.dmpFilesize
64KB
-
memory/780-1071-0x0000000004A70000-0x0000000004A80000-memory.dmpFilesize
64KB
-
memory/780-1072-0x0000000004A70000-0x0000000004A80000-memory.dmpFilesize
64KB
-
memory/780-1073-0x0000000005CF0000-0x0000000005D56000-memory.dmpFilesize
408KB
-
memory/780-1074-0x0000000006500000-0x0000000006592000-memory.dmpFilesize
584KB
-
memory/780-1075-0x00000000065F0000-0x00000000067B2000-memory.dmpFilesize
1.8MB
-
memory/780-1076-0x00000000067C0000-0x0000000006CEC000-memory.dmpFilesize
5.2MB
-
memory/780-1077-0x0000000004A70000-0x0000000004A80000-memory.dmpFilesize
64KB
-
memory/780-1078-0x0000000007080000-0x00000000070F6000-memory.dmpFilesize
472KB
-
memory/780-1079-0x0000000007100000-0x0000000007150000-memory.dmpFilesize
320KB
-
memory/2672-1086-0x0000000000680000-0x00000000006B2000-memory.dmpFilesize
200KB
-
memory/2672-1087-0x0000000005020000-0x0000000005030000-memory.dmpFilesize
64KB
-
memory/3340-147-0x0000000000190000-0x000000000019A000-memory.dmpFilesize
40KB