Analysis
-
max time kernel
111s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 21:04
Static task
static1
Behavioral task
behavioral1
Sample
6a29f191089f76a860fe6ec2f1ddc22219f51c2eaaf166a1a1354b0c84e8100a.exe
Resource
win10v2004-20230220-en
General
-
Target
6a29f191089f76a860fe6ec2f1ddc22219f51c2eaaf166a1a1354b0c84e8100a.exe
-
Size
658KB
-
MD5
b17bcf009d5d1454381cb4c3e3fb96e3
-
SHA1
1573975302be2133ac7dc65e87248b728cb5c223
-
SHA256
6a29f191089f76a860fe6ec2f1ddc22219f51c2eaaf166a1a1354b0c84e8100a
-
SHA512
6b8b5f58b2c1df26cb420d1c0b0c797c770864eafdd100e0d5c6df2348ed3aa8cb0b9590b1f494854445363c72b885ef4c3714f5be9c9f62d8d5807268a88636
-
SSDEEP
12288:9Mroy90Vzoe+WKfIxGEteTSQT3JToG44NzWKDr8vyfbv3:hyltfILtSfT3Fov4QK1bv3
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro6436.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro6436.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro6436.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro6436.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro6436.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro6436.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro6436.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/3408-192-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/3408-194-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/3408-191-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/3408-196-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/3408-198-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/3408-200-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/3408-202-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/3408-204-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/3408-207-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/3408-210-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/3408-213-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/3408-215-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/3408-217-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/3408-219-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/3408-221-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/3408-223-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/3408-225-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/3408-227-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un060861.exepro6436.exequ1002.exesi886350.exepid process 2152 un060861.exe 4396 pro6436.exe 3408 qu1002.exe 2640 si886350.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro6436.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro6436.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro6436.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
6a29f191089f76a860fe6ec2f1ddc22219f51c2eaaf166a1a1354b0c84e8100a.exeun060861.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 6a29f191089f76a860fe6ec2f1ddc22219f51c2eaaf166a1a1354b0c84e8100a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 6a29f191089f76a860fe6ec2f1ddc22219f51c2eaaf166a1a1354b0c84e8100a.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un060861.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un060861.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4668 4396 WerFault.exe pro6436.exe 2132 3408 WerFault.exe qu1002.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro6436.exequ1002.exesi886350.exepid process 4396 pro6436.exe 4396 pro6436.exe 3408 qu1002.exe 3408 qu1002.exe 2640 si886350.exe 2640 si886350.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro6436.exequ1002.exesi886350.exedescription pid process Token: SeDebugPrivilege 4396 pro6436.exe Token: SeDebugPrivilege 3408 qu1002.exe Token: SeDebugPrivilege 2640 si886350.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
6a29f191089f76a860fe6ec2f1ddc22219f51c2eaaf166a1a1354b0c84e8100a.exeun060861.exedescription pid process target process PID 2208 wrote to memory of 2152 2208 6a29f191089f76a860fe6ec2f1ddc22219f51c2eaaf166a1a1354b0c84e8100a.exe un060861.exe PID 2208 wrote to memory of 2152 2208 6a29f191089f76a860fe6ec2f1ddc22219f51c2eaaf166a1a1354b0c84e8100a.exe un060861.exe PID 2208 wrote to memory of 2152 2208 6a29f191089f76a860fe6ec2f1ddc22219f51c2eaaf166a1a1354b0c84e8100a.exe un060861.exe PID 2152 wrote to memory of 4396 2152 un060861.exe pro6436.exe PID 2152 wrote to memory of 4396 2152 un060861.exe pro6436.exe PID 2152 wrote to memory of 4396 2152 un060861.exe pro6436.exe PID 2152 wrote to memory of 3408 2152 un060861.exe qu1002.exe PID 2152 wrote to memory of 3408 2152 un060861.exe qu1002.exe PID 2152 wrote to memory of 3408 2152 un060861.exe qu1002.exe PID 2208 wrote to memory of 2640 2208 6a29f191089f76a860fe6ec2f1ddc22219f51c2eaaf166a1a1354b0c84e8100a.exe si886350.exe PID 2208 wrote to memory of 2640 2208 6a29f191089f76a860fe6ec2f1ddc22219f51c2eaaf166a1a1354b0c84e8100a.exe si886350.exe PID 2208 wrote to memory of 2640 2208 6a29f191089f76a860fe6ec2f1ddc22219f51c2eaaf166a1a1354b0c84e8100a.exe si886350.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a29f191089f76a860fe6ec2f1ddc22219f51c2eaaf166a1a1354b0c84e8100a.exe"C:\Users\Admin\AppData\Local\Temp\6a29f191089f76a860fe6ec2f1ddc22219f51c2eaaf166a1a1354b0c84e8100a.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un060861.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un060861.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6436.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6436.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 10804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1002.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1002.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 13484⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si886350.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si886350.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4396 -ip 43961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3408 -ip 34081⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si886350.exeFilesize
175KB
MD53ca7dd200817279a1a56fb1c7408177f
SHA17d1f477e7c2c5683de05cbda4ba9af97b689b6d2
SHA256baefc2f1fed4042e1852809ff360c39d3f454d959944c9c56c0011e1f11719db
SHA51253b85da7bc87e01dad39a56fa16daa8b96b39262b35011c2bae34c67deb49c08fc04cdf500a56af92ed0625bcd87ed036341dc5296eaa3dd8eb470470cef2a02
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si886350.exeFilesize
175KB
MD53ca7dd200817279a1a56fb1c7408177f
SHA17d1f477e7c2c5683de05cbda4ba9af97b689b6d2
SHA256baefc2f1fed4042e1852809ff360c39d3f454d959944c9c56c0011e1f11719db
SHA51253b85da7bc87e01dad39a56fa16daa8b96b39262b35011c2bae34c67deb49c08fc04cdf500a56af92ed0625bcd87ed036341dc5296eaa3dd8eb470470cef2a02
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un060861.exeFilesize
516KB
MD55fb9537549bada4000b1d4964d6d679c
SHA1c5c166fef16347cc7182b068ae66a115824eefb1
SHA256d9438a0e62ab262057d96c4cedfbe11178680339c9d3867dc015e87d2144ffa5
SHA512efe978eb91ec560c9d0c7499675a453f2dd483ed2558c2ff99b70d609217952149c3223f41d760f2a3ba495944ea893b19435b06e0dab64f0174a6765c6cb39e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un060861.exeFilesize
516KB
MD55fb9537549bada4000b1d4964d6d679c
SHA1c5c166fef16347cc7182b068ae66a115824eefb1
SHA256d9438a0e62ab262057d96c4cedfbe11178680339c9d3867dc015e87d2144ffa5
SHA512efe978eb91ec560c9d0c7499675a453f2dd483ed2558c2ff99b70d609217952149c3223f41d760f2a3ba495944ea893b19435b06e0dab64f0174a6765c6cb39e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6436.exeFilesize
235KB
MD51367269354d1328d57a21ac91b44d93d
SHA1d4c926d631f1f6acdf654fa3b61f6e9715b69226
SHA2560a4f23a46be25c7152955549cbbab6d26ae0dd630806f78f0104f975b5bfc843
SHA51238f7f46ca9c5f15339f9776382aa778ca73d1e43fbb85daf3f8f382e82083d496958109ff006f83667f80bc8540a926ea1fc120d68f3f64db246f361be05cc09
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6436.exeFilesize
235KB
MD51367269354d1328d57a21ac91b44d93d
SHA1d4c926d631f1f6acdf654fa3b61f6e9715b69226
SHA2560a4f23a46be25c7152955549cbbab6d26ae0dd630806f78f0104f975b5bfc843
SHA51238f7f46ca9c5f15339f9776382aa778ca73d1e43fbb85daf3f8f382e82083d496958109ff006f83667f80bc8540a926ea1fc120d68f3f64db246f361be05cc09
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1002.exeFilesize
294KB
MD52155a78716eb65675a86c7fea4a3ef4c
SHA1cdd97680fc4f37c1cb669d53c827e95ed295f27e
SHA256a42f99752af2936b5bcad56d3fe824dd7ce9faa4eae64119b2b061fae52368df
SHA512d1e4d733cb70fafc9fbcae54fc1c9ed04748e3c14fdd4f0f1c1ea8bcff098503f7a84c82998ec56ac8bd3f0f6afa236da2b19889c1b20fcb476c500b8601fdbb
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1002.exeFilesize
294KB
MD52155a78716eb65675a86c7fea4a3ef4c
SHA1cdd97680fc4f37c1cb669d53c827e95ed295f27e
SHA256a42f99752af2936b5bcad56d3fe824dd7ce9faa4eae64119b2b061fae52368df
SHA512d1e4d733cb70fafc9fbcae54fc1c9ed04748e3c14fdd4f0f1c1ea8bcff098503f7a84c82998ec56ac8bd3f0f6afa236da2b19889c1b20fcb476c500b8601fdbb
-
memory/2640-1123-0x0000000005A30000-0x0000000005A40000-memory.dmpFilesize
64KB
-
memory/2640-1122-0x0000000005A30000-0x0000000005A40000-memory.dmpFilesize
64KB
-
memory/2640-1121-0x0000000000E50000-0x0000000000E82000-memory.dmpFilesize
200KB
-
memory/3408-1102-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/3408-1105-0x0000000005BB0000-0x0000000005C42000-memory.dmpFilesize
584KB
-
memory/3408-1115-0x0000000007970000-0x0000000007E9C000-memory.dmpFilesize
5.2MB
-
memory/3408-1114-0x00000000077A0000-0x0000000007962000-memory.dmpFilesize
1.8MB
-
memory/3408-1113-0x0000000002250000-0x00000000022A0000-memory.dmpFilesize
320KB
-
memory/3408-1112-0x00000000076E0000-0x0000000007756000-memory.dmpFilesize
472KB
-
memory/3408-1111-0x0000000004B80000-0x0000000004B90000-memory.dmpFilesize
64KB
-
memory/3408-1110-0x0000000004B80000-0x0000000004B90000-memory.dmpFilesize
64KB
-
memory/3408-1109-0x0000000004B80000-0x0000000004B90000-memory.dmpFilesize
64KB
-
memory/3408-1108-0x0000000004B80000-0x0000000004B90000-memory.dmpFilesize
64KB
-
memory/3408-1107-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/3408-1104-0x0000000004B80000-0x0000000004B90000-memory.dmpFilesize
64KB
-
memory/3408-1103-0x00000000058C0000-0x00000000058FC000-memory.dmpFilesize
240KB
-
memory/3408-1101-0x0000000005760000-0x000000000586A000-memory.dmpFilesize
1.0MB
-
memory/3408-1100-0x0000000005140000-0x0000000005758000-memory.dmpFilesize
6.1MB
-
memory/3408-227-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/3408-225-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/3408-223-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/3408-221-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/3408-219-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/3408-192-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/3408-194-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/3408-191-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/3408-196-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/3408-198-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/3408-200-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/3408-202-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/3408-204-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/3408-206-0x0000000000660000-0x00000000006AB000-memory.dmpFilesize
300KB
-
memory/3408-207-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/3408-209-0x0000000004B80000-0x0000000004B90000-memory.dmpFilesize
64KB
-
memory/3408-211-0x0000000004B80000-0x0000000004B90000-memory.dmpFilesize
64KB
-
memory/3408-210-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/3408-213-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/3408-215-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/3408-217-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/4396-177-0x0000000002410000-0x0000000002422000-memory.dmpFilesize
72KB
-
memory/4396-184-0x0000000004B50000-0x0000000004B60000-memory.dmpFilesize
64KB
-
memory/4396-157-0x0000000002410000-0x0000000002422000-memory.dmpFilesize
72KB
-
memory/4396-185-0x0000000004B50000-0x0000000004B60000-memory.dmpFilesize
64KB
-
memory/4396-175-0x0000000002410000-0x0000000002422000-memory.dmpFilesize
72KB
-
memory/4396-183-0x0000000004B50000-0x0000000004B60000-memory.dmpFilesize
64KB
-
memory/4396-181-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4396-173-0x0000000002410000-0x0000000002422000-memory.dmpFilesize
72KB
-
memory/4396-180-0x0000000004B50000-0x0000000004B60000-memory.dmpFilesize
64KB
-
memory/4396-179-0x0000000004B50000-0x0000000004B60000-memory.dmpFilesize
64KB
-
memory/4396-161-0x0000000002410000-0x0000000002422000-memory.dmpFilesize
72KB
-
memory/4396-178-0x0000000004B50000-0x0000000004B60000-memory.dmpFilesize
64KB
-
memory/4396-186-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4396-159-0x0000000002410000-0x0000000002422000-memory.dmpFilesize
72KB
-
memory/4396-155-0x0000000002410000-0x0000000002422000-memory.dmpFilesize
72KB
-
memory/4396-171-0x0000000002410000-0x0000000002422000-memory.dmpFilesize
72KB
-
memory/4396-169-0x0000000002410000-0x0000000002422000-memory.dmpFilesize
72KB
-
memory/4396-167-0x0000000002410000-0x0000000002422000-memory.dmpFilesize
72KB
-
memory/4396-165-0x0000000002410000-0x0000000002422000-memory.dmpFilesize
72KB
-
memory/4396-163-0x0000000002410000-0x0000000002422000-memory.dmpFilesize
72KB
-
memory/4396-153-0x0000000002410000-0x0000000002422000-memory.dmpFilesize
72KB
-
memory/4396-151-0x0000000002410000-0x0000000002422000-memory.dmpFilesize
72KB
-
memory/4396-150-0x0000000002410000-0x0000000002422000-memory.dmpFilesize
72KB
-
memory/4396-149-0x0000000004B60000-0x0000000005104000-memory.dmpFilesize
5.6MB
-
memory/4396-148-0x0000000000630000-0x000000000065D000-memory.dmpFilesize
180KB