Analysis
-
max time kernel
123s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 21:09
Static task
static1
Behavioral task
behavioral1
Sample
157f5a18990ac3098731e592c15f6dbe176ec3b5fbee75a15bf56f36a974a757.exe
Resource
win10v2004-20230220-en
General
-
Target
157f5a18990ac3098731e592c15f6dbe176ec3b5fbee75a15bf56f36a974a757.exe
-
Size
658KB
-
MD5
05fa0df696bbf529c8576494cfe90436
-
SHA1
aed5cdcc7c801203c8b115d7354173b8deed114b
-
SHA256
157f5a18990ac3098731e592c15f6dbe176ec3b5fbee75a15bf56f36a974a757
-
SHA512
822e29458142231340ac917342bc733d645c2998e9f071eb55677f0156f6ed93aeb02b944888618b587e85d23e595455c2db5755cba2af95406a10939278b0e3
-
SSDEEP
12288:zMrqy90oey8u+Ed2h72tRtVYP1zpYtFEKQFjYAU6QF5gAW446zWKzo8vp9xs:Jy6EhGdzqt6XFq61Af4DKTxs
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro4646.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro4646.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro4646.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro4646.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro4646.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro4646.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro4646.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/4608-190-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/4608-191-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/4608-193-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/4608-195-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/4608-197-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/4608-199-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/4608-201-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/4608-203-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/4608-207-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/4608-211-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/4608-213-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/4608-215-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/4608-217-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/4608-219-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/4608-221-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/4608-223-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/4608-225-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline behavioral1/memory/4608-227-0x0000000004A80000-0x0000000004ABF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un848264.exepro4646.exequ8106.exesi330667.exepid process 1540 un848264.exe 3880 pro4646.exe 4608 qu8106.exe 1588 si330667.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro4646.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro4646.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro4646.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un848264.exe157f5a18990ac3098731e592c15f6dbe176ec3b5fbee75a15bf56f36a974a757.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un848264.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un848264.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 157f5a18990ac3098731e592c15f6dbe176ec3b5fbee75a15bf56f36a974a757.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 157f5a18990ac3098731e592c15f6dbe176ec3b5fbee75a15bf56f36a974a757.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2648 3880 WerFault.exe pro4646.exe 1968 4608 WerFault.exe qu8106.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro4646.exequ8106.exesi330667.exepid process 3880 pro4646.exe 3880 pro4646.exe 4608 qu8106.exe 4608 qu8106.exe 1588 si330667.exe 1588 si330667.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro4646.exequ8106.exesi330667.exedescription pid process Token: SeDebugPrivilege 3880 pro4646.exe Token: SeDebugPrivilege 4608 qu8106.exe Token: SeDebugPrivilege 1588 si330667.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
157f5a18990ac3098731e592c15f6dbe176ec3b5fbee75a15bf56f36a974a757.exeun848264.exedescription pid process target process PID 2544 wrote to memory of 1540 2544 157f5a18990ac3098731e592c15f6dbe176ec3b5fbee75a15bf56f36a974a757.exe un848264.exe PID 2544 wrote to memory of 1540 2544 157f5a18990ac3098731e592c15f6dbe176ec3b5fbee75a15bf56f36a974a757.exe un848264.exe PID 2544 wrote to memory of 1540 2544 157f5a18990ac3098731e592c15f6dbe176ec3b5fbee75a15bf56f36a974a757.exe un848264.exe PID 1540 wrote to memory of 3880 1540 un848264.exe pro4646.exe PID 1540 wrote to memory of 3880 1540 un848264.exe pro4646.exe PID 1540 wrote to memory of 3880 1540 un848264.exe pro4646.exe PID 1540 wrote to memory of 4608 1540 un848264.exe qu8106.exe PID 1540 wrote to memory of 4608 1540 un848264.exe qu8106.exe PID 1540 wrote to memory of 4608 1540 un848264.exe qu8106.exe PID 2544 wrote to memory of 1588 2544 157f5a18990ac3098731e592c15f6dbe176ec3b5fbee75a15bf56f36a974a757.exe si330667.exe PID 2544 wrote to memory of 1588 2544 157f5a18990ac3098731e592c15f6dbe176ec3b5fbee75a15bf56f36a974a757.exe si330667.exe PID 2544 wrote to memory of 1588 2544 157f5a18990ac3098731e592c15f6dbe176ec3b5fbee75a15bf56f36a974a757.exe si330667.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\157f5a18990ac3098731e592c15f6dbe176ec3b5fbee75a15bf56f36a974a757.exe"C:\Users\Admin\AppData\Local\Temp\157f5a18990ac3098731e592c15f6dbe176ec3b5fbee75a15bf56f36a974a757.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un848264.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un848264.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4646.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4646.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 10844⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8106.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8106.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 13284⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si330667.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si330667.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3880 -ip 38801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4608 -ip 46081⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si330667.exeFilesize
175KB
MD56839e024c76b4b4a52705f7091e03c79
SHA198415c1841f658af4fa12b537ed55602fb340537
SHA256c055065a098afb4913ed87939a0ed6d7fa2d2f407696449922ccc9e3ccd3d6d9
SHA5122ff894b1c0506552a1dfb333b60d0ba8cb1ee135228fbe1b1d8c28f378386eb8baa7517c0a376472cd966f61c9e2888a657f47de0da5e7e5533fcfd29a2e98e6
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si330667.exeFilesize
175KB
MD56839e024c76b4b4a52705f7091e03c79
SHA198415c1841f658af4fa12b537ed55602fb340537
SHA256c055065a098afb4913ed87939a0ed6d7fa2d2f407696449922ccc9e3ccd3d6d9
SHA5122ff894b1c0506552a1dfb333b60d0ba8cb1ee135228fbe1b1d8c28f378386eb8baa7517c0a376472cd966f61c9e2888a657f47de0da5e7e5533fcfd29a2e98e6
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un848264.exeFilesize
516KB
MD52958842e0dac02b3517eef9e5ddc3421
SHA1344db65c5e29d19182185342c90530e1ba70a4d0
SHA256a7face7ac9886fe5f8114f556acbc9628b98e2e156368032b869c3913a7d35a9
SHA51250a275f055332b5a732de585061ef0e7ce41a867d304eb37512f2e702fe6be4cd47ae75cebe7b9e5e10378d88a91bc34a28584d5314ed8f18a629fa9c8ccf132
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un848264.exeFilesize
516KB
MD52958842e0dac02b3517eef9e5ddc3421
SHA1344db65c5e29d19182185342c90530e1ba70a4d0
SHA256a7face7ac9886fe5f8114f556acbc9628b98e2e156368032b869c3913a7d35a9
SHA51250a275f055332b5a732de585061ef0e7ce41a867d304eb37512f2e702fe6be4cd47ae75cebe7b9e5e10378d88a91bc34a28584d5314ed8f18a629fa9c8ccf132
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4646.exeFilesize
235KB
MD517636a417aa1f1e2ce5e0054a9698e4d
SHA1d24b087aa90b10b8347bbfa7475820fd0c18db14
SHA256a5b6b3e5ccaf4b4faf1868f9d151633221bf6a287b2b23c3fbdfc51501cd6b8a
SHA512c5c4fe37b3086b03644c0d597c21625c70e3157bc661a63667efdb0fff2fccf59e78f285e1a138a899f7d5a1b8bf7b723c8438a03c9822c0a6f3b6173f601c04
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4646.exeFilesize
235KB
MD517636a417aa1f1e2ce5e0054a9698e4d
SHA1d24b087aa90b10b8347bbfa7475820fd0c18db14
SHA256a5b6b3e5ccaf4b4faf1868f9d151633221bf6a287b2b23c3fbdfc51501cd6b8a
SHA512c5c4fe37b3086b03644c0d597c21625c70e3157bc661a63667efdb0fff2fccf59e78f285e1a138a899f7d5a1b8bf7b723c8438a03c9822c0a6f3b6173f601c04
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8106.exeFilesize
294KB
MD5d3c5fafe611bd7f26765141607383864
SHA1daa266b6d68efcddfee51e0e3a4138b577b7b35b
SHA256b559a4eacb8a6d8e3237398f325765aadb44560e69e2769d4cac58160a128609
SHA5129af048466394b7661608ef84b7c60fa1dbe70267f95e4566a04ffc644d5a18e339b871d322dda6cf35a5c128075423cc6a296254d1ed6e406b438a255a16566c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8106.exeFilesize
294KB
MD5d3c5fafe611bd7f26765141607383864
SHA1daa266b6d68efcddfee51e0e3a4138b577b7b35b
SHA256b559a4eacb8a6d8e3237398f325765aadb44560e69e2769d4cac58160a128609
SHA5129af048466394b7661608ef84b7c60fa1dbe70267f95e4566a04ffc644d5a18e339b871d322dda6cf35a5c128075423cc6a296254d1ed6e406b438a255a16566c
-
memory/1588-1121-0x0000000000020000-0x0000000000052000-memory.dmpFilesize
200KB
-
memory/1588-1122-0x00000000048C0000-0x00000000048D0000-memory.dmpFilesize
64KB
-
memory/3880-158-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/3880-168-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/3880-151-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/3880-152-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/3880-154-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/3880-156-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/3880-149-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/3880-160-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/3880-162-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/3880-164-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/3880-166-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/3880-150-0x0000000004BD0000-0x0000000005174000-memory.dmpFilesize
5.6MB
-
memory/3880-170-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/3880-172-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/3880-174-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/3880-176-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/3880-178-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/3880-179-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/3880-180-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/3880-181-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/3880-183-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/3880-184-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/3880-185-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/3880-148-0x00000000004F0000-0x000000000051D000-memory.dmpFilesize
180KB
-
memory/4608-191-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/4608-225-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/4608-195-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/4608-197-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/4608-199-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/4608-201-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/4608-204-0x0000000000630000-0x000000000067B000-memory.dmpFilesize
300KB
-
memory/4608-206-0x0000000004B00000-0x0000000004B10000-memory.dmpFilesize
64KB
-
memory/4608-203-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/4608-210-0x0000000004B00000-0x0000000004B10000-memory.dmpFilesize
64KB
-
memory/4608-208-0x0000000004B00000-0x0000000004B10000-memory.dmpFilesize
64KB
-
memory/4608-207-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/4608-211-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/4608-213-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/4608-215-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/4608-217-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/4608-219-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/4608-221-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/4608-223-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/4608-193-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/4608-227-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/4608-1100-0x0000000005200000-0x0000000005818000-memory.dmpFilesize
6.1MB
-
memory/4608-1101-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/4608-1102-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/4608-1103-0x0000000004B00000-0x0000000004B10000-memory.dmpFilesize
64KB
-
memory/4608-1104-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/4608-1106-0x0000000005CF0000-0x0000000005D56000-memory.dmpFilesize
408KB
-
memory/4608-1107-0x00000000064A0000-0x0000000006532000-memory.dmpFilesize
584KB
-
memory/4608-1108-0x00000000065B0000-0x0000000006772000-memory.dmpFilesize
1.8MB
-
memory/4608-1109-0x0000000006780000-0x0000000006CAC000-memory.dmpFilesize
5.2MB
-
memory/4608-1110-0x0000000004B00000-0x0000000004B10000-memory.dmpFilesize
64KB
-
memory/4608-1111-0x0000000004B00000-0x0000000004B10000-memory.dmpFilesize
64KB
-
memory/4608-1112-0x0000000004B00000-0x0000000004B10000-memory.dmpFilesize
64KB
-
memory/4608-190-0x0000000004A80000-0x0000000004ABF000-memory.dmpFilesize
252KB
-
memory/4608-1113-0x0000000006E00000-0x0000000006E76000-memory.dmpFilesize
472KB
-
memory/4608-1114-0x0000000006E80000-0x0000000006ED0000-memory.dmpFilesize
320KB
-
memory/4608-1115-0x0000000004B00000-0x0000000004B10000-memory.dmpFilesize
64KB