Analysis
-
max time kernel
140s -
max time network
256s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
05-04-2023 04:00
Static task
static1
Behavioral task
behavioral1
Sample
b917acc11bde080ad083210079ce978cf4d19b016a56148df44a49fc37fed34b.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
b917acc11bde080ad083210079ce978cf4d19b016a56148df44a49fc37fed34b.exe
Resource
win10-20230220-en
General
-
Target
b917acc11bde080ad083210079ce978cf4d19b016a56148df44a49fc37fed34b.exe
-
Size
677KB
-
MD5
b851d75f35fa92846fa11daa164f5655
-
SHA1
4b4189a0481c58544dbe4826ca80c4f34ca552b3
-
SHA256
b917acc11bde080ad083210079ce978cf4d19b016a56148df44a49fc37fed34b
-
SHA512
1b25e330a5bf7b8fc6bdb8e76d5a0a5210c943fb952b93c3c678fe4f8725c02650031eaa8cd84a8aad9a8d00803276ddaefe75d0689c1b5a5504b3f9880127fb
-
SSDEEP
12288:ZMrUy90O6UocJ15NmPrgbVj6T3tby6DUOsXggMPWvGItJf/z:pyf6U115Nmze020U/ggM+jtx/z
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro2325.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro2325.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro2325.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro2325.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro2325.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro2325.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral2/memory/4692-176-0x00000000023B0000-0x00000000023F6000-memory.dmp family_redline behavioral2/memory/4692-177-0x0000000002930000-0x0000000002974000-memory.dmp family_redline behavioral2/memory/4692-178-0x0000000002930000-0x000000000296F000-memory.dmp family_redline behavioral2/memory/4692-179-0x0000000002930000-0x000000000296F000-memory.dmp family_redline behavioral2/memory/4692-181-0x0000000002930000-0x000000000296F000-memory.dmp family_redline behavioral2/memory/4692-183-0x0000000002930000-0x000000000296F000-memory.dmp family_redline behavioral2/memory/4692-185-0x0000000002930000-0x000000000296F000-memory.dmp family_redline behavioral2/memory/4692-187-0x0000000002930000-0x000000000296F000-memory.dmp family_redline behavioral2/memory/4692-189-0x0000000002930000-0x000000000296F000-memory.dmp family_redline behavioral2/memory/4692-191-0x0000000002930000-0x000000000296F000-memory.dmp family_redline behavioral2/memory/4692-193-0x0000000002930000-0x000000000296F000-memory.dmp family_redline behavioral2/memory/4692-195-0x0000000002930000-0x000000000296F000-memory.dmp family_redline behavioral2/memory/4692-197-0x0000000002930000-0x000000000296F000-memory.dmp family_redline behavioral2/memory/4692-199-0x0000000002930000-0x000000000296F000-memory.dmp family_redline behavioral2/memory/4692-201-0x0000000002930000-0x000000000296F000-memory.dmp family_redline behavioral2/memory/4692-203-0x0000000002930000-0x000000000296F000-memory.dmp family_redline behavioral2/memory/4692-205-0x0000000002930000-0x000000000296F000-memory.dmp family_redline behavioral2/memory/4692-207-0x0000000002930000-0x000000000296F000-memory.dmp family_redline behavioral2/memory/4692-209-0x0000000002930000-0x000000000296F000-memory.dmp family_redline behavioral2/memory/4692-211-0x0000000002930000-0x000000000296F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un827843.exepro2325.exequ4473.exesi133702.exepid process 4120 un827843.exe 4576 pro2325.exe 4692 qu4473.exe 4720 si133702.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro2325.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro2325.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro2325.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
b917acc11bde080ad083210079ce978cf4d19b016a56148df44a49fc37fed34b.exeun827843.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce b917acc11bde080ad083210079ce978cf4d19b016a56148df44a49fc37fed34b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" b917acc11bde080ad083210079ce978cf4d19b016a56148df44a49fc37fed34b.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un827843.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un827843.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro2325.exequ4473.exesi133702.exepid process 4576 pro2325.exe 4576 pro2325.exe 4692 qu4473.exe 4692 qu4473.exe 4720 si133702.exe 4720 si133702.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro2325.exequ4473.exesi133702.exedescription pid process Token: SeDebugPrivilege 4576 pro2325.exe Token: SeDebugPrivilege 4692 qu4473.exe Token: SeDebugPrivilege 4720 si133702.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
b917acc11bde080ad083210079ce978cf4d19b016a56148df44a49fc37fed34b.exeun827843.exedescription pid process target process PID 4116 wrote to memory of 4120 4116 b917acc11bde080ad083210079ce978cf4d19b016a56148df44a49fc37fed34b.exe un827843.exe PID 4116 wrote to memory of 4120 4116 b917acc11bde080ad083210079ce978cf4d19b016a56148df44a49fc37fed34b.exe un827843.exe PID 4116 wrote to memory of 4120 4116 b917acc11bde080ad083210079ce978cf4d19b016a56148df44a49fc37fed34b.exe un827843.exe PID 4120 wrote to memory of 4576 4120 un827843.exe pro2325.exe PID 4120 wrote to memory of 4576 4120 un827843.exe pro2325.exe PID 4120 wrote to memory of 4576 4120 un827843.exe pro2325.exe PID 4120 wrote to memory of 4692 4120 un827843.exe qu4473.exe PID 4120 wrote to memory of 4692 4120 un827843.exe qu4473.exe PID 4120 wrote to memory of 4692 4120 un827843.exe qu4473.exe PID 4116 wrote to memory of 4720 4116 b917acc11bde080ad083210079ce978cf4d19b016a56148df44a49fc37fed34b.exe si133702.exe PID 4116 wrote to memory of 4720 4116 b917acc11bde080ad083210079ce978cf4d19b016a56148df44a49fc37fed34b.exe si133702.exe PID 4116 wrote to memory of 4720 4116 b917acc11bde080ad083210079ce978cf4d19b016a56148df44a49fc37fed34b.exe si133702.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b917acc11bde080ad083210079ce978cf4d19b016a56148df44a49fc37fed34b.exe"C:\Users\Admin\AppData\Local\Temp\b917acc11bde080ad083210079ce978cf4d19b016a56148df44a49fc37fed34b.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un827843.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un827843.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2325.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2325.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4473.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4473.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si133702.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si133702.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si133702.exeFilesize
175KB
MD5bb6d43fa4ebafe62b98ec4dea4ff49d9
SHA1d8188e664ac977f59d3ec26589e3cf67b1fab23b
SHA2561d1cdf01afc38fc6784a41fe8aa2f308ec44606d2d16c4edd9445813af33fe89
SHA512679a0e394c5751020c38ceaba6a1bd1a33c558b8c9142fc796fa3570baa0ac082d099891451fde50249e165625b9738ead7321dccf2b2da567f3f7e3d4ee4644
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si133702.exeFilesize
175KB
MD5bb6d43fa4ebafe62b98ec4dea4ff49d9
SHA1d8188e664ac977f59d3ec26589e3cf67b1fab23b
SHA2561d1cdf01afc38fc6784a41fe8aa2f308ec44606d2d16c4edd9445813af33fe89
SHA512679a0e394c5751020c38ceaba6a1bd1a33c558b8c9142fc796fa3570baa0ac082d099891451fde50249e165625b9738ead7321dccf2b2da567f3f7e3d4ee4644
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un827843.exeFilesize
535KB
MD5d4aeda2a8f56936aee36ccfe3c925b81
SHA1cd54afeba1274ddb9d6bd5ff4af78c8fe305e09f
SHA2562cf3984eea7bd4769731d30f09cd949d55671b2ceed0f69f62c7dc7ae7712f54
SHA512a00068385ce1d96e20b162db2bbfec46565ba699a9ebfbc5a3c515922714eef761f3feeb91153b00481a1f7596d0a8f085dddaefce68c9a7312e35eb56a19eda
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un827843.exeFilesize
535KB
MD5d4aeda2a8f56936aee36ccfe3c925b81
SHA1cd54afeba1274ddb9d6bd5ff4af78c8fe305e09f
SHA2562cf3984eea7bd4769731d30f09cd949d55671b2ceed0f69f62c7dc7ae7712f54
SHA512a00068385ce1d96e20b162db2bbfec46565ba699a9ebfbc5a3c515922714eef761f3feeb91153b00481a1f7596d0a8f085dddaefce68c9a7312e35eb56a19eda
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2325.exeFilesize
311KB
MD51fa2e9eea11c814a3e9538fe75d5cc86
SHA16c267f701406435ae56c46bb899576216f31766c
SHA256d2b9bef38a101ffbbf68e3867d2eb6217c9cd97a6c80d7c0aee649ffe510c3c6
SHA512a449c80cfe13f1390c94ec67ec7627dbabbb8c4260cd5bd309f8fb46608ed5fdb43a1d790174f015a693ffb36dc9626c68a81de4583f98227bbbab0f88a5070e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2325.exeFilesize
311KB
MD51fa2e9eea11c814a3e9538fe75d5cc86
SHA16c267f701406435ae56c46bb899576216f31766c
SHA256d2b9bef38a101ffbbf68e3867d2eb6217c9cd97a6c80d7c0aee649ffe510c3c6
SHA512a449c80cfe13f1390c94ec67ec7627dbabbb8c4260cd5bd309f8fb46608ed5fdb43a1d790174f015a693ffb36dc9626c68a81de4583f98227bbbab0f88a5070e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4473.exeFilesize
370KB
MD520c0a5ac2530df5146eb925fded8b7a4
SHA1df094dbdb9050f66300f8e6058714468bf1ac769
SHA256dd5a3d5e88746aefd340f6ad09cd1f5d74f5a665acedd8decf2c4d83e6eac192
SHA512980ee9aa79919fdecbd0f69ad1d06b8efb7234f05b56dde6d57307ad2c2cd62e1a86e1b1ef5e701e8a573e60fc0cd6c0324944be3ce8d4e7d4283506ae760e87
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4473.exeFilesize
370KB
MD520c0a5ac2530df5146eb925fded8b7a4
SHA1df094dbdb9050f66300f8e6058714468bf1ac769
SHA256dd5a3d5e88746aefd340f6ad09cd1f5d74f5a665acedd8decf2c4d83e6eac192
SHA512980ee9aa79919fdecbd0f69ad1d06b8efb7234f05b56dde6d57307ad2c2cd62e1a86e1b1ef5e701e8a573e60fc0cd6c0324944be3ce8d4e7d4283506ae760e87
-
memory/4576-131-0x0000000002300000-0x000000000231A000-memory.dmpFilesize
104KB
-
memory/4576-132-0x0000000004E90000-0x000000000538E000-memory.dmpFilesize
5.0MB
-
memory/4576-133-0x00000000025C0000-0x00000000025D8000-memory.dmpFilesize
96KB
-
memory/4576-134-0x00000000001D0000-0x00000000001FD000-memory.dmpFilesize
180KB
-
memory/4576-136-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/4576-135-0x0000000002640000-0x0000000002650000-memory.dmpFilesize
64KB
-
memory/4576-140-0x0000000002640000-0x0000000002650000-memory.dmpFilesize
64KB
-
memory/4576-138-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/4576-137-0x0000000002640000-0x0000000002650000-memory.dmpFilesize
64KB
-
memory/4576-141-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/4576-143-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/4576-145-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/4576-147-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/4576-149-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/4576-151-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/4576-153-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/4576-155-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/4576-157-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/4576-159-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/4576-161-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/4576-163-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/4576-165-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/4576-166-0x0000000000400000-0x0000000000802000-memory.dmpFilesize
4.0MB
-
memory/4576-168-0x0000000002640000-0x0000000002650000-memory.dmpFilesize
64KB
-
memory/4576-169-0x0000000002640000-0x0000000002650000-memory.dmpFilesize
64KB
-
memory/4576-170-0x0000000002640000-0x0000000002650000-memory.dmpFilesize
64KB
-
memory/4576-171-0x0000000000400000-0x0000000000802000-memory.dmpFilesize
4.0MB
-
memory/4692-176-0x00000000023B0000-0x00000000023F6000-memory.dmpFilesize
280KB
-
memory/4692-177-0x0000000002930000-0x0000000002974000-memory.dmpFilesize
272KB
-
memory/4692-178-0x0000000002930000-0x000000000296F000-memory.dmpFilesize
252KB
-
memory/4692-179-0x0000000002930000-0x000000000296F000-memory.dmpFilesize
252KB
-
memory/4692-181-0x0000000002930000-0x000000000296F000-memory.dmpFilesize
252KB
-
memory/4692-183-0x0000000002930000-0x000000000296F000-memory.dmpFilesize
252KB
-
memory/4692-185-0x0000000002930000-0x000000000296F000-memory.dmpFilesize
252KB
-
memory/4692-187-0x0000000002930000-0x000000000296F000-memory.dmpFilesize
252KB
-
memory/4692-189-0x0000000002930000-0x000000000296F000-memory.dmpFilesize
252KB
-
memory/4692-191-0x0000000002930000-0x000000000296F000-memory.dmpFilesize
252KB
-
memory/4692-193-0x0000000002930000-0x000000000296F000-memory.dmpFilesize
252KB
-
memory/4692-195-0x0000000002930000-0x000000000296F000-memory.dmpFilesize
252KB
-
memory/4692-197-0x0000000002930000-0x000000000296F000-memory.dmpFilesize
252KB
-
memory/4692-199-0x0000000002930000-0x000000000296F000-memory.dmpFilesize
252KB
-
memory/4692-201-0x0000000002930000-0x000000000296F000-memory.dmpFilesize
252KB
-
memory/4692-203-0x0000000002930000-0x000000000296F000-memory.dmpFilesize
252KB
-
memory/4692-205-0x0000000002930000-0x000000000296F000-memory.dmpFilesize
252KB
-
memory/4692-207-0x0000000002930000-0x000000000296F000-memory.dmpFilesize
252KB
-
memory/4692-209-0x0000000002930000-0x000000000296F000-memory.dmpFilesize
252KB
-
memory/4692-211-0x0000000002930000-0x000000000296F000-memory.dmpFilesize
252KB
-
memory/4692-274-0x0000000000820000-0x000000000086B000-memory.dmpFilesize
300KB
-
memory/4692-278-0x0000000004F60000-0x0000000004F70000-memory.dmpFilesize
64KB
-
memory/4692-279-0x0000000004F60000-0x0000000004F70000-memory.dmpFilesize
64KB
-
memory/4692-275-0x0000000004F60000-0x0000000004F70000-memory.dmpFilesize
64KB
-
memory/4692-1088-0x0000000005470000-0x0000000005A76000-memory.dmpFilesize
6.0MB
-
memory/4692-1089-0x0000000005A80000-0x0000000005B8A000-memory.dmpFilesize
1.0MB
-
memory/4692-1090-0x0000000004ED0000-0x0000000004EE2000-memory.dmpFilesize
72KB
-
memory/4692-1091-0x0000000004EF0000-0x0000000004F2E000-memory.dmpFilesize
248KB
-
memory/4692-1092-0x0000000005C90000-0x0000000005CDB000-memory.dmpFilesize
300KB
-
memory/4692-1093-0x0000000004F60000-0x0000000004F70000-memory.dmpFilesize
64KB
-
memory/4692-1095-0x0000000005E00000-0x0000000005E66000-memory.dmpFilesize
408KB
-
memory/4692-1096-0x00000000064D0000-0x0000000006562000-memory.dmpFilesize
584KB
-
memory/4692-1097-0x00000000066A0000-0x0000000006862000-memory.dmpFilesize
1.8MB
-
memory/4692-1098-0x0000000006870000-0x0000000006D9C000-memory.dmpFilesize
5.2MB
-
memory/4692-1099-0x0000000004F60000-0x0000000004F70000-memory.dmpFilesize
64KB
-
memory/4692-1100-0x0000000004F60000-0x0000000004F70000-memory.dmpFilesize
64KB
-
memory/4692-1101-0x0000000004F60000-0x0000000004F70000-memory.dmpFilesize
64KB
-
memory/4692-1102-0x0000000004F60000-0x0000000004F70000-memory.dmpFilesize
64KB
-
memory/4692-1103-0x00000000082F0000-0x0000000008366000-memory.dmpFilesize
472KB
-
memory/4692-1104-0x0000000008370000-0x00000000083C0000-memory.dmpFilesize
320KB
-
memory/4720-1110-0x00000000003F0000-0x0000000000422000-memory.dmpFilesize
200KB
-
memory/4720-1111-0x0000000004E30000-0x0000000004E7B000-memory.dmpFilesize
300KB
-
memory/4720-1112-0x0000000005010000-0x0000000005020000-memory.dmpFilesize
64KB
-
memory/4720-1113-0x0000000005010000-0x0000000005020000-memory.dmpFilesize
64KB