Analysis
-
max time kernel
50s -
max time network
146s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
15/02/2023, 08:59
Static task
static1
Behavioral task
behavioral1
Sample
3014714607cced0fe45b275de5077bdf782fe3b3c4e0b1f198ca9185608dbc1d.exe
Resource
win10-20220812-en
General
-
Target
3014714607cced0fe45b275de5077bdf782fe3b3c4e0b1f198ca9185608dbc1d.exe
-
Size
482KB
-
MD5
5e0018d2ab221b5049d4840ecd081dd2
-
SHA1
ea46185f45e5332e0033c696dad22b5acc296196
-
SHA256
3014714607cced0fe45b275de5077bdf782fe3b3c4e0b1f198ca9185608dbc1d
-
SHA512
d9960b0c1abe156578cc0a16482d58e31ccdd4d7097506fb5340f69849d903b8104cacd93126f3b036994cab3dbf7e01f5388807f66e40f393ac6cd25fd1afc5
-
SSDEEP
12288:wMrwy905w+nMcAyFxMGd8WYWw61eiHzJh5T:QyqwBEFxiLp61eyJX
Malware Config
Extracted
redline
fukia
193.233.20.13:4136
-
auth_value
e5783636fbd9e4f0cf9a017bce02e67e
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" eBR08hx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" eBR08hx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" eBR08hx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" dFj79Ws.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" dFj79Ws.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" dFj79Ws.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" dFj79Ws.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" dFj79Ws.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" eBR08hx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" eBR08hx.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
pid Process 3144 njZ73yF25.exe 4932 dFj79Ws.exe 5024 eBR08hx.exe 3484 fsP54lS.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" dFj79Ws.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features eBR08hx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" eBR08hx.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 3014714607cced0fe45b275de5077bdf782fe3b3c4e0b1f198ca9185608dbc1d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 3014714607cced0fe45b275de5077bdf782fe3b3c4e0b1f198ca9185608dbc1d.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce njZ73yF25.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" njZ73yF25.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4932 dFj79Ws.exe 4932 dFj79Ws.exe 5024 eBR08hx.exe 5024 eBR08hx.exe 3484 fsP54lS.exe 3484 fsP54lS.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4932 dFj79Ws.exe Token: SeDebugPrivilege 5024 eBR08hx.exe Token: SeDebugPrivilege 3484 fsP54lS.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2432 wrote to memory of 3144 2432 3014714607cced0fe45b275de5077bdf782fe3b3c4e0b1f198ca9185608dbc1d.exe 66 PID 2432 wrote to memory of 3144 2432 3014714607cced0fe45b275de5077bdf782fe3b3c4e0b1f198ca9185608dbc1d.exe 66 PID 2432 wrote to memory of 3144 2432 3014714607cced0fe45b275de5077bdf782fe3b3c4e0b1f198ca9185608dbc1d.exe 66 PID 3144 wrote to memory of 4932 3144 njZ73yF25.exe 67 PID 3144 wrote to memory of 4932 3144 njZ73yF25.exe 67 PID 3144 wrote to memory of 5024 3144 njZ73yF25.exe 68 PID 3144 wrote to memory of 5024 3144 njZ73yF25.exe 68 PID 3144 wrote to memory of 5024 3144 njZ73yF25.exe 68 PID 2432 wrote to memory of 3484 2432 3014714607cced0fe45b275de5077bdf782fe3b3c4e0b1f198ca9185608dbc1d.exe 69 PID 2432 wrote to memory of 3484 2432 3014714607cced0fe45b275de5077bdf782fe3b3c4e0b1f198ca9185608dbc1d.exe 69 PID 2432 wrote to memory of 3484 2432 3014714607cced0fe45b275de5077bdf782fe3b3c4e0b1f198ca9185608dbc1d.exe 69
Processes
-
C:\Users\Admin\AppData\Local\Temp\3014714607cced0fe45b275de5077bdf782fe3b3c4e0b1f198ca9185608dbc1d.exe"C:\Users\Admin\AppData\Local\Temp\3014714607cced0fe45b275de5077bdf782fe3b3c4e0b1f198ca9185608dbc1d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\njZ73yF25.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\njZ73yF25.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dFj79Ws.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dFj79Ws.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4932
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\eBR08hx.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\eBR08hx.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5024
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fsP54lS.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fsP54lS.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3484
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD5a5f5c5d6291c7ae9e1d1b7ed1e551490
SHA13d06413341893b838549939e15f8f1eec423d71a
SHA2561a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e
SHA512d9b3ba67bdd615ee2ce91a29cd9cf6723464be27bf45186fd0e9559ff2b0e7c51b423cfc3e32b5e90955046fb75a34c4a8528df7294b6c831ca254a65d2b8ba2
-
Filesize
175KB
MD5a5f5c5d6291c7ae9e1d1b7ed1e551490
SHA13d06413341893b838549939e15f8f1eec423d71a
SHA2561a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e
SHA512d9b3ba67bdd615ee2ce91a29cd9cf6723464be27bf45186fd0e9559ff2b0e7c51b423cfc3e32b5e90955046fb75a34c4a8528df7294b6c831ca254a65d2b8ba2
-
Filesize
337KB
MD5a80c8e4f90fc1aa8ef77166021d103b7
SHA16d557c68c4d0f69cb921b0e51a2391dd4807d74f
SHA2569b74e7d17759b4e5a57f606de76f5cde528eee87a8a197d37c10883b738f78f1
SHA5129255431567f765e95430d47ea00a48f1722b5a17cd6bc627b7b0062ec0003dd1bdb2865b43f0126fd80af9eea47435c83495fb6bc2f5c8c883eb0688b1ee4da2
-
Filesize
337KB
MD5a80c8e4f90fc1aa8ef77166021d103b7
SHA16d557c68c4d0f69cb921b0e51a2391dd4807d74f
SHA2569b74e7d17759b4e5a57f606de76f5cde528eee87a8a197d37c10883b738f78f1
SHA5129255431567f765e95430d47ea00a48f1722b5a17cd6bc627b7b0062ec0003dd1bdb2865b43f0126fd80af9eea47435c83495fb6bc2f5c8c883eb0688b1ee4da2
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
248KB
MD5304c8cb41d2d053924fd649d46e25833
SHA1c828210477114f0133a8a40ffa5698466c1c111d
SHA256cafba37de3836bb04111ba302733eaede3db9af37c66268722ea5fccfae57333
SHA512af3eef5638ada7d7e9680924cef2354d36a7cf9a29b7733cb3dbdf0215e91542037edeb70616978e4e494f24cb5a4c0d7fb2ae2b1db12df8c9a0e0409f35ae44
-
Filesize
248KB
MD5304c8cb41d2d053924fd649d46e25833
SHA1c828210477114f0133a8a40ffa5698466c1c111d
SHA256cafba37de3836bb04111ba302733eaede3db9af37c66268722ea5fccfae57333
SHA512af3eef5638ada7d7e9680924cef2354d36a7cf9a29b7733cb3dbdf0215e91542037edeb70616978e4e494f24cb5a4c0d7fb2ae2b1db12df8c9a0e0409f35ae44