Analysis
-
max time kernel
153s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
11-03-2023 23:11
Static task
static1
Behavioral task
behavioral1
Sample
012246d33d0db647d7d358792ca9610d561f0cfdbb7b173966842d93ad4af725.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
012246d33d0db647d7d358792ca9610d561f0cfdbb7b173966842d93ad4af725.exe
Resource
win10v2004-20230220-en
General
-
Target
012246d33d0db647d7d358792ca9610d561f0cfdbb7b173966842d93ad4af725.exe
-
Size
652KB
-
MD5
14f5e165626c6af52bffbc89d21329cc
-
SHA1
984311acb1194d14570e18fb067d0d77e18e09f7
-
SHA256
012246d33d0db647d7d358792ca9610d561f0cfdbb7b173966842d93ad4af725
-
SHA512
09943f10e8f01e32822a270451c7a6b9d46657b1b7d857f70c7a39ec0f11b49d79faefd8bb6cdfd3dc16b3fa4d224e793a9fa77c15048d025129fac470737fba
-
SSDEEP
12288:zVWaqBVJ9djGK+NILVhWtA2upeUQFEoo+eN1d2xH8+llKGkAOH:zVWlhd+NIph4APeUQFEoo+eN1OH8+llu
Malware Config
Extracted
redline
garry
193.56.146.11:4173
-
auth_value
210ba56bf751fefe327f26e00f0be5a9
Signatures
-
Processes:
a897ftxo.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection a897ftxo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a897ftxo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a897ftxo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a897ftxo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a897ftxo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a897ftxo.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 3 IoCs
Processes:
m652x759.exea897ftxo.exefAano057.exepid process 4316 m652x759.exe 180 a897ftxo.exe 2816 fAano057.exe -
Processes:
a897ftxo.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features a897ftxo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" a897ftxo.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
012246d33d0db647d7d358792ca9610d561f0cfdbb7b173966842d93ad4af725.exem652x759.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 012246d33d0db647d7d358792ca9610d561f0cfdbb7b173966842d93ad4af725.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 012246d33d0db647d7d358792ca9610d561f0cfdbb7b173966842d93ad4af725.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce m652x759.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" m652x759.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 732 180 WerFault.exe a897ftxo.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
a897ftxo.exepid process 180 a897ftxo.exe 180 a897ftxo.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a897ftxo.exedescription pid process Token: SeDebugPrivilege 180 a897ftxo.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
012246d33d0db647d7d358792ca9610d561f0cfdbb7b173966842d93ad4af725.exem652x759.exedescription pid process target process PID 4116 wrote to memory of 4316 4116 012246d33d0db647d7d358792ca9610d561f0cfdbb7b173966842d93ad4af725.exe m652x759.exe PID 4116 wrote to memory of 4316 4116 012246d33d0db647d7d358792ca9610d561f0cfdbb7b173966842d93ad4af725.exe m652x759.exe PID 4116 wrote to memory of 4316 4116 012246d33d0db647d7d358792ca9610d561f0cfdbb7b173966842d93ad4af725.exe m652x759.exe PID 4316 wrote to memory of 180 4316 m652x759.exe a897ftxo.exe PID 4316 wrote to memory of 180 4316 m652x759.exe a897ftxo.exe PID 4316 wrote to memory of 180 4316 m652x759.exe a897ftxo.exe PID 4316 wrote to memory of 2816 4316 m652x759.exe fAano057.exe PID 4316 wrote to memory of 2816 4316 m652x759.exe fAano057.exe PID 4316 wrote to memory of 2816 4316 m652x759.exe fAano057.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\012246d33d0db647d7d358792ca9610d561f0cfdbb7b173966842d93ad4af725.exe"C:\Users\Admin\AppData\Local\Temp\012246d33d0db647d7d358792ca9610d561f0cfdbb7b173966842d93ad4af725.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m652x759.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m652x759.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a897ftxo.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a897ftxo.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 180 -s 10844⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\fAano057.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\fAano057.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 180 -ip 1801⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m652x759.exeFilesize
382KB
MD565fb93ce39b827d09f8090aea0d8e9d3
SHA1dd4eb0405f6d2d4dff4bbde92bcd600972dda160
SHA25693386cf794aa821ea9970aeef3af62ff94c5c7aacd52df6178415e09ddad91c3
SHA5127fc2dc83b8c619acbb08dc48540a147642c393679a74bffeb11077d82746c5640d2876b3e7fc9b40c0294d4ae78daf811d7d5aa033d15d4e5d14d5de78a5cdc3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m652x759.exeFilesize
382KB
MD565fb93ce39b827d09f8090aea0d8e9d3
SHA1dd4eb0405f6d2d4dff4bbde92bcd600972dda160
SHA25693386cf794aa821ea9970aeef3af62ff94c5c7aacd52df6178415e09ddad91c3
SHA5127fc2dc83b8c619acbb08dc48540a147642c393679a74bffeb11077d82746c5640d2876b3e7fc9b40c0294d4ae78daf811d7d5aa033d15d4e5d14d5de78a5cdc3
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a897ftxo.exeFilesize
322KB
MD58141937b23cd1895e561d8e90fdeeff3
SHA16f810e9e480564f5837461f8ccdd07c951a1bece
SHA256ddda10348c77cf0a1539c3a42ce4f71e2c1895ab9b77348256e0a1f01c0936b6
SHA51240957cd33c4be1dab98ac0c40424c868aa3be6f6265fa28df050e5a4844ac6324acb93770bc6cb7cafedabc93fab9b9179a6e6525f6b3dd6fa9e31b4d5da5bec
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a897ftxo.exeFilesize
322KB
MD58141937b23cd1895e561d8e90fdeeff3
SHA16f810e9e480564f5837461f8ccdd07c951a1bece
SHA256ddda10348c77cf0a1539c3a42ce4f71e2c1895ab9b77348256e0a1f01c0936b6
SHA51240957cd33c4be1dab98ac0c40424c868aa3be6f6265fa28df050e5a4844ac6324acb93770bc6cb7cafedabc93fab9b9179a6e6525f6b3dd6fa9e31b4d5da5bec
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\fAano057.exeFilesize
175KB
MD5f321ec1070df38bc3d9516ced9c63e82
SHA1ed54b270a786bbd3f9d055e0ae5eaf8e2752fde5
SHA25617696f99326cbeb44f8bd3bae2f91a7fbafa32ef54cf6631f0751cf6227c61a7
SHA5128bd8939185690415cb2305b4ae05e7d0c97db2260cb6bb0197460ff8bede41e0c3dd8c25b96af21503acc82fe24ebfd4e70aac966488de6111b20def9c30d2ab
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\fAano057.exeFilesize
175KB
MD5f321ec1070df38bc3d9516ced9c63e82
SHA1ed54b270a786bbd3f9d055e0ae5eaf8e2752fde5
SHA25617696f99326cbeb44f8bd3bae2f91a7fbafa32ef54cf6631f0751cf6227c61a7
SHA5128bd8939185690415cb2305b4ae05e7d0c97db2260cb6bb0197460ff8bede41e0c3dd8c25b96af21503acc82fe24ebfd4e70aac966488de6111b20def9c30d2ab
-
memory/180-168-0x0000000005010000-0x0000000005022000-memory.dmpFilesize
72KB
-
memory/180-162-0x0000000005010000-0x0000000005022000-memory.dmpFilesize
72KB
-
memory/180-151-0x0000000000610000-0x000000000063D000-memory.dmpFilesize
180KB
-
memory/180-154-0x0000000004A60000-0x0000000005004000-memory.dmpFilesize
5.6MB
-
memory/180-160-0x0000000005010000-0x0000000005022000-memory.dmpFilesize
72KB
-
memory/180-170-0x0000000005010000-0x0000000005022000-memory.dmpFilesize
72KB
-
memory/180-176-0x0000000005010000-0x0000000005022000-memory.dmpFilesize
72KB
-
memory/180-180-0x0000000005010000-0x0000000005022000-memory.dmpFilesize
72KB
-
memory/180-178-0x0000000005010000-0x0000000005022000-memory.dmpFilesize
72KB
-
memory/180-182-0x0000000005010000-0x0000000005022000-memory.dmpFilesize
72KB
-
memory/180-174-0x0000000005010000-0x0000000005022000-memory.dmpFilesize
72KB
-
memory/180-172-0x0000000005010000-0x0000000005022000-memory.dmpFilesize
72KB
-
memory/180-153-0x00000000024C0000-0x00000000024D0000-memory.dmpFilesize
64KB
-
memory/180-166-0x0000000005010000-0x0000000005022000-memory.dmpFilesize
72KB
-
memory/180-164-0x0000000005010000-0x0000000005022000-memory.dmpFilesize
72KB
-
memory/180-152-0x00000000024C0000-0x00000000024D0000-memory.dmpFilesize
64KB
-
memory/180-158-0x0000000005010000-0x0000000005022000-memory.dmpFilesize
72KB
-
memory/180-156-0x0000000005010000-0x0000000005022000-memory.dmpFilesize
72KB
-
memory/180-155-0x0000000005010000-0x0000000005022000-memory.dmpFilesize
72KB
-
memory/180-187-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB
-
memory/180-185-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB
-
memory/2816-191-0x0000000000600000-0x0000000000632000-memory.dmpFilesize
200KB
-
memory/2816-192-0x0000000005530000-0x0000000005B48000-memory.dmpFilesize
6.1MB
-
memory/2816-193-0x00000000050B0000-0x00000000051BA000-memory.dmpFilesize
1.0MB
-
memory/2816-194-0x0000000004FF0000-0x0000000005002000-memory.dmpFilesize
72KB
-
memory/2816-195-0x0000000005050000-0x000000000508C000-memory.dmpFilesize
240KB
-
memory/2816-196-0x0000000004FB0000-0x0000000004FC0000-memory.dmpFilesize
64KB
-
memory/2816-198-0x0000000004FB0000-0x0000000004FC0000-memory.dmpFilesize
64KB
-
memory/4116-183-0x00000000021B0000-0x000000000223F000-memory.dmpFilesize
572KB
-
memory/4116-134-0x00000000021B0000-0x000000000223F000-memory.dmpFilesize
572KB
-
memory/4116-150-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB