Analysis

  • max time kernel
    238s
  • max time network
    275s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/05/2023, 19:36

General

  • Target

    fe3b1ed46f48fedf189d82841757339f75d4b9ed69eb18ddd2ffc2e57928f940.exe

  • Size

    644KB

  • MD5

    add745b6e38654a1d0ee8566fc29d363

  • SHA1

    7719eae533b94ad44c26cb84daecad37b0a65f5d

  • SHA256

    fe3b1ed46f48fedf189d82841757339f75d4b9ed69eb18ddd2ffc2e57928f940

  • SHA512

    dfe898d59ed0284c665f056fab6aa289de82bdb2cf975a2b716abe20f2628662ff78ddc696ee8fe5f5cc15cca643dee49d6269847d10b51cf3d64f65fbaa71be

  • SSDEEP

    12288:2y9078xzKp3xtWSKGNZqWt6QuV7lrqQPZRlu8qx0iSPe7XfyXZND:2y1xzKmikK2pWwj0uve7XqND

Malware Config

Signatures

  • Detects Redline Stealer samples 1 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fe3b1ed46f48fedf189d82841757339f75d4b9ed69eb18ddd2ffc2e57928f940.exe
    "C:\Users\Admin\AppData\Local\Temp\fe3b1ed46f48fedf189d82841757339f75d4b9ed69eb18ddd2ffc2e57928f940.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4220
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st618533.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st618533.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:336
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\18326323.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\18326323.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1400
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp433506.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp433506.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4592

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st618533.exe

    Filesize

    489KB

    MD5

    79cff599fcc2b79dd55645595fd36963

    SHA1

    993f5ba1be7d12150246ed191093687c5d8c6eee

    SHA256

    2a95c9b1701b5549eddddc93c93e7f113dabffb6f762c271c0a8075001243e62

    SHA512

    b2f4ef976eece8b6dee53f5c4236c2c18623b43a5f87f1a3fe4e894b52cf5b2dd865edc37c822f9100f6ccc383dbc92a68e6202cf5ce679524a7bb2aa0ea5005

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st618533.exe

    Filesize

    489KB

    MD5

    79cff599fcc2b79dd55645595fd36963

    SHA1

    993f5ba1be7d12150246ed191093687c5d8c6eee

    SHA256

    2a95c9b1701b5549eddddc93c93e7f113dabffb6f762c271c0a8075001243e62

    SHA512

    b2f4ef976eece8b6dee53f5c4236c2c18623b43a5f87f1a3fe4e894b52cf5b2dd865edc37c822f9100f6ccc383dbc92a68e6202cf5ce679524a7bb2aa0ea5005

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\18326323.exe

    Filesize

    175KB

    MD5

    3d10b67208452d7a91d7bd7066067676

    SHA1

    e6c3ab7b6da65c8cc7dd95351f118caf3a50248d

    SHA256

    5c8ae96739bd9454a59e92b5eb6965647030e87453f7c417dbd7d53ebd837302

    SHA512

    b86d5ff4f55c90922a890401ae4301da7e71eb5e546a82536073cc58780ce55585214cff39ec9b52f70704580ad36c1fa95ebee1515dd2e7ea313cb670f2b4df

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\18326323.exe

    Filesize

    175KB

    MD5

    3d10b67208452d7a91d7bd7066067676

    SHA1

    e6c3ab7b6da65c8cc7dd95351f118caf3a50248d

    SHA256

    5c8ae96739bd9454a59e92b5eb6965647030e87453f7c417dbd7d53ebd837302

    SHA512

    b86d5ff4f55c90922a890401ae4301da7e71eb5e546a82536073cc58780ce55585214cff39ec9b52f70704580ad36c1fa95ebee1515dd2e7ea313cb670f2b4df

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp433506.exe

    Filesize

    348KB

    MD5

    1b6b914aec47b0255742b156456229f0

    SHA1

    0fb2ad395dfda1227922af244c2323dced6f25fc

    SHA256

    2bbc822303bd5a1f6a4b00ccd5c9f82d3ed7cb931d973d27bf1f9ac14efd9ed7

    SHA512

    d00d9675d54627e3fedc457b902dd4edeb73144f14b3202c775c5ebba6a1c027f0675126e35d0129b5ccf866f09ce354a1499848a8e6ae8392b23c62ff49156e

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp433506.exe

    Filesize

    348KB

    MD5

    1b6b914aec47b0255742b156456229f0

    SHA1

    0fb2ad395dfda1227922af244c2323dced6f25fc

    SHA256

    2bbc822303bd5a1f6a4b00ccd5c9f82d3ed7cb931d973d27bf1f9ac14efd9ed7

    SHA512

    d00d9675d54627e3fedc457b902dd4edeb73144f14b3202c775c5ebba6a1c027f0675126e35d0129b5ccf866f09ce354a1499848a8e6ae8392b23c62ff49156e

  • memory/1400-147-0x00000000049F0000-0x0000000004F94000-memory.dmp

    Filesize

    5.6MB

  • memory/1400-148-0x00000000049E0000-0x00000000049F0000-memory.dmp

    Filesize

    64KB

  • memory/1400-149-0x00000000049E0000-0x00000000049F0000-memory.dmp

    Filesize

    64KB

  • memory/1400-150-0x00000000049E0000-0x00000000049F0000-memory.dmp

    Filesize

    64KB

  • memory/1400-151-0x0000000004950000-0x0000000004963000-memory.dmp

    Filesize

    76KB

  • memory/1400-152-0x0000000004950000-0x0000000004963000-memory.dmp

    Filesize

    76KB

  • memory/1400-154-0x0000000004950000-0x0000000004963000-memory.dmp

    Filesize

    76KB

  • memory/1400-156-0x0000000004950000-0x0000000004963000-memory.dmp

    Filesize

    76KB

  • memory/1400-158-0x0000000004950000-0x0000000004963000-memory.dmp

    Filesize

    76KB

  • memory/1400-160-0x0000000004950000-0x0000000004963000-memory.dmp

    Filesize

    76KB

  • memory/1400-162-0x0000000004950000-0x0000000004963000-memory.dmp

    Filesize

    76KB

  • memory/1400-164-0x0000000004950000-0x0000000004963000-memory.dmp

    Filesize

    76KB

  • memory/1400-166-0x0000000004950000-0x0000000004963000-memory.dmp

    Filesize

    76KB

  • memory/1400-168-0x0000000004950000-0x0000000004963000-memory.dmp

    Filesize

    76KB

  • memory/1400-170-0x0000000004950000-0x0000000004963000-memory.dmp

    Filesize

    76KB

  • memory/1400-174-0x0000000004950000-0x0000000004963000-memory.dmp

    Filesize

    76KB

  • memory/1400-172-0x0000000004950000-0x0000000004963000-memory.dmp

    Filesize

    76KB

  • memory/1400-178-0x0000000004950000-0x0000000004963000-memory.dmp

    Filesize

    76KB

  • memory/1400-176-0x0000000004950000-0x0000000004963000-memory.dmp

    Filesize

    76KB

  • memory/1400-179-0x00000000049E0000-0x00000000049F0000-memory.dmp

    Filesize

    64KB

  • memory/1400-180-0x00000000049E0000-0x00000000049F0000-memory.dmp

    Filesize

    64KB

  • memory/1400-181-0x00000000049E0000-0x00000000049F0000-memory.dmp

    Filesize

    64KB

  • memory/4592-187-0x0000000004F60000-0x0000000004F95000-memory.dmp

    Filesize

    212KB

  • memory/4592-188-0x0000000004F60000-0x0000000004F95000-memory.dmp

    Filesize

    212KB

  • memory/4592-190-0x0000000004F60000-0x0000000004F95000-memory.dmp

    Filesize

    212KB

  • memory/4592-192-0x0000000004F60000-0x0000000004F95000-memory.dmp

    Filesize

    212KB

  • memory/4592-194-0x0000000004F60000-0x0000000004F95000-memory.dmp

    Filesize

    212KB

  • memory/4592-196-0x0000000004F60000-0x0000000004F95000-memory.dmp

    Filesize

    212KB

  • memory/4592-198-0x0000000004F60000-0x0000000004F95000-memory.dmp

    Filesize

    212KB

  • memory/4592-200-0x0000000004F60000-0x0000000004F95000-memory.dmp

    Filesize

    212KB

  • memory/4592-202-0x0000000004F60000-0x0000000004F95000-memory.dmp

    Filesize

    212KB

  • memory/4592-204-0x0000000004F60000-0x0000000004F95000-memory.dmp

    Filesize

    212KB

  • memory/4592-206-0x0000000004F60000-0x0000000004F95000-memory.dmp

    Filesize

    212KB

  • memory/4592-208-0x0000000004F60000-0x0000000004F95000-memory.dmp

    Filesize

    212KB

  • memory/4592-210-0x0000000004F60000-0x0000000004F95000-memory.dmp

    Filesize

    212KB

  • memory/4592-212-0x0000000004F60000-0x0000000004F95000-memory.dmp

    Filesize

    212KB

  • memory/4592-214-0x0000000004F60000-0x0000000004F95000-memory.dmp

    Filesize

    212KB

  • memory/4592-216-0x0000000004F60000-0x0000000004F95000-memory.dmp

    Filesize

    212KB

  • memory/4592-218-0x0000000004F60000-0x0000000004F95000-memory.dmp

    Filesize

    212KB

  • memory/4592-220-0x0000000004F60000-0x0000000004F95000-memory.dmp

    Filesize

    212KB

  • memory/4592-222-0x0000000004F60000-0x0000000004F95000-memory.dmp

    Filesize

    212KB

  • memory/4592-232-0x0000000004850000-0x0000000004896000-memory.dmp

    Filesize

    280KB

  • memory/4592-234-0x0000000007480000-0x0000000007490000-memory.dmp

    Filesize

    64KB

  • memory/4592-236-0x0000000007480000-0x0000000007490000-memory.dmp

    Filesize

    64KB

  • memory/4592-982-0x0000000009DC0000-0x000000000A3D8000-memory.dmp

    Filesize

    6.1MB

  • memory/4592-984-0x0000000007480000-0x0000000007490000-memory.dmp

    Filesize

    64KB

  • memory/4592-985-0x000000000A450000-0x000000000A462000-memory.dmp

    Filesize

    72KB

  • memory/4592-987-0x0000000007310000-0x000000000741A000-memory.dmp

    Filesize

    1.0MB

  • memory/4592-988-0x000000000A470000-0x000000000A4AC000-memory.dmp

    Filesize

    240KB

  • memory/4592-989-0x0000000007480000-0x0000000007490000-memory.dmp

    Filesize

    64KB

  • memory/4592-992-0x0000000007480000-0x0000000007490000-memory.dmp

    Filesize

    64KB