Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05/05/2023, 18:32
Static task
static1
Behavioral task
behavioral1
Sample
7654b7b139d02caf594e3bb76024b436.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
7654b7b139d02caf594e3bb76024b436.exe
Resource
win10v2004-20230220-en
General
-
Target
7654b7b139d02caf594e3bb76024b436.exe
-
Size
480KB
-
MD5
7654b7b139d02caf594e3bb76024b436
-
SHA1
9ab0d7bc3a1e5f69dc0c15074f4ba85a7a907144
-
SHA256
1503129c1499aee0902cfcfa2d78d909e0f5117d9f7091134309eb05564a2e8f
-
SHA512
7a824318084704b92ade92267de286503ce2f111c85097e1a0a2cd65e65f29140e5df45e987482a440d21678ad4ba45b03e7d1bb40dbab42a6bc351b30738356
-
SSDEEP
12288:WMruy90sAoIpon4xyFZaP5xW5VYY2vrARptcjsVmC58pIr3:MyrIon4xynAsd48Rzrb+Or3
Malware Config
Extracted
redline
daris
217.196.96.56:4138
-
auth_value
3491f24ae0250969cd45ce4b3fe77549
Signatures
-
Detects Redline Stealer samples 3 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
resource yara_rule behavioral2/memory/1876-148-0x0000000005250000-0x0000000005868000-memory.dmp redline_stealer behavioral2/memory/1876-156-0x00000000051A0000-0x0000000005206000-memory.dmp redline_stealer behavioral2/memory/1876-157-0x0000000006030000-0x00000000061F2000-memory.dmp redline_stealer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" l4489086.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" l4489086.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" l4489086.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" l4489086.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" l4489086.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection l4489086.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation m1308172.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 7 IoCs
pid Process 2016 y3085576.exe 1876 k5575547.exe 320 l4489086.exe 4516 m1308172.exe 4204 oneetx.exe 5116 oneetx.exe 4616 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 2108 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" l4489086.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features l4489086.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 7654b7b139d02caf594e3bb76024b436.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 7654b7b139d02caf594e3bb76024b436.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce y3085576.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y3085576.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3824 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1876 k5575547.exe 1876 k5575547.exe 320 l4489086.exe 320 l4489086.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1876 k5575547.exe Token: SeDebugPrivilege 320 l4489086.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4516 m1308172.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 5012 wrote to memory of 2016 5012 7654b7b139d02caf594e3bb76024b436.exe 83 PID 5012 wrote to memory of 2016 5012 7654b7b139d02caf594e3bb76024b436.exe 83 PID 5012 wrote to memory of 2016 5012 7654b7b139d02caf594e3bb76024b436.exe 83 PID 2016 wrote to memory of 1876 2016 y3085576.exe 84 PID 2016 wrote to memory of 1876 2016 y3085576.exe 84 PID 2016 wrote to memory of 1876 2016 y3085576.exe 84 PID 2016 wrote to memory of 320 2016 y3085576.exe 85 PID 2016 wrote to memory of 320 2016 y3085576.exe 85 PID 2016 wrote to memory of 320 2016 y3085576.exe 85 PID 5012 wrote to memory of 4516 5012 7654b7b139d02caf594e3bb76024b436.exe 86 PID 5012 wrote to memory of 4516 5012 7654b7b139d02caf594e3bb76024b436.exe 86 PID 5012 wrote to memory of 4516 5012 7654b7b139d02caf594e3bb76024b436.exe 86 PID 4516 wrote to memory of 4204 4516 m1308172.exe 87 PID 4516 wrote to memory of 4204 4516 m1308172.exe 87 PID 4516 wrote to memory of 4204 4516 m1308172.exe 87 PID 4204 wrote to memory of 3824 4204 oneetx.exe 89 PID 4204 wrote to memory of 3824 4204 oneetx.exe 89 PID 4204 wrote to memory of 3824 4204 oneetx.exe 89 PID 4204 wrote to memory of 3876 4204 oneetx.exe 91 PID 4204 wrote to memory of 3876 4204 oneetx.exe 91 PID 4204 wrote to memory of 3876 4204 oneetx.exe 91 PID 3876 wrote to memory of 844 3876 cmd.exe 93 PID 3876 wrote to memory of 844 3876 cmd.exe 93 PID 3876 wrote to memory of 844 3876 cmd.exe 93 PID 3876 wrote to memory of 2844 3876 cmd.exe 94 PID 3876 wrote to memory of 2844 3876 cmd.exe 94 PID 3876 wrote to memory of 2844 3876 cmd.exe 94 PID 3876 wrote to memory of 2032 3876 cmd.exe 95 PID 3876 wrote to memory of 2032 3876 cmd.exe 95 PID 3876 wrote to memory of 2032 3876 cmd.exe 95 PID 3876 wrote to memory of 4716 3876 cmd.exe 96 PID 3876 wrote to memory of 4716 3876 cmd.exe 96 PID 3876 wrote to memory of 4716 3876 cmd.exe 96 PID 3876 wrote to memory of 332 3876 cmd.exe 97 PID 3876 wrote to memory of 332 3876 cmd.exe 97 PID 3876 wrote to memory of 332 3876 cmd.exe 97 PID 3876 wrote to memory of 2176 3876 cmd.exe 98 PID 3876 wrote to memory of 2176 3876 cmd.exe 98 PID 3876 wrote to memory of 2176 3876 cmd.exe 98 PID 4204 wrote to memory of 2108 4204 oneetx.exe 100 PID 4204 wrote to memory of 2108 4204 oneetx.exe 100 PID 4204 wrote to memory of 2108 4204 oneetx.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\7654b7b139d02caf594e3bb76024b436.exe"C:\Users\Admin\AppData\Local\Temp\7654b7b139d02caf594e3bb76024b436.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3085576.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3085576.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5575547.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5575547.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1876
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4489086.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4489086.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:320
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m1308172.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m1308172.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:3824
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:844
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:2844
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:2032
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:4716
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:N"5⤵PID:332
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:R" /E5⤵PID:2176
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:2108
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:5116
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:4616
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
206KB
MD5f57e19f38f18020aad3db588cc2e88bb
SHA160f87e8a9ed71093d21666f7184bfbe0a335b1df
SHA256b890109466306df20c295b7f51d674b27c67bf5c4fd8b8c0c4f18e6581c8d481
SHA5125eb26e49fe36451d8f944add24db08c8f535ef94148f8a5be5a709ba1695bba88ecb6bae7ca70824cabc326dd332e80f041c30bc584f6507e028b35a91353eef
-
Filesize
206KB
MD5f57e19f38f18020aad3db588cc2e88bb
SHA160f87e8a9ed71093d21666f7184bfbe0a335b1df
SHA256b890109466306df20c295b7f51d674b27c67bf5c4fd8b8c0c4f18e6581c8d481
SHA5125eb26e49fe36451d8f944add24db08c8f535ef94148f8a5be5a709ba1695bba88ecb6bae7ca70824cabc326dd332e80f041c30bc584f6507e028b35a91353eef
-
Filesize
308KB
MD50c8c5816f58bb7cc9df5093b60df7211
SHA1ef729dd2ee538acb8f84621bdc960f7fc1529ca3
SHA256a00c0f9cccc086e259d21ede9f2129f6c618ce96cf2e544b827715666b04efbf
SHA5125e89ca9984ad454ac55e2214c3f8467eed6f68c611d4ee7968b63a3b94d262a450949e839e383ecf102e4a1ac05d7ff5387ccf4eb3b67c90fde6861b02b4ed1d
-
Filesize
308KB
MD50c8c5816f58bb7cc9df5093b60df7211
SHA1ef729dd2ee538acb8f84621bdc960f7fc1529ca3
SHA256a00c0f9cccc086e259d21ede9f2129f6c618ce96cf2e544b827715666b04efbf
SHA5125e89ca9984ad454ac55e2214c3f8467eed6f68c611d4ee7968b63a3b94d262a450949e839e383ecf102e4a1ac05d7ff5387ccf4eb3b67c90fde6861b02b4ed1d
-
Filesize
168KB
MD524d9df908e3542b85f406248da09bccd
SHA1f6619e6b403e4889f4946ae5f7b8bb0e1d3bff65
SHA25620488d08992718b3bf98a8375d0b79efdee7bf402db9f57f4efdaedb8bd223f1
SHA5128ee8f0ddbe30ed2ed10df18f9041278de77c0ea57e7c22e16e720cb4a5466d702a7ef5e23820acdc4aeba1ca2eff56203f5ed0273b3f2018457b293440e77838
-
Filesize
168KB
MD524d9df908e3542b85f406248da09bccd
SHA1f6619e6b403e4889f4946ae5f7b8bb0e1d3bff65
SHA25620488d08992718b3bf98a8375d0b79efdee7bf402db9f57f4efdaedb8bd223f1
SHA5128ee8f0ddbe30ed2ed10df18f9041278de77c0ea57e7c22e16e720cb4a5466d702a7ef5e23820acdc4aeba1ca2eff56203f5ed0273b3f2018457b293440e77838
-
Filesize
179KB
MD50948e18c3e62fcdd93b18c56279d10c9
SHA18ffba5e073e62488e75f846477922b3d81c118bf
SHA256c4d65b3bc20562810bc1eeffe5a2af50464f274d3d69d634e5d0c13b21a658c3
SHA5124fa1beeca911d3cdbf6620ae7890c920f9a63942cfdd2df2b5ece1c27788a19cd780df90381ac437e10a64f1df39fda76418a638d1aa71e94f967639ea7fa6eb
-
Filesize
179KB
MD50948e18c3e62fcdd93b18c56279d10c9
SHA18ffba5e073e62488e75f846477922b3d81c118bf
SHA256c4d65b3bc20562810bc1eeffe5a2af50464f274d3d69d634e5d0c13b21a658c3
SHA5124fa1beeca911d3cdbf6620ae7890c920f9a63942cfdd2df2b5ece1c27788a19cd780df90381ac437e10a64f1df39fda76418a638d1aa71e94f967639ea7fa6eb
-
Filesize
206KB
MD5f57e19f38f18020aad3db588cc2e88bb
SHA160f87e8a9ed71093d21666f7184bfbe0a335b1df
SHA256b890109466306df20c295b7f51d674b27c67bf5c4fd8b8c0c4f18e6581c8d481
SHA5125eb26e49fe36451d8f944add24db08c8f535ef94148f8a5be5a709ba1695bba88ecb6bae7ca70824cabc326dd332e80f041c30bc584f6507e028b35a91353eef
-
Filesize
206KB
MD5f57e19f38f18020aad3db588cc2e88bb
SHA160f87e8a9ed71093d21666f7184bfbe0a335b1df
SHA256b890109466306df20c295b7f51d674b27c67bf5c4fd8b8c0c4f18e6581c8d481
SHA5125eb26e49fe36451d8f944add24db08c8f535ef94148f8a5be5a709ba1695bba88ecb6bae7ca70824cabc326dd332e80f041c30bc584f6507e028b35a91353eef
-
Filesize
206KB
MD5f57e19f38f18020aad3db588cc2e88bb
SHA160f87e8a9ed71093d21666f7184bfbe0a335b1df
SHA256b890109466306df20c295b7f51d674b27c67bf5c4fd8b8c0c4f18e6581c8d481
SHA5125eb26e49fe36451d8f944add24db08c8f535ef94148f8a5be5a709ba1695bba88ecb6bae7ca70824cabc326dd332e80f041c30bc584f6507e028b35a91353eef
-
Filesize
206KB
MD5f57e19f38f18020aad3db588cc2e88bb
SHA160f87e8a9ed71093d21666f7184bfbe0a335b1df
SHA256b890109466306df20c295b7f51d674b27c67bf5c4fd8b8c0c4f18e6581c8d481
SHA5125eb26e49fe36451d8f944add24db08c8f535ef94148f8a5be5a709ba1695bba88ecb6bae7ca70824cabc326dd332e80f041c30bc584f6507e028b35a91353eef
-
Filesize
206KB
MD5f57e19f38f18020aad3db588cc2e88bb
SHA160f87e8a9ed71093d21666f7184bfbe0a335b1df
SHA256b890109466306df20c295b7f51d674b27c67bf5c4fd8b8c0c4f18e6581c8d481
SHA5125eb26e49fe36451d8f944add24db08c8f535ef94148f8a5be5a709ba1695bba88ecb6bae7ca70824cabc326dd332e80f041c30bc584f6507e028b35a91353eef
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5