Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05/05/2023, 18:46
Static task
static1
Behavioral task
behavioral1
Sample
a2382c294b0e79a219a5987082d85eef9d878a650cc2195035a46202cbcbcf81.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
a2382c294b0e79a219a5987082d85eef9d878a650cc2195035a46202cbcbcf81.exe
Resource
win10v2004-20230220-en
General
-
Target
a2382c294b0e79a219a5987082d85eef9d878a650cc2195035a46202cbcbcf81.exe
-
Size
691KB
-
MD5
d0fb48d898d81a8d109e7825feb7b195
-
SHA1
1b3cffddb8d82d480bf925661110086cb064981c
-
SHA256
a2382c294b0e79a219a5987082d85eef9d878a650cc2195035a46202cbcbcf81
-
SHA512
2fa3ea744e860421f1c45170662350955ff6b583e4ff521a60acd27cf2956aa5e88c6ec283b15779b6190e162f38fb5d1990616e292159bbd6662ff17e0cfeea
-
SSDEEP
12288:Ey90j+HH/HoZeeEaDkfRkOSz3HoEGOniNBmvxsEsXNBK:Eyq+n/Ig+GRzSeNMF6NBK
Malware Config
Signatures
-
Detects Redline Stealer samples 1 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
resource yara_rule behavioral2/memory/4760-987-0x0000000007510000-0x0000000007B28000-memory.dmp redline_stealer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 02756733.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 02756733.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 02756733.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 02756733.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 02756733.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 02756733.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 3 IoCs
pid Process 4336 un792698.exe 1732 02756733.exe 4760 rk929973.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 02756733.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 02756733.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce a2382c294b0e79a219a5987082d85eef9d878a650cc2195035a46202cbcbcf81.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a2382c294b0e79a219a5987082d85eef9d878a650cc2195035a46202cbcbcf81.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un792698.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un792698.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 5104 1732 WerFault.exe 84 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1732 02756733.exe 1732 02756733.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1732 02756733.exe Token: SeDebugPrivilege 4760 rk929973.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4388 wrote to memory of 4336 4388 a2382c294b0e79a219a5987082d85eef9d878a650cc2195035a46202cbcbcf81.exe 83 PID 4388 wrote to memory of 4336 4388 a2382c294b0e79a219a5987082d85eef9d878a650cc2195035a46202cbcbcf81.exe 83 PID 4388 wrote to memory of 4336 4388 a2382c294b0e79a219a5987082d85eef9d878a650cc2195035a46202cbcbcf81.exe 83 PID 4336 wrote to memory of 1732 4336 un792698.exe 84 PID 4336 wrote to memory of 1732 4336 un792698.exe 84 PID 4336 wrote to memory of 1732 4336 un792698.exe 84 PID 4336 wrote to memory of 4760 4336 un792698.exe 90 PID 4336 wrote to memory of 4760 4336 un792698.exe 90 PID 4336 wrote to memory of 4760 4336 un792698.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2382c294b0e79a219a5987082d85eef9d878a650cc2195035a46202cbcbcf81.exe"C:\Users\Admin\AppData\Local\Temp\a2382c294b0e79a219a5987082d85eef9d878a650cc2195035a46202cbcbcf81.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un792698.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un792698.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\02756733.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\02756733.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1732 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 10924⤵
- Program crash
PID:5104
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk929973.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk929973.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4760
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1732 -ip 17321⤵PID:3136
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
536KB
MD583f191cf888d2ff63481cd7aeaed96fe
SHA1d538d3ccf8ea3bbfa8153bbfb5646b28e4ba6823
SHA256b9589edab73cb4b80317b85e8121d0bab7524f052df93912cb383c02a49e61a6
SHA512355a64ea785dce23ca1dbd7b405ec4489d150d91aca5002415ac566577b2af37ec0dc8c6e00a90c1e46fa2811402440b49cebb5ba7e7760dcd9fb8c9365a5bf1
-
Filesize
536KB
MD583f191cf888d2ff63481cd7aeaed96fe
SHA1d538d3ccf8ea3bbfa8153bbfb5646b28e4ba6823
SHA256b9589edab73cb4b80317b85e8121d0bab7524f052df93912cb383c02a49e61a6
SHA512355a64ea785dce23ca1dbd7b405ec4489d150d91aca5002415ac566577b2af37ec0dc8c6e00a90c1e46fa2811402440b49cebb5ba7e7760dcd9fb8c9365a5bf1
-
Filesize
258KB
MD52f1d4228181655659c2a9002d249ba46
SHA1f5e62845af7cf08033c779baa2dc40c8d5933cda
SHA256aa615a6a4ebe2c31760306e67fd65ddaf3fd849262305edb1ed5a4131798b9a0
SHA51264f4c7b1621ac9210424b2214eec31b97d1fb600ba8040d8b78ca4e29b85b0dbcbd94af48e304ea90d473a4e3437f1ed50a8927f12cbd6a6db6b5b1329f286f8
-
Filesize
258KB
MD52f1d4228181655659c2a9002d249ba46
SHA1f5e62845af7cf08033c779baa2dc40c8d5933cda
SHA256aa615a6a4ebe2c31760306e67fd65ddaf3fd849262305edb1ed5a4131798b9a0
SHA51264f4c7b1621ac9210424b2214eec31b97d1fb600ba8040d8b78ca4e29b85b0dbcbd94af48e304ea90d473a4e3437f1ed50a8927f12cbd6a6db6b5b1329f286f8
-
Filesize
341KB
MD57231f66a0db7533f2c99e814626f2bf0
SHA10c6a22dde526e960b6cf359e154875cff5d0b66c
SHA256c9adb9c5b6df7ce7b378766b74cdfe6d6570748753e064357b8d8642b3240fe8
SHA51257f4091033f47f737ce8841a99a599fea29230619f0f7f8e4e0a181653b99e05741c229c3eec2ef9b6eb0a2d01fbc3fd7edc147df2a9ce05732734d2e44a3ee0
-
Filesize
341KB
MD57231f66a0db7533f2c99e814626f2bf0
SHA10c6a22dde526e960b6cf359e154875cff5d0b66c
SHA256c9adb9c5b6df7ce7b378766b74cdfe6d6570748753e064357b8d8642b3240fe8
SHA51257f4091033f47f737ce8841a99a599fea29230619f0f7f8e4e0a181653b99e05741c229c3eec2ef9b6eb0a2d01fbc3fd7edc147df2a9ce05732734d2e44a3ee0