Analysis

  • max time kernel
    141s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-05-2023 20:38

General

  • Target

    fcf6613a3454512e24632047ce20c9ad3098ac76511b2f2abc68d42c4667b0e9.exe

  • Size

    690KB

  • MD5

    8cb991d44f83950d56b05c5513480254

  • SHA1

    91861e9496f01a1681d9c1239f3ac4d7803c6883

  • SHA256

    fcf6613a3454512e24632047ce20c9ad3098ac76511b2f2abc68d42c4667b0e9

  • SHA512

    75e97aa1adc0a96f21816fee16a821fbd2e10921f0a989eb509274284da2b8017758e76369829438d1e25e8bc288d1b4536c2320258c7ae5b00fe8a84eab5336

  • SSDEEP

    12288:3y90dmJsQJUcyKb+/83yb1E/VIE80qKR2ymJOD7zLSvuH:3yrOc7+QdIZk2ycO//H

Malware Config

Signatures

  • Detects Redline Stealer samples 1 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fcf6613a3454512e24632047ce20c9ad3098ac76511b2f2abc68d42c4667b0e9.exe
    "C:\Users\Admin\AppData\Local\Temp\fcf6613a3454512e24632047ce20c9ad3098ac76511b2f2abc68d42c4667b0e9.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:740
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un302444.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un302444.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2344
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\94857262.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\94857262.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1172
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1172 -s 1080
          4⤵
          • Program crash
          PID:1620
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk139230.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk139230.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1080
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1172 -ip 1172
    1⤵
      PID:760

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un302444.exe

      Filesize

      536KB

      MD5

      5b573a4889bcbb8b0ad137a2fd9ec438

      SHA1

      4ea6de70e2655e92864e229e5aa6c833d214a907

      SHA256

      efec0406db2fe14f8c3e976c0ff96a7acd01cfb7b7ccf5bba8e26498659e81ea

      SHA512

      1c9ff76d42095f0c2951643e01edf91d27290c69c6b55fae6f08cdd7bbc6c92929fb81f4e881c543de0ecc46765a9d16dc27fa01ecb9e8e6026dd111ae782231

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un302444.exe

      Filesize

      536KB

      MD5

      5b573a4889bcbb8b0ad137a2fd9ec438

      SHA1

      4ea6de70e2655e92864e229e5aa6c833d214a907

      SHA256

      efec0406db2fe14f8c3e976c0ff96a7acd01cfb7b7ccf5bba8e26498659e81ea

      SHA512

      1c9ff76d42095f0c2951643e01edf91d27290c69c6b55fae6f08cdd7bbc6c92929fb81f4e881c543de0ecc46765a9d16dc27fa01ecb9e8e6026dd111ae782231

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\94857262.exe

      Filesize

      259KB

      MD5

      086fdf0ed9298523e0e464c697a83d9b

      SHA1

      f01b5e2a786ee2dd6d9c4b5b6d0e4eabe97d87c1

      SHA256

      c6f2cc98fa6815449d730618fa1ef41a81a0fe7bdebcc5f41b11a22d1ce5839a

      SHA512

      c4849d796beb812eeddbb984976c6bf9350ac0822c0ed49fb332909fb094943c9485d4147eedbc2ab95e9ded09f9dc91c0233a88a5d6baa813eb3988704b2091

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\94857262.exe

      Filesize

      259KB

      MD5

      086fdf0ed9298523e0e464c697a83d9b

      SHA1

      f01b5e2a786ee2dd6d9c4b5b6d0e4eabe97d87c1

      SHA256

      c6f2cc98fa6815449d730618fa1ef41a81a0fe7bdebcc5f41b11a22d1ce5839a

      SHA512

      c4849d796beb812eeddbb984976c6bf9350ac0822c0ed49fb332909fb094943c9485d4147eedbc2ab95e9ded09f9dc91c0233a88a5d6baa813eb3988704b2091

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk139230.exe

      Filesize

      341KB

      MD5

      661c757d3f34b1ada0fef0b536f263fc

      SHA1

      66d9cc199fe247540d730db57eaeab7fea3c6cc2

      SHA256

      02d5a4364bb851f2688b58b60d56b009f0b2c50c3cdce9be505842a11dcce7c0

      SHA512

      acb6f126a66d2aa7abaf65cecf5c3e29c1ff9b4f7f6c49e0a2794123383fc0fe55374d848ae522d6a0212318020f08bf962ba894ab3dd5e36e78a32ddd6ff5f2

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk139230.exe

      Filesize

      341KB

      MD5

      661c757d3f34b1ada0fef0b536f263fc

      SHA1

      66d9cc199fe247540d730db57eaeab7fea3c6cc2

      SHA256

      02d5a4364bb851f2688b58b60d56b009f0b2c50c3cdce9be505842a11dcce7c0

      SHA512

      acb6f126a66d2aa7abaf65cecf5c3e29c1ff9b4f7f6c49e0a2794123383fc0fe55374d848ae522d6a0212318020f08bf962ba894ab3dd5e36e78a32ddd6ff5f2

    • memory/1080-216-0x0000000004AB0000-0x0000000004AE5000-memory.dmp

      Filesize

      212KB

    • memory/1080-220-0x0000000004AB0000-0x0000000004AE5000-memory.dmp

      Filesize

      212KB

    • memory/1080-991-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

      Filesize

      64KB

    • memory/1080-196-0x0000000004AB0000-0x0000000004AE5000-memory.dmp

      Filesize

      212KB

    • memory/1080-989-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

      Filesize

      64KB

    • memory/1080-987-0x0000000007D10000-0x0000000007D4C000-memory.dmp

      Filesize

      240KB

    • memory/1080-194-0x0000000004AB0000-0x0000000004AE5000-memory.dmp

      Filesize

      212KB

    • memory/1080-986-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

      Filesize

      64KB

    • memory/1080-985-0x0000000007C00000-0x0000000007D0A000-memory.dmp

      Filesize

      1.0MB

    • memory/1080-984-0x0000000004B70000-0x0000000004B82000-memory.dmp

      Filesize

      72KB

    • memory/1080-983-0x00000000075E0000-0x0000000007BF8000-memory.dmp

      Filesize

      6.1MB

    • memory/1080-379-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

      Filesize

      64KB

    • memory/1080-376-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

      Filesize

      64KB

    • memory/1080-377-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

      Filesize

      64KB

    • memory/1080-374-0x0000000000730000-0x0000000000776000-memory.dmp

      Filesize

      280KB

    • memory/1080-204-0x0000000004AB0000-0x0000000004AE5000-memory.dmp

      Filesize

      212KB

    • memory/1080-218-0x0000000004AB0000-0x0000000004AE5000-memory.dmp

      Filesize

      212KB

    • memory/1080-214-0x0000000004AB0000-0x0000000004AE5000-memory.dmp

      Filesize

      212KB

    • memory/1080-192-0x0000000004AB0000-0x0000000004AE5000-memory.dmp

      Filesize

      212KB

    • memory/1080-212-0x0000000004AB0000-0x0000000004AE5000-memory.dmp

      Filesize

      212KB

    • memory/1080-210-0x0000000004AB0000-0x0000000004AE5000-memory.dmp

      Filesize

      212KB

    • memory/1080-188-0x0000000004AB0000-0x0000000004AE5000-memory.dmp

      Filesize

      212KB

    • memory/1080-187-0x0000000004AB0000-0x0000000004AE5000-memory.dmp

      Filesize

      212KB

    • memory/1080-190-0x0000000004AB0000-0x0000000004AE5000-memory.dmp

      Filesize

      212KB

    • memory/1080-208-0x0000000004AB0000-0x0000000004AE5000-memory.dmp

      Filesize

      212KB

    • memory/1080-206-0x0000000004AB0000-0x0000000004AE5000-memory.dmp

      Filesize

      212KB

    • memory/1080-990-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

      Filesize

      64KB

    • memory/1080-198-0x0000000004AB0000-0x0000000004AE5000-memory.dmp

      Filesize

      212KB

    • memory/1080-200-0x0000000004AB0000-0x0000000004AE5000-memory.dmp

      Filesize

      212KB

    • memory/1080-202-0x0000000004AB0000-0x0000000004AE5000-memory.dmp

      Filesize

      212KB

    • memory/1172-173-0x0000000002580000-0x0000000002593000-memory.dmp

      Filesize

      76KB

    • memory/1172-159-0x0000000002580000-0x0000000002593000-memory.dmp

      Filesize

      76KB

    • memory/1172-182-0x0000000000400000-0x0000000000455000-memory.dmp

      Filesize

      340KB

    • memory/1172-150-0x0000000002450000-0x0000000002460000-memory.dmp

      Filesize

      64KB

    • memory/1172-149-0x0000000002450000-0x0000000002460000-memory.dmp

      Filesize

      64KB

    • memory/1172-180-0x0000000000400000-0x0000000000455000-memory.dmp

      Filesize

      340KB

    • memory/1172-148-0x0000000000600000-0x000000000062D000-memory.dmp

      Filesize

      180KB

    • memory/1172-179-0x0000000002580000-0x0000000002593000-memory.dmp

      Filesize

      76KB

    • memory/1172-177-0x0000000002580000-0x0000000002593000-memory.dmp

      Filesize

      76KB

    • memory/1172-175-0x0000000002580000-0x0000000002593000-memory.dmp

      Filesize

      76KB

    • memory/1172-151-0x0000000004A30000-0x0000000004FD4000-memory.dmp

      Filesize

      5.6MB

    • memory/1172-171-0x0000000002580000-0x0000000002593000-memory.dmp

      Filesize

      76KB

    • memory/1172-169-0x0000000002580000-0x0000000002593000-memory.dmp

      Filesize

      76KB

    • memory/1172-167-0x0000000002580000-0x0000000002593000-memory.dmp

      Filesize

      76KB

    • memory/1172-165-0x0000000002580000-0x0000000002593000-memory.dmp

      Filesize

      76KB

    • memory/1172-163-0x0000000002580000-0x0000000002593000-memory.dmp

      Filesize

      76KB

    • memory/1172-161-0x0000000002580000-0x0000000002593000-memory.dmp

      Filesize

      76KB

    • memory/1172-155-0x0000000002580000-0x0000000002593000-memory.dmp

      Filesize

      76KB

    • memory/1172-157-0x0000000002580000-0x0000000002593000-memory.dmp

      Filesize

      76KB

    • memory/1172-153-0x0000000002580000-0x0000000002593000-memory.dmp

      Filesize

      76KB

    • memory/1172-152-0x0000000002580000-0x0000000002593000-memory.dmp

      Filesize

      76KB