Analysis
-
max time kernel
181s -
max time network
192s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
06/05/2023, 22:01
Static task
static1
Behavioral task
behavioral1
Sample
576b363c58966498acde28dd962e65af53ae0555d8b7903807c826864e399c59.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
576b363c58966498acde28dd962e65af53ae0555d8b7903807c826864e399c59.exe
Resource
win10v2004-20230220-en
General
-
Target
576b363c58966498acde28dd962e65af53ae0555d8b7903807c826864e399c59.exe
-
Size
562KB
-
MD5
6d88965f4484398951970344837363f8
-
SHA1
fec55bcf9c071c6a38d6a8eabafb39fb5dc654d4
-
SHA256
576b363c58966498acde28dd962e65af53ae0555d8b7903807c826864e399c59
-
SHA512
54263ba5c9da5f4456a5d2baf1f9f3781ab84c681e04942233c90cfd4f398061592cb0f40e7e1fdc12fa94389a62745c48032a30a26569c852a367f4f1941896
-
SSDEEP
12288:Hy90SyDk5J4dZz/AmaLEOkoVsoFzI/7KJDhSgi:HyVygfw/YQVE/FM2Z7i
Malware Config
Signatures
-
Detects Redline Stealer samples 1 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
resource yara_rule behavioral2/memory/5088-952-0x0000000009DF0000-0x000000000A408000-memory.dmp redline_stealer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 84334617.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 84334617.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 84334617.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 84334617.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 84334617.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 84334617.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 3 IoCs
pid Process 2388 st673337.exe 1480 84334617.exe 5088 kp678488.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" 84334617.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 576b363c58966498acde28dd962e65af53ae0555d8b7903807c826864e399c59.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 576b363c58966498acde28dd962e65af53ae0555d8b7903807c826864e399c59.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce st673337.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" st673337.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1480 84334617.exe 1480 84334617.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1480 84334617.exe Token: SeDebugPrivilege 5088 kp678488.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4732 wrote to memory of 2388 4732 576b363c58966498acde28dd962e65af53ae0555d8b7903807c826864e399c59.exe 81 PID 4732 wrote to memory of 2388 4732 576b363c58966498acde28dd962e65af53ae0555d8b7903807c826864e399c59.exe 81 PID 4732 wrote to memory of 2388 4732 576b363c58966498acde28dd962e65af53ae0555d8b7903807c826864e399c59.exe 81 PID 2388 wrote to memory of 1480 2388 st673337.exe 82 PID 2388 wrote to memory of 1480 2388 st673337.exe 82 PID 2388 wrote to memory of 5088 2388 st673337.exe 83 PID 2388 wrote to memory of 5088 2388 st673337.exe 83 PID 2388 wrote to memory of 5088 2388 st673337.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\576b363c58966498acde28dd962e65af53ae0555d8b7903807c826864e399c59.exe"C:\Users\Admin\AppData\Local\Temp\576b363c58966498acde28dd962e65af53ae0555d8b7903807c826864e399c59.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st673337.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st673337.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\84334617.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\84334617.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1480
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp678488.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp678488.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5088
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD5b0f544026ac1efb4e78fdf207e92f70b
SHA1374b036579ea74abf7d436ff017ef432fdeb3587
SHA256852e829a51ac10ebce3052da7db8c6fcd4582b34dcd320e875863898236ac8fe
SHA512761abfe3732c5638d9963f83b0d2c27c890f6d2876d952443cc8b05bc56678d5bd9d51eb69d5b67c567d0cf8a6e6a8d8c54f54c1922b6667006ae37b421c87b2
-
Filesize
408KB
MD5b0f544026ac1efb4e78fdf207e92f70b
SHA1374b036579ea74abf7d436ff017ef432fdeb3587
SHA256852e829a51ac10ebce3052da7db8c6fcd4582b34dcd320e875863898236ac8fe
SHA512761abfe3732c5638d9963f83b0d2c27c890f6d2876d952443cc8b05bc56678d5bd9d51eb69d5b67c567d0cf8a6e6a8d8c54f54c1922b6667006ae37b421c87b2
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
360KB
MD52a5caeeded3331a633e4e2a282ebb4a0
SHA1ec5d990bf6c4afe4908f87588311631b0629f72f
SHA2562441bbdc3404d50081578b810e2335e7ba50a6e4991051dacb71cf32847c35e3
SHA512006d83f4ab9f6eded3eccb1f2d9ca651cf69861f2c78bbf8bef3f4ba6927197391707455eab4fab63c68dc933341806a2b649bf218bb5e2b19f7260ac85c1c7a
-
Filesize
360KB
MD52a5caeeded3331a633e4e2a282ebb4a0
SHA1ec5d990bf6c4afe4908f87588311631b0629f72f
SHA2562441bbdc3404d50081578b810e2335e7ba50a6e4991051dacb71cf32847c35e3
SHA512006d83f4ab9f6eded3eccb1f2d9ca651cf69861f2c78bbf8bef3f4ba6927197391707455eab4fab63c68dc933341806a2b649bf218bb5e2b19f7260ac85c1c7a