Analysis

  • max time kernel
    147s
  • max time network
    174s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/05/2023, 21:02

General

  • Target

    270a27490464c7612d4599d8165047480b54640d22f846c775b1aaf8b1b4d7be.exe

  • Size

    612KB

  • MD5

    9304e2435e2e65302adf82d2fd2542c8

  • SHA1

    259862d477e94eccabbd2766fdf67c6511877787

  • SHA256

    270a27490464c7612d4599d8165047480b54640d22f846c775b1aaf8b1b4d7be

  • SHA512

    cba7e6438faa439b03c9b6ac83bd736c8359e03fd0dfc50c3042a96c9e16bfc14d9d24f712da824ed778615485ad3d05594a6cd47b0ca8d07661ea5dcc7f7837

  • SSDEEP

    12288:ey90bZLWyflpyE6P4Gbtf1lfnTWQLki6Wtxzwuv62x0oS38KHBQ:eyKLbtpyE6/fPTtkD+0uS2MhQ

Malware Config

Signatures

  • Detects Redline Stealer samples 1 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\270a27490464c7612d4599d8165047480b54640d22f846c775b1aaf8b1b4d7be.exe
    "C:\Users\Admin\AppData\Local\Temp\270a27490464c7612d4599d8165047480b54640d22f846c775b1aaf8b1b4d7be.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:388
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st672172.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st672172.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1692
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\80648290.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\80648290.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1724
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp902492.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp902492.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3536

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st672172.exe

          Filesize

          458KB

          MD5

          ce141d4b7883a20bf4613bae8cdf2586

          SHA1

          3ed623951e10f4cb4885978c15415f0fc0d5996f

          SHA256

          d073379f5175cabe1245d72715a2d9d191792d8b253e5712b986918d4e3e968a

          SHA512

          0b6bf142105d47cc71a0f0e35aa526cd61f681bc00b20376716980c147afafd4279d3a14fb7f5398f89bdaff961a2d698ba22c853efcc055087f6d2f2494b658

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st672172.exe

          Filesize

          458KB

          MD5

          ce141d4b7883a20bf4613bae8cdf2586

          SHA1

          3ed623951e10f4cb4885978c15415f0fc0d5996f

          SHA256

          d073379f5175cabe1245d72715a2d9d191792d8b253e5712b986918d4e3e968a

          SHA512

          0b6bf142105d47cc71a0f0e35aa526cd61f681bc00b20376716980c147afafd4279d3a14fb7f5398f89bdaff961a2d698ba22c853efcc055087f6d2f2494b658

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\80648290.exe

          Filesize

          11KB

          MD5

          7e93bacbbc33e6652e147e7fe07572a0

          SHA1

          421a7167da01c8da4dc4d5234ca3dd84e319e762

          SHA256

          850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

          SHA512

          250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\80648290.exe

          Filesize

          11KB

          MD5

          7e93bacbbc33e6652e147e7fe07572a0

          SHA1

          421a7167da01c8da4dc4d5234ca3dd84e319e762

          SHA256

          850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

          SHA512

          250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp902492.exe

          Filesize

          460KB

          MD5

          81feb04824185a4230b25976702f42ed

          SHA1

          7c94f5fb1ad39e05404c82177d806b3f3aceae70

          SHA256

          d88abcd9b1e851a442963742663e6134dc151884797cf81635e6786c23a3ae2d

          SHA512

          9f659f279abb369bffe289e758449a890135da973e25e00f4d8c738a3e75b9245cdb4f895842c84d5e9a7ba6a372ce26aa3bde91d1dab9234ff4982808600b22

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp902492.exe

          Filesize

          460KB

          MD5

          81feb04824185a4230b25976702f42ed

          SHA1

          7c94f5fb1ad39e05404c82177d806b3f3aceae70

          SHA256

          d88abcd9b1e851a442963742663e6134dc151884797cf81635e6786c23a3ae2d

          SHA512

          9f659f279abb369bffe289e758449a890135da973e25e00f4d8c738a3e75b9245cdb4f895842c84d5e9a7ba6a372ce26aa3bde91d1dab9234ff4982808600b22

        • memory/1724-147-0x00000000009F0000-0x00000000009FA000-memory.dmp

          Filesize

          40KB

        • memory/3536-153-0x0000000004E40000-0x00000000053E4000-memory.dmp

          Filesize

          5.6MB

        • memory/3536-154-0x0000000000820000-0x0000000000866000-memory.dmp

          Filesize

          280KB

        • memory/3536-155-0x0000000004E30000-0x0000000004E40000-memory.dmp

          Filesize

          64KB

        • memory/3536-156-0x0000000004E30000-0x0000000004E40000-memory.dmp

          Filesize

          64KB

        • memory/3536-157-0x0000000004E30000-0x0000000004E40000-memory.dmp

          Filesize

          64KB

        • memory/3536-158-0x0000000004DC0000-0x0000000004DF5000-memory.dmp

          Filesize

          212KB

        • memory/3536-159-0x0000000004DC0000-0x0000000004DF5000-memory.dmp

          Filesize

          212KB

        • memory/3536-161-0x0000000004DC0000-0x0000000004DF5000-memory.dmp

          Filesize

          212KB

        • memory/3536-163-0x0000000004DC0000-0x0000000004DF5000-memory.dmp

          Filesize

          212KB

        • memory/3536-167-0x0000000004DC0000-0x0000000004DF5000-memory.dmp

          Filesize

          212KB

        • memory/3536-165-0x0000000004DC0000-0x0000000004DF5000-memory.dmp

          Filesize

          212KB

        • memory/3536-169-0x0000000004DC0000-0x0000000004DF5000-memory.dmp

          Filesize

          212KB

        • memory/3536-171-0x0000000004DC0000-0x0000000004DF5000-memory.dmp

          Filesize

          212KB

        • memory/3536-173-0x0000000004DC0000-0x0000000004DF5000-memory.dmp

          Filesize

          212KB

        • memory/3536-175-0x0000000004DC0000-0x0000000004DF5000-memory.dmp

          Filesize

          212KB

        • memory/3536-177-0x0000000004DC0000-0x0000000004DF5000-memory.dmp

          Filesize

          212KB

        • memory/3536-179-0x0000000004DC0000-0x0000000004DF5000-memory.dmp

          Filesize

          212KB

        • memory/3536-181-0x0000000004DC0000-0x0000000004DF5000-memory.dmp

          Filesize

          212KB

        • memory/3536-183-0x0000000004DC0000-0x0000000004DF5000-memory.dmp

          Filesize

          212KB

        • memory/3536-185-0x0000000004DC0000-0x0000000004DF5000-memory.dmp

          Filesize

          212KB

        • memory/3536-187-0x0000000004DC0000-0x0000000004DF5000-memory.dmp

          Filesize

          212KB

        • memory/3536-189-0x0000000004DC0000-0x0000000004DF5000-memory.dmp

          Filesize

          212KB

        • memory/3536-191-0x0000000004DC0000-0x0000000004DF5000-memory.dmp

          Filesize

          212KB

        • memory/3536-193-0x0000000004DC0000-0x0000000004DF5000-memory.dmp

          Filesize

          212KB

        • memory/3536-195-0x0000000004DC0000-0x0000000004DF5000-memory.dmp

          Filesize

          212KB

        • memory/3536-197-0x0000000004DC0000-0x0000000004DF5000-memory.dmp

          Filesize

          212KB

        • memory/3536-199-0x0000000004DC0000-0x0000000004DF5000-memory.dmp

          Filesize

          212KB

        • memory/3536-201-0x0000000004DC0000-0x0000000004DF5000-memory.dmp

          Filesize

          212KB

        • memory/3536-203-0x0000000004DC0000-0x0000000004DF5000-memory.dmp

          Filesize

          212KB

        • memory/3536-205-0x0000000004DC0000-0x0000000004DF5000-memory.dmp

          Filesize

          212KB

        • memory/3536-207-0x0000000004DC0000-0x0000000004DF5000-memory.dmp

          Filesize

          212KB

        • memory/3536-211-0x0000000004DC0000-0x0000000004DF5000-memory.dmp

          Filesize

          212KB

        • memory/3536-213-0x0000000004DC0000-0x0000000004DF5000-memory.dmp

          Filesize

          212KB

        • memory/3536-215-0x0000000004DC0000-0x0000000004DF5000-memory.dmp

          Filesize

          212KB

        • memory/3536-209-0x0000000004DC0000-0x0000000004DF5000-memory.dmp

          Filesize

          212KB

        • memory/3536-217-0x0000000004DC0000-0x0000000004DF5000-memory.dmp

          Filesize

          212KB

        • memory/3536-219-0x0000000004DC0000-0x0000000004DF5000-memory.dmp

          Filesize

          212KB

        • memory/3536-221-0x0000000004DC0000-0x0000000004DF5000-memory.dmp

          Filesize

          212KB

        • memory/3536-950-0x00000000078B0000-0x0000000007EC8000-memory.dmp

          Filesize

          6.1MB

        • memory/3536-951-0x0000000007F70000-0x0000000007F82000-memory.dmp

          Filesize

          72KB

        • memory/3536-952-0x0000000007F90000-0x000000000809A000-memory.dmp

          Filesize

          1.0MB

        • memory/3536-953-0x0000000004E30000-0x0000000004E40000-memory.dmp

          Filesize

          64KB

        • memory/3536-954-0x00000000080B0000-0x00000000080EC000-memory.dmp

          Filesize

          240KB

        • memory/3536-956-0x0000000004E30000-0x0000000004E40000-memory.dmp

          Filesize

          64KB

        • memory/3536-957-0x0000000004E30000-0x0000000004E40000-memory.dmp

          Filesize

          64KB

        • memory/3536-958-0x0000000004E30000-0x0000000004E40000-memory.dmp

          Filesize

          64KB

        • memory/3536-959-0x0000000004E30000-0x0000000004E40000-memory.dmp

          Filesize

          64KB