Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
09/05/2023, 21:51
Static task
static1
Behavioral task
behavioral1
Sample
db326b83d8aa896aabdd95fe7a75cc832e42749a3912647862cdbd93f44e6ffa.exe
Resource
win10-20230220-en
General
-
Target
db326b83d8aa896aabdd95fe7a75cc832e42749a3912647862cdbd93f44e6ffa.exe
-
Size
480KB
-
MD5
e3fb152b389a3a4797bf7d35eb4b0d61
-
SHA1
8c95fa504f835ef8f1940f8b8580bc238260e8eb
-
SHA256
db326b83d8aa896aabdd95fe7a75cc832e42749a3912647862cdbd93f44e6ffa
-
SHA512
dad3865a001d85b3729e3a8e20e9c9c7029e239c43780ffa48a11588955fc2a160a06aca99220ac4c994978862bedc10080db662f1b8da0b5c06c7daaa7dcd6a
-
SSDEEP
12288:bMrPy90XBqMVBBf3w9PUvL2XPQZT2TLoYCbt:kyvqB9fvL2/QZoMJ
Malware Config
Extracted
redline
dease
217.196.96.101:4132
-
auth_value
82e4d5f9abc21848e0345118814a4e6c
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" k9271991.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" k9271991.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" k9271991.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" k9271991.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" k9271991.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 7 IoCs
pid Process 2016 y8557942.exe 2440 k9271991.exe 4288 l4957193.exe 3924 m6196993.exe 1848 oneetx.exe 4744 oneetx.exe 3148 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 4700 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features k9271991.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" k9271991.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce db326b83d8aa896aabdd95fe7a75cc832e42749a3912647862cdbd93f44e6ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" db326b83d8aa896aabdd95fe7a75cc832e42749a3912647862cdbd93f44e6ffa.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce y8557942.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y8557942.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3608 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2440 k9271991.exe 2440 k9271991.exe 4288 l4957193.exe 4288 l4957193.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2440 k9271991.exe Token: SeDebugPrivilege 4288 l4957193.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3924 m6196993.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 2008 wrote to memory of 2016 2008 db326b83d8aa896aabdd95fe7a75cc832e42749a3912647862cdbd93f44e6ffa.exe 66 PID 2008 wrote to memory of 2016 2008 db326b83d8aa896aabdd95fe7a75cc832e42749a3912647862cdbd93f44e6ffa.exe 66 PID 2008 wrote to memory of 2016 2008 db326b83d8aa896aabdd95fe7a75cc832e42749a3912647862cdbd93f44e6ffa.exe 66 PID 2016 wrote to memory of 2440 2016 y8557942.exe 67 PID 2016 wrote to memory of 2440 2016 y8557942.exe 67 PID 2016 wrote to memory of 2440 2016 y8557942.exe 67 PID 2016 wrote to memory of 4288 2016 y8557942.exe 68 PID 2016 wrote to memory of 4288 2016 y8557942.exe 68 PID 2016 wrote to memory of 4288 2016 y8557942.exe 68 PID 2008 wrote to memory of 3924 2008 db326b83d8aa896aabdd95fe7a75cc832e42749a3912647862cdbd93f44e6ffa.exe 70 PID 2008 wrote to memory of 3924 2008 db326b83d8aa896aabdd95fe7a75cc832e42749a3912647862cdbd93f44e6ffa.exe 70 PID 2008 wrote to memory of 3924 2008 db326b83d8aa896aabdd95fe7a75cc832e42749a3912647862cdbd93f44e6ffa.exe 70 PID 3924 wrote to memory of 1848 3924 m6196993.exe 71 PID 3924 wrote to memory of 1848 3924 m6196993.exe 71 PID 3924 wrote to memory of 1848 3924 m6196993.exe 71 PID 1848 wrote to memory of 3608 1848 oneetx.exe 72 PID 1848 wrote to memory of 3608 1848 oneetx.exe 72 PID 1848 wrote to memory of 3608 1848 oneetx.exe 72 PID 1848 wrote to memory of 3820 1848 oneetx.exe 74 PID 1848 wrote to memory of 3820 1848 oneetx.exe 74 PID 1848 wrote to memory of 3820 1848 oneetx.exe 74 PID 3820 wrote to memory of 1352 3820 cmd.exe 76 PID 3820 wrote to memory of 1352 3820 cmd.exe 76 PID 3820 wrote to memory of 1352 3820 cmd.exe 76 PID 3820 wrote to memory of 2628 3820 cmd.exe 77 PID 3820 wrote to memory of 2628 3820 cmd.exe 77 PID 3820 wrote to memory of 2628 3820 cmd.exe 77 PID 3820 wrote to memory of 2916 3820 cmd.exe 78 PID 3820 wrote to memory of 2916 3820 cmd.exe 78 PID 3820 wrote to memory of 2916 3820 cmd.exe 78 PID 3820 wrote to memory of 3752 3820 cmd.exe 79 PID 3820 wrote to memory of 3752 3820 cmd.exe 79 PID 3820 wrote to memory of 3752 3820 cmd.exe 79 PID 3820 wrote to memory of 3688 3820 cmd.exe 80 PID 3820 wrote to memory of 3688 3820 cmd.exe 80 PID 3820 wrote to memory of 3688 3820 cmd.exe 80 PID 3820 wrote to memory of 4344 3820 cmd.exe 81 PID 3820 wrote to memory of 4344 3820 cmd.exe 81 PID 3820 wrote to memory of 4344 3820 cmd.exe 81 PID 1848 wrote to memory of 4700 1848 oneetx.exe 82 PID 1848 wrote to memory of 4700 1848 oneetx.exe 82 PID 1848 wrote to memory of 4700 1848 oneetx.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\db326b83d8aa896aabdd95fe7a75cc832e42749a3912647862cdbd93f44e6ffa.exe"C:\Users\Admin\AppData\Local\Temp\db326b83d8aa896aabdd95fe7a75cc832e42749a3912647862cdbd93f44e6ffa.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8557942.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8557942.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k9271991.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k9271991.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2440
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4957193.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4957193.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4288
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m6196993.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m6196993.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:3608
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:1352
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:2628
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:2916
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:3752
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:N"5⤵PID:3688
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:R" /E5⤵PID:4344
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:4700
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:4744
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:3148
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212KB
MD5f2688d0d59008c382d83a958db0b2c6b
SHA12d9975d2ccf7e0e789f307bc797ce43df50546b2
SHA256b4c2bdf0e41ba1b032ea7441f9ce800b2b64c69a3e82c5d8e129b6f62101b0b9
SHA512f10048a78bb14cc0bebe54ca6062e9e99dc07dab66b7b6d2cd3144f49d93d0f49330e0116bc9743541b58a3ee2de430a7d4e4ec3bf070c6569d76d671e3c02fe
-
Filesize
212KB
MD5f2688d0d59008c382d83a958db0b2c6b
SHA12d9975d2ccf7e0e789f307bc797ce43df50546b2
SHA256b4c2bdf0e41ba1b032ea7441f9ce800b2b64c69a3e82c5d8e129b6f62101b0b9
SHA512f10048a78bb14cc0bebe54ca6062e9e99dc07dab66b7b6d2cd3144f49d93d0f49330e0116bc9743541b58a3ee2de430a7d4e4ec3bf070c6569d76d671e3c02fe
-
Filesize
309KB
MD5f6968b387130555a08a45f65514d32d4
SHA181f08df3fc60c030c1a6055a9da5de50359622c2
SHA256d2c0838fa07c45f331f819f223e839c90a27fb1767c317089bef0adf8cf5d917
SHA5124dc5d6ce81521303614519f95ca56894071119f900bb576c27bad76d8d4ca736c69e687afa68257c8664dfeda896b281e8370515dbb4de8c9a47c0981f2e4c4a
-
Filesize
309KB
MD5f6968b387130555a08a45f65514d32d4
SHA181f08df3fc60c030c1a6055a9da5de50359622c2
SHA256d2c0838fa07c45f331f819f223e839c90a27fb1767c317089bef0adf8cf5d917
SHA5124dc5d6ce81521303614519f95ca56894071119f900bb576c27bad76d8d4ca736c69e687afa68257c8664dfeda896b281e8370515dbb4de8c9a47c0981f2e4c4a
-
Filesize
181KB
MD5014961b4c9764a4b81757884a57d7f72
SHA164797a68fc4adfb64cb527fd23f603803e711267
SHA256a2d0fa17bb978c5b36d72251ec1d4d75ebdbabd8ff3beff90bf3c964e565b81b
SHA512b353ad0b82a723b6accc8f95be4002fcee2b9b72a1e5da3978e494a6b2445239c840bebf65ac746ada4f35eb5e091696553f778665f956ccd58bf8a20a659ff0
-
Filesize
181KB
MD5014961b4c9764a4b81757884a57d7f72
SHA164797a68fc4adfb64cb527fd23f603803e711267
SHA256a2d0fa17bb978c5b36d72251ec1d4d75ebdbabd8ff3beff90bf3c964e565b81b
SHA512b353ad0b82a723b6accc8f95be4002fcee2b9b72a1e5da3978e494a6b2445239c840bebf65ac746ada4f35eb5e091696553f778665f956ccd58bf8a20a659ff0
-
Filesize
168KB
MD508f31efb194876ae05fcc57339d94140
SHA16df51bc2d21cf322c932ab653c213481b82ea001
SHA256f9acd7b6af4593c1e8295da2f8c8a22f53f43754534db172c1b6a8e1542a023c
SHA5124df51bdcc142211931b7a4f7d5b1d7966fa61402b4185c0fbb4e5c77af4159564f7451bde419cb7208d9d5a52d0ba53c690817b226015452fa0c80915a72b506
-
Filesize
168KB
MD508f31efb194876ae05fcc57339d94140
SHA16df51bc2d21cf322c932ab653c213481b82ea001
SHA256f9acd7b6af4593c1e8295da2f8c8a22f53f43754534db172c1b6a8e1542a023c
SHA5124df51bdcc142211931b7a4f7d5b1d7966fa61402b4185c0fbb4e5c77af4159564f7451bde419cb7208d9d5a52d0ba53c690817b226015452fa0c80915a72b506
-
Filesize
212KB
MD5f2688d0d59008c382d83a958db0b2c6b
SHA12d9975d2ccf7e0e789f307bc797ce43df50546b2
SHA256b4c2bdf0e41ba1b032ea7441f9ce800b2b64c69a3e82c5d8e129b6f62101b0b9
SHA512f10048a78bb14cc0bebe54ca6062e9e99dc07dab66b7b6d2cd3144f49d93d0f49330e0116bc9743541b58a3ee2de430a7d4e4ec3bf070c6569d76d671e3c02fe
-
Filesize
212KB
MD5f2688d0d59008c382d83a958db0b2c6b
SHA12d9975d2ccf7e0e789f307bc797ce43df50546b2
SHA256b4c2bdf0e41ba1b032ea7441f9ce800b2b64c69a3e82c5d8e129b6f62101b0b9
SHA512f10048a78bb14cc0bebe54ca6062e9e99dc07dab66b7b6d2cd3144f49d93d0f49330e0116bc9743541b58a3ee2de430a7d4e4ec3bf070c6569d76d671e3c02fe
-
Filesize
212KB
MD5f2688d0d59008c382d83a958db0b2c6b
SHA12d9975d2ccf7e0e789f307bc797ce43df50546b2
SHA256b4c2bdf0e41ba1b032ea7441f9ce800b2b64c69a3e82c5d8e129b6f62101b0b9
SHA512f10048a78bb14cc0bebe54ca6062e9e99dc07dab66b7b6d2cd3144f49d93d0f49330e0116bc9743541b58a3ee2de430a7d4e4ec3bf070c6569d76d671e3c02fe
-
Filesize
212KB
MD5f2688d0d59008c382d83a958db0b2c6b
SHA12d9975d2ccf7e0e789f307bc797ce43df50546b2
SHA256b4c2bdf0e41ba1b032ea7441f9ce800b2b64c69a3e82c5d8e129b6f62101b0b9
SHA512f10048a78bb14cc0bebe54ca6062e9e99dc07dab66b7b6d2cd3144f49d93d0f49330e0116bc9743541b58a3ee2de430a7d4e4ec3bf070c6569d76d671e3c02fe
-
Filesize
212KB
MD5f2688d0d59008c382d83a958db0b2c6b
SHA12d9975d2ccf7e0e789f307bc797ce43df50546b2
SHA256b4c2bdf0e41ba1b032ea7441f9ce800b2b64c69a3e82c5d8e129b6f62101b0b9
SHA512f10048a78bb14cc0bebe54ca6062e9e99dc07dab66b7b6d2cd3144f49d93d0f49330e0116bc9743541b58a3ee2de430a7d4e4ec3bf070c6569d76d671e3c02fe
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53