Analysis
-
max time kernel
149s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2023, 03:50
Static task
static1
Behavioral task
behavioral1
Sample
2726a572396a9721640a622afbd1d67143934533dfcc48d761b6fc5c5bd20fdc.exe
Resource
win10v2004-20230220-en
General
-
Target
2726a572396a9721640a622afbd1d67143934533dfcc48d761b6fc5c5bd20fdc.exe
-
Size
479KB
-
MD5
2e0f228d9138a50a7b093742ed1c9910
-
SHA1
1cc6640bc85a779cc66bc53ec3c026b1f93fd7e4
-
SHA256
2726a572396a9721640a622afbd1d67143934533dfcc48d761b6fc5c5bd20fdc
-
SHA512
5f91f5ec51350830801b3a822c9a03ed2723232573ed48b43ef72417d35c6ccdc7de1e68c6e7fcf69af28995e0efa4ea6b6d56190e27151f72bf17911058738a
-
SSDEEP
6144:KPy+bnr+Xp0yN90QEfLKPR7dx/o8N/ZNVeXDCY99Pxn51fKWgQfpLOe6MZbX:dMr7y906ASvsXP991dp6ebX
Malware Config
Extracted
redline
mufos
217.196.96.102:4132
-
auth_value
136f202e6569ad5815c34377858a255c
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a7670731.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a7670731.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a7670731.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a7670731.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a7670731.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection a7670731.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation oneetx.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation d2369378.exe -
Executes dropped EXE 7 IoCs
pid Process 4648 v7269259.exe 2232 a7670731.exe 1216 b9840839.exe 4948 d2369378.exe 1640 oneetx.exe 2328 oneetx.exe 5032 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 1352 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features a7670731.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" a7670731.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 2726a572396a9721640a622afbd1d67143934533dfcc48d761b6fc5c5bd20fdc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v7269259.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v7269259.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 2726a572396a9721640a622afbd1d67143934533dfcc48d761b6fc5c5bd20fdc.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2620 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2660 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2232 a7670731.exe 2232 a7670731.exe 1216 b9840839.exe 1216 b9840839.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2232 a7670731.exe Token: SeDebugPrivilege 1216 b9840839.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4948 d2369378.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 4868 wrote to memory of 4648 4868 2726a572396a9721640a622afbd1d67143934533dfcc48d761b6fc5c5bd20fdc.exe 82 PID 4868 wrote to memory of 4648 4868 2726a572396a9721640a622afbd1d67143934533dfcc48d761b6fc5c5bd20fdc.exe 82 PID 4868 wrote to memory of 4648 4868 2726a572396a9721640a622afbd1d67143934533dfcc48d761b6fc5c5bd20fdc.exe 82 PID 4648 wrote to memory of 2232 4648 v7269259.exe 83 PID 4648 wrote to memory of 2232 4648 v7269259.exe 83 PID 4648 wrote to memory of 2232 4648 v7269259.exe 83 PID 4648 wrote to memory of 1216 4648 v7269259.exe 87 PID 4648 wrote to memory of 1216 4648 v7269259.exe 87 PID 4648 wrote to memory of 1216 4648 v7269259.exe 87 PID 4868 wrote to memory of 4948 4868 2726a572396a9721640a622afbd1d67143934533dfcc48d761b6fc5c5bd20fdc.exe 88 PID 4868 wrote to memory of 4948 4868 2726a572396a9721640a622afbd1d67143934533dfcc48d761b6fc5c5bd20fdc.exe 88 PID 4868 wrote to memory of 4948 4868 2726a572396a9721640a622afbd1d67143934533dfcc48d761b6fc5c5bd20fdc.exe 88 PID 4948 wrote to memory of 1640 4948 d2369378.exe 90 PID 4948 wrote to memory of 1640 4948 d2369378.exe 90 PID 4948 wrote to memory of 1640 4948 d2369378.exe 90 PID 1640 wrote to memory of 2660 1640 oneetx.exe 91 PID 1640 wrote to memory of 2660 1640 oneetx.exe 91 PID 1640 wrote to memory of 2660 1640 oneetx.exe 91 PID 1640 wrote to memory of 2976 1640 oneetx.exe 93 PID 1640 wrote to memory of 2976 1640 oneetx.exe 93 PID 1640 wrote to memory of 2976 1640 oneetx.exe 93 PID 2976 wrote to memory of 4576 2976 cmd.exe 95 PID 2976 wrote to memory of 4576 2976 cmd.exe 95 PID 2976 wrote to memory of 4576 2976 cmd.exe 95 PID 2976 wrote to memory of 4252 2976 cmd.exe 96 PID 2976 wrote to memory of 4252 2976 cmd.exe 96 PID 2976 wrote to memory of 4252 2976 cmd.exe 96 PID 2976 wrote to memory of 2192 2976 cmd.exe 97 PID 2976 wrote to memory of 2192 2976 cmd.exe 97 PID 2976 wrote to memory of 2192 2976 cmd.exe 97 PID 2976 wrote to memory of 3696 2976 cmd.exe 98 PID 2976 wrote to memory of 3696 2976 cmd.exe 98 PID 2976 wrote to memory of 3696 2976 cmd.exe 98 PID 2976 wrote to memory of 4960 2976 cmd.exe 99 PID 2976 wrote to memory of 4960 2976 cmd.exe 99 PID 2976 wrote to memory of 4960 2976 cmd.exe 99 PID 2976 wrote to memory of 4068 2976 cmd.exe 100 PID 2976 wrote to memory of 4068 2976 cmd.exe 100 PID 2976 wrote to memory of 4068 2976 cmd.exe 100 PID 1640 wrote to memory of 1352 1640 oneetx.exe 106 PID 1640 wrote to memory of 1352 1640 oneetx.exe 106 PID 1640 wrote to memory of 1352 1640 oneetx.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2726a572396a9721640a622afbd1d67143934533dfcc48d761b6fc5c5bd20fdc.exe"C:\Users\Admin\AppData\Local\Temp\2726a572396a9721640a622afbd1d67143934533dfcc48d761b6fc5c5bd20fdc.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7269259.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7269259.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7670731.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7670731.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2232
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9840839.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9840839.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1216
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d2369378.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d2369378.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:2660
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:4576
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:4252
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:2192
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:3696
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:N"5⤵PID:4960
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:R" /E5⤵PID:4068
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:1352
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:2328
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:5032
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
PID:2620
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212KB
MD530b8f7e254838e074c0b555beb7c8b74
SHA18de34883fe7acc59062580f3fd775791a399be13
SHA2568b7a59615ca4b1a7f52a6f5aa3552d516df3207fe956f89d48ac4fac70c9f7e8
SHA51272c420ed9d8e414729644ba5b90996647b92be11fb06eca81d6da7933ba5953314753eff370b4219170f526a3a6e14e28baa111785b2e92df96c73b4ce5351aa
-
Filesize
212KB
MD530b8f7e254838e074c0b555beb7c8b74
SHA18de34883fe7acc59062580f3fd775791a399be13
SHA2568b7a59615ca4b1a7f52a6f5aa3552d516df3207fe956f89d48ac4fac70c9f7e8
SHA51272c420ed9d8e414729644ba5b90996647b92be11fb06eca81d6da7933ba5953314753eff370b4219170f526a3a6e14e28baa111785b2e92df96c73b4ce5351aa
-
Filesize
307KB
MD53f24644d234e2cbbb072c6d87fce7d52
SHA19f5a9861d967544b549ddd0444385c759ece9fc1
SHA256d421fd53b50910aa051173123e50396471f91198667a7289d741500fa3050a46
SHA512c38ceb1246f75bae069347b56a8783c5c6aa2306a7ce661c0d4909051407cf6ca37fbb50bca9c9ed4162aba7d4310ee72418093b2cf439100bede796ff8b1f84
-
Filesize
307KB
MD53f24644d234e2cbbb072c6d87fce7d52
SHA19f5a9861d967544b549ddd0444385c759ece9fc1
SHA256d421fd53b50910aa051173123e50396471f91198667a7289d741500fa3050a46
SHA512c38ceb1246f75bae069347b56a8783c5c6aa2306a7ce661c0d4909051407cf6ca37fbb50bca9c9ed4162aba7d4310ee72418093b2cf439100bede796ff8b1f84
-
Filesize
182KB
MD5f5b02b9406368d96f8cf801e7a3db36c
SHA16786548077783cc792257ed796762233d7032840
SHA256018cffd940dc05e1cde75aed6b005d71a117c4db5f5d28707799d33dc024efa4
SHA512bb44656fb4506e474bc7aff1e55fbb94d2b14b0f3543c54864e76db109d48a812ff4a7b1014c9da6988ac6231e66b2478a7cc45e689c443ac765405a34c47448
-
Filesize
182KB
MD5f5b02b9406368d96f8cf801e7a3db36c
SHA16786548077783cc792257ed796762233d7032840
SHA256018cffd940dc05e1cde75aed6b005d71a117c4db5f5d28707799d33dc024efa4
SHA512bb44656fb4506e474bc7aff1e55fbb94d2b14b0f3543c54864e76db109d48a812ff4a7b1014c9da6988ac6231e66b2478a7cc45e689c443ac765405a34c47448
-
Filesize
168KB
MD51352218ee491b7ee0b3051b6c464b5c7
SHA1fe1dc75d0b952c540738ebe823331dd3d16ff676
SHA256e44043a00d5b72b667b3c5d9153cb45942976028e42027b7f43a8ca2f7613d22
SHA512247a510b832e25e1f234df7bc28662363e5faf6d12b325e23f206d7aa65e16e73e2c8ecb7e2d169680be55d9ab61fcba5185cac481ee9b99ca16cd117777d7a4
-
Filesize
168KB
MD51352218ee491b7ee0b3051b6c464b5c7
SHA1fe1dc75d0b952c540738ebe823331dd3d16ff676
SHA256e44043a00d5b72b667b3c5d9153cb45942976028e42027b7f43a8ca2f7613d22
SHA512247a510b832e25e1f234df7bc28662363e5faf6d12b325e23f206d7aa65e16e73e2c8ecb7e2d169680be55d9ab61fcba5185cac481ee9b99ca16cd117777d7a4
-
Filesize
212KB
MD530b8f7e254838e074c0b555beb7c8b74
SHA18de34883fe7acc59062580f3fd775791a399be13
SHA2568b7a59615ca4b1a7f52a6f5aa3552d516df3207fe956f89d48ac4fac70c9f7e8
SHA51272c420ed9d8e414729644ba5b90996647b92be11fb06eca81d6da7933ba5953314753eff370b4219170f526a3a6e14e28baa111785b2e92df96c73b4ce5351aa
-
Filesize
212KB
MD530b8f7e254838e074c0b555beb7c8b74
SHA18de34883fe7acc59062580f3fd775791a399be13
SHA2568b7a59615ca4b1a7f52a6f5aa3552d516df3207fe956f89d48ac4fac70c9f7e8
SHA51272c420ed9d8e414729644ba5b90996647b92be11fb06eca81d6da7933ba5953314753eff370b4219170f526a3a6e14e28baa111785b2e92df96c73b4ce5351aa
-
Filesize
212KB
MD530b8f7e254838e074c0b555beb7c8b74
SHA18de34883fe7acc59062580f3fd775791a399be13
SHA2568b7a59615ca4b1a7f52a6f5aa3552d516df3207fe956f89d48ac4fac70c9f7e8
SHA51272c420ed9d8e414729644ba5b90996647b92be11fb06eca81d6da7933ba5953314753eff370b4219170f526a3a6e14e28baa111785b2e92df96c73b4ce5351aa
-
Filesize
212KB
MD530b8f7e254838e074c0b555beb7c8b74
SHA18de34883fe7acc59062580f3fd775791a399be13
SHA2568b7a59615ca4b1a7f52a6f5aa3552d516df3207fe956f89d48ac4fac70c9f7e8
SHA51272c420ed9d8e414729644ba5b90996647b92be11fb06eca81d6da7933ba5953314753eff370b4219170f526a3a6e14e28baa111785b2e92df96c73b4ce5351aa
-
Filesize
212KB
MD530b8f7e254838e074c0b555beb7c8b74
SHA18de34883fe7acc59062580f3fd775791a399be13
SHA2568b7a59615ca4b1a7f52a6f5aa3552d516df3207fe956f89d48ac4fac70c9f7e8
SHA51272c420ed9d8e414729644ba5b90996647b92be11fb06eca81d6da7933ba5953314753eff370b4219170f526a3a6e14e28baa111785b2e92df96c73b4ce5351aa
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5