Analysis
-
max time kernel
104s -
max time network
150s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
10/05/2023, 07:49
Static task
static1
Behavioral task
behavioral1
Sample
e88444241a629edb7203fae11d29fb1f42e010106c808592a50f86cc8e3b038e.exe
Resource
win10-20230220-en
General
-
Target
e88444241a629edb7203fae11d29fb1f42e010106c808592a50f86cc8e3b038e.exe
-
Size
479KB
-
MD5
46e585869aa9c82f01a6dbea123beee0
-
SHA1
deff1d87fad2228926806e32f497b76bdfa7c804
-
SHA256
e88444241a629edb7203fae11d29fb1f42e010106c808592a50f86cc8e3b038e
-
SHA512
b9d1a2bcc35c3dddc4b1a872087a98b5b851617331ff5d53dad0c65bb8f173012f3ad93f446cc7b1a0941fed1dff88ace11233a21c5da7e2ef4acef5726da57b
-
SSDEEP
12288:oMrXy90fMSyAqdJjQIecLlgRUlcoCoDuFCusg:fy82AMJMchgW2oDqCusg
Malware Config
Extracted
redline
divan
217.196.96.102:4132
-
auth_value
b414986bebd7f5a3ec9aee0341b8e769
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" k2349051.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" k2349051.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" k2349051.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" k2349051.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" k2349051.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 7 IoCs
pid Process 3512 y9989669.exe 1728 k2349051.exe 4372 l1833130.exe 4760 m9003941.exe 4936 oneetx.exe 4716 oneetx.exe 4784 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 3348 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features k2349051.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" k2349051.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y9989669.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce e88444241a629edb7203fae11d29fb1f42e010106c808592a50f86cc8e3b038e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" e88444241a629edb7203fae11d29fb1f42e010106c808592a50f86cc8e3b038e.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce y9989669.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4980 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1728 k2349051.exe 1728 k2349051.exe 4372 l1833130.exe 4372 l1833130.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1728 k2349051.exe Token: SeDebugPrivilege 4372 l1833130.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4760 m9003941.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 4024 wrote to memory of 3512 4024 e88444241a629edb7203fae11d29fb1f42e010106c808592a50f86cc8e3b038e.exe 66 PID 4024 wrote to memory of 3512 4024 e88444241a629edb7203fae11d29fb1f42e010106c808592a50f86cc8e3b038e.exe 66 PID 4024 wrote to memory of 3512 4024 e88444241a629edb7203fae11d29fb1f42e010106c808592a50f86cc8e3b038e.exe 66 PID 3512 wrote to memory of 1728 3512 y9989669.exe 67 PID 3512 wrote to memory of 1728 3512 y9989669.exe 67 PID 3512 wrote to memory of 1728 3512 y9989669.exe 67 PID 3512 wrote to memory of 4372 3512 y9989669.exe 68 PID 3512 wrote to memory of 4372 3512 y9989669.exe 68 PID 3512 wrote to memory of 4372 3512 y9989669.exe 68 PID 4024 wrote to memory of 4760 4024 e88444241a629edb7203fae11d29fb1f42e010106c808592a50f86cc8e3b038e.exe 70 PID 4024 wrote to memory of 4760 4024 e88444241a629edb7203fae11d29fb1f42e010106c808592a50f86cc8e3b038e.exe 70 PID 4024 wrote to memory of 4760 4024 e88444241a629edb7203fae11d29fb1f42e010106c808592a50f86cc8e3b038e.exe 70 PID 4760 wrote to memory of 4936 4760 m9003941.exe 71 PID 4760 wrote to memory of 4936 4760 m9003941.exe 71 PID 4760 wrote to memory of 4936 4760 m9003941.exe 71 PID 4936 wrote to memory of 4980 4936 oneetx.exe 72 PID 4936 wrote to memory of 4980 4936 oneetx.exe 72 PID 4936 wrote to memory of 4980 4936 oneetx.exe 72 PID 4936 wrote to memory of 3144 4936 oneetx.exe 74 PID 4936 wrote to memory of 3144 4936 oneetx.exe 74 PID 4936 wrote to memory of 3144 4936 oneetx.exe 74 PID 3144 wrote to memory of 2632 3144 cmd.exe 76 PID 3144 wrote to memory of 2632 3144 cmd.exe 76 PID 3144 wrote to memory of 2632 3144 cmd.exe 76 PID 3144 wrote to memory of 404 3144 cmd.exe 77 PID 3144 wrote to memory of 404 3144 cmd.exe 77 PID 3144 wrote to memory of 404 3144 cmd.exe 77 PID 3144 wrote to memory of 3792 3144 cmd.exe 78 PID 3144 wrote to memory of 3792 3144 cmd.exe 78 PID 3144 wrote to memory of 3792 3144 cmd.exe 78 PID 3144 wrote to memory of 4612 3144 cmd.exe 79 PID 3144 wrote to memory of 4612 3144 cmd.exe 79 PID 3144 wrote to memory of 4612 3144 cmd.exe 79 PID 3144 wrote to memory of 4616 3144 cmd.exe 80 PID 3144 wrote to memory of 4616 3144 cmd.exe 80 PID 3144 wrote to memory of 4616 3144 cmd.exe 80 PID 3144 wrote to memory of 4312 3144 cmd.exe 81 PID 3144 wrote to memory of 4312 3144 cmd.exe 81 PID 3144 wrote to memory of 4312 3144 cmd.exe 81 PID 4936 wrote to memory of 3348 4936 oneetx.exe 83 PID 4936 wrote to memory of 3348 4936 oneetx.exe 83 PID 4936 wrote to memory of 3348 4936 oneetx.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\e88444241a629edb7203fae11d29fb1f42e010106c808592a50f86cc8e3b038e.exe"C:\Users\Admin\AppData\Local\Temp\e88444241a629edb7203fae11d29fb1f42e010106c808592a50f86cc8e3b038e.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9989669.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9989669.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2349051.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2349051.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1728
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1833130.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1833130.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4372
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m9003941.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m9003941.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:4980
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:2632
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:404
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:3792
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:4612
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:N"5⤵PID:4616
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:R" /E5⤵PID:4312
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:3348
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:4716
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:4784
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212KB
MD572d3167d4bef056ed122f23ced089f60
SHA12f6e80661164bd8bda8f6d0843352f7b1828299e
SHA256a3fb2bac0e6af0301db3dc7410748fb6b72348d35fc447bb1afe3740d7d470f1
SHA512f16038ecd0915accb7b5619bdf92360ddccb641356a11ba127c343be194bc36fbc5497c73d1022e94274fae2d9d28469599ea24d6a52ff5a9d3a0e1de0127718
-
Filesize
212KB
MD572d3167d4bef056ed122f23ced089f60
SHA12f6e80661164bd8bda8f6d0843352f7b1828299e
SHA256a3fb2bac0e6af0301db3dc7410748fb6b72348d35fc447bb1afe3740d7d470f1
SHA512f16038ecd0915accb7b5619bdf92360ddccb641356a11ba127c343be194bc36fbc5497c73d1022e94274fae2d9d28469599ea24d6a52ff5a9d3a0e1de0127718
-
Filesize
307KB
MD50c02b164fecb108f6a63df4c5d95da1b
SHA1f1db057672ba29271d1c5c2294f9c7a2ed58c15d
SHA256b1e9627022c930d53afade0636debd718e8eb60ba53b5697cfc90fb800a0ccdb
SHA512bf895893a493d73bacad84fb943420af730cb2fb96ffc0d42bf197a022a57904b24f18860ecc74fda3bdac1e0369eeb354fff9b587fbe47d358afbd70ed13192
-
Filesize
307KB
MD50c02b164fecb108f6a63df4c5d95da1b
SHA1f1db057672ba29271d1c5c2294f9c7a2ed58c15d
SHA256b1e9627022c930d53afade0636debd718e8eb60ba53b5697cfc90fb800a0ccdb
SHA512bf895893a493d73bacad84fb943420af730cb2fb96ffc0d42bf197a022a57904b24f18860ecc74fda3bdac1e0369eeb354fff9b587fbe47d358afbd70ed13192
-
Filesize
182KB
MD557ef151a4abf1f353b0670f9fd22fd0f
SHA1ecb730913ab1106b984c37a86afa05d4a2b1b47b
SHA2568b849d4ca3613e1bf4b9c87f600bb05f63e480b818b53b99f27a78c5b1b2cac1
SHA512baf20fd242bec2428375395485cccb54402c8eafe3bd1d715d7b7682695a66379ebad62e6d3ca84c72c9338b66e968d5f349b664f43018f379cfa691f496ee09
-
Filesize
182KB
MD557ef151a4abf1f353b0670f9fd22fd0f
SHA1ecb730913ab1106b984c37a86afa05d4a2b1b47b
SHA2568b849d4ca3613e1bf4b9c87f600bb05f63e480b818b53b99f27a78c5b1b2cac1
SHA512baf20fd242bec2428375395485cccb54402c8eafe3bd1d715d7b7682695a66379ebad62e6d3ca84c72c9338b66e968d5f349b664f43018f379cfa691f496ee09
-
Filesize
168KB
MD53cc004332f5d25e97150a3724b4bddde
SHA19329779f2be2b6773237785631e5198befc007be
SHA25667804b845023676b9869663815c2aa6af57b0bfa052e7f5fb78bc371ea6d6607
SHA512ededc84e747bb5ace1ac2834b63e40388601554c41da53349195b2e22dfa857631874f06befb4ec37d0c5700119b1deed76af2f911aec45a47f7308eecb982e2
-
Filesize
168KB
MD53cc004332f5d25e97150a3724b4bddde
SHA19329779f2be2b6773237785631e5198befc007be
SHA25667804b845023676b9869663815c2aa6af57b0bfa052e7f5fb78bc371ea6d6607
SHA512ededc84e747bb5ace1ac2834b63e40388601554c41da53349195b2e22dfa857631874f06befb4ec37d0c5700119b1deed76af2f911aec45a47f7308eecb982e2
-
Filesize
212KB
MD572d3167d4bef056ed122f23ced089f60
SHA12f6e80661164bd8bda8f6d0843352f7b1828299e
SHA256a3fb2bac0e6af0301db3dc7410748fb6b72348d35fc447bb1afe3740d7d470f1
SHA512f16038ecd0915accb7b5619bdf92360ddccb641356a11ba127c343be194bc36fbc5497c73d1022e94274fae2d9d28469599ea24d6a52ff5a9d3a0e1de0127718
-
Filesize
212KB
MD572d3167d4bef056ed122f23ced089f60
SHA12f6e80661164bd8bda8f6d0843352f7b1828299e
SHA256a3fb2bac0e6af0301db3dc7410748fb6b72348d35fc447bb1afe3740d7d470f1
SHA512f16038ecd0915accb7b5619bdf92360ddccb641356a11ba127c343be194bc36fbc5497c73d1022e94274fae2d9d28469599ea24d6a52ff5a9d3a0e1de0127718
-
Filesize
212KB
MD572d3167d4bef056ed122f23ced089f60
SHA12f6e80661164bd8bda8f6d0843352f7b1828299e
SHA256a3fb2bac0e6af0301db3dc7410748fb6b72348d35fc447bb1afe3740d7d470f1
SHA512f16038ecd0915accb7b5619bdf92360ddccb641356a11ba127c343be194bc36fbc5497c73d1022e94274fae2d9d28469599ea24d6a52ff5a9d3a0e1de0127718
-
Filesize
212KB
MD572d3167d4bef056ed122f23ced089f60
SHA12f6e80661164bd8bda8f6d0843352f7b1828299e
SHA256a3fb2bac0e6af0301db3dc7410748fb6b72348d35fc447bb1afe3740d7d470f1
SHA512f16038ecd0915accb7b5619bdf92360ddccb641356a11ba127c343be194bc36fbc5497c73d1022e94274fae2d9d28469599ea24d6a52ff5a9d3a0e1de0127718
-
Filesize
212KB
MD572d3167d4bef056ed122f23ced089f60
SHA12f6e80661164bd8bda8f6d0843352f7b1828299e
SHA256a3fb2bac0e6af0301db3dc7410748fb6b72348d35fc447bb1afe3740d7d470f1
SHA512f16038ecd0915accb7b5619bdf92360ddccb641356a11ba127c343be194bc36fbc5497c73d1022e94274fae2d9d28469599ea24d6a52ff5a9d3a0e1de0127718
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53