Analysis
-
max time kernel
128s -
max time network
172s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
14-05-2023 18:37
Static task
static1
Behavioral task
behavioral1
Sample
e6b20152b7a02fa4ecd807646a4977b1ccca9fbd59e3dee8c1cec8c05b4e6821.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
e6b20152b7a02fa4ecd807646a4977b1ccca9fbd59e3dee8c1cec8c05b4e6821.exe
Resource
win10v2004-20230220-en
General
-
Target
e6b20152b7a02fa4ecd807646a4977b1ccca9fbd59e3dee8c1cec8c05b4e6821.exe
-
Size
1.1MB
-
MD5
913cdfd16747cffbde289b950ffa3bee
-
SHA1
f84057817f72ae8eeb4f940fc70bcf1e01010338
-
SHA256
e6b20152b7a02fa4ecd807646a4977b1ccca9fbd59e3dee8c1cec8c05b4e6821
-
SHA512
c076710e04e1135658e49ecd484b6b57ebb77805ae9010df1dfa4d1d301cb67f194627549327e5a04f99a7c0a8198fb75f0136b69f76e3c1f43302802d26c946
-
SSDEEP
24576:HyH/k8E6DW6O/2vVVXwOrbF21MsHm1a2vko6r7WzGdF/:SMJ6O/2vVVgOfOhf7WzGd
Malware Config
Extracted
redline
messi
185.161.248.75:4132
-
auth_value
b602b28664bb738e322d37baab91db28
Signatures
-
Processes:
a7908594.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection a7908594.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a7908594.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a7908594.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a7908594.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a7908594.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a7908594.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
Processes:
v7712230.exev5214296.exea7908594.exeb2576307.exepid process 916 v7712230.exe 296 v5214296.exe 1396 a7908594.exe 1880 b2576307.exe -
Loads dropped DLL 8 IoCs
Processes:
e6b20152b7a02fa4ecd807646a4977b1ccca9fbd59e3dee8c1cec8c05b4e6821.exev7712230.exev5214296.exea7908594.exeb2576307.exepid process 1716 e6b20152b7a02fa4ecd807646a4977b1ccca9fbd59e3dee8c1cec8c05b4e6821.exe 916 v7712230.exe 916 v7712230.exe 296 v5214296.exe 296 v5214296.exe 1396 a7908594.exe 296 v5214296.exe 1880 b2576307.exe -
Processes:
a7908594.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features a7908594.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" a7908594.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
e6b20152b7a02fa4ecd807646a4977b1ccca9fbd59e3dee8c1cec8c05b4e6821.exev7712230.exev5214296.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce e6b20152b7a02fa4ecd807646a4977b1ccca9fbd59e3dee8c1cec8c05b4e6821.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" e6b20152b7a02fa4ecd807646a4977b1ccca9fbd59e3dee8c1cec8c05b4e6821.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce v7712230.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v7712230.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce v5214296.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v5214296.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
a7908594.exepid process 1396 a7908594.exe 1396 a7908594.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a7908594.exedescription pid process Token: SeDebugPrivilege 1396 a7908594.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
e6b20152b7a02fa4ecd807646a4977b1ccca9fbd59e3dee8c1cec8c05b4e6821.exev7712230.exev5214296.exedescription pid process target process PID 1716 wrote to memory of 916 1716 e6b20152b7a02fa4ecd807646a4977b1ccca9fbd59e3dee8c1cec8c05b4e6821.exe v7712230.exe PID 1716 wrote to memory of 916 1716 e6b20152b7a02fa4ecd807646a4977b1ccca9fbd59e3dee8c1cec8c05b4e6821.exe v7712230.exe PID 1716 wrote to memory of 916 1716 e6b20152b7a02fa4ecd807646a4977b1ccca9fbd59e3dee8c1cec8c05b4e6821.exe v7712230.exe PID 1716 wrote to memory of 916 1716 e6b20152b7a02fa4ecd807646a4977b1ccca9fbd59e3dee8c1cec8c05b4e6821.exe v7712230.exe PID 1716 wrote to memory of 916 1716 e6b20152b7a02fa4ecd807646a4977b1ccca9fbd59e3dee8c1cec8c05b4e6821.exe v7712230.exe PID 1716 wrote to memory of 916 1716 e6b20152b7a02fa4ecd807646a4977b1ccca9fbd59e3dee8c1cec8c05b4e6821.exe v7712230.exe PID 1716 wrote to memory of 916 1716 e6b20152b7a02fa4ecd807646a4977b1ccca9fbd59e3dee8c1cec8c05b4e6821.exe v7712230.exe PID 916 wrote to memory of 296 916 v7712230.exe v5214296.exe PID 916 wrote to memory of 296 916 v7712230.exe v5214296.exe PID 916 wrote to memory of 296 916 v7712230.exe v5214296.exe PID 916 wrote to memory of 296 916 v7712230.exe v5214296.exe PID 916 wrote to memory of 296 916 v7712230.exe v5214296.exe PID 916 wrote to memory of 296 916 v7712230.exe v5214296.exe PID 916 wrote to memory of 296 916 v7712230.exe v5214296.exe PID 296 wrote to memory of 1396 296 v5214296.exe a7908594.exe PID 296 wrote to memory of 1396 296 v5214296.exe a7908594.exe PID 296 wrote to memory of 1396 296 v5214296.exe a7908594.exe PID 296 wrote to memory of 1396 296 v5214296.exe a7908594.exe PID 296 wrote to memory of 1396 296 v5214296.exe a7908594.exe PID 296 wrote to memory of 1396 296 v5214296.exe a7908594.exe PID 296 wrote to memory of 1396 296 v5214296.exe a7908594.exe PID 296 wrote to memory of 1880 296 v5214296.exe b2576307.exe PID 296 wrote to memory of 1880 296 v5214296.exe b2576307.exe PID 296 wrote to memory of 1880 296 v5214296.exe b2576307.exe PID 296 wrote to memory of 1880 296 v5214296.exe b2576307.exe PID 296 wrote to memory of 1880 296 v5214296.exe b2576307.exe PID 296 wrote to memory of 1880 296 v5214296.exe b2576307.exe PID 296 wrote to memory of 1880 296 v5214296.exe b2576307.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e6b20152b7a02fa4ecd807646a4977b1ccca9fbd59e3dee8c1cec8c05b4e6821.exe"C:\Users\Admin\AppData\Local\Temp\e6b20152b7a02fa4ecd807646a4977b1ccca9fbd59e3dee8c1cec8c05b4e6821.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7712230.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7712230.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5214296.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5214296.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7908594.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7908594.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2576307.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2576307.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7712230.exeFilesize
750KB
MD53196c8184fcbf1c2454b9b95ebc7a439
SHA15cc942fc8eaee676dfe54c08a2e0e0de420e6e8f
SHA2567d250d9192e2973377afb9371e958cd44606b1975cbc1330e9f8b0a5b9296292
SHA5120fc151b254cab6ab1f62fa2ef3a00754d199ac74d2c91db60829bca31a51b6e4b31413ec3c250eb2207692227555d627b57a3822b09c0b8302d9ec0e26e09c0c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7712230.exeFilesize
750KB
MD53196c8184fcbf1c2454b9b95ebc7a439
SHA15cc942fc8eaee676dfe54c08a2e0e0de420e6e8f
SHA2567d250d9192e2973377afb9371e958cd44606b1975cbc1330e9f8b0a5b9296292
SHA5120fc151b254cab6ab1f62fa2ef3a00754d199ac74d2c91db60829bca31a51b6e4b31413ec3c250eb2207692227555d627b57a3822b09c0b8302d9ec0e26e09c0c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5214296.exeFilesize
305KB
MD5cd6e8cda35c11974588db4c2114ed863
SHA14aad65084449d240df163519dea099c01cd11db9
SHA256858dc44642decf27c8f57bd8e7f0aa4146a0525259a13d6acafa36fce99e3032
SHA51254623d0536853d52e25d837d749ae6a54fdd1cbfd35c9ad5ab324fb59bc8e4bcf40dee55438e62733737c19d053f198df0eef76fa6ae794954817de12ed74dcd
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5214296.exeFilesize
305KB
MD5cd6e8cda35c11974588db4c2114ed863
SHA14aad65084449d240df163519dea099c01cd11db9
SHA256858dc44642decf27c8f57bd8e7f0aa4146a0525259a13d6acafa36fce99e3032
SHA51254623d0536853d52e25d837d749ae6a54fdd1cbfd35c9ad5ab324fb59bc8e4bcf40dee55438e62733737c19d053f198df0eef76fa6ae794954817de12ed74dcd
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7908594.exeFilesize
183KB
MD5ff1aa7f76d4cea755543168b431441a4
SHA1375600e48988ab127bdd7791bb865d1592ce9d59
SHA25686404d121df2718c6a95a78c19eb400c5397fdd145488c1c9eff7003203b7161
SHA512bf4a0c2ad265d5095697e432011a9b5fc6d59b8010d3ee7e3468baa9b9de6c40de3205553964b1cd53f89c458e7e9d0a36a7b970a03013e43748ba948efeb251
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7908594.exeFilesize
183KB
MD5ff1aa7f76d4cea755543168b431441a4
SHA1375600e48988ab127bdd7791bb865d1592ce9d59
SHA25686404d121df2718c6a95a78c19eb400c5397fdd145488c1c9eff7003203b7161
SHA512bf4a0c2ad265d5095697e432011a9b5fc6d59b8010d3ee7e3468baa9b9de6c40de3205553964b1cd53f89c458e7e9d0a36a7b970a03013e43748ba948efeb251
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2576307.exeFilesize
145KB
MD5fb4ebf1c1efd896dacda6f465bc638d7
SHA152ffaf6853f0c121e9e4fb7f1f9e953c2451492e
SHA256e1c9162ef3e9b1be03a36d9b88f783fe9ffc0b0419cfb6a886811ab4e8b20c57
SHA512457168e863442b599f2b568ce62b320c41f127a747d927a5a9c3508cf083f47b7da6cbcd7211506fd0298dfac2bfee8d81ee4e41875e21d65671097bcd41cdbc
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2576307.exeFilesize
145KB
MD5fb4ebf1c1efd896dacda6f465bc638d7
SHA152ffaf6853f0c121e9e4fb7f1f9e953c2451492e
SHA256e1c9162ef3e9b1be03a36d9b88f783fe9ffc0b0419cfb6a886811ab4e8b20c57
SHA512457168e863442b599f2b568ce62b320c41f127a747d927a5a9c3508cf083f47b7da6cbcd7211506fd0298dfac2bfee8d81ee4e41875e21d65671097bcd41cdbc
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7712230.exeFilesize
750KB
MD53196c8184fcbf1c2454b9b95ebc7a439
SHA15cc942fc8eaee676dfe54c08a2e0e0de420e6e8f
SHA2567d250d9192e2973377afb9371e958cd44606b1975cbc1330e9f8b0a5b9296292
SHA5120fc151b254cab6ab1f62fa2ef3a00754d199ac74d2c91db60829bca31a51b6e4b31413ec3c250eb2207692227555d627b57a3822b09c0b8302d9ec0e26e09c0c
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7712230.exeFilesize
750KB
MD53196c8184fcbf1c2454b9b95ebc7a439
SHA15cc942fc8eaee676dfe54c08a2e0e0de420e6e8f
SHA2567d250d9192e2973377afb9371e958cd44606b1975cbc1330e9f8b0a5b9296292
SHA5120fc151b254cab6ab1f62fa2ef3a00754d199ac74d2c91db60829bca31a51b6e4b31413ec3c250eb2207692227555d627b57a3822b09c0b8302d9ec0e26e09c0c
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5214296.exeFilesize
305KB
MD5cd6e8cda35c11974588db4c2114ed863
SHA14aad65084449d240df163519dea099c01cd11db9
SHA256858dc44642decf27c8f57bd8e7f0aa4146a0525259a13d6acafa36fce99e3032
SHA51254623d0536853d52e25d837d749ae6a54fdd1cbfd35c9ad5ab324fb59bc8e4bcf40dee55438e62733737c19d053f198df0eef76fa6ae794954817de12ed74dcd
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5214296.exeFilesize
305KB
MD5cd6e8cda35c11974588db4c2114ed863
SHA14aad65084449d240df163519dea099c01cd11db9
SHA256858dc44642decf27c8f57bd8e7f0aa4146a0525259a13d6acafa36fce99e3032
SHA51254623d0536853d52e25d837d749ae6a54fdd1cbfd35c9ad5ab324fb59bc8e4bcf40dee55438e62733737c19d053f198df0eef76fa6ae794954817de12ed74dcd
-
\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7908594.exeFilesize
183KB
MD5ff1aa7f76d4cea755543168b431441a4
SHA1375600e48988ab127bdd7791bb865d1592ce9d59
SHA25686404d121df2718c6a95a78c19eb400c5397fdd145488c1c9eff7003203b7161
SHA512bf4a0c2ad265d5095697e432011a9b5fc6d59b8010d3ee7e3468baa9b9de6c40de3205553964b1cd53f89c458e7e9d0a36a7b970a03013e43748ba948efeb251
-
\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7908594.exeFilesize
183KB
MD5ff1aa7f76d4cea755543168b431441a4
SHA1375600e48988ab127bdd7791bb865d1592ce9d59
SHA25686404d121df2718c6a95a78c19eb400c5397fdd145488c1c9eff7003203b7161
SHA512bf4a0c2ad265d5095697e432011a9b5fc6d59b8010d3ee7e3468baa9b9de6c40de3205553964b1cd53f89c458e7e9d0a36a7b970a03013e43748ba948efeb251
-
\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2576307.exeFilesize
145KB
MD5fb4ebf1c1efd896dacda6f465bc638d7
SHA152ffaf6853f0c121e9e4fb7f1f9e953c2451492e
SHA256e1c9162ef3e9b1be03a36d9b88f783fe9ffc0b0419cfb6a886811ab4e8b20c57
SHA512457168e863442b599f2b568ce62b320c41f127a747d927a5a9c3508cf083f47b7da6cbcd7211506fd0298dfac2bfee8d81ee4e41875e21d65671097bcd41cdbc
-
\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2576307.exeFilesize
145KB
MD5fb4ebf1c1efd896dacda6f465bc638d7
SHA152ffaf6853f0c121e9e4fb7f1f9e953c2451492e
SHA256e1c9162ef3e9b1be03a36d9b88f783fe9ffc0b0419cfb6a886811ab4e8b20c57
SHA512457168e863442b599f2b568ce62b320c41f127a747d927a5a9c3508cf083f47b7da6cbcd7211506fd0298dfac2bfee8d81ee4e41875e21d65671097bcd41cdbc
-
memory/1396-91-0x00000000004C0000-0x00000000004D6000-memory.dmpFilesize
88KB
-
memory/1396-109-0x00000000004C0000-0x00000000004D6000-memory.dmpFilesize
88KB
-
memory/1396-88-0x00000000004C0000-0x00000000004D6000-memory.dmpFilesize
88KB
-
memory/1396-93-0x00000000004C0000-0x00000000004D6000-memory.dmpFilesize
88KB
-
memory/1396-95-0x00000000004C0000-0x00000000004D6000-memory.dmpFilesize
88KB
-
memory/1396-97-0x00000000004C0000-0x00000000004D6000-memory.dmpFilesize
88KB
-
memory/1396-99-0x00000000004C0000-0x00000000004D6000-memory.dmpFilesize
88KB
-
memory/1396-101-0x00000000004C0000-0x00000000004D6000-memory.dmpFilesize
88KB
-
memory/1396-103-0x00000000004C0000-0x00000000004D6000-memory.dmpFilesize
88KB
-
memory/1396-105-0x00000000004C0000-0x00000000004D6000-memory.dmpFilesize
88KB
-
memory/1396-107-0x00000000004C0000-0x00000000004D6000-memory.dmpFilesize
88KB
-
memory/1396-89-0x00000000004C0000-0x00000000004D6000-memory.dmpFilesize
88KB
-
memory/1396-111-0x00000000004C0000-0x00000000004D6000-memory.dmpFilesize
88KB
-
memory/1396-113-0x00000000004C0000-0x00000000004D6000-memory.dmpFilesize
88KB
-
memory/1396-115-0x00000000004C0000-0x00000000004D6000-memory.dmpFilesize
88KB
-
memory/1396-116-0x0000000002430000-0x0000000002470000-memory.dmpFilesize
256KB
-
memory/1396-87-0x0000000002430000-0x0000000002470000-memory.dmpFilesize
256KB
-
memory/1396-86-0x0000000002430000-0x0000000002470000-memory.dmpFilesize
256KB
-
memory/1396-85-0x00000000004C0000-0x00000000004DC000-memory.dmpFilesize
112KB
-
memory/1396-84-0x00000000003E0000-0x00000000003FE000-memory.dmpFilesize
120KB
-
memory/1880-123-0x0000000000180000-0x00000000001AA000-memory.dmpFilesize
168KB
-
memory/1880-124-0x0000000002480000-0x00000000024C0000-memory.dmpFilesize
256KB