Analysis
-
max time kernel
29s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
28-05-2023 18:07
Static task
static1
Behavioral task
behavioral1
Sample
08031399.exe
Resource
win7-20230220-en
General
-
Target
08031399.exe
-
Size
1.1MB
-
MD5
033b5a43d82fd615986e9fea7d8a8e6c
-
SHA1
368dae1edf4c5c6935ac41d938cc6c9e92c0e4aa
-
SHA256
acf2e5e45baa4b9a72f8a559639102a75224927a2fb75133d3cbab08de6a278a
-
SHA512
3d0ef172b0ef7b510315a27b230ed1ff161e31c5cd2aa95377a410ea96ccf9efb3bf6cd6e321cb783e0ce9af7c57b0235f93e7e0cc0452a0feef14e01ed7eb3f
-
SSDEEP
24576:FynyJ2BKsjvaXXm1MFN7tKDbJdkEybz+7DL6:gyMBLvaHNjtKD52+7
Malware Config
Extracted
redline
liza
83.97.73.127:19045
-
auth_value
198e3e9b188d6cfab0a2b0fb100bb7c5
Signatures
-
Processes:
AppLaunch.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
Processes:
z1710920.exez6419139.exeo0777267.exep0103044.exepid process 916 z1710920.exe 1108 z6419139.exe 268 o0777267.exe 328 p0103044.exe -
Loads dropped DLL 13 IoCs
Processes:
08031399.exez1710920.exez6419139.exeo0777267.exep0103044.exeWerFault.exepid process 1236 08031399.exe 916 z1710920.exe 916 z1710920.exe 1108 z6419139.exe 1108 z6419139.exe 268 o0777267.exe 1108 z6419139.exe 328 p0103044.exe 1624 WerFault.exe 1624 WerFault.exe 1624 WerFault.exe 1624 WerFault.exe 1624 WerFault.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
z1710920.exez6419139.exe08031399.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z1710920.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce z6419139.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z6419139.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce 08031399.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 08031399.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce z1710920.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
o0777267.exedescription pid process target process PID 268 set thread context of 1280 268 o0777267.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1624 328 WerFault.exe p0103044.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 1280 AppLaunch.exe 1280 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 1280 AppLaunch.exe -
Suspicious use of WriteProcessMemory 44 IoCs
Processes:
08031399.exez1710920.exez6419139.exeo0777267.exep0103044.exedescription pid process target process PID 1236 wrote to memory of 916 1236 08031399.exe z1710920.exe PID 1236 wrote to memory of 916 1236 08031399.exe z1710920.exe PID 1236 wrote to memory of 916 1236 08031399.exe z1710920.exe PID 1236 wrote to memory of 916 1236 08031399.exe z1710920.exe PID 1236 wrote to memory of 916 1236 08031399.exe z1710920.exe PID 1236 wrote to memory of 916 1236 08031399.exe z1710920.exe PID 1236 wrote to memory of 916 1236 08031399.exe z1710920.exe PID 916 wrote to memory of 1108 916 z1710920.exe z6419139.exe PID 916 wrote to memory of 1108 916 z1710920.exe z6419139.exe PID 916 wrote to memory of 1108 916 z1710920.exe z6419139.exe PID 916 wrote to memory of 1108 916 z1710920.exe z6419139.exe PID 916 wrote to memory of 1108 916 z1710920.exe z6419139.exe PID 916 wrote to memory of 1108 916 z1710920.exe z6419139.exe PID 916 wrote to memory of 1108 916 z1710920.exe z6419139.exe PID 1108 wrote to memory of 268 1108 z6419139.exe o0777267.exe PID 1108 wrote to memory of 268 1108 z6419139.exe o0777267.exe PID 1108 wrote to memory of 268 1108 z6419139.exe o0777267.exe PID 1108 wrote to memory of 268 1108 z6419139.exe o0777267.exe PID 1108 wrote to memory of 268 1108 z6419139.exe o0777267.exe PID 1108 wrote to memory of 268 1108 z6419139.exe o0777267.exe PID 1108 wrote to memory of 268 1108 z6419139.exe o0777267.exe PID 268 wrote to memory of 1280 268 o0777267.exe AppLaunch.exe PID 268 wrote to memory of 1280 268 o0777267.exe AppLaunch.exe PID 268 wrote to memory of 1280 268 o0777267.exe AppLaunch.exe PID 268 wrote to memory of 1280 268 o0777267.exe AppLaunch.exe PID 268 wrote to memory of 1280 268 o0777267.exe AppLaunch.exe PID 268 wrote to memory of 1280 268 o0777267.exe AppLaunch.exe PID 268 wrote to memory of 1280 268 o0777267.exe AppLaunch.exe PID 268 wrote to memory of 1280 268 o0777267.exe AppLaunch.exe PID 268 wrote to memory of 1280 268 o0777267.exe AppLaunch.exe PID 1108 wrote to memory of 328 1108 z6419139.exe p0103044.exe PID 1108 wrote to memory of 328 1108 z6419139.exe p0103044.exe PID 1108 wrote to memory of 328 1108 z6419139.exe p0103044.exe PID 1108 wrote to memory of 328 1108 z6419139.exe p0103044.exe PID 1108 wrote to memory of 328 1108 z6419139.exe p0103044.exe PID 1108 wrote to memory of 328 1108 z6419139.exe p0103044.exe PID 1108 wrote to memory of 328 1108 z6419139.exe p0103044.exe PID 328 wrote to memory of 1624 328 p0103044.exe WerFault.exe PID 328 wrote to memory of 1624 328 p0103044.exe WerFault.exe PID 328 wrote to memory of 1624 328 p0103044.exe WerFault.exe PID 328 wrote to memory of 1624 328 p0103044.exe WerFault.exe PID 328 wrote to memory of 1624 328 p0103044.exe WerFault.exe PID 328 wrote to memory of 1624 328 p0103044.exe WerFault.exe PID 328 wrote to memory of 1624 328 p0103044.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\08031399.exe"C:\Users\Admin\AppData\Local\Temp\08031399.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1710920.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1710920.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6419139.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6419139.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o0777267.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o0777267.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"5⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p0103044.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p0103044.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 328 -s 6405⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1710920.exeFilesize
633KB
MD56e5578a1bc6b5eaeff6d471fd3db5415
SHA17e65226e733d1fb2d1c7d6f383f9c5585c8365a5
SHA25664ed963a18c9f531b70b88952238e6e74a26b65dbcfc464b9aee53b9b6f2c101
SHA5123874efcc1af76eb18099636b485cc2a96f42762690314e80c30536c2ea9ff36cd20063b7f94c66f99b795ba58608ac0a0beb2352287b398aff28f9fcb487cd11
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1710920.exeFilesize
633KB
MD56e5578a1bc6b5eaeff6d471fd3db5415
SHA17e65226e733d1fb2d1c7d6f383f9c5585c8365a5
SHA25664ed963a18c9f531b70b88952238e6e74a26b65dbcfc464b9aee53b9b6f2c101
SHA5123874efcc1af76eb18099636b485cc2a96f42762690314e80c30536c2ea9ff36cd20063b7f94c66f99b795ba58608ac0a0beb2352287b398aff28f9fcb487cd11
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6419139.exeFilesize
290KB
MD550505eddc89e7cb140d9f399a3cde203
SHA1aa4f395ce024e137c476ae7d9459e7feccd3826c
SHA256ea6c6b97b8e3b9da1c89c21e809eaf5e49a0d732be803f24d763310c054bdb91
SHA512c81e4d24be53e61903720cae1e78b9558fc894f43064556b1fd870e82b7c520e947d084bdce0e84755ed77395bd02491c51c50b5db6a1f6b7acf7918bac67e79
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6419139.exeFilesize
290KB
MD550505eddc89e7cb140d9f399a3cde203
SHA1aa4f395ce024e137c476ae7d9459e7feccd3826c
SHA256ea6c6b97b8e3b9da1c89c21e809eaf5e49a0d732be803f24d763310c054bdb91
SHA512c81e4d24be53e61903720cae1e78b9558fc894f43064556b1fd870e82b7c520e947d084bdce0e84755ed77395bd02491c51c50b5db6a1f6b7acf7918bac67e79
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o0777267.exeFilesize
193KB
MD57380e2c7d8ed5700de7046a49a061ae8
SHA1d9af50a4c118f7d127b49c2b2560990c5a34eb4d
SHA256251f30483b5ab5ed0f9b13f0609b0cb3672b95db3f15bb1c35fb7d4af9a91640
SHA512d7e9ddcb68ffa4643724fe38389f173ecd2c6f20549a6b4f17828499313fee4d654567eae369784323c6feee5291d07030750a3589bd23df6bcb5ab05af3d79e
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o0777267.exeFilesize
193KB
MD57380e2c7d8ed5700de7046a49a061ae8
SHA1d9af50a4c118f7d127b49c2b2560990c5a34eb4d
SHA256251f30483b5ab5ed0f9b13f0609b0cb3672b95db3f15bb1c35fb7d4af9a91640
SHA512d7e9ddcb68ffa4643724fe38389f173ecd2c6f20549a6b4f17828499313fee4d654567eae369784323c6feee5291d07030750a3589bd23df6bcb5ab05af3d79e
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p0103044.exeFilesize
168KB
MD5a3cc13607f6340b76c99cceaa37e458c
SHA1dcfa3eb633da8395374b70745a5fde85228919e8
SHA2560c0300399efee094368a643289f80ae9a157e9b7a10f194ee5d52af4e12a809d
SHA512f4c5a361a3f2cb7dd0f78d53f9672da7e42cf2fa39435db8732858722f9e39543ca66c1a5860b32fbeb784f9e25635cbd1b31db53eba08b81faff6891fe775db
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p0103044.exeFilesize
168KB
MD5a3cc13607f6340b76c99cceaa37e458c
SHA1dcfa3eb633da8395374b70745a5fde85228919e8
SHA2560c0300399efee094368a643289f80ae9a157e9b7a10f194ee5d52af4e12a809d
SHA512f4c5a361a3f2cb7dd0f78d53f9672da7e42cf2fa39435db8732858722f9e39543ca66c1a5860b32fbeb784f9e25635cbd1b31db53eba08b81faff6891fe775db
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1710920.exeFilesize
633KB
MD56e5578a1bc6b5eaeff6d471fd3db5415
SHA17e65226e733d1fb2d1c7d6f383f9c5585c8365a5
SHA25664ed963a18c9f531b70b88952238e6e74a26b65dbcfc464b9aee53b9b6f2c101
SHA5123874efcc1af76eb18099636b485cc2a96f42762690314e80c30536c2ea9ff36cd20063b7f94c66f99b795ba58608ac0a0beb2352287b398aff28f9fcb487cd11
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1710920.exeFilesize
633KB
MD56e5578a1bc6b5eaeff6d471fd3db5415
SHA17e65226e733d1fb2d1c7d6f383f9c5585c8365a5
SHA25664ed963a18c9f531b70b88952238e6e74a26b65dbcfc464b9aee53b9b6f2c101
SHA5123874efcc1af76eb18099636b485cc2a96f42762690314e80c30536c2ea9ff36cd20063b7f94c66f99b795ba58608ac0a0beb2352287b398aff28f9fcb487cd11
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6419139.exeFilesize
290KB
MD550505eddc89e7cb140d9f399a3cde203
SHA1aa4f395ce024e137c476ae7d9459e7feccd3826c
SHA256ea6c6b97b8e3b9da1c89c21e809eaf5e49a0d732be803f24d763310c054bdb91
SHA512c81e4d24be53e61903720cae1e78b9558fc894f43064556b1fd870e82b7c520e947d084bdce0e84755ed77395bd02491c51c50b5db6a1f6b7acf7918bac67e79
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6419139.exeFilesize
290KB
MD550505eddc89e7cb140d9f399a3cde203
SHA1aa4f395ce024e137c476ae7d9459e7feccd3826c
SHA256ea6c6b97b8e3b9da1c89c21e809eaf5e49a0d732be803f24d763310c054bdb91
SHA512c81e4d24be53e61903720cae1e78b9558fc894f43064556b1fd870e82b7c520e947d084bdce0e84755ed77395bd02491c51c50b5db6a1f6b7acf7918bac67e79
-
\Users\Admin\AppData\Local\Temp\IXP002.TMP\o0777267.exeFilesize
193KB
MD57380e2c7d8ed5700de7046a49a061ae8
SHA1d9af50a4c118f7d127b49c2b2560990c5a34eb4d
SHA256251f30483b5ab5ed0f9b13f0609b0cb3672b95db3f15bb1c35fb7d4af9a91640
SHA512d7e9ddcb68ffa4643724fe38389f173ecd2c6f20549a6b4f17828499313fee4d654567eae369784323c6feee5291d07030750a3589bd23df6bcb5ab05af3d79e
-
\Users\Admin\AppData\Local\Temp\IXP002.TMP\o0777267.exeFilesize
193KB
MD57380e2c7d8ed5700de7046a49a061ae8
SHA1d9af50a4c118f7d127b49c2b2560990c5a34eb4d
SHA256251f30483b5ab5ed0f9b13f0609b0cb3672b95db3f15bb1c35fb7d4af9a91640
SHA512d7e9ddcb68ffa4643724fe38389f173ecd2c6f20549a6b4f17828499313fee4d654567eae369784323c6feee5291d07030750a3589bd23df6bcb5ab05af3d79e
-
\Users\Admin\AppData\Local\Temp\IXP002.TMP\p0103044.exeFilesize
168KB
MD5a3cc13607f6340b76c99cceaa37e458c
SHA1dcfa3eb633da8395374b70745a5fde85228919e8
SHA2560c0300399efee094368a643289f80ae9a157e9b7a10f194ee5d52af4e12a809d
SHA512f4c5a361a3f2cb7dd0f78d53f9672da7e42cf2fa39435db8732858722f9e39543ca66c1a5860b32fbeb784f9e25635cbd1b31db53eba08b81faff6891fe775db
-
\Users\Admin\AppData\Local\Temp\IXP002.TMP\p0103044.exeFilesize
168KB
MD5a3cc13607f6340b76c99cceaa37e458c
SHA1dcfa3eb633da8395374b70745a5fde85228919e8
SHA2560c0300399efee094368a643289f80ae9a157e9b7a10f194ee5d52af4e12a809d
SHA512f4c5a361a3f2cb7dd0f78d53f9672da7e42cf2fa39435db8732858722f9e39543ca66c1a5860b32fbeb784f9e25635cbd1b31db53eba08b81faff6891fe775db
-
\Users\Admin\AppData\Local\Temp\IXP002.TMP\p0103044.exeFilesize
168KB
MD5a3cc13607f6340b76c99cceaa37e458c
SHA1dcfa3eb633da8395374b70745a5fde85228919e8
SHA2560c0300399efee094368a643289f80ae9a157e9b7a10f194ee5d52af4e12a809d
SHA512f4c5a361a3f2cb7dd0f78d53f9672da7e42cf2fa39435db8732858722f9e39543ca66c1a5860b32fbeb784f9e25635cbd1b31db53eba08b81faff6891fe775db
-
\Users\Admin\AppData\Local\Temp\IXP002.TMP\p0103044.exeFilesize
168KB
MD5a3cc13607f6340b76c99cceaa37e458c
SHA1dcfa3eb633da8395374b70745a5fde85228919e8
SHA2560c0300399efee094368a643289f80ae9a157e9b7a10f194ee5d52af4e12a809d
SHA512f4c5a361a3f2cb7dd0f78d53f9672da7e42cf2fa39435db8732858722f9e39543ca66c1a5860b32fbeb784f9e25635cbd1b31db53eba08b81faff6891fe775db
-
\Users\Admin\AppData\Local\Temp\IXP002.TMP\p0103044.exeFilesize
168KB
MD5a3cc13607f6340b76c99cceaa37e458c
SHA1dcfa3eb633da8395374b70745a5fde85228919e8
SHA2560c0300399efee094368a643289f80ae9a157e9b7a10f194ee5d52af4e12a809d
SHA512f4c5a361a3f2cb7dd0f78d53f9672da7e42cf2fa39435db8732858722f9e39543ca66c1a5860b32fbeb784f9e25635cbd1b31db53eba08b81faff6891fe775db
-
\Users\Admin\AppData\Local\Temp\IXP002.TMP\p0103044.exeFilesize
168KB
MD5a3cc13607f6340b76c99cceaa37e458c
SHA1dcfa3eb633da8395374b70745a5fde85228919e8
SHA2560c0300399efee094368a643289f80ae9a157e9b7a10f194ee5d52af4e12a809d
SHA512f4c5a361a3f2cb7dd0f78d53f9672da7e42cf2fa39435db8732858722f9e39543ca66c1a5860b32fbeb784f9e25635cbd1b31db53eba08b81faff6891fe775db
-
\Users\Admin\AppData\Local\Temp\IXP002.TMP\p0103044.exeFilesize
168KB
MD5a3cc13607f6340b76c99cceaa37e458c
SHA1dcfa3eb633da8395374b70745a5fde85228919e8
SHA2560c0300399efee094368a643289f80ae9a157e9b7a10f194ee5d52af4e12a809d
SHA512f4c5a361a3f2cb7dd0f78d53f9672da7e42cf2fa39435db8732858722f9e39543ca66c1a5860b32fbeb784f9e25635cbd1b31db53eba08b81faff6891fe775db
-
memory/328-100-0x00000000003A0000-0x00000000003CE000-memory.dmpFilesize
184KB
-
memory/1280-85-0x0000000000090000-0x000000000009A000-memory.dmpFilesize
40KB
-
memory/1280-93-0x0000000000090000-0x000000000009A000-memory.dmpFilesize
40KB
-
memory/1280-92-0x0000000000090000-0x000000000009A000-memory.dmpFilesize
40KB
-
memory/1280-90-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/1280-86-0x0000000000090000-0x000000000009A000-memory.dmpFilesize
40KB