Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
05-06-2023 00:00
Static task
static1
Behavioral task
behavioral1
Sample
f400406675e078e6465430676ab8efc736fe42d52d38fb02c7829840d301e317.exe
Resource
win10-20230220-en
General
-
Target
f400406675e078e6465430676ab8efc736fe42d52d38fb02c7829840d301e317.exe
-
Size
580KB
-
MD5
3d33cc4a4007bf7d7e26dae656fab795
-
SHA1
e908a0268e62aa3cbc70fb40276eccde98455106
-
SHA256
f400406675e078e6465430676ab8efc736fe42d52d38fb02c7829840d301e317
-
SHA512
67e5f38d74a6bdbfcec27519ac441cd576d8537fdc31d52876aedd5c8f415ce042e10b4d45e7bc24c31963f0afcc7c508ac2de5a3991a6aa4a400b44faf9b7b9
-
SSDEEP
12288:aMrWy90/gB9v1iFA7j8cZMdxSTjRGBsD7FKWvUkxxJI3ZB:MylNSi8cydANGBiAWFxx4
Malware Config
Extracted
redline
maxi
83.97.73.126:19046
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Signatures
-
Processes:
a5581629.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a5581629.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a5581629.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a5581629.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a5581629.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a5581629.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
Processes:
v4640148.exev5539219.exea5581629.exeb8421290.exepid process 1500 v4640148.exe 1788 v5539219.exe 4940 a5581629.exe 2032 b8421290.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
a5581629.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a5581629.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
f400406675e078e6465430676ab8efc736fe42d52d38fb02c7829840d301e317.exev4640148.exev5539219.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" f400406675e078e6465430676ab8efc736fe42d52d38fb02c7829840d301e317.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v4640148.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v4640148.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v5539219.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v5539219.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce f400406675e078e6465430676ab8efc736fe42d52d38fb02c7829840d301e317.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 36 IoCs
Processes:
a5581629.exeb8421290.exepid process 4940 a5581629.exe 4940 a5581629.exe 2032 b8421290.exe 2032 b8421290.exe 2032 b8421290.exe 2032 b8421290.exe 2032 b8421290.exe 2032 b8421290.exe 2032 b8421290.exe 2032 b8421290.exe 2032 b8421290.exe 2032 b8421290.exe 2032 b8421290.exe 2032 b8421290.exe 2032 b8421290.exe 2032 b8421290.exe 2032 b8421290.exe 2032 b8421290.exe 2032 b8421290.exe 2032 b8421290.exe 2032 b8421290.exe 2032 b8421290.exe 2032 b8421290.exe 2032 b8421290.exe 2032 b8421290.exe 2032 b8421290.exe 2032 b8421290.exe 2032 b8421290.exe 2032 b8421290.exe 2032 b8421290.exe 2032 b8421290.exe 2032 b8421290.exe 2032 b8421290.exe 2032 b8421290.exe 2032 b8421290.exe 2032 b8421290.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
a5581629.exeb8421290.exedescription pid process Token: SeDebugPrivilege 4940 a5581629.exe Token: SeDebugPrivilege 2032 b8421290.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
f400406675e078e6465430676ab8efc736fe42d52d38fb02c7829840d301e317.exev4640148.exev5539219.exedescription pid process target process PID 1232 wrote to memory of 1500 1232 f400406675e078e6465430676ab8efc736fe42d52d38fb02c7829840d301e317.exe v4640148.exe PID 1232 wrote to memory of 1500 1232 f400406675e078e6465430676ab8efc736fe42d52d38fb02c7829840d301e317.exe v4640148.exe PID 1232 wrote to memory of 1500 1232 f400406675e078e6465430676ab8efc736fe42d52d38fb02c7829840d301e317.exe v4640148.exe PID 1500 wrote to memory of 1788 1500 v4640148.exe v5539219.exe PID 1500 wrote to memory of 1788 1500 v4640148.exe v5539219.exe PID 1500 wrote to memory of 1788 1500 v4640148.exe v5539219.exe PID 1788 wrote to memory of 4940 1788 v5539219.exe a5581629.exe PID 1788 wrote to memory of 4940 1788 v5539219.exe a5581629.exe PID 1788 wrote to memory of 2032 1788 v5539219.exe b8421290.exe PID 1788 wrote to memory of 2032 1788 v5539219.exe b8421290.exe PID 1788 wrote to memory of 2032 1788 v5539219.exe b8421290.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f400406675e078e6465430676ab8efc736fe42d52d38fb02c7829840d301e317.exe"C:\Users\Admin\AppData\Local\Temp\f400406675e078e6465430676ab8efc736fe42d52d38fb02c7829840d301e317.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4640148.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4640148.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5539219.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5539219.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a5581629.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a5581629.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8421290.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8421290.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4640148.exeFilesize
378KB
MD508310e1252404cb9eb0c95405916b4e6
SHA1a2e753db164b1064f92753ebe43f00cdda5faddb
SHA256e9a223064eb629045c3df2be145cb4e4b87aa4612bb9f516bfab57000b5ed73b
SHA5125d8f9f6ed2aed8d18be191aa1cb69c91fdfc43f8b9f98a0da6f76287276f82ac5682f8fd0ace0ea51631efdb0321c4aa205cc9adb4e012e21bc3a0b29d4dc6a1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4640148.exeFilesize
378KB
MD508310e1252404cb9eb0c95405916b4e6
SHA1a2e753db164b1064f92753ebe43f00cdda5faddb
SHA256e9a223064eb629045c3df2be145cb4e4b87aa4612bb9f516bfab57000b5ed73b
SHA5125d8f9f6ed2aed8d18be191aa1cb69c91fdfc43f8b9f98a0da6f76287276f82ac5682f8fd0ace0ea51631efdb0321c4aa205cc9adb4e012e21bc3a0b29d4dc6a1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5539219.exeFilesize
206KB
MD51a59af8cfe51430ba3232b6440be2258
SHA145981b180827d80e9461c6127e0c4732819c4379
SHA256b3116bcb09056ee96110b042701d78450dac078a8e0383a70b0a5aff4f8309e4
SHA512827219098cc9c702f719b28fb95bdd0a21d12f4ae50e53434dfb2dd32ac6f7432da58cb03c30942111672e84fdb0ae3bda2d1596de5fdc0c932f474b0ca0b724
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5539219.exeFilesize
206KB
MD51a59af8cfe51430ba3232b6440be2258
SHA145981b180827d80e9461c6127e0c4732819c4379
SHA256b3116bcb09056ee96110b042701d78450dac078a8e0383a70b0a5aff4f8309e4
SHA512827219098cc9c702f719b28fb95bdd0a21d12f4ae50e53434dfb2dd32ac6f7432da58cb03c30942111672e84fdb0ae3bda2d1596de5fdc0c932f474b0ca0b724
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a5581629.exeFilesize
11KB
MD57718786682a8337d7648a66452f38451
SHA18c920f18fcba96bf298b6b4fedc106d41bffc15d
SHA256bfaddfa17ef956d9ff60aa9a7e934ceb72aaa5d3fa44f25301dc311cb84f7062
SHA5123b5ebf59a31776f85d2c69d054e67e39643b0953501149559892a09281470458ffbb1791a954b846289490b940e766a573804711fece9c66e1fd496ba1e59106
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a5581629.exeFilesize
11KB
MD57718786682a8337d7648a66452f38451
SHA18c920f18fcba96bf298b6b4fedc106d41bffc15d
SHA256bfaddfa17ef956d9ff60aa9a7e934ceb72aaa5d3fa44f25301dc311cb84f7062
SHA5123b5ebf59a31776f85d2c69d054e67e39643b0953501149559892a09281470458ffbb1791a954b846289490b940e766a573804711fece9c66e1fd496ba1e59106
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8421290.exeFilesize
172KB
MD530aa28ce8fe7e0306c6c23f43a8188be
SHA1c5e75ac0d08b223833df143725f403b2f5ad518b
SHA256b6756eac7497c8eaf1f8d0d8860e84ed6c4204a3c061367ea4304c641e2f68f0
SHA512d3b2f2bda8634daf0e1f98ece78e4aefc40ac2d644cdef9ee2d7e71f998f2f70da9e78b14366c25a21cc45714bca832acb0888c21bbc33aabf8c52c0721d0578
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8421290.exeFilesize
172KB
MD530aa28ce8fe7e0306c6c23f43a8188be
SHA1c5e75ac0d08b223833df143725f403b2f5ad518b
SHA256b6756eac7497c8eaf1f8d0d8860e84ed6c4204a3c061367ea4304c641e2f68f0
SHA512d3b2f2bda8634daf0e1f98ece78e4aefc40ac2d644cdef9ee2d7e71f998f2f70da9e78b14366c25a21cc45714bca832acb0888c21bbc33aabf8c52c0721d0578
-
memory/2032-156-0x000000000AE40000-0x000000000AED2000-memory.dmpFilesize
584KB
-
memory/2032-155-0x000000000A680000-0x000000000A6F6000-memory.dmpFilesize
472KB
-
memory/2032-148-0x0000000004D80000-0x0000000004D86000-memory.dmpFilesize
24KB
-
memory/2032-149-0x000000000A790000-0x000000000AD96000-memory.dmpFilesize
6.0MB
-
memory/2032-150-0x000000000A2D0000-0x000000000A3DA000-memory.dmpFilesize
1.0MB
-
memory/2032-151-0x000000000A200000-0x000000000A212000-memory.dmpFilesize
72KB
-
memory/2032-152-0x000000000A260000-0x000000000A29E000-memory.dmpFilesize
248KB
-
memory/2032-153-0x000000000A3E0000-0x000000000A42B000-memory.dmpFilesize
300KB
-
memory/2032-154-0x0000000004DF0000-0x0000000004E00000-memory.dmpFilesize
64KB
-
memory/2032-147-0x00000000004D0000-0x0000000000500000-memory.dmpFilesize
192KB
-
memory/2032-162-0x000000000B370000-0x000000000B3C0000-memory.dmpFilesize
320KB
-
memory/2032-157-0x000000000A700000-0x000000000A766000-memory.dmpFilesize
408KB
-
memory/2032-158-0x000000000B6E0000-0x000000000BBDE000-memory.dmpFilesize
5.0MB
-
memory/2032-159-0x000000000B460000-0x000000000B622000-memory.dmpFilesize
1.8MB
-
memory/2032-160-0x000000000C110000-0x000000000C63C000-memory.dmpFilesize
5.2MB
-
memory/2032-161-0x0000000004DF0000-0x0000000004E00000-memory.dmpFilesize
64KB
-
memory/4940-142-0x0000000000D90000-0x0000000000D9A000-memory.dmpFilesize
40KB