Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
05-06-2023 02:56
Static task
static1
Behavioral task
behavioral1
Sample
46bfe886ea2c9c0e7ffd450bf542b971eaae59e1aa417ded2d5d1347a445dd98.exe
Resource
win10-20230220-en
General
-
Target
46bfe886ea2c9c0e7ffd450bf542b971eaae59e1aa417ded2d5d1347a445dd98.exe
-
Size
581KB
-
MD5
1253121fd4f3de775178f2d56f2a6f78
-
SHA1
8abb80df6a2eb3bc5eb9fb0a68cb155aebe9ad9a
-
SHA256
46bfe886ea2c9c0e7ffd450bf542b971eaae59e1aa417ded2d5d1347a445dd98
-
SHA512
5960278d065faa9bf1c21d48ed3c5418828811d85142487ad0178387c79d7e5dc577edb48da31737769146ffb0fd0708be0e8771b4a437cd3a24c14b1d410d2a
-
SSDEEP
12288:1Mr7y904FrRbN3jBun9OE43Z6xgPd40JELr6p6/:Gy1F33dunnWnUOp6/
Malware Config
Extracted
redline
maxi
83.97.73.126:19046
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Signatures
-
Processes:
a0567724.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a0567724.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a0567724.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a0567724.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a0567724.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a0567724.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
Processes:
v0317205.exev5066214.exea0567724.exeb8835094.exepid process 2116 v0317205.exe 4928 v5066214.exe 2772 a0567724.exe 3884 b8835094.exe -
Processes:
a0567724.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a0567724.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
46bfe886ea2c9c0e7ffd450bf542b971eaae59e1aa417ded2d5d1347a445dd98.exev0317205.exev5066214.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 46bfe886ea2c9c0e7ffd450bf542b971eaae59e1aa417ded2d5d1347a445dd98.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 46bfe886ea2c9c0e7ffd450bf542b971eaae59e1aa417ded2d5d1347a445dd98.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v0317205.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v0317205.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v5066214.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v5066214.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
a0567724.exepid process 2772 a0567724.exe 2772 a0567724.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a0567724.exedescription pid process Token: SeDebugPrivilege 2772 a0567724.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
46bfe886ea2c9c0e7ffd450bf542b971eaae59e1aa417ded2d5d1347a445dd98.exev0317205.exev5066214.exedescription pid process target process PID 2920 wrote to memory of 2116 2920 46bfe886ea2c9c0e7ffd450bf542b971eaae59e1aa417ded2d5d1347a445dd98.exe v0317205.exe PID 2920 wrote to memory of 2116 2920 46bfe886ea2c9c0e7ffd450bf542b971eaae59e1aa417ded2d5d1347a445dd98.exe v0317205.exe PID 2920 wrote to memory of 2116 2920 46bfe886ea2c9c0e7ffd450bf542b971eaae59e1aa417ded2d5d1347a445dd98.exe v0317205.exe PID 2116 wrote to memory of 4928 2116 v0317205.exe v5066214.exe PID 2116 wrote to memory of 4928 2116 v0317205.exe v5066214.exe PID 2116 wrote to memory of 4928 2116 v0317205.exe v5066214.exe PID 4928 wrote to memory of 2772 4928 v5066214.exe a0567724.exe PID 4928 wrote to memory of 2772 4928 v5066214.exe a0567724.exe PID 4928 wrote to memory of 3884 4928 v5066214.exe b8835094.exe PID 4928 wrote to memory of 3884 4928 v5066214.exe b8835094.exe PID 4928 wrote to memory of 3884 4928 v5066214.exe b8835094.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\46bfe886ea2c9c0e7ffd450bf542b971eaae59e1aa417ded2d5d1347a445dd98.exe"C:\Users\Admin\AppData\Local\Temp\46bfe886ea2c9c0e7ffd450bf542b971eaae59e1aa417ded2d5d1347a445dd98.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0317205.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0317205.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5066214.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5066214.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0567724.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0567724.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8835094.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8835094.exe4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0317205.exeFilesize
378KB
MD54441fa32e8a8b9b34a0100eebda411e7
SHA1ac0dfe3f87e09b123012b0d9ed69b48420bbb637
SHA256667f99a01f538e88fdd42e66755d56324915a9831314cc4afe88ef5754c9ba45
SHA51205cfe838fe869153a266961064a935647c90d16894765882344699c4f4839de5c8a84b8e0499417e3c6fefa466fa14ce959baec98a60ecdf0c8fa9c3bf2fe28a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0317205.exeFilesize
378KB
MD54441fa32e8a8b9b34a0100eebda411e7
SHA1ac0dfe3f87e09b123012b0d9ed69b48420bbb637
SHA256667f99a01f538e88fdd42e66755d56324915a9831314cc4afe88ef5754c9ba45
SHA51205cfe838fe869153a266961064a935647c90d16894765882344699c4f4839de5c8a84b8e0499417e3c6fefa466fa14ce959baec98a60ecdf0c8fa9c3bf2fe28a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5066214.exeFilesize
206KB
MD50da0446fc5f7d9688af8004550692f9f
SHA12cdb16773be7f1ba1a0f0b9a6933209577202a8c
SHA256e1821a23c1deb014321b5e2a278765814565f9de448468b430a605140b3313f7
SHA512c30ed83705a17c760d562069a96669ba5ccee2a50808ae25663e9cd7134c8c5c117d20401146a64fb4beab5543dc2f9c87068072551231808b64eed688d5c958
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5066214.exeFilesize
206KB
MD50da0446fc5f7d9688af8004550692f9f
SHA12cdb16773be7f1ba1a0f0b9a6933209577202a8c
SHA256e1821a23c1deb014321b5e2a278765814565f9de448468b430a605140b3313f7
SHA512c30ed83705a17c760d562069a96669ba5ccee2a50808ae25663e9cd7134c8c5c117d20401146a64fb4beab5543dc2f9c87068072551231808b64eed688d5c958
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0567724.exeFilesize
11KB
MD5949999f1dc6995d322ae77b6e1e26bed
SHA14d70b171709dbc43766556069432751a4ad40fc7
SHA256e0ce77e6c4116db0dd40c363eb739512c000d2b974d99e37ee861ec2a5f76880
SHA51249e02db9926d15a5b0e796c8d407a3b3a5fa50ad982fe07489e84411f1e4ac68243112db0c26dddd04adcdb25d97b07df40c918437a8177a9cd3fd8644ef6e44
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0567724.exeFilesize
11KB
MD5949999f1dc6995d322ae77b6e1e26bed
SHA14d70b171709dbc43766556069432751a4ad40fc7
SHA256e0ce77e6c4116db0dd40c363eb739512c000d2b974d99e37ee861ec2a5f76880
SHA51249e02db9926d15a5b0e796c8d407a3b3a5fa50ad982fe07489e84411f1e4ac68243112db0c26dddd04adcdb25d97b07df40c918437a8177a9cd3fd8644ef6e44
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8835094.exeFilesize
172KB
MD5e8779f1f06ac00224a1f167b39dc59ac
SHA13f1e3bd4cc7644adb9d2a94a7ce35d08858e87e5
SHA256388174c0b5ca64236b350449348644dcf92aaf2ee8465a8a3b4df0463c1b4c89
SHA51243d3abf955a93d94c9330fe1c2c3c893b54c826e21bf7c26bf03e9b2586a45b2aa4fbf287c11b441a83cd68901cdba46722ab4700b3293a7e26d104d486d004d
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8835094.exeFilesize
172KB
MD5e8779f1f06ac00224a1f167b39dc59ac
SHA13f1e3bd4cc7644adb9d2a94a7ce35d08858e87e5
SHA256388174c0b5ca64236b350449348644dcf92aaf2ee8465a8a3b4df0463c1b4c89
SHA51243d3abf955a93d94c9330fe1c2c3c893b54c826e21bf7c26bf03e9b2586a45b2aa4fbf287c11b441a83cd68901cdba46722ab4700b3293a7e26d104d486d004d
-
memory/2772-142-0x0000000000EA0000-0x0000000000EAA000-memory.dmpFilesize
40KB
-
memory/3884-147-0x0000000000980000-0x00000000009B0000-memory.dmpFilesize
192KB
-
memory/3884-148-0x0000000002B00000-0x0000000002B06000-memory.dmpFilesize
24KB
-
memory/3884-149-0x0000000005940000-0x0000000005F46000-memory.dmpFilesize
6.0MB
-
memory/3884-150-0x0000000005440000-0x000000000554A000-memory.dmpFilesize
1.0MB
-
memory/3884-151-0x0000000005180000-0x0000000005192000-memory.dmpFilesize
72KB
-
memory/3884-152-0x00000000051E0000-0x000000000521E000-memory.dmpFilesize
248KB
-
memory/3884-153-0x0000000005220000-0x0000000005230000-memory.dmpFilesize
64KB
-
memory/3884-154-0x0000000005330000-0x000000000537B000-memory.dmpFilesize
300KB
-
memory/3884-155-0x0000000005220000-0x0000000005230000-memory.dmpFilesize
64KB