Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
05-06-2023 06:27
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20230221-en
General
-
Target
tmp.exe
-
Size
581KB
-
MD5
c9968ef91ff9712743285c79271a7155
-
SHA1
b2e293ef8276bd29c9751adabe6742b71735bf81
-
SHA256
8dae5b41823c4d24ba663ff6141d0354a049ea034c0afaf8da86e66fe6740122
-
SHA512
e10b439dbd64c2d0b74f1aca639638474d1d96a4310242779e5eab12c74e59faa61709e545d6b222b6da8c3a788550aefb108cde5b0e26e485558763c6566abf
-
SSDEEP
12288:EMrpy90KdSwdNLtrOHVyUlw2U01gz2ojZbse89mLMQp4rNo9v:dyVdSwzpWJW10untb89oMQp4ri
Malware Config
Extracted
redline
maxi
83.97.73.126:19046
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Signatures
-
Processes:
a1977287.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection a1977287.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a1977287.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a1977287.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a1977287.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a1977287.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a1977287.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
Processes:
v3524326.exev4913060.exea1977287.exeb3898701.exepid process 2032 v3524326.exe 436 v4913060.exe 588 a1977287.exe 716 b3898701.exe -
Loads dropped DLL 7 IoCs
Processes:
tmp.exev3524326.exev4913060.exeb3898701.exepid process 1324 tmp.exe 2032 v3524326.exe 2032 v3524326.exe 436 v4913060.exe 436 v4913060.exe 436 v4913060.exe 716 b3898701.exe -
Processes:
a1977287.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features a1977287.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a1977287.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
v4913060.exetmp.exev3524326.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v4913060.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce tmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" tmp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce v3524326.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v3524326.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce v4913060.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
a1977287.exepid process 588 a1977287.exe 588 a1977287.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a1977287.exedescription pid process Token: SeDebugPrivilege 588 a1977287.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
tmp.exev3524326.exev4913060.exedescription pid process target process PID 1324 wrote to memory of 2032 1324 tmp.exe v3524326.exe PID 1324 wrote to memory of 2032 1324 tmp.exe v3524326.exe PID 1324 wrote to memory of 2032 1324 tmp.exe v3524326.exe PID 1324 wrote to memory of 2032 1324 tmp.exe v3524326.exe PID 1324 wrote to memory of 2032 1324 tmp.exe v3524326.exe PID 1324 wrote to memory of 2032 1324 tmp.exe v3524326.exe PID 1324 wrote to memory of 2032 1324 tmp.exe v3524326.exe PID 2032 wrote to memory of 436 2032 v3524326.exe v4913060.exe PID 2032 wrote to memory of 436 2032 v3524326.exe v4913060.exe PID 2032 wrote to memory of 436 2032 v3524326.exe v4913060.exe PID 2032 wrote to memory of 436 2032 v3524326.exe v4913060.exe PID 2032 wrote to memory of 436 2032 v3524326.exe v4913060.exe PID 2032 wrote to memory of 436 2032 v3524326.exe v4913060.exe PID 2032 wrote to memory of 436 2032 v3524326.exe v4913060.exe PID 436 wrote to memory of 588 436 v4913060.exe a1977287.exe PID 436 wrote to memory of 588 436 v4913060.exe a1977287.exe PID 436 wrote to memory of 588 436 v4913060.exe a1977287.exe PID 436 wrote to memory of 588 436 v4913060.exe a1977287.exe PID 436 wrote to memory of 588 436 v4913060.exe a1977287.exe PID 436 wrote to memory of 588 436 v4913060.exe a1977287.exe PID 436 wrote to memory of 588 436 v4913060.exe a1977287.exe PID 436 wrote to memory of 716 436 v4913060.exe b3898701.exe PID 436 wrote to memory of 716 436 v4913060.exe b3898701.exe PID 436 wrote to memory of 716 436 v4913060.exe b3898701.exe PID 436 wrote to memory of 716 436 v4913060.exe b3898701.exe PID 436 wrote to memory of 716 436 v4913060.exe b3898701.exe PID 436 wrote to memory of 716 436 v4913060.exe b3898701.exe PID 436 wrote to memory of 716 436 v4913060.exe b3898701.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3524326.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3524326.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4913060.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4913060.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3898701.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3898701.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1977287.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1977287.exe1⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3524326.exeFilesize
377KB
MD5cbc96be815d1507721794bf6c6ada894
SHA1021ca78fffd47ca86ae797b02863f067a8009f2f
SHA256ba362017ff950c39ebb2242d8ee44a8790557ec926ea8ddcd807a2bdfe6914ac
SHA51214e012f931478314adcc16018433c77b768f1c3292fb85410fcdb5db95859d807e79585325a326daeb6da53157672c033d5007dd3534123bf18df59e3044454b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3524326.exeFilesize
377KB
MD5cbc96be815d1507721794bf6c6ada894
SHA1021ca78fffd47ca86ae797b02863f067a8009f2f
SHA256ba362017ff950c39ebb2242d8ee44a8790557ec926ea8ddcd807a2bdfe6914ac
SHA51214e012f931478314adcc16018433c77b768f1c3292fb85410fcdb5db95859d807e79585325a326daeb6da53157672c033d5007dd3534123bf18df59e3044454b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4913060.exeFilesize
206KB
MD553a9c4d3aba52eb9218778f09c9a6660
SHA1d383091dffbe0e820a099e3e5cb8a8ceb06731a2
SHA2562bbd1d9cb527447843871a4eb1b350f0de7764f22aa4c199bc8c3f5e11637591
SHA5128a5333624efc8926b10f166272c8824eec75d66785dcf46c61d0c4431935fd24a585a908c1be02374138acd8b0bd2487d73c2c66f71202b00828ccac316f29f3
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4913060.exeFilesize
206KB
MD553a9c4d3aba52eb9218778f09c9a6660
SHA1d383091dffbe0e820a099e3e5cb8a8ceb06731a2
SHA2562bbd1d9cb527447843871a4eb1b350f0de7764f22aa4c199bc8c3f5e11637591
SHA5128a5333624efc8926b10f166272c8824eec75d66785dcf46c61d0c4431935fd24a585a908c1be02374138acd8b0bd2487d73c2c66f71202b00828ccac316f29f3
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1977287.exeFilesize
11KB
MD50b16c5fb31b45cd17a6aee41a9719304
SHA131fe5b608a2d70b917ad9215acb0ce5e800a66e1
SHA25605823cbe248e7eb0af93e05f7d5c0272ea92b3f2ca130392ade08b9b64d3ca99
SHA5123946fe4691c28fc01ec222367de02b7f3a8ae21e8318dedc3de03636ccafd1fab60ce8d03d7658258011e59cd2f947b4d12732b7a740e0d660c53758601b15ee
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1977287.exeFilesize
11KB
MD50b16c5fb31b45cd17a6aee41a9719304
SHA131fe5b608a2d70b917ad9215acb0ce5e800a66e1
SHA25605823cbe248e7eb0af93e05f7d5c0272ea92b3f2ca130392ade08b9b64d3ca99
SHA5123946fe4691c28fc01ec222367de02b7f3a8ae21e8318dedc3de03636ccafd1fab60ce8d03d7658258011e59cd2f947b4d12732b7a740e0d660c53758601b15ee
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3898701.exeFilesize
172KB
MD5199812cab0522fdeaf34b6f4bab5d203
SHA1b688002c10482380b801e69ed0523678bf25e550
SHA256a38c467b4c19079e5316e1aaec651d71dadc21b6c70c6a129349305b2c92cd3d
SHA512e2d616b4173f397cfab9d69779b87f8fab175f7a890a07ddb87f2426c7a3ca7eabcf1d01e181f33c852db88270ec1aa265a78c4b3bc9c4bf32adec2788bc025a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3898701.exeFilesize
172KB
MD5199812cab0522fdeaf34b6f4bab5d203
SHA1b688002c10482380b801e69ed0523678bf25e550
SHA256a38c467b4c19079e5316e1aaec651d71dadc21b6c70c6a129349305b2c92cd3d
SHA512e2d616b4173f397cfab9d69779b87f8fab175f7a890a07ddb87f2426c7a3ca7eabcf1d01e181f33c852db88270ec1aa265a78c4b3bc9c4bf32adec2788bc025a
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3524326.exeFilesize
377KB
MD5cbc96be815d1507721794bf6c6ada894
SHA1021ca78fffd47ca86ae797b02863f067a8009f2f
SHA256ba362017ff950c39ebb2242d8ee44a8790557ec926ea8ddcd807a2bdfe6914ac
SHA51214e012f931478314adcc16018433c77b768f1c3292fb85410fcdb5db95859d807e79585325a326daeb6da53157672c033d5007dd3534123bf18df59e3044454b
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3524326.exeFilesize
377KB
MD5cbc96be815d1507721794bf6c6ada894
SHA1021ca78fffd47ca86ae797b02863f067a8009f2f
SHA256ba362017ff950c39ebb2242d8ee44a8790557ec926ea8ddcd807a2bdfe6914ac
SHA51214e012f931478314adcc16018433c77b768f1c3292fb85410fcdb5db95859d807e79585325a326daeb6da53157672c033d5007dd3534123bf18df59e3044454b
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4913060.exeFilesize
206KB
MD553a9c4d3aba52eb9218778f09c9a6660
SHA1d383091dffbe0e820a099e3e5cb8a8ceb06731a2
SHA2562bbd1d9cb527447843871a4eb1b350f0de7764f22aa4c199bc8c3f5e11637591
SHA5128a5333624efc8926b10f166272c8824eec75d66785dcf46c61d0c4431935fd24a585a908c1be02374138acd8b0bd2487d73c2c66f71202b00828ccac316f29f3
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4913060.exeFilesize
206KB
MD553a9c4d3aba52eb9218778f09c9a6660
SHA1d383091dffbe0e820a099e3e5cb8a8ceb06731a2
SHA2562bbd1d9cb527447843871a4eb1b350f0de7764f22aa4c199bc8c3f5e11637591
SHA5128a5333624efc8926b10f166272c8824eec75d66785dcf46c61d0c4431935fd24a585a908c1be02374138acd8b0bd2487d73c2c66f71202b00828ccac316f29f3
-
\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1977287.exeFilesize
11KB
MD50b16c5fb31b45cd17a6aee41a9719304
SHA131fe5b608a2d70b917ad9215acb0ce5e800a66e1
SHA25605823cbe248e7eb0af93e05f7d5c0272ea92b3f2ca130392ade08b9b64d3ca99
SHA5123946fe4691c28fc01ec222367de02b7f3a8ae21e8318dedc3de03636ccafd1fab60ce8d03d7658258011e59cd2f947b4d12732b7a740e0d660c53758601b15ee
-
\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3898701.exeFilesize
172KB
MD5199812cab0522fdeaf34b6f4bab5d203
SHA1b688002c10482380b801e69ed0523678bf25e550
SHA256a38c467b4c19079e5316e1aaec651d71dadc21b6c70c6a129349305b2c92cd3d
SHA512e2d616b4173f397cfab9d69779b87f8fab175f7a890a07ddb87f2426c7a3ca7eabcf1d01e181f33c852db88270ec1aa265a78c4b3bc9c4bf32adec2788bc025a
-
\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3898701.exeFilesize
172KB
MD5199812cab0522fdeaf34b6f4bab5d203
SHA1b688002c10482380b801e69ed0523678bf25e550
SHA256a38c467b4c19079e5316e1aaec651d71dadc21b6c70c6a129349305b2c92cd3d
SHA512e2d616b4173f397cfab9d69779b87f8fab175f7a890a07ddb87f2426c7a3ca7eabcf1d01e181f33c852db88270ec1aa265a78c4b3bc9c4bf32adec2788bc025a
-
memory/588-82-0x00000000002F0000-0x00000000002FA000-memory.dmpFilesize
40KB
-
memory/716-89-0x0000000000FF0000-0x0000000001020000-memory.dmpFilesize
192KB
-
memory/716-90-0x0000000000380000-0x0000000000386000-memory.dmpFilesize
24KB
-
memory/716-91-0x0000000000BB0000-0x0000000000BF0000-memory.dmpFilesize
256KB
-
memory/716-92-0x0000000000BB0000-0x0000000000BF0000-memory.dmpFilesize
256KB