Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
05-06-2023 06:27
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20230221-en
General
-
Target
tmp.exe
-
Size
581KB
-
MD5
c9968ef91ff9712743285c79271a7155
-
SHA1
b2e293ef8276bd29c9751adabe6742b71735bf81
-
SHA256
8dae5b41823c4d24ba663ff6141d0354a049ea034c0afaf8da86e66fe6740122
-
SHA512
e10b439dbd64c2d0b74f1aca639638474d1d96a4310242779e5eab12c74e59faa61709e545d6b222b6da8c3a788550aefb108cde5b0e26e485558763c6566abf
-
SSDEEP
12288:EMrpy90KdSwdNLtrOHVyUlw2U01gz2ojZbse89mLMQp4rNo9v:dyVdSwzpWJW10untb89oMQp4ri
Malware Config
Extracted
redline
maxi
83.97.73.126:19046
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Signatures
-
Processes:
a1977287.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a1977287.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a1977287.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection a1977287.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a1977287.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a1977287.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a1977287.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
Processes:
v3524326.exev4913060.exea1977287.exeb3898701.exepid process 1320 v3524326.exe 912 v4913060.exe 5012 a1977287.exe 1612 b3898701.exe -
Processes:
a1977287.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a1977287.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
v4913060.exetmp.exev3524326.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v4913060.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v4913060.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce tmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" tmp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v3524326.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v3524326.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
a1977287.exepid process 5012 a1977287.exe 5012 a1977287.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a1977287.exedescription pid process Token: SeDebugPrivilege 5012 a1977287.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
tmp.exev3524326.exev4913060.exedescription pid process target process PID 4416 wrote to memory of 1320 4416 tmp.exe v3524326.exe PID 4416 wrote to memory of 1320 4416 tmp.exe v3524326.exe PID 4416 wrote to memory of 1320 4416 tmp.exe v3524326.exe PID 1320 wrote to memory of 912 1320 v3524326.exe v4913060.exe PID 1320 wrote to memory of 912 1320 v3524326.exe v4913060.exe PID 1320 wrote to memory of 912 1320 v3524326.exe v4913060.exe PID 912 wrote to memory of 5012 912 v4913060.exe a1977287.exe PID 912 wrote to memory of 5012 912 v4913060.exe a1977287.exe PID 912 wrote to memory of 1612 912 v4913060.exe b3898701.exe PID 912 wrote to memory of 1612 912 v4913060.exe b3898701.exe PID 912 wrote to memory of 1612 912 v4913060.exe b3898701.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3524326.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3524326.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4913060.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4913060.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1977287.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1977287.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3898701.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3898701.exe4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3524326.exeFilesize
377KB
MD5cbc96be815d1507721794bf6c6ada894
SHA1021ca78fffd47ca86ae797b02863f067a8009f2f
SHA256ba362017ff950c39ebb2242d8ee44a8790557ec926ea8ddcd807a2bdfe6914ac
SHA51214e012f931478314adcc16018433c77b768f1c3292fb85410fcdb5db95859d807e79585325a326daeb6da53157672c033d5007dd3534123bf18df59e3044454b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3524326.exeFilesize
377KB
MD5cbc96be815d1507721794bf6c6ada894
SHA1021ca78fffd47ca86ae797b02863f067a8009f2f
SHA256ba362017ff950c39ebb2242d8ee44a8790557ec926ea8ddcd807a2bdfe6914ac
SHA51214e012f931478314adcc16018433c77b768f1c3292fb85410fcdb5db95859d807e79585325a326daeb6da53157672c033d5007dd3534123bf18df59e3044454b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4913060.exeFilesize
206KB
MD553a9c4d3aba52eb9218778f09c9a6660
SHA1d383091dffbe0e820a099e3e5cb8a8ceb06731a2
SHA2562bbd1d9cb527447843871a4eb1b350f0de7764f22aa4c199bc8c3f5e11637591
SHA5128a5333624efc8926b10f166272c8824eec75d66785dcf46c61d0c4431935fd24a585a908c1be02374138acd8b0bd2487d73c2c66f71202b00828ccac316f29f3
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4913060.exeFilesize
206KB
MD553a9c4d3aba52eb9218778f09c9a6660
SHA1d383091dffbe0e820a099e3e5cb8a8ceb06731a2
SHA2562bbd1d9cb527447843871a4eb1b350f0de7764f22aa4c199bc8c3f5e11637591
SHA5128a5333624efc8926b10f166272c8824eec75d66785dcf46c61d0c4431935fd24a585a908c1be02374138acd8b0bd2487d73c2c66f71202b00828ccac316f29f3
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1977287.exeFilesize
11KB
MD50b16c5fb31b45cd17a6aee41a9719304
SHA131fe5b608a2d70b917ad9215acb0ce5e800a66e1
SHA25605823cbe248e7eb0af93e05f7d5c0272ea92b3f2ca130392ade08b9b64d3ca99
SHA5123946fe4691c28fc01ec222367de02b7f3a8ae21e8318dedc3de03636ccafd1fab60ce8d03d7658258011e59cd2f947b4d12732b7a740e0d660c53758601b15ee
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1977287.exeFilesize
11KB
MD50b16c5fb31b45cd17a6aee41a9719304
SHA131fe5b608a2d70b917ad9215acb0ce5e800a66e1
SHA25605823cbe248e7eb0af93e05f7d5c0272ea92b3f2ca130392ade08b9b64d3ca99
SHA5123946fe4691c28fc01ec222367de02b7f3a8ae21e8318dedc3de03636ccafd1fab60ce8d03d7658258011e59cd2f947b4d12732b7a740e0d660c53758601b15ee
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3898701.exeFilesize
172KB
MD5199812cab0522fdeaf34b6f4bab5d203
SHA1b688002c10482380b801e69ed0523678bf25e550
SHA256a38c467b4c19079e5316e1aaec651d71dadc21b6c70c6a129349305b2c92cd3d
SHA512e2d616b4173f397cfab9d69779b87f8fab175f7a890a07ddb87f2426c7a3ca7eabcf1d01e181f33c852db88270ec1aa265a78c4b3bc9c4bf32adec2788bc025a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3898701.exeFilesize
172KB
MD5199812cab0522fdeaf34b6f4bab5d203
SHA1b688002c10482380b801e69ed0523678bf25e550
SHA256a38c467b4c19079e5316e1aaec651d71dadc21b6c70c6a129349305b2c92cd3d
SHA512e2d616b4173f397cfab9d69779b87f8fab175f7a890a07ddb87f2426c7a3ca7eabcf1d01e181f33c852db88270ec1aa265a78c4b3bc9c4bf32adec2788bc025a
-
memory/1612-159-0x0000000000A70000-0x0000000000AA0000-memory.dmpFilesize
192KB
-
memory/1612-160-0x000000000AE70000-0x000000000B488000-memory.dmpFilesize
6.1MB
-
memory/1612-161-0x000000000A9F0000-0x000000000AAFA000-memory.dmpFilesize
1.0MB
-
memory/1612-162-0x000000000A930000-0x000000000A942000-memory.dmpFilesize
72KB
-
memory/1612-163-0x000000000A990000-0x000000000A9CC000-memory.dmpFilesize
240KB
-
memory/1612-164-0x0000000002DE0000-0x0000000002DF0000-memory.dmpFilesize
64KB
-
memory/1612-165-0x0000000002DE0000-0x0000000002DF0000-memory.dmpFilesize
64KB
-
memory/5012-154-0x00000000003B0000-0x00000000003BA000-memory.dmpFilesize
40KB