Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05-06-2023 05:58
Static task
static1
Behavioral task
behavioral1
Sample
65ba8ecad6bfd7e358ab6ea6890cf929c6e5d9656da2548006bc79a9a374f00b.exe
Resource
win10v2004-20230220-en
General
-
Target
65ba8ecad6bfd7e358ab6ea6890cf929c6e5d9656da2548006bc79a9a374f00b.exe
-
Size
581KB
-
MD5
c1e47cbba1766521eb46cfadac0f2f43
-
SHA1
69c59918818d333408890b3bffc8f42aa45afbba
-
SHA256
65ba8ecad6bfd7e358ab6ea6890cf929c6e5d9656da2548006bc79a9a374f00b
-
SHA512
93cb870609b31e8b5d82f28c878224f745360982c82a2823e8164536f4c6ea189fddffefcab72318fb18e24346d29fa8c00397c1f18f67a63a17a27276fc1de7
-
SSDEEP
12288:xMrzy90ajANF2uMdTeK78XW72CN9oMlVNzLgj2lBNih:Kyv+0FXHj/ZgCM
Malware Config
Extracted
redline
maxi
83.97.73.126:19046
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Signatures
-
Processes:
a1797546.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a1797546.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a1797546.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a1797546.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a1797546.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a1797546.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection a1797546.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
Processes:
v5261214.exev7849614.exea1797546.exeb9041074.exepid process 800 v5261214.exe 4484 v7849614.exe 1444 a1797546.exe 2828 b9041074.exe -
Processes:
a1797546.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a1797546.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
v5261214.exev7849614.exe65ba8ecad6bfd7e358ab6ea6890cf929c6e5d9656da2548006bc79a9a374f00b.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v5261214.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v5261214.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v7849614.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v7849614.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 65ba8ecad6bfd7e358ab6ea6890cf929c6e5d9656da2548006bc79a9a374f00b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 65ba8ecad6bfd7e358ab6ea6890cf929c6e5d9656da2548006bc79a9a374f00b.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
a1797546.exepid process 1444 a1797546.exe 1444 a1797546.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a1797546.exedescription pid process Token: SeDebugPrivilege 1444 a1797546.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
65ba8ecad6bfd7e358ab6ea6890cf929c6e5d9656da2548006bc79a9a374f00b.exev5261214.exev7849614.exedescription pid process target process PID 4628 wrote to memory of 800 4628 65ba8ecad6bfd7e358ab6ea6890cf929c6e5d9656da2548006bc79a9a374f00b.exe v5261214.exe PID 4628 wrote to memory of 800 4628 65ba8ecad6bfd7e358ab6ea6890cf929c6e5d9656da2548006bc79a9a374f00b.exe v5261214.exe PID 4628 wrote to memory of 800 4628 65ba8ecad6bfd7e358ab6ea6890cf929c6e5d9656da2548006bc79a9a374f00b.exe v5261214.exe PID 800 wrote to memory of 4484 800 v5261214.exe v7849614.exe PID 800 wrote to memory of 4484 800 v5261214.exe v7849614.exe PID 800 wrote to memory of 4484 800 v5261214.exe v7849614.exe PID 4484 wrote to memory of 1444 4484 v7849614.exe a1797546.exe PID 4484 wrote to memory of 1444 4484 v7849614.exe a1797546.exe PID 4484 wrote to memory of 2828 4484 v7849614.exe b9041074.exe PID 4484 wrote to memory of 2828 4484 v7849614.exe b9041074.exe PID 4484 wrote to memory of 2828 4484 v7849614.exe b9041074.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\65ba8ecad6bfd7e358ab6ea6890cf929c6e5d9656da2548006bc79a9a374f00b.exe"C:\Users\Admin\AppData\Local\Temp\65ba8ecad6bfd7e358ab6ea6890cf929c6e5d9656da2548006bc79a9a374f00b.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5261214.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5261214.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7849614.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7849614.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1797546.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1797546.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b9041074.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b9041074.exe4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5261214.exeFilesize
378KB
MD58ddbe30c65e48f5350e1126f1a907cc2
SHA122f2c61e9b8fd4b37ab7f6b4a503f2fe1d0a8b69
SHA2560276ddd2bd672bd13f1ced74d4c74ca95767a2f7c1d9c5ef13d4ce3f3586dcdc
SHA512470ccb3d5988f28dedf7159c0896709ba641780b86f80c58264f5c7ca6d51558f2f748897ea0ed3c1595cadf46e05e1ce1212edc256af7c58d8c53c04d83c41b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5261214.exeFilesize
378KB
MD58ddbe30c65e48f5350e1126f1a907cc2
SHA122f2c61e9b8fd4b37ab7f6b4a503f2fe1d0a8b69
SHA2560276ddd2bd672bd13f1ced74d4c74ca95767a2f7c1d9c5ef13d4ce3f3586dcdc
SHA512470ccb3d5988f28dedf7159c0896709ba641780b86f80c58264f5c7ca6d51558f2f748897ea0ed3c1595cadf46e05e1ce1212edc256af7c58d8c53c04d83c41b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7849614.exeFilesize
206KB
MD59e71223d00454584a9c7e51a6758cfe5
SHA1403351a8afc244116f387b6b6404deb100c95ea1
SHA25690cd2291c5c08d2cf9e2f848e6a6affcb32eadab29c93a28816652858fd56d22
SHA5128e006a7779dcee7e205278da7c3c0d830f267e055328adbc02db04182dcaaee5f6b16add4f67257b49c819cf9d3ecb88c5faad190a99291fb46835fb313a8e1c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7849614.exeFilesize
206KB
MD59e71223d00454584a9c7e51a6758cfe5
SHA1403351a8afc244116f387b6b6404deb100c95ea1
SHA25690cd2291c5c08d2cf9e2f848e6a6affcb32eadab29c93a28816652858fd56d22
SHA5128e006a7779dcee7e205278da7c3c0d830f267e055328adbc02db04182dcaaee5f6b16add4f67257b49c819cf9d3ecb88c5faad190a99291fb46835fb313a8e1c
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1797546.exeFilesize
11KB
MD53ab3ae9095771d7b47462294bd24b0e9
SHA1bede31e2bf5afefddfdf380867a3afdf4063dbdc
SHA2560d8d47ef7871160b0df12bac466c8d822c69e43bca6213d8b6f2b5d4cb138d04
SHA5124a6bc2361e6a70cf31a852a222ca7069c470abc63803642e3ad8ca979d8285028fab1ff2f4cef5c05b5894c7b85826f92dd931408aaab1b081ed25b1413a3c43
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1797546.exeFilesize
11KB
MD53ab3ae9095771d7b47462294bd24b0e9
SHA1bede31e2bf5afefddfdf380867a3afdf4063dbdc
SHA2560d8d47ef7871160b0df12bac466c8d822c69e43bca6213d8b6f2b5d4cb138d04
SHA5124a6bc2361e6a70cf31a852a222ca7069c470abc63803642e3ad8ca979d8285028fab1ff2f4cef5c05b5894c7b85826f92dd931408aaab1b081ed25b1413a3c43
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b9041074.exeFilesize
172KB
MD5e646f910bafa9bb56c244f04f434f91d
SHA17cda0311f4e9506526d95ffb7245a5d38aefb440
SHA256c2e49a0b5a07e8f0a67ecdc9d628cf456c58e567f1edf7f2a807467d02620f76
SHA5128b2002de1bde7f646d15961b9d7d70e899c61e0e6e27ec820c8dda64a9de7323a6d27d48d4d63309369d213447ed249bd2d1e33370a17678c85896deec12dae2
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b9041074.exeFilesize
172KB
MD5e646f910bafa9bb56c244f04f434f91d
SHA17cda0311f4e9506526d95ffb7245a5d38aefb440
SHA256c2e49a0b5a07e8f0a67ecdc9d628cf456c58e567f1edf7f2a807467d02620f76
SHA5128b2002de1bde7f646d15961b9d7d70e899c61e0e6e27ec820c8dda64a9de7323a6d27d48d4d63309369d213447ed249bd2d1e33370a17678c85896deec12dae2
-
memory/1444-154-0x0000000000450000-0x000000000045A000-memory.dmpFilesize
40KB
-
memory/2828-159-0x0000000000520000-0x0000000000550000-memory.dmpFilesize
192KB
-
memory/2828-160-0x000000000A920000-0x000000000AF38000-memory.dmpFilesize
6.1MB
-
memory/2828-161-0x000000000A4A0000-0x000000000A5AA000-memory.dmpFilesize
1.0MB
-
memory/2828-162-0x000000000A3E0000-0x000000000A3F2000-memory.dmpFilesize
72KB
-
memory/2828-163-0x000000000A440000-0x000000000A47C000-memory.dmpFilesize
240KB
-
memory/2828-164-0x0000000004F70000-0x0000000004F80000-memory.dmpFilesize
64KB
-
memory/2828-165-0x0000000004F70000-0x0000000004F80000-memory.dmpFilesize
64KB