Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05-06-2023 06:55
Static task
static1
Behavioral task
behavioral1
Sample
2fb6de4ff6816fe9db70ae103e31f39825c3e738180028431cc366d0d871d983.exe
Resource
win10v2004-20230220-en
General
-
Target
2fb6de4ff6816fe9db70ae103e31f39825c3e738180028431cc366d0d871d983.exe
-
Size
580KB
-
MD5
74961b3d2ba94680dd0a8a9945ee46a4
-
SHA1
dab73096107320f74ca58566faffa5b35f3611b3
-
SHA256
2fb6de4ff6816fe9db70ae103e31f39825c3e738180028431cc366d0d871d983
-
SHA512
ec1122d3a25c143cc18ca945301a05630a98caf45e10c23fd28bfecc05c4d03c84592760d55a507bbe7317543f9c7ba0d99a896285d832b891a728a3f2df624b
-
SSDEEP
12288:KMrly90HrbY2eFUvPUkHgJHmGo/79NjcX1aIcX:nyi4liImGoZNYl+
Malware Config
Extracted
redline
maxi
83.97.73.126:19046
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Signatures
-
Processes:
a3621933.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a3621933.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a3621933.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a3621933.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a3621933.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a3621933.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection a3621933.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
Processes:
v0698900.exev4361474.exea3621933.exeb5056863.exepid process 2784 v0698900.exe 3188 v4361474.exe 1420 a3621933.exe 3856 b5056863.exe -
Processes:
a3621933.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a3621933.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
v4361474.exe2fb6de4ff6816fe9db70ae103e31f39825c3e738180028431cc366d0d871d983.exev0698900.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v4361474.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 2fb6de4ff6816fe9db70ae103e31f39825c3e738180028431cc366d0d871d983.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 2fb6de4ff6816fe9db70ae103e31f39825c3e738180028431cc366d0d871d983.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v0698900.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v0698900.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v4361474.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
a3621933.exepid process 1420 a3621933.exe 1420 a3621933.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a3621933.exedescription pid process Token: SeDebugPrivilege 1420 a3621933.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
2fb6de4ff6816fe9db70ae103e31f39825c3e738180028431cc366d0d871d983.exev0698900.exev4361474.exedescription pid process target process PID 2936 wrote to memory of 2784 2936 2fb6de4ff6816fe9db70ae103e31f39825c3e738180028431cc366d0d871d983.exe v0698900.exe PID 2936 wrote to memory of 2784 2936 2fb6de4ff6816fe9db70ae103e31f39825c3e738180028431cc366d0d871d983.exe v0698900.exe PID 2936 wrote to memory of 2784 2936 2fb6de4ff6816fe9db70ae103e31f39825c3e738180028431cc366d0d871d983.exe v0698900.exe PID 2784 wrote to memory of 3188 2784 v0698900.exe v4361474.exe PID 2784 wrote to memory of 3188 2784 v0698900.exe v4361474.exe PID 2784 wrote to memory of 3188 2784 v0698900.exe v4361474.exe PID 3188 wrote to memory of 1420 3188 v4361474.exe a3621933.exe PID 3188 wrote to memory of 1420 3188 v4361474.exe a3621933.exe PID 3188 wrote to memory of 3856 3188 v4361474.exe b5056863.exe PID 3188 wrote to memory of 3856 3188 v4361474.exe b5056863.exe PID 3188 wrote to memory of 3856 3188 v4361474.exe b5056863.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2fb6de4ff6816fe9db70ae103e31f39825c3e738180028431cc366d0d871d983.exe"C:\Users\Admin\AppData\Local\Temp\2fb6de4ff6816fe9db70ae103e31f39825c3e738180028431cc366d0d871d983.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0698900.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0698900.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4361474.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4361474.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3621933.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3621933.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5056863.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5056863.exe4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0698900.exeFilesize
377KB
MD53f3c791aa385ec170f4db00f85463cde
SHA1408b8536deca2561957556fc5a3da384b4ae2dc6
SHA256ad76330287b1b75fbbbf12216186b0dbd51130f0aef446b3975ceee8fe75725e
SHA512dc421e581d82467ee52da3fef7975c5b3b4ec53fb423c56c5fc7a49a980d68c06baa98b5512d8d3206dbfe166583e8586030ceb36571936a0a51b7aafd6cb37d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0698900.exeFilesize
377KB
MD53f3c791aa385ec170f4db00f85463cde
SHA1408b8536deca2561957556fc5a3da384b4ae2dc6
SHA256ad76330287b1b75fbbbf12216186b0dbd51130f0aef446b3975ceee8fe75725e
SHA512dc421e581d82467ee52da3fef7975c5b3b4ec53fb423c56c5fc7a49a980d68c06baa98b5512d8d3206dbfe166583e8586030ceb36571936a0a51b7aafd6cb37d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4361474.exeFilesize
206KB
MD5ab357fe580c91b50e3a38a26b99502e1
SHA13924050cd4749ce6dfd538cb6f9345d093de8a02
SHA2566efef4f1fcaabca315d0bc620812dfb5e80ee16992d5a258f7d7a0810cf3d1cd
SHA512a15747bfe320e18fccbede76bab8b264405d1bae89e2c279af15c0639ef9b85aa1091b69a099537124a1ed7bc09fd0cef880f17748cb3fc06efd28642a97d197
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4361474.exeFilesize
206KB
MD5ab357fe580c91b50e3a38a26b99502e1
SHA13924050cd4749ce6dfd538cb6f9345d093de8a02
SHA2566efef4f1fcaabca315d0bc620812dfb5e80ee16992d5a258f7d7a0810cf3d1cd
SHA512a15747bfe320e18fccbede76bab8b264405d1bae89e2c279af15c0639ef9b85aa1091b69a099537124a1ed7bc09fd0cef880f17748cb3fc06efd28642a97d197
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3621933.exeFilesize
11KB
MD597ac268fb02ea976d6c4045aa62edfe1
SHA1f0734c5a446d420eccab629a61df860df59cba03
SHA256e53c50f5300972cea9cb13404a80f3fd8f93ae5f01a5624c5541d3c7a34c8ee9
SHA512ff1da3484c14825464c3f57dc07fb404af7a6ec517f86bc79d91fc568811ca8fea8443c451efe6e5fc791c5538c4252f163eae9dfe00f84e4ef1d0d141d97601
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3621933.exeFilesize
11KB
MD597ac268fb02ea976d6c4045aa62edfe1
SHA1f0734c5a446d420eccab629a61df860df59cba03
SHA256e53c50f5300972cea9cb13404a80f3fd8f93ae5f01a5624c5541d3c7a34c8ee9
SHA512ff1da3484c14825464c3f57dc07fb404af7a6ec517f86bc79d91fc568811ca8fea8443c451efe6e5fc791c5538c4252f163eae9dfe00f84e4ef1d0d141d97601
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5056863.exeFilesize
172KB
MD5c5ea1578bf294033b52fbaf454dd023f
SHA1323be12e05558e17f4d83b740628d700fd2b1c10
SHA2563461a7a3e0432ad4ed32db90eb2f8143e7b4089e1b92ebf014b4f7242071cad1
SHA512de4993ee90017e7bd45400941d867540d3646740ab9fece9d39d41c313a17e2f25c6a41333cb7d36c1ae2993c79107bdc7a1c4dcae76019742a77de4dc28df37
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5056863.exeFilesize
172KB
MD5c5ea1578bf294033b52fbaf454dd023f
SHA1323be12e05558e17f4d83b740628d700fd2b1c10
SHA2563461a7a3e0432ad4ed32db90eb2f8143e7b4089e1b92ebf014b4f7242071cad1
SHA512de4993ee90017e7bd45400941d867540d3646740ab9fece9d39d41c313a17e2f25c6a41333cb7d36c1ae2993c79107bdc7a1c4dcae76019742a77de4dc28df37
-
memory/1420-154-0x0000000000860000-0x000000000086A000-memory.dmpFilesize
40KB
-
memory/3856-159-0x00000000000F0000-0x0000000000120000-memory.dmpFilesize
192KB
-
memory/3856-160-0x000000000A530000-0x000000000AB48000-memory.dmpFilesize
6.1MB
-
memory/3856-161-0x000000000A070000-0x000000000A17A000-memory.dmpFilesize
1.0MB
-
memory/3856-162-0x0000000009FB0000-0x0000000009FC2000-memory.dmpFilesize
72KB
-
memory/3856-163-0x000000000A010000-0x000000000A04C000-memory.dmpFilesize
240KB
-
memory/3856-164-0x0000000004B80000-0x0000000004B90000-memory.dmpFilesize
64KB
-
memory/3856-165-0x0000000004B80000-0x0000000004B90000-memory.dmpFilesize
64KB