Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
05-06-2023 07:00
Static task
static1
Behavioral task
behavioral1
Sample
cccd05406f2ea5051041bc6ee246b9175dc22f0df1f9bfd8724ae96fafcc0a9f.exe
Resource
win10v2004-20230221-en
General
-
Target
cccd05406f2ea5051041bc6ee246b9175dc22f0df1f9bfd8724ae96fafcc0a9f.exe
-
Size
580KB
-
MD5
fcf686a2f8478c0d7233284d840fe07e
-
SHA1
f7c8e9145a16467be98002753002df8dcd7961f2
-
SHA256
cccd05406f2ea5051041bc6ee246b9175dc22f0df1f9bfd8724ae96fafcc0a9f
-
SHA512
f0fb7a99d174b5b7814b4f268c693375aa4264c8716244536bf23e1d61fad5b07bcc13d591cc12fc78507a72c9d8b95c82117caec35e0ba2cb5315bc954f2ec8
-
SSDEEP
12288:sMr9y9054LXUXituh9sGpe22U05gSKYiV5nC5LgRXXw:ZysykPhWGg22U0FW3nSLgNA
Malware Config
Extracted
redline
maxi
83.97.73.126:19046
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Signatures
-
Processes:
a7962651.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection a7962651.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a7962651.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a7962651.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a7962651.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a7962651.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a7962651.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
Processes:
v8821415.exev7191090.exea7962651.exeb6653795.exepid process 2708 v8821415.exe 4644 v7191090.exe 1160 a7962651.exe 1220 b6653795.exe -
Processes:
a7962651.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a7962651.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
cccd05406f2ea5051041bc6ee246b9175dc22f0df1f9bfd8724ae96fafcc0a9f.exev8821415.exev7191090.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce cccd05406f2ea5051041bc6ee246b9175dc22f0df1f9bfd8724ae96fafcc0a9f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" cccd05406f2ea5051041bc6ee246b9175dc22f0df1f9bfd8724ae96fafcc0a9f.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v8821415.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v8821415.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v7191090.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v7191090.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
a7962651.exepid process 1160 a7962651.exe 1160 a7962651.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a7962651.exedescription pid process Token: SeDebugPrivilege 1160 a7962651.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
cccd05406f2ea5051041bc6ee246b9175dc22f0df1f9bfd8724ae96fafcc0a9f.exev8821415.exev7191090.exedescription pid process target process PID 2676 wrote to memory of 2708 2676 cccd05406f2ea5051041bc6ee246b9175dc22f0df1f9bfd8724ae96fafcc0a9f.exe v8821415.exe PID 2676 wrote to memory of 2708 2676 cccd05406f2ea5051041bc6ee246b9175dc22f0df1f9bfd8724ae96fafcc0a9f.exe v8821415.exe PID 2676 wrote to memory of 2708 2676 cccd05406f2ea5051041bc6ee246b9175dc22f0df1f9bfd8724ae96fafcc0a9f.exe v8821415.exe PID 2708 wrote to memory of 4644 2708 v8821415.exe v7191090.exe PID 2708 wrote to memory of 4644 2708 v8821415.exe v7191090.exe PID 2708 wrote to memory of 4644 2708 v8821415.exe v7191090.exe PID 4644 wrote to memory of 1160 4644 v7191090.exe a7962651.exe PID 4644 wrote to memory of 1160 4644 v7191090.exe a7962651.exe PID 4644 wrote to memory of 1220 4644 v7191090.exe b6653795.exe PID 4644 wrote to memory of 1220 4644 v7191090.exe b6653795.exe PID 4644 wrote to memory of 1220 4644 v7191090.exe b6653795.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cccd05406f2ea5051041bc6ee246b9175dc22f0df1f9bfd8724ae96fafcc0a9f.exe"C:\Users\Admin\AppData\Local\Temp\cccd05406f2ea5051041bc6ee246b9175dc22f0df1f9bfd8724ae96fafcc0a9f.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8821415.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8821415.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7191090.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7191090.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7962651.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7962651.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6653795.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6653795.exe4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8821415.exeFilesize
377KB
MD5299854985b821504c2a6cde499fb5c54
SHA1c06cd3ee7c670bd067b2d14047a54b0df32bc6d9
SHA256971fb3c8428a4fb277694f5c6df349b738ee1db593bfffd3ed243ec5846860e1
SHA51279626bb45a580e239d21b031c319e52207d20e14831747e3211477e3ce5ab0cca09716766409484ba7af18f2e7804dd68ecea6833d525b9e7abd2ad9bb35640c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8821415.exeFilesize
377KB
MD5299854985b821504c2a6cde499fb5c54
SHA1c06cd3ee7c670bd067b2d14047a54b0df32bc6d9
SHA256971fb3c8428a4fb277694f5c6df349b738ee1db593bfffd3ed243ec5846860e1
SHA51279626bb45a580e239d21b031c319e52207d20e14831747e3211477e3ce5ab0cca09716766409484ba7af18f2e7804dd68ecea6833d525b9e7abd2ad9bb35640c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7191090.exeFilesize
206KB
MD5cbd4e0468885c5e0e56a7deeaabec09c
SHA142e87934cfca264fa7eb5a30f0843d13558cc153
SHA2569d8ee0c5343d2ffda16e3ac89ce7be3926d52f612fcff4f3099abb1e73c5a116
SHA5127ca44d673dcebb3321e9aa42faa501f5c1d42f8751c8b9efbf069d6b028a3b0cb8918de3b6a251fa530f0b8da4befd6ac288a13ec4ffa6c2d322ead2b1ccbd97
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7191090.exeFilesize
206KB
MD5cbd4e0468885c5e0e56a7deeaabec09c
SHA142e87934cfca264fa7eb5a30f0843d13558cc153
SHA2569d8ee0c5343d2ffda16e3ac89ce7be3926d52f612fcff4f3099abb1e73c5a116
SHA5127ca44d673dcebb3321e9aa42faa501f5c1d42f8751c8b9efbf069d6b028a3b0cb8918de3b6a251fa530f0b8da4befd6ac288a13ec4ffa6c2d322ead2b1ccbd97
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7962651.exeFilesize
11KB
MD5992f840b8844279765e9956933b71c9a
SHA154817a24a05a39181f0ca7e232411a8c3a22180c
SHA2562091b6ccd6133f4c7fd3d0787be78f5584c500f2fb9cd3acd0a8de0d67a38aa7
SHA51247a8dae101736fec9586a47195758137d04fb7fd3f5cb73e6ae8b43c400b5630458a9ca8a04ffb68a1974035addb46f7ae2a74fc267ca26e4bed780c823923aa
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7962651.exeFilesize
11KB
MD5992f840b8844279765e9956933b71c9a
SHA154817a24a05a39181f0ca7e232411a8c3a22180c
SHA2562091b6ccd6133f4c7fd3d0787be78f5584c500f2fb9cd3acd0a8de0d67a38aa7
SHA51247a8dae101736fec9586a47195758137d04fb7fd3f5cb73e6ae8b43c400b5630458a9ca8a04ffb68a1974035addb46f7ae2a74fc267ca26e4bed780c823923aa
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6653795.exeFilesize
172KB
MD59432cb337859ae13f807724fd81ae49e
SHA1a839d9d7a55cb3c1fe069afd33efa3eb9db5d405
SHA256e37ea980109d26a5cba10c122f20be5165a85f7241fa41c1db4d0268afa4b36b
SHA5121e18f16f2b9db4bb01614750be770aa8877d2775bd0cb874909b8eab51010183ed96003f73e7601aa33961c06447ae99ec7e599a160cdb46094baa0266c8aeef
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6653795.exeFilesize
172KB
MD59432cb337859ae13f807724fd81ae49e
SHA1a839d9d7a55cb3c1fe069afd33efa3eb9db5d405
SHA256e37ea980109d26a5cba10c122f20be5165a85f7241fa41c1db4d0268afa4b36b
SHA5121e18f16f2b9db4bb01614750be770aa8877d2775bd0cb874909b8eab51010183ed96003f73e7601aa33961c06447ae99ec7e599a160cdb46094baa0266c8aeef
-
memory/1160-154-0x00000000005D0000-0x00000000005DA000-memory.dmpFilesize
40KB
-
memory/1220-159-0x0000000000310000-0x0000000000340000-memory.dmpFilesize
192KB
-
memory/1220-160-0x000000000A5F0000-0x000000000AC08000-memory.dmpFilesize
6.1MB
-
memory/1220-161-0x000000000A150000-0x000000000A25A000-memory.dmpFilesize
1.0MB
-
memory/1220-162-0x000000000A090000-0x000000000A0A2000-memory.dmpFilesize
72KB
-
memory/1220-163-0x0000000004C40000-0x0000000004C50000-memory.dmpFilesize
64KB
-
memory/1220-164-0x000000000A0F0000-0x000000000A12C000-memory.dmpFilesize
240KB
-
memory/1220-165-0x0000000004C40000-0x0000000004C50000-memory.dmpFilesize
64KB