Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05-06-2023 07:52
Static task
static1
Behavioral task
behavioral1
Sample
17fbdc887305e01bd6fc3ca93dbb2b50af8d8bb8135bda4a8b244107b991767a.exe
Resource
win10v2004-20230220-en
General
-
Target
17fbdc887305e01bd6fc3ca93dbb2b50af8d8bb8135bda4a8b244107b991767a.exe
-
Size
579KB
-
MD5
3761df12bebd38333cc8a961b6abfe2b
-
SHA1
30bde90e1ab6b292ebf71920b21849228d4f950a
-
SHA256
17fbdc887305e01bd6fc3ca93dbb2b50af8d8bb8135bda4a8b244107b991767a
-
SHA512
6716576d6adc4acb7ffd66830395b82cde53d67dbcb97aa31104f6b33962610b98714fd4db4dbf86da61f79906a6e7401608c00fc2362bd74278f8dd061b06ad
-
SSDEEP
12288:IMrJy90Xlf0XKD7LauHVkRZMInGpfC9nOCMfPkjFNvS+:ByAlfUKDNJPfC9nOCMfMf6+
Malware Config
Extracted
redline
maxi
83.97.73.126:19046
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Signatures
-
Processes:
a7015700.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a7015700.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a7015700.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a7015700.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a7015700.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection a7015700.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a7015700.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
Processes:
v7610644.exev0458835.exea7015700.exeb6250151.exepid process 2408 v7610644.exe 1404 v0458835.exe 4596 a7015700.exe 4260 b6250151.exe -
Processes:
a7015700.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a7015700.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
17fbdc887305e01bd6fc3ca93dbb2b50af8d8bb8135bda4a8b244107b991767a.exev7610644.exev0458835.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 17fbdc887305e01bd6fc3ca93dbb2b50af8d8bb8135bda4a8b244107b991767a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 17fbdc887305e01bd6fc3ca93dbb2b50af8d8bb8135bda4a8b244107b991767a.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v7610644.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v7610644.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v0458835.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v0458835.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
a7015700.exepid process 4596 a7015700.exe 4596 a7015700.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a7015700.exedescription pid process Token: SeDebugPrivilege 4596 a7015700.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
17fbdc887305e01bd6fc3ca93dbb2b50af8d8bb8135bda4a8b244107b991767a.exev7610644.exev0458835.exedescription pid process target process PID 3080 wrote to memory of 2408 3080 17fbdc887305e01bd6fc3ca93dbb2b50af8d8bb8135bda4a8b244107b991767a.exe v7610644.exe PID 3080 wrote to memory of 2408 3080 17fbdc887305e01bd6fc3ca93dbb2b50af8d8bb8135bda4a8b244107b991767a.exe v7610644.exe PID 3080 wrote to memory of 2408 3080 17fbdc887305e01bd6fc3ca93dbb2b50af8d8bb8135bda4a8b244107b991767a.exe v7610644.exe PID 2408 wrote to memory of 1404 2408 v7610644.exe v0458835.exe PID 2408 wrote to memory of 1404 2408 v7610644.exe v0458835.exe PID 2408 wrote to memory of 1404 2408 v7610644.exe v0458835.exe PID 1404 wrote to memory of 4596 1404 v0458835.exe a7015700.exe PID 1404 wrote to memory of 4596 1404 v0458835.exe a7015700.exe PID 1404 wrote to memory of 4260 1404 v0458835.exe b6250151.exe PID 1404 wrote to memory of 4260 1404 v0458835.exe b6250151.exe PID 1404 wrote to memory of 4260 1404 v0458835.exe b6250151.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\17fbdc887305e01bd6fc3ca93dbb2b50af8d8bb8135bda4a8b244107b991767a.exe"C:\Users\Admin\AppData\Local\Temp\17fbdc887305e01bd6fc3ca93dbb2b50af8d8bb8135bda4a8b244107b991767a.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7610644.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7610644.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0458835.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0458835.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7015700.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7015700.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6250151.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6250151.exe4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7610644.exeFilesize
377KB
MD5680bdda538ba2c8c5f16077f7c1aec4a
SHA1af6995054d8622a1422569e2a48676db379a2bd3
SHA25678a913eb8e6e672806fed1f46d1ddbd05795c4566ea84429061a5ad574edcce1
SHA51298921eb0f8df88da184a736872e5de333abbba354798b174b17f815c8140c59028991b826e7c525ec8109e65fd92789199b51168fceeed3e7ab7f35ebb2be351
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7610644.exeFilesize
377KB
MD5680bdda538ba2c8c5f16077f7c1aec4a
SHA1af6995054d8622a1422569e2a48676db379a2bd3
SHA25678a913eb8e6e672806fed1f46d1ddbd05795c4566ea84429061a5ad574edcce1
SHA51298921eb0f8df88da184a736872e5de333abbba354798b174b17f815c8140c59028991b826e7c525ec8109e65fd92789199b51168fceeed3e7ab7f35ebb2be351
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0458835.exeFilesize
206KB
MD5790eb418bd43765b31deb95a69de35dc
SHA112c17ad002f119b24d746d03fe9fe5e2bc4baa3f
SHA256b5b0c56331252527533100950020d547e5dbc5ddb5dfc363dcbd7aad9f2c4352
SHA51269106d782a2ffeebe2f46d28e823c270b8e0932a905b5f69d8415925cbc74c0e1e1e66f3a57b23c243710b2d4a8e1cb6ca489da3d4d0b5dfacf643cee80e948e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0458835.exeFilesize
206KB
MD5790eb418bd43765b31deb95a69de35dc
SHA112c17ad002f119b24d746d03fe9fe5e2bc4baa3f
SHA256b5b0c56331252527533100950020d547e5dbc5ddb5dfc363dcbd7aad9f2c4352
SHA51269106d782a2ffeebe2f46d28e823c270b8e0932a905b5f69d8415925cbc74c0e1e1e66f3a57b23c243710b2d4a8e1cb6ca489da3d4d0b5dfacf643cee80e948e
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7015700.exeFilesize
11KB
MD56adc836b8e5dbbdfc8c49d6418816921
SHA15b968ba5e97f672a755a2503d8d9162091744cb6
SHA256ecf409d4195fda12593d9bf6067e1123722a98f0a400a414f8e90573d47b45d6
SHA512bb1b28b20e90bdc7becf97fa116105144ec06f415d0c20d7bf4fe39346432ec29914b7019b323e66e4f91ecd5494646d0f999406021d17bb6f0b1734d6ca7e6e
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7015700.exeFilesize
11KB
MD56adc836b8e5dbbdfc8c49d6418816921
SHA15b968ba5e97f672a755a2503d8d9162091744cb6
SHA256ecf409d4195fda12593d9bf6067e1123722a98f0a400a414f8e90573d47b45d6
SHA512bb1b28b20e90bdc7becf97fa116105144ec06f415d0c20d7bf4fe39346432ec29914b7019b323e66e4f91ecd5494646d0f999406021d17bb6f0b1734d6ca7e6e
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6250151.exeFilesize
172KB
MD5e2c373e03336f7e4df11ae12377c8490
SHA15dfe9aa87546ec6f3c26af07e882f403050aabb5
SHA256865704f1846cc7e2f15838404ba890f1c15979f7056f08994ae654f790f19c7e
SHA5128ee6005fcc149984d76e2424ad2aa33c7c5295b7c4aef454bf336a6b03a0819f06555ecd17f89625017ada11228e1ac24f4c6df981a095b3b3e46084acf9ada2
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6250151.exeFilesize
172KB
MD5e2c373e03336f7e4df11ae12377c8490
SHA15dfe9aa87546ec6f3c26af07e882f403050aabb5
SHA256865704f1846cc7e2f15838404ba890f1c15979f7056f08994ae654f790f19c7e
SHA5128ee6005fcc149984d76e2424ad2aa33c7c5295b7c4aef454bf336a6b03a0819f06555ecd17f89625017ada11228e1ac24f4c6df981a095b3b3e46084acf9ada2
-
memory/4260-159-0x00000000005A0000-0x00000000005D0000-memory.dmpFilesize
192KB
-
memory/4260-160-0x000000000A9A0000-0x000000000AFB8000-memory.dmpFilesize
6.1MB
-
memory/4260-161-0x000000000A520000-0x000000000A62A000-memory.dmpFilesize
1.0MB
-
memory/4260-162-0x0000000004FC0000-0x0000000004FD0000-memory.dmpFilesize
64KB
-
memory/4260-163-0x000000000A460000-0x000000000A472000-memory.dmpFilesize
72KB
-
memory/4260-164-0x000000000A4C0000-0x000000000A4FC000-memory.dmpFilesize
240KB
-
memory/4260-165-0x0000000004FC0000-0x0000000004FD0000-memory.dmpFilesize
64KB
-
memory/4596-154-0x0000000000DB0000-0x0000000000DBA000-memory.dmpFilesize
40KB