Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05-06-2023 08:04
Static task
static1
Behavioral task
behavioral1
Sample
f5aff3952c538af0d1826d698399aad8d7fe8de73ed200714b9735c851fab4ff.exe
Resource
win10v2004-20230220-en
General
-
Target
f5aff3952c538af0d1826d698399aad8d7fe8de73ed200714b9735c851fab4ff.exe
-
Size
580KB
-
MD5
9be282d5f1ba5c7a440591e92704a0c2
-
SHA1
1b85129421448d153423d2cab125f0765d8b3a7a
-
SHA256
f5aff3952c538af0d1826d698399aad8d7fe8de73ed200714b9735c851fab4ff
-
SHA512
49d2e45a4e6b875f67d5e0502882a5b2a54d46adcf2b9c04e72e92450633f13da59cee6f6f000771b0b3aded3440a2300af8e1e8490caf6201e41041b5837d7f
-
SSDEEP
12288:cMrfy90tXutLZHQS8Zj38EO2JKUBRRsVEUpCTKERvN:jyyWLPI4sJKIvUXCTDv
Malware Config
Extracted
redline
maxi
83.97.73.126:19046
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Signatures
-
Processes:
a0292340.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a0292340.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a0292340.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a0292340.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a0292340.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection a0292340.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a0292340.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
Processes:
v0221291.exev0627316.exea0292340.exeb8171212.exepid process 4208 v0221291.exe 4020 v0627316.exe 4280 a0292340.exe 512 b8171212.exe -
Processes:
a0292340.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a0292340.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
v0221291.exev0627316.exef5aff3952c538af0d1826d698399aad8d7fe8de73ed200714b9735c851fab4ff.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v0221291.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v0627316.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v0627316.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce f5aff3952c538af0d1826d698399aad8d7fe8de73ed200714b9735c851fab4ff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" f5aff3952c538af0d1826d698399aad8d7fe8de73ed200714b9735c851fab4ff.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v0221291.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
a0292340.exepid process 4280 a0292340.exe 4280 a0292340.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a0292340.exedescription pid process Token: SeDebugPrivilege 4280 a0292340.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
f5aff3952c538af0d1826d698399aad8d7fe8de73ed200714b9735c851fab4ff.exev0221291.exev0627316.exedescription pid process target process PID 1200 wrote to memory of 4208 1200 f5aff3952c538af0d1826d698399aad8d7fe8de73ed200714b9735c851fab4ff.exe v0221291.exe PID 1200 wrote to memory of 4208 1200 f5aff3952c538af0d1826d698399aad8d7fe8de73ed200714b9735c851fab4ff.exe v0221291.exe PID 1200 wrote to memory of 4208 1200 f5aff3952c538af0d1826d698399aad8d7fe8de73ed200714b9735c851fab4ff.exe v0221291.exe PID 4208 wrote to memory of 4020 4208 v0221291.exe v0627316.exe PID 4208 wrote to memory of 4020 4208 v0221291.exe v0627316.exe PID 4208 wrote to memory of 4020 4208 v0221291.exe v0627316.exe PID 4020 wrote to memory of 4280 4020 v0627316.exe a0292340.exe PID 4020 wrote to memory of 4280 4020 v0627316.exe a0292340.exe PID 4020 wrote to memory of 512 4020 v0627316.exe b8171212.exe PID 4020 wrote to memory of 512 4020 v0627316.exe b8171212.exe PID 4020 wrote to memory of 512 4020 v0627316.exe b8171212.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5aff3952c538af0d1826d698399aad8d7fe8de73ed200714b9735c851fab4ff.exe"C:\Users\Admin\AppData\Local\Temp\f5aff3952c538af0d1826d698399aad8d7fe8de73ed200714b9735c851fab4ff.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0221291.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0221291.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0627316.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0627316.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0292340.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0292340.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8171212.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8171212.exe4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0221291.exeFilesize
378KB
MD5def38113f0ae84d3d0368d13296f1496
SHA14ad242401ba0ec0edb0420e3736de57083b95e6a
SHA256b2da4b52afa3da32a78204434bd1879d4d19b58fa1b61d33c618688fa45cb8ee
SHA512390598b662445e9d3974b54dc200284006410ab76f405514b62e83bd691d130b38185d7d9b496581b5d043bbc77b578e6aa4edd458f39a08a28b9e125cddc19c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0221291.exeFilesize
378KB
MD5def38113f0ae84d3d0368d13296f1496
SHA14ad242401ba0ec0edb0420e3736de57083b95e6a
SHA256b2da4b52afa3da32a78204434bd1879d4d19b58fa1b61d33c618688fa45cb8ee
SHA512390598b662445e9d3974b54dc200284006410ab76f405514b62e83bd691d130b38185d7d9b496581b5d043bbc77b578e6aa4edd458f39a08a28b9e125cddc19c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0627316.exeFilesize
206KB
MD56f2ffde5440f207e8f23589072b88e07
SHA13dcd5768357d52b1d53f4cca78618c662c821b90
SHA256141bdacfdce008831c593363fd6badf5914eff908d55c71c4d4e2bc066e5fcad
SHA5122a42a4cc414717bd8ce271019707c1f71d5455e616c18c3954a097d1b321334b946cdd0bebe366008c638308251dc69616c7008a9ec0fa7e22930ed4df8d85ea
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0627316.exeFilesize
206KB
MD56f2ffde5440f207e8f23589072b88e07
SHA13dcd5768357d52b1d53f4cca78618c662c821b90
SHA256141bdacfdce008831c593363fd6badf5914eff908d55c71c4d4e2bc066e5fcad
SHA5122a42a4cc414717bd8ce271019707c1f71d5455e616c18c3954a097d1b321334b946cdd0bebe366008c638308251dc69616c7008a9ec0fa7e22930ed4df8d85ea
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0292340.exeFilesize
11KB
MD53b13abc3a4ea1ebc54c5d519b61f6cfc
SHA17914024ffcf0337609973a7e00d4c3f6750b11f8
SHA256db128aa1b144a15460d96ee541f9f33f0bbf3c85792e9f81117e1985dec8c35e
SHA512efbf7300313877e098dc432c3304ba354c6f3fc4749a55c9c412c6c32add185f661a3feca4b15aef943bf6c58ff0df11497285a04c5d8343f00e374e0f1224ff
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0292340.exeFilesize
11KB
MD53b13abc3a4ea1ebc54c5d519b61f6cfc
SHA17914024ffcf0337609973a7e00d4c3f6750b11f8
SHA256db128aa1b144a15460d96ee541f9f33f0bbf3c85792e9f81117e1985dec8c35e
SHA512efbf7300313877e098dc432c3304ba354c6f3fc4749a55c9c412c6c32add185f661a3feca4b15aef943bf6c58ff0df11497285a04c5d8343f00e374e0f1224ff
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8171212.exeFilesize
172KB
MD5ecec36a4a4e263b1a764f219ea441e57
SHA116fe09c484b69d2fee537819851fd204525b44aa
SHA256a23863cd7efc82ae463049ddc4fbb52672bcae91adeeba395ecd31832475ff5b
SHA512f9a319e2bb415389a75af0fd965bf4f9ae979b663be48dbf6a643cc9e4cbeb564072dae3ebd20ed8d1d808550bb86de9e3be7d4e0c47e4752f7fd439701248a4
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8171212.exeFilesize
172KB
MD5ecec36a4a4e263b1a764f219ea441e57
SHA116fe09c484b69d2fee537819851fd204525b44aa
SHA256a23863cd7efc82ae463049ddc4fbb52672bcae91adeeba395ecd31832475ff5b
SHA512f9a319e2bb415389a75af0fd965bf4f9ae979b663be48dbf6a643cc9e4cbeb564072dae3ebd20ed8d1d808550bb86de9e3be7d4e0c47e4752f7fd439701248a4
-
memory/512-159-0x0000000000080000-0x00000000000B0000-memory.dmpFilesize
192KB
-
memory/512-160-0x000000000A4C0000-0x000000000AAD8000-memory.dmpFilesize
6.1MB
-
memory/512-161-0x000000000A000000-0x000000000A10A000-memory.dmpFilesize
1.0MB
-
memory/512-162-0x0000000009F40000-0x0000000009F52000-memory.dmpFilesize
72KB
-
memory/512-163-0x0000000009FA0000-0x0000000009FDC000-memory.dmpFilesize
240KB
-
memory/512-164-0x0000000004B10000-0x0000000004B20000-memory.dmpFilesize
64KB
-
memory/512-165-0x0000000004B10000-0x0000000004B20000-memory.dmpFilesize
64KB
-
memory/4280-154-0x00000000006E0000-0x00000000006EA000-memory.dmpFilesize
40KB