Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
05-06-2023 08:26
Static task
static1
Behavioral task
behavioral1
Sample
126c9bdb94a802e34f637812af2f1d753c4a4f6f9733e6ab753535768eea4be0.exe
Resource
win10v2004-20230221-en
General
-
Target
126c9bdb94a802e34f637812af2f1d753c4a4f6f9733e6ab753535768eea4be0.exe
-
Size
579KB
-
MD5
289c797539e006499cfa78e6ba421478
-
SHA1
acd2518c80d2128ec136da8465e34cde0e81a60b
-
SHA256
126c9bdb94a802e34f637812af2f1d753c4a4f6f9733e6ab753535768eea4be0
-
SHA512
6bd58bd613363666b744b5f7025fa6e47e43638362ed797e99c584c29d8d089bcdacce914251a6ac78276d7141ada22a142018da8b86c95c03d4c5944f85eab8
-
SSDEEP
12288:HMr1y90+ZYWHWkeVzGAvWbIcATYoMqcHKhsVeLIfSbUJt4u:Wy5FqVzGARxT/CqqfS4J+u
Malware Config
Extracted
redline
maxi
83.97.73.126:19046
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Signatures
-
Processes:
a1076701.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection a1076701.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a1076701.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a1076701.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a1076701.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a1076701.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a1076701.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
Processes:
v8164776.exev2598729.exea1076701.exeb3567561.exepid process 4616 v8164776.exe 4928 v2598729.exe 456 a1076701.exe 1656 b3567561.exe -
Processes:
a1076701.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a1076701.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
126c9bdb94a802e34f637812af2f1d753c4a4f6f9733e6ab753535768eea4be0.exev8164776.exev2598729.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 126c9bdb94a802e34f637812af2f1d753c4a4f6f9733e6ab753535768eea4be0.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v8164776.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v8164776.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v2598729.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v2598729.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 126c9bdb94a802e34f637812af2f1d753c4a4f6f9733e6ab753535768eea4be0.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
a1076701.exepid process 456 a1076701.exe 456 a1076701.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a1076701.exedescription pid process Token: SeDebugPrivilege 456 a1076701.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
126c9bdb94a802e34f637812af2f1d753c4a4f6f9733e6ab753535768eea4be0.exev8164776.exev2598729.exedescription pid process target process PID 4216 wrote to memory of 4616 4216 126c9bdb94a802e34f637812af2f1d753c4a4f6f9733e6ab753535768eea4be0.exe v8164776.exe PID 4216 wrote to memory of 4616 4216 126c9bdb94a802e34f637812af2f1d753c4a4f6f9733e6ab753535768eea4be0.exe v8164776.exe PID 4216 wrote to memory of 4616 4216 126c9bdb94a802e34f637812af2f1d753c4a4f6f9733e6ab753535768eea4be0.exe v8164776.exe PID 4616 wrote to memory of 4928 4616 v8164776.exe v2598729.exe PID 4616 wrote to memory of 4928 4616 v8164776.exe v2598729.exe PID 4616 wrote to memory of 4928 4616 v8164776.exe v2598729.exe PID 4928 wrote to memory of 456 4928 v2598729.exe a1076701.exe PID 4928 wrote to memory of 456 4928 v2598729.exe a1076701.exe PID 4928 wrote to memory of 1656 4928 v2598729.exe b3567561.exe PID 4928 wrote to memory of 1656 4928 v2598729.exe b3567561.exe PID 4928 wrote to memory of 1656 4928 v2598729.exe b3567561.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\126c9bdb94a802e34f637812af2f1d753c4a4f6f9733e6ab753535768eea4be0.exe"C:\Users\Admin\AppData\Local\Temp\126c9bdb94a802e34f637812af2f1d753c4a4f6f9733e6ab753535768eea4be0.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8164776.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8164776.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2598729.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2598729.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1076701.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1076701.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3567561.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3567561.exe4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8164776.exeFilesize
377KB
MD5f41399fcd55cff4a843b4a035b4c2d43
SHA1d241d3357baa8abc65dc97abbea02cc36ead98a1
SHA2566df175969e50571355b65b816ba26ecce0497fd5f54d619864c2fe2273fda344
SHA512f6f85ce15c12e4c773b3057ca2e18dd4eea3042cdf3006414779d6cb14078eda892046cc6f73f49dbe8f8702ddf7c0810c97107380d783a701a168cef4ff9931
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8164776.exeFilesize
377KB
MD5f41399fcd55cff4a843b4a035b4c2d43
SHA1d241d3357baa8abc65dc97abbea02cc36ead98a1
SHA2566df175969e50571355b65b816ba26ecce0497fd5f54d619864c2fe2273fda344
SHA512f6f85ce15c12e4c773b3057ca2e18dd4eea3042cdf3006414779d6cb14078eda892046cc6f73f49dbe8f8702ddf7c0810c97107380d783a701a168cef4ff9931
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2598729.exeFilesize
206KB
MD5529e1c3636e9561fb8a37ed5318a6b25
SHA1df32460fcd2f7d69c499953337c5bf92118b3276
SHA25603dfd551f22256f0116fb66fc254b038fe5820b58fb0712e8cb6d677a65492ae
SHA51227e0fa77f8dc88671b4a2e51ebe0ff5a0b367b6808cc3097364f83a3a82ca59876638de6c13dbaf3d513c697cded8f8ba920c2316493003be093c559bd37d528
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2598729.exeFilesize
206KB
MD5529e1c3636e9561fb8a37ed5318a6b25
SHA1df32460fcd2f7d69c499953337c5bf92118b3276
SHA25603dfd551f22256f0116fb66fc254b038fe5820b58fb0712e8cb6d677a65492ae
SHA51227e0fa77f8dc88671b4a2e51ebe0ff5a0b367b6808cc3097364f83a3a82ca59876638de6c13dbaf3d513c697cded8f8ba920c2316493003be093c559bd37d528
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1076701.exeFilesize
12KB
MD5c2a05bf02a5e6ce6beeb1b747f006b3e
SHA1801edcbef274e47c522bb985467ced3bff296dfb
SHA256cb2b0d97af25b121dd8ef83a7003f3cee9469acd374d0d04986be37c76ed060b
SHA512dc399d61fc7efeea480ef95f008d13c6b040080246eac7efd56e43457af2d0d6a5e89f16c63eb339d98d0b0d2b8ed1879ce4bc707111f5b74f928f1499182d56
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1076701.exeFilesize
12KB
MD5c2a05bf02a5e6ce6beeb1b747f006b3e
SHA1801edcbef274e47c522bb985467ced3bff296dfb
SHA256cb2b0d97af25b121dd8ef83a7003f3cee9469acd374d0d04986be37c76ed060b
SHA512dc399d61fc7efeea480ef95f008d13c6b040080246eac7efd56e43457af2d0d6a5e89f16c63eb339d98d0b0d2b8ed1879ce4bc707111f5b74f928f1499182d56
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3567561.exeFilesize
172KB
MD5c4b60e437ef855048af2f3684b188ae9
SHA1be86f2a356df18fc4fb12df777fe34ca694742ca
SHA256d1ee48e11d4f86c6a40533211fb353ff52d659f72d62278b54cdc388ff29ab02
SHA512bc3e230d4a8dcde20eb96e73c9dbe1852ebadff71342821969e4a5210aba0b20d8e14eeb76e3e1b89dda5947b053097b459dc51ef2a99a2439be574e47bd1035
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3567561.exeFilesize
172KB
MD5c4b60e437ef855048af2f3684b188ae9
SHA1be86f2a356df18fc4fb12df777fe34ca694742ca
SHA256d1ee48e11d4f86c6a40533211fb353ff52d659f72d62278b54cdc388ff29ab02
SHA512bc3e230d4a8dcde20eb96e73c9dbe1852ebadff71342821969e4a5210aba0b20d8e14eeb76e3e1b89dda5947b053097b459dc51ef2a99a2439be574e47bd1035
-
memory/456-154-0x0000000000DF0000-0x0000000000DFA000-memory.dmpFilesize
40KB
-
memory/1656-159-0x00000000009A0000-0x00000000009D0000-memory.dmpFilesize
192KB
-
memory/1656-160-0x000000000ADA0000-0x000000000B3B8000-memory.dmpFilesize
6.1MB
-
memory/1656-161-0x000000000A920000-0x000000000AA2A000-memory.dmpFilesize
1.0MB
-
memory/1656-162-0x000000000A860000-0x000000000A872000-memory.dmpFilesize
72KB
-
memory/1656-163-0x0000000002D40000-0x0000000002D50000-memory.dmpFilesize
64KB
-
memory/1656-164-0x000000000A8C0000-0x000000000A8FC000-memory.dmpFilesize
240KB
-
memory/1656-165-0x0000000002D40000-0x0000000002D50000-memory.dmpFilesize
64KB