Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05-06-2023 10:23
Static task
static1
Behavioral task
behavioral1
Sample
920feb2ecf913eeeb9529bf00bf448957e6bf72d53cef8d52634e6b8e5485587.exe
Resource
win10v2004-20230220-en
General
-
Target
920feb2ecf913eeeb9529bf00bf448957e6bf72d53cef8d52634e6b8e5485587.exe
-
Size
580KB
-
MD5
e68bf83d4ba9d30b8139951cf3bdb70f
-
SHA1
c7403616495758559d4674d0b1b58849f29ee0fd
-
SHA256
920feb2ecf913eeeb9529bf00bf448957e6bf72d53cef8d52634e6b8e5485587
-
SHA512
db0a1666f0180a32d01b5204aecfa3aca2aecf59909683c569919d69c4c0de1ec16b72960d38dc607f37509dd503f296fa81f7c3951f69b9feb77f002c21ca63
-
SSDEEP
12288:jMrty90Rxy2d0MUSLqgoitl+ycBs0IpxdLymtrbylQ:6yGFz/nPtrpxVdxbyK
Malware Config
Extracted
redline
maxi
83.97.73.126:19046
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Signatures
-
Processes:
a7704307.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a7704307.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection a7704307.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a7704307.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a7704307.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a7704307.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a7704307.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
Processes:
v2120122.exev3112633.exea7704307.exeb5426233.exepid process 3968 v2120122.exe 2716 v3112633.exe 3660 a7704307.exe 4536 b5426233.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
a7704307.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a7704307.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
v3112633.exe920feb2ecf913eeeb9529bf00bf448957e6bf72d53cef8d52634e6b8e5485587.exev2120122.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v3112633.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v3112633.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 920feb2ecf913eeeb9529bf00bf448957e6bf72d53cef8d52634e6b8e5485587.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 920feb2ecf913eeeb9529bf00bf448957e6bf72d53cef8d52634e6b8e5485587.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v2120122.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v2120122.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
a7704307.exeb5426233.exepid process 3660 a7704307.exe 3660 a7704307.exe 4536 b5426233.exe 4536 b5426233.exe 4536 b5426233.exe 4536 b5426233.exe 4536 b5426233.exe 4536 b5426233.exe 4536 b5426233.exe 4536 b5426233.exe 4536 b5426233.exe 4536 b5426233.exe 4536 b5426233.exe 4536 b5426233.exe 4536 b5426233.exe 4536 b5426233.exe 4536 b5426233.exe 4536 b5426233.exe 4536 b5426233.exe 4536 b5426233.exe 4536 b5426233.exe 4536 b5426233.exe 4536 b5426233.exe 4536 b5426233.exe 4536 b5426233.exe 4536 b5426233.exe 4536 b5426233.exe 4536 b5426233.exe 4536 b5426233.exe 4536 b5426233.exe 4536 b5426233.exe 4536 b5426233.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
a7704307.exeb5426233.exedescription pid process Token: SeDebugPrivilege 3660 a7704307.exe Token: SeDebugPrivilege 4536 b5426233.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
920feb2ecf913eeeb9529bf00bf448957e6bf72d53cef8d52634e6b8e5485587.exev2120122.exev3112633.exedescription pid process target process PID 3260 wrote to memory of 3968 3260 920feb2ecf913eeeb9529bf00bf448957e6bf72d53cef8d52634e6b8e5485587.exe v2120122.exe PID 3260 wrote to memory of 3968 3260 920feb2ecf913eeeb9529bf00bf448957e6bf72d53cef8d52634e6b8e5485587.exe v2120122.exe PID 3260 wrote to memory of 3968 3260 920feb2ecf913eeeb9529bf00bf448957e6bf72d53cef8d52634e6b8e5485587.exe v2120122.exe PID 3968 wrote to memory of 2716 3968 v2120122.exe v3112633.exe PID 3968 wrote to memory of 2716 3968 v2120122.exe v3112633.exe PID 3968 wrote to memory of 2716 3968 v2120122.exe v3112633.exe PID 2716 wrote to memory of 3660 2716 v3112633.exe a7704307.exe PID 2716 wrote to memory of 3660 2716 v3112633.exe a7704307.exe PID 2716 wrote to memory of 4536 2716 v3112633.exe b5426233.exe PID 2716 wrote to memory of 4536 2716 v3112633.exe b5426233.exe PID 2716 wrote to memory of 4536 2716 v3112633.exe b5426233.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\920feb2ecf913eeeb9529bf00bf448957e6bf72d53cef8d52634e6b8e5485587.exe"C:\Users\Admin\AppData\Local\Temp\920feb2ecf913eeeb9529bf00bf448957e6bf72d53cef8d52634e6b8e5485587.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2120122.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2120122.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3112633.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3112633.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7704307.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7704307.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5426233.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5426233.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2120122.exeFilesize
377KB
MD5f054cb0f1086f961b4abcfa33ab2e74c
SHA1466fa191858aee7cb78af569959ccc520efa968a
SHA256a056f9d0e344d66bfbe17d0cca164119c670bfc217fdaae2dc1b50b4e3c76f9c
SHA512e791bcfd9eed4262aedd52a7ca78f1114eb461926c255e04dda7a69129614e43eeb827ea9770945f1e1c0a87943d340acbd933c95e783eb2e879214888a33011
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2120122.exeFilesize
377KB
MD5f054cb0f1086f961b4abcfa33ab2e74c
SHA1466fa191858aee7cb78af569959ccc520efa968a
SHA256a056f9d0e344d66bfbe17d0cca164119c670bfc217fdaae2dc1b50b4e3c76f9c
SHA512e791bcfd9eed4262aedd52a7ca78f1114eb461926c255e04dda7a69129614e43eeb827ea9770945f1e1c0a87943d340acbd933c95e783eb2e879214888a33011
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3112633.exeFilesize
206KB
MD55d3610cb4583ec08cf78afd88d3c5529
SHA14330f4c4060792c85c719a660651b2c90ee0b3d7
SHA25663a6f94c03411ffcea14ad5bae9ce839cb888b0967ed5631ba7cd624edd252b2
SHA5128f85bbead23e2c39b26b87b4125771eb6d1a338d57733fe46e5c22840854e1c4607ee741b116795c3bce1d88d0e637f1a03c31adcf717e8e2e50790edf060136
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3112633.exeFilesize
206KB
MD55d3610cb4583ec08cf78afd88d3c5529
SHA14330f4c4060792c85c719a660651b2c90ee0b3d7
SHA25663a6f94c03411ffcea14ad5bae9ce839cb888b0967ed5631ba7cd624edd252b2
SHA5128f85bbead23e2c39b26b87b4125771eb6d1a338d57733fe46e5c22840854e1c4607ee741b116795c3bce1d88d0e637f1a03c31adcf717e8e2e50790edf060136
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7704307.exeFilesize
12KB
MD5812d1b479d9531c44390b1a8089df61c
SHA13ebf6aab8f2bf78ad8a1a68e86e11a00bf443b7d
SHA256fc0158b5b0750ee408ea393beea080a7601a7c5024882809713112c041f9da89
SHA512e75466a5830d29bd7ef4d348306ffeea2cbfbf850e5020b16645b8d4e5779b271033a6a438438b0364179453ad19f3cc30be62bbf79865f92a7b6f535548cdd0
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7704307.exeFilesize
12KB
MD5812d1b479d9531c44390b1a8089df61c
SHA13ebf6aab8f2bf78ad8a1a68e86e11a00bf443b7d
SHA256fc0158b5b0750ee408ea393beea080a7601a7c5024882809713112c041f9da89
SHA512e75466a5830d29bd7ef4d348306ffeea2cbfbf850e5020b16645b8d4e5779b271033a6a438438b0364179453ad19f3cc30be62bbf79865f92a7b6f535548cdd0
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5426233.exeFilesize
172KB
MD51c86c329124ff21195866c50818d531d
SHA19d954f3a8f0d95435af89975726c1820e26e31bb
SHA2564be2c7fbc3e5bfc79264e199a20862a80669216afeab938a41e5e28700346f08
SHA512bd62617f33e15d4362a781f12ec51633cccb998b5df53a575251ad16364a443d99c7f3fc01abcfbec35d4a71b43db685ed86d07ee507ec0300186c296be752cf
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5426233.exeFilesize
172KB
MD51c86c329124ff21195866c50818d531d
SHA19d954f3a8f0d95435af89975726c1820e26e31bb
SHA2564be2c7fbc3e5bfc79264e199a20862a80669216afeab938a41e5e28700346f08
SHA512bd62617f33e15d4362a781f12ec51633cccb998b5df53a575251ad16364a443d99c7f3fc01abcfbec35d4a71b43db685ed86d07ee507ec0300186c296be752cf
-
memory/3660-154-0x0000000000460000-0x000000000046A000-memory.dmpFilesize
40KB
-
memory/4536-160-0x000000000B0B0000-0x000000000B6C8000-memory.dmpFilesize
6.1MB
-
memory/4536-166-0x000000000AFC0000-0x000000000B052000-memory.dmpFilesize
584KB
-
memory/4536-161-0x000000000ABF0000-0x000000000ACFA000-memory.dmpFilesize
1.0MB
-
memory/4536-162-0x000000000AB30000-0x000000000AB42000-memory.dmpFilesize
72KB
-
memory/4536-163-0x000000000AB90000-0x000000000ABCC000-memory.dmpFilesize
240KB
-
memory/4536-164-0x0000000005700000-0x0000000005710000-memory.dmpFilesize
64KB
-
memory/4536-165-0x000000000AEA0000-0x000000000AF16000-memory.dmpFilesize
472KB
-
memory/4536-159-0x0000000000C70000-0x0000000000CA0000-memory.dmpFilesize
192KB
-
memory/4536-167-0x000000000AF20000-0x000000000AF86000-memory.dmpFilesize
408KB
-
memory/4536-168-0x000000000C080000-0x000000000C624000-memory.dmpFilesize
5.6MB
-
memory/4536-169-0x000000000BCC0000-0x000000000BD10000-memory.dmpFilesize
320KB
-
memory/4536-170-0x0000000005700000-0x0000000005710000-memory.dmpFilesize
64KB
-
memory/4536-171-0x000000000C630000-0x000000000C7F2000-memory.dmpFilesize
1.8MB
-
memory/4536-172-0x000000000CD30000-0x000000000D25C000-memory.dmpFilesize
5.2MB