Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
05-06-2023 11:51
Static task
static1
Behavioral task
behavioral1
Sample
a810aca18e981e329fd28af2fc126ec9f01bb19d09efe47f5b84005c5357b65f.exe
Resource
win10-20230220-en
General
-
Target
a810aca18e981e329fd28af2fc126ec9f01bb19d09efe47f5b84005c5357b65f.exe
-
Size
729KB
-
MD5
6455bda83a3b4aef68a6ac3602e36dc7
-
SHA1
31379ba51f93ade2ebdc1f058731a327aaca3266
-
SHA256
a810aca18e981e329fd28af2fc126ec9f01bb19d09efe47f5b84005c5357b65f
-
SHA512
8ce571ee49a55846e0ce8e93c41959fcd7a4f5d000e039c1c80185014f6ebd86e804973cfd9b88e09edb043c50ce8f538fd8f738da25e54874c0e1b14d51fb26
-
SSDEEP
12288:4MrMy90vbCjfSluomHWq9MJDE/RKT20LnEZNCEc0d5oUJaLABx9parz53Fxd:kyFzkJDEwa0Loc0diUgEg3d
Malware Config
Extracted
redline
maxi
83.97.73.126:19046
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Signatures
-
Processes:
a2831742.exeAppLaunch.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a2831742.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a2831742.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a2831742.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a2831742.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a2831742.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 6 IoCs
Processes:
v3009449.exev1439706.exev2012102.exea2831742.exeb9890641.exec1852209.exepid process 2268 v3009449.exe 2492 v1439706.exe 2856 v2012102.exe 4980 a2831742.exe 4432 b9890641.exe 1652 c1852209.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
a2831742.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a2831742.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
a810aca18e981e329fd28af2fc126ec9f01bb19d09efe47f5b84005c5357b65f.exev3009449.exev1439706.exev2012102.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a810aca18e981e329fd28af2fc126ec9f01bb19d09efe47f5b84005c5357b65f.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v3009449.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v3009449.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v1439706.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v1439706.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v2012102.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" v2012102.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce a810aca18e981e329fd28af2fc126ec9f01bb19d09efe47f5b84005c5357b65f.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
b9890641.exedescription pid process target process PID 4432 set thread context of 4004 4432 b9890641.exe AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
a2831742.exeAppLaunch.exec1852209.exepid process 4980 a2831742.exe 4980 a2831742.exe 4004 AppLaunch.exe 4004 AppLaunch.exe 1652 c1852209.exe 1652 c1852209.exe 1652 c1852209.exe 1652 c1852209.exe 1652 c1852209.exe 1652 c1852209.exe 1652 c1852209.exe 1652 c1852209.exe 1652 c1852209.exe 1652 c1852209.exe 1652 c1852209.exe 1652 c1852209.exe 1652 c1852209.exe 1652 c1852209.exe 1652 c1852209.exe 1652 c1852209.exe 1652 c1852209.exe 1652 c1852209.exe 1652 c1852209.exe 1652 c1852209.exe 1652 c1852209.exe 1652 c1852209.exe 1652 c1852209.exe 1652 c1852209.exe 1652 c1852209.exe 1652 c1852209.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
a2831742.exeAppLaunch.exec1852209.exedescription pid process Token: SeDebugPrivilege 4980 a2831742.exe Token: SeDebugPrivilege 4004 AppLaunch.exe Token: SeDebugPrivilege 1652 c1852209.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
a810aca18e981e329fd28af2fc126ec9f01bb19d09efe47f5b84005c5357b65f.exev3009449.exev1439706.exev2012102.exeb9890641.exedescription pid process target process PID 2052 wrote to memory of 2268 2052 a810aca18e981e329fd28af2fc126ec9f01bb19d09efe47f5b84005c5357b65f.exe v3009449.exe PID 2052 wrote to memory of 2268 2052 a810aca18e981e329fd28af2fc126ec9f01bb19d09efe47f5b84005c5357b65f.exe v3009449.exe PID 2052 wrote to memory of 2268 2052 a810aca18e981e329fd28af2fc126ec9f01bb19d09efe47f5b84005c5357b65f.exe v3009449.exe PID 2268 wrote to memory of 2492 2268 v3009449.exe v1439706.exe PID 2268 wrote to memory of 2492 2268 v3009449.exe v1439706.exe PID 2268 wrote to memory of 2492 2268 v3009449.exe v1439706.exe PID 2492 wrote to memory of 2856 2492 v1439706.exe v2012102.exe PID 2492 wrote to memory of 2856 2492 v1439706.exe v2012102.exe PID 2492 wrote to memory of 2856 2492 v1439706.exe v2012102.exe PID 2856 wrote to memory of 4980 2856 v2012102.exe a2831742.exe PID 2856 wrote to memory of 4980 2856 v2012102.exe a2831742.exe PID 2856 wrote to memory of 4432 2856 v2012102.exe b9890641.exe PID 2856 wrote to memory of 4432 2856 v2012102.exe b9890641.exe PID 2856 wrote to memory of 4432 2856 v2012102.exe b9890641.exe PID 4432 wrote to memory of 4004 4432 b9890641.exe AppLaunch.exe PID 4432 wrote to memory of 4004 4432 b9890641.exe AppLaunch.exe PID 4432 wrote to memory of 4004 4432 b9890641.exe AppLaunch.exe PID 4432 wrote to memory of 4004 4432 b9890641.exe AppLaunch.exe PID 4432 wrote to memory of 4004 4432 b9890641.exe AppLaunch.exe PID 2492 wrote to memory of 1652 2492 v1439706.exe c1852209.exe PID 2492 wrote to memory of 1652 2492 v1439706.exe c1852209.exe PID 2492 wrote to memory of 1652 2492 v1439706.exe c1852209.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a810aca18e981e329fd28af2fc126ec9f01bb19d09efe47f5b84005c5357b65f.exe"C:\Users\Admin\AppData\Local\Temp\a810aca18e981e329fd28af2fc126ec9f01bb19d09efe47f5b84005c5357b65f.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3009449.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3009449.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1439706.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1439706.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2012102.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2012102.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2831742.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2831742.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9890641.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9890641.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c1852209.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c1852209.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3009449.exeFilesize
526KB
MD5ed9903a3f517be8ac57c72424be7ff14
SHA175c11ff563efc0878f697bd8e5f06144e0b8912d
SHA256925cd6902ba2b172aeaf14df9b9cafa2e93b044ed6754c1ea023fd8c684295c1
SHA512d988e885b9833b403beaadec529ff8c595f8d448c82e1dfbe9799ba15bb4469ecabf3a8a30604ccf4f9f7e33cc5052e1ac6dbee5e841360a9b8560ee8ede1052
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3009449.exeFilesize
526KB
MD5ed9903a3f517be8ac57c72424be7ff14
SHA175c11ff563efc0878f697bd8e5f06144e0b8912d
SHA256925cd6902ba2b172aeaf14df9b9cafa2e93b044ed6754c1ea023fd8c684295c1
SHA512d988e885b9833b403beaadec529ff8c595f8d448c82e1dfbe9799ba15bb4469ecabf3a8a30604ccf4f9f7e33cc5052e1ac6dbee5e841360a9b8560ee8ede1052
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1439706.exeFilesize
354KB
MD5cd5cfa068db5e2420d5610d4286ebbdb
SHA1635c9ce0ac7e4f22747d234e9d9d91abbcd56ef6
SHA256ef95f13d33c127aa3872375c5b53d6dda25acf08ccfd42b7618dd18e63f5d49b
SHA512b646a70f1d9e12fadf761bafd34d7f2a31da5ae027c98bea558bda153a9510a4b6c1e4bc19a8172659eafef016f8fda0a9c3895c087b09f3607ce46fe8c172fb
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1439706.exeFilesize
354KB
MD5cd5cfa068db5e2420d5610d4286ebbdb
SHA1635c9ce0ac7e4f22747d234e9d9d91abbcd56ef6
SHA256ef95f13d33c127aa3872375c5b53d6dda25acf08ccfd42b7618dd18e63f5d49b
SHA512b646a70f1d9e12fadf761bafd34d7f2a31da5ae027c98bea558bda153a9510a4b6c1e4bc19a8172659eafef016f8fda0a9c3895c087b09f3607ce46fe8c172fb
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c1852209.exeFilesize
172KB
MD531cc2ea764118fe5a9746348e90aa834
SHA17b9f18501972a389700c12c739278995fb1ef358
SHA256ad082bfec927e22940fd829e26932a68bf9a43d9992636e1e214184ceb02b240
SHA512837aeb13de78f5ab175279cdf387ce28437d50bb53cb3506502b7271ab672f45fdf678a2786f5e3d72f7fa34e6ff19dd3491bfbf4a67c7f22e1449efff78708d
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c1852209.exeFilesize
172KB
MD531cc2ea764118fe5a9746348e90aa834
SHA17b9f18501972a389700c12c739278995fb1ef358
SHA256ad082bfec927e22940fd829e26932a68bf9a43d9992636e1e214184ceb02b240
SHA512837aeb13de78f5ab175279cdf387ce28437d50bb53cb3506502b7271ab672f45fdf678a2786f5e3d72f7fa34e6ff19dd3491bfbf4a67c7f22e1449efff78708d
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2012102.exeFilesize
199KB
MD571963f20a67fba5b0242207934a1adbe
SHA1e19515c675c268203223eb87a5352256f9dc44b5
SHA256ef19b7355b5e16fa21cc863d7315843e8b9d4a7720abac6f552c3d52b6728028
SHA512d0176f97b154dbfcc1c10c0383b1daeba7aac9dbe937731f91eb2ca6623bcc453630bfb19b7a06bfe087debc4adf19c98f9e58f6a7630bd6e247d3896effc827
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2012102.exeFilesize
199KB
MD571963f20a67fba5b0242207934a1adbe
SHA1e19515c675c268203223eb87a5352256f9dc44b5
SHA256ef19b7355b5e16fa21cc863d7315843e8b9d4a7720abac6f552c3d52b6728028
SHA512d0176f97b154dbfcc1c10c0383b1daeba7aac9dbe937731f91eb2ca6623bcc453630bfb19b7a06bfe087debc4adf19c98f9e58f6a7630bd6e247d3896effc827
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2831742.exeFilesize
12KB
MD5cef9fab97c2e92cdc6b8a78378e5eb3c
SHA17f4fe229983a3b9e327ab9e9a90ad2133a1f6615
SHA256f9a4615c6157366d520ab9fa5496851902e18ed444e5b32c32a03fb38e04a364
SHA512d1f8c2284e6cd9b749ba2716f08cce1d80698663d1c1241d798266eb802c8c69028a68f403fe80993ab15567e53e770760e2d41a5056ab49297482f2fef7f49f
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2831742.exeFilesize
12KB
MD5cef9fab97c2e92cdc6b8a78378e5eb3c
SHA17f4fe229983a3b9e327ab9e9a90ad2133a1f6615
SHA256f9a4615c6157366d520ab9fa5496851902e18ed444e5b32c32a03fb38e04a364
SHA512d1f8c2284e6cd9b749ba2716f08cce1d80698663d1c1241d798266eb802c8c69028a68f403fe80993ab15567e53e770760e2d41a5056ab49297482f2fef7f49f
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9890641.exeFilesize
105KB
MD50f52360bd0ac17b2dd8797e423df9552
SHA1f59e4443575d3011515555088e4dacbc6a9517b7
SHA256fbe71279bf491c771247ee3f401d44b4ff21d1e9b276192a4349c408116bae11
SHA5121f1a38bc3a1f7dd741a1a91e4d8f794064e60262cb1dd23f83a1885f907cb29fe7cf1c61b125ad5210d6094538574cf0101ca2bd45c15adee9d4079545e84c32
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9890641.exeFilesize
105KB
MD50f52360bd0ac17b2dd8797e423df9552
SHA1f59e4443575d3011515555088e4dacbc6a9517b7
SHA256fbe71279bf491c771247ee3f401d44b4ff21d1e9b276192a4349c408116bae11
SHA5121f1a38bc3a1f7dd741a1a91e4d8f794064e60262cb1dd23f83a1885f907cb29fe7cf1c61b125ad5210d6094538574cf0101ca2bd45c15adee9d4079545e84c32
-
memory/1652-165-0x00000000001B0000-0x00000000001E0000-memory.dmpFilesize
192KB
-
memory/1652-176-0x0000000004A00000-0x0000000004A10000-memory.dmpFilesize
64KB
-
memory/1652-202-0x00000000083C0000-0x00000000088EC000-memory.dmpFilesize
5.2MB
-
memory/1652-166-0x00000000023C0000-0x00000000023C6000-memory.dmpFilesize
24KB
-
memory/1652-167-0x0000000005220000-0x0000000005826000-memory.dmpFilesize
6.0MB
-
memory/1652-168-0x0000000004D20000-0x0000000004E2A000-memory.dmpFilesize
1.0MB
-
memory/1652-169-0x0000000004C10000-0x0000000004C22000-memory.dmpFilesize
72KB
-
memory/1652-170-0x0000000004C30000-0x0000000004C6E000-memory.dmpFilesize
248KB
-
memory/1652-175-0x0000000004C70000-0x0000000004CBB000-memory.dmpFilesize
300KB
-
memory/1652-201-0x0000000006640000-0x0000000006802000-memory.dmpFilesize
1.8MB
-
memory/1652-181-0x0000000004F80000-0x0000000004FF6000-memory.dmpFilesize
472KB
-
memory/1652-182-0x00000000050A0000-0x0000000005132000-memory.dmpFilesize
584KB
-
memory/1652-183-0x0000000006140000-0x000000000663E000-memory.dmpFilesize
5.0MB
-
memory/1652-184-0x0000000005140000-0x00000000051A6000-memory.dmpFilesize
408KB
-
memory/1652-199-0x0000000005A80000-0x0000000005AD0000-memory.dmpFilesize
320KB
-
memory/1652-200-0x0000000004A00000-0x0000000004A10000-memory.dmpFilesize
64KB
-
memory/4004-154-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/4980-149-0x0000000000F30000-0x0000000000F3A000-memory.dmpFilesize
40KB