Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
05-06-2023 11:30
Static task
static1
Behavioral task
behavioral1
Sample
b2ef6152c28d194375f2a5398ff7f2f9141b854a4e71f5e27ed7793bccb705a7.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
b2ef6152c28d194375f2a5398ff7f2f9141b854a4e71f5e27ed7793bccb705a7.exe
Resource
win10v2004-20230220-en
General
-
Target
b2ef6152c28d194375f2a5398ff7f2f9141b854a4e71f5e27ed7793bccb705a7.exe
-
Size
786KB
-
MD5
7008a6317fd9009852f4bf6267131b4d
-
SHA1
51d6f93d427c93e57648d156f73eedb07d971de2
-
SHA256
b2ef6152c28d194375f2a5398ff7f2f9141b854a4e71f5e27ed7793bccb705a7
-
SHA512
35a39d0fffb1b3ed957c6bc1b2095c2c4c9c340baa6565c952f78c2600654316dadf3094cf24fbdeb5269828fb72c160353bb94abb3f2fd2bd840f3410b7e900
-
SSDEEP
24576:PyJ82wFqgfDwsjiN8w2tnXIlwv/WHFjS:aCZ7Z/Ylw2H1
Malware Config
Extracted
redline
maxi
83.97.73.126:19046
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Signatures
-
Processes:
AppLaunch.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
Processes:
v8995080.exev7463971.exea8535070.exeb7653130.exepid process 868 v8995080.exe 1416 v7463971.exe 268 a8535070.exe 1524 b7653130.exe -
Loads dropped DLL 8 IoCs
Processes:
b2ef6152c28d194375f2a5398ff7f2f9141b854a4e71f5e27ed7793bccb705a7.exev8995080.exev7463971.exea8535070.exeb7653130.exepid process 2016 b2ef6152c28d194375f2a5398ff7f2f9141b854a4e71f5e27ed7793bccb705a7.exe 868 v8995080.exe 868 v8995080.exe 1416 v7463971.exe 1416 v7463971.exe 268 a8535070.exe 1416 v7463971.exe 1524 b7653130.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
b2ef6152c28d194375f2a5398ff7f2f9141b854a4e71f5e27ed7793bccb705a7.exev8995080.exev7463971.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" b2ef6152c28d194375f2a5398ff7f2f9141b854a4e71f5e27ed7793bccb705a7.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce v8995080.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v8995080.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce v7463971.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v7463971.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce b2ef6152c28d194375f2a5398ff7f2f9141b854a4e71f5e27ed7793bccb705a7.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a8535070.exedescription pid process target process PID 268 set thread context of 824 268 a8535070.exe AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 824 AppLaunch.exe 824 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 824 AppLaunch.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
b2ef6152c28d194375f2a5398ff7f2f9141b854a4e71f5e27ed7793bccb705a7.exev8995080.exev7463971.exea8535070.exedescription pid process target process PID 2016 wrote to memory of 868 2016 b2ef6152c28d194375f2a5398ff7f2f9141b854a4e71f5e27ed7793bccb705a7.exe v8995080.exe PID 2016 wrote to memory of 868 2016 b2ef6152c28d194375f2a5398ff7f2f9141b854a4e71f5e27ed7793bccb705a7.exe v8995080.exe PID 2016 wrote to memory of 868 2016 b2ef6152c28d194375f2a5398ff7f2f9141b854a4e71f5e27ed7793bccb705a7.exe v8995080.exe PID 2016 wrote to memory of 868 2016 b2ef6152c28d194375f2a5398ff7f2f9141b854a4e71f5e27ed7793bccb705a7.exe v8995080.exe PID 2016 wrote to memory of 868 2016 b2ef6152c28d194375f2a5398ff7f2f9141b854a4e71f5e27ed7793bccb705a7.exe v8995080.exe PID 2016 wrote to memory of 868 2016 b2ef6152c28d194375f2a5398ff7f2f9141b854a4e71f5e27ed7793bccb705a7.exe v8995080.exe PID 2016 wrote to memory of 868 2016 b2ef6152c28d194375f2a5398ff7f2f9141b854a4e71f5e27ed7793bccb705a7.exe v8995080.exe PID 868 wrote to memory of 1416 868 v8995080.exe v7463971.exe PID 868 wrote to memory of 1416 868 v8995080.exe v7463971.exe PID 868 wrote to memory of 1416 868 v8995080.exe v7463971.exe PID 868 wrote to memory of 1416 868 v8995080.exe v7463971.exe PID 868 wrote to memory of 1416 868 v8995080.exe v7463971.exe PID 868 wrote to memory of 1416 868 v8995080.exe v7463971.exe PID 868 wrote to memory of 1416 868 v8995080.exe v7463971.exe PID 1416 wrote to memory of 268 1416 v7463971.exe a8535070.exe PID 1416 wrote to memory of 268 1416 v7463971.exe a8535070.exe PID 1416 wrote to memory of 268 1416 v7463971.exe a8535070.exe PID 1416 wrote to memory of 268 1416 v7463971.exe a8535070.exe PID 1416 wrote to memory of 268 1416 v7463971.exe a8535070.exe PID 1416 wrote to memory of 268 1416 v7463971.exe a8535070.exe PID 1416 wrote to memory of 268 1416 v7463971.exe a8535070.exe PID 268 wrote to memory of 824 268 a8535070.exe AppLaunch.exe PID 268 wrote to memory of 824 268 a8535070.exe AppLaunch.exe PID 268 wrote to memory of 824 268 a8535070.exe AppLaunch.exe PID 268 wrote to memory of 824 268 a8535070.exe AppLaunch.exe PID 268 wrote to memory of 824 268 a8535070.exe AppLaunch.exe PID 268 wrote to memory of 824 268 a8535070.exe AppLaunch.exe PID 268 wrote to memory of 824 268 a8535070.exe AppLaunch.exe PID 268 wrote to memory of 824 268 a8535070.exe AppLaunch.exe PID 268 wrote to memory of 824 268 a8535070.exe AppLaunch.exe PID 1416 wrote to memory of 1524 1416 v7463971.exe b7653130.exe PID 1416 wrote to memory of 1524 1416 v7463971.exe b7653130.exe PID 1416 wrote to memory of 1524 1416 v7463971.exe b7653130.exe PID 1416 wrote to memory of 1524 1416 v7463971.exe b7653130.exe PID 1416 wrote to memory of 1524 1416 v7463971.exe b7653130.exe PID 1416 wrote to memory of 1524 1416 v7463971.exe b7653130.exe PID 1416 wrote to memory of 1524 1416 v7463971.exe b7653130.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2ef6152c28d194375f2a5398ff7f2f9141b854a4e71f5e27ed7793bccb705a7.exe"C:\Users\Admin\AppData\Local\Temp\b2ef6152c28d194375f2a5398ff7f2f9141b854a4e71f5e27ed7793bccb705a7.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8995080.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8995080.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7463971.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7463971.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a8535070.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a8535070.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"5⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7653130.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7653130.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8995080.exeFilesize
452KB
MD5557a60be95133a91e0bdc02ad33cd15c
SHA1169f466aed9078abe92c2e8820d5ae8f9089f640
SHA256d025eb3afd2eb6a7355ad9648f66813db51b408f827291e5faa2ac7746396729
SHA5129ad1fa39d205d7660674254d0ebf1b71ecb7c9522ac6ab69af5e981a186b7672595f180e519ba81684e08fdd864f24b590f7f96ba7701e49f8e695d5d0eec4f4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8995080.exeFilesize
452KB
MD5557a60be95133a91e0bdc02ad33cd15c
SHA1169f466aed9078abe92c2e8820d5ae8f9089f640
SHA256d025eb3afd2eb6a7355ad9648f66813db51b408f827291e5faa2ac7746396729
SHA5129ad1fa39d205d7660674254d0ebf1b71ecb7c9522ac6ab69af5e981a186b7672595f180e519ba81684e08fdd864f24b590f7f96ba7701e49f8e695d5d0eec4f4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7463971.exeFilesize
280KB
MD5616253e82cabd73a9253b155485163dc
SHA147146c9a9ef55101d119686bf2cd4ca7f7b04476
SHA25698d950f56029fc38a2b9d4c45cda9667e59b7b0573931b434251065b875a67c4
SHA512f837d064ad2d696a0715f25234d3ef751b71974f1fc579674142e7b44d0eb5caec64d620313707a5b01182edd72562ff4913eddbd8455e224f596302ec0a211e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7463971.exeFilesize
280KB
MD5616253e82cabd73a9253b155485163dc
SHA147146c9a9ef55101d119686bf2cd4ca7f7b04476
SHA25698d950f56029fc38a2b9d4c45cda9667e59b7b0573931b434251065b875a67c4
SHA512f837d064ad2d696a0715f25234d3ef751b71974f1fc579674142e7b44d0eb5caec64d620313707a5b01182edd72562ff4913eddbd8455e224f596302ec0a211e
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a8535070.exeFilesize
157KB
MD5873ad19fe63250adfa598de0243101c8
SHA13ae506442628c120e447304a23c5a9441acd0396
SHA256c7ce5bb7a131507ea5b5ec49b20cf24b6b6c581739eca6ac2df419cac6a4ec85
SHA5120b88da3140687280785742cd1c43fce803fe2e01f76cb94be8c99240e1a3718f8fd5c176c464509ed0a115c2c70d800785a057c350c9c441dbf05c5e34366b79
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a8535070.exeFilesize
157KB
MD5873ad19fe63250adfa598de0243101c8
SHA13ae506442628c120e447304a23c5a9441acd0396
SHA256c7ce5bb7a131507ea5b5ec49b20cf24b6b6c581739eca6ac2df419cac6a4ec85
SHA5120b88da3140687280785742cd1c43fce803fe2e01f76cb94be8c99240e1a3718f8fd5c176c464509ed0a115c2c70d800785a057c350c9c441dbf05c5e34366b79
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7653130.exeFilesize
168KB
MD5c68831e38ce6abe3e479cf8ac4f3ee78
SHA14d09ff623bdd29672a2e1d3c8cf60e86d242e6d2
SHA256a2e46d63973cc8aedb3277df7c1e991a460c0ac83f3f5d9e47529f7ed177fb4c
SHA512ca7c93cb143397c9e392a9d8a7e304b490b064e8a1aeafda70e79169f4bfd8cbbd2b214ed19ad97947d3801ebb34c9990f3639a4d37b140b8f8cfc012288d5db
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7653130.exeFilesize
168KB
MD5c68831e38ce6abe3e479cf8ac4f3ee78
SHA14d09ff623bdd29672a2e1d3c8cf60e86d242e6d2
SHA256a2e46d63973cc8aedb3277df7c1e991a460c0ac83f3f5d9e47529f7ed177fb4c
SHA512ca7c93cb143397c9e392a9d8a7e304b490b064e8a1aeafda70e79169f4bfd8cbbd2b214ed19ad97947d3801ebb34c9990f3639a4d37b140b8f8cfc012288d5db
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8995080.exeFilesize
452KB
MD5557a60be95133a91e0bdc02ad33cd15c
SHA1169f466aed9078abe92c2e8820d5ae8f9089f640
SHA256d025eb3afd2eb6a7355ad9648f66813db51b408f827291e5faa2ac7746396729
SHA5129ad1fa39d205d7660674254d0ebf1b71ecb7c9522ac6ab69af5e981a186b7672595f180e519ba81684e08fdd864f24b590f7f96ba7701e49f8e695d5d0eec4f4
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8995080.exeFilesize
452KB
MD5557a60be95133a91e0bdc02ad33cd15c
SHA1169f466aed9078abe92c2e8820d5ae8f9089f640
SHA256d025eb3afd2eb6a7355ad9648f66813db51b408f827291e5faa2ac7746396729
SHA5129ad1fa39d205d7660674254d0ebf1b71ecb7c9522ac6ab69af5e981a186b7672595f180e519ba81684e08fdd864f24b590f7f96ba7701e49f8e695d5d0eec4f4
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7463971.exeFilesize
280KB
MD5616253e82cabd73a9253b155485163dc
SHA147146c9a9ef55101d119686bf2cd4ca7f7b04476
SHA25698d950f56029fc38a2b9d4c45cda9667e59b7b0573931b434251065b875a67c4
SHA512f837d064ad2d696a0715f25234d3ef751b71974f1fc579674142e7b44d0eb5caec64d620313707a5b01182edd72562ff4913eddbd8455e224f596302ec0a211e
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7463971.exeFilesize
280KB
MD5616253e82cabd73a9253b155485163dc
SHA147146c9a9ef55101d119686bf2cd4ca7f7b04476
SHA25698d950f56029fc38a2b9d4c45cda9667e59b7b0573931b434251065b875a67c4
SHA512f837d064ad2d696a0715f25234d3ef751b71974f1fc579674142e7b44d0eb5caec64d620313707a5b01182edd72562ff4913eddbd8455e224f596302ec0a211e
-
\Users\Admin\AppData\Local\Temp\IXP002.TMP\a8535070.exeFilesize
157KB
MD5873ad19fe63250adfa598de0243101c8
SHA13ae506442628c120e447304a23c5a9441acd0396
SHA256c7ce5bb7a131507ea5b5ec49b20cf24b6b6c581739eca6ac2df419cac6a4ec85
SHA5120b88da3140687280785742cd1c43fce803fe2e01f76cb94be8c99240e1a3718f8fd5c176c464509ed0a115c2c70d800785a057c350c9c441dbf05c5e34366b79
-
\Users\Admin\AppData\Local\Temp\IXP002.TMP\a8535070.exeFilesize
157KB
MD5873ad19fe63250adfa598de0243101c8
SHA13ae506442628c120e447304a23c5a9441acd0396
SHA256c7ce5bb7a131507ea5b5ec49b20cf24b6b6c581739eca6ac2df419cac6a4ec85
SHA5120b88da3140687280785742cd1c43fce803fe2e01f76cb94be8c99240e1a3718f8fd5c176c464509ed0a115c2c70d800785a057c350c9c441dbf05c5e34366b79
-
\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7653130.exeFilesize
168KB
MD5c68831e38ce6abe3e479cf8ac4f3ee78
SHA14d09ff623bdd29672a2e1d3c8cf60e86d242e6d2
SHA256a2e46d63973cc8aedb3277df7c1e991a460c0ac83f3f5d9e47529f7ed177fb4c
SHA512ca7c93cb143397c9e392a9d8a7e304b490b064e8a1aeafda70e79169f4bfd8cbbd2b214ed19ad97947d3801ebb34c9990f3639a4d37b140b8f8cfc012288d5db
-
\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7653130.exeFilesize
168KB
MD5c68831e38ce6abe3e479cf8ac4f3ee78
SHA14d09ff623bdd29672a2e1d3c8cf60e86d242e6d2
SHA256a2e46d63973cc8aedb3277df7c1e991a460c0ac83f3f5d9e47529f7ed177fb4c
SHA512ca7c93cb143397c9e392a9d8a7e304b490b064e8a1aeafda70e79169f4bfd8cbbd2b214ed19ad97947d3801ebb34c9990f3639a4d37b140b8f8cfc012288d5db
-
memory/824-91-0x0000000000090000-0x000000000009A000-memory.dmpFilesize
40KB
-
memory/824-89-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/824-92-0x0000000000090000-0x000000000009A000-memory.dmpFilesize
40KB
-
memory/824-85-0x0000000000090000-0x000000000009A000-memory.dmpFilesize
40KB
-
memory/824-84-0x0000000000090000-0x000000000009A000-memory.dmpFilesize
40KB
-
memory/1524-99-0x0000000000C00000-0x0000000000C2E000-memory.dmpFilesize
184KB
-
memory/1524-100-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/1524-101-0x00000000004A0000-0x00000000004E0000-memory.dmpFilesize
256KB
-
memory/1524-102-0x00000000004A0000-0x00000000004E0000-memory.dmpFilesize
256KB