Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05-06-2023 11:34
Static task
static1
Behavioral task
behavioral1
Sample
f4da76ffebcab21de638b15536ac6385a0d91ac0a95042cff7bc3defd8aed66b.exe
Resource
win10v2004-20230220-en
General
-
Target
f4da76ffebcab21de638b15536ac6385a0d91ac0a95042cff7bc3defd8aed66b.exe
-
Size
729KB
-
MD5
c2c64a4c37bc7924410cccfc059eb36a
-
SHA1
ccca10d0ec6ebf9adec01ca7ebaec2fe78136dd6
-
SHA256
f4da76ffebcab21de638b15536ac6385a0d91ac0a95042cff7bc3defd8aed66b
-
SHA512
529e39258e8e7d87a657ad0a41968a318c1a7cc455558129b12c720fe30ac95130989177085fc16c73f5da0fda7b1b76940596a5e3f117a67c015ff84dd5e4d6
-
SSDEEP
12288:ZMrwy90PA5ZKqUfbSX8A8S4ZhL8AmmOblw+01aaW2i9mr7tUO:5yIZqmbuwHCFYaaW297tUO
Malware Config
Extracted
redline
maxi
83.97.73.126:19046
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Signatures
-
Processes:
AppLaunch.exea6620030.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a6620030.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a6620030.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection a6620030.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a6620030.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a6620030.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a6620030.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 6 IoCs
Processes:
v2651822.exev9201808.exev7342066.exea6620030.exeb3954608.exec1468187.exepid process 3224 v2651822.exe 532 v9201808.exe 1204 v7342066.exe 2116 a6620030.exe 4356 b3954608.exe 1832 c1468187.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
a6620030.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a6620030.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
v7342066.exef4da76ffebcab21de638b15536ac6385a0d91ac0a95042cff7bc3defd8aed66b.exev2651822.exev9201808.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v7342066.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" v7342066.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce f4da76ffebcab21de638b15536ac6385a0d91ac0a95042cff7bc3defd8aed66b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" f4da76ffebcab21de638b15536ac6385a0d91ac0a95042cff7bc3defd8aed66b.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v2651822.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v2651822.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v9201808.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v9201808.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
b3954608.exedescription pid process target process PID 4356 set thread context of 3820 4356 b3954608.exe AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
a6620030.exeAppLaunch.exec1468187.exepid process 2116 a6620030.exe 2116 a6620030.exe 3820 AppLaunch.exe 3820 AppLaunch.exe 1832 c1468187.exe 1832 c1468187.exe 1832 c1468187.exe 1832 c1468187.exe 1832 c1468187.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
a6620030.exeAppLaunch.exec1468187.exedescription pid process Token: SeDebugPrivilege 2116 a6620030.exe Token: SeDebugPrivilege 3820 AppLaunch.exe Token: SeDebugPrivilege 1832 c1468187.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
f4da76ffebcab21de638b15536ac6385a0d91ac0a95042cff7bc3defd8aed66b.exev2651822.exev9201808.exev7342066.exeb3954608.exedescription pid process target process PID 984 wrote to memory of 3224 984 f4da76ffebcab21de638b15536ac6385a0d91ac0a95042cff7bc3defd8aed66b.exe v2651822.exe PID 984 wrote to memory of 3224 984 f4da76ffebcab21de638b15536ac6385a0d91ac0a95042cff7bc3defd8aed66b.exe v2651822.exe PID 984 wrote to memory of 3224 984 f4da76ffebcab21de638b15536ac6385a0d91ac0a95042cff7bc3defd8aed66b.exe v2651822.exe PID 3224 wrote to memory of 532 3224 v2651822.exe v9201808.exe PID 3224 wrote to memory of 532 3224 v2651822.exe v9201808.exe PID 3224 wrote to memory of 532 3224 v2651822.exe v9201808.exe PID 532 wrote to memory of 1204 532 v9201808.exe v7342066.exe PID 532 wrote to memory of 1204 532 v9201808.exe v7342066.exe PID 532 wrote to memory of 1204 532 v9201808.exe v7342066.exe PID 1204 wrote to memory of 2116 1204 v7342066.exe a6620030.exe PID 1204 wrote to memory of 2116 1204 v7342066.exe a6620030.exe PID 1204 wrote to memory of 4356 1204 v7342066.exe b3954608.exe PID 1204 wrote to memory of 4356 1204 v7342066.exe b3954608.exe PID 1204 wrote to memory of 4356 1204 v7342066.exe b3954608.exe PID 4356 wrote to memory of 3820 4356 b3954608.exe AppLaunch.exe PID 4356 wrote to memory of 3820 4356 b3954608.exe AppLaunch.exe PID 4356 wrote to memory of 3820 4356 b3954608.exe AppLaunch.exe PID 4356 wrote to memory of 3820 4356 b3954608.exe AppLaunch.exe PID 4356 wrote to memory of 3820 4356 b3954608.exe AppLaunch.exe PID 532 wrote to memory of 1832 532 v9201808.exe c1468187.exe PID 532 wrote to memory of 1832 532 v9201808.exe c1468187.exe PID 532 wrote to memory of 1832 532 v9201808.exe c1468187.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f4da76ffebcab21de638b15536ac6385a0d91ac0a95042cff7bc3defd8aed66b.exe"C:\Users\Admin\AppData\Local\Temp\f4da76ffebcab21de638b15536ac6385a0d91ac0a95042cff7bc3defd8aed66b.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2651822.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2651822.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9201808.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9201808.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7342066.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7342066.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6620030.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6620030.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3954608.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3954608.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c1468187.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c1468187.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2651822.exeFilesize
526KB
MD53d5574a82cad8523a8c3e6633ac1d2ac
SHA11eb0985aa2dbda9db214056426efdb19acce66d7
SHA2564f425720aabc967e81afb5e6e1c14e50387ecb1908027c5860b82fc76d22aa65
SHA512c4bb635c10ba72a8f4bc125b4b7e1e44d0fe97069701a0074e16494090603e47a4526aad14af76234c028b653e73f59fc658630418e737fca5e19c59490c1785
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2651822.exeFilesize
526KB
MD53d5574a82cad8523a8c3e6633ac1d2ac
SHA11eb0985aa2dbda9db214056426efdb19acce66d7
SHA2564f425720aabc967e81afb5e6e1c14e50387ecb1908027c5860b82fc76d22aa65
SHA512c4bb635c10ba72a8f4bc125b4b7e1e44d0fe97069701a0074e16494090603e47a4526aad14af76234c028b653e73f59fc658630418e737fca5e19c59490c1785
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9201808.exeFilesize
354KB
MD50bde5951f456b099ddf8b1dab968ab28
SHA171fb9a04e0c45a8b6dc3e507ea35f6b37b6ef948
SHA25675b63473625208367ce89c1a052e721a041785b1ab7e295bc6e57306b10d2331
SHA512027463cc49eee2a908b6fdeb72570d275cce0a8f3fdcc9b348381626da4b73e6687de4d55a6b692f57d78b381a403b353843aed61c489723b6153d0b3923f86f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9201808.exeFilesize
354KB
MD50bde5951f456b099ddf8b1dab968ab28
SHA171fb9a04e0c45a8b6dc3e507ea35f6b37b6ef948
SHA25675b63473625208367ce89c1a052e721a041785b1ab7e295bc6e57306b10d2331
SHA512027463cc49eee2a908b6fdeb72570d275cce0a8f3fdcc9b348381626da4b73e6687de4d55a6b692f57d78b381a403b353843aed61c489723b6153d0b3923f86f
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c1468187.exeFilesize
172KB
MD50001e7c760035782754bc24ed50d27b0
SHA15d14a1ef9ed0bb85f6ddca3576b744bc61db49dd
SHA2563e3a27fc77ef26a1f44110bae008ca4c72e0da95254b0cd213e52c64cd1ebc9e
SHA5128b84c25daab703af7a2825f7dad0e9c485cf9424d02613ecf0b692847b601514410818923d52cc678d39edef5b85884d19e09e804af36e66e86eecde96889199
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c1468187.exeFilesize
172KB
MD50001e7c760035782754bc24ed50d27b0
SHA15d14a1ef9ed0bb85f6ddca3576b744bc61db49dd
SHA2563e3a27fc77ef26a1f44110bae008ca4c72e0da95254b0cd213e52c64cd1ebc9e
SHA5128b84c25daab703af7a2825f7dad0e9c485cf9424d02613ecf0b692847b601514410818923d52cc678d39edef5b85884d19e09e804af36e66e86eecde96889199
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7342066.exeFilesize
199KB
MD5c77b5c83b6aee5aaa7f40fbce8889fdc
SHA1e0449d45ef34edb7c734cf05ad67bc42d061ad27
SHA25637d2c58971e73683b2e0afa0608bbef5432596835a857ac71020bcd1dc31afae
SHA512e5c18e50c5c928f100861aee28905a3e082af629b24efd85df04a2cc17cb4553afdf645783a82824f597a3d8cfe9468cc1cdfd01960044d3107a7a06e2b0cb8e
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7342066.exeFilesize
199KB
MD5c77b5c83b6aee5aaa7f40fbce8889fdc
SHA1e0449d45ef34edb7c734cf05ad67bc42d061ad27
SHA25637d2c58971e73683b2e0afa0608bbef5432596835a857ac71020bcd1dc31afae
SHA512e5c18e50c5c928f100861aee28905a3e082af629b24efd85df04a2cc17cb4553afdf645783a82824f597a3d8cfe9468cc1cdfd01960044d3107a7a06e2b0cb8e
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6620030.exeFilesize
12KB
MD569ae814bd0f2f5c008c8c2e086c3e81c
SHA131a5ca19b25094ed72b287f709e75de8e2d984ea
SHA256254045ce880196020992a144f5f638c2b3367e0def65a90b771db13e37135ed8
SHA512d4253e3520c019b25a0bde87f1aa3af6205e1f63182dc89cf767847a7c8131d2382a907bc8da8c531450348ea0535cbd9ac37f89cd37cd61f6462c83f77459e3
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6620030.exeFilesize
12KB
MD569ae814bd0f2f5c008c8c2e086c3e81c
SHA131a5ca19b25094ed72b287f709e75de8e2d984ea
SHA256254045ce880196020992a144f5f638c2b3367e0def65a90b771db13e37135ed8
SHA512d4253e3520c019b25a0bde87f1aa3af6205e1f63182dc89cf767847a7c8131d2382a907bc8da8c531450348ea0535cbd9ac37f89cd37cd61f6462c83f77459e3
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3954608.exeFilesize
106KB
MD5af544166b40a60556ddaef09b0454750
SHA1e764dbaf795614fd6aed6ca652c0bc8b45b9f6a7
SHA256cb87ca5f4e521cf3a21a83e7a9a81cb67eb57f1f93e1bd67528b42725222aad2
SHA512bb09037f7b796127e2df1841d7062b83627226558c806646df1e7239d4fef3567f2c1d548648c4cf257ebf855a4eb8d3b7e565de0e56b92185608754d9ce2618
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3954608.exeFilesize
106KB
MD5af544166b40a60556ddaef09b0454750
SHA1e764dbaf795614fd6aed6ca652c0bc8b45b9f6a7
SHA256cb87ca5f4e521cf3a21a83e7a9a81cb67eb57f1f93e1bd67528b42725222aad2
SHA512bb09037f7b796127e2df1841d7062b83627226558c806646df1e7239d4fef3567f2c1d548648c4cf257ebf855a4eb8d3b7e565de0e56b92185608754d9ce2618
-
memory/1832-174-0x0000000000CD0000-0x0000000000D00000-memory.dmpFilesize
192KB
-
memory/1832-179-0x000000000ABF0000-0x000000000AC2C000-memory.dmpFilesize
240KB
-
memory/1832-188-0x000000000BC20000-0x000000000BC70000-memory.dmpFilesize
320KB
-
memory/1832-175-0x000000000B120000-0x000000000B738000-memory.dmpFilesize
6.1MB
-
memory/1832-176-0x000000000AC50000-0x000000000AD5A000-memory.dmpFilesize
1.0MB
-
memory/1832-177-0x000000000AB90000-0x000000000ABA2000-memory.dmpFilesize
72KB
-
memory/1832-178-0x0000000005670000-0x0000000005680000-memory.dmpFilesize
64KB
-
memory/1832-187-0x000000000C9D0000-0x000000000CEFC000-memory.dmpFilesize
5.2MB
-
memory/1832-181-0x0000000005670000-0x0000000005680000-memory.dmpFilesize
64KB
-
memory/1832-182-0x0000000002CD0000-0x0000000002D46000-memory.dmpFilesize
472KB
-
memory/1832-183-0x000000000B070000-0x000000000B102000-memory.dmpFilesize
584KB
-
memory/1832-184-0x0000000002D50000-0x0000000002DB6000-memory.dmpFilesize
408KB
-
memory/1832-185-0x000000000BEF0000-0x000000000C494000-memory.dmpFilesize
5.6MB
-
memory/1832-186-0x000000000BC70000-0x000000000BE32000-memory.dmpFilesize
1.8MB
-
memory/2116-161-0x0000000000030000-0x000000000003A000-memory.dmpFilesize
40KB
-
memory/3820-166-0x0000000000780000-0x000000000078A000-memory.dmpFilesize
40KB