Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05-06-2023 13:14
Static task
static1
Behavioral task
behavioral1
Sample
c260c59382ec917b9c319749cb900eafbdff592b14e473f181b82fd29b5db9ad.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
c260c59382ec917b9c319749cb900eafbdff592b14e473f181b82fd29b5db9ad.exe
Resource
win10v2004-20230220-en
General
-
Target
c260c59382ec917b9c319749cb900eafbdff592b14e473f181b82fd29b5db9ad.exe
-
Size
786KB
-
MD5
ffd7656707c92c1f0500fcd0661e9628
-
SHA1
05cf2514396955e91545ba8939a46290b108202a
-
SHA256
c260c59382ec917b9c319749cb900eafbdff592b14e473f181b82fd29b5db9ad
-
SHA512
41503d126a2f7cc02a8dd33c6579ed8617afd1c3e1d299211451e80d1e5a4fab736250870645d391ef0187d40bfc1632a74ab1022a3fe258f15c112ae453995d
-
SSDEEP
24576:kyb3HOzuT8hc5gVWarFqlan32T/1wvbW+:zbcu4WFoJnmT/1wC
Malware Config
Extracted
redline
maxi
83.97.73.126:19046
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Signatures
-
Processes:
AppLaunch.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
Processes:
v3884490.exev3583531.exea9712800.exeb4250856.exepid process 3872 v3884490.exe 1440 v3583531.exe 1316 a9712800.exe 4912 b4250856.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
v3884490.exev3583531.exec260c59382ec917b9c319749cb900eafbdff592b14e473f181b82fd29b5db9ad.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v3884490.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v3884490.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v3583531.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v3583531.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce c260c59382ec917b9c319749cb900eafbdff592b14e473f181b82fd29b5db9ad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c260c59382ec917b9c319749cb900eafbdff592b14e473f181b82fd29b5db9ad.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a9712800.exedescription pid process target process PID 1316 set thread context of 1676 1316 a9712800.exe AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 1676 AppLaunch.exe 1676 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 1676 AppLaunch.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
c260c59382ec917b9c319749cb900eafbdff592b14e473f181b82fd29b5db9ad.exev3884490.exev3583531.exea9712800.exedescription pid process target process PID 224 wrote to memory of 3872 224 c260c59382ec917b9c319749cb900eafbdff592b14e473f181b82fd29b5db9ad.exe v3884490.exe PID 224 wrote to memory of 3872 224 c260c59382ec917b9c319749cb900eafbdff592b14e473f181b82fd29b5db9ad.exe v3884490.exe PID 224 wrote to memory of 3872 224 c260c59382ec917b9c319749cb900eafbdff592b14e473f181b82fd29b5db9ad.exe v3884490.exe PID 3872 wrote to memory of 1440 3872 v3884490.exe v3583531.exe PID 3872 wrote to memory of 1440 3872 v3884490.exe v3583531.exe PID 3872 wrote to memory of 1440 3872 v3884490.exe v3583531.exe PID 1440 wrote to memory of 1316 1440 v3583531.exe a9712800.exe PID 1440 wrote to memory of 1316 1440 v3583531.exe a9712800.exe PID 1440 wrote to memory of 1316 1440 v3583531.exe a9712800.exe PID 1316 wrote to memory of 1676 1316 a9712800.exe AppLaunch.exe PID 1316 wrote to memory of 1676 1316 a9712800.exe AppLaunch.exe PID 1316 wrote to memory of 1676 1316 a9712800.exe AppLaunch.exe PID 1316 wrote to memory of 1676 1316 a9712800.exe AppLaunch.exe PID 1316 wrote to memory of 1676 1316 a9712800.exe AppLaunch.exe PID 1440 wrote to memory of 4912 1440 v3583531.exe b4250856.exe PID 1440 wrote to memory of 4912 1440 v3583531.exe b4250856.exe PID 1440 wrote to memory of 4912 1440 v3583531.exe b4250856.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c260c59382ec917b9c319749cb900eafbdff592b14e473f181b82fd29b5db9ad.exe"C:\Users\Admin\AppData\Local\Temp\c260c59382ec917b9c319749cb900eafbdff592b14e473f181b82fd29b5db9ad.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3884490.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3884490.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3583531.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3583531.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9712800.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9712800.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"5⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b4250856.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b4250856.exe4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3884490.exeFilesize
452KB
MD54454ea0083a79cfd3ddd198a1f02bb5a
SHA162b9441b0e8ff62870e7b0c6de192f828b6fa96c
SHA25668168e875d59db8e1b215ccd9a86e2ffd71614e0dc4765f294c445ca187c3a34
SHA512f8eb271db9d1140ba22ef0358a9b701a8102aa100bd5f739acb73183620c57da82447eb19bdf6606329b9f4a0fb3c867ad864ea1c71d8c2e161b112b6529328d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3884490.exeFilesize
452KB
MD54454ea0083a79cfd3ddd198a1f02bb5a
SHA162b9441b0e8ff62870e7b0c6de192f828b6fa96c
SHA25668168e875d59db8e1b215ccd9a86e2ffd71614e0dc4765f294c445ca187c3a34
SHA512f8eb271db9d1140ba22ef0358a9b701a8102aa100bd5f739acb73183620c57da82447eb19bdf6606329b9f4a0fb3c867ad864ea1c71d8c2e161b112b6529328d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3583531.exeFilesize
280KB
MD50f8942a68f5de55889220e1f7f751151
SHA16bc9d0e5547483958e8ed7b6d486924c2d276a4c
SHA256e8c5d1a33108f461eded5e2b0277932b1cba1a2c706e09946a6fb8125596a438
SHA5125a452e2c04c5bc03c370a242f16c5955d2ba2c622bcc0f07dea94f573bd742bbb75052b7b88933dc66813466c7ef57ef3862745c6748f5767ac67fa759ccb5cc
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3583531.exeFilesize
280KB
MD50f8942a68f5de55889220e1f7f751151
SHA16bc9d0e5547483958e8ed7b6d486924c2d276a4c
SHA256e8c5d1a33108f461eded5e2b0277932b1cba1a2c706e09946a6fb8125596a438
SHA5125a452e2c04c5bc03c370a242f16c5955d2ba2c622bcc0f07dea94f573bd742bbb75052b7b88933dc66813466c7ef57ef3862745c6748f5767ac67fa759ccb5cc
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9712800.exeFilesize
157KB
MD5c1071a0a3f987a5de3522605a20213b5
SHA1641287d1db5998d1db116414a1bb97d550224246
SHA2569566bf7e2fa08042afa0e29f03a24f99713639bf9939180d38e1632fe63170eb
SHA512a31c7fcc4b364366d54e0bca18edde25eb82a387e0936731ae8d45312a95cc6752e80c1d21a0346e229039ba06cecd7efe690afacffe09960c557b21af9057f8
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9712800.exeFilesize
157KB
MD5c1071a0a3f987a5de3522605a20213b5
SHA1641287d1db5998d1db116414a1bb97d550224246
SHA2569566bf7e2fa08042afa0e29f03a24f99713639bf9939180d38e1632fe63170eb
SHA512a31c7fcc4b364366d54e0bca18edde25eb82a387e0936731ae8d45312a95cc6752e80c1d21a0346e229039ba06cecd7efe690afacffe09960c557b21af9057f8
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b4250856.exeFilesize
168KB
MD528574ddfdfd90307cba658cc45a3df27
SHA10d287b5cb8ee5404dbc93544eee56b5b2aa2f9a2
SHA25665deb77712ab9818f704f60c24aadaa7db9a76773307eb64882140e81fdaae98
SHA51235d0b9cbb9aa99ac5a7bd7cbef0fff7708f974a4e6db0c6afc7fbdd195dee126a63134e13f4d5b94af0d88f16c8f84bbe5c0a05c4bd31317a71ef9c07f98883d
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b4250856.exeFilesize
168KB
MD528574ddfdfd90307cba658cc45a3df27
SHA10d287b5cb8ee5404dbc93544eee56b5b2aa2f9a2
SHA25665deb77712ab9818f704f60c24aadaa7db9a76773307eb64882140e81fdaae98
SHA51235d0b9cbb9aa99ac5a7bd7cbef0fff7708f974a4e6db0c6afc7fbdd195dee126a63134e13f4d5b94af0d88f16c8f84bbe5c0a05c4bd31317a71ef9c07f98883d
-
memory/1676-154-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/4912-162-0x0000000000D70000-0x0000000000D9E000-memory.dmpFilesize
184KB
-
memory/4912-163-0x000000000B1C0000-0x000000000B7D8000-memory.dmpFilesize
6.1MB
-
memory/4912-164-0x000000000ACF0000-0x000000000ADFA000-memory.dmpFilesize
1.0MB
-
memory/4912-165-0x000000000AC20000-0x000000000AC32000-memory.dmpFilesize
72KB
-
memory/4912-166-0x000000000AC80000-0x000000000ACBC000-memory.dmpFilesize
240KB
-
memory/4912-167-0x0000000005810000-0x0000000005820000-memory.dmpFilesize
64KB
-
memory/4912-169-0x0000000005810000-0x0000000005820000-memory.dmpFilesize
64KB