Analysis
-
max time kernel
56s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
05-06-2023 14:49
Static task
static1
Behavioral task
behavioral1
Sample
d3970f171d76ecca9cf98135d46b3e69ed05d7d58ef0d653c58c0913da421988.exe
Resource
win10-20230220-en
General
-
Target
d3970f171d76ecca9cf98135d46b3e69ed05d7d58ef0d653c58c0913da421988.exe
-
Size
729KB
-
MD5
48eca29d7556a5cc08229cd4fc9ba5d2
-
SHA1
0c14043e4aa1e944a10ee2780b3a8d550af7fbef
-
SHA256
d3970f171d76ecca9cf98135d46b3e69ed05d7d58ef0d653c58c0913da421988
-
SHA512
be364bb23aa3fc5b33d5205f32d36ecc08e3c3039844560cc6f59006acf7a24fb8b795beb034dfcb9706b6d5f6ebb4d662226bcd1bddced45f312d012f3b88ff
-
SSDEEP
12288:qMrKy90rZ4kpvm21J1sBgxunHFeeSD1Eb9lEss6lBEOmiZgekFE5J+84:8yflQRxYIeWyb9dfEDiqekkB4
Malware Config
Extracted
redline
maxi
83.97.73.126:19048
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Signatures
-
Processes:
AppLaunch.exea9519469.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a9519469.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a9519469.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a9519469.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a9519469.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a9519469.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 6 IoCs
Processes:
v1645069.exev3540426.exev2806881.exea9519469.exeb3399551.exec5201134.exepid process 3784 v1645069.exe 4128 v3540426.exe 3568 v2806881.exe 5040 a9519469.exe 4192 b3399551.exe 4016 c5201134.exe -
Processes:
a9519469.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a9519469.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
v1645069.exev3540426.exev2806881.exed3970f171d76ecca9cf98135d46b3e69ed05d7d58ef0d653c58c0913da421988.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v1645069.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v1645069.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v3540426.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v3540426.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v2806881.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" v2806881.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce d3970f171d76ecca9cf98135d46b3e69ed05d7d58ef0d653c58c0913da421988.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" d3970f171d76ecca9cf98135d46b3e69ed05d7d58ef0d653c58c0913da421988.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
b3399551.exedescription pid process target process PID 4192 set thread context of 984 4192 b3399551.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 68 4016 WerFault.exe c5201134.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
a9519469.exeAppLaunch.exepid process 5040 a9519469.exe 5040 a9519469.exe 984 AppLaunch.exe 984 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
a9519469.exeAppLaunch.exedescription pid process Token: SeDebugPrivilege 5040 a9519469.exe Token: SeDebugPrivilege 984 AppLaunch.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
d3970f171d76ecca9cf98135d46b3e69ed05d7d58ef0d653c58c0913da421988.exev1645069.exev3540426.exev2806881.exeb3399551.exedescription pid process target process PID 2928 wrote to memory of 3784 2928 d3970f171d76ecca9cf98135d46b3e69ed05d7d58ef0d653c58c0913da421988.exe v1645069.exe PID 2928 wrote to memory of 3784 2928 d3970f171d76ecca9cf98135d46b3e69ed05d7d58ef0d653c58c0913da421988.exe v1645069.exe PID 2928 wrote to memory of 3784 2928 d3970f171d76ecca9cf98135d46b3e69ed05d7d58ef0d653c58c0913da421988.exe v1645069.exe PID 3784 wrote to memory of 4128 3784 v1645069.exe v3540426.exe PID 3784 wrote to memory of 4128 3784 v1645069.exe v3540426.exe PID 3784 wrote to memory of 4128 3784 v1645069.exe v3540426.exe PID 4128 wrote to memory of 3568 4128 v3540426.exe v2806881.exe PID 4128 wrote to memory of 3568 4128 v3540426.exe v2806881.exe PID 4128 wrote to memory of 3568 4128 v3540426.exe v2806881.exe PID 3568 wrote to memory of 5040 3568 v2806881.exe a9519469.exe PID 3568 wrote to memory of 5040 3568 v2806881.exe a9519469.exe PID 3568 wrote to memory of 4192 3568 v2806881.exe b3399551.exe PID 3568 wrote to memory of 4192 3568 v2806881.exe b3399551.exe PID 3568 wrote to memory of 4192 3568 v2806881.exe b3399551.exe PID 4192 wrote to memory of 984 4192 b3399551.exe AppLaunch.exe PID 4192 wrote to memory of 984 4192 b3399551.exe AppLaunch.exe PID 4192 wrote to memory of 984 4192 b3399551.exe AppLaunch.exe PID 4192 wrote to memory of 984 4192 b3399551.exe AppLaunch.exe PID 4192 wrote to memory of 984 4192 b3399551.exe AppLaunch.exe PID 4128 wrote to memory of 4016 4128 v3540426.exe c5201134.exe PID 4128 wrote to memory of 4016 4128 v3540426.exe c5201134.exe PID 4128 wrote to memory of 4016 4128 v3540426.exe c5201134.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d3970f171d76ecca9cf98135d46b3e69ed05d7d58ef0d653c58c0913da421988.exe"C:\Users\Admin\AppData\Local\Temp\d3970f171d76ecca9cf98135d46b3e69ed05d7d58ef0d653c58c0913da421988.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1645069.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1645069.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3540426.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3540426.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2806881.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2806881.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9519469.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9519469.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3399551.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3399551.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c5201134.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c5201134.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 9485⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1645069.exeFilesize
526KB
MD5c8c036027eb575b963c9c22e240bb77e
SHA18ec4cab28703532df5e7dae164b02e1d40d58d43
SHA2569bb058e2668973fd9a71f783cf8e812acb52eb3f32517015ca5c4ea2cfccfba2
SHA512a4fea2b971da189241dffc22612650544bb388550b98d3d6732236e6fb8c83ed0562dd50d86258be192b9b295719bf7085c5742d147f1b5e7cf5e42ce0850237
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1645069.exeFilesize
526KB
MD5c8c036027eb575b963c9c22e240bb77e
SHA18ec4cab28703532df5e7dae164b02e1d40d58d43
SHA2569bb058e2668973fd9a71f783cf8e812acb52eb3f32517015ca5c4ea2cfccfba2
SHA512a4fea2b971da189241dffc22612650544bb388550b98d3d6732236e6fb8c83ed0562dd50d86258be192b9b295719bf7085c5742d147f1b5e7cf5e42ce0850237
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3540426.exeFilesize
354KB
MD548d4b0a1ab40175f3736ab15fdacb8a5
SHA1898580bbb11e7e6fb39447b0ea565c55a5698853
SHA2565369038872fb5a678e27c5f20446d4fa90de9c27b80e45b954aa6d9828cd9c01
SHA51270d8f972e09d5597a5a45fe9cec05ca2a7becab4d3d83aa7eb9b112b48cdfa5eeab2b219a9f77f717bbfbbd58d144689d7c6f20a60328fb5298b16e5b9592e79
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3540426.exeFilesize
354KB
MD548d4b0a1ab40175f3736ab15fdacb8a5
SHA1898580bbb11e7e6fb39447b0ea565c55a5698853
SHA2565369038872fb5a678e27c5f20446d4fa90de9c27b80e45b954aa6d9828cd9c01
SHA51270d8f972e09d5597a5a45fe9cec05ca2a7becab4d3d83aa7eb9b112b48cdfa5eeab2b219a9f77f717bbfbbd58d144689d7c6f20a60328fb5298b16e5b9592e79
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c5201134.exeFilesize
172KB
MD57c69b60160775d770234f257ff7ea96f
SHA13af0a1cf28089b5b26d4e44c21bac6c9566d3d19
SHA256eceafc9eaea0f2a730a4868106ca5d34d546e16eb36718f04951bf16c5f5d685
SHA512dc1a17bba08b025b169c3a3f107cde195444834ad06fe13c3af0966b43f6df6c157157cb4e89815c679fc836547f413694157b55cc15c309f86fae1197ff5388
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c5201134.exeFilesize
172KB
MD57c69b60160775d770234f257ff7ea96f
SHA13af0a1cf28089b5b26d4e44c21bac6c9566d3d19
SHA256eceafc9eaea0f2a730a4868106ca5d34d546e16eb36718f04951bf16c5f5d685
SHA512dc1a17bba08b025b169c3a3f107cde195444834ad06fe13c3af0966b43f6df6c157157cb4e89815c679fc836547f413694157b55cc15c309f86fae1197ff5388
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2806881.exeFilesize
199KB
MD5d88a240a57f3739a500ff4f28498f491
SHA1806602d7e24e7b886c3bcc8509f360f6c90040e7
SHA25626803eba804332858bc742ad41317b1ddfa1a8c3d4a0d1e38592ca853f1be136
SHA512ce392f422d5e5505297834c1e67c40e1fd955c4454d1930f92de161d003d7b85f399d0b7a49f5547abb0c31f688f3a88dc9ae067f8cacefd3712e829fc5658d7
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2806881.exeFilesize
199KB
MD5d88a240a57f3739a500ff4f28498f491
SHA1806602d7e24e7b886c3bcc8509f360f6c90040e7
SHA25626803eba804332858bc742ad41317b1ddfa1a8c3d4a0d1e38592ca853f1be136
SHA512ce392f422d5e5505297834c1e67c40e1fd955c4454d1930f92de161d003d7b85f399d0b7a49f5547abb0c31f688f3a88dc9ae067f8cacefd3712e829fc5658d7
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9519469.exeFilesize
12KB
MD5d6336bc87b48924191187e04ac34e392
SHA1fd3aeef197332cda61bfc50ec37df50a51593dfa
SHA256e3d29d97b3c8bae7ee296c03773976c248223b62a5a1f9eeeb8a83a0f89c5997
SHA512573d6e69276c69533051d6bcfa9a7c3801b564b0323c73b03deed031ebefcdf5ed67f5af9be137a7fc6c94cb944e9960e62d79236a3bd9701fc5a867e99afa10
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9519469.exeFilesize
12KB
MD5d6336bc87b48924191187e04ac34e392
SHA1fd3aeef197332cda61bfc50ec37df50a51593dfa
SHA256e3d29d97b3c8bae7ee296c03773976c248223b62a5a1f9eeeb8a83a0f89c5997
SHA512573d6e69276c69533051d6bcfa9a7c3801b564b0323c73b03deed031ebefcdf5ed67f5af9be137a7fc6c94cb944e9960e62d79236a3bd9701fc5a867e99afa10
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3399551.exeFilesize
105KB
MD5df49c15f6ef18121bdcf2f7698d76e00
SHA1744d461f98bba8452bf978bfda1d31c3d0c0e000
SHA256c272817aec3bdcf4e8a62872d22b6f850e29823e3044e921b6609da3353d5714
SHA5123dccc43e279613b08071c483e5683b851fcae5f742863967f8a2844c5d1f0f0bbfb51020debaeb6f9251a527aa8f1f0c5fd63f5b70d8556ab5a71df013978011
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3399551.exeFilesize
105KB
MD5df49c15f6ef18121bdcf2f7698d76e00
SHA1744d461f98bba8452bf978bfda1d31c3d0c0e000
SHA256c272817aec3bdcf4e8a62872d22b6f850e29823e3044e921b6609da3353d5714
SHA5123dccc43e279613b08071c483e5683b851fcae5f742863967f8a2844c5d1f0f0bbfb51020debaeb6f9251a527aa8f1f0c5fd63f5b70d8556ab5a71df013978011
-
memory/984-154-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/4016-165-0x0000000000FC0000-0x0000000000FF0000-memory.dmpFilesize
192KB
-
memory/5040-149-0x00000000009F0000-0x00000000009FA000-memory.dmpFilesize
40KB