Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05-06-2023 17:36
Static task
static1
Behavioral task
behavioral1
Sample
554d25724c8f6f53af8721d0ef6b6f42.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
554d25724c8f6f53af8721d0ef6b6f42.exe
Resource
win10v2004-20230220-en
General
-
Target
554d25724c8f6f53af8721d0ef6b6f42.exe
-
Size
736KB
-
MD5
554d25724c8f6f53af8721d0ef6b6f42
-
SHA1
12aa02a42690740e106790852709edd8648177ac
-
SHA256
e43fff23b2fff04d4a335ab5ff3cf69ba90bcc0dbe35901cf1c1e020614a0f07
-
SHA512
b3edc933a34230613dafc3edf1d3e6e6adc73a55fcad4b4e80d903aec6bd87052df69c7752a39618385508006625b4d828bf25eaecc15bec4966e9320a39bff0
-
SSDEEP
12288:HMriy90oEzXGK/FxXki8Y52n1bW2sIPNhO1d8lvUeVaPXDBXi9V0Hh9PHL39n+rZ:xyLQWK/FxuY5kIAwBeV+XlXtHhJrt+rZ
Malware Config
Extracted
redline
maxi
83.97.73.126:19048
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Signatures
-
Processes:
a6692923.exeAppLaunch.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a6692923.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection a6692923.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a6692923.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a6692923.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a6692923.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a6692923.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 6 IoCs
Processes:
v4282178.exev8350329.exev5476116.exea6692923.exeb8416695.exec1073509.exepid process 4972 v4282178.exe 4852 v8350329.exe 1376 v5476116.exe 2416 a6692923.exe 4324 b8416695.exe 4968 c1073509.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
a6692923.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a6692923.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
554d25724c8f6f53af8721d0ef6b6f42.exev4282178.exev8350329.exev5476116.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 554d25724c8f6f53af8721d0ef6b6f42.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v4282178.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v4282178.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v8350329.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v8350329.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v5476116.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" v5476116.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 554d25724c8f6f53af8721d0ef6b6f42.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
b8416695.exedescription pid process target process PID 4324 set thread context of 212 4324 b8416695.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1784 4324 WerFault.exe b8416695.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
a6692923.exeAppLaunch.exec1073509.exepid process 2416 a6692923.exe 2416 a6692923.exe 212 AppLaunch.exe 212 AppLaunch.exe 4968 c1073509.exe 4968 c1073509.exe 4968 c1073509.exe 4968 c1073509.exe 4968 c1073509.exe 4968 c1073509.exe 4968 c1073509.exe 4968 c1073509.exe 4968 c1073509.exe 4968 c1073509.exe 4968 c1073509.exe 4968 c1073509.exe 4968 c1073509.exe 4968 c1073509.exe 4968 c1073509.exe 4968 c1073509.exe 4968 c1073509.exe 4968 c1073509.exe 4968 c1073509.exe 4968 c1073509.exe 4968 c1073509.exe 4968 c1073509.exe 4968 c1073509.exe 4968 c1073509.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
a6692923.exeAppLaunch.exec1073509.exedescription pid process Token: SeDebugPrivilege 2416 a6692923.exe Token: SeDebugPrivilege 212 AppLaunch.exe Token: SeDebugPrivilege 4968 c1073509.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
554d25724c8f6f53af8721d0ef6b6f42.exev4282178.exev8350329.exev5476116.exeb8416695.exedescription pid process target process PID 4088 wrote to memory of 4972 4088 554d25724c8f6f53af8721d0ef6b6f42.exe v4282178.exe PID 4088 wrote to memory of 4972 4088 554d25724c8f6f53af8721d0ef6b6f42.exe v4282178.exe PID 4088 wrote to memory of 4972 4088 554d25724c8f6f53af8721d0ef6b6f42.exe v4282178.exe PID 4972 wrote to memory of 4852 4972 v4282178.exe v8350329.exe PID 4972 wrote to memory of 4852 4972 v4282178.exe v8350329.exe PID 4972 wrote to memory of 4852 4972 v4282178.exe v8350329.exe PID 4852 wrote to memory of 1376 4852 v8350329.exe v5476116.exe PID 4852 wrote to memory of 1376 4852 v8350329.exe v5476116.exe PID 4852 wrote to memory of 1376 4852 v8350329.exe v5476116.exe PID 1376 wrote to memory of 2416 1376 v5476116.exe a6692923.exe PID 1376 wrote to memory of 2416 1376 v5476116.exe a6692923.exe PID 1376 wrote to memory of 4324 1376 v5476116.exe b8416695.exe PID 1376 wrote to memory of 4324 1376 v5476116.exe b8416695.exe PID 1376 wrote to memory of 4324 1376 v5476116.exe b8416695.exe PID 4324 wrote to memory of 212 4324 b8416695.exe AppLaunch.exe PID 4324 wrote to memory of 212 4324 b8416695.exe AppLaunch.exe PID 4324 wrote to memory of 212 4324 b8416695.exe AppLaunch.exe PID 4324 wrote to memory of 212 4324 b8416695.exe AppLaunch.exe PID 4324 wrote to memory of 212 4324 b8416695.exe AppLaunch.exe PID 4852 wrote to memory of 4968 4852 v8350329.exe c1073509.exe PID 4852 wrote to memory of 4968 4852 v8350329.exe c1073509.exe PID 4852 wrote to memory of 4968 4852 v8350329.exe c1073509.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\554d25724c8f6f53af8721d0ef6b6f42.exe"C:\Users\Admin\AppData\Local\Temp\554d25724c8f6f53af8721d0ef6b6f42.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4282178.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4282178.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8350329.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8350329.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5476116.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5476116.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6692923.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6692923.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b8416695.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b8416695.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 1406⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c1073509.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c1073509.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4324 -ip 43241⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4282178.exeFilesize
530KB
MD574c8878c784193821fde72cdb708b9e5
SHA1e9fc68444cc64464845fb86b78bd27cf2d58bea0
SHA256e7ce2b0f8b8b468c645c5ec18db067302f716364e92f58aad0b7a3ccafb9ab8d
SHA5121d4c4c033457861943e9f9b5c53716fa4df852894b5480fe5df7ac4e6701d6445b5308e494a204fb55e2641f36f2cd208946209f40706fdee5a80a9af40be76b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4282178.exeFilesize
530KB
MD574c8878c784193821fde72cdb708b9e5
SHA1e9fc68444cc64464845fb86b78bd27cf2d58bea0
SHA256e7ce2b0f8b8b468c645c5ec18db067302f716364e92f58aad0b7a3ccafb9ab8d
SHA5121d4c4c033457861943e9f9b5c53716fa4df852894b5480fe5df7ac4e6701d6445b5308e494a204fb55e2641f36f2cd208946209f40706fdee5a80a9af40be76b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8350329.exeFilesize
357KB
MD54a07d3b59f93c28437247216a494c0c2
SHA1ec2ef25efc1f74689e80480141053ac7a91f0352
SHA2565f6cc1acf6ec51f9a9fd13a1bc5ae19a5f473c1a2780416abb113c96c350212e
SHA5122e09dab24c8356b858bdddaf3416351aee77d850f5b9222e04fc5abbced490d396edd1e02c5fac71d318a5d94b88f18509da610691c55d4300ac0efab57c36dc
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8350329.exeFilesize
357KB
MD54a07d3b59f93c28437247216a494c0c2
SHA1ec2ef25efc1f74689e80480141053ac7a91f0352
SHA2565f6cc1acf6ec51f9a9fd13a1bc5ae19a5f473c1a2780416abb113c96c350212e
SHA5122e09dab24c8356b858bdddaf3416351aee77d850f5b9222e04fc5abbced490d396edd1e02c5fac71d318a5d94b88f18509da610691c55d4300ac0efab57c36dc
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c1073509.exeFilesize
172KB
MD5f17b925b89873e7378d7044d135f23e2
SHA1a382efba677549ccd2e1019639a072a3ad58da26
SHA2566fdd5e1f4426925be384b71188e67e5e8305143418321b6ce6389809d5a7690e
SHA512fee1bdc466b2e124bdd7c41aa0e057e373945f4b57223e157dc338df638ebfbc23cb702fd986d96487b1db0950966f7574d020c123bd516b5dce73bda9a1aaf8
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c1073509.exeFilesize
172KB
MD5f17b925b89873e7378d7044d135f23e2
SHA1a382efba677549ccd2e1019639a072a3ad58da26
SHA2566fdd5e1f4426925be384b71188e67e5e8305143418321b6ce6389809d5a7690e
SHA512fee1bdc466b2e124bdd7c41aa0e057e373945f4b57223e157dc338df638ebfbc23cb702fd986d96487b1db0950966f7574d020c123bd516b5dce73bda9a1aaf8
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5476116.exeFilesize
202KB
MD5b6de18a33a5bc0ac35f1a39e7490c08d
SHA1c33bfa9a357bc475a29f92a849f82b43fe4ffc76
SHA2564e4146f2cc0f240ea42bac1bd223893662010ebc02a314f0471f980b9a69623b
SHA51286a0fb90c03e413f4c04bddd16b835d105c548dd4f86e42c199f66c63cd7fc7def2bd0ec9fd493b2352681771d9877231b3274aee0f89b02937b4f2010dc5290
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5476116.exeFilesize
202KB
MD5b6de18a33a5bc0ac35f1a39e7490c08d
SHA1c33bfa9a357bc475a29f92a849f82b43fe4ffc76
SHA2564e4146f2cc0f240ea42bac1bd223893662010ebc02a314f0471f980b9a69623b
SHA51286a0fb90c03e413f4c04bddd16b835d105c548dd4f86e42c199f66c63cd7fc7def2bd0ec9fd493b2352681771d9877231b3274aee0f89b02937b4f2010dc5290
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6692923.exeFilesize
12KB
MD5f85901fcc83414178c8a881836b4b2c5
SHA1f0fb83bc0001f02bb667eadcd304d94256c185dd
SHA256aa711fb69f762623c2f61665c13a2e430d89bc81e418385b89da18e34073121c
SHA512650a42f98f4439662df4bc0a4d04eab932e16914087d7af64c00bd40529178086cadf47469f8522d8250e432495f1856948ed739c46999e5fe05dd217d28e489
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6692923.exeFilesize
12KB
MD5f85901fcc83414178c8a881836b4b2c5
SHA1f0fb83bc0001f02bb667eadcd304d94256c185dd
SHA256aa711fb69f762623c2f61665c13a2e430d89bc81e418385b89da18e34073121c
SHA512650a42f98f4439662df4bc0a4d04eab932e16914087d7af64c00bd40529178086cadf47469f8522d8250e432495f1856948ed739c46999e5fe05dd217d28e489
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b8416695.exeFilesize
117KB
MD599c79b4865f41834bf153c3eb2007bb1
SHA1bec27466b5257cf4adfebed9b3e2ef99c23b7aeb
SHA25613d22c4aa1fb26ddbc1d57209e9c7a40fe3e5df472b0239d5fbd66829066293c
SHA512f0cd6b29fc00ffcf6b2152264f717c47861554c2cd6638654ce35617191d3035309b9b3d2182b55ec01f25afa8e914a34fc85846de5cb4c03ae04f5edee4b635
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b8416695.exeFilesize
117KB
MD599c79b4865f41834bf153c3eb2007bb1
SHA1bec27466b5257cf4adfebed9b3e2ef99c23b7aeb
SHA25613d22c4aa1fb26ddbc1d57209e9c7a40fe3e5df472b0239d5fbd66829066293c
SHA512f0cd6b29fc00ffcf6b2152264f717c47861554c2cd6638654ce35617191d3035309b9b3d2182b55ec01f25afa8e914a34fc85846de5cb4c03ae04f5edee4b635
-
memory/212-167-0x0000000000300000-0x000000000030A000-memory.dmpFilesize
40KB
-
memory/2416-161-0x0000000000E40000-0x0000000000E4A000-memory.dmpFilesize
40KB
-
memory/4968-175-0x00000000007F0000-0x0000000000820000-memory.dmpFilesize
192KB
-
memory/4968-176-0x0000000005860000-0x0000000005E78000-memory.dmpFilesize
6.1MB
-
memory/4968-177-0x0000000005350000-0x000000000545A000-memory.dmpFilesize
1.0MB
-
memory/4968-178-0x0000000005290000-0x00000000052A2000-memory.dmpFilesize
72KB
-
memory/4968-179-0x00000000052F0000-0x000000000532C000-memory.dmpFilesize
240KB
-
memory/4968-180-0x0000000005030000-0x0000000005040000-memory.dmpFilesize
64KB
-
memory/4968-181-0x0000000005600000-0x0000000005676000-memory.dmpFilesize
472KB
-
memory/4968-182-0x0000000005720000-0x00000000057B2000-memory.dmpFilesize
584KB
-
memory/4968-183-0x0000000006820000-0x0000000006DC4000-memory.dmpFilesize
5.6MB
-
memory/4968-184-0x00000000057C0000-0x0000000005826000-memory.dmpFilesize
408KB
-
memory/4968-185-0x0000000006370000-0x00000000063C0000-memory.dmpFilesize
320KB
-
memory/4968-187-0x0000000006DD0000-0x0000000006F92000-memory.dmpFilesize
1.8MB
-
memory/4968-188-0x00000000089F0000-0x0000000008F1C000-memory.dmpFilesize
5.2MB
-
memory/4968-189-0x0000000005030000-0x0000000005040000-memory.dmpFilesize
64KB