Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05-06-2023 17:41
Static task
static1
Behavioral task
behavioral1
Sample
4ec286e74acba9ce0a7a415ceadee38a00a60cf30598b030bddc4df2239443a9.exe
Resource
win10v2004-20230220-en
General
-
Target
4ec286e74acba9ce0a7a415ceadee38a00a60cf30598b030bddc4df2239443a9.exe
-
Size
735KB
-
MD5
9b6cf7d31209584d8156bdab9864f4a5
-
SHA1
d3d7e6525ca965bb3a0bc9453512d0e38a1a94bd
-
SHA256
4ec286e74acba9ce0a7a415ceadee38a00a60cf30598b030bddc4df2239443a9
-
SHA512
5e8c392b25bc616541795e7365a09c4618c6feca6d5dd1b9d634cd930fb9b705e1447fc9bcd43968e8588bb49ed876ee57bf30b995282d7600a56436071a0097
-
SSDEEP
12288:VMrCy90GnRejmDeYvzA09IyIfBQozZN+vtSqe2LpthW:vyQjO/vqyB0N+voq5V3W
Malware Config
Extracted
redline
maxi
83.97.73.126:19048
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Signatures
-
Processes:
a6322769.exeAppLaunch.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a6322769.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a6322769.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection a6322769.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a6322769.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a6322769.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a6322769.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 6 IoCs
Processes:
v0051612.exev5813734.exev7539679.exea6322769.exeb5062989.exec5192922.exepid process 4796 v0051612.exe 5084 v5813734.exe 2272 v7539679.exe 4992 a6322769.exe 1620 b5062989.exe 4480 c5192922.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
a6322769.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a6322769.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
v0051612.exev5813734.exev7539679.exe4ec286e74acba9ce0a7a415ceadee38a00a60cf30598b030bddc4df2239443a9.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v0051612.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v5813734.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v5813734.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v7539679.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" v7539679.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 4ec286e74acba9ce0a7a415ceadee38a00a60cf30598b030bddc4df2239443a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 4ec286e74acba9ce0a7a415ceadee38a00a60cf30598b030bddc4df2239443a9.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v0051612.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
b5062989.exedescription pid process target process PID 1620 set thread context of 3932 1620 b5062989.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4012 1620 WerFault.exe b5062989.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
a6322769.exeAppLaunch.exec5192922.exepid process 4992 a6322769.exe 4992 a6322769.exe 3932 AppLaunch.exe 3932 AppLaunch.exe 4480 c5192922.exe 4480 c5192922.exe 4480 c5192922.exe 4480 c5192922.exe 4480 c5192922.exe 4480 c5192922.exe 4480 c5192922.exe 4480 c5192922.exe 4480 c5192922.exe 4480 c5192922.exe 4480 c5192922.exe 4480 c5192922.exe 4480 c5192922.exe 4480 c5192922.exe 4480 c5192922.exe 4480 c5192922.exe 4480 c5192922.exe 4480 c5192922.exe 4480 c5192922.exe 4480 c5192922.exe 4480 c5192922.exe 4480 c5192922.exe 4480 c5192922.exe 4480 c5192922.exe 4480 c5192922.exe 4480 c5192922.exe 4480 c5192922.exe 4480 c5192922.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
a6322769.exeAppLaunch.exec5192922.exedescription pid process Token: SeDebugPrivilege 4992 a6322769.exe Token: SeDebugPrivilege 3932 AppLaunch.exe Token: SeDebugPrivilege 4480 c5192922.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
4ec286e74acba9ce0a7a415ceadee38a00a60cf30598b030bddc4df2239443a9.exev0051612.exev5813734.exev7539679.exeb5062989.exedescription pid process target process PID 3052 wrote to memory of 4796 3052 4ec286e74acba9ce0a7a415ceadee38a00a60cf30598b030bddc4df2239443a9.exe v0051612.exe PID 3052 wrote to memory of 4796 3052 4ec286e74acba9ce0a7a415ceadee38a00a60cf30598b030bddc4df2239443a9.exe v0051612.exe PID 3052 wrote to memory of 4796 3052 4ec286e74acba9ce0a7a415ceadee38a00a60cf30598b030bddc4df2239443a9.exe v0051612.exe PID 4796 wrote to memory of 5084 4796 v0051612.exe v5813734.exe PID 4796 wrote to memory of 5084 4796 v0051612.exe v5813734.exe PID 4796 wrote to memory of 5084 4796 v0051612.exe v5813734.exe PID 5084 wrote to memory of 2272 5084 v5813734.exe v7539679.exe PID 5084 wrote to memory of 2272 5084 v5813734.exe v7539679.exe PID 5084 wrote to memory of 2272 5084 v5813734.exe v7539679.exe PID 2272 wrote to memory of 4992 2272 v7539679.exe a6322769.exe PID 2272 wrote to memory of 4992 2272 v7539679.exe a6322769.exe PID 2272 wrote to memory of 1620 2272 v7539679.exe b5062989.exe PID 2272 wrote to memory of 1620 2272 v7539679.exe b5062989.exe PID 2272 wrote to memory of 1620 2272 v7539679.exe b5062989.exe PID 1620 wrote to memory of 3932 1620 b5062989.exe AppLaunch.exe PID 1620 wrote to memory of 3932 1620 b5062989.exe AppLaunch.exe PID 1620 wrote to memory of 3932 1620 b5062989.exe AppLaunch.exe PID 1620 wrote to memory of 3932 1620 b5062989.exe AppLaunch.exe PID 1620 wrote to memory of 3932 1620 b5062989.exe AppLaunch.exe PID 5084 wrote to memory of 4480 5084 v5813734.exe c5192922.exe PID 5084 wrote to memory of 4480 5084 v5813734.exe c5192922.exe PID 5084 wrote to memory of 4480 5084 v5813734.exe c5192922.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ec286e74acba9ce0a7a415ceadee38a00a60cf30598b030bddc4df2239443a9.exe"C:\Users\Admin\AppData\Local\Temp\4ec286e74acba9ce0a7a415ceadee38a00a60cf30598b030bddc4df2239443a9.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0051612.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0051612.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5813734.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5813734.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7539679.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7539679.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6322769.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6322769.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5062989.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5062989.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 5726⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c5192922.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c5192922.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1620 -ip 16201⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0051612.exeFilesize
529KB
MD5f39783ff5b0a38cd11a837e2c1f72bbf
SHA1fd62670ef6b0aec4fa8170485aa599e603cad2ca
SHA256fdd265da35e6c2062e387c4b63c1148cd75414fab4a6df23d0832bab1afc06ef
SHA5127a5941f08ec7404d6a00e231316a413b36eb54f14181f9f9d91a71b0eb5862c4662339bf7821e33b567a6e95030cd9255e3cf043435959dad1399f5ab5f85550
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0051612.exeFilesize
529KB
MD5f39783ff5b0a38cd11a837e2c1f72bbf
SHA1fd62670ef6b0aec4fa8170485aa599e603cad2ca
SHA256fdd265da35e6c2062e387c4b63c1148cd75414fab4a6df23d0832bab1afc06ef
SHA5127a5941f08ec7404d6a00e231316a413b36eb54f14181f9f9d91a71b0eb5862c4662339bf7821e33b567a6e95030cd9255e3cf043435959dad1399f5ab5f85550
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5813734.exeFilesize
357KB
MD5775a5c0649b18cbac2e7a76adf7f448a
SHA1595ebe790d2801698c5e6647989a4cae482a553e
SHA256769856a3ef9d76ad22086f94660455c448f6bf7b1fe8a84799b2239e6a4b9d6d
SHA51230287c4e62aab798441ffb7c693ad3c52845c13a65677da7a758d4894a8c0eaac2294fd267bc5e65bc85e8d094d235bb90a8807a56128bd082a0e02af196ed72
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5813734.exeFilesize
357KB
MD5775a5c0649b18cbac2e7a76adf7f448a
SHA1595ebe790d2801698c5e6647989a4cae482a553e
SHA256769856a3ef9d76ad22086f94660455c448f6bf7b1fe8a84799b2239e6a4b9d6d
SHA51230287c4e62aab798441ffb7c693ad3c52845c13a65677da7a758d4894a8c0eaac2294fd267bc5e65bc85e8d094d235bb90a8807a56128bd082a0e02af196ed72
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c5192922.exeFilesize
172KB
MD50bfb9767ce3c364ec5e2c630a17a57be
SHA16588cf3f004d3785e9652ce4ca71bf0d8d57c0c1
SHA25647e2d1de61f00652d88e77cba20d5931e7158241fd797f19bab8e504363f278f
SHA512fd0c69abb90ac7bc98f155136aa44dd7fa69c4888d22bcf733ab8416283ade6a37d36991e46f87e36c9137cff7d0711a23016388615110f88191de7d80e15b05
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c5192922.exeFilesize
172KB
MD50bfb9767ce3c364ec5e2c630a17a57be
SHA16588cf3f004d3785e9652ce4ca71bf0d8d57c0c1
SHA25647e2d1de61f00652d88e77cba20d5931e7158241fd797f19bab8e504363f278f
SHA512fd0c69abb90ac7bc98f155136aa44dd7fa69c4888d22bcf733ab8416283ade6a37d36991e46f87e36c9137cff7d0711a23016388615110f88191de7d80e15b05
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7539679.exeFilesize
202KB
MD57bb4e939d2b2773083ec36e6e59128ac
SHA13b7196e04980d1146173f259d00b52f42d710556
SHA256c60ee39528d0b6566389b0a975ed2606af65719af32486e4d3799bd88eaef794
SHA512490816de12e8d73807b3fce659c8eaea9aac9c83f87cda61682dca9096d6d30e22694e6cfd57a8d827145697e39060e1c40a1bf6dcadfb39ca3a53f88653a70d
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7539679.exeFilesize
202KB
MD57bb4e939d2b2773083ec36e6e59128ac
SHA13b7196e04980d1146173f259d00b52f42d710556
SHA256c60ee39528d0b6566389b0a975ed2606af65719af32486e4d3799bd88eaef794
SHA512490816de12e8d73807b3fce659c8eaea9aac9c83f87cda61682dca9096d6d30e22694e6cfd57a8d827145697e39060e1c40a1bf6dcadfb39ca3a53f88653a70d
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6322769.exeFilesize
12KB
MD51be42356ce5cf66de9b55c0bb661ba6a
SHA191454f4c9d8e93923b3ea12ee13ea69b9e7591ae
SHA2569babc9dc5ba988dab254f1fde63f0e704c58b9e72fd20d88900845291bf87f8d
SHA51288c122246573c9ec8826cc488c6899104530572d09545cef959bf0d463b372aab3e5fdd2e0534a633e5fdacf23068b070ac4897674eb4cd00ffbba1dd20340c7
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6322769.exeFilesize
12KB
MD51be42356ce5cf66de9b55c0bb661ba6a
SHA191454f4c9d8e93923b3ea12ee13ea69b9e7591ae
SHA2569babc9dc5ba988dab254f1fde63f0e704c58b9e72fd20d88900845291bf87f8d
SHA51288c122246573c9ec8826cc488c6899104530572d09545cef959bf0d463b372aab3e5fdd2e0534a633e5fdacf23068b070ac4897674eb4cd00ffbba1dd20340c7
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5062989.exeFilesize
117KB
MD5717b3e755736172c7a3e6b8b8ebdb5c7
SHA1f6938b53ae457288f34fa097a3a1dd44f4445ce6
SHA256f53ac6f7e8d40def0afce055d6e02395ba11b75fdc64fa527d9a5385a2be3006
SHA5128a0762e7af5ff1a5e0ce228f4f65d459423ed0f01881021a95c2114fea405625990389842b552522d88e1aea69a0bfe028b3b0d0451b4d536186aa029a0c2d59
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5062989.exeFilesize
117KB
MD5717b3e755736172c7a3e6b8b8ebdb5c7
SHA1f6938b53ae457288f34fa097a3a1dd44f4445ce6
SHA256f53ac6f7e8d40def0afce055d6e02395ba11b75fdc64fa527d9a5385a2be3006
SHA5128a0762e7af5ff1a5e0ce228f4f65d459423ed0f01881021a95c2114fea405625990389842b552522d88e1aea69a0bfe028b3b0d0451b4d536186aa029a0c2d59
-
memory/3932-167-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/4480-175-0x0000000000080000-0x00000000000B0000-memory.dmpFilesize
192KB
-
memory/4480-181-0x000000000A2B0000-0x000000000A326000-memory.dmpFilesize
472KB
-
memory/4480-176-0x000000000A480000-0x000000000AA98000-memory.dmpFilesize
6.1MB
-
memory/4480-177-0x000000000A000000-0x000000000A10A000-memory.dmpFilesize
1.0MB
-
memory/4480-179-0x00000000049D0000-0x00000000049E0000-memory.dmpFilesize
64KB
-
memory/4480-178-0x0000000009F40000-0x0000000009F52000-memory.dmpFilesize
72KB
-
memory/4480-180-0x0000000009FA0000-0x0000000009FDC000-memory.dmpFilesize
240KB
-
memory/4480-189-0x000000000B7A0000-0x000000000B7F0000-memory.dmpFilesize
320KB
-
memory/4480-182-0x000000000A3D0000-0x000000000A462000-memory.dmpFilesize
584KB
-
memory/4480-183-0x000000000B050000-0x000000000B5F4000-memory.dmpFilesize
5.6MB
-
memory/4480-184-0x000000000ABA0000-0x000000000AC06000-memory.dmpFilesize
408KB
-
memory/4480-186-0x00000000049D0000-0x00000000049E0000-memory.dmpFilesize
64KB
-
memory/4480-187-0x000000000B8D0000-0x000000000BA92000-memory.dmpFilesize
1.8MB
-
memory/4480-188-0x000000000BFD0000-0x000000000C4FC000-memory.dmpFilesize
5.2MB
-
memory/4992-161-0x00000000007C0000-0x00000000007CA000-memory.dmpFilesize
40KB