Analysis
-
max time kernel
45s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05-06-2023 17:59
Static task
static1
Behavioral task
behavioral1
Sample
341378f10c992e7900c77d77d640aa3462552c668ae6421432e38f89fc960937.exe
Resource
win10v2004-20230220-en
General
-
Target
341378f10c992e7900c77d77d640aa3462552c668ae6421432e38f89fc960937.exe
-
Size
734KB
-
MD5
b914bf56ca71dc6cf88cab0d99c56b4b
-
SHA1
f28d6f9c338c968471bda88f8d42b39aaf4815a8
-
SHA256
341378f10c992e7900c77d77d640aa3462552c668ae6421432e38f89fc960937
-
SHA512
7c78770a511a62273b370b815e1b6722cff193e2a771e6236c073244fba172a6817dcc0634c5d43735f93edfabb1a0286a5316cfd8ea5768fff0115dc513f080
-
SSDEEP
12288:AMrsy90IRNXRnLR+RYD4xngWI9B3j2JNXZ9gZnX7zuHqkjjIdU2HJUD2SOp:cyhRlpLR7mntI9BoNvhPj32KNOp
Malware Config
Extracted
redline
maxi
83.97.73.126:19048
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Signatures
-
Processes:
a9780356.exeAppLaunch.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection a9780356.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a9780356.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a9780356.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a9780356.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a9780356.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a9780356.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 6 IoCs
Processes:
v8369176.exev6438101.exev8755728.exea9780356.exeb4043778.exec5629529.exepid process 5104 v8369176.exe 4696 v6438101.exe 3132 v8755728.exe 4360 a9780356.exe 3364 b4043778.exe 1208 c5629529.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
a9780356.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a9780356.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
v6438101.exev8755728.exe341378f10c992e7900c77d77d640aa3462552c668ae6421432e38f89fc960937.exev8369176.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v6438101.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v8755728.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" v8755728.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 341378f10c992e7900c77d77d640aa3462552c668ae6421432e38f89fc960937.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 341378f10c992e7900c77d77d640aa3462552c668ae6421432e38f89fc960937.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v8369176.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v8369176.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v6438101.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
b4043778.exedescription pid process target process PID 3364 set thread context of 4748 3364 b4043778.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3940 3364 WerFault.exe b4043778.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
a9780356.exeAppLaunch.exec5629529.exepid process 4360 a9780356.exe 4360 a9780356.exe 4748 AppLaunch.exe 4748 AppLaunch.exe 1208 c5629529.exe 1208 c5629529.exe 1208 c5629529.exe 1208 c5629529.exe 1208 c5629529.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
a9780356.exeAppLaunch.exec5629529.exedescription pid process Token: SeDebugPrivilege 4360 a9780356.exe Token: SeDebugPrivilege 4748 AppLaunch.exe Token: SeDebugPrivilege 1208 c5629529.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
341378f10c992e7900c77d77d640aa3462552c668ae6421432e38f89fc960937.exev8369176.exev6438101.exev8755728.exeb4043778.exedescription pid process target process PID 3952 wrote to memory of 5104 3952 341378f10c992e7900c77d77d640aa3462552c668ae6421432e38f89fc960937.exe v8369176.exe PID 3952 wrote to memory of 5104 3952 341378f10c992e7900c77d77d640aa3462552c668ae6421432e38f89fc960937.exe v8369176.exe PID 3952 wrote to memory of 5104 3952 341378f10c992e7900c77d77d640aa3462552c668ae6421432e38f89fc960937.exe v8369176.exe PID 5104 wrote to memory of 4696 5104 v8369176.exe v6438101.exe PID 5104 wrote to memory of 4696 5104 v8369176.exe v6438101.exe PID 5104 wrote to memory of 4696 5104 v8369176.exe v6438101.exe PID 4696 wrote to memory of 3132 4696 v6438101.exe v8755728.exe PID 4696 wrote to memory of 3132 4696 v6438101.exe v8755728.exe PID 4696 wrote to memory of 3132 4696 v6438101.exe v8755728.exe PID 3132 wrote to memory of 4360 3132 v8755728.exe a9780356.exe PID 3132 wrote to memory of 4360 3132 v8755728.exe a9780356.exe PID 3132 wrote to memory of 3364 3132 v8755728.exe b4043778.exe PID 3132 wrote to memory of 3364 3132 v8755728.exe b4043778.exe PID 3132 wrote to memory of 3364 3132 v8755728.exe b4043778.exe PID 3364 wrote to memory of 4748 3364 b4043778.exe AppLaunch.exe PID 3364 wrote to memory of 4748 3364 b4043778.exe AppLaunch.exe PID 3364 wrote to memory of 4748 3364 b4043778.exe AppLaunch.exe PID 3364 wrote to memory of 4748 3364 b4043778.exe AppLaunch.exe PID 3364 wrote to memory of 4748 3364 b4043778.exe AppLaunch.exe PID 4696 wrote to memory of 1208 4696 v6438101.exe c5629529.exe PID 4696 wrote to memory of 1208 4696 v6438101.exe c5629529.exe PID 4696 wrote to memory of 1208 4696 v6438101.exe c5629529.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\341378f10c992e7900c77d77d640aa3462552c668ae6421432e38f89fc960937.exe"C:\Users\Admin\AppData\Local\Temp\341378f10c992e7900c77d77d640aa3462552c668ae6421432e38f89fc960937.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8369176.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8369176.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6438101.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6438101.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8755728.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8755728.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9780356.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9780356.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4043778.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4043778.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 2166⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c5629529.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c5629529.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3364 -ip 33641⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8369176.exeFilesize
530KB
MD52565f0fbdc8ec1632829c2b12b9c613b
SHA180970fa81fc9ffd973946ac6c4a77a5531bf73b9
SHA256e910862dedc1c70e7c84ee3dbf66da9f043080359ca25ffdf2f5850cdae5070f
SHA5120d3027a1ea7055b3f442e3bb2a8278d9406be4017c6e49a42901cc0affde74003068e4211e76965f7a07d1b331986486a6fd5fffd3960ef8956f63de1da43201
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8369176.exeFilesize
530KB
MD52565f0fbdc8ec1632829c2b12b9c613b
SHA180970fa81fc9ffd973946ac6c4a77a5531bf73b9
SHA256e910862dedc1c70e7c84ee3dbf66da9f043080359ca25ffdf2f5850cdae5070f
SHA5120d3027a1ea7055b3f442e3bb2a8278d9406be4017c6e49a42901cc0affde74003068e4211e76965f7a07d1b331986486a6fd5fffd3960ef8956f63de1da43201
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6438101.exeFilesize
357KB
MD5a0ec82d43ff9b21477b9d676f4822282
SHA1255704ce2dbf833745afeebb54d9f88cac7f2c9c
SHA25690907396f2df68d3e22dcf39c5e6274baad6fd6718e512bf8c2455d2966f19a9
SHA5127007acccb76fc0580567803d8ae572208170c12b9ad2f4e1e31a097a837fce3922920c28fb8178126093f7e762b08bc526a6590434bd3b242b416f3509efa3a7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6438101.exeFilesize
357KB
MD5a0ec82d43ff9b21477b9d676f4822282
SHA1255704ce2dbf833745afeebb54d9f88cac7f2c9c
SHA25690907396f2df68d3e22dcf39c5e6274baad6fd6718e512bf8c2455d2966f19a9
SHA5127007acccb76fc0580567803d8ae572208170c12b9ad2f4e1e31a097a837fce3922920c28fb8178126093f7e762b08bc526a6590434bd3b242b416f3509efa3a7
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c5629529.exeFilesize
172KB
MD54ef79be7d11626605516e0eec9a29508
SHA10163ee73c04177742f471d5ad04aefbb94c68ff9
SHA2562ea7442857497666002889df8cfb8b9c77e64a900b9b43ba2e3b9ebcb9463fb8
SHA512f7e497a394746927ab057b3b2ab3566dd68122756b496faa17451d1789e549cad28b46d66c67f6a1878be191a7a4627d0286cf8096c0a0f7b271ad90d51f225d
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c5629529.exeFilesize
172KB
MD54ef79be7d11626605516e0eec9a29508
SHA10163ee73c04177742f471d5ad04aefbb94c68ff9
SHA2562ea7442857497666002889df8cfb8b9c77e64a900b9b43ba2e3b9ebcb9463fb8
SHA512f7e497a394746927ab057b3b2ab3566dd68122756b496faa17451d1789e549cad28b46d66c67f6a1878be191a7a4627d0286cf8096c0a0f7b271ad90d51f225d
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8755728.exeFilesize
202KB
MD5a9a058967d290ec1e03e9d1353f86bb9
SHA11560b2ac0d3399af68bf8e64b3121da8716d2e57
SHA256589b9711832e9ac4edeaf25cf75edbcab1a3e8f0f34c26be00a06eab1a71aa00
SHA512585329aef8027244666d85860fc5a9b117bf841feefc9142d436f0c93d888fb31bd6c39044e0f8ae979d13064e2979c5d3d94a6aace2d1c804fb9c9358590b6e
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8755728.exeFilesize
202KB
MD5a9a058967d290ec1e03e9d1353f86bb9
SHA11560b2ac0d3399af68bf8e64b3121da8716d2e57
SHA256589b9711832e9ac4edeaf25cf75edbcab1a3e8f0f34c26be00a06eab1a71aa00
SHA512585329aef8027244666d85860fc5a9b117bf841feefc9142d436f0c93d888fb31bd6c39044e0f8ae979d13064e2979c5d3d94a6aace2d1c804fb9c9358590b6e
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9780356.exeFilesize
12KB
MD57c54c74def66969ea23e92d3aa8271c6
SHA18fb5470c63caad82094ff94d5503405ceeeead95
SHA256f9e08f4d91232719e55875369d032cf75a8b68946663f5209ee44d12085fdc9e
SHA51273c404e489f9a909bdb8717ae2cbe79e583fb7d7ec592935eb870fd756b62326a00bb64440e8d594571679793cf1647bb6febb88b579320f2b97b03f489af7d0
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9780356.exeFilesize
12KB
MD57c54c74def66969ea23e92d3aa8271c6
SHA18fb5470c63caad82094ff94d5503405ceeeead95
SHA256f9e08f4d91232719e55875369d032cf75a8b68946663f5209ee44d12085fdc9e
SHA51273c404e489f9a909bdb8717ae2cbe79e583fb7d7ec592935eb870fd756b62326a00bb64440e8d594571679793cf1647bb6febb88b579320f2b97b03f489af7d0
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4043778.exeFilesize
117KB
MD5c98688d5f72d8e7bba3eb6a0529c06f3
SHA19f236ba957be3580c293cf171757f3a46f20ab41
SHA256d38b1392f7f113fe1934f1ee2b5aea462631c6c8c44871459333cb51b9a2ea91
SHA5121eed377bf810688c5a60056bc0cf0edd8fac1bb670d5b7d8e80568c808248e1770be93d671be30e4f130f2697f2b8684b017928d2d8ee4842996e77ad2de7c68
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4043778.exeFilesize
117KB
MD5c98688d5f72d8e7bba3eb6a0529c06f3
SHA19f236ba957be3580c293cf171757f3a46f20ab41
SHA256d38b1392f7f113fe1934f1ee2b5aea462631c6c8c44871459333cb51b9a2ea91
SHA5121eed377bf810688c5a60056bc0cf0edd8fac1bb670d5b7d8e80568c808248e1770be93d671be30e4f130f2697f2b8684b017928d2d8ee4842996e77ad2de7c68
-
memory/1208-175-0x0000000000050000-0x0000000000080000-memory.dmpFilesize
192KB
-
memory/1208-180-0x0000000009F70000-0x0000000009FAC000-memory.dmpFilesize
240KB
-
memory/1208-189-0x000000000B080000-0x000000000B0D0000-memory.dmpFilesize
320KB
-
memory/1208-176-0x000000000A4A0000-0x000000000AAB8000-memory.dmpFilesize
6.1MB
-
memory/1208-177-0x0000000009FD0000-0x000000000A0DA000-memory.dmpFilesize
1.0MB
-
memory/1208-178-0x0000000009F10000-0x0000000009F22000-memory.dmpFilesize
72KB
-
memory/1208-179-0x00000000048F0000-0x0000000004900000-memory.dmpFilesize
64KB
-
memory/1208-188-0x00000000048F0000-0x0000000004900000-memory.dmpFilesize
64KB
-
memory/1208-181-0x000000000A280000-0x000000000A2F6000-memory.dmpFilesize
472KB
-
memory/1208-182-0x000000000A3A0000-0x000000000A432000-memory.dmpFilesize
584KB
-
memory/1208-183-0x000000000B170000-0x000000000B714000-memory.dmpFilesize
5.6MB
-
memory/1208-184-0x000000000ABC0000-0x000000000AC26000-memory.dmpFilesize
408KB
-
memory/1208-186-0x000000000B8F0000-0x000000000BAB2000-memory.dmpFilesize
1.8MB
-
memory/1208-187-0x000000000BFF0000-0x000000000C51C000-memory.dmpFilesize
5.2MB
-
memory/4360-161-0x0000000000850000-0x000000000085A000-memory.dmpFilesize
40KB
-
memory/4748-167-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB