Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05-06-2023 20:46
Static task
static1
Behavioral task
behavioral1
Sample
c8e3066ab822f34eaeeffec4022d61503f87395cba1f5645cef25133f5b64f00.exe
Resource
win10v2004-20230220-en
General
-
Target
c8e3066ab822f34eaeeffec4022d61503f87395cba1f5645cef25133f5b64f00.exe
-
Size
736KB
-
MD5
48cc4253ca1886c1340b31e397bc51c3
-
SHA1
003d1c6bb9b105c93a5b66a163786b6fe82edffb
-
SHA256
c8e3066ab822f34eaeeffec4022d61503f87395cba1f5645cef25133f5b64f00
-
SHA512
1cca6ac0dadca86195506b95516799cba6b31342508cda204511e6a747f22a5a725ac598d5d997cdc108a511c81d53e9b174c5394887d286fa2269e9a8d89f03
-
SSDEEP
12288:9MrCy90KEZbTk+F22+EvKMlIhO0x364hv6jx0ZDh8+jkWkiRwKTXWnC9E8y:7yu19+D/3Thy9ul8qk7M791y
Malware Config
Extracted
redline
maxi
83.97.73.126:19048
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Signatures
-
Processes:
AppLaunch.exea5771448.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection a5771448.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a5771448.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a5771448.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a5771448.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a5771448.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a5771448.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 6 IoCs
Processes:
v3672886.exev5485840.exev8871597.exea5771448.exeb7848338.exec3935179.exepid process 3800 v3672886.exe 4744 v5485840.exe 1016 v8871597.exe 3740 a5771448.exe 4732 b7848338.exe 2348 c3935179.exe -
Processes:
a5771448.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a5771448.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
v8871597.exec8e3066ab822f34eaeeffec4022d61503f87395cba1f5645cef25133f5b64f00.exev3672886.exev5485840.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v8871597.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" v8871597.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce c8e3066ab822f34eaeeffec4022d61503f87395cba1f5645cef25133f5b64f00.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c8e3066ab822f34eaeeffec4022d61503f87395cba1f5645cef25133f5b64f00.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v3672886.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v3672886.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v5485840.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v5485840.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
b7848338.exedescription pid process target process PID 4732 set thread context of 4428 4732 b7848338.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3292 4732 WerFault.exe b7848338.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
a5771448.exeAppLaunch.exepid process 3740 a5771448.exe 3740 a5771448.exe 4428 AppLaunch.exe 4428 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
a5771448.exeAppLaunch.exedescription pid process Token: SeDebugPrivilege 3740 a5771448.exe Token: SeDebugPrivilege 4428 AppLaunch.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
c8e3066ab822f34eaeeffec4022d61503f87395cba1f5645cef25133f5b64f00.exev3672886.exev5485840.exev8871597.exeb7848338.exedescription pid process target process PID 384 wrote to memory of 3800 384 c8e3066ab822f34eaeeffec4022d61503f87395cba1f5645cef25133f5b64f00.exe v3672886.exe PID 384 wrote to memory of 3800 384 c8e3066ab822f34eaeeffec4022d61503f87395cba1f5645cef25133f5b64f00.exe v3672886.exe PID 384 wrote to memory of 3800 384 c8e3066ab822f34eaeeffec4022d61503f87395cba1f5645cef25133f5b64f00.exe v3672886.exe PID 3800 wrote to memory of 4744 3800 v3672886.exe v5485840.exe PID 3800 wrote to memory of 4744 3800 v3672886.exe v5485840.exe PID 3800 wrote to memory of 4744 3800 v3672886.exe v5485840.exe PID 4744 wrote to memory of 1016 4744 v5485840.exe v8871597.exe PID 4744 wrote to memory of 1016 4744 v5485840.exe v8871597.exe PID 4744 wrote to memory of 1016 4744 v5485840.exe v8871597.exe PID 1016 wrote to memory of 3740 1016 v8871597.exe a5771448.exe PID 1016 wrote to memory of 3740 1016 v8871597.exe a5771448.exe PID 1016 wrote to memory of 4732 1016 v8871597.exe b7848338.exe PID 1016 wrote to memory of 4732 1016 v8871597.exe b7848338.exe PID 1016 wrote to memory of 4732 1016 v8871597.exe b7848338.exe PID 4732 wrote to memory of 4428 4732 b7848338.exe AppLaunch.exe PID 4732 wrote to memory of 4428 4732 b7848338.exe AppLaunch.exe PID 4732 wrote to memory of 4428 4732 b7848338.exe AppLaunch.exe PID 4732 wrote to memory of 4428 4732 b7848338.exe AppLaunch.exe PID 4732 wrote to memory of 4428 4732 b7848338.exe AppLaunch.exe PID 4744 wrote to memory of 2348 4744 v5485840.exe c3935179.exe PID 4744 wrote to memory of 2348 4744 v5485840.exe c3935179.exe PID 4744 wrote to memory of 2348 4744 v5485840.exe c3935179.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8e3066ab822f34eaeeffec4022d61503f87395cba1f5645cef25133f5b64f00.exe"C:\Users\Admin\AppData\Local\Temp\c8e3066ab822f34eaeeffec4022d61503f87395cba1f5645cef25133f5b64f00.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3672886.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3672886.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5485840.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5485840.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8871597.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8871597.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a5771448.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a5771448.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7848338.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7848338.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 1406⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3935179.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3935179.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4732 -ip 47321⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3672886.exeFilesize
529KB
MD5db848e9178309b49e06884a80b296460
SHA1ea3385d6c04c33a276827706b2824ee5fb99761f
SHA256e8febf5d7d06141abce39338e93b399a8732e80c8aa6717afee6ac997a76c5f8
SHA5120027eb0e3aab96066b70466c18b01678372519e6f55b4a5a2c9cc469a9a48378093c35a704b1f868f636b6376e23f2ca13191fa52c26a7c7658cd5705630f422
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3672886.exeFilesize
529KB
MD5db848e9178309b49e06884a80b296460
SHA1ea3385d6c04c33a276827706b2824ee5fb99761f
SHA256e8febf5d7d06141abce39338e93b399a8732e80c8aa6717afee6ac997a76c5f8
SHA5120027eb0e3aab96066b70466c18b01678372519e6f55b4a5a2c9cc469a9a48378093c35a704b1f868f636b6376e23f2ca13191fa52c26a7c7658cd5705630f422
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5485840.exeFilesize
357KB
MD5a0525adf9a117a619395bdf31e333dad
SHA13000621987af5c5ef7df80df453d47bc7c609349
SHA256812bae200f97e4e50936e49485ebf2f5018f2995361c2fb309e51520ad631d91
SHA512046efe0bb1b4efa9c08d2fa9cf37f2b35ca57160f464c46ff474866d1345828052c6c25f4bca711c9b74455c5f16ec0d76ef7b54ab7611c943a8900237c33320
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5485840.exeFilesize
357KB
MD5a0525adf9a117a619395bdf31e333dad
SHA13000621987af5c5ef7df80df453d47bc7c609349
SHA256812bae200f97e4e50936e49485ebf2f5018f2995361c2fb309e51520ad631d91
SHA512046efe0bb1b4efa9c08d2fa9cf37f2b35ca57160f464c46ff474866d1345828052c6c25f4bca711c9b74455c5f16ec0d76ef7b54ab7611c943a8900237c33320
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3935179.exeFilesize
172KB
MD5baf16a158f75ac24ae1997cb569e2a1a
SHA1ffb978f5f893b4d019341b3451f99658ccb1d87d
SHA2567715e135148d76f26452354e50701b174377dce847556fa51f37fdf8b6763ebe
SHA5127aa946d2c827322a0a4c3666202c681992ac3280ce027aadb8ce59fca721af2375a443b8a0e4e5cd82ace5796a8344cc362488cd474f582ca8a6c8e74871a510
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3935179.exeFilesize
172KB
MD5baf16a158f75ac24ae1997cb569e2a1a
SHA1ffb978f5f893b4d019341b3451f99658ccb1d87d
SHA2567715e135148d76f26452354e50701b174377dce847556fa51f37fdf8b6763ebe
SHA5127aa946d2c827322a0a4c3666202c681992ac3280ce027aadb8ce59fca721af2375a443b8a0e4e5cd82ace5796a8344cc362488cd474f582ca8a6c8e74871a510
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8871597.exeFilesize
202KB
MD5e8f3b5e0072a8fc15e11b880c7dd56d7
SHA1068ef5627c1de19e38675c7e2ddb46ba93284d7f
SHA256b9f7d7af1e400518fe040c0b39a10036fe2fe0fd6b7959c215c85e97df36246b
SHA5125c33b7d6c21db653dcbee4b67706887e0abdab1077cc48b79bb33f7bcb264e98682b1574bd627caefceb52fa76e3f4e7acf1fa3e7ee08cfab7395fff47f51164
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8871597.exeFilesize
202KB
MD5e8f3b5e0072a8fc15e11b880c7dd56d7
SHA1068ef5627c1de19e38675c7e2ddb46ba93284d7f
SHA256b9f7d7af1e400518fe040c0b39a10036fe2fe0fd6b7959c215c85e97df36246b
SHA5125c33b7d6c21db653dcbee4b67706887e0abdab1077cc48b79bb33f7bcb264e98682b1574bd627caefceb52fa76e3f4e7acf1fa3e7ee08cfab7395fff47f51164
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a5771448.exeFilesize
12KB
MD550d0ca1c0932722371f7c99fc472c9dd
SHA1c5a906dd2afbc85bf662ec9b31c6c6ff077d711e
SHA256d54eaa0246a19cc54be3c2236c0f3ffcb8ee9d91655df6c71f9ef3b31bf8904f
SHA512dd486393037c1d3c475ee01899a45816c28376c5535928d880ee7d3d2e61642edb810d8b14caa5db5e73bf8761507202a588fb6677580b1dcdc5ca800b92a702
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a5771448.exeFilesize
12KB
MD550d0ca1c0932722371f7c99fc472c9dd
SHA1c5a906dd2afbc85bf662ec9b31c6c6ff077d711e
SHA256d54eaa0246a19cc54be3c2236c0f3ffcb8ee9d91655df6c71f9ef3b31bf8904f
SHA512dd486393037c1d3c475ee01899a45816c28376c5535928d880ee7d3d2e61642edb810d8b14caa5db5e73bf8761507202a588fb6677580b1dcdc5ca800b92a702
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7848338.exeFilesize
117KB
MD57bda4dea047104a4ed0e2ba96f32bf7e
SHA10504f6ccabde31df24819b8aff83812584518c41
SHA256582c7c80def14e493f8e41791c3b801cfeda6828d13546597c0ea40f66bb416c
SHA512333cc818cff9de334c72e4196ad279d3d7686f4e898e71817ef6fdafc94dc032c3afed95aa3f1b92c409a1d27a94c8b02ad5ea26bdb14f1c04496aa106870c18
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7848338.exeFilesize
117KB
MD57bda4dea047104a4ed0e2ba96f32bf7e
SHA10504f6ccabde31df24819b8aff83812584518c41
SHA256582c7c80def14e493f8e41791c3b801cfeda6828d13546597c0ea40f66bb416c
SHA512333cc818cff9de334c72e4196ad279d3d7686f4e898e71817ef6fdafc94dc032c3afed95aa3f1b92c409a1d27a94c8b02ad5ea26bdb14f1c04496aa106870c18
-
memory/2348-175-0x00000000007C0000-0x00000000007F0000-memory.dmpFilesize
192KB
-
memory/2348-176-0x000000000ABE0000-0x000000000B1F8000-memory.dmpFilesize
6.1MB
-
memory/2348-177-0x000000000A740000-0x000000000A84A000-memory.dmpFilesize
1.0MB
-
memory/2348-178-0x000000000A680000-0x000000000A692000-memory.dmpFilesize
72KB
-
memory/2348-179-0x000000000A6E0000-0x000000000A71C000-memory.dmpFilesize
240KB
-
memory/2348-180-0x0000000004FF0000-0x0000000005000000-memory.dmpFilesize
64KB
-
memory/2348-182-0x0000000004FF0000-0x0000000005000000-memory.dmpFilesize
64KB
-
memory/3740-161-0x0000000000B40000-0x0000000000B4A000-memory.dmpFilesize
40KB
-
memory/4428-167-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB