Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
06-06-2023 01:29
Static task
static1
Behavioral task
behavioral1
Sample
4922ba7ac074fc41ba141ff9fd2088de18d999460623e521d305cd6a5e795b11.exe
Resource
win10v2004-20230220-en
General
-
Target
4922ba7ac074fc41ba141ff9fd2088de18d999460623e521d305cd6a5e795b11.exe
-
Size
735KB
-
MD5
15d0bdf345583efd9c9ca87fbfc540d8
-
SHA1
6950e27d49640275be0df433bceffa00a4107047
-
SHA256
4922ba7ac074fc41ba141ff9fd2088de18d999460623e521d305cd6a5e795b11
-
SHA512
75ec4c6dd1a592e762b3e2e2f8eb7d358c96821adc380497384dd743b54fdf948c1fe26e3b9075d6cc13b9477ab4bf8ae50a85c66b67dbd1fa95759decb29f17
-
SSDEEP
12288:iMr8y90hpP3roagjPzsPV55U5m03yrklBCcJvD3K4vhYczaR29YrS6wGozQ:iyYpP3rfFN5C5jyklwcJDK4v23eYrSxM
Malware Config
Extracted
redline
maxi
83.97.73.126:19048
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Signatures
-
Processes:
a9013704.exeAppLaunch.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a9013704.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a9013704.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a9013704.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a9013704.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection a9013704.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a9013704.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 6 IoCs
Processes:
v5021963.exev9835229.exev9244236.exea9013704.exeb5522754.exec8452129.exepid process 4380 v5021963.exe 3216 v9835229.exe 808 v9244236.exe 960 a9013704.exe 4528 b5522754.exe 3436 c8452129.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
a9013704.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a9013704.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
4922ba7ac074fc41ba141ff9fd2088de18d999460623e521d305cd6a5e795b11.exev5021963.exev9835229.exev9244236.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 4922ba7ac074fc41ba141ff9fd2088de18d999460623e521d305cd6a5e795b11.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v5021963.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v5021963.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v9835229.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v9835229.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v9244236.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" v9244236.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 4922ba7ac074fc41ba141ff9fd2088de18d999460623e521d305cd6a5e795b11.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
b5522754.exedescription pid process target process PID 4528 set thread context of 2888 4528 b5522754.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3652 4528 WerFault.exe b5522754.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
Processes:
a9013704.exeAppLaunch.exec8452129.exepid process 960 a9013704.exe 960 a9013704.exe 2888 AppLaunch.exe 2888 AppLaunch.exe 3436 c8452129.exe 3436 c8452129.exe 3436 c8452129.exe 3436 c8452129.exe 3436 c8452129.exe 3436 c8452129.exe 3436 c8452129.exe 3436 c8452129.exe 3436 c8452129.exe 3436 c8452129.exe 3436 c8452129.exe 3436 c8452129.exe 3436 c8452129.exe 3436 c8452129.exe 3436 c8452129.exe 3436 c8452129.exe 3436 c8452129.exe 3436 c8452129.exe 3436 c8452129.exe 3436 c8452129.exe 3436 c8452129.exe 3436 c8452129.exe 3436 c8452129.exe 3436 c8452129.exe 3436 c8452129.exe 3436 c8452129.exe 3436 c8452129.exe 3436 c8452129.exe 3436 c8452129.exe 3436 c8452129.exe 3436 c8452129.exe 3436 c8452129.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
a9013704.exeAppLaunch.exec8452129.exedescription pid process Token: SeDebugPrivilege 960 a9013704.exe Token: SeDebugPrivilege 2888 AppLaunch.exe Token: SeDebugPrivilege 3436 c8452129.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
4922ba7ac074fc41ba141ff9fd2088de18d999460623e521d305cd6a5e795b11.exev5021963.exev9835229.exev9244236.exeb5522754.exedescription pid process target process PID 1224 wrote to memory of 4380 1224 4922ba7ac074fc41ba141ff9fd2088de18d999460623e521d305cd6a5e795b11.exe v5021963.exe PID 1224 wrote to memory of 4380 1224 4922ba7ac074fc41ba141ff9fd2088de18d999460623e521d305cd6a5e795b11.exe v5021963.exe PID 1224 wrote to memory of 4380 1224 4922ba7ac074fc41ba141ff9fd2088de18d999460623e521d305cd6a5e795b11.exe v5021963.exe PID 4380 wrote to memory of 3216 4380 v5021963.exe v9835229.exe PID 4380 wrote to memory of 3216 4380 v5021963.exe v9835229.exe PID 4380 wrote to memory of 3216 4380 v5021963.exe v9835229.exe PID 3216 wrote to memory of 808 3216 v9835229.exe v9244236.exe PID 3216 wrote to memory of 808 3216 v9835229.exe v9244236.exe PID 3216 wrote to memory of 808 3216 v9835229.exe v9244236.exe PID 808 wrote to memory of 960 808 v9244236.exe a9013704.exe PID 808 wrote to memory of 960 808 v9244236.exe a9013704.exe PID 808 wrote to memory of 4528 808 v9244236.exe b5522754.exe PID 808 wrote to memory of 4528 808 v9244236.exe b5522754.exe PID 808 wrote to memory of 4528 808 v9244236.exe b5522754.exe PID 4528 wrote to memory of 2888 4528 b5522754.exe AppLaunch.exe PID 4528 wrote to memory of 2888 4528 b5522754.exe AppLaunch.exe PID 4528 wrote to memory of 2888 4528 b5522754.exe AppLaunch.exe PID 4528 wrote to memory of 2888 4528 b5522754.exe AppLaunch.exe PID 4528 wrote to memory of 2888 4528 b5522754.exe AppLaunch.exe PID 3216 wrote to memory of 3436 3216 v9835229.exe c8452129.exe PID 3216 wrote to memory of 3436 3216 v9835229.exe c8452129.exe PID 3216 wrote to memory of 3436 3216 v9835229.exe c8452129.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4922ba7ac074fc41ba141ff9fd2088de18d999460623e521d305cd6a5e795b11.exe"C:\Users\Admin\AppData\Local\Temp\4922ba7ac074fc41ba141ff9fd2088de18d999460623e521d305cd6a5e795b11.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5021963.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5021963.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9835229.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9835229.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9244236.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9244236.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9013704.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9013704.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5522754.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5522754.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 1406⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c8452129.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c8452129.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4528 -ip 45281⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5021963.exeFilesize
529KB
MD5282311fb9944b6ca251dc06052003983
SHA1e1e1976fe6246c8fbf30e23ba45fc9dc8e8bdc7a
SHA256f4403d24312c19015bd58205a42cb58e616461a8bd8f25dc2cfe6cfc090fdb72
SHA5122b9209281d8ce11346e1eb0041558fff5d69227b35a498b12d727c5aeac3881de3c645f3eb133ee145e0cbee8ec12151926a936d8d63a6abbb639324b3a629dc
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5021963.exeFilesize
529KB
MD5282311fb9944b6ca251dc06052003983
SHA1e1e1976fe6246c8fbf30e23ba45fc9dc8e8bdc7a
SHA256f4403d24312c19015bd58205a42cb58e616461a8bd8f25dc2cfe6cfc090fdb72
SHA5122b9209281d8ce11346e1eb0041558fff5d69227b35a498b12d727c5aeac3881de3c645f3eb133ee145e0cbee8ec12151926a936d8d63a6abbb639324b3a629dc
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9835229.exeFilesize
357KB
MD51838f49e23cdda13f7cd4068af82ef5f
SHA1439239ee31de7eb836bcca92abf22f4c31001b5d
SHA25615ab4c6602273925d1bdba1e3869ce1ac521e04df29bb1ca9c7b5fc97e2617dc
SHA512bc94d96253702aa6df73c6ec604bcf304cbed0406b56a139b92077120da8053ce748f1d16ad05d718d8650a55f0c5c83e8b68ded76254c8f60155b468e542449
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9835229.exeFilesize
357KB
MD51838f49e23cdda13f7cd4068af82ef5f
SHA1439239ee31de7eb836bcca92abf22f4c31001b5d
SHA25615ab4c6602273925d1bdba1e3869ce1ac521e04df29bb1ca9c7b5fc97e2617dc
SHA512bc94d96253702aa6df73c6ec604bcf304cbed0406b56a139b92077120da8053ce748f1d16ad05d718d8650a55f0c5c83e8b68ded76254c8f60155b468e542449
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c8452129.exeFilesize
172KB
MD57e15e9bda63b1fa296cb0b5d2bae63fa
SHA18485c8350dd13b7bf61c8a00bbeaefdea313443b
SHA256d169339be68160f973ec8a9e09d6f9905030edbe63318a5916eeac2fb6d3cbc3
SHA5129ef5d9edaad90c71cc4802f7ea901c2c520157c6fd85c57470fa1c8598e0aa418e4a06cf2ba728483a4bd4619b70cdc485891edbfcfa7b29b8ddca6f683bb753
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c8452129.exeFilesize
172KB
MD57e15e9bda63b1fa296cb0b5d2bae63fa
SHA18485c8350dd13b7bf61c8a00bbeaefdea313443b
SHA256d169339be68160f973ec8a9e09d6f9905030edbe63318a5916eeac2fb6d3cbc3
SHA5129ef5d9edaad90c71cc4802f7ea901c2c520157c6fd85c57470fa1c8598e0aa418e4a06cf2ba728483a4bd4619b70cdc485891edbfcfa7b29b8ddca6f683bb753
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9244236.exeFilesize
202KB
MD579fdabcd1d738c80fb1085e025cc12ab
SHA1780c2f4f19a6a1d640f631017d3bbf249b0b1c0f
SHA256cbb4d353ecd2e9149781a38b80f68c36ec438b50fa7c3ef93038974abe4ebfe9
SHA5123315bbd7730467a234adf6f7a5baf6999023b14b6c2f69151c6191d650b133733671cf69cbbe158b0d68f8cdba9d63d7742116e522c8fe782bd3bc6f5954df76
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9244236.exeFilesize
202KB
MD579fdabcd1d738c80fb1085e025cc12ab
SHA1780c2f4f19a6a1d640f631017d3bbf249b0b1c0f
SHA256cbb4d353ecd2e9149781a38b80f68c36ec438b50fa7c3ef93038974abe4ebfe9
SHA5123315bbd7730467a234adf6f7a5baf6999023b14b6c2f69151c6191d650b133733671cf69cbbe158b0d68f8cdba9d63d7742116e522c8fe782bd3bc6f5954df76
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9013704.exeFilesize
13KB
MD561edf4dbc24bc996233c91aa24209e26
SHA18090c82e40e295abd2176f8977b604ad352ca875
SHA2568edff49a2c7742c2ef2911b72ef4fdd385839a402c83f057c8ea8d07092c5e4d
SHA5121397f33ac3e2af7ff683ddb563f1c8d67f1b4cb1d30e3938fa0c72d39ded456d52adf4314d91270ca1e2e1d5c31547946a8ecb00a6c251c7bf0e21be4e3901e2
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9013704.exeFilesize
13KB
MD561edf4dbc24bc996233c91aa24209e26
SHA18090c82e40e295abd2176f8977b604ad352ca875
SHA2568edff49a2c7742c2ef2911b72ef4fdd385839a402c83f057c8ea8d07092c5e4d
SHA5121397f33ac3e2af7ff683ddb563f1c8d67f1b4cb1d30e3938fa0c72d39ded456d52adf4314d91270ca1e2e1d5c31547946a8ecb00a6c251c7bf0e21be4e3901e2
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5522754.exeFilesize
117KB
MD5e03853d9d16d87a91e62f4da78f50879
SHA1465baf7ce13bd194cc80fc65b81b6831e0fabccf
SHA256d79ae78f3d63f76fc5c1c9a1063e1436b0eed3db685d0cb767b023dccab488d7
SHA5126f869b6551051d3150334888df8d71ca947a63453ac6a029b55d5d75b7b4999915e38c4721309296a096f4075a7fbfb39ae863a4364ce5784cc0b9b3851348df
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5522754.exeFilesize
117KB
MD5e03853d9d16d87a91e62f4da78f50879
SHA1465baf7ce13bd194cc80fc65b81b6831e0fabccf
SHA256d79ae78f3d63f76fc5c1c9a1063e1436b0eed3db685d0cb767b023dccab488d7
SHA5126f869b6551051d3150334888df8d71ca947a63453ac6a029b55d5d75b7b4999915e38c4721309296a096f4075a7fbfb39ae863a4364ce5784cc0b9b3851348df
-
memory/960-161-0x00000000007C0000-0x00000000007CA000-memory.dmpFilesize
40KB
-
memory/2888-167-0x00000000005E0000-0x00000000005EA000-memory.dmpFilesize
40KB
-
memory/3436-175-0x0000000000120000-0x0000000000150000-memory.dmpFilesize
192KB
-
memory/3436-176-0x000000000A580000-0x000000000AB98000-memory.dmpFilesize
6.1MB
-
memory/3436-177-0x000000000A0A0000-0x000000000A1AA000-memory.dmpFilesize
1.0MB
-
memory/3436-178-0x0000000009FE0000-0x0000000009FF2000-memory.dmpFilesize
72KB
-
memory/3436-179-0x00000000049D0000-0x00000000049E0000-memory.dmpFilesize
64KB
-
memory/3436-180-0x000000000A040000-0x000000000A07C000-memory.dmpFilesize
240KB
-
memory/3436-182-0x000000000A350000-0x000000000A3C6000-memory.dmpFilesize
472KB
-
memory/3436-183-0x000000000A470000-0x000000000A502000-memory.dmpFilesize
584KB
-
memory/3436-184-0x000000000B150000-0x000000000B6F4000-memory.dmpFilesize
5.6MB
-
memory/3436-185-0x000000000A510000-0x000000000A576000-memory.dmpFilesize
408KB
-
memory/3436-186-0x00000000049D0000-0x00000000049E0000-memory.dmpFilesize
64KB
-
memory/3436-187-0x000000000B8F0000-0x000000000BAB2000-memory.dmpFilesize
1.8MB
-
memory/3436-188-0x000000000BFF0000-0x000000000C51C000-memory.dmpFilesize
5.2MB
-
memory/3436-189-0x000000000B810000-0x000000000B860000-memory.dmpFilesize
320KB