Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
06-06-2023 02:16
Static task
static1
Behavioral task
behavioral1
Sample
04f7fefd1e1a7fd1c41833205b9fa2e4.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
04f7fefd1e1a7fd1c41833205b9fa2e4.exe
Resource
win10v2004-20230221-en
General
-
Target
04f7fefd1e1a7fd1c41833205b9fa2e4.exe
-
Size
735KB
-
MD5
04f7fefd1e1a7fd1c41833205b9fa2e4
-
SHA1
fa3c4eb9b429559c6dd4c270b16965e8dae31939
-
SHA256
66b7df7b740edf84d18c3b692293dc19e5a108936f10537ad5e9324906c90e34
-
SHA512
9a6fe1282cb08fc5e26dae8b5bf60641da510db4661f4cf89511d194d7bd404fa2faa05bc9ec6afad03c7b2f516dd8a534d28b1520fa4620a11cd3fa7e2a761b
-
SSDEEP
12288:4Mruy90CidCE16JejWlEVFpkn+Z0nlFr6YNCLG7flGKd9d5f1Iy3YIDDeD6/qlXx:myAdn142Dqlx6DyUKd9TfW+ZDyTXx
Malware Config
Extracted
redline
maxi
83.97.73.126:19048
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Signatures
-
Processes:
AppLaunch.exea6585250.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection a6585250.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a6585250.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a6585250.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a6585250.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a6585250.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a6585250.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 6 IoCs
Processes:
v0128068.exev9890736.exev6339666.exea6585250.exeb4676796.exec5690500.exepid process 1968 v0128068.exe 964 v9890736.exe 4436 v6339666.exe 4864 a6585250.exe 3228 b4676796.exe 3864 c5690500.exe -
Processes:
a6585250.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a6585250.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
04f7fefd1e1a7fd1c41833205b9fa2e4.exev0128068.exev9890736.exev6339666.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 04f7fefd1e1a7fd1c41833205b9fa2e4.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v0128068.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v0128068.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v9890736.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v9890736.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v6339666.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" v6339666.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 04f7fefd1e1a7fd1c41833205b9fa2e4.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
b4676796.exedescription pid process target process PID 3228 set thread context of 3108 3228 b4676796.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4768 3228 WerFault.exe b4676796.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
a6585250.exeAppLaunch.exepid process 4864 a6585250.exe 4864 a6585250.exe 3108 AppLaunch.exe 3108 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
a6585250.exeAppLaunch.exedescription pid process Token: SeDebugPrivilege 4864 a6585250.exe Token: SeDebugPrivilege 3108 AppLaunch.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
04f7fefd1e1a7fd1c41833205b9fa2e4.exev0128068.exev9890736.exev6339666.exeb4676796.exedescription pid process target process PID 2724 wrote to memory of 1968 2724 04f7fefd1e1a7fd1c41833205b9fa2e4.exe v0128068.exe PID 2724 wrote to memory of 1968 2724 04f7fefd1e1a7fd1c41833205b9fa2e4.exe v0128068.exe PID 2724 wrote to memory of 1968 2724 04f7fefd1e1a7fd1c41833205b9fa2e4.exe v0128068.exe PID 1968 wrote to memory of 964 1968 v0128068.exe v9890736.exe PID 1968 wrote to memory of 964 1968 v0128068.exe v9890736.exe PID 1968 wrote to memory of 964 1968 v0128068.exe v9890736.exe PID 964 wrote to memory of 4436 964 v9890736.exe v6339666.exe PID 964 wrote to memory of 4436 964 v9890736.exe v6339666.exe PID 964 wrote to memory of 4436 964 v9890736.exe v6339666.exe PID 4436 wrote to memory of 4864 4436 v6339666.exe a6585250.exe PID 4436 wrote to memory of 4864 4436 v6339666.exe a6585250.exe PID 4436 wrote to memory of 3228 4436 v6339666.exe b4676796.exe PID 4436 wrote to memory of 3228 4436 v6339666.exe b4676796.exe PID 4436 wrote to memory of 3228 4436 v6339666.exe b4676796.exe PID 3228 wrote to memory of 3108 3228 b4676796.exe AppLaunch.exe PID 3228 wrote to memory of 3108 3228 b4676796.exe AppLaunch.exe PID 3228 wrote to memory of 3108 3228 b4676796.exe AppLaunch.exe PID 3228 wrote to memory of 3108 3228 b4676796.exe AppLaunch.exe PID 3228 wrote to memory of 3108 3228 b4676796.exe AppLaunch.exe PID 964 wrote to memory of 3864 964 v9890736.exe c5690500.exe PID 964 wrote to memory of 3864 964 v9890736.exe c5690500.exe PID 964 wrote to memory of 3864 964 v9890736.exe c5690500.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\04f7fefd1e1a7fd1c41833205b9fa2e4.exe"C:\Users\Admin\AppData\Local\Temp\04f7fefd1e1a7fd1c41833205b9fa2e4.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0128068.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0128068.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9890736.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9890736.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v6339666.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v6339666.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6585250.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6585250.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4676796.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4676796.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3108 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 1406⤵
- Program crash
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c5690500.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c5690500.exe4⤵
- Executes dropped EXE
PID:3864
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3228 -ip 32281⤵PID:4708
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0128068.exeFilesize
530KB
MD54ad4dc6fba88d72675ad0b823c577db3
SHA15694f749101cd644c8070539adb77ea6521b576c
SHA256a2400f0c45431723da65392f2278c81cf5c879598de4cde6055d4df54a590889
SHA512d144cf306fb1729b0229abf37cf0110007156ad9fea82cf19adbab03eb0f88a8701fe19415cc7e9cc3eabe272f4dab0c4cab62e9cc4734d4b7511259c62a3c69
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0128068.exeFilesize
530KB
MD54ad4dc6fba88d72675ad0b823c577db3
SHA15694f749101cd644c8070539adb77ea6521b576c
SHA256a2400f0c45431723da65392f2278c81cf5c879598de4cde6055d4df54a590889
SHA512d144cf306fb1729b0229abf37cf0110007156ad9fea82cf19adbab03eb0f88a8701fe19415cc7e9cc3eabe272f4dab0c4cab62e9cc4734d4b7511259c62a3c69
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9890736.exeFilesize
357KB
MD5f553ecb0b5340bed65d3ec1194d76b41
SHA1546a6ee61a9aff3a36ba5fa9c9fc0342f168c952
SHA25643054d827408da8e36fdf95d578cb79d4299b36cfcc7fbf4fad9c9b32261bbee
SHA51237e065838e521b043b22ad6116972de778011409e1c4837c29979d4410e7d0f16b02fcac50ae471667ffe5106aa0de8c1a878f8f45928863541fac7eaff8e831
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9890736.exeFilesize
357KB
MD5f553ecb0b5340bed65d3ec1194d76b41
SHA1546a6ee61a9aff3a36ba5fa9c9fc0342f168c952
SHA25643054d827408da8e36fdf95d578cb79d4299b36cfcc7fbf4fad9c9b32261bbee
SHA51237e065838e521b043b22ad6116972de778011409e1c4837c29979d4410e7d0f16b02fcac50ae471667ffe5106aa0de8c1a878f8f45928863541fac7eaff8e831
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c5690500.exeFilesize
172KB
MD5edc62d3b29a4336d6f2b8d283f7ec29c
SHA1dca69c2fd9ff7c7a808358008a4ef56ccc2e7b62
SHA256ef2ad138b1d9dab4f7f2f40a11eeef1cdba6c35b9a1672ab1a8efd897eccdaa7
SHA5120e387e4851e7eb7eef10a0be5c84bfaef8f8cef88746ae23f7b52988ba40dd924824d63d6245496f74af8a7396e304dace1be37c0472241a229bad2165d243d0
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c5690500.exeFilesize
172KB
MD5edc62d3b29a4336d6f2b8d283f7ec29c
SHA1dca69c2fd9ff7c7a808358008a4ef56ccc2e7b62
SHA256ef2ad138b1d9dab4f7f2f40a11eeef1cdba6c35b9a1672ab1a8efd897eccdaa7
SHA5120e387e4851e7eb7eef10a0be5c84bfaef8f8cef88746ae23f7b52988ba40dd924824d63d6245496f74af8a7396e304dace1be37c0472241a229bad2165d243d0
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v6339666.exeFilesize
202KB
MD59972306228dcdc24bb8df6a8e1100165
SHA1166240f3cbe18cee9847c8b433a0f09a720f1fde
SHA2566384d90520827f655983b7fe438922c8cf85df1ee46d9ca521670d137c2728d0
SHA51216231134962c7c8019f0f2cb4d7b2e3803ed04a0cd9a7f97e87b777dcfdb18c804d30c89bd675b3958d50caf0835de1e213acdbc36a796b1d93a5246dd96cad9
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v6339666.exeFilesize
202KB
MD59972306228dcdc24bb8df6a8e1100165
SHA1166240f3cbe18cee9847c8b433a0f09a720f1fde
SHA2566384d90520827f655983b7fe438922c8cf85df1ee46d9ca521670d137c2728d0
SHA51216231134962c7c8019f0f2cb4d7b2e3803ed04a0cd9a7f97e87b777dcfdb18c804d30c89bd675b3958d50caf0835de1e213acdbc36a796b1d93a5246dd96cad9
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6585250.exeFilesize
12KB
MD5ce854333fb135b49a3419c3a18496803
SHA1a29e4cf3ebf28e86a5c6959bba79565ddf4d8c6f
SHA25649ff0e05227a986ab397a22ba4d45d34c010652b5b9f3e95de84763fd69fecef
SHA512098bcd4459b41c34c96a8191f5b22dd51b281acb432e41f98788d5bb00b86a9fa4ded2b821cb3bccee67a2050b9c47c1040bba1b5c3468156cd0bca40e9f9ab4
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6585250.exeFilesize
12KB
MD5ce854333fb135b49a3419c3a18496803
SHA1a29e4cf3ebf28e86a5c6959bba79565ddf4d8c6f
SHA25649ff0e05227a986ab397a22ba4d45d34c010652b5b9f3e95de84763fd69fecef
SHA512098bcd4459b41c34c96a8191f5b22dd51b281acb432e41f98788d5bb00b86a9fa4ded2b821cb3bccee67a2050b9c47c1040bba1b5c3468156cd0bca40e9f9ab4
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4676796.exeFilesize
117KB
MD5ce0797e9541e624794a92c713989ca3a
SHA16c4a21eff4ac6467b0f34ee5c7ca67b92465e08e
SHA256bbd2ea2418e38bc54a6782e08d262bcbf8e5ae3fb8b0315f5fe48bf653b2686d
SHA51263a0031941f87e003fac8b4c20756da5e27075aa6c2d9dfabc3143cc70bedb8c719b79dbf388a7484172feab49dd113fe79b577d025b1e5ec19a6a80091cf7ef
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4676796.exeFilesize
117KB
MD5ce0797e9541e624794a92c713989ca3a
SHA16c4a21eff4ac6467b0f34ee5c7ca67b92465e08e
SHA256bbd2ea2418e38bc54a6782e08d262bcbf8e5ae3fb8b0315f5fe48bf653b2686d
SHA51263a0031941f87e003fac8b4c20756da5e27075aa6c2d9dfabc3143cc70bedb8c719b79dbf388a7484172feab49dd113fe79b577d025b1e5ec19a6a80091cf7ef
-
memory/3108-167-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/3864-175-0x0000000000950000-0x0000000000980000-memory.dmpFilesize
192KB
-
memory/3864-176-0x000000000AC10000-0x000000000B228000-memory.dmpFilesize
6.1MB
-
memory/3864-177-0x000000000A790000-0x000000000A89A000-memory.dmpFilesize
1.0MB
-
memory/3864-178-0x000000000A6D0000-0x000000000A6E2000-memory.dmpFilesize
72KB
-
memory/3864-179-0x0000000005220000-0x0000000005230000-memory.dmpFilesize
64KB
-
memory/3864-180-0x000000000A730000-0x000000000A76C000-memory.dmpFilesize
240KB
-
memory/3864-182-0x0000000005220000-0x0000000005230000-memory.dmpFilesize
64KB
-
memory/4864-161-0x0000000000CE0000-0x0000000000CEA000-memory.dmpFilesize
40KB