Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
06-06-2023 02:16
Static task
static1
Behavioral task
behavioral1
Sample
c7bf75dc5395e5623f80df6f9080632e.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
c7bf75dc5395e5623f80df6f9080632e.exe
Resource
win10v2004-20230221-en
General
-
Target
c7bf75dc5395e5623f80df6f9080632e.exe
-
Size
736KB
-
MD5
c7bf75dc5395e5623f80df6f9080632e
-
SHA1
a376dabda615aed4258a5c88e5360b84b71271fe
-
SHA256
a831f4abfb429b97536aa52605d5e7405007ea5b2af185e6dcee9234c21804cc
-
SHA512
d3ad36a5085d8fc55f406790fbf28b2d477d2ee6e759875e90c0a054e457050e65dd8b7ece21d5fdfdde05de876727c6c249c5d4c79d223b2aaec5b302330871
-
SSDEEP
12288:VMrKy90GXkxlINahTNCrvxyekItxPZ2sxMKyhH/sq0snucYgpp//NcdG:TyP0vYauvxDkIJ2sxM7hU/cYgj/NOG
Malware Config
Extracted
redline
maxi
83.97.73.126:19048
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Signatures
-
Processes:
a3611066.exeAppLaunch.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection a3611066.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a3611066.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a3611066.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a3611066.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a3611066.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a3611066.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 6 IoCs
Processes:
v2255143.exev2049348.exev0097665.exea3611066.exeb4949158.exec4591357.exepid process 1856 v2255143.exe 1392 v2049348.exe 2172 v0097665.exe 2112 a3611066.exe 3428 b4949158.exe 332 c4591357.exe -
Processes:
a3611066.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a3611066.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
v0097665.exec7bf75dc5395e5623f80df6f9080632e.exev2255143.exev2049348.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v0097665.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" v0097665.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce c7bf75dc5395e5623f80df6f9080632e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c7bf75dc5395e5623f80df6f9080632e.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v2255143.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v2255143.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v2049348.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v2049348.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
b4949158.exedescription pid process target process PID 3428 set thread context of 2020 3428 b4949158.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1348 3428 WerFault.exe b4949158.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
a3611066.exeAppLaunch.exepid process 2112 a3611066.exe 2112 a3611066.exe 2020 AppLaunch.exe 2020 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
a3611066.exeAppLaunch.exedescription pid process Token: SeDebugPrivilege 2112 a3611066.exe Token: SeDebugPrivilege 2020 AppLaunch.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
c7bf75dc5395e5623f80df6f9080632e.exev2255143.exev2049348.exev0097665.exeb4949158.exedescription pid process target process PID 2472 wrote to memory of 1856 2472 c7bf75dc5395e5623f80df6f9080632e.exe v2255143.exe PID 2472 wrote to memory of 1856 2472 c7bf75dc5395e5623f80df6f9080632e.exe v2255143.exe PID 2472 wrote to memory of 1856 2472 c7bf75dc5395e5623f80df6f9080632e.exe v2255143.exe PID 1856 wrote to memory of 1392 1856 v2255143.exe v2049348.exe PID 1856 wrote to memory of 1392 1856 v2255143.exe v2049348.exe PID 1856 wrote to memory of 1392 1856 v2255143.exe v2049348.exe PID 1392 wrote to memory of 2172 1392 v2049348.exe v0097665.exe PID 1392 wrote to memory of 2172 1392 v2049348.exe v0097665.exe PID 1392 wrote to memory of 2172 1392 v2049348.exe v0097665.exe PID 2172 wrote to memory of 2112 2172 v0097665.exe a3611066.exe PID 2172 wrote to memory of 2112 2172 v0097665.exe a3611066.exe PID 2172 wrote to memory of 3428 2172 v0097665.exe b4949158.exe PID 2172 wrote to memory of 3428 2172 v0097665.exe b4949158.exe PID 2172 wrote to memory of 3428 2172 v0097665.exe b4949158.exe PID 3428 wrote to memory of 2020 3428 b4949158.exe AppLaunch.exe PID 3428 wrote to memory of 2020 3428 b4949158.exe AppLaunch.exe PID 3428 wrote to memory of 2020 3428 b4949158.exe AppLaunch.exe PID 3428 wrote to memory of 2020 3428 b4949158.exe AppLaunch.exe PID 3428 wrote to memory of 2020 3428 b4949158.exe AppLaunch.exe PID 1392 wrote to memory of 332 1392 v2049348.exe c4591357.exe PID 1392 wrote to memory of 332 1392 v2049348.exe c4591357.exe PID 1392 wrote to memory of 332 1392 v2049348.exe c4591357.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7bf75dc5395e5623f80df6f9080632e.exe"C:\Users\Admin\AppData\Local\Temp\c7bf75dc5395e5623f80df6f9080632e.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2255143.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2255143.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2049348.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2049348.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0097665.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0097665.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3611066.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3611066.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4949158.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4949158.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 1406⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c4591357.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c4591357.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3428 -ip 34281⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2255143.exeFilesize
530KB
MD51e2eb71d6374d06c22ddd409dd39b92f
SHA1526871234f41e4cc53f00b7d83d948a5b180501a
SHA2566393b614d0f7738c1407c6d7509bcaaf881ec9aacb3751ab918ecc6ecda10c1d
SHA5123b9a59a92d9934b0c24c30108ff4b8f338e7b63afca1a792485b16cd23281edd7073236de2e08ee3d96b633de5f00ce82f6a5d6f1bddda50f482d46cfa5f916c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2255143.exeFilesize
530KB
MD51e2eb71d6374d06c22ddd409dd39b92f
SHA1526871234f41e4cc53f00b7d83d948a5b180501a
SHA2566393b614d0f7738c1407c6d7509bcaaf881ec9aacb3751ab918ecc6ecda10c1d
SHA5123b9a59a92d9934b0c24c30108ff4b8f338e7b63afca1a792485b16cd23281edd7073236de2e08ee3d96b633de5f00ce82f6a5d6f1bddda50f482d46cfa5f916c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2049348.exeFilesize
357KB
MD579f32459e012e74c3dcecab09feaeea6
SHA16f7bb377cc04cb13a0e5305b8ade3f659bb09359
SHA25602fd420afa66b1e359ab3be8132f1fca41a2f014cdca7b72a9d7d82f193ab265
SHA512f6eb4cb83028a6ed181b707ccca519f69d2eff94d9f8ed1556663b4c7a2ba4d854d61b30328d35aded63487453b1711a6c6ed0131fb9ea5013742f2219db8fb5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2049348.exeFilesize
357KB
MD579f32459e012e74c3dcecab09feaeea6
SHA16f7bb377cc04cb13a0e5305b8ade3f659bb09359
SHA25602fd420afa66b1e359ab3be8132f1fca41a2f014cdca7b72a9d7d82f193ab265
SHA512f6eb4cb83028a6ed181b707ccca519f69d2eff94d9f8ed1556663b4c7a2ba4d854d61b30328d35aded63487453b1711a6c6ed0131fb9ea5013742f2219db8fb5
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c4591357.exeFilesize
172KB
MD5efeda15795430b76be6d0dd1cbeae546
SHA1611e033ee0c8acb3f7be87b44c0d8c6505ba6d1f
SHA256a0adc61062017bf465d20323d11fa8402579e29661dfac9d121464c4833c9c8a
SHA5123f4f4c20249552b8e977beb1ca14a6928c01e8a35f077a6c140979a40ac6372151dd4ddec09e988e43eb4c062397fd7ff461caba7fcd6b5fd633e38646652f74
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c4591357.exeFilesize
172KB
MD5efeda15795430b76be6d0dd1cbeae546
SHA1611e033ee0c8acb3f7be87b44c0d8c6505ba6d1f
SHA256a0adc61062017bf465d20323d11fa8402579e29661dfac9d121464c4833c9c8a
SHA5123f4f4c20249552b8e977beb1ca14a6928c01e8a35f077a6c140979a40ac6372151dd4ddec09e988e43eb4c062397fd7ff461caba7fcd6b5fd633e38646652f74
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0097665.exeFilesize
202KB
MD5719d41434507304244531839da3b1d6e
SHA14a21d1894a07fa47b6c88f952a94864c48015d21
SHA25664e92037bca945179a83b1315bf4074c18cd73c46e0a258587aca2693fea9645
SHA512415293d2898c94eb9d1a5c3564c11eab89834f75e7355bbbbda0b8b90020e9779f344b4dba5ab1c5403eac38689374b39e1034403fa62bdf647265b92834db7d
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0097665.exeFilesize
202KB
MD5719d41434507304244531839da3b1d6e
SHA14a21d1894a07fa47b6c88f952a94864c48015d21
SHA25664e92037bca945179a83b1315bf4074c18cd73c46e0a258587aca2693fea9645
SHA512415293d2898c94eb9d1a5c3564c11eab89834f75e7355bbbbda0b8b90020e9779f344b4dba5ab1c5403eac38689374b39e1034403fa62bdf647265b92834db7d
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3611066.exeFilesize
13KB
MD56f6e9a2d0b0e7c9211b1cc1cbc5faa49
SHA14007f95b24791bf42675b3adf299e042951ec10a
SHA256f23be7c442a3587cb85a0795218763140cd73a3760ace1eb468c11a60b54ab58
SHA5122bf347ad5595de26455c95a9be5992dd7657b13d8697dca58166531ead656bda097f2bb4c0c5b11b5cdd02a5fef9e62731ec0eb7fdbff78fd644556efe6f91c6
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3611066.exeFilesize
13KB
MD56f6e9a2d0b0e7c9211b1cc1cbc5faa49
SHA14007f95b24791bf42675b3adf299e042951ec10a
SHA256f23be7c442a3587cb85a0795218763140cd73a3760ace1eb468c11a60b54ab58
SHA5122bf347ad5595de26455c95a9be5992dd7657b13d8697dca58166531ead656bda097f2bb4c0c5b11b5cdd02a5fef9e62731ec0eb7fdbff78fd644556efe6f91c6
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4949158.exeFilesize
117KB
MD55bdb50ebe74e9f8412240374002665f6
SHA1bb08e2e8e2693fe7a653f4f334dca58a4ec5952f
SHA25684a19044c11539c98b809f4aa1ac71288b853e568acbb35c1b69c06fb3550e1e
SHA512b7a8802c83f12421c75aa7f19d568a89225a6b59b4f11dc7bd6c53cf8dbc93e85fd95278615ec5fe6fd898d64789b7f94b755779c431dc411905dfea17049ef3
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4949158.exeFilesize
117KB
MD55bdb50ebe74e9f8412240374002665f6
SHA1bb08e2e8e2693fe7a653f4f334dca58a4ec5952f
SHA25684a19044c11539c98b809f4aa1ac71288b853e568acbb35c1b69c06fb3550e1e
SHA512b7a8802c83f12421c75aa7f19d568a89225a6b59b4f11dc7bd6c53cf8dbc93e85fd95278615ec5fe6fd898d64789b7f94b755779c431dc411905dfea17049ef3
-
memory/332-175-0x0000000000F20000-0x0000000000F50000-memory.dmpFilesize
192KB
-
memory/332-176-0x0000000005E50000-0x0000000006468000-memory.dmpFilesize
6.1MB
-
memory/332-177-0x0000000005940000-0x0000000005A4A000-memory.dmpFilesize
1.0MB
-
memory/332-178-0x0000000005880000-0x0000000005892000-memory.dmpFilesize
72KB
-
memory/332-179-0x00000000058E0000-0x000000000591C000-memory.dmpFilesize
240KB
-
memory/332-180-0x00000000056E0000-0x00000000056F0000-memory.dmpFilesize
64KB
-
memory/332-182-0x00000000056E0000-0x00000000056F0000-memory.dmpFilesize
64KB
-
memory/2020-167-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2112-161-0x00000000002F0000-0x00000000002FA000-memory.dmpFilesize
40KB