Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
06-06-2023 11:29
Static task
static1
Behavioral task
behavioral1
Sample
01617599.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
01617599.exe
Resource
win10v2004-20230220-en
General
-
Target
01617599.exe
-
Size
735KB
-
MD5
57e9a2f139811a7d7c681a5f6498bdc6
-
SHA1
db8f3271f5d9d7b762c1ccd9621c46e40c7c8be3
-
SHA256
f979c3ad640974fa3e5b64bcb9cb9c02d61476b8b1855930dfdea45f879059c4
-
SHA512
df16a534d1fa2a9ddd0240b038891f990fbfe5a61e87ad00669c46566ffc3c6e826890da2954213d2733059a3b2435a3ae6ddf15e79168edab02037c8b279c7b
-
SSDEEP
12288:nMrgy905eUFEETWFOh6njyM7VTNYd4I8tHP2znIRyX3c9zg0G1IVN6KI:vy+i3WMxTNYSjlUTX3ce0LTI
Malware Config
Extracted
redline
maxi
83.97.73.126:19048
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Signatures
-
Processes:
a5375617.exeAppLaunch.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection a5375617.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a5375617.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a5375617.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a5375617.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a5375617.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a5375617.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 6 IoCs
Processes:
v1132758.exev1273129.exev5683016.exea5375617.exeb2049210.exec4189397.exepid process 2224 v1132758.exe 4892 v1273129.exe 2008 v5683016.exe 4680 a5375617.exe 4980 b2049210.exe 4592 c4189397.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
a5375617.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a5375617.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
v1132758.exev1273129.exev5683016.exe01617599.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v1132758.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v1132758.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v1273129.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v1273129.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v5683016.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" v5683016.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 01617599.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 01617599.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
b2049210.exedescription pid process target process PID 4980 set thread context of 436 4980 b2049210.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1624 4980 WerFault.exe b2049210.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
a5375617.exeAppLaunch.exec4189397.exepid process 4680 a5375617.exe 4680 a5375617.exe 436 AppLaunch.exe 436 AppLaunch.exe 4592 c4189397.exe 4592 c4189397.exe 4592 c4189397.exe 4592 c4189397.exe 4592 c4189397.exe 4592 c4189397.exe 4592 c4189397.exe 4592 c4189397.exe 4592 c4189397.exe 4592 c4189397.exe 4592 c4189397.exe 4592 c4189397.exe 4592 c4189397.exe 4592 c4189397.exe 4592 c4189397.exe 4592 c4189397.exe 4592 c4189397.exe 4592 c4189397.exe 4592 c4189397.exe 4592 c4189397.exe 4592 c4189397.exe 4592 c4189397.exe 4592 c4189397.exe 4592 c4189397.exe 4592 c4189397.exe 4592 c4189397.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
a5375617.exeAppLaunch.exec4189397.exedescription pid process Token: SeDebugPrivilege 4680 a5375617.exe Token: SeDebugPrivilege 436 AppLaunch.exe Token: SeDebugPrivilege 4592 c4189397.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
01617599.exev1132758.exev1273129.exev5683016.exeb2049210.exedescription pid process target process PID 4532 wrote to memory of 2224 4532 01617599.exe v1132758.exe PID 4532 wrote to memory of 2224 4532 01617599.exe v1132758.exe PID 4532 wrote to memory of 2224 4532 01617599.exe v1132758.exe PID 2224 wrote to memory of 4892 2224 v1132758.exe v1273129.exe PID 2224 wrote to memory of 4892 2224 v1132758.exe v1273129.exe PID 2224 wrote to memory of 4892 2224 v1132758.exe v1273129.exe PID 4892 wrote to memory of 2008 4892 v1273129.exe v5683016.exe PID 4892 wrote to memory of 2008 4892 v1273129.exe v5683016.exe PID 4892 wrote to memory of 2008 4892 v1273129.exe v5683016.exe PID 2008 wrote to memory of 4680 2008 v5683016.exe a5375617.exe PID 2008 wrote to memory of 4680 2008 v5683016.exe a5375617.exe PID 2008 wrote to memory of 4980 2008 v5683016.exe b2049210.exe PID 2008 wrote to memory of 4980 2008 v5683016.exe b2049210.exe PID 2008 wrote to memory of 4980 2008 v5683016.exe b2049210.exe PID 4980 wrote to memory of 436 4980 b2049210.exe AppLaunch.exe PID 4980 wrote to memory of 436 4980 b2049210.exe AppLaunch.exe PID 4980 wrote to memory of 436 4980 b2049210.exe AppLaunch.exe PID 4980 wrote to memory of 436 4980 b2049210.exe AppLaunch.exe PID 4980 wrote to memory of 436 4980 b2049210.exe AppLaunch.exe PID 4892 wrote to memory of 4592 4892 v1273129.exe c4189397.exe PID 4892 wrote to memory of 4592 4892 v1273129.exe c4189397.exe PID 4892 wrote to memory of 4592 4892 v1273129.exe c4189397.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\01617599.exe"C:\Users\Admin\AppData\Local\Temp\01617599.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1132758.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1132758.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1273129.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1273129.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5683016.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5683016.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a5375617.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a5375617.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b2049210.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b2049210.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 1526⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c4189397.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c4189397.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4980 -ip 49801⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1132758.exeFilesize
532KB
MD5a66457c197433fd924f3772a19317778
SHA1af03349e2d3fe075d68415ca04fc75ca543b1a8b
SHA256ca82a9197f35e6c276c2d3878f982df03bbe2b93eb4ba9607f924741dde4a091
SHA51223b0bb3df9c26db0bbb18151eb0bc224a7c6e1a6dff7ad7d76b9179797cd0e0c662a08c750a941759e3887bde939de9c3a5640ae20bc22230ccefdf1413f992d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1132758.exeFilesize
532KB
MD5a66457c197433fd924f3772a19317778
SHA1af03349e2d3fe075d68415ca04fc75ca543b1a8b
SHA256ca82a9197f35e6c276c2d3878f982df03bbe2b93eb4ba9607f924741dde4a091
SHA51223b0bb3df9c26db0bbb18151eb0bc224a7c6e1a6dff7ad7d76b9179797cd0e0c662a08c750a941759e3887bde939de9c3a5640ae20bc22230ccefdf1413f992d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1273129.exeFilesize
359KB
MD52cd02464adebffc760345e84d163c0e4
SHA175eaff25dbba4ee0aea1bfcf4631ee5cf3bc3a9e
SHA256bc2ecff2590011ba7c2a6f042c0a2222a45d41c258ad2c3aeefc3487315565b4
SHA51296060dedec69e741137394175f8e688bb64304d45865bc7667e0537b9b63bd47fc4a1390034aa1045a4c63be3e656ceefcb07b3566fa83f72e701641343f45ff
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1273129.exeFilesize
359KB
MD52cd02464adebffc760345e84d163c0e4
SHA175eaff25dbba4ee0aea1bfcf4631ee5cf3bc3a9e
SHA256bc2ecff2590011ba7c2a6f042c0a2222a45d41c258ad2c3aeefc3487315565b4
SHA51296060dedec69e741137394175f8e688bb64304d45865bc7667e0537b9b63bd47fc4a1390034aa1045a4c63be3e656ceefcb07b3566fa83f72e701641343f45ff
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c4189397.exeFilesize
172KB
MD523f206b50f60690a383ce7a0f51556ea
SHA127935a3a0f8eab965d69303c4301afaf7883cf05
SHA256e8ccfd769c0767b0b990515cd118bb79c6b604ff5b17363aeb0aa4461b5fcc0f
SHA5124cf99256bb08873be8329d5dcd3ca3950d708f64b3f69ae58562c70e6b217e561afc0ff4e1f74db99cfed4cc06caed90354f94c1b8edf2a7935d931b7dfeb046
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c4189397.exeFilesize
172KB
MD523f206b50f60690a383ce7a0f51556ea
SHA127935a3a0f8eab965d69303c4301afaf7883cf05
SHA256e8ccfd769c0767b0b990515cd118bb79c6b604ff5b17363aeb0aa4461b5fcc0f
SHA5124cf99256bb08873be8329d5dcd3ca3950d708f64b3f69ae58562c70e6b217e561afc0ff4e1f74db99cfed4cc06caed90354f94c1b8edf2a7935d931b7dfeb046
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5683016.exeFilesize
204KB
MD51cc216115031acff5f95ba5ae5ede605
SHA15f785e24ba8a6c206f583545ae683466e3d63e57
SHA256099dd80c4e3be2096a5f013289136d746396cc3ffaee17a056aea9a1459c443d
SHA512c9620c0aaf7cb755c12462fca0cfb70985d34524ed0fdc9e37cf3cc256b71502823be31a20f680f3142a95406102e8ea377289dccaf1ee7ff676a4dd5c24e509
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5683016.exeFilesize
204KB
MD51cc216115031acff5f95ba5ae5ede605
SHA15f785e24ba8a6c206f583545ae683466e3d63e57
SHA256099dd80c4e3be2096a5f013289136d746396cc3ffaee17a056aea9a1459c443d
SHA512c9620c0aaf7cb755c12462fca0cfb70985d34524ed0fdc9e37cf3cc256b71502823be31a20f680f3142a95406102e8ea377289dccaf1ee7ff676a4dd5c24e509
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a5375617.exeFilesize
13KB
MD56a5f8d8d67730a5d20c4306d53f66ca2
SHA15645f127049ef4ced9469724117609938fd250c7
SHA25634c237a06d81f1b41dc499a791ea9b41c8e75ddac46247337bf114af256a3a47
SHA512068efc44ec09af899f6646813d8ac4cbb4ca426980f671cbd8791daeed9855d6a54f6f9689bbe0d6aa3cc2cd2632179ba18dcbde6f7eaba869d2d883e7cb18bf
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a5375617.exeFilesize
13KB
MD56a5f8d8d67730a5d20c4306d53f66ca2
SHA15645f127049ef4ced9469724117609938fd250c7
SHA25634c237a06d81f1b41dc499a791ea9b41c8e75ddac46247337bf114af256a3a47
SHA512068efc44ec09af899f6646813d8ac4cbb4ca426980f671cbd8791daeed9855d6a54f6f9689bbe0d6aa3cc2cd2632179ba18dcbde6f7eaba869d2d883e7cb18bf
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b2049210.exeFilesize
120KB
MD5765ac1e3c70538f9d7b7f48fc7d79bcf
SHA1d78dcb51efb38d5baae2f701a273b6e49d093384
SHA25609a709644e41207462c99bdc1c75e7ff33530d3796ae9a46dbf948b786d23377
SHA512416d04e4137399287b3d56d042f4753d145baa2aa33242f49476bcd7ae6a603b9f30a72c01a5832583b66e6cc52f6212b27f399a1c0bae80abbb6cda789bc68a
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b2049210.exeFilesize
120KB
MD5765ac1e3c70538f9d7b7f48fc7d79bcf
SHA1d78dcb51efb38d5baae2f701a273b6e49d093384
SHA25609a709644e41207462c99bdc1c75e7ff33530d3796ae9a46dbf948b786d23377
SHA512416d04e4137399287b3d56d042f4753d145baa2aa33242f49476bcd7ae6a603b9f30a72c01a5832583b66e6cc52f6212b27f399a1c0bae80abbb6cda789bc68a
-
memory/436-167-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/4592-175-0x00000000007F0000-0x0000000000820000-memory.dmpFilesize
192KB
-
memory/4592-181-0x000000000A8E0000-0x000000000A956000-memory.dmpFilesize
472KB
-
memory/4592-176-0x000000000AAB0000-0x000000000B0C8000-memory.dmpFilesize
6.1MB
-
memory/4592-177-0x000000000A630000-0x000000000A73A000-memory.dmpFilesize
1.0MB
-
memory/4592-178-0x000000000A570000-0x000000000A582000-memory.dmpFilesize
72KB
-
memory/4592-179-0x000000000A5D0000-0x000000000A60C000-memory.dmpFilesize
240KB
-
memory/4592-180-0x00000000050E0000-0x00000000050F0000-memory.dmpFilesize
64KB
-
memory/4592-189-0x00000000050E0000-0x00000000050F0000-memory.dmpFilesize
64KB
-
memory/4592-182-0x000000000AA00000-0x000000000AA92000-memory.dmpFilesize
584KB
-
memory/4592-183-0x000000000B680000-0x000000000BC24000-memory.dmpFilesize
5.6MB
-
memory/4592-184-0x000000000B1D0000-0x000000000B236000-memory.dmpFilesize
408KB
-
memory/4592-186-0x000000000BC30000-0x000000000BC80000-memory.dmpFilesize
320KB
-
memory/4592-187-0x000000000BE50000-0x000000000C012000-memory.dmpFilesize
1.8MB
-
memory/4592-188-0x000000000C550000-0x000000000CA7C000-memory.dmpFilesize
5.2MB
-
memory/4680-161-0x0000000000EB0000-0x0000000000EBA000-memory.dmpFilesize
40KB