Analysis
-
max time kernel
291s -
max time network
305s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system -
submitted
19-09-2023 06:53
Static task
static1
Behavioral task
behavioral1
Sample
x5182030.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
x5182030.exe
Resource
win10-20230915-en
General
-
Target
x5182030.exe
-
Size
326KB
-
MD5
11924a7c6b34d401fce9a0289a495d90
-
SHA1
7e07aa42127ad4e83b4db9988d42f36229275c72
-
SHA256
b610208386aff19bb310792255e5022f47fc360015fde0da73df201153ae013d
-
SHA512
1d1501b04e60ac2e2ebd31a9ec8d62690f556ad4f7b1e3aa7ca822ac8137dc7ae04f8c06e404798973e487f17930fac08237e6329ae0d860a6d3d27218931fb1
-
SSDEEP
6144:K7y+bnr+4p0yN90QErBzQZI0aFkyxWAQh17NpZKE+ShX8yd27JALErj7:pMrYy908xahxWTTxq2X8yUJALEL
Malware Config
Extracted
redline
black
77.91.124.82:19071
-
auth_value
c5887216cebc5a219113738140bc3047
Signatures
-
Detects Healer an antivirus disabler dropper 1 IoCs
Processes:
resource yara_rule behavioral2/memory/784-7-0x0000000000400000-0x000000000040A000-memory.dmp healer -
Processes:
AppLaunch.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 2 IoCs
Processes:
g6429604.exeh4643382.exepid process 4908 g6429604.exe 928 h4643382.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
x5182030.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" x5182030.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
g6429604.exedescription pid process target process PID 4908 set thread context of 784 4908 g6429604.exe AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 784 AppLaunch.exe 784 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 784 AppLaunch.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
x5182030.exeg6429604.exedescription pid process target process PID 3048 wrote to memory of 4908 3048 x5182030.exe g6429604.exe PID 3048 wrote to memory of 4908 3048 x5182030.exe g6429604.exe PID 3048 wrote to memory of 4908 3048 x5182030.exe g6429604.exe PID 4908 wrote to memory of 784 4908 g6429604.exe AppLaunch.exe PID 4908 wrote to memory of 784 4908 g6429604.exe AppLaunch.exe PID 4908 wrote to memory of 784 4908 g6429604.exe AppLaunch.exe PID 4908 wrote to memory of 784 4908 g6429604.exe AppLaunch.exe PID 4908 wrote to memory of 784 4908 g6429604.exe AppLaunch.exe PID 4908 wrote to memory of 784 4908 g6429604.exe AppLaunch.exe PID 4908 wrote to memory of 784 4908 g6429604.exe AppLaunch.exe PID 4908 wrote to memory of 784 4908 g6429604.exe AppLaunch.exe PID 3048 wrote to memory of 928 3048 x5182030.exe h4643382.exe PID 3048 wrote to memory of 928 3048 x5182030.exe h4643382.exe PID 3048 wrote to memory of 928 3048 x5182030.exe h4643382.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\x5182030.exe"C:\Users\Admin\AppData\Local\Temp\x5182030.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g6429604.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g6429604.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h4643382.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h4643382.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g6429604.exeFilesize
242KB
MD58989f700c821326027fe2fe0f49e5377
SHA142caa5229b3098681604d0ef16959b4bf0bbb4c2
SHA256f083e0adfc6196b5a9eff007132b1bbce34ff64ea672a9aebe64ed0bcf745421
SHA5122405054d42419eacc4e4ee9630e80a146e3a359a22152ad7d49098aac72691b218db1c3085a3d4b5ac604ddc874bc8369719f8e0ad126f6b1c4abdcfcfb2e368
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g6429604.exeFilesize
242KB
MD58989f700c821326027fe2fe0f49e5377
SHA142caa5229b3098681604d0ef16959b4bf0bbb4c2
SHA256f083e0adfc6196b5a9eff007132b1bbce34ff64ea672a9aebe64ed0bcf745421
SHA5122405054d42419eacc4e4ee9630e80a146e3a359a22152ad7d49098aac72691b218db1c3085a3d4b5ac604ddc874bc8369719f8e0ad126f6b1c4abdcfcfb2e368
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h4643382.exeFilesize
174KB
MD51827ae586ad2402dc0adc144a7669594
SHA17c4c2a6be7c2cb469e0ca47d971957620938edea
SHA2560429a60d41dd59931c21923cfaf7158b5678f26d4cd8b2832ba200487a17ab78
SHA5120d20f12df977497f7959a22a5568bc5b681f2e7caad0c6014f19c5a70d49b1ee56e5bf548a3679ce51618d687c68975565ae13a2e1808ba64329d25d6a13f71e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h4643382.exeFilesize
174KB
MD51827ae586ad2402dc0adc144a7669594
SHA17c4c2a6be7c2cb469e0ca47d971957620938edea
SHA2560429a60d41dd59931c21923cfaf7158b5678f26d4cd8b2832ba200487a17ab78
SHA5120d20f12df977497f7959a22a5568bc5b681f2e7caad0c6014f19c5a70d49b1ee56e5bf548a3679ce51618d687c68975565ae13a2e1808ba64329d25d6a13f71e
-
memory/784-7-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/784-46-0x00000000739F0000-0x00000000740DE000-memory.dmpFilesize
6.9MB
-
memory/784-15-0x00000000739F0000-0x00000000740DE000-memory.dmpFilesize
6.9MB
-
memory/784-31-0x00000000739F0000-0x00000000740DE000-memory.dmpFilesize
6.9MB
-
memory/928-17-0x0000000004E60000-0x0000000004E66000-memory.dmpFilesize
24KB
-
memory/928-18-0x000000000A930000-0x000000000AF36000-memory.dmpFilesize
6.0MB
-
memory/928-19-0x000000000A4B0000-0x000000000A5BA000-memory.dmpFilesize
1.0MB
-
memory/928-20-0x000000000A3E0000-0x000000000A3F2000-memory.dmpFilesize
72KB
-
memory/928-21-0x000000000A440000-0x000000000A47E000-memory.dmpFilesize
248KB
-
memory/928-22-0x000000000A5C0000-0x000000000A60B000-memory.dmpFilesize
300KB
-
memory/928-16-0x00000000739F0000-0x00000000740DE000-memory.dmpFilesize
6.9MB
-
memory/928-14-0x00000000006A0000-0x00000000006D0000-memory.dmpFilesize
192KB
-
memory/928-47-0x00000000739F0000-0x00000000740DE000-memory.dmpFilesize
6.9MB