Analysis

  • max time kernel
    52s
  • max time network
    54s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    13-02-2023 06:34

General

  • Target

    dbe58be8dd1d29b95b29470bded895eb4e56de9c8d0f78d556f5a97d19552738.exe

  • Size

    481KB

  • MD5

    e44976bdb0218ad9048d8653f29ceb04

  • SHA1

    27016d7d97f0d48c44dc6b40644ba4534601d297

  • SHA256

    dbe58be8dd1d29b95b29470bded895eb4e56de9c8d0f78d556f5a97d19552738

  • SHA512

    e611e9492a29c7fff80270df923e369bb3d233797a7ea987966a93fa93e4734dcb6075c90810c79a4abb3505704188aa0cf10260a998dd2fd24ab4a019ff17fb

  • SSDEEP

    12288:tMrOy90Ou9D1WactFEZlbpV48QOoUbhGi:Tyfu9BrctFEr4c5

Malware Config

Extracted

Family

redline

Botnet

fusa

C2

193.233.20.12:4132

Attributes
  • auth_value

    a08b2f01bd2af756e38c5dd60e87e697

Extracted

Family

redline

Botnet

crnn

C2

176.113.115.17:4132

Attributes
  • auth_value

    6dfbf5eac3db7046d55dfd3f6608be3f

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dbe58be8dd1d29b95b29470bded895eb4e56de9c8d0f78d556f5a97d19552738.exe
    "C:\Users\Admin\AppData\Local\Temp\dbe58be8dd1d29b95b29470bded895eb4e56de9c8d0f78d556f5a97d19552738.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2248
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nqH64.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nqH64.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2108
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bBm62.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bBm62.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2272
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cbW01MY.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cbW01MY.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3324
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dmG78.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dmG78.exe
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Executes dropped EXE
      • Windows security modification
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4776

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dmG78.exe

    Filesize

    248KB

    MD5

    bff8038cbd0298ace77dfd5c5a4249c2

    SHA1

    390f91519cbdf582e2495948bd436bbb5e534c46

    SHA256

    c2edd540118d2586ebd7e518d56577536afddd67f8524f547195e152ed806ef4

    SHA512

    9fdab976c4cbbffe68d057d50139d2e2c492aa9825c9a11d35d83ca046d3c7f546a5628f2f5b406cd4f601ac1724af121ca02e2d96cc8843266006d70f3f2ab5

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dmG78.exe

    Filesize

    248KB

    MD5

    bff8038cbd0298ace77dfd5c5a4249c2

    SHA1

    390f91519cbdf582e2495948bd436bbb5e534c46

    SHA256

    c2edd540118d2586ebd7e518d56577536afddd67f8524f547195e152ed806ef4

    SHA512

    9fdab976c4cbbffe68d057d50139d2e2c492aa9825c9a11d35d83ca046d3c7f546a5628f2f5b406cd4f601ac1724af121ca02e2d96cc8843266006d70f3f2ab5

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nqH64.exe

    Filesize

    200KB

    MD5

    d14397e2b26effeb9a59f3d62b050f48

    SHA1

    797ef467ccb80f04845798bd641b7f7cd9f4396d

    SHA256

    e078e56bf0989a99b6d7303b7961e65669e0e35808f8b4e3c925084b1df263e4

    SHA512

    fbbd3cec21e723798dbd15fde0351f073454febfb827923b2c3228765a8c9f7fb8e9061e3b54d1124832c048d8fdbe27a6d886143d9c60d139bc28fd0b5db3f0

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nqH64.exe

    Filesize

    200KB

    MD5

    d14397e2b26effeb9a59f3d62b050f48

    SHA1

    797ef467ccb80f04845798bd641b7f7cd9f4396d

    SHA256

    e078e56bf0989a99b6d7303b7961e65669e0e35808f8b4e3c925084b1df263e4

    SHA512

    fbbd3cec21e723798dbd15fde0351f073454febfb827923b2c3228765a8c9f7fb8e9061e3b54d1124832c048d8fdbe27a6d886143d9c60d139bc28fd0b5db3f0

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bBm62.exe

    Filesize

    175KB

    MD5

    da6f3bef8abc85bd09f50783059964e3

    SHA1

    a0f25f60ec1896c4c920ea397f40e6ce29724322

    SHA256

    e6d9ee8ab0ea2ade6e5a9481d8f0f921427ec6919b1b48c6067570fde270736b

    SHA512

    4d2e1472b114c98c74900b8305aabbc49ba28edffdc2376206cf02e26593df4e444933b3aa19f0c6cd0ae3ac3133d656433574aaf25a57748758e5dd25edfbec

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bBm62.exe

    Filesize

    175KB

    MD5

    da6f3bef8abc85bd09f50783059964e3

    SHA1

    a0f25f60ec1896c4c920ea397f40e6ce29724322

    SHA256

    e6d9ee8ab0ea2ade6e5a9481d8f0f921427ec6919b1b48c6067570fde270736b

    SHA512

    4d2e1472b114c98c74900b8305aabbc49ba28edffdc2376206cf02e26593df4e444933b3aa19f0c6cd0ae3ac3133d656433574aaf25a57748758e5dd25edfbec

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cbW01MY.exe

    Filesize

    175KB

    MD5

    062a3c73b1aaf076abefd71633b66de5

    SHA1

    e4b7e004c32d673fd61b1669c797dc4b207d8445

    SHA256

    f281aafa876847194d635feddb06b11295249cc4bcf940d5246bdb5938410881

    SHA512

    6bee4020fa8e4955b3028a71037f78ec922132009942283e071b3acdeea375300cef092fd692e9463d625065d5ef57e5e1ebd98f72e801ffc2178c071d645ec3

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cbW01MY.exe

    Filesize

    175KB

    MD5

    062a3c73b1aaf076abefd71633b66de5

    SHA1

    e4b7e004c32d673fd61b1669c797dc4b207d8445

    SHA256

    f281aafa876847194d635feddb06b11295249cc4bcf940d5246bdb5938410881

    SHA512

    6bee4020fa8e4955b3028a71037f78ec922132009942283e071b3acdeea375300cef092fd692e9463d625065d5ef57e5e1ebd98f72e801ffc2178c071d645ec3

  • memory/2108-176-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2108-174-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2108-181-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2108-180-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2108-179-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2108-178-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2108-177-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2108-183-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2108-175-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2108-182-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2108-184-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2108-173-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2108-171-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2108-170-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2108-164-0x0000000000000000-mapping.dmp

  • memory/2108-166-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2108-169-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2108-168-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2108-167-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-142-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-129-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-147-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-148-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-149-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-150-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-151-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-152-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-153-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-154-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-155-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-157-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-158-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-156-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-159-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-160-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-161-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-162-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-163-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-145-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-144-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-143-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-118-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-141-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-140-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-139-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-137-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-138-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-136-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-135-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-134-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-133-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-132-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-131-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-130-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-146-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-128-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-127-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-126-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-125-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-119-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-124-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-123-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-120-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-121-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2248-122-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2272-299-0x0000000007930000-0x00000000079A6000-memory.dmp

    Filesize

    472KB

  • memory/2272-263-0x00000000008D0000-0x0000000000902000-memory.dmp

    Filesize

    200KB

  • memory/2272-283-0x0000000005310000-0x000000000535B000-memory.dmp

    Filesize

    300KB

  • memory/2272-287-0x00000000054F0000-0x0000000005582000-memory.dmp

    Filesize

    584KB

  • memory/2272-288-0x00000000061D0000-0x00000000066CE000-memory.dmp

    Filesize

    5.0MB

  • memory/2272-291-0x0000000005590000-0x00000000055F6000-memory.dmp

    Filesize

    408KB

  • memory/2272-281-0x0000000005190000-0x00000000051CE000-memory.dmp

    Filesize

    248KB

  • memory/2272-300-0x0000000006160000-0x00000000061B0000-memory.dmp

    Filesize

    320KB

  • memory/2272-279-0x0000000005130000-0x0000000005142000-memory.dmp

    Filesize

    72KB

  • memory/2272-302-0x0000000008280000-0x00000000087AC000-memory.dmp

    Filesize

    5.2MB

  • memory/2272-301-0x0000000007B80000-0x0000000007D42000-memory.dmp

    Filesize

    1.8MB

  • memory/2272-277-0x0000000005200000-0x000000000530A000-memory.dmp

    Filesize

    1.0MB

  • memory/2272-276-0x00000000056C0000-0x0000000005CC6000-memory.dmp

    Filesize

    6.0MB

  • memory/2272-213-0x0000000000000000-mapping.dmp

  • memory/3324-310-0x0000000000000000-mapping.dmp

  • memory/3324-360-0x0000000000130000-0x0000000000162000-memory.dmp

    Filesize

    200KB

  • memory/4776-395-0x0000000000000000-mapping.dmp

  • memory/4776-452-0x00000000023A0000-0x00000000023BA000-memory.dmp

    Filesize

    104KB

  • memory/4776-457-0x0000000002640000-0x0000000002658000-memory.dmp

    Filesize

    96KB

  • memory/4776-460-0x0000000000620000-0x000000000076A000-memory.dmp

    Filesize

    1.3MB

  • memory/4776-461-0x0000000000570000-0x000000000059D000-memory.dmp

    Filesize

    180KB

  • memory/4776-462-0x0000000000400000-0x000000000056E000-memory.dmp

    Filesize

    1.4MB

  • memory/4776-464-0x0000000000400000-0x000000000056E000-memory.dmp

    Filesize

    1.4MB