Analysis

  • max time kernel
    91s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/02/2023, 08:47

General

  • Target

    0bead0cdef80c6f14d2886f577edaa1b9d81e7e254ba63d3d5667f10293edb2f.exe

  • Size

    770KB

  • MD5

    1e226692b2d5423e50a51bea02971818

  • SHA1

    6372899359638d4440876a6e6c5c2541401241bf

  • SHA256

    0bead0cdef80c6f14d2886f577edaa1b9d81e7e254ba63d3d5667f10293edb2f

  • SHA512

    fbcc06dce71e538d17a13d9d6d41b80b3c1f8ee3d03f81c5f2f461283dcbd6bedca32a60bd4bc8c09be36021afc4c3531d1d2264129779988fe59599a040a90b

  • SSDEEP

    24576:LyiCSIPlQjAmLRNtLh0o/IhSdi6ZHB9Z:+hlkASDXy16ZB9

Malware Config

Extracted

Family

redline

Botnet

cr2

C2

176.113.115.17:4132

Attributes
  • auth_value

    4bf573d6f5ab16f3b5e36da6855dc128

Extracted

Family

redline

Botnet

dunm

C2

193.233.20.12:4132

Attributes
  • auth_value

    352959e3707029296ec94306d74e2334

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0bead0cdef80c6f14d2886f577edaa1b9d81e7e254ba63d3d5667f10293edb2f.exe
    "C:\Users\Admin\AppData\Local\Temp\0bead0cdef80c6f14d2886f577edaa1b9d81e7e254ba63d3d5667f10293edb2f.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2800
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vYx49.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vYx49.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4232
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vbc55.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vbc55.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:988
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dwM92.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dwM92.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2576
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 1352
            5⤵
            • Program crash
            PID:4876
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lCW04.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lCW04.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:3948
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2872
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nIY14.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nIY14.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4628
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svA90.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svA90.exe
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Executes dropped EXE
      • Windows security modification
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3588
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2576 -ip 2576
    1⤵
      PID:4392

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svA90.exe

      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svA90.exe

      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vYx49.exe

      Filesize

      666KB

      MD5

      834257b7abd368047bb5e7191cb18466

      SHA1

      5f6d29b699b26dca4088a8cd93a57ee3d8957934

      SHA256

      ff84bb2e31dea5749f7699f5f6bc4601aa4f74b01f383db17c423c11f269e186

      SHA512

      b5f5e6f2ff500585cbf1b8290377bede06e9308414ed4998b7e08ffa67538ddfd3bd0cf9be5b158c99ff491a5ef1a49b3a67c7a8e296ec07b5021ac5147d009c

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vYx49.exe

      Filesize

      666KB

      MD5

      834257b7abd368047bb5e7191cb18466

      SHA1

      5f6d29b699b26dca4088a8cd93a57ee3d8957934

      SHA256

      ff84bb2e31dea5749f7699f5f6bc4601aa4f74b01f383db17c423c11f269e186

      SHA512

      b5f5e6f2ff500585cbf1b8290377bede06e9308414ed4998b7e08ffa67538ddfd3bd0cf9be5b158c99ff491a5ef1a49b3a67c7a8e296ec07b5021ac5147d009c

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nIY14.exe

      Filesize

      175KB

      MD5

      69f79e05d0c83aee310d9adfe5aa7f2b

      SHA1

      485c490180380051a14316564fbda07723be11b1

      SHA256

      c41dc7f6cc752595337cd7f209f923b43b061b201c6ab4dc02151afb90cd66e2

      SHA512

      f1789a74aeb83867c37ddeadcd06cddfc1454a94fcc122b35d67b0309b46742b9a6611e4c3e583baa90a3fd456e45c75ae5f1a206f6e4500c1f3f8ddf5e47b42

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nIY14.exe

      Filesize

      175KB

      MD5

      69f79e05d0c83aee310d9adfe5aa7f2b

      SHA1

      485c490180380051a14316564fbda07723be11b1

      SHA256

      c41dc7f6cc752595337cd7f209f923b43b061b201c6ab4dc02151afb90cd66e2

      SHA512

      f1789a74aeb83867c37ddeadcd06cddfc1454a94fcc122b35d67b0309b46742b9a6611e4c3e583baa90a3fd456e45c75ae5f1a206f6e4500c1f3f8ddf5e47b42

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vbc55.exe

      Filesize

      521KB

      MD5

      f76b7d591680121f0e4859decaad4d96

      SHA1

      74f5431a449dc97aff47a2e3a37a1d658355a108

      SHA256

      15795e52a2230ed68cdf2e7e951bebf73567a3f295bea6108223c0b2838e2c20

      SHA512

      4042eec1349378828650ca244326021a79104343652e49bf8ad14d13c0b370d43482bbd17409f1c500c03a95c3b15183b38bb60cf31074943e0869f7d5d61a39

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vbc55.exe

      Filesize

      521KB

      MD5

      f76b7d591680121f0e4859decaad4d96

      SHA1

      74f5431a449dc97aff47a2e3a37a1d658355a108

      SHA256

      15795e52a2230ed68cdf2e7e951bebf73567a3f295bea6108223c0b2838e2c20

      SHA512

      4042eec1349378828650ca244326021a79104343652e49bf8ad14d13c0b370d43482bbd17409f1c500c03a95c3b15183b38bb60cf31074943e0869f7d5d61a39

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dwM92.exe

      Filesize

      306KB

      MD5

      921ae22af4e5bcbbba6eeac357e87cdc

      SHA1

      fe565744533a2c245ae97f1f96971e6618439867

      SHA256

      c0f241a8d18844f41622cde61dc532a31249f2ea6af1ed23ad0f83df4c95bc21

      SHA512

      923b394378e9c6df6c101a7d134a7c8c931bb8fabe744df002fa2d49bb6c35e1b4ea0ea9ed6e70384cf6205561c3816c83e55592e4305ccde653a76e98e61514

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dwM92.exe

      Filesize

      306KB

      MD5

      921ae22af4e5bcbbba6eeac357e87cdc

      SHA1

      fe565744533a2c245ae97f1f96971e6618439867

      SHA256

      c0f241a8d18844f41622cde61dc532a31249f2ea6af1ed23ad0f83df4c95bc21

      SHA512

      923b394378e9c6df6c101a7d134a7c8c931bb8fabe744df002fa2d49bb6c35e1b4ea0ea9ed6e70384cf6205561c3816c83e55592e4305ccde653a76e98e61514

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lCW04.exe

      Filesize

      281KB

      MD5

      4f7302c3f372c146e2dd87a7ea481f31

      SHA1

      c1f39c30a4138440399ae1c566cd414b2a4dd459

      SHA256

      6c9f8de22f30f2d8ddf1fa04c975d2832f6455e546a5ac1e923e76016ffa66e3

      SHA512

      a9a355bef77e741cb4b5040480960e0509d5c2ebcc866ad81a448bd24096fafa4962d02f76f365f8714bb8f41bbff28320566ce049746e3857c4353029140312

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lCW04.exe

      Filesize

      281KB

      MD5

      4f7302c3f372c146e2dd87a7ea481f31

      SHA1

      c1f39c30a4138440399ae1c566cd414b2a4dd459

      SHA256

      6c9f8de22f30f2d8ddf1fa04c975d2832f6455e546a5ac1e923e76016ffa66e3

      SHA512

      a9a355bef77e741cb4b5040480960e0509d5c2ebcc866ad81a448bd24096fafa4962d02f76f365f8714bb8f41bbff28320566ce049746e3857c4353029140312

    • memory/2576-152-0x00000000066D0000-0x0000000006720000-memory.dmp

      Filesize

      320KB

    • memory/2576-156-0x00000000006E1000-0x000000000070F000-memory.dmp

      Filesize

      184KB

    • memory/2576-147-0x0000000002860000-0x0000000002872000-memory.dmp

      Filesize

      72KB

    • memory/2576-148-0x0000000005AB0000-0x0000000005AEC000-memory.dmp

      Filesize

      240KB

    • memory/2576-149-0x0000000005DA0000-0x0000000005E32000-memory.dmp

      Filesize

      584KB

    • memory/2576-150-0x0000000005E40000-0x0000000005EA6000-memory.dmp

      Filesize

      408KB

    • memory/2576-151-0x0000000006640000-0x00000000066B6000-memory.dmp

      Filesize

      472KB

    • memory/2576-141-0x0000000004CD0000-0x0000000005274000-memory.dmp

      Filesize

      5.6MB

    • memory/2576-153-0x00000000006E1000-0x000000000070F000-memory.dmp

      Filesize

      184KB

    • memory/2576-154-0x0000000006A00000-0x0000000006BC2000-memory.dmp

      Filesize

      1.8MB

    • memory/2576-155-0x0000000006BD0000-0x00000000070FC000-memory.dmp

      Filesize

      5.2MB

    • memory/2576-157-0x0000000000400000-0x000000000057D000-memory.dmp

      Filesize

      1.5MB

    • memory/2576-146-0x00000000059A0000-0x0000000005AAA000-memory.dmp

      Filesize

      1.0MB

    • memory/2576-145-0x0000000005380000-0x0000000005998000-memory.dmp

      Filesize

      6.1MB

    • memory/2576-144-0x0000000000400000-0x000000000057D000-memory.dmp

      Filesize

      1.5MB

    • memory/2576-142-0x00000000006E1000-0x000000000070F000-memory.dmp

      Filesize

      184KB

    • memory/2576-143-0x0000000000580000-0x00000000005CB000-memory.dmp

      Filesize

      300KB

    • memory/2872-162-0x0000000000400000-0x0000000000432000-memory.dmp

      Filesize

      200KB

    • memory/3588-175-0x00007FFC13360000-0x00007FFC13E21000-memory.dmp

      Filesize

      10.8MB

    • memory/3588-174-0x00000000005D0000-0x00000000005DA000-memory.dmp

      Filesize

      40KB

    • memory/3588-176-0x00007FFC13360000-0x00007FFC13E21000-memory.dmp

      Filesize

      10.8MB

    • memory/4628-170-0x0000000000930000-0x0000000000962000-memory.dmp

      Filesize

      200KB