Resubmissions

29/10/2024, 12:21

241029-pjbl2avgmf 10

13/02/2023, 15:09

230213-sjg1lade2v 10

Analysis

  • max time kernel
    56s
  • max time network
    146s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    13/02/2023, 15:09

General

  • Target

    dc013bb782e3ceeec5507ea108401b66a55ec30f435751350fe8c4dbc7cb9095.exe

  • Size

    474KB

  • MD5

    0132924603f08693b2754365a1982cfc

  • SHA1

    c8f9a90879c88c0b999cb38331e4e44c99aec1dc

  • SHA256

    dc013bb782e3ceeec5507ea108401b66a55ec30f435751350fe8c4dbc7cb9095

  • SHA512

    9b2509a77ac24ee82933e9e093ead9418c8f80dc3bd168231350cc17f675b208e9ce6339a386d8dca9423fd3bb9df8a164c0ccb4fbff52f97a256d4b1d0315a1

  • SSDEEP

    6144:Kgy+bnr+Wp0yN90QEt/ooX0LQZ2XvSDsRI1XUUhZzOpH4al9w2z5EF33Oevl9jCq:sMruy90Ld86DsYhZGvOF3/d9jCq

Malware Config

Extracted

Family

redline

Botnet

fusa

C2

193.233.20.12:4132

Attributes
  • auth_value

    a08b2f01bd2af756e38c5dd60e87e697

Extracted

Family

redline

Botnet

crnn

C2

176.113.115.17:4132

Attributes
  • auth_value

    6dfbf5eac3db7046d55dfd3f6608be3f

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dc013bb782e3ceeec5507ea108401b66a55ec30f435751350fe8c4dbc7cb9095.exe
    "C:\Users\Admin\AppData\Local\Temp\dc013bb782e3ceeec5507ea108401b66a55ec30f435751350fe8c4dbc7cb9095.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2360
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nCV34.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nCV34.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4556
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bqD98.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bqD98.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1416
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cvn13CS.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cvn13CS.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2928
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dJD11.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dJD11.exe
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Executes dropped EXE
      • Windows security modification
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4724

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dJD11.exe

          Filesize

          235KB

          MD5

          1dfaea61e3959f902a94287e95ee6824

          SHA1

          a303be2ea1744692c8bf527568100d2182ddf58a

          SHA256

          1054db02a2bf17fa18d0f4422f9fa62893cd437bdb74d31225643b7c0c1861e6

          SHA512

          c69619f34be5345efd95a91d5771564651e521ff5cccad9b5ce694eed982344539bbfcb9f39bae0208b4a62c9215ca82f254715606a99cedabdf47ad0dcf7dd3

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dJD11.exe

          Filesize

          235KB

          MD5

          1dfaea61e3959f902a94287e95ee6824

          SHA1

          a303be2ea1744692c8bf527568100d2182ddf58a

          SHA256

          1054db02a2bf17fa18d0f4422f9fa62893cd437bdb74d31225643b7c0c1861e6

          SHA512

          c69619f34be5345efd95a91d5771564651e521ff5cccad9b5ce694eed982344539bbfcb9f39bae0208b4a62c9215ca82f254715606a99cedabdf47ad0dcf7dd3

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nCV34.exe

          Filesize

          200KB

          MD5

          d901c40d66f39ce57245aebcc139a5ad

          SHA1

          0cdfe58bce9a8c9abedc65610c744383406f8ede

          SHA256

          bd87b9d04c03d49359727f4d60bc77f1de2411ff7b619dc593c18dabf9ef4c09

          SHA512

          4a5a66abe4db90bf14034113bcaf383a264fafbf1cfa236afb427acb9d0e45c07f73e47cc9b9c8f5ec111a1e5c5a00ae3f9ea2b24a061a05b2961824c05839ed

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nCV34.exe

          Filesize

          200KB

          MD5

          d901c40d66f39ce57245aebcc139a5ad

          SHA1

          0cdfe58bce9a8c9abedc65610c744383406f8ede

          SHA256

          bd87b9d04c03d49359727f4d60bc77f1de2411ff7b619dc593c18dabf9ef4c09

          SHA512

          4a5a66abe4db90bf14034113bcaf383a264fafbf1cfa236afb427acb9d0e45c07f73e47cc9b9c8f5ec111a1e5c5a00ae3f9ea2b24a061a05b2961824c05839ed

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bqD98.exe

          Filesize

          175KB

          MD5

          da6f3bef8abc85bd09f50783059964e3

          SHA1

          a0f25f60ec1896c4c920ea397f40e6ce29724322

          SHA256

          e6d9ee8ab0ea2ade6e5a9481d8f0f921427ec6919b1b48c6067570fde270736b

          SHA512

          4d2e1472b114c98c74900b8305aabbc49ba28edffdc2376206cf02e26593df4e444933b3aa19f0c6cd0ae3ac3133d656433574aaf25a57748758e5dd25edfbec

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bqD98.exe

          Filesize

          175KB

          MD5

          da6f3bef8abc85bd09f50783059964e3

          SHA1

          a0f25f60ec1896c4c920ea397f40e6ce29724322

          SHA256

          e6d9ee8ab0ea2ade6e5a9481d8f0f921427ec6919b1b48c6067570fde270736b

          SHA512

          4d2e1472b114c98c74900b8305aabbc49ba28edffdc2376206cf02e26593df4e444933b3aa19f0c6cd0ae3ac3133d656433574aaf25a57748758e5dd25edfbec

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cvn13CS.exe

          Filesize

          175KB

          MD5

          062a3c73b1aaf076abefd71633b66de5

          SHA1

          e4b7e004c32d673fd61b1669c797dc4b207d8445

          SHA256

          f281aafa876847194d635feddb06b11295249cc4bcf940d5246bdb5938410881

          SHA512

          6bee4020fa8e4955b3028a71037f78ec922132009942283e071b3acdeea375300cef092fd692e9463d625065d5ef57e5e1ebd98f72e801ffc2178c071d645ec3

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cvn13CS.exe

          Filesize

          175KB

          MD5

          062a3c73b1aaf076abefd71633b66de5

          SHA1

          e4b7e004c32d673fd61b1669c797dc4b207d8445

          SHA256

          f281aafa876847194d635feddb06b11295249cc4bcf940d5246bdb5938410881

          SHA512

          6bee4020fa8e4955b3028a71037f78ec922132009942283e071b3acdeea375300cef092fd692e9463d625065d5ef57e5e1ebd98f72e801ffc2178c071d645ec3

        • memory/1416-298-0x0000000005B20000-0x000000000601E000-memory.dmp

          Filesize

          5.0MB

        • memory/1416-279-0x00000000049A0000-0x0000000004AAA000-memory.dmp

          Filesize

          1.0MB

        • memory/1416-301-0x00000000058B0000-0x0000000005926000-memory.dmp

          Filesize

          472KB

        • memory/1416-290-0x0000000004CA0000-0x0000000004D06000-memory.dmp

          Filesize

          408KB

        • memory/1416-285-0x0000000004AB0000-0x0000000004AFB000-memory.dmp

          Filesize

          300KB

        • memory/1416-283-0x0000000004930000-0x000000000496E000-memory.dmp

          Filesize

          248KB

        • memory/1416-281-0x00000000048D0000-0x00000000048E2000-memory.dmp

          Filesize

          72KB

        • memory/1416-299-0x0000000005810000-0x00000000058A2000-memory.dmp

          Filesize

          584KB

        • memory/1416-278-0x0000000004E10000-0x0000000005416000-memory.dmp

          Filesize

          6.0MB

        • memory/1416-265-0x0000000000070000-0x00000000000A2000-memory.dmp

          Filesize

          200KB

        • memory/1416-302-0x0000000005930000-0x0000000005980000-memory.dmp

          Filesize

          320KB

        • memory/1416-303-0x00000000061F0000-0x00000000063B2000-memory.dmp

          Filesize

          1.8MB

        • memory/1416-304-0x00000000068F0000-0x0000000006E1C000-memory.dmp

          Filesize

          5.2MB

        • memory/2360-144-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-130-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-120-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-145-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-146-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-148-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-147-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-149-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-150-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-151-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-152-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-153-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-154-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-155-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-156-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-157-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-159-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-160-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-158-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-161-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-162-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-163-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-164-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-165-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-121-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-122-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-123-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-124-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-125-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-126-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-127-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-128-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-129-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-143-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-131-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-132-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-133-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-134-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-135-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-136-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-142-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-137-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-138-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-141-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-139-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2360-140-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/2928-362-0x0000000000480000-0x00000000004B2000-memory.dmp

          Filesize

          200KB

        • memory/4556-175-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/4556-168-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/4556-183-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/4556-186-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/4556-172-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/4556-184-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/4556-178-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/4556-180-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/4556-182-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/4556-181-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/4556-179-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/4556-177-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/4556-176-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/4556-173-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/4556-185-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/4556-171-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/4556-169-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/4556-170-0x00000000776F0000-0x000000007787E000-memory.dmp

          Filesize

          1.6MB

        • memory/4724-453-0x0000000000B60000-0x0000000000B7A000-memory.dmp

          Filesize

          104KB

        • memory/4724-458-0x00000000022D0000-0x00000000022E8000-memory.dmp

          Filesize

          96KB

        • memory/4724-460-0x00000000008F1000-0x0000000000911000-memory.dmp

          Filesize

          128KB

        • memory/4724-461-0x00000000001D0000-0x00000000001FD000-memory.dmp

          Filesize

          180KB

        • memory/4724-463-0x0000000000400000-0x000000000056B000-memory.dmp

          Filesize

          1.4MB

        • memory/4724-464-0x00000000008F1000-0x0000000000911000-memory.dmp

          Filesize

          128KB

        • memory/4724-466-0x00000000008F1000-0x0000000000911000-memory.dmp

          Filesize

          128KB

        • memory/4724-467-0x0000000000400000-0x000000000056B000-memory.dmp

          Filesize

          1.4MB