Analysis

  • max time kernel
    68s
  • max time network
    57s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    14/02/2023, 13:42

General

  • Target

    156845b1bf7447d5131a1392b2809f27.exe

  • Size

    528KB

  • MD5

    156845b1bf7447d5131a1392b2809f27

  • SHA1

    a525aa16b7fe1dc7a568f509861fce60f957f525

  • SHA256

    9255b7a154698669aa8d751692d350651653054f0190f4963e8c28edb37afcc5

  • SHA512

    ff68feb16255008591ffc2d2487639e217f1d95fa35fafdc43c314d3a0746a6375eaf52ee1ceb486957cd63d261442c9d9df7e23d1e0a9d2c8e83d0b78ff3096

  • SSDEEP

    12288:OMrVy90DAo5EyqQ7svdj8POHb9KSTOocNk:HyA5EdQ7kiPsdcNk

Malware Config

Extracted

Family

redline

Botnet

ruma

C2

193.233.20.13:4136

Attributes
  • auth_value

    647d00dfaba082a4a30f383bca5d1a2a

Extracted

Family

redline

Botnet

dubka

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5a9421183a033f283b2f23139b471f0

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\156845b1bf7447d5131a1392b2809f27.exe
    "C:\Users\Admin\AppData\Local\Temp\156845b1bf7447d5131a1392b2809f27.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1432
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vXp80.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vXp80.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1536
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dQx82.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dQx82.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1248
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nCc88rL.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nCc88rL.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1124
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sYC88.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sYC88.exe
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Executes dropped EXE
      • Windows security modification
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2044

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sYC88.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sYC88.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vXp80.exe

    Filesize

    424KB

    MD5

    da907eb8a286ac0efcfbffdc26a0fe11

    SHA1

    18954e048e815a83103d5ce0fcae5eb8f28188fa

    SHA256

    427c00e6d41644be91ea2c4a8e2694bf8b2ee1758d0225725a576f89da9fef09

    SHA512

    17ee65852ce2cb9a0b89e3869f4925f0d2095f0ac794c66c6421bb08abf2b191e9e4699d0d6e1d0bd70d140737e81877b49125fb88c2595d95bb7b9fb649b311

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vXp80.exe

    Filesize

    424KB

    MD5

    da907eb8a286ac0efcfbffdc26a0fe11

    SHA1

    18954e048e815a83103d5ce0fcae5eb8f28188fa

    SHA256

    427c00e6d41644be91ea2c4a8e2694bf8b2ee1758d0225725a576f89da9fef09

    SHA512

    17ee65852ce2cb9a0b89e3869f4925f0d2095f0ac794c66c6421bb08abf2b191e9e4699d0d6e1d0bd70d140737e81877b49125fb88c2595d95bb7b9fb649b311

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dQx82.exe

    Filesize

    278KB

    MD5

    6e88575e5a8289855c38133d70e4466d

    SHA1

    f4dba78bb2db07d4964846d2707136ea7078566a

    SHA256

    5dddea590a2fa5de71f11a70e98cec2735f106ebe59d84c79f465c2744b89556

    SHA512

    a4712145bbf4d16d75ed65754c80397f08195917b65ab7f86d8fbb1d9820f7f0c45644045001def0708192387144640850d49aed40cc7a976c1e07b1c622f03c

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dQx82.exe

    Filesize

    278KB

    MD5

    6e88575e5a8289855c38133d70e4466d

    SHA1

    f4dba78bb2db07d4964846d2707136ea7078566a

    SHA256

    5dddea590a2fa5de71f11a70e98cec2735f106ebe59d84c79f465c2744b89556

    SHA512

    a4712145bbf4d16d75ed65754c80397f08195917b65ab7f86d8fbb1d9820f7f0c45644045001def0708192387144640850d49aed40cc7a976c1e07b1c622f03c

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nCc88rL.exe

    Filesize

    175KB

    MD5

    dd0c9e110c68ce1fa5308979ef718f7b

    SHA1

    473deb8069f0841d47b74b7f414dacc6f96eca78

    SHA256

    dc28c9d9ab3f30222ed59f3991c5981bec40604e725ece488d8599eef917a7b3

    SHA512

    29bd76da816b13b31c938a3f8699d2f5942a24c9ef61fddcac490e0a30f82c1a4a76ca9a6866a8d2c8e57566f66b3aea31e7f70646d3ebef63c63a06f8fe2236

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nCc88rL.exe

    Filesize

    175KB

    MD5

    dd0c9e110c68ce1fa5308979ef718f7b

    SHA1

    473deb8069f0841d47b74b7f414dacc6f96eca78

    SHA256

    dc28c9d9ab3f30222ed59f3991c5981bec40604e725ece488d8599eef917a7b3

    SHA512

    29bd76da816b13b31c938a3f8699d2f5942a24c9ef61fddcac490e0a30f82c1a4a76ca9a6866a8d2c8e57566f66b3aea31e7f70646d3ebef63c63a06f8fe2236

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\sYC88.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\vXp80.exe

    Filesize

    424KB

    MD5

    da907eb8a286ac0efcfbffdc26a0fe11

    SHA1

    18954e048e815a83103d5ce0fcae5eb8f28188fa

    SHA256

    427c00e6d41644be91ea2c4a8e2694bf8b2ee1758d0225725a576f89da9fef09

    SHA512

    17ee65852ce2cb9a0b89e3869f4925f0d2095f0ac794c66c6421bb08abf2b191e9e4699d0d6e1d0bd70d140737e81877b49125fb88c2595d95bb7b9fb649b311

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\vXp80.exe

    Filesize

    424KB

    MD5

    da907eb8a286ac0efcfbffdc26a0fe11

    SHA1

    18954e048e815a83103d5ce0fcae5eb8f28188fa

    SHA256

    427c00e6d41644be91ea2c4a8e2694bf8b2ee1758d0225725a576f89da9fef09

    SHA512

    17ee65852ce2cb9a0b89e3869f4925f0d2095f0ac794c66c6421bb08abf2b191e9e4699d0d6e1d0bd70d140737e81877b49125fb88c2595d95bb7b9fb649b311

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\dQx82.exe

    Filesize

    278KB

    MD5

    6e88575e5a8289855c38133d70e4466d

    SHA1

    f4dba78bb2db07d4964846d2707136ea7078566a

    SHA256

    5dddea590a2fa5de71f11a70e98cec2735f106ebe59d84c79f465c2744b89556

    SHA512

    a4712145bbf4d16d75ed65754c80397f08195917b65ab7f86d8fbb1d9820f7f0c45644045001def0708192387144640850d49aed40cc7a976c1e07b1c622f03c

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\dQx82.exe

    Filesize

    278KB

    MD5

    6e88575e5a8289855c38133d70e4466d

    SHA1

    f4dba78bb2db07d4964846d2707136ea7078566a

    SHA256

    5dddea590a2fa5de71f11a70e98cec2735f106ebe59d84c79f465c2744b89556

    SHA512

    a4712145bbf4d16d75ed65754c80397f08195917b65ab7f86d8fbb1d9820f7f0c45644045001def0708192387144640850d49aed40cc7a976c1e07b1c622f03c

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\dQx82.exe

    Filesize

    278KB

    MD5

    6e88575e5a8289855c38133d70e4466d

    SHA1

    f4dba78bb2db07d4964846d2707136ea7078566a

    SHA256

    5dddea590a2fa5de71f11a70e98cec2735f106ebe59d84c79f465c2744b89556

    SHA512

    a4712145bbf4d16d75ed65754c80397f08195917b65ab7f86d8fbb1d9820f7f0c45644045001def0708192387144640850d49aed40cc7a976c1e07b1c622f03c

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\nCc88rL.exe

    Filesize

    175KB

    MD5

    dd0c9e110c68ce1fa5308979ef718f7b

    SHA1

    473deb8069f0841d47b74b7f414dacc6f96eca78

    SHA256

    dc28c9d9ab3f30222ed59f3991c5981bec40604e725ece488d8599eef917a7b3

    SHA512

    29bd76da816b13b31c938a3f8699d2f5942a24c9ef61fddcac490e0a30f82c1a4a76ca9a6866a8d2c8e57566f66b3aea31e7f70646d3ebef63c63a06f8fe2236

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\nCc88rL.exe

    Filesize

    175KB

    MD5

    dd0c9e110c68ce1fa5308979ef718f7b

    SHA1

    473deb8069f0841d47b74b7f414dacc6f96eca78

    SHA256

    dc28c9d9ab3f30222ed59f3991c5981bec40604e725ece488d8599eef917a7b3

    SHA512

    29bd76da816b13b31c938a3f8699d2f5942a24c9ef61fddcac490e0a30f82c1a4a76ca9a6866a8d2c8e57566f66b3aea31e7f70646d3ebef63c63a06f8fe2236

  • memory/1124-81-0x0000000000220000-0x0000000000252000-memory.dmp

    Filesize

    200KB

  • memory/1248-68-0x0000000002730000-0x0000000002776000-memory.dmp

    Filesize

    280KB

  • memory/1248-74-0x0000000000400000-0x0000000000763000-memory.dmp

    Filesize

    3.4MB

  • memory/1248-73-0x00000000002BF000-0x00000000002EE000-memory.dmp

    Filesize

    188KB

  • memory/1248-69-0x0000000004CB0000-0x0000000004CF4000-memory.dmp

    Filesize

    272KB

  • memory/1248-72-0x0000000000400000-0x0000000000763000-memory.dmp

    Filesize

    3.4MB

  • memory/1248-70-0x00000000002BF000-0x00000000002EE000-memory.dmp

    Filesize

    188KB

  • memory/1248-71-0x0000000000AE0000-0x0000000000B2B000-memory.dmp

    Filesize

    300KB

  • memory/1432-54-0x0000000075C31000-0x0000000075C33000-memory.dmp

    Filesize

    8KB

  • memory/2044-86-0x0000000001210000-0x000000000121A000-memory.dmp

    Filesize

    40KB