Analysis

  • max time kernel
    140s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-03-2023 22:24

General

  • Target

    a6b2801b074d71729663602a1dc8cd75fea0b7c4d59268a1b5dbe93c9269d02b.exe

  • Size

    693KB

  • MD5

    e4f864be71a5fd2a2471cb89e65cfb57

  • SHA1

    246981954d84c65ced4e824d0545be7426aae359

  • SHA256

    a6b2801b074d71729663602a1dc8cd75fea0b7c4d59268a1b5dbe93c9269d02b

  • SHA512

    2b122794fae7da2886823c821e8afd10ae66c91df61265950402dc0b3ebad5a53265067203985f75d118b7a954309a10a04bc9419ff3ec4af470758bbf391d9a

  • SSDEEP

    12288:fMr9y90KnEY12wvT8z1kpUomZI9Yyw9m/7G3nmI/7akbDL8l:+yFEcTGG5s9bK7Ktr8l

Malware Config

Extracted

Family

redline

Botnet

ruzhpe

C2

pepunn.com:4162

Attributes
  • auth_value

    f735ced96ae8d01d0bd1d514240e54e0

Extracted

Family

redline

Botnet

fchan

C2

pepunn.com:4162

Attributes
  • auth_value

    127bd53d55e8c4f0dd2f6e1ea60deef4

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a6b2801b074d71729663602a1dc8cd75fea0b7c4d59268a1b5dbe93c9269d02b.exe
    "C:\Users\Admin\AppData\Local\Temp\a6b2801b074d71729663602a1dc8cd75fea0b7c4d59268a1b5dbe93c9269d02b.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4476
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ycvx99Yd45.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ycvx99Yd45.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2736
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\urEg06bH51.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\urEg06bH51.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4796
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 1076
          4⤵
          • Program crash
          PID:4712
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wrVn47ZH41.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wrVn47ZH41.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3964
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 1940
          4⤵
          • Program crash
          PID:3200
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xuqy89xU94.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xuqy89xU94.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4992
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4796 -ip 4796
    1⤵
      PID:1304
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3964 -ip 3964
      1⤵
        PID:3228
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe start wuauserv
        1⤵
        • Launches sc.exe
        PID:4640

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xuqy89xU94.exe

        Filesize

        175KB

        MD5

        e19d994fcb8a0791c19fc1853cd8d4da

        SHA1

        3b433a9486740ce4956ba89ed3b051f0efe0c2f9

        SHA256

        b4ef53d7bfb5d952c6f2ef004cf0a5b8881b1dc12979136dc5c7a173bb26ad90

        SHA512

        68eff9f7362b495d10adbb1cdac888e88c3bfec8051d4105bc4fdb8435812e59c30a8f1416d8487168cad345399663616f70f29231573762439ef8033ecb798e

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xuqy89xU94.exe

        Filesize

        175KB

        MD5

        e19d994fcb8a0791c19fc1853cd8d4da

        SHA1

        3b433a9486740ce4956ba89ed3b051f0efe0c2f9

        SHA256

        b4ef53d7bfb5d952c6f2ef004cf0a5b8881b1dc12979136dc5c7a173bb26ad90

        SHA512

        68eff9f7362b495d10adbb1cdac888e88c3bfec8051d4105bc4fdb8435812e59c30a8f1416d8487168cad345399663616f70f29231573762439ef8033ecb798e

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ycvx99Yd45.exe

        Filesize

        549KB

        MD5

        15514ddca2f6e550d8332f7dd5b00e85

        SHA1

        db27abf3d463564a8157893a0ebadfac703e8b66

        SHA256

        f5787d667e074c4c643bdb69843b33c25a96790ce2da4f457eef87b2cf217b26

        SHA512

        19c3a7de1f63e3021b0687f1f23025a75281f5ce2e3dfded6a18043c55063877e964ab1a0e497f51adb1a8f6710fe32eec5f7ab06608f7f54f12d5ed2d9e4e6c

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ycvx99Yd45.exe

        Filesize

        549KB

        MD5

        15514ddca2f6e550d8332f7dd5b00e85

        SHA1

        db27abf3d463564a8157893a0ebadfac703e8b66

        SHA256

        f5787d667e074c4c643bdb69843b33c25a96790ce2da4f457eef87b2cf217b26

        SHA512

        19c3a7de1f63e3021b0687f1f23025a75281f5ce2e3dfded6a18043c55063877e964ab1a0e497f51adb1a8f6710fe32eec5f7ab06608f7f54f12d5ed2d9e4e6c

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\urEg06bH51.exe

        Filesize

        350KB

        MD5

        e51e74d094b076776b0169ed1a54d0a3

        SHA1

        0e6f8f2fc33bed2e1d0768ae674e0e4b182085b2

        SHA256

        6e25bad8749aa05160afd2dfe3a01906f424ca495518c70cebc2d3ef5930521b

        SHA512

        d04434571bf1c971c350fb13e54b4a6d6bc96b1443a45ba2a0124c5d903f0f17287fd8ea54c94e1d06ec302242275900819807559318f16fac28c6f6e6a3ff5f

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\urEg06bH51.exe

        Filesize

        350KB

        MD5

        e51e74d094b076776b0169ed1a54d0a3

        SHA1

        0e6f8f2fc33bed2e1d0768ae674e0e4b182085b2

        SHA256

        6e25bad8749aa05160afd2dfe3a01906f424ca495518c70cebc2d3ef5930521b

        SHA512

        d04434571bf1c971c350fb13e54b4a6d6bc96b1443a45ba2a0124c5d903f0f17287fd8ea54c94e1d06ec302242275900819807559318f16fac28c6f6e6a3ff5f

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wrVn47ZH41.exe

        Filesize

        409KB

        MD5

        67530ca401a21e9021983dd91b37c971

        SHA1

        059cc53f7d897b6e0b9072274cb964ab547489a9

        SHA256

        3b8cd7237a32fdb861ebd4c8243729f969a0355e4554832f73d8ab0ee3871b9a

        SHA512

        0b8f93e0d38b8bf6fab4adb7c1ecd05da3c354acd94e9f02c48ef8f822be328d6e2c558806e732a840178ec2d0c32daf718f372a6040403353565196ce231b78

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wrVn47ZH41.exe

        Filesize

        409KB

        MD5

        67530ca401a21e9021983dd91b37c971

        SHA1

        059cc53f7d897b6e0b9072274cb964ab547489a9

        SHA256

        3b8cd7237a32fdb861ebd4c8243729f969a0355e4554832f73d8ab0ee3871b9a

        SHA512

        0b8f93e0d38b8bf6fab4adb7c1ecd05da3c354acd94e9f02c48ef8f822be328d6e2c558806e732a840178ec2d0c32daf718f372a6040403353565196ce231b78

      • memory/3964-1102-0x0000000008010000-0x000000000811A000-memory.dmp

        Filesize

        1.0MB

      • memory/3964-1105-0x0000000007330000-0x0000000007340000-memory.dmp

        Filesize

        64KB

      • memory/3964-1117-0x00000000096E0000-0x0000000009730000-memory.dmp

        Filesize

        320KB

      • memory/3964-1116-0x0000000009650000-0x00000000096C6000-memory.dmp

        Filesize

        472KB

      • memory/3964-1115-0x0000000007330000-0x0000000007340000-memory.dmp

        Filesize

        64KB

      • memory/3964-1114-0x0000000008EB0000-0x00000000093DC000-memory.dmp

        Filesize

        5.2MB

      • memory/3964-1113-0x0000000008CD0000-0x0000000008E92000-memory.dmp

        Filesize

        1.8MB

      • memory/3964-1112-0x0000000007330000-0x0000000007340000-memory.dmp

        Filesize

        64KB

      • memory/3964-1111-0x0000000007330000-0x0000000007340000-memory.dmp

        Filesize

        64KB

      • memory/3964-1110-0x0000000007330000-0x0000000007340000-memory.dmp

        Filesize

        64KB

      • memory/3964-1109-0x0000000008AF0000-0x0000000008B82000-memory.dmp

        Filesize

        584KB

      • memory/3964-1108-0x0000000008420000-0x0000000008486000-memory.dmp

        Filesize

        408KB

      • memory/3964-1107-0x0000000002CB0000-0x0000000002CFB000-memory.dmp

        Filesize

        300KB

      • memory/3964-209-0x00000000071C0000-0x00000000071FE000-memory.dmp

        Filesize

        248KB

      • memory/3964-1104-0x0000000008120000-0x000000000815C000-memory.dmp

        Filesize

        240KB

      • memory/3964-1103-0x0000000007310000-0x0000000007322000-memory.dmp

        Filesize

        72KB

      • memory/3964-1101-0x00000000079F0000-0x0000000008008000-memory.dmp

        Filesize

        6.1MB

      • memory/3964-227-0x0000000007330000-0x0000000007340000-memory.dmp

        Filesize

        64KB

      • memory/3964-228-0x00000000071C0000-0x00000000071FE000-memory.dmp

        Filesize

        248KB

      • memory/3964-225-0x0000000007330000-0x0000000007340000-memory.dmp

        Filesize

        64KB

      • memory/3964-223-0x00000000071C0000-0x00000000071FE000-memory.dmp

        Filesize

        248KB

      • memory/3964-224-0x0000000007330000-0x0000000007340000-memory.dmp

        Filesize

        64KB

      • memory/3964-221-0x00000000071C0000-0x00000000071FE000-memory.dmp

        Filesize

        248KB

      • memory/3964-191-0x0000000002CB0000-0x0000000002CFB000-memory.dmp

        Filesize

        300KB

      • memory/3964-192-0x00000000071C0000-0x00000000071FE000-memory.dmp

        Filesize

        248KB

      • memory/3964-193-0x00000000071C0000-0x00000000071FE000-memory.dmp

        Filesize

        248KB

      • memory/3964-195-0x00000000071C0000-0x00000000071FE000-memory.dmp

        Filesize

        248KB

      • memory/3964-197-0x00000000071C0000-0x00000000071FE000-memory.dmp

        Filesize

        248KB

      • memory/3964-199-0x00000000071C0000-0x00000000071FE000-memory.dmp

        Filesize

        248KB

      • memory/3964-201-0x00000000071C0000-0x00000000071FE000-memory.dmp

        Filesize

        248KB

      • memory/3964-211-0x00000000071C0000-0x00000000071FE000-memory.dmp

        Filesize

        248KB

      • memory/3964-205-0x00000000071C0000-0x00000000071FE000-memory.dmp

        Filesize

        248KB

      • memory/3964-217-0x00000000071C0000-0x00000000071FE000-memory.dmp

        Filesize

        248KB

      • memory/3964-219-0x00000000071C0000-0x00000000071FE000-memory.dmp

        Filesize

        248KB

      • memory/3964-203-0x00000000071C0000-0x00000000071FE000-memory.dmp

        Filesize

        248KB

      • memory/3964-213-0x00000000071C0000-0x00000000071FE000-memory.dmp

        Filesize

        248KB

      • memory/3964-215-0x00000000071C0000-0x00000000071FE000-memory.dmp

        Filesize

        248KB

      • memory/3964-207-0x00000000071C0000-0x00000000071FE000-memory.dmp

        Filesize

        248KB

      • memory/4796-186-0x0000000000400000-0x0000000002BC5000-memory.dmp

        Filesize

        39.8MB

      • memory/4796-160-0x0000000004D00000-0x0000000004D12000-memory.dmp

        Filesize

        72KB

      • memory/4796-150-0x00000000071D0000-0x00000000071E0000-memory.dmp

        Filesize

        64KB

      • memory/4796-170-0x0000000004D00000-0x0000000004D12000-memory.dmp

        Filesize

        72KB

      • memory/4796-184-0x00000000071D0000-0x00000000071E0000-memory.dmp

        Filesize

        64KB

      • memory/4796-182-0x00000000071D0000-0x00000000071E0000-memory.dmp

        Filesize

        64KB

      • memory/4796-183-0x00000000071D0000-0x00000000071E0000-memory.dmp

        Filesize

        64KB

      • memory/4796-181-0x0000000000400000-0x0000000002BC5000-memory.dmp

        Filesize

        39.8MB

      • memory/4796-151-0x00000000071D0000-0x00000000071E0000-memory.dmp

        Filesize

        64KB

      • memory/4796-180-0x0000000004D00000-0x0000000004D12000-memory.dmp

        Filesize

        72KB

      • memory/4796-168-0x0000000004D00000-0x0000000004D12000-memory.dmp

        Filesize

        72KB

      • memory/4796-154-0x0000000004D00000-0x0000000004D12000-memory.dmp

        Filesize

        72KB

      • memory/4796-174-0x0000000004D00000-0x0000000004D12000-memory.dmp

        Filesize

        72KB

      • memory/4796-152-0x00000000071D0000-0x00000000071E0000-memory.dmp

        Filesize

        64KB

      • memory/4796-162-0x0000000004D00000-0x0000000004D12000-memory.dmp

        Filesize

        72KB

      • memory/4796-178-0x0000000004D00000-0x0000000004D12000-memory.dmp

        Filesize

        72KB

      • memory/4796-166-0x0000000004D00000-0x0000000004D12000-memory.dmp

        Filesize

        72KB

      • memory/4796-164-0x0000000004D00000-0x0000000004D12000-memory.dmp

        Filesize

        72KB

      • memory/4796-176-0x0000000004D00000-0x0000000004D12000-memory.dmp

        Filesize

        72KB

      • memory/4796-172-0x0000000004D00000-0x0000000004D12000-memory.dmp

        Filesize

        72KB

      • memory/4796-158-0x0000000004D00000-0x0000000004D12000-memory.dmp

        Filesize

        72KB

      • memory/4796-156-0x0000000004D00000-0x0000000004D12000-memory.dmp

        Filesize

        72KB

      • memory/4796-153-0x0000000004D00000-0x0000000004D12000-memory.dmp

        Filesize

        72KB

      • memory/4796-149-0x0000000002BE0000-0x0000000002C0D000-memory.dmp

        Filesize

        180KB

      • memory/4796-148-0x00000000071E0000-0x0000000007784000-memory.dmp

        Filesize

        5.6MB

      • memory/4992-1123-0x0000000000AA0000-0x0000000000AD2000-memory.dmp

        Filesize

        200KB

      • memory/4992-1124-0x00000000056E0000-0x00000000056F0000-memory.dmp

        Filesize

        64KB

      • memory/4992-1125-0x00000000056E0000-0x00000000056F0000-memory.dmp

        Filesize

        64KB