Analysis
-
max time kernel
109s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
-
submitted
02/03/2023, 19:52
General
-
Target
1de72482a538cf12388debeb12e57d895cc80d278346a89328d79697cce6e2b8.exe
-
Size
546KB
-
MD5
ab5381c6a50b6a3f3904d19e2ed1d75e
-
SHA1
8236cbd83287e38ed52011390e9a86f10c6d30f1
-
SHA256
1de72482a538cf12388debeb12e57d895cc80d278346a89328d79697cce6e2b8
-
SHA512
aae11849b4476cbf4fd521aa71e25be48726884ad7b3549f19896fd411b349624c3dcc187e69bc828f2f73201f4573817772b29acaa7930af3374690a9c6925a
-
SSDEEP
12288:8Mrry903xbCJ4aJxENKjTa/1BA2DhnR4IWLqB7k:fyqCJJxkK3SWqhqA4
Malware Config
Extracted
redline
stek
melevv.eu:4162
-
auth_value
4205381daf6946b2df5fe3bc7eacc918
Extracted
redline
fomich
melevv.eu:4162
-
auth_value
b018e52ac946001794d8b8c23e901859
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
-
Executes dropped EXE 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 1 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1de72482a538cf12388debeb12e57d895cc80d278346a89328d79697cce6e2b8.exe"C:\Users\Admin\AppData\Local\Temp\1de72482a538cf12388debeb12e57d895cc80d278346a89328d79697cce6e2b8.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vyP3920EO.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vyP3920EO.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw91ah86gT63.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw91ah86gT63.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tBl69xG38.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tBl69xG38.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 13884⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\uaD66xj41.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\uaD66xj41.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4508 -ip 45081⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD58fa3c4181cc7d1fec1d18645fde2f246
SHA1678ca5d1b3f26a5ff2d385fc373b43bc420bf7ff
SHA2561a8824b03168c0113abda3bd982be7611e176678d09fdc85c39798802b272c65
SHA512654a1cb1ed6e520eb03e9425de2ddec9ba347b9ef2c0fe356d94ff76dadc405a92a3607a4e58f879c578b1033240935971ded708373b6f1c6b8df7b6b52d2a21
-
Filesize
175KB
MD58fa3c4181cc7d1fec1d18645fde2f246
SHA1678ca5d1b3f26a5ff2d385fc373b43bc420bf7ff
SHA2561a8824b03168c0113abda3bd982be7611e176678d09fdc85c39798802b272c65
SHA512654a1cb1ed6e520eb03e9425de2ddec9ba347b9ef2c0fe356d94ff76dadc405a92a3607a4e58f879c578b1033240935971ded708373b6f1c6b8df7b6b52d2a21
-
Filesize
401KB
MD5a058fcf603155923638830623c0e8b2a
SHA1ec91b1c8498289a8c3d637100837636bf23fca77
SHA256ec291fbc7df5c6edadb143a2f0210a96116ea0e1dec034ab4f8e7ebf6a74868f
SHA512e629f7db957a8c67effbda520a91f16f724060862d828a4209eca39496aee44993a33a6c86e1ae83281b6e6cea15e0011c813a80b16cec760d2ec5bf678a01b0
-
Filesize
401KB
MD5a058fcf603155923638830623c0e8b2a
SHA1ec91b1c8498289a8c3d637100837636bf23fca77
SHA256ec291fbc7df5c6edadb143a2f0210a96116ea0e1dec034ab4f8e7ebf6a74868f
SHA512e629f7db957a8c67effbda520a91f16f724060862d828a4209eca39496aee44993a33a6c86e1ae83281b6e6cea15e0011c813a80b16cec760d2ec5bf678a01b0
-
Filesize
17KB
MD54edc669abdf0bb05b346d5a5c5ca6d54
SHA1fccb2fe77269ef921ff9c79ae6f5b157247e1402
SHA2564e4501444951b4d5ec5da92774c190e86b1db702d739a9a3f8f940d90cba02a7
SHA512b50c19679c4e68d165a1d216ba87d9745d6ec7eced8f58d7b7635505f3adc53d2c80d60a8c2a82e1b5b23f7e70c590b48be849203d95ea978c254da8d7b57084
-
Filesize
17KB
MD54edc669abdf0bb05b346d5a5c5ca6d54
SHA1fccb2fe77269ef921ff9c79ae6f5b157247e1402
SHA2564e4501444951b4d5ec5da92774c190e86b1db702d739a9a3f8f940d90cba02a7
SHA512b50c19679c4e68d165a1d216ba87d9745d6ec7eced8f58d7b7635505f3adc53d2c80d60a8c2a82e1b5b23f7e70c590b48be849203d95ea978c254da8d7b57084
-
Filesize
376KB
MD5d59f82338e5d937f8762de73d2fe5bfd
SHA1405e65a38c7677eaed8a28a9b9ef72a0ad7bdacb
SHA256138b6143c345a24a8f866d24f461d19ce4c9ed06204f12eb4d09207baff6ebf1
SHA512bf1cfe667b92ecdfd20625a50245e2640ddcc7f0320ae842b28ebd9e48582a437ed68360745d997d0cb5064926b84ec7de4450bf9f3d89692ea5f1ddf4775e75
-
Filesize
376KB
MD5d59f82338e5d937f8762de73d2fe5bfd
SHA1405e65a38c7677eaed8a28a9b9ef72a0ad7bdacb
SHA256138b6143c345a24a8f866d24f461d19ce4c9ed06204f12eb4d09207baff6ebf1
SHA512bf1cfe667b92ecdfd20625a50245e2640ddcc7f0320ae842b28ebd9e48582a437ed68360745d997d0cb5064926b84ec7de4450bf9f3d89692ea5f1ddf4775e75
-
Filesize
200KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
5.6MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
300KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
64KB
-
Filesize
472KB
-
Filesize
320KB