Analysis
-
max time kernel
49s -
max time network
56s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
03-03-2023 11:53
General
-
Target
78307c971ea622222f7f8cdba360c0c912b804acdb9fc28930a74f2225916274.exe
-
Size
673KB
-
MD5
5caea57f970a2f9392fc480cd56e6598
-
SHA1
97c4a12b8fac3c38650841109b9a714207cafd75
-
SHA256
78307c971ea622222f7f8cdba360c0c912b804acdb9fc28930a74f2225916274
-
SHA512
ea1e7f10287fb1353b260145de9957936fa5d432a8a24b5cf5d39b92379c208a637c69a02534ab9bd6bb2d74d889911b7fb9e0d5a427f36a18da0a65af9e8391
-
SSDEEP
12288:PMrmy90Lty8OFzXZ65keVi8/jflodWU0tGS4wpp5pePGjZivM2bFFe2B:5yoty9F8eeVi3L0gSTYPGNi0Kr
Malware Config
Extracted
redline
rosto
hueref.eu:4162
-
auth_value
07d81eba8cad42bbd0ae60042d48eac6
Extracted
redline
flurs
hueref.eu:4162
-
auth_value
967190a484bd63836957d2fa7d601592
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Executes dropped EXE 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 2 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\78307c971ea622222f7f8cdba360c0c912b804acdb9fc28930a74f2225916274.exe"C:\Users\Admin\AppData\Local\Temp\78307c971ea622222f7f8cdba360c0c912b804acdb9fc28930a74f2225916274.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ycTG31OC20.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ycTG31OC20.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\urcK51Xc45.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\urcK51Xc45.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wrfY64hc65.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wrfY64hc65.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xuQB30Na25.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xuQB30Na25.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD50dc3450163abd7a73dee76462760fabd
SHA1eb48cc0853484871e093be7be7944aede932c842
SHA25651baa36a92c69bf90240ff1cd09f03802805423add326d5ef8b776a11b570e71
SHA5127613118eab9a9b3259fefcba3419dd24dcf4ef41be661bbc83b4d0ff7788ce18383cdea53d3e63df9db5f3681ab714711812c43a0d0cd137ee308cb86d27e5d2
-
Filesize
175KB
MD50dc3450163abd7a73dee76462760fabd
SHA1eb48cc0853484871e093be7be7944aede932c842
SHA25651baa36a92c69bf90240ff1cd09f03802805423add326d5ef8b776a11b570e71
SHA5127613118eab9a9b3259fefcba3419dd24dcf4ef41be661bbc83b4d0ff7788ce18383cdea53d3e63df9db5f3681ab714711812c43a0d0cd137ee308cb86d27e5d2
-
Filesize
528KB
MD5fd4a39808c5c92c5112d107dd8cfda27
SHA1835f9a0c24219d4492e719be72f643cf81172a60
SHA256ed378e2e8443db54fe250568c3737d87db718326cf13670c0460f8cab3daf85e
SHA5125aeb577ac9394c0c3e129abaa894ec93f85b59130ff876fa2e54859c06067feb4dd4bc2884b2b3a2a0bb86f3237569563ff60fbc3e49f059df125269e6990152
-
Filesize
528KB
MD5fd4a39808c5c92c5112d107dd8cfda27
SHA1835f9a0c24219d4492e719be72f643cf81172a60
SHA256ed378e2e8443db54fe250568c3737d87db718326cf13670c0460f8cab3daf85e
SHA5125aeb577ac9394c0c3e129abaa894ec93f85b59130ff876fa2e54859c06067feb4dd4bc2884b2b3a2a0bb86f3237569563ff60fbc3e49f059df125269e6990152
-
Filesize
258KB
MD53fa3b033c4f009e10bc1fc1937d1648f
SHA15312efd06ad98019cd9b47e29508eda8e0a75a22
SHA256802445df965f6ab11774fe9b2df81259fde366c7d31e201920c01c52e4470265
SHA51215b09a70edfa6e9db5ec26ed4f905e8ab9879274e3bbc3bc7b88e331ef557ad64fa060f1c35013055070fec16ad703e31c3e0ab01b86ac0a846709e7600ff3d1
-
Filesize
258KB
MD53fa3b033c4f009e10bc1fc1937d1648f
SHA15312efd06ad98019cd9b47e29508eda8e0a75a22
SHA256802445df965f6ab11774fe9b2df81259fde366c7d31e201920c01c52e4470265
SHA51215b09a70edfa6e9db5ec26ed4f905e8ab9879274e3bbc3bc7b88e331ef557ad64fa060f1c35013055070fec16ad703e31c3e0ab01b86ac0a846709e7600ff3d1
-
Filesize
308KB
MD5c08ea92c1d03fb367226765e9271415b
SHA1a7446c05eb491cbaeb1d528f96b4d6ba70017c2a
SHA2565687174289cc28ecf2025e0aec313a18151361200f818a8e6d83123e4ad40388
SHA512a975c487c656bd35704a3a2da42c2cae28aa72c234295ffc4d4c87f2aa4f05889bc5bed1d6e41c4b5c7390808cc0fae7241577cbf538694eb0167de089400a1d
-
Filesize
308KB
MD5c08ea92c1d03fb367226765e9271415b
SHA1a7446c05eb491cbaeb1d528f96b4d6ba70017c2a
SHA2565687174289cc28ecf2025e0aec313a18151361200f818a8e6d83123e4ad40388
SHA512a975c487c656bd35704a3a2da42c2cae28aa72c234295ffc4d4c87f2aa4f05889bc5bed1d6e41c4b5c7390808cc0fae7241577cbf538694eb0167de089400a1d
-
Filesize
6.0MB
-
Filesize
248KB
-
Filesize
64KB
-
Filesize
320KB
-
Filesize
472KB
-
Filesize
248KB
-
Filesize
5.2MB
-
Filesize
1.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
408KB
-
Filesize
300KB
-
Filesize
248KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
1.0MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
280KB
-
Filesize
272KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
1.5MB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.5MB
-
Filesize
64KB
-
Filesize
96KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
180KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
5.0MB
-
Filesize
104KB
-
Filesize
200KB
-
Filesize
300KB
-
Filesize
64KB