Analysis

  • max time kernel
    77s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/03/2023, 05:16

General

  • Target

    cce03db758554e7162259948e471d558d97ffb02ed5284debfcc9c2ad4dd1040.exe

  • Size

    659KB

  • MD5

    09ee40cdf9bb0ac0f8d08893a4308016

  • SHA1

    d099b1f19f300691f8621928eb33fd5c5f011cfd

  • SHA256

    cce03db758554e7162259948e471d558d97ffb02ed5284debfcc9c2ad4dd1040

  • SHA512

    93984354f963acd12a35aebcd4032cfeba2df057ab761ff8c0576e0e5429e0c1215c7c5fcbc06eb63e8bd60962d12e128c150b7372f4e50620e8626f203eee8a

  • SSDEEP

    12288:TMrgy90evpJcRtH7lUJW6TEvmeiLjhklnwfoio1AwAQEiXTG9g:Hy2tH5sxEOjjhInMcHXTX

Malware Config

Extracted

Family

redline

Botnet

rosto

C2

hueref.eu:4162

Attributes
  • auth_value

    07d81eba8cad42bbd0ae60042d48eac6

Extracted

Family

redline

Botnet

foksa

C2

hueref.eu:4162

Attributes
  • auth_value

    6a9b2601a21672b285de3ed41b5402e4

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 18 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cce03db758554e7162259948e471d558d97ffb02ed5284debfcc9c2ad4dd1040.exe
    "C:\Users\Admin\AppData\Local\Temp\cce03db758554e7162259948e471d558d97ffb02ed5284debfcc9c2ad4dd1040.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4244
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ycSR33bg56.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ycSR33bg56.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2132
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\urMk27oF71.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\urMk27oF71.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1504
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 1080
          4⤵
          • Program crash
          PID:4612
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wrci56Uk47.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wrci56Uk47.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1116
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 1764
          4⤵
          • Program crash
          PID:2924
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xumG71iJ61.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xumG71iJ61.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1960
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1504 -ip 1504
    1⤵
      PID:3172
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1116 -ip 1116
      1⤵
        PID:3840

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xumG71iJ61.exe

        Filesize

        175KB

        MD5

        75ced8ad0d8cd237ebc9cb7b00852651

        SHA1

        adab63df3e0a40fd9f170ab57da66f01f226141c

        SHA256

        a35a264162c124ffd066dd867ed96359131d37b243cb0445c1c9eba6a58de819

        SHA512

        f565a49b14671683a1e48cece82a437a79bf8bdb456a3c6f35fac020e5fef3cd666399208633b7d2da9407f7b334a311a416b0a969c8b62ff28e15e7d4a0c431

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xumG71iJ61.exe

        Filesize

        175KB

        MD5

        75ced8ad0d8cd237ebc9cb7b00852651

        SHA1

        adab63df3e0a40fd9f170ab57da66f01f226141c

        SHA256

        a35a264162c124ffd066dd867ed96359131d37b243cb0445c1c9eba6a58de819

        SHA512

        f565a49b14671683a1e48cece82a437a79bf8bdb456a3c6f35fac020e5fef3cd666399208633b7d2da9407f7b334a311a416b0a969c8b62ff28e15e7d4a0c431

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ycSR33bg56.exe

        Filesize

        515KB

        MD5

        599f3583e2a6ecc4c506526355bab406

        SHA1

        5885604e0abc91dc6e44045ed58f98824d58da51

        SHA256

        750980bb6cd241c01c9a91ff6907bed1efaf1c7b1ccddda1d64d4bb67c5fcea4

        SHA512

        6f74b824e54c3368fcf433ca802cdc3f4c8167ea650d31c70ffafd4db563e8c6092150acaf1db380189bf0b91eeec792c238d397348f8aa94cc81448746aeb54

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ycSR33bg56.exe

        Filesize

        515KB

        MD5

        599f3583e2a6ecc4c506526355bab406

        SHA1

        5885604e0abc91dc6e44045ed58f98824d58da51

        SHA256

        750980bb6cd241c01c9a91ff6907bed1efaf1c7b1ccddda1d64d4bb67c5fcea4

        SHA512

        6f74b824e54c3368fcf433ca802cdc3f4c8167ea650d31c70ffafd4db563e8c6092150acaf1db380189bf0b91eeec792c238d397348f8aa94cc81448746aeb54

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\urMk27oF71.exe

        Filesize

        232KB

        MD5

        be1c9ba8d385566aa2c1c0fe1001af3e

        SHA1

        bf40ca7120746478f12d9c7d430ae7945568a502

        SHA256

        8b7d7f82899b5d6718e90bea99fc1d9aabc09d961bada4eb29790661fa8260b4

        SHA512

        5c4edda4e7eb88164a82de739a373a388c1a7cf3e296aafffd95c2a4385ec63ca214455f53c33d1c86e7a268524d0d726e5f5775ab1c9c41d378c5c754215ae6

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\urMk27oF71.exe

        Filesize

        232KB

        MD5

        be1c9ba8d385566aa2c1c0fe1001af3e

        SHA1

        bf40ca7120746478f12d9c7d430ae7945568a502

        SHA256

        8b7d7f82899b5d6718e90bea99fc1d9aabc09d961bada4eb29790661fa8260b4

        SHA512

        5c4edda4e7eb88164a82de739a373a388c1a7cf3e296aafffd95c2a4385ec63ca214455f53c33d1c86e7a268524d0d726e5f5775ab1c9c41d378c5c754215ae6

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wrci56Uk47.exe

        Filesize

        290KB

        MD5

        8fee42f989bab807a7e66858ba5fe89d

        SHA1

        2f0c74aba0b54d351ac033248a718fa08edbfd91

        SHA256

        0b8c7c56907917d4b837cb95e0f7f47223d4457ddddd5986922cd7e3d61d70e5

        SHA512

        d4e1289b7bd0255a74eb8b85b552326ef288d45a9c69188a70215ecba62c984ecdb2ebb8ded103a699d109bf6d82ade212ed7c3dda8e04e780a79593cc3f6926

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wrci56Uk47.exe

        Filesize

        290KB

        MD5

        8fee42f989bab807a7e66858ba5fe89d

        SHA1

        2f0c74aba0b54d351ac033248a718fa08edbfd91

        SHA256

        0b8c7c56907917d4b837cb95e0f7f47223d4457ddddd5986922cd7e3d61d70e5

        SHA512

        d4e1289b7bd0255a74eb8b85b552326ef288d45a9c69188a70215ecba62c984ecdb2ebb8ded103a699d109bf6d82ade212ed7c3dda8e04e780a79593cc3f6926

      • memory/1116-1099-0x0000000005AB0000-0x0000000005AC2000-memory.dmp

        Filesize

        72KB

      • memory/1116-1100-0x0000000005AD0000-0x0000000005B0C000-memory.dmp

        Filesize

        240KB

      • memory/1116-1112-0x0000000002490000-0x00000000024E0000-memory.dmp

        Filesize

        320KB

      • memory/1116-1111-0x0000000008160000-0x00000000081D6000-memory.dmp

        Filesize

        472KB

      • memory/1116-1110-0x0000000007B10000-0x000000000803C000-memory.dmp

        Filesize

        5.2MB

      • memory/1116-1109-0x0000000007930000-0x0000000007AF2000-memory.dmp

        Filesize

        1.8MB

      • memory/1116-1108-0x0000000004AC0000-0x0000000004AD0000-memory.dmp

        Filesize

        64KB

      • memory/1116-1107-0x0000000004AC0000-0x0000000004AD0000-memory.dmp

        Filesize

        64KB

      • memory/1116-1106-0x0000000004AC0000-0x0000000004AD0000-memory.dmp

        Filesize

        64KB

      • memory/1116-1105-0x0000000004AC0000-0x0000000004AD0000-memory.dmp

        Filesize

        64KB

      • memory/1116-1104-0x0000000005E70000-0x0000000005ED6000-memory.dmp

        Filesize

        408KB

      • memory/1116-1102-0x0000000005DD0000-0x0000000005E62000-memory.dmp

        Filesize

        584KB

      • memory/1116-1101-0x0000000004AC0000-0x0000000004AD0000-memory.dmp

        Filesize

        64KB

      • memory/1116-1098-0x0000000005970000-0x0000000005A7A000-memory.dmp

        Filesize

        1.0MB

      • memory/1116-1097-0x00000000052D0000-0x00000000058E8000-memory.dmp

        Filesize

        6.1MB

      • memory/1116-224-0x0000000005100000-0x000000000513E000-memory.dmp

        Filesize

        248KB

      • memory/1116-222-0x0000000005100000-0x000000000513E000-memory.dmp

        Filesize

        248KB

      • memory/1116-220-0x0000000005100000-0x000000000513E000-memory.dmp

        Filesize

        248KB

      • memory/1116-218-0x0000000005100000-0x000000000513E000-memory.dmp

        Filesize

        248KB

      • memory/1116-187-0x0000000000590000-0x00000000005DB000-memory.dmp

        Filesize

        300KB

      • memory/1116-188-0x0000000004AC0000-0x0000000004AD0000-memory.dmp

        Filesize

        64KB

      • memory/1116-189-0x0000000004AC0000-0x0000000004AD0000-memory.dmp

        Filesize

        64KB

      • memory/1116-190-0x0000000004AC0000-0x0000000004AD0000-memory.dmp

        Filesize

        64KB

      • memory/1116-191-0x0000000005100000-0x000000000513E000-memory.dmp

        Filesize

        248KB

      • memory/1116-192-0x0000000005100000-0x000000000513E000-memory.dmp

        Filesize

        248KB

      • memory/1116-194-0x0000000005100000-0x000000000513E000-memory.dmp

        Filesize

        248KB

      • memory/1116-196-0x0000000005100000-0x000000000513E000-memory.dmp

        Filesize

        248KB

      • memory/1116-198-0x0000000005100000-0x000000000513E000-memory.dmp

        Filesize

        248KB

      • memory/1116-200-0x0000000005100000-0x000000000513E000-memory.dmp

        Filesize

        248KB

      • memory/1116-202-0x0000000005100000-0x000000000513E000-memory.dmp

        Filesize

        248KB

      • memory/1116-204-0x0000000005100000-0x000000000513E000-memory.dmp

        Filesize

        248KB

      • memory/1116-206-0x0000000005100000-0x000000000513E000-memory.dmp

        Filesize

        248KB

      • memory/1116-208-0x0000000005100000-0x000000000513E000-memory.dmp

        Filesize

        248KB

      • memory/1116-210-0x0000000005100000-0x000000000513E000-memory.dmp

        Filesize

        248KB

      • memory/1116-212-0x0000000005100000-0x000000000513E000-memory.dmp

        Filesize

        248KB

      • memory/1116-214-0x0000000005100000-0x000000000513E000-memory.dmp

        Filesize

        248KB

      • memory/1116-216-0x0000000005100000-0x000000000513E000-memory.dmp

        Filesize

        248KB

      • memory/1504-171-0x00000000025E0000-0x00000000025F2000-memory.dmp

        Filesize

        72KB

      • memory/1504-175-0x00000000025E0000-0x00000000025F2000-memory.dmp

        Filesize

        72KB

      • memory/1504-182-0x0000000000400000-0x000000000057E000-memory.dmp

        Filesize

        1.5MB

      • memory/1504-180-0x0000000000400000-0x000000000057E000-memory.dmp

        Filesize

        1.5MB

      • memory/1504-179-0x00000000025E0000-0x00000000025F2000-memory.dmp

        Filesize

        72KB

      • memory/1504-177-0x00000000025E0000-0x00000000025F2000-memory.dmp

        Filesize

        72KB

      • memory/1504-150-0x0000000004CA0000-0x0000000004CB0000-memory.dmp

        Filesize

        64KB

      • memory/1504-167-0x00000000025E0000-0x00000000025F2000-memory.dmp

        Filesize

        72KB

      • memory/1504-169-0x00000000025E0000-0x00000000025F2000-memory.dmp

        Filesize

        72KB

      • memory/1504-173-0x00000000025E0000-0x00000000025F2000-memory.dmp

        Filesize

        72KB

      • memory/1504-152-0x00000000025E0000-0x00000000025F2000-memory.dmp

        Filesize

        72KB

      • memory/1504-151-0x0000000004CB0000-0x0000000005254000-memory.dmp

        Filesize

        5.6MB

      • memory/1504-153-0x00000000025E0000-0x00000000025F2000-memory.dmp

        Filesize

        72KB

      • memory/1504-165-0x00000000025E0000-0x00000000025F2000-memory.dmp

        Filesize

        72KB

      • memory/1504-161-0x00000000025E0000-0x00000000025F2000-memory.dmp

        Filesize

        72KB

      • memory/1504-163-0x00000000025E0000-0x00000000025F2000-memory.dmp

        Filesize

        72KB

      • memory/1504-159-0x00000000025E0000-0x00000000025F2000-memory.dmp

        Filesize

        72KB

      • memory/1504-157-0x00000000025E0000-0x00000000025F2000-memory.dmp

        Filesize

        72KB

      • memory/1504-155-0x00000000025E0000-0x00000000025F2000-memory.dmp

        Filesize

        72KB

      • memory/1504-149-0x0000000004CA0000-0x0000000004CB0000-memory.dmp

        Filesize

        64KB

      • memory/1504-148-0x0000000000580000-0x00000000005AD000-memory.dmp

        Filesize

        180KB

      • memory/1960-1118-0x0000000000EF0000-0x0000000000F22000-memory.dmp

        Filesize

        200KB

      • memory/1960-1119-0x0000000005780000-0x0000000005790000-memory.dmp

        Filesize

        64KB