Analysis

  • max time kernel
    144s
  • max time network
    147s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    05-03-2023 19:11

General

  • Target

    b17edadffa1f147d0e1dbe7dd5296584a0dafdc6d4682bd61db38d43116be087.exe

  • Size

    526KB

  • MD5

    ddda2347a7f8f0038f1dea6f5f19b212

  • SHA1

    8132f718eefc676fc8495db3a6ab1c4573cc19ba

  • SHA256

    b17edadffa1f147d0e1dbe7dd5296584a0dafdc6d4682bd61db38d43116be087

  • SHA512

    b689371f4375c85dfc05149529875c1edb59ba53a83dcd739833c71b004eb2ae585ae4c9ca27057b31721d707893cbc99c04e86e8998572d9ff806f009d571b4

  • SSDEEP

    12288:zMrZy90eRzyBfDNWIAnJTeDAOZ5QnBuva16yRYE6KA11vc:WyPaD4IYTesOv6BrvZyJc

Malware Config

Extracted

Family

redline

Botnet

fud

C2

193.233.20.27:4123

Attributes
  • auth_value

    cddc991efd6918ad5321d80dac884b40

Extracted

Family

redline

Botnet

fabio

C2

193.233.20.27:4123

Attributes
  • auth_value

    56b82736c3f56b13be8e64c87d2cf9e5

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b17edadffa1f147d0e1dbe7dd5296584a0dafdc6d4682bd61db38d43116be087.exe
    "C:\Users\Admin\AppData\Local\Temp\b17edadffa1f147d0e1dbe7dd5296584a0dafdc6d4682bd61db38d43116be087.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2896
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhPV8344Ub.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhPV8344Ub.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3160
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf73iF58fV18.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf73iF58fV18.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4360
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf02ii99oU80.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf02ii99oU80.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2956
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\uhnW21qo40jA.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\uhnW21qo40jA.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1940

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\uhnW21qo40jA.exe

    Filesize

    175KB

    MD5

    edf9446b94abd7b431aa9201a157a5c3

    SHA1

    ba2af6fb45ed6a546c3a9e74674420fc4f0e942e

    SHA256

    c5a29805ae1c8027a26fe0e4094eb1eb607e1bd719bad36a1803465e987260c7

    SHA512

    e58bf34859cf0df1dd69870796936e4a778e490117130446585de61bc9ebb40ca7338daadea0775f6e2789b842888c97fe8ccfdea0a13f71c658b927c6f1ddf8

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\uhnW21qo40jA.exe

    Filesize

    175KB

    MD5

    edf9446b94abd7b431aa9201a157a5c3

    SHA1

    ba2af6fb45ed6a546c3a9e74674420fc4f0e942e

    SHA256

    c5a29805ae1c8027a26fe0e4094eb1eb607e1bd719bad36a1803465e987260c7

    SHA512

    e58bf34859cf0df1dd69870796936e4a778e490117130446585de61bc9ebb40ca7338daadea0775f6e2789b842888c97fe8ccfdea0a13f71c658b927c6f1ddf8

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhPV8344Ub.exe

    Filesize

    381KB

    MD5

    14c887a9ef100af3c6dcc7ac3ef3f2cc

    SHA1

    9ae35f5815eb5b4624eca4e28e25d74b70f537d9

    SHA256

    df33f5bc276c11c1326967823ca3e6181679e2f94513d934e7a6ffb521dd3480

    SHA512

    412d431b991538179416309adf4beeddf142afa0a58bea18c3e7eac51265fca7551526c38e926556df3e3ec8823e44c274dbdb4f87786048b62ff834e200745d

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhPV8344Ub.exe

    Filesize

    381KB

    MD5

    14c887a9ef100af3c6dcc7ac3ef3f2cc

    SHA1

    9ae35f5815eb5b4624eca4e28e25d74b70f537d9

    SHA256

    df33f5bc276c11c1326967823ca3e6181679e2f94513d934e7a6ffb521dd3480

    SHA512

    412d431b991538179416309adf4beeddf142afa0a58bea18c3e7eac51265fca7551526c38e926556df3e3ec8823e44c274dbdb4f87786048b62ff834e200745d

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf73iF58fV18.exe

    Filesize

    11KB

    MD5

    4759c87cb8aae3b368ce489ed3888406

    SHA1

    428b9a715af61d129a9a86145884f344a557f1aa

    SHA256

    48ebc806315e6f54059fd03b98c5c853e0e3a457b1f1d8dc6fa61f57470b7f62

    SHA512

    e8b16bbc37b67efcbee78d2085487f57d909e4e84160e6fbef838a403f5642d86b330db35ea0887b89629176ed684a8d2c4ef76a32724dbb4b35aead6ef16d04

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf73iF58fV18.exe

    Filesize

    11KB

    MD5

    4759c87cb8aae3b368ce489ed3888406

    SHA1

    428b9a715af61d129a9a86145884f344a557f1aa

    SHA256

    48ebc806315e6f54059fd03b98c5c853e0e3a457b1f1d8dc6fa61f57470b7f62

    SHA512

    e8b16bbc37b67efcbee78d2085487f57d909e4e84160e6fbef838a403f5642d86b330db35ea0887b89629176ed684a8d2c4ef76a32724dbb4b35aead6ef16d04

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf02ii99oU80.exe

    Filesize

    292KB

    MD5

    bd407beaed8912f6f9f5b269e5a85686

    SHA1

    f9d8fc6c0a1ca9a1e0af1ca278f629994df04b1b

    SHA256

    3fb5f126878146985387aac28dc8b1c17d8ee6ae3630a0c754c135138180d367

    SHA512

    79eca3bfa76f241986888271cbcf4858a6eb2c729b1dbebcf000ae13b9fb1e981360c930e40c39437c027794ecce33d9302e6db93d65208ad6bb458aa1b2ff72

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf02ii99oU80.exe

    Filesize

    292KB

    MD5

    bd407beaed8912f6f9f5b269e5a85686

    SHA1

    f9d8fc6c0a1ca9a1e0af1ca278f629994df04b1b

    SHA256

    3fb5f126878146985387aac28dc8b1c17d8ee6ae3630a0c754c135138180d367

    SHA512

    79eca3bfa76f241986888271cbcf4858a6eb2c729b1dbebcf000ae13b9fb1e981360c930e40c39437c027794ecce33d9302e6db93d65208ad6bb458aa1b2ff72

  • memory/1940-1074-0x0000000000EA0000-0x0000000000ED2000-memory.dmp

    Filesize

    200KB

  • memory/1940-1075-0x0000000005780000-0x00000000057CB000-memory.dmp

    Filesize

    300KB

  • memory/1940-1076-0x0000000005710000-0x0000000005720000-memory.dmp

    Filesize

    64KB

  • memory/2956-177-0x00000000026F0000-0x000000000272E000-memory.dmp

    Filesize

    248KB

  • memory/2956-189-0x00000000026F0000-0x000000000272E000-memory.dmp

    Filesize

    248KB

  • memory/2956-144-0x0000000000660000-0x00000000006AB000-memory.dmp

    Filesize

    300KB

  • memory/2956-145-0x0000000004D40000-0x0000000004D50000-memory.dmp

    Filesize

    64KB

  • memory/2956-146-0x0000000004D40000-0x0000000004D50000-memory.dmp

    Filesize

    64KB

  • memory/2956-147-0x0000000004D40000-0x0000000004D50000-memory.dmp

    Filesize

    64KB

  • memory/2956-148-0x00000000026F0000-0x000000000272E000-memory.dmp

    Filesize

    248KB

  • memory/2956-149-0x00000000026F0000-0x000000000272E000-memory.dmp

    Filesize

    248KB

  • memory/2956-151-0x00000000026F0000-0x000000000272E000-memory.dmp

    Filesize

    248KB

  • memory/2956-153-0x00000000026F0000-0x000000000272E000-memory.dmp

    Filesize

    248KB

  • memory/2956-155-0x00000000026F0000-0x000000000272E000-memory.dmp

    Filesize

    248KB

  • memory/2956-157-0x00000000026F0000-0x000000000272E000-memory.dmp

    Filesize

    248KB

  • memory/2956-159-0x00000000026F0000-0x000000000272E000-memory.dmp

    Filesize

    248KB

  • memory/2956-161-0x00000000026F0000-0x000000000272E000-memory.dmp

    Filesize

    248KB

  • memory/2956-163-0x00000000026F0000-0x000000000272E000-memory.dmp

    Filesize

    248KB

  • memory/2956-165-0x00000000026F0000-0x000000000272E000-memory.dmp

    Filesize

    248KB

  • memory/2956-167-0x00000000026F0000-0x000000000272E000-memory.dmp

    Filesize

    248KB

  • memory/2956-169-0x00000000026F0000-0x000000000272E000-memory.dmp

    Filesize

    248KB

  • memory/2956-171-0x00000000026F0000-0x000000000272E000-memory.dmp

    Filesize

    248KB

  • memory/2956-173-0x00000000026F0000-0x000000000272E000-memory.dmp

    Filesize

    248KB

  • memory/2956-175-0x00000000026F0000-0x000000000272E000-memory.dmp

    Filesize

    248KB

  • memory/2956-142-0x0000000004D50000-0x000000000524E000-memory.dmp

    Filesize

    5.0MB

  • memory/2956-179-0x00000000026F0000-0x000000000272E000-memory.dmp

    Filesize

    248KB

  • memory/2956-181-0x00000000026F0000-0x000000000272E000-memory.dmp

    Filesize

    248KB

  • memory/2956-183-0x00000000026F0000-0x000000000272E000-memory.dmp

    Filesize

    248KB

  • memory/2956-185-0x00000000026F0000-0x000000000272E000-memory.dmp

    Filesize

    248KB

  • memory/2956-187-0x00000000026F0000-0x000000000272E000-memory.dmp

    Filesize

    248KB

  • memory/2956-143-0x00000000026F0000-0x0000000002734000-memory.dmp

    Filesize

    272KB

  • memory/2956-191-0x00000000026F0000-0x000000000272E000-memory.dmp

    Filesize

    248KB

  • memory/2956-193-0x00000000026F0000-0x000000000272E000-memory.dmp

    Filesize

    248KB

  • memory/2956-195-0x00000000026F0000-0x000000000272E000-memory.dmp

    Filesize

    248KB

  • memory/2956-197-0x00000000026F0000-0x000000000272E000-memory.dmp

    Filesize

    248KB

  • memory/2956-199-0x00000000026F0000-0x000000000272E000-memory.dmp

    Filesize

    248KB

  • memory/2956-201-0x00000000026F0000-0x000000000272E000-memory.dmp

    Filesize

    248KB

  • memory/2956-203-0x00000000026F0000-0x000000000272E000-memory.dmp

    Filesize

    248KB

  • memory/2956-205-0x00000000026F0000-0x000000000272E000-memory.dmp

    Filesize

    248KB

  • memory/2956-207-0x00000000026F0000-0x000000000272E000-memory.dmp

    Filesize

    248KB

  • memory/2956-209-0x00000000026F0000-0x000000000272E000-memory.dmp

    Filesize

    248KB

  • memory/2956-211-0x00000000026F0000-0x000000000272E000-memory.dmp

    Filesize

    248KB

  • memory/2956-1054-0x0000000005860000-0x0000000005E66000-memory.dmp

    Filesize

    6.0MB

  • memory/2956-1055-0x0000000004C10000-0x0000000004D1A000-memory.dmp

    Filesize

    1.0MB

  • memory/2956-1056-0x0000000005260000-0x0000000005272000-memory.dmp

    Filesize

    72KB

  • memory/2956-1057-0x0000000005280000-0x00000000052BE000-memory.dmp

    Filesize

    248KB

  • memory/2956-1058-0x0000000004D40000-0x0000000004D50000-memory.dmp

    Filesize

    64KB

  • memory/2956-1059-0x00000000053D0000-0x000000000541B000-memory.dmp

    Filesize

    300KB

  • memory/2956-1061-0x0000000005560000-0x00000000055C6000-memory.dmp

    Filesize

    408KB

  • memory/2956-1062-0x0000000004D40000-0x0000000004D50000-memory.dmp

    Filesize

    64KB

  • memory/2956-1063-0x0000000006260000-0x00000000062F2000-memory.dmp

    Filesize

    584KB

  • memory/2956-1064-0x0000000006440000-0x00000000064B6000-memory.dmp

    Filesize

    472KB

  • memory/2956-141-0x0000000002670000-0x00000000026B6000-memory.dmp

    Filesize

    280KB

  • memory/2956-1065-0x00000000064C0000-0x0000000006510000-memory.dmp

    Filesize

    320KB

  • memory/2956-1066-0x0000000006530000-0x00000000066F2000-memory.dmp

    Filesize

    1.8MB

  • memory/2956-1067-0x0000000006710000-0x0000000006C3C000-memory.dmp

    Filesize

    5.2MB

  • memory/2956-1068-0x0000000004D40000-0x0000000004D50000-memory.dmp

    Filesize

    64KB

  • memory/4360-135-0x0000000000E90000-0x0000000000E9A000-memory.dmp

    Filesize

    40KB