Analysis
-
max time kernel
142s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
11/03/2023, 23:10 UTC
General
-
Target
002776c37d85fcca57dfea495f529bceb725f280e2fefdaad8cf98601f9ab8a2.exe
-
Size
1.3MB
-
MD5
62cab663d218c152d00ef98f1b4a4cf7
-
SHA1
435a083ebfed6445e8ee1d487fad1a1ffdd3c9a1
-
SHA256
002776c37d85fcca57dfea495f529bceb725f280e2fefdaad8cf98601f9ab8a2
-
SHA512
963f73b7bdca3ac9edad11554e19a0bd89eefcea9ebc6c794506c2efa7443dc07249279639bd979cabdc5d06ac58fbd204e33095d2c16c87a2c1d78e0114f88f
-
SSDEEP
24576:4yvwJJmioZPBAU7mUyv9pDk6Bz3TpSy3oc0aMm7shAXzeHMrbV761:/wJ4MWmUyFpDkez3Tp935Mm7s+jeHMHp
Malware Config
Extracted
redline
rouch
193.56.146.11:4162
-
auth_value
1b1735bcfc122c708eae27ca352568de
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
-
Executes dropped EXE 7 IoCs
-
Windows security modification 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 12 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\002776c37d85fcca57dfea495f529bceb725f280e2fefdaad8cf98601f9ab8a2.exe"C:\Users\Admin\AppData\Local\Temp\002776c37d85fcca57dfea495f529bceb725f280e2fefdaad8cf98601f9ab8a2.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ptBk1509sJ.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ptBk1509sJ.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ptEC5145xi.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ptEC5145xi.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ptHy8694oO.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ptHy8694oO.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ptQP8092Yh.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ptQP8092Yh.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\ptdj6654mk.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\ptdj6654mk.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\beBb76xg18.exeC:\Users\Admin\AppData\Local\Temp\IXP005.TMP\beBb76xg18.exe7⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\cuWy67ym81.exeC:\Users\Admin\AppData\Local\Temp\IXP005.TMP\cuWy67ym81.exe7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
Network
-
DNS97.17.167.52.in-addr.arpaRemote address:8.8.8.8:53Request97.17.167.52.in-addr.arpaIN PTRResponse -
DNS210.81.184.52.in-addr.arpaRemote address:8.8.8.8:53Request210.81.184.52.in-addr.arpaIN PTRResponse
-
DNS58.104.205.20.in-addr.arpaRemote address:8.8.8.8:53Request58.104.205.20.in-addr.arpaIN PTRResponse
-
DNS97.238.32.23.in-addr.arpaRemote address:8.8.8.8:53Request97.238.32.23.in-addr.arpaIN PTRResponse97.238.32.23.in-addr.arpaIN PTRa23-32-238-97deploystaticakamaitechnologiescom
-
DNS64.13.109.52.in-addr.arpaRemote address:8.8.8.8:53Request64.13.109.52.in-addr.arpaIN PTRResponse
-
193.56.146.11:4162 -
40.79.141.153:443 -
193.56.146.11:4162
-
193.56.146.11:4162
-
173.223.113.164:443 -
193.56.146.11:4162
-
193.56.146.11:4162
-
8.8.8.8:5397.17.167.52.in-addr.arpadns
DNS Request
97.17.167.52.in-addr.arpa
-
8.8.8.8:53210.81.184.52.in-addr.arpadns
DNS Request
210.81.184.52.in-addr.arpa
-
8.8.8.8:5358.104.205.20.in-addr.arpadns
DNS Request
58.104.205.20.in-addr.arpa
-
8.8.8.8:5397.238.32.23.in-addr.arpadns
DNS Request
97.238.32.23.in-addr.arpa
-
8.8.8.8:5364.13.109.52.in-addr.arpadns
DNS Request
64.13.109.52.in-addr.arpa
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5d012a754a22114dabcc026d1454e4a57
SHA1f5f944b9a67846f8693d809b2283761f96582ceb
SHA25615687588a64caddf2e8b8a2c6848a029cd3af94a162734383532d83df58b5b59
SHA512c631361eef9226c60385e4e6255ab0fb502af98f5baf1c80c6e8a3b51a17372d648a52fed67d63b33eba455381e695bf808750713d95fa19b91959803ec32a21
-
Filesize
1.2MB
MD5d012a754a22114dabcc026d1454e4a57
SHA1f5f944b9a67846f8693d809b2283761f96582ceb
SHA25615687588a64caddf2e8b8a2c6848a029cd3af94a162734383532d83df58b5b59
SHA512c631361eef9226c60385e4e6255ab0fb502af98f5baf1c80c6e8a3b51a17372d648a52fed67d63b33eba455381e695bf808750713d95fa19b91959803ec32a21
-
Filesize
1.0MB
MD5474f424f4aadf8e4d697b57e00a55709
SHA1ccccd9a03e149610f8a24ab358ef675120909d1a
SHA256fea441550b126056661a0d297fb09bf7e17655f91edf0e5663048a76163c6331
SHA512e7b11038c6e3d36571f636e6351fd2b8a9b973fc68d22861350b04f57c8a581ff1d2be1adca4f1f3a8462158c3858b7bd37c793e0cbe04391af8f592c25f3878
-
Filesize
1.0MB
MD5474f424f4aadf8e4d697b57e00a55709
SHA1ccccd9a03e149610f8a24ab358ef675120909d1a
SHA256fea441550b126056661a0d297fb09bf7e17655f91edf0e5663048a76163c6331
SHA512e7b11038c6e3d36571f636e6351fd2b8a9b973fc68d22861350b04f57c8a581ff1d2be1adca4f1f3a8462158c3858b7bd37c793e0cbe04391af8f592c25f3878
-
Filesize
935KB
MD53e41d36efb2e9c26dc9f35bd057b8ea7
SHA1471f1c72bb88aecfc4ca661e35e3ba6ea4fe0418
SHA2561c5a6c6683d2d3b995f5d5ff6e22aa18c38d4d2552a19f27ca5b5b7dd88e88d4
SHA5129343d101c37045d507aed058d2b9e14930ddcf42dc664e1ff95d8ab7999c02a0998de3e462f3b776130863cd3d2dfab989fe77cdc01aecc17e05aefac5df070f
-
Filesize
935KB
MD53e41d36efb2e9c26dc9f35bd057b8ea7
SHA1471f1c72bb88aecfc4ca661e35e3ba6ea4fe0418
SHA2561c5a6c6683d2d3b995f5d5ff6e22aa18c38d4d2552a19f27ca5b5b7dd88e88d4
SHA5129343d101c37045d507aed058d2b9e14930ddcf42dc664e1ff95d8ab7999c02a0998de3e462f3b776130863cd3d2dfab989fe77cdc01aecc17e05aefac5df070f
-
Filesize
666KB
MD528b4c5e70eee3019e5482fe12310d8ad
SHA12461e053ba54c6ae186ef2ffd79599d0a7338cb8
SHA2567d1c2617f9cb41cf0e30d7251496f3d0eae53d596a6b385eeaf9545234963d22
SHA5127b70c540fcdbe6cd83474b0ef4f8b3ceccc0e9357f7a3b7bb374311d3f1fab82744eb0fa30246f123b8eaeeb9fb91dcd380c2c661c1b24654d3684e04b6fc1bb
-
Filesize
666KB
MD528b4c5e70eee3019e5482fe12310d8ad
SHA12461e053ba54c6ae186ef2ffd79599d0a7338cb8
SHA2567d1c2617f9cb41cf0e30d7251496f3d0eae53d596a6b385eeaf9545234963d22
SHA5127b70c540fcdbe6cd83474b0ef4f8b3ceccc0e9357f7a3b7bb374311d3f1fab82744eb0fa30246f123b8eaeeb9fb91dcd380c2c661c1b24654d3684e04b6fc1bb
-
Filesize
391KB
MD51e0f8ecb339f0e9fecdc45c885507a67
SHA10e12114090dadb4244084eedd2cea5f79eb95a9a
SHA256db886d48ee3cb46a07c55908bcf01af03d3f3e4baff9ecef1bd12848064aaab2
SHA512673cd445c86696d8031f150c9b23bd036553a40583b6a7767109bc17fd02bd29e8ce08c67b008531b64b8c578e719910bf8b45ecd51e4257e267e95f3751f102
-
Filesize
391KB
MD51e0f8ecb339f0e9fecdc45c885507a67
SHA10e12114090dadb4244084eedd2cea5f79eb95a9a
SHA256db886d48ee3cb46a07c55908bcf01af03d3f3e4baff9ecef1bd12848064aaab2
SHA512673cd445c86696d8031f150c9b23bd036553a40583b6a7767109bc17fd02bd29e8ce08c67b008531b64b8c578e719910bf8b45ecd51e4257e267e95f3751f102
-
Filesize
11KB
MD5d4d85643b7fac92d62acadf7b6f62310
SHA149f17fec10ce02b6f26635e1366661e5d92cdf4e
SHA256bb9ded5e3e79f1ba1c44e9f7f2a802a0fbad93c867b83aaae439578efd65ece1
SHA512364b640f8221fde7ab0865053406d468893b017f3ca5af54d2d9b08c4fecae5f9d1c53a9117baa392b02079727a30b3c251c41026d970198a918dc3c45c98f4f
-
Filesize
11KB
MD5d4d85643b7fac92d62acadf7b6f62310
SHA149f17fec10ce02b6f26635e1366661e5d92cdf4e
SHA256bb9ded5e3e79f1ba1c44e9f7f2a802a0fbad93c867b83aaae439578efd65ece1
SHA512364b640f8221fde7ab0865053406d468893b017f3ca5af54d2d9b08c4fecae5f9d1c53a9117baa392b02079727a30b3c251c41026d970198a918dc3c45c98f4f
-
Filesize
11KB
MD5d4d85643b7fac92d62acadf7b6f62310
SHA149f17fec10ce02b6f26635e1366661e5d92cdf4e
SHA256bb9ded5e3e79f1ba1c44e9f7f2a802a0fbad93c867b83aaae439578efd65ece1
SHA512364b640f8221fde7ab0865053406d468893b017f3ca5af54d2d9b08c4fecae5f9d1c53a9117baa392b02079727a30b3c251c41026d970198a918dc3c45c98f4f
-
Filesize
304KB
MD59c3e7c5879f2758bb2add2fbf488ed16
SHA1c5a2662767f97a4860f33a9fe6cace435a3c1b02
SHA2567ec2ec7a2ee43e8dc5523be5af507bcf31f19dfed1faa303314729d2fe456acf
SHA5120808e8e4d00ffe2201f792095081c7fc1678ef3d75d8ae1e6d18363d1693a4bf3c1458252209a6ebd13255d8eb43c9eed45d8029a409ed511fbe3020e8b7ae8a
-
Filesize
304KB
MD59c3e7c5879f2758bb2add2fbf488ed16
SHA1c5a2662767f97a4860f33a9fe6cace435a3c1b02
SHA2567ec2ec7a2ee43e8dc5523be5af507bcf31f19dfed1faa303314729d2fe456acf
SHA5120808e8e4d00ffe2201f792095081c7fc1678ef3d75d8ae1e6d18363d1693a4bf3c1458252209a6ebd13255d8eb43c9eed45d8029a409ed511fbe3020e8b7ae8a
-
Filesize
304KB
MD59c3e7c5879f2758bb2add2fbf488ed16
SHA1c5a2662767f97a4860f33a9fe6cace435a3c1b02
SHA2567ec2ec7a2ee43e8dc5523be5af507bcf31f19dfed1faa303314729d2fe456acf
SHA5120808e8e4d00ffe2201f792095081c7fc1678ef3d75d8ae1e6d18363d1693a4bf3c1458252209a6ebd13255d8eb43c9eed45d8029a409ed511fbe3020e8b7ae8a
-
Filesize
40KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
5.6MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB