Analysis

  • max time kernel
    50s
  • max time network
    64s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    16/03/2023, 05:20

General

  • Target

    13282d3149bba8cea62b34ad7d8c3de131cf37fec713091c9306a0ce6cad08b8.exe

  • Size

    864KB

  • MD5

    465235ad4e77d07cad4377287fdf8002

  • SHA1

    28e0f668919d2974d31e48ef94b5e054a93e534d

  • SHA256

    13282d3149bba8cea62b34ad7d8c3de131cf37fec713091c9306a0ce6cad08b8

  • SHA512

    31be199d4221c9bd17e3adc0a2ae2766ba53d19430c8cfd3b88db00793902c7221c0e8b8803f0b5baacab3d35faa6d85298d5d782dbe54eb59bc1726d0c8feca

  • SSDEEP

    24576:Sy8YMFNuPYusVMp1tUCBrR4s0pN8gbZx:59HPYu/95BFe

Malware Config

Extracted

Family

redline

Botnet

mango

C2

193.233.20.28:4125

Attributes
  • auth_value

    ecf79d7f5227d998a3501c972d915d23

Extracted

Family

redline

Botnet

sito

C2

193.233.20.28:4125

Attributes
  • auth_value

    030f94d8e396dbe51ce339b815cdad17

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\13282d3149bba8cea62b34ad7d8c3de131cf37fec713091c9306a0ce6cad08b8.exe
    "C:\Users\Admin\AppData\Local\Temp\13282d3149bba8cea62b34ad7d8c3de131cf37fec713091c9306a0ce6cad08b8.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2484
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice7573.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice7573.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2144
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice5580.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice5580.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3200
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5593hB.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5593hB.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5020
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c75zN89.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c75zN89.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4396
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dnDko86.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dnDko86.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3692
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e04qZ63.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e04qZ63.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4700

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e04qZ63.exe

          Filesize

          175KB

          MD5

          795f3fe5687db9b19853eaf6acdc389a

          SHA1

          cd1ba862909c58a01d3a8e44c29cb71bb6b50630

          SHA256

          448bad37914cb6f2102c2c8b10cd93770e529ab4fd13e616ee99e2e184cb0e56

          SHA512

          d9fdfef28242f378cda4698e6e89ae736dc60f5e1852aa414519bf0bdfce129e6c015306c43c7f10ab7648d158761ebaeb4dd54c1a04fa6d20a2f35cbf2b6130

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e04qZ63.exe

          Filesize

          175KB

          MD5

          795f3fe5687db9b19853eaf6acdc389a

          SHA1

          cd1ba862909c58a01d3a8e44c29cb71bb6b50630

          SHA256

          448bad37914cb6f2102c2c8b10cd93770e529ab4fd13e616ee99e2e184cb0e56

          SHA512

          d9fdfef28242f378cda4698e6e89ae736dc60f5e1852aa414519bf0bdfce129e6c015306c43c7f10ab7648d158761ebaeb4dd54c1a04fa6d20a2f35cbf2b6130

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice7573.exe

          Filesize

          719KB

          MD5

          2dcfb46f9d8abd37b640dba3367e11b8

          SHA1

          6da93a880908370daa18e4a5e6e7500f68434700

          SHA256

          ddc699075f0f0b269a70636ddcd22957609e9c76ff80dae6bd24811f9967eced

          SHA512

          6afc3b8f8657c383a6f37f2a1cfa97a178e169b6c4e9e2ee52cf6904c3993b6eddd629fae9e0fa3ad847c53d1ebe24ca3e8aabcd225df31724fae357f00f9acd

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice7573.exe

          Filesize

          719KB

          MD5

          2dcfb46f9d8abd37b640dba3367e11b8

          SHA1

          6da93a880908370daa18e4a5e6e7500f68434700

          SHA256

          ddc699075f0f0b269a70636ddcd22957609e9c76ff80dae6bd24811f9967eced

          SHA512

          6afc3b8f8657c383a6f37f2a1cfa97a178e169b6c4e9e2ee52cf6904c3993b6eddd629fae9e0fa3ad847c53d1ebe24ca3e8aabcd225df31724fae357f00f9acd

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dnDko86.exe

          Filesize

          408KB

          MD5

          8ffdea8c0227a5c9a986f88ff79aec28

          SHA1

          928faf2b6350a0791d2b89e2cda8a080c0ecfeee

          SHA256

          7fa1ab5ce7888320d5052a7b645c889d759b1548f508c6e49d6aabadb7f066a4

          SHA512

          58e9f2af3711a96c13b166db42478c1d74253b298df9c00a2ebe42b8e713f10b9e72e4d863dc6db2d6d8a1d2ea8ef05d5778e0410e714d84c389035a56fb1d32

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dnDko86.exe

          Filesize

          408KB

          MD5

          8ffdea8c0227a5c9a986f88ff79aec28

          SHA1

          928faf2b6350a0791d2b89e2cda8a080c0ecfeee

          SHA256

          7fa1ab5ce7888320d5052a7b645c889d759b1548f508c6e49d6aabadb7f066a4

          SHA512

          58e9f2af3711a96c13b166db42478c1d74253b298df9c00a2ebe42b8e713f10b9e72e4d863dc6db2d6d8a1d2ea8ef05d5778e0410e714d84c389035a56fb1d32

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice5580.exe

          Filesize

          360KB

          MD5

          af5da9e670408fe47a545c2fbad6c0bf

          SHA1

          2965353bae466c128ce4e26a31b9c29e797d3d88

          SHA256

          0a105c01a5ab55a9ccf675182129030c78948732a01ca0efae16936b288e31e2

          SHA512

          42ec721dade69887f0a1df97fc9d27c9962abb4bdba9934d58630c05fc772476d84b3ee256ac531e90fdbd25d8d20ba5a20736cb060bdb44dfc5f0592dfa7066

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice5580.exe

          Filesize

          360KB

          MD5

          af5da9e670408fe47a545c2fbad6c0bf

          SHA1

          2965353bae466c128ce4e26a31b9c29e797d3d88

          SHA256

          0a105c01a5ab55a9ccf675182129030c78948732a01ca0efae16936b288e31e2

          SHA512

          42ec721dade69887f0a1df97fc9d27c9962abb4bdba9934d58630c05fc772476d84b3ee256ac531e90fdbd25d8d20ba5a20736cb060bdb44dfc5f0592dfa7066

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5593hB.exe

          Filesize

          11KB

          MD5

          7e93bacbbc33e6652e147e7fe07572a0

          SHA1

          421a7167da01c8da4dc4d5234ca3dd84e319e762

          SHA256

          850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

          SHA512

          250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5593hB.exe

          Filesize

          11KB

          MD5

          7e93bacbbc33e6652e147e7fe07572a0

          SHA1

          421a7167da01c8da4dc4d5234ca3dd84e319e762

          SHA256

          850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

          SHA512

          250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c75zN89.exe

          Filesize

          350KB

          MD5

          cdf4274f5253474ffee50855148e2f59

          SHA1

          605a482c95f9adc478830674a01982478dda4713

          SHA256

          3dbdb5f9678e8ed43e738e55f24f65a731261073c3ae684ebc06cda88ea2f6a5

          SHA512

          2f23d4921426501c974ccf134b52d1eca05a8c9ea77f391d7eab240fcfacbd22c2cf3437567c35e3c449365fd474f07bcdda4b7b50654ce514d8e6a32e5889a7

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c75zN89.exe

          Filesize

          350KB

          MD5

          cdf4274f5253474ffee50855148e2f59

          SHA1

          605a482c95f9adc478830674a01982478dda4713

          SHA256

          3dbdb5f9678e8ed43e738e55f24f65a731261073c3ae684ebc06cda88ea2f6a5

          SHA512

          2f23d4921426501c974ccf134b52d1eca05a8c9ea77f391d7eab240fcfacbd22c2cf3437567c35e3c449365fd474f07bcdda4b7b50654ce514d8e6a32e5889a7

        • memory/3692-353-0x00000000072C0000-0x00000000072D0000-memory.dmp

          Filesize

          64KB

        • memory/3692-1104-0x00000000071F0000-0x0000000007202000-memory.dmp

          Filesize

          72KB

        • memory/3692-1117-0x00000000093D0000-0x0000000009420000-memory.dmp

          Filesize

          320KB

        • memory/3692-1116-0x0000000009340000-0x00000000093B6000-memory.dmp

          Filesize

          472KB

        • memory/3692-1115-0x0000000008C00000-0x000000000912C000-memory.dmp

          Filesize

          5.2MB

        • memory/3692-1114-0x0000000008A30000-0x0000000008BF2000-memory.dmp

          Filesize

          1.8MB

        • memory/3692-1113-0x00000000072C0000-0x00000000072D0000-memory.dmp

          Filesize

          64KB

        • memory/3692-1112-0x00000000072C0000-0x00000000072D0000-memory.dmp

          Filesize

          64KB

        • memory/3692-1111-0x00000000072C0000-0x00000000072D0000-memory.dmp

          Filesize

          64KB

        • memory/3692-1110-0x00000000087F0000-0x0000000008882000-memory.dmp

          Filesize

          584KB

        • memory/3692-1109-0x0000000007B10000-0x0000000007B76000-memory.dmp

          Filesize

          408KB

        • memory/3692-1107-0x00000000072C0000-0x00000000072D0000-memory.dmp

          Filesize

          64KB

        • memory/3692-1106-0x0000000007260000-0x00000000072AB000-memory.dmp

          Filesize

          300KB

        • memory/3692-1105-0x0000000007210000-0x000000000724E000-memory.dmp

          Filesize

          248KB

        • memory/3692-1103-0x00000000077D0000-0x00000000078DA000-memory.dmp

          Filesize

          1.0MB

        • memory/3692-1102-0x0000000007DE0000-0x00000000083E6000-memory.dmp

          Filesize

          6.0MB

        • memory/3692-355-0x00000000072C0000-0x00000000072D0000-memory.dmp

          Filesize

          64KB

        • memory/3692-352-0x00000000072C0000-0x00000000072D0000-memory.dmp

          Filesize

          64KB

        • memory/3692-350-0x0000000002B30000-0x0000000002B7B000-memory.dmp

          Filesize

          300KB

        • memory/3692-225-0x0000000004C60000-0x0000000004C9E000-memory.dmp

          Filesize

          248KB

        • memory/3692-223-0x0000000004C60000-0x0000000004C9E000-memory.dmp

          Filesize

          248KB

        • memory/3692-217-0x0000000004C60000-0x0000000004C9E000-memory.dmp

          Filesize

          248KB

        • memory/3692-219-0x0000000004C60000-0x0000000004C9E000-memory.dmp

          Filesize

          248KB

        • memory/3692-190-0x0000000004900000-0x0000000004946000-memory.dmp

          Filesize

          280KB

        • memory/3692-191-0x0000000004C60000-0x0000000004CA4000-memory.dmp

          Filesize

          272KB

        • memory/3692-192-0x0000000004C60000-0x0000000004C9E000-memory.dmp

          Filesize

          248KB

        • memory/3692-193-0x0000000004C60000-0x0000000004C9E000-memory.dmp

          Filesize

          248KB

        • memory/3692-197-0x0000000004C60000-0x0000000004C9E000-memory.dmp

          Filesize

          248KB

        • memory/3692-195-0x0000000004C60000-0x0000000004C9E000-memory.dmp

          Filesize

          248KB

        • memory/3692-201-0x0000000004C60000-0x0000000004C9E000-memory.dmp

          Filesize

          248KB

        • memory/3692-199-0x0000000004C60000-0x0000000004C9E000-memory.dmp

          Filesize

          248KB

        • memory/3692-207-0x0000000004C60000-0x0000000004C9E000-memory.dmp

          Filesize

          248KB

        • memory/3692-205-0x0000000004C60000-0x0000000004C9E000-memory.dmp

          Filesize

          248KB

        • memory/3692-203-0x0000000004C60000-0x0000000004C9E000-memory.dmp

          Filesize

          248KB

        • memory/3692-211-0x0000000004C60000-0x0000000004C9E000-memory.dmp

          Filesize

          248KB

        • memory/3692-213-0x0000000004C60000-0x0000000004C9E000-memory.dmp

          Filesize

          248KB

        • memory/3692-215-0x0000000004C60000-0x0000000004C9E000-memory.dmp

          Filesize

          248KB

        • memory/3692-209-0x0000000004C60000-0x0000000004C9E000-memory.dmp

          Filesize

          248KB

        • memory/3692-221-0x0000000004C60000-0x0000000004C9E000-memory.dmp

          Filesize

          248KB

        • memory/4396-172-0x00000000048F0000-0x0000000004902000-memory.dmp

          Filesize

          72KB

        • memory/4396-148-0x0000000004740000-0x000000000475A000-memory.dmp

          Filesize

          104KB

        • memory/4396-185-0x0000000000400000-0x0000000002B1C000-memory.dmp

          Filesize

          39.1MB

        • memory/4396-183-0x0000000000400000-0x0000000002B1C000-memory.dmp

          Filesize

          39.1MB

        • memory/4396-150-0x00000000048F0000-0x0000000004908000-memory.dmp

          Filesize

          96KB

        • memory/4396-181-0x0000000004D10000-0x0000000004D20000-memory.dmp

          Filesize

          64KB

        • memory/4396-149-0x0000000007170000-0x000000000766E000-memory.dmp

          Filesize

          5.0MB

        • memory/4396-180-0x0000000004D10000-0x0000000004D20000-memory.dmp

          Filesize

          64KB

        • memory/4396-179-0x0000000002BF0000-0x0000000002C1D000-memory.dmp

          Filesize

          180KB

        • memory/4396-174-0x00000000048F0000-0x0000000004902000-memory.dmp

          Filesize

          72KB

        • memory/4396-151-0x00000000048F0000-0x0000000004902000-memory.dmp

          Filesize

          72KB

        • memory/4396-178-0x00000000048F0000-0x0000000004902000-memory.dmp

          Filesize

          72KB

        • memory/4396-152-0x00000000048F0000-0x0000000004902000-memory.dmp

          Filesize

          72KB

        • memory/4396-176-0x00000000048F0000-0x0000000004902000-memory.dmp

          Filesize

          72KB

        • memory/4396-182-0x0000000004D10000-0x0000000004D20000-memory.dmp

          Filesize

          64KB

        • memory/4396-170-0x00000000048F0000-0x0000000004902000-memory.dmp

          Filesize

          72KB

        • memory/4396-164-0x00000000048F0000-0x0000000004902000-memory.dmp

          Filesize

          72KB

        • memory/4396-166-0x00000000048F0000-0x0000000004902000-memory.dmp

          Filesize

          72KB

        • memory/4396-162-0x00000000048F0000-0x0000000004902000-memory.dmp

          Filesize

          72KB

        • memory/4396-160-0x00000000048F0000-0x0000000004902000-memory.dmp

          Filesize

          72KB

        • memory/4396-154-0x00000000048F0000-0x0000000004902000-memory.dmp

          Filesize

          72KB

        • memory/4396-156-0x00000000048F0000-0x0000000004902000-memory.dmp

          Filesize

          72KB

        • memory/4396-158-0x00000000048F0000-0x0000000004902000-memory.dmp

          Filesize

          72KB

        • memory/4396-168-0x00000000048F0000-0x0000000004902000-memory.dmp

          Filesize

          72KB

        • memory/4700-1123-0x0000000000020000-0x0000000000052000-memory.dmp

          Filesize

          200KB

        • memory/4700-1124-0x0000000004C40000-0x0000000004C50000-memory.dmp

          Filesize

          64KB

        • memory/4700-1125-0x0000000004A60000-0x0000000004AAB000-memory.dmp

          Filesize

          300KB

        • memory/5020-142-0x0000000000800000-0x000000000080A000-memory.dmp

          Filesize

          40KB