Analysis

  • max time kernel
    78s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/03/2023, 03:04

General

  • Target

    b64fa8d5cb275e892c79b281c28b0e3a0f1fc7bffdbc898158c2faea26ce91d8.exe

  • Size

    818KB

  • MD5

    3a3fdb9411fa808e0d822388231f8a07

  • SHA1

    a1095bce34ee56eab22b65d19798ab60d986a2a5

  • SHA256

    b64fa8d5cb275e892c79b281c28b0e3a0f1fc7bffdbc898158c2faea26ce91d8

  • SHA512

    ed584da52157d995a3a8b291775bcfc86636af0e8673468380743946c996c29ec5a9abc73d1dbb1d1d70b6713b7457c4445c98b88f240f2cf77f7a9761a75c4e

  • SSDEEP

    24576:/y5YgRsAzSZGnkkyWBarYSn8UfakzItk:K5HBGZGt2kIBI

Malware Config

Extracted

Family

redline

Botnet

gena

C2

193.233.20.30:4125

Attributes
  • auth_value

    93c20961cb6b06b2d5781c212db6201e

Extracted

Family

redline

Botnet

ruka

C2

193.233.20.28:4125

Attributes
  • auth_value

    5d1d0e51ebe1e3f16cca573ff651c43c

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 18 IoCs
  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b64fa8d5cb275e892c79b281c28b0e3a0f1fc7bffdbc898158c2faea26ce91d8.exe
    "C:\Users\Admin\AppData\Local\Temp\b64fa8d5cb275e892c79b281c28b0e3a0f1fc7bffdbc898158c2faea26ce91d8.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3728
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba6032.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba6032.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4348
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\niba9048.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\niba9048.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:632
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f3363GY.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f3363GY.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:748
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h74Da40.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h74Da40.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3548
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 1096
            5⤵
            • Program crash
            PID:1032
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iZzet41.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iZzet41.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:768
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 1340
          4⤵
          • Program crash
          PID:1824
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l89jM94.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l89jM94.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3312
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3548 -ip 3548
    1⤵
      PID:432
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 768 -ip 768
      1⤵
        PID:2684

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l89jM94.exe

              Filesize

              175KB

              MD5

              6c4c2a56d5dd785adbe4fe60fa3cc1f2

              SHA1

              f8bd4379310258f8e54c47b56f5eec7394adb9a2

              SHA256

              b182f2d3d49bdda2e29a0ed312deef4bee03983de54080c5e97ad6422de192d2

              SHA512

              f6958cab80e2f7736cea307b51be546e50acd5494b72db0343a09e6ef8c446114f51be6c9826fcb6e9f7190e4ec8415c0a403c3c1706183577c2604b877ff830

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l89jM94.exe

              Filesize

              175KB

              MD5

              6c4c2a56d5dd785adbe4fe60fa3cc1f2

              SHA1

              f8bd4379310258f8e54c47b56f5eec7394adb9a2

              SHA256

              b182f2d3d49bdda2e29a0ed312deef4bee03983de54080c5e97ad6422de192d2

              SHA512

              f6958cab80e2f7736cea307b51be546e50acd5494b72db0343a09e6ef8c446114f51be6c9826fcb6e9f7190e4ec8415c0a403c3c1706183577c2604b877ff830

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba6032.exe

              Filesize

              677KB

              MD5

              039a8cd851df912ec343765f917bc638

              SHA1

              0466b749def3fd4ce254a6e4e89c0f6be139a0e2

              SHA256

              339a9e61265a65d980fb550623bf2bda14443d36dfa650165cdccee7cf15aabb

              SHA512

              664ae9d772845654e6a9e84b26470317fa06c34859e72781334752417164cecfd94bc3939e36edcf3062de9fa383c0e5cd6be1c961589a3089db490d0bf39537

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba6032.exe

              Filesize

              677KB

              MD5

              039a8cd851df912ec343765f917bc638

              SHA1

              0466b749def3fd4ce254a6e4e89c0f6be139a0e2

              SHA256

              339a9e61265a65d980fb550623bf2bda14443d36dfa650165cdccee7cf15aabb

              SHA512

              664ae9d772845654e6a9e84b26470317fa06c34859e72781334752417164cecfd94bc3939e36edcf3062de9fa383c0e5cd6be1c961589a3089db490d0bf39537

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iZzet41.exe

              Filesize

              349KB

              MD5

              5c7575acf35509541159fb92aee64ee2

              SHA1

              071dbbb0c6c9fb1585ab946d684296f65c424a05

              SHA256

              21660dda02442003a377e5f5230cb77dc5fd8e84cdc4f5d7974fb8316af22e23

              SHA512

              cf42126b2e67efe743d9af58603577a21ca510824f2e7dd60bd22d2d7e94ed83070344a1c127cef1b31bb532c0287d7d2f1c04e31e5c1599aa11279d6c9caca9

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iZzet41.exe

              Filesize

              349KB

              MD5

              5c7575acf35509541159fb92aee64ee2

              SHA1

              071dbbb0c6c9fb1585ab946d684296f65c424a05

              SHA256

              21660dda02442003a377e5f5230cb77dc5fd8e84cdc4f5d7974fb8316af22e23

              SHA512

              cf42126b2e67efe743d9af58603577a21ca510824f2e7dd60bd22d2d7e94ed83070344a1c127cef1b31bb532c0287d7d2f1c04e31e5c1599aa11279d6c9caca9

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\niba9048.exe

              Filesize

              334KB

              MD5

              bdc7cbd4c0648166ece58a342002d019

              SHA1

              042cf5c82f03ebf95267a599d83743d09ad3e5c3

              SHA256

              1b3c3ddcbdc352edf26f22c6c633eda9621b78fc3890d72f20993a9010959f55

              SHA512

              5373443e9ba7ccf2d860c208b7c675af89cc8b7d8d9fd856045654e09e4d07cd43e473d25122805f4a503bc89568aa9fc600e251ef2196fb1a78b7ca6051e26f

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\niba9048.exe

              Filesize

              334KB

              MD5

              bdc7cbd4c0648166ece58a342002d019

              SHA1

              042cf5c82f03ebf95267a599d83743d09ad3e5c3

              SHA256

              1b3c3ddcbdc352edf26f22c6c633eda9621b78fc3890d72f20993a9010959f55

              SHA512

              5373443e9ba7ccf2d860c208b7c675af89cc8b7d8d9fd856045654e09e4d07cd43e473d25122805f4a503bc89568aa9fc600e251ef2196fb1a78b7ca6051e26f

            • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f3363GY.exe

              Filesize

              11KB

              MD5

              7e93bacbbc33e6652e147e7fe07572a0

              SHA1

              421a7167da01c8da4dc4d5234ca3dd84e319e762

              SHA256

              850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

              SHA512

              250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

            • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f3363GY.exe

              Filesize

              11KB

              MD5

              7e93bacbbc33e6652e147e7fe07572a0

              SHA1

              421a7167da01c8da4dc4d5234ca3dd84e319e762

              SHA256

              850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

              SHA512

              250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

            • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h74Da40.exe

              Filesize

              290KB

              MD5

              c8f3b34e35518ff59fc0b14294859854

              SHA1

              a4e122853996cfb0e4b005f9dc296422013d0494

              SHA256

              09633e4d0640b4c11ccaf6a017288e9158d54f3e6b13ef220d26c4af9dd0a92a

              SHA512

              1b88a55db78990051d24036673e72bca003a76e727baae08bd4a4fb7df55d5ea8b0a0c2bc78a9877946b794102a04493937f64ceaf4a3be10aa479d59ed32fe6

            • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h74Da40.exe

              Filesize

              290KB

              MD5

              c8f3b34e35518ff59fc0b14294859854

              SHA1

              a4e122853996cfb0e4b005f9dc296422013d0494

              SHA256

              09633e4d0640b4c11ccaf6a017288e9158d54f3e6b13ef220d26c4af9dd0a92a

              SHA512

              1b88a55db78990051d24036673e72bca003a76e727baae08bd4a4fb7df55d5ea8b0a0c2bc78a9877946b794102a04493937f64ceaf4a3be10aa479d59ed32fe6

            • memory/748-154-0x0000000000C20000-0x0000000000C2A000-memory.dmp

              Filesize

              40KB

            • memory/768-245-0x0000000004F40000-0x0000000004F50000-memory.dmp

              Filesize

              64KB

            • memory/768-1114-0x0000000005B20000-0x0000000005C2A000-memory.dmp

              Filesize

              1.0MB

            • memory/768-1130-0x0000000004F40000-0x0000000004F50000-memory.dmp

              Filesize

              64KB

            • memory/768-1127-0x0000000006AC0000-0x0000000006FEC000-memory.dmp

              Filesize

              5.2MB

            • memory/768-1126-0x00000000068E0000-0x0000000006AA2000-memory.dmp

              Filesize

              1.8MB

            • memory/768-1125-0x0000000006860000-0x00000000068B0000-memory.dmp

              Filesize

              320KB

            • memory/768-1124-0x00000000067D0000-0x0000000006846000-memory.dmp

              Filesize

              472KB

            • memory/768-1123-0x0000000004F40000-0x0000000004F50000-memory.dmp

              Filesize

              64KB

            • memory/768-1122-0x0000000004F40000-0x0000000004F50000-memory.dmp

              Filesize

              64KB

            • memory/768-1121-0x0000000004F40000-0x0000000004F50000-memory.dmp

              Filesize

              64KB

            • memory/768-1119-0x00000000065F0000-0x0000000006682000-memory.dmp

              Filesize

              584KB

            • memory/768-1118-0x0000000005F30000-0x0000000005F96000-memory.dmp

              Filesize

              408KB

            • memory/768-1117-0x0000000004F40000-0x0000000004F50000-memory.dmp

              Filesize

              64KB

            • memory/768-1116-0x0000000005C50000-0x0000000005C8C000-memory.dmp

              Filesize

              240KB

            • memory/768-1115-0x0000000005C30000-0x0000000005C42000-memory.dmp

              Filesize

              72KB

            • memory/768-1113-0x0000000005500000-0x0000000005B18000-memory.dmp

              Filesize

              6.1MB

            • memory/768-248-0x0000000004F40000-0x0000000004F50000-memory.dmp

              Filesize

              64KB

            • memory/768-241-0x00000000023A0000-0x00000000023EB000-memory.dmp

              Filesize

              300KB

            • memory/768-243-0x0000000004F40000-0x0000000004F50000-memory.dmp

              Filesize

              64KB

            • memory/768-236-0x0000000002AC0000-0x0000000002AFE000-memory.dmp

              Filesize

              248KB

            • memory/768-234-0x0000000002AC0000-0x0000000002AFE000-memory.dmp

              Filesize

              248KB

            • memory/768-232-0x0000000002AC0000-0x0000000002AFE000-memory.dmp

              Filesize

              248KB

            • memory/768-230-0x0000000002AC0000-0x0000000002AFE000-memory.dmp

              Filesize

              248KB

            • memory/768-204-0x0000000002AC0000-0x0000000002AFE000-memory.dmp

              Filesize

              248KB

            • memory/768-203-0x0000000002AC0000-0x0000000002AFE000-memory.dmp

              Filesize

              248KB

            • memory/768-206-0x0000000002AC0000-0x0000000002AFE000-memory.dmp

              Filesize

              248KB

            • memory/768-208-0x0000000002AC0000-0x0000000002AFE000-memory.dmp

              Filesize

              248KB

            • memory/768-210-0x0000000002AC0000-0x0000000002AFE000-memory.dmp

              Filesize

              248KB

            • memory/768-212-0x0000000002AC0000-0x0000000002AFE000-memory.dmp

              Filesize

              248KB

            • memory/768-214-0x0000000002AC0000-0x0000000002AFE000-memory.dmp

              Filesize

              248KB

            • memory/768-216-0x0000000002AC0000-0x0000000002AFE000-memory.dmp

              Filesize

              248KB

            • memory/768-218-0x0000000002AC0000-0x0000000002AFE000-memory.dmp

              Filesize

              248KB

            • memory/768-220-0x0000000002AC0000-0x0000000002AFE000-memory.dmp

              Filesize

              248KB

            • memory/768-222-0x0000000002AC0000-0x0000000002AFE000-memory.dmp

              Filesize

              248KB

            • memory/768-224-0x0000000002AC0000-0x0000000002AFE000-memory.dmp

              Filesize

              248KB

            • memory/768-226-0x0000000002AC0000-0x0000000002AFE000-memory.dmp

              Filesize

              248KB

            • memory/768-228-0x0000000002AC0000-0x0000000002AFE000-memory.dmp

              Filesize

              248KB

            • memory/3312-1134-0x0000000000CB0000-0x0000000000CE2000-memory.dmp

              Filesize

              200KB

            • memory/3312-1135-0x0000000005550000-0x0000000005560000-memory.dmp

              Filesize

              64KB

            • memory/3548-189-0x0000000005350000-0x0000000005362000-memory.dmp

              Filesize

              72KB

            • memory/3548-161-0x0000000004D60000-0x0000000005304000-memory.dmp

              Filesize

              5.6MB

            • memory/3548-196-0x0000000002590000-0x00000000025A0000-memory.dmp

              Filesize

              64KB

            • memory/3548-195-0x0000000002590000-0x00000000025A0000-memory.dmp

              Filesize

              64KB

            • memory/3548-193-0x0000000000400000-0x0000000000830000-memory.dmp

              Filesize

              4.2MB

            • memory/3548-162-0x0000000005350000-0x0000000005362000-memory.dmp

              Filesize

              72KB

            • memory/3548-192-0x0000000002590000-0x00000000025A0000-memory.dmp

              Filesize

              64KB

            • memory/3548-167-0x0000000005350000-0x0000000005362000-memory.dmp

              Filesize

              72KB

            • memory/3548-191-0x0000000002590000-0x00000000025A0000-memory.dmp

              Filesize

              64KB

            • memory/3548-190-0x0000000002590000-0x00000000025A0000-memory.dmp

              Filesize

              64KB

            • memory/3548-165-0x0000000005350000-0x0000000005362000-memory.dmp

              Filesize

              72KB

            • memory/3548-187-0x0000000005350000-0x0000000005362000-memory.dmp

              Filesize

              72KB

            • memory/3548-197-0x0000000002590000-0x00000000025A0000-memory.dmp

              Filesize

              64KB

            • memory/3548-179-0x0000000005350000-0x0000000005362000-memory.dmp

              Filesize

              72KB

            • memory/3548-185-0x0000000005350000-0x0000000005362000-memory.dmp

              Filesize

              72KB

            • memory/3548-181-0x0000000005350000-0x0000000005362000-memory.dmp

              Filesize

              72KB

            • memory/3548-177-0x0000000005350000-0x0000000005362000-memory.dmp

              Filesize

              72KB

            • memory/3548-175-0x0000000005350000-0x0000000005362000-memory.dmp

              Filesize

              72KB

            • memory/3548-173-0x0000000005350000-0x0000000005362000-memory.dmp

              Filesize

              72KB

            • memory/3548-171-0x0000000005350000-0x0000000005362000-memory.dmp

              Filesize

              72KB

            • memory/3548-169-0x0000000005350000-0x0000000005362000-memory.dmp

              Filesize

              72KB

            • memory/3548-183-0x0000000005350000-0x0000000005362000-memory.dmp

              Filesize

              72KB

            • memory/3548-160-0x00000000009A0000-0x00000000009CD000-memory.dmp

              Filesize

              180KB

            • memory/3548-198-0x0000000000400000-0x0000000000830000-memory.dmp

              Filesize

              4.2MB

            • memory/3548-163-0x0000000005350000-0x0000000005362000-memory.dmp

              Filesize

              72KB