Analysis
-
max time kernel
50s -
max time network
64s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
23-03-2023 21:38
General
-
Target
57ed9275a663712413df6f55ed38d5792eb0c1672a005b3fb4ebdc19764b784a.exe
-
Size
544KB
-
MD5
d2dbc9bfd2ea4986b0d7acb81aafe78b
-
SHA1
f8bf98ae739127ee942a937f189ab35e0877ad0a
-
SHA256
57ed9275a663712413df6f55ed38d5792eb0c1672a005b3fb4ebdc19764b784a
-
SHA512
70a369598ce47b3fb04a5aa0744df63ae1a1f0e867f7d498496d8cc8424f55bb5163a21f87c511295f7f69fdef08411c618244e77c9ea884ec15f3cf4aa2ed7a
-
SSDEEP
12288:ZMrWy90uyXtoJdaLAD32drh1u2spLtBqgU5MLvwje8+9PlGE8Ais9IHj:jyYGWcujuVpL9oMzF9PgE1iR
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
real
193.233.20.31:4125
-
auth_value
bb22a50228754849387d5f4d1611e71b
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
-
Executes dropped EXE 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 1 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\57ed9275a663712413df6f55ed38d5792eb0c1672a005b3fb4ebdc19764b784a.exe"C:\Users\Admin\AppData\Local\Temp\57ed9275a663712413df6f55ed38d5792eb0c1672a005b3fb4ebdc19764b784a.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio2608.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio2608.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2373.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2373.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5415.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5415.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si084830.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si084830.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD541707338e1e2d868aa699ac0dd2e77b0
SHA136e0dfba09f9fb409faf0f9a99217d0d0c524b82
SHA2568d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557
SHA51280c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2
-
Filesize
175KB
MD541707338e1e2d868aa699ac0dd2e77b0
SHA136e0dfba09f9fb409faf0f9a99217d0d0c524b82
SHA2568d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557
SHA51280c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2
-
Filesize
402KB
MD56c20d122c1cb11495a8e945293bf83fb
SHA1eb2618ceb7d1457dd6d7d3bc953420a9392b43a6
SHA256582279cccdb463b43298607822a05a436ecf241410a551adad3dcfa74680870f
SHA512f0e4d6c17898d4fe699b87a16a9f6f3f0985b11d4d6c20781c9eebe674f9be980d2ba275d1c2dcd9f957419845240b99626f7fabbe1fbfa289fa9466d9efb0c1
-
Filesize
402KB
MD56c20d122c1cb11495a8e945293bf83fb
SHA1eb2618ceb7d1457dd6d7d3bc953420a9392b43a6
SHA256582279cccdb463b43298607822a05a436ecf241410a551adad3dcfa74680870f
SHA512f0e4d6c17898d4fe699b87a16a9f6f3f0985b11d4d6c20781c9eebe674f9be980d2ba275d1c2dcd9f957419845240b99626f7fabbe1fbfa289fa9466d9efb0c1
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
349KB
MD51c77d9ef995cad6fc0ebf2362f2016f0
SHA1ad4d47521f81b420b9d5f9216bd5049bdcff5dae
SHA25625be1b0cc6272c9da0bc2b5b5ea629d24d7f8511f25e05bb9db9aeb684f577fc
SHA512546db3565a04c2252e029e0db55ddcb4049a016b485d8d063874782b9d4c74646ef918dbbe78dcb618648c43f9d631db30da4d25937dc004423dfc02d4f1a67d
-
Filesize
349KB
MD51c77d9ef995cad6fc0ebf2362f2016f0
SHA1ad4d47521f81b420b9d5f9216bd5049bdcff5dae
SHA25625be1b0cc6272c9da0bc2b5b5ea629d24d7f8511f25e05bb9db9aeb684f577fc
SHA512546db3565a04c2252e029e0db55ddcb4049a016b485d8d063874782b9d4c74646ef918dbbe78dcb618648c43f9d631db30da4d25937dc004423dfc02d4f1a67d
-
Filesize
40KB
-
Filesize
300KB
-
Filesize
280KB
-
Filesize
5.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
272KB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
6.0MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
584KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
64KB
-
Filesize
472KB
-
Filesize
320KB
-
Filesize
200KB
-
Filesize
300KB
-
Filesize
64KB