Analysis

  • max time kernel
    99s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-03-2023 21:45

General

  • Target

    df5262a0aff91def9713ab81b7e298101a09befc093c24b01587e70cbc85a3fe.exe

  • Size

    544KB

  • MD5

    2a578bb39d5f5e98f1f43a9c16357996

  • SHA1

    f16430d6a6121320d0ffd6147d8b663ee4edf2ac

  • SHA256

    df5262a0aff91def9713ab81b7e298101a09befc093c24b01587e70cbc85a3fe

  • SHA512

    33ef7e391b8e5d7b2c00c9c0b015669e20e75233b320276d4d738b786243ebf4260da95edaa131a5e5947b5ee9d52af8ec80ad7588133f850787c4632cd0464e

  • SSDEEP

    12288:1Mr+y90pLVE/41gES4DAfqgUUMLHwvUZN5VOj:Dy+N1U4DA1ZMbEUH5VOj

Malware Config

Extracted

Family

redline

Botnet

down

C2

193.233.20.31:4125

Attributes
  • auth_value

    12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

lown

C2

193.233.20.31:4125

Attributes
  • auth_value

    4cf836e062bcdc2a4fdbf410f5747ec7

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 33 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\df5262a0aff91def9713ab81b7e298101a09befc093c24b01587e70cbc85a3fe.exe
    "C:\Users\Admin\AppData\Local\Temp\df5262a0aff91def9713ab81b7e298101a09befc093c24b01587e70cbc85a3fe.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:740
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba5713.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba5713.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3416
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h23bg87.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h23bg87.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2380
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\izQKF86.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\izQKF86.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3928
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3928 -s 1364
          4⤵
          • Program crash
          PID:1532
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l42gV08.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l42gV08.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3696
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3928 -ip 3928
    1⤵
      PID:3440

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Modify Existing Service

    1
    T1031

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    3
    T1112

    Disabling Security Tools

    2
    T1089

    Credential Access

    Credentials in Files

    2
    T1081

    Discovery

    Query Registry

    1
    T1012

    Collection

    Data from Local System

    2
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l42gV08.exe
      Filesize

      175KB

      MD5

      50809fe16d7c482c1f4a2ea19fdcbc0a

      SHA1

      11b6f69c06a724da15183b16039c5cbc86016158

      SHA256

      09917b67829de37b5d6be8115c8f8321f436554f426a24e079257a8368051cb1

      SHA512

      c35170e5eb6dabda9fd2d289153df829957ca8e9665178529a1ba36395155bb34f489372993ec694d10bea490c86cef2ae152e2df480288aca8e796ba135261f

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l42gV08.exe
      Filesize

      175KB

      MD5

      50809fe16d7c482c1f4a2ea19fdcbc0a

      SHA1

      11b6f69c06a724da15183b16039c5cbc86016158

      SHA256

      09917b67829de37b5d6be8115c8f8321f436554f426a24e079257a8368051cb1

      SHA512

      c35170e5eb6dabda9fd2d289153df829957ca8e9665178529a1ba36395155bb34f489372993ec694d10bea490c86cef2ae152e2df480288aca8e796ba135261f

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba5713.exe
      Filesize

      402KB

      MD5

      d3a8abf2a9df750aed45361791f934eb

      SHA1

      ad0dec334ebc4f1d82dda670967e51041c26380e

      SHA256

      923ce5aa3fda969b0a53f229249b92d8449ed7c424aa5cdcd3d80077a2abdf2a

      SHA512

      6c9bfdf5c036ec3a334582f5d7b421b0cf934c3ae00bfad48d66d65f6c047de9f2c6e1e5c9353ed9fdba59702d13eac11ab5feac38553c261c5883cb171a214f

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba5713.exe
      Filesize

      402KB

      MD5

      d3a8abf2a9df750aed45361791f934eb

      SHA1

      ad0dec334ebc4f1d82dda670967e51041c26380e

      SHA256

      923ce5aa3fda969b0a53f229249b92d8449ed7c424aa5cdcd3d80077a2abdf2a

      SHA512

      6c9bfdf5c036ec3a334582f5d7b421b0cf934c3ae00bfad48d66d65f6c047de9f2c6e1e5c9353ed9fdba59702d13eac11ab5feac38553c261c5883cb171a214f

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h23bg87.exe
      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h23bg87.exe
      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\izQKF86.exe
      Filesize

      349KB

      MD5

      e19cc809c669101a8566ccf93c418429

      SHA1

      514c624ca8b46e943b99e75d584aabb26e519207

      SHA256

      f71a69abae699591c4ca0328ea6af26ab1df98462c88511a5c13df3e9fb82773

      SHA512

      747848101c047a8796df1a88b1802dabb3b15c05f19548e832f65fbcfc5f3123c49188044cc57d221ed2fe753a52d0ba34298a57a6e8e247ac2786fc9713658f

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\izQKF86.exe
      Filesize

      349KB

      MD5

      e19cc809c669101a8566ccf93c418429

      SHA1

      514c624ca8b46e943b99e75d584aabb26e519207

      SHA256

      f71a69abae699591c4ca0328ea6af26ab1df98462c88511a5c13df3e9fb82773

      SHA512

      747848101c047a8796df1a88b1802dabb3b15c05f19548e832f65fbcfc5f3123c49188044cc57d221ed2fe753a52d0ba34298a57a6e8e247ac2786fc9713658f

    • memory/2380-147-0x0000000000720000-0x000000000072A000-memory.dmp
      Filesize

      40KB

    • memory/3696-1080-0x00000000006D0000-0x0000000000702000-memory.dmp
      Filesize

      200KB

    • memory/3696-1081-0x0000000005280000-0x0000000005290000-memory.dmp
      Filesize

      64KB

    • memory/3928-183-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
      Filesize

      248KB

    • memory/3928-195-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
      Filesize

      248KB

    • memory/3928-155-0x0000000004E10000-0x00000000053B4000-memory.dmp
      Filesize

      5.6MB

    • memory/3928-156-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
      Filesize

      248KB

    • memory/3928-157-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
      Filesize

      248KB

    • memory/3928-159-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
      Filesize

      248KB

    • memory/3928-161-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
      Filesize

      248KB

    • memory/3928-167-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
      Filesize

      248KB

    • memory/3928-169-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
      Filesize

      248KB

    • memory/3928-165-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
      Filesize

      248KB

    • memory/3928-163-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
      Filesize

      248KB

    • memory/3928-171-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
      Filesize

      248KB

    • memory/3928-173-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
      Filesize

      248KB

    • memory/3928-175-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
      Filesize

      248KB

    • memory/3928-177-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
      Filesize

      248KB

    • memory/3928-179-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
      Filesize

      248KB

    • memory/3928-181-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
      Filesize

      248KB

    • memory/3928-153-0x00000000023A0000-0x00000000023EB000-memory.dmp
      Filesize

      300KB

    • memory/3928-185-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
      Filesize

      248KB

    • memory/3928-187-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
      Filesize

      248KB

    • memory/3928-189-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
      Filesize

      248KB

    • memory/3928-191-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
      Filesize

      248KB

    • memory/3928-193-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
      Filesize

      248KB

    • memory/3928-154-0x0000000004E00000-0x0000000004E10000-memory.dmp
      Filesize

      64KB

    • memory/3928-197-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
      Filesize

      248KB

    • memory/3928-199-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
      Filesize

      248KB

    • memory/3928-201-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
      Filesize

      248KB

    • memory/3928-203-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
      Filesize

      248KB

    • memory/3928-205-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
      Filesize

      248KB

    • memory/3928-207-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
      Filesize

      248KB

    • memory/3928-209-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
      Filesize

      248KB

    • memory/3928-211-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
      Filesize

      248KB

    • memory/3928-213-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
      Filesize

      248KB

    • memory/3928-215-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
      Filesize

      248KB

    • memory/3928-217-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
      Filesize

      248KB

    • memory/3928-219-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
      Filesize

      248KB

    • memory/3928-1062-0x00000000054C0000-0x0000000005AD8000-memory.dmp
      Filesize

      6.1MB

    • memory/3928-1063-0x0000000005B00000-0x0000000005C0A000-memory.dmp
      Filesize

      1.0MB

    • memory/3928-1064-0x0000000005C40000-0x0000000005C52000-memory.dmp
      Filesize

      72KB

    • memory/3928-1065-0x0000000005C60000-0x0000000005C9C000-memory.dmp
      Filesize

      240KB

    • memory/3928-1066-0x0000000004E00000-0x0000000004E10000-memory.dmp
      Filesize

      64KB

    • memory/3928-1067-0x0000000005F50000-0x0000000005FE2000-memory.dmp
      Filesize

      584KB

    • memory/3928-1068-0x0000000005FF0000-0x0000000006056000-memory.dmp
      Filesize

      408KB

    • memory/3928-1070-0x00000000066E0000-0x0000000006756000-memory.dmp
      Filesize

      472KB

    • memory/3928-1071-0x0000000006780000-0x00000000067D0000-memory.dmp
      Filesize

      320KB

    • memory/3928-1072-0x00000000067F0000-0x00000000069B2000-memory.dmp
      Filesize

      1.8MB

    • memory/3928-1073-0x00000000069D0000-0x0000000006EFC000-memory.dmp
      Filesize

      5.2MB

    • memory/3928-1075-0x0000000004E00000-0x0000000004E10000-memory.dmp
      Filesize

      64KB