Analysis

  • max time kernel
    143s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-03-2023 19:46

General

  • Target

    ac96cdd91aa090ad77bff3f1adf283c09544d461cc53cb5e515e331994f561a3.exe

  • Size

    679KB

  • MD5

    d1515a8af4fbb322c14b48a3cf033636

  • SHA1

    7a9f5e48b7fa80c9d798bcd82d65933c649103c1

  • SHA256

    ac96cdd91aa090ad77bff3f1adf283c09544d461cc53cb5e515e331994f561a3

  • SHA512

    c3d039bc0dbc7f749739272481dc0432a7e9167f3f897e5b23460cf67cf3fed8d97fd18b149c4b640ece0a8dc49dea796a2aa433a0054373c31f924d2bd62da9

  • SSDEEP

    12288:zHmxMy2FxQAVSh5ahZXhrlX4BAQitxjN7ThRsWTt:TbLFxQAk5wzhQitnsE

Malware Config

Extracted

Family

redline

Botnet

down

C2

193.233.20.31:4125

Attributes
  • auth_value

    12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

real

C2

193.233.20.31:4125

Attributes
  • auth_value

    bb22a50228754849387d5f4d1611e71b

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 33 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ac96cdd91aa090ad77bff3f1adf283c09544d461cc53cb5e515e331994f561a3.exe
    "C:\Users\Admin\AppData\Local\Temp\ac96cdd91aa090ad77bff3f1adf283c09544d461cc53cb5e515e331994f561a3.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2744
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zizz8651.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zizz8651.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4180
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr491081.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr491081.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1676
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku859349.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku859349.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:980
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr195364.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr195364.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4152
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 480
      2⤵
      • Program crash
      PID:4896
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2744 -ip 2744
    1⤵
      PID:1488

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr195364.exe
      Filesize

      175KB

      MD5

      41707338e1e2d868aa699ac0dd2e77b0

      SHA1

      36e0dfba09f9fb409faf0f9a99217d0d0c524b82

      SHA256

      8d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557

      SHA512

      80c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr195364.exe
      Filesize

      175KB

      MD5

      41707338e1e2d868aa699ac0dd2e77b0

      SHA1

      36e0dfba09f9fb409faf0f9a99217d0d0c524b82

      SHA256

      8d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557

      SHA512

      80c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zizz8651.exe
      Filesize

      402KB

      MD5

      01728de0331b53044ae99cbd8f88fcb0

      SHA1

      5e3585f7cddceb6fd34623b6eae2ceb2b6c90d7c

      SHA256

      c5350e256c67fdb36fdceda3d106ec476f3ceadf8e43ee56b648294d5930a147

      SHA512

      f173c2082bce18b58e9aa8c213f8c30582bbfbf3244e634a003fe915826d07d0f7270c930a61424703ee3b657ebc5583635652e63eafe0048277d3c945260d06

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zizz8651.exe
      Filesize

      402KB

      MD5

      01728de0331b53044ae99cbd8f88fcb0

      SHA1

      5e3585f7cddceb6fd34623b6eae2ceb2b6c90d7c

      SHA256

      c5350e256c67fdb36fdceda3d106ec476f3ceadf8e43ee56b648294d5930a147

      SHA512

      f173c2082bce18b58e9aa8c213f8c30582bbfbf3244e634a003fe915826d07d0f7270c930a61424703ee3b657ebc5583635652e63eafe0048277d3c945260d06

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr491081.exe
      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr491081.exe
      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku859349.exe
      Filesize

      349KB

      MD5

      c01d88a844ea37d2f823df5904150b85

      SHA1

      780c09d6717d88c3bc5aa78d4d5191ca05515021

      SHA256

      0068854c1f35177c54149fcf3ac878ed32070e8c1a69d5d7e227b0b67bef67a2

      SHA512

      49177239ac4ad141d71cbff43c94793b8eb2691e0da95871c9f3c6162e1c3955a59be035bd57ae8267575e9c39536f70b3898722c01083ec9fa269bab8ea6934

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku859349.exe
      Filesize

      349KB

      MD5

      c01d88a844ea37d2f823df5904150b85

      SHA1

      780c09d6717d88c3bc5aa78d4d5191ca05515021

      SHA256

      0068854c1f35177c54149fcf3ac878ed32070e8c1a69d5d7e227b0b67bef67a2

      SHA512

      49177239ac4ad141d71cbff43c94793b8eb2691e0da95871c9f3c6162e1c3955a59be035bd57ae8267575e9c39536f70b3898722c01083ec9fa269bab8ea6934

    • memory/980-201-0x0000000004CE0000-0x0000000004D1E000-memory.dmp
      Filesize

      248KB

    • memory/980-207-0x0000000004CE0000-0x0000000004D1E000-memory.dmp
      Filesize

      248KB

    • memory/980-161-0x0000000004CE0000-0x0000000004D1E000-memory.dmp
      Filesize

      248KB

    • memory/980-159-0x0000000004CE0000-0x0000000004D1E000-memory.dmp
      Filesize

      248KB

    • memory/980-163-0x0000000004CE0000-0x0000000004D1E000-memory.dmp
      Filesize

      248KB

    • memory/980-165-0x0000000004CE0000-0x0000000004D1E000-memory.dmp
      Filesize

      248KB

    • memory/980-167-0x0000000004CE0000-0x0000000004D1E000-memory.dmp
      Filesize

      248KB

    • memory/980-169-0x0000000004CE0000-0x0000000004D1E000-memory.dmp
      Filesize

      248KB

    • memory/980-171-0x0000000004CE0000-0x0000000004D1E000-memory.dmp
      Filesize

      248KB

    • memory/980-173-0x0000000004CE0000-0x0000000004D1E000-memory.dmp
      Filesize

      248KB

    • memory/980-175-0x0000000004CE0000-0x0000000004D1E000-memory.dmp
      Filesize

      248KB

    • memory/980-177-0x0000000004CE0000-0x0000000004D1E000-memory.dmp
      Filesize

      248KB

    • memory/980-179-0x0000000004CE0000-0x0000000004D1E000-memory.dmp
      Filesize

      248KB

    • memory/980-181-0x0000000004CE0000-0x0000000004D1E000-memory.dmp
      Filesize

      248KB

    • memory/980-183-0x0000000004CE0000-0x0000000004D1E000-memory.dmp
      Filesize

      248KB

    • memory/980-185-0x0000000004CE0000-0x0000000004D1E000-memory.dmp
      Filesize

      248KB

    • memory/980-186-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
      Filesize

      64KB

    • memory/980-189-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
      Filesize

      64KB

    • memory/980-188-0x0000000004CE0000-0x0000000004D1E000-memory.dmp
      Filesize

      248KB

    • memory/980-191-0x0000000004CE0000-0x0000000004D1E000-memory.dmp
      Filesize

      248KB

    • memory/980-193-0x0000000004CE0000-0x0000000004D1E000-memory.dmp
      Filesize

      248KB

    • memory/980-195-0x0000000004CE0000-0x0000000004D1E000-memory.dmp
      Filesize

      248KB

    • memory/980-197-0x0000000004CE0000-0x0000000004D1E000-memory.dmp
      Filesize

      248KB

    • memory/980-199-0x0000000004CE0000-0x0000000004D1E000-memory.dmp
      Filesize

      248KB

    • memory/980-157-0x0000000004EC0000-0x0000000005464000-memory.dmp
      Filesize

      5.6MB

    • memory/980-203-0x0000000004CE0000-0x0000000004D1E000-memory.dmp
      Filesize

      248KB

    • memory/980-205-0x0000000004CE0000-0x0000000004D1E000-memory.dmp
      Filesize

      248KB

    • memory/980-158-0x0000000004CE0000-0x0000000004D1E000-memory.dmp
      Filesize

      248KB

    • memory/980-209-0x0000000004CE0000-0x0000000004D1E000-memory.dmp
      Filesize

      248KB

    • memory/980-213-0x0000000004CE0000-0x0000000004D1E000-memory.dmp
      Filesize

      248KB

    • memory/980-211-0x0000000004CE0000-0x0000000004D1E000-memory.dmp
      Filesize

      248KB

    • memory/980-215-0x0000000004CE0000-0x0000000004D1E000-memory.dmp
      Filesize

      248KB

    • memory/980-217-0x0000000004CE0000-0x0000000004D1E000-memory.dmp
      Filesize

      248KB

    • memory/980-219-0x0000000004CE0000-0x0000000004D1E000-memory.dmp
      Filesize

      248KB

    • memory/980-221-0x0000000004CE0000-0x0000000004D1E000-memory.dmp
      Filesize

      248KB

    • memory/980-1066-0x0000000005470000-0x0000000005A88000-memory.dmp
      Filesize

      6.1MB

    • memory/980-1067-0x0000000005B00000-0x0000000005C0A000-memory.dmp
      Filesize

      1.0MB

    • memory/980-1068-0x0000000005C40000-0x0000000005C52000-memory.dmp
      Filesize

      72KB

    • memory/980-1069-0x0000000005C60000-0x0000000005C9C000-memory.dmp
      Filesize

      240KB

    • memory/980-1070-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
      Filesize

      64KB

    • memory/980-1073-0x0000000005F50000-0x0000000005FE2000-memory.dmp
      Filesize

      584KB

    • memory/980-1074-0x0000000005FF0000-0x0000000006056000-memory.dmp
      Filesize

      408KB

    • memory/980-1075-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
      Filesize

      64KB

    • memory/980-1076-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
      Filesize

      64KB

    • memory/980-1077-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
      Filesize

      64KB

    • memory/980-1078-0x0000000006950000-0x00000000069C6000-memory.dmp
      Filesize

      472KB

    • memory/980-1079-0x00000000069E0000-0x0000000006A30000-memory.dmp
      Filesize

      320KB

    • memory/980-1080-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
      Filesize

      64KB

    • memory/980-1081-0x0000000006BB0000-0x0000000006D72000-memory.dmp
      Filesize

      1.8MB

    • memory/980-156-0x0000000000880000-0x00000000008CB000-memory.dmp
      Filesize

      300KB

    • memory/980-1082-0x0000000006D80000-0x00000000072AC000-memory.dmp
      Filesize

      5.2MB

    • memory/1676-149-0x00000000007B0000-0x00000000007BA000-memory.dmp
      Filesize

      40KB

    • memory/2744-134-0x0000000002510000-0x0000000002599000-memory.dmp
      Filesize

      548KB

    • memory/2744-150-0x0000000000400000-0x000000000076C000-memory.dmp
      Filesize

      3.4MB

    • memory/4152-1088-0x0000000000180000-0x00000000001B2000-memory.dmp
      Filesize

      200KB

    • memory/4152-1089-0x0000000004D50000-0x0000000004D60000-memory.dmp
      Filesize

      64KB