Analysis

  • max time kernel
    144s
  • max time network
    122s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-03-2023 19:55

General

  • Target

    61eb23740b53f193d9239c044dd90976be692ab14797c570487abf97f642079d.exe

  • Size

    544KB

  • MD5

    eea159f285bb0ef2ce8115e3b5328c0b

  • SHA1

    cdd45a160ad0cae7807c4297071ee27170d90f73

  • SHA256

    61eb23740b53f193d9239c044dd90976be692ab14797c570487abf97f642079d

  • SHA512

    3a1f03308fb5cbebba9cd435953b01cc4ef362dc0157585ddb0ae3333ca5effa4baf0775bf6238d21111b39c15292d9e73ffd4b8b1da770e2c5a26620681ab07

  • SSDEEP

    12288:5Mrwy90kcCDlXBZ8z3OSBlASzp/E+7rYc9:hyEW7SBl9/E+7rYc9

Malware Config

Extracted

Family

redline

Botnet

down

C2

193.233.20.31:4125

Attributes
  • auth_value

    12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

lown

C2

193.233.20.31:4125

Attributes
  • auth_value

    4cf836e062bcdc2a4fdbf410f5747ec7

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 33 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\61eb23740b53f193d9239c044dd90976be692ab14797c570487abf97f642079d.exe
    "C:\Users\Admin\AppData\Local\Temp\61eb23740b53f193d9239c044dd90976be692ab14797c570487abf97f642079d.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1336
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba7597.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba7597.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:960
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h45LL65.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h45LL65.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1332
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iueEI75.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iueEI75.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1828
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l06di45.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l06di45.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1464

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

3
T1112

Disabling Security Tools

2
T1089

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l06di45.exe
    Filesize

    175KB

    MD5

    50809fe16d7c482c1f4a2ea19fdcbc0a

    SHA1

    11b6f69c06a724da15183b16039c5cbc86016158

    SHA256

    09917b67829de37b5d6be8115c8f8321f436554f426a24e079257a8368051cb1

    SHA512

    c35170e5eb6dabda9fd2d289153df829957ca8e9665178529a1ba36395155bb34f489372993ec694d10bea490c86cef2ae152e2df480288aca8e796ba135261f

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l06di45.exe
    Filesize

    175KB

    MD5

    50809fe16d7c482c1f4a2ea19fdcbc0a

    SHA1

    11b6f69c06a724da15183b16039c5cbc86016158

    SHA256

    09917b67829de37b5d6be8115c8f8321f436554f426a24e079257a8368051cb1

    SHA512

    c35170e5eb6dabda9fd2d289153df829957ca8e9665178529a1ba36395155bb34f489372993ec694d10bea490c86cef2ae152e2df480288aca8e796ba135261f

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba7597.exe
    Filesize

    402KB

    MD5

    f079aa081fe0e1a3f1977de10e35e387

    SHA1

    4d12003f02482c2e834a99cadaf2ce0acc443c70

    SHA256

    ed29f9d3115dbac07a5072b226399b78e22200c95b8f41427d183cfe2d5828bb

    SHA512

    85a4aa7866f19d54bf681c43a6678bf38849ca8866feabef8d3deaf9539dc975fddd03c4483565c9a201913854a20b09ee03d5ecff7e3f0bc59ce2fb2de7f26d

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba7597.exe
    Filesize

    402KB

    MD5

    f079aa081fe0e1a3f1977de10e35e387

    SHA1

    4d12003f02482c2e834a99cadaf2ce0acc443c70

    SHA256

    ed29f9d3115dbac07a5072b226399b78e22200c95b8f41427d183cfe2d5828bb

    SHA512

    85a4aa7866f19d54bf681c43a6678bf38849ca8866feabef8d3deaf9539dc975fddd03c4483565c9a201913854a20b09ee03d5ecff7e3f0bc59ce2fb2de7f26d

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h45LL65.exe
    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h45LL65.exe
    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iueEI75.exe
    Filesize

    349KB

    MD5

    2f63e7734d542e1e3e7072dece0a0fea

    SHA1

    5cda097a12577f809f46a3512cd5e56b3f92ba2e

    SHA256

    a4f61a211ee0701ac915d38db474d924589c8b4a9ac98e5b2ffb948e9f095bea

    SHA512

    7bae26af711140f3dc8669327ad92294549696f95c0bc2f5dccf69e3b3fd0e95188afec311b5d4b2ec21499accc66c336b00172ec3b0dfb0015ae6ce9e4e119e

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iueEI75.exe
    Filesize

    349KB

    MD5

    2f63e7734d542e1e3e7072dece0a0fea

    SHA1

    5cda097a12577f809f46a3512cd5e56b3f92ba2e

    SHA256

    a4f61a211ee0701ac915d38db474d924589c8b4a9ac98e5b2ffb948e9f095bea

    SHA512

    7bae26af711140f3dc8669327ad92294549696f95c0bc2f5dccf69e3b3fd0e95188afec311b5d4b2ec21499accc66c336b00172ec3b0dfb0015ae6ce9e4e119e

  • memory/1332-147-0x0000000000B70000-0x0000000000B7A000-memory.dmp
    Filesize

    40KB

  • memory/1464-1085-0x0000000000660000-0x0000000000692000-memory.dmp
    Filesize

    200KB

  • memory/1464-1086-0x0000000004F20000-0x0000000004F30000-memory.dmp
    Filesize

    64KB

  • memory/1828-189-0x00000000027B0000-0x00000000027EE000-memory.dmp
    Filesize

    248KB

  • memory/1828-201-0x00000000027B0000-0x00000000027EE000-memory.dmp
    Filesize

    248KB

  • memory/1828-155-0x00000000029B0000-0x00000000029C0000-memory.dmp
    Filesize

    64KB

  • memory/1828-156-0x00000000029B0000-0x00000000029C0000-memory.dmp
    Filesize

    64KB

  • memory/1828-157-0x00000000029B0000-0x00000000029C0000-memory.dmp
    Filesize

    64KB

  • memory/1828-158-0x00000000027B0000-0x00000000027EE000-memory.dmp
    Filesize

    248KB

  • memory/1828-159-0x00000000027B0000-0x00000000027EE000-memory.dmp
    Filesize

    248KB

  • memory/1828-161-0x00000000027B0000-0x00000000027EE000-memory.dmp
    Filesize

    248KB

  • memory/1828-163-0x00000000027B0000-0x00000000027EE000-memory.dmp
    Filesize

    248KB

  • memory/1828-165-0x00000000027B0000-0x00000000027EE000-memory.dmp
    Filesize

    248KB

  • memory/1828-167-0x00000000027B0000-0x00000000027EE000-memory.dmp
    Filesize

    248KB

  • memory/1828-169-0x00000000027B0000-0x00000000027EE000-memory.dmp
    Filesize

    248KB

  • memory/1828-171-0x00000000027B0000-0x00000000027EE000-memory.dmp
    Filesize

    248KB

  • memory/1828-173-0x00000000027B0000-0x00000000027EE000-memory.dmp
    Filesize

    248KB

  • memory/1828-175-0x00000000027B0000-0x00000000027EE000-memory.dmp
    Filesize

    248KB

  • memory/1828-177-0x00000000027B0000-0x00000000027EE000-memory.dmp
    Filesize

    248KB

  • memory/1828-179-0x00000000027B0000-0x00000000027EE000-memory.dmp
    Filesize

    248KB

  • memory/1828-181-0x00000000027B0000-0x00000000027EE000-memory.dmp
    Filesize

    248KB

  • memory/1828-183-0x00000000027B0000-0x00000000027EE000-memory.dmp
    Filesize

    248KB

  • memory/1828-185-0x00000000027B0000-0x00000000027EE000-memory.dmp
    Filesize

    248KB

  • memory/1828-187-0x00000000027B0000-0x00000000027EE000-memory.dmp
    Filesize

    248KB

  • memory/1828-153-0x0000000004E20000-0x00000000053C4000-memory.dmp
    Filesize

    5.6MB

  • memory/1828-191-0x00000000027B0000-0x00000000027EE000-memory.dmp
    Filesize

    248KB

  • memory/1828-193-0x00000000027B0000-0x00000000027EE000-memory.dmp
    Filesize

    248KB

  • memory/1828-195-0x00000000027B0000-0x00000000027EE000-memory.dmp
    Filesize

    248KB

  • memory/1828-197-0x00000000027B0000-0x00000000027EE000-memory.dmp
    Filesize

    248KB

  • memory/1828-199-0x00000000027B0000-0x00000000027EE000-memory.dmp
    Filesize

    248KB

  • memory/1828-154-0x00000000008A0000-0x00000000008EB000-memory.dmp
    Filesize

    300KB

  • memory/1828-203-0x00000000027B0000-0x00000000027EE000-memory.dmp
    Filesize

    248KB

  • memory/1828-205-0x00000000027B0000-0x00000000027EE000-memory.dmp
    Filesize

    248KB

  • memory/1828-207-0x00000000027B0000-0x00000000027EE000-memory.dmp
    Filesize

    248KB

  • memory/1828-209-0x00000000027B0000-0x00000000027EE000-memory.dmp
    Filesize

    248KB

  • memory/1828-211-0x00000000027B0000-0x00000000027EE000-memory.dmp
    Filesize

    248KB

  • memory/1828-213-0x00000000027B0000-0x00000000027EE000-memory.dmp
    Filesize

    248KB

  • memory/1828-215-0x00000000027B0000-0x00000000027EE000-memory.dmp
    Filesize

    248KB

  • memory/1828-217-0x00000000027B0000-0x00000000027EE000-memory.dmp
    Filesize

    248KB

  • memory/1828-219-0x00000000027B0000-0x00000000027EE000-memory.dmp
    Filesize

    248KB

  • memory/1828-221-0x00000000027B0000-0x00000000027EE000-memory.dmp
    Filesize

    248KB

  • memory/1828-1064-0x00000000054D0000-0x0000000005AE8000-memory.dmp
    Filesize

    6.1MB

  • memory/1828-1065-0x0000000005B00000-0x0000000005C0A000-memory.dmp
    Filesize

    1.0MB

  • memory/1828-1066-0x0000000005C40000-0x0000000005C52000-memory.dmp
    Filesize

    72KB

  • memory/1828-1067-0x00000000029B0000-0x00000000029C0000-memory.dmp
    Filesize

    64KB

  • memory/1828-1068-0x0000000005C60000-0x0000000005C9C000-memory.dmp
    Filesize

    240KB

  • memory/1828-1070-0x0000000005F50000-0x0000000005FE2000-memory.dmp
    Filesize

    584KB

  • memory/1828-1071-0x0000000005FF0000-0x0000000006056000-memory.dmp
    Filesize

    408KB

  • memory/1828-1072-0x00000000066E0000-0x0000000006756000-memory.dmp
    Filesize

    472KB

  • memory/1828-1073-0x0000000006780000-0x00000000067D0000-memory.dmp
    Filesize

    320KB

  • memory/1828-1074-0x00000000029B0000-0x00000000029C0000-memory.dmp
    Filesize

    64KB

  • memory/1828-1075-0x00000000029B0000-0x00000000029C0000-memory.dmp
    Filesize

    64KB

  • memory/1828-1076-0x00000000029B0000-0x00000000029C0000-memory.dmp
    Filesize

    64KB

  • memory/1828-1077-0x00000000068F0000-0x0000000006AB2000-memory.dmp
    Filesize

    1.8MB

  • memory/1828-1078-0x0000000006AD0000-0x0000000006FFC000-memory.dmp
    Filesize

    5.2MB

  • memory/1828-1079-0x00000000029B0000-0x00000000029C0000-memory.dmp
    Filesize

    64KB