Analysis

  • max time kernel
    145s
  • max time network
    104s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-03-2023 20:01

General

  • Target

    c049cff535b58e0b6f218fa5e59705bc4ddbbe0c27574ffe77142c47aa138e6c.exe

  • Size

    544KB

  • MD5

    fe5541da7047542fa8a083b3171ebb2a

  • SHA1

    03f647b6b92c6d51ae45b9165a2a803193294ea2

  • SHA256

    c049cff535b58e0b6f218fa5e59705bc4ddbbe0c27574ffe77142c47aa138e6c

  • SHA512

    1d245b9ea8892ecace01f35e62ab5680dace7c5eab0aa85ab9312acfb4542c0220ff9bede425c949e533c4ba47cbc8051057a2c29b3fbbfd7f35ac8b81862b8b

  • SSDEEP

    12288:SMr4y90ZXKLPQO0YWzt+D6wzp/pc2uQL24Dl:mysCUjzKZ/pc2fXJ

Malware Config

Extracted

Family

redline

Botnet

down

C2

193.233.20.31:4125

Attributes
  • auth_value

    12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

lown

C2

193.233.20.31:4125

Attributes
  • auth_value

    4cf836e062bcdc2a4fdbf410f5747ec7

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c049cff535b58e0b6f218fa5e59705bc4ddbbe0c27574ffe77142c47aa138e6c.exe
    "C:\Users\Admin\AppData\Local\Temp\c049cff535b58e0b6f218fa5e59705bc4ddbbe0c27574ffe77142c47aa138e6c.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1968
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba5216.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba5216.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1320
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h93yz77.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h93yz77.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3696
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iedqm51.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iedqm51.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3380
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l53px15.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l53px15.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4676
  • C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start wuauserv
    1⤵
    • Launches sc.exe
    PID:3928

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

3
T1112

Disabling Security Tools

2
T1089

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l53px15.exe
    Filesize

    175KB

    MD5

    50809fe16d7c482c1f4a2ea19fdcbc0a

    SHA1

    11b6f69c06a724da15183b16039c5cbc86016158

    SHA256

    09917b67829de37b5d6be8115c8f8321f436554f426a24e079257a8368051cb1

    SHA512

    c35170e5eb6dabda9fd2d289153df829957ca8e9665178529a1ba36395155bb34f489372993ec694d10bea490c86cef2ae152e2df480288aca8e796ba135261f

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l53px15.exe
    Filesize

    175KB

    MD5

    50809fe16d7c482c1f4a2ea19fdcbc0a

    SHA1

    11b6f69c06a724da15183b16039c5cbc86016158

    SHA256

    09917b67829de37b5d6be8115c8f8321f436554f426a24e079257a8368051cb1

    SHA512

    c35170e5eb6dabda9fd2d289153df829957ca8e9665178529a1ba36395155bb34f489372993ec694d10bea490c86cef2ae152e2df480288aca8e796ba135261f

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba5216.exe
    Filesize

    402KB

    MD5

    24ccd7b9df6549d09aa9ea14ee137e31

    SHA1

    fe60be1182c774296af2eddd6ca7ba9e8ab0aac1

    SHA256

    d05dc3388034c7770414309461b6b1916aabcaa76d10974c564257d74117e576

    SHA512

    47aaea2677facf7d41a509a1839dbdd9326fc0b0388a77401b31b2b1fc81a1147a4a0a5b78558ad054900bea4ea7f96082bd1e908e4cd1e6b8e0cfb20e73285a

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba5216.exe
    Filesize

    402KB

    MD5

    24ccd7b9df6549d09aa9ea14ee137e31

    SHA1

    fe60be1182c774296af2eddd6ca7ba9e8ab0aac1

    SHA256

    d05dc3388034c7770414309461b6b1916aabcaa76d10974c564257d74117e576

    SHA512

    47aaea2677facf7d41a509a1839dbdd9326fc0b0388a77401b31b2b1fc81a1147a4a0a5b78558ad054900bea4ea7f96082bd1e908e4cd1e6b8e0cfb20e73285a

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h93yz77.exe
    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h93yz77.exe
    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iedqm51.exe
    Filesize

    349KB

    MD5

    0d99082ac33345a678852b7bb39352b2

    SHA1

    152cbcd9c30f3fa4d66bf082aff88f7a1abc9ffe

    SHA256

    551f87329c0f48a4ea228cc719c7844d6f914de659f6db38601f1a2d3a26a50d

    SHA512

    724ac5a09b3447e2f0254fea00bc5e1afde0d0f06780ffac99ab4f8ff9a7041161e121dda0a0c3ae3840bfe7d87e14e8005085c6da0754cbcd0e1fdcfdae8f59

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iedqm51.exe
    Filesize

    349KB

    MD5

    0d99082ac33345a678852b7bb39352b2

    SHA1

    152cbcd9c30f3fa4d66bf082aff88f7a1abc9ffe

    SHA256

    551f87329c0f48a4ea228cc719c7844d6f914de659f6db38601f1a2d3a26a50d

    SHA512

    724ac5a09b3447e2f0254fea00bc5e1afde0d0f06780ffac99ab4f8ff9a7041161e121dda0a0c3ae3840bfe7d87e14e8005085c6da0754cbcd0e1fdcfdae8f59

  • memory/3380-153-0x0000000002250000-0x000000000229B000-memory.dmp
    Filesize

    300KB

  • memory/3380-154-0x0000000004F90000-0x0000000005534000-memory.dmp
    Filesize

    5.6MB

  • memory/3380-155-0x00000000028D0000-0x000000000290E000-memory.dmp
    Filesize

    248KB

  • memory/3380-158-0x00000000028D0000-0x000000000290E000-memory.dmp
    Filesize

    248KB

  • memory/3380-156-0x00000000028D0000-0x000000000290E000-memory.dmp
    Filesize

    248KB

  • memory/3380-160-0x00000000028D0000-0x000000000290E000-memory.dmp
    Filesize

    248KB

  • memory/3380-162-0x00000000028D0000-0x000000000290E000-memory.dmp
    Filesize

    248KB

  • memory/3380-164-0x00000000028D0000-0x000000000290E000-memory.dmp
    Filesize

    248KB

  • memory/3380-166-0x00000000028D0000-0x000000000290E000-memory.dmp
    Filesize

    248KB

  • memory/3380-168-0x00000000028D0000-0x000000000290E000-memory.dmp
    Filesize

    248KB

  • memory/3380-170-0x00000000028D0000-0x000000000290E000-memory.dmp
    Filesize

    248KB

  • memory/3380-172-0x00000000028D0000-0x000000000290E000-memory.dmp
    Filesize

    248KB

  • memory/3380-174-0x00000000028D0000-0x000000000290E000-memory.dmp
    Filesize

    248KB

  • memory/3380-176-0x00000000028D0000-0x000000000290E000-memory.dmp
    Filesize

    248KB

  • memory/3380-178-0x00000000028D0000-0x000000000290E000-memory.dmp
    Filesize

    248KB

  • memory/3380-180-0x00000000028D0000-0x000000000290E000-memory.dmp
    Filesize

    248KB

  • memory/3380-182-0x00000000028D0000-0x000000000290E000-memory.dmp
    Filesize

    248KB

  • memory/3380-184-0x00000000028D0000-0x000000000290E000-memory.dmp
    Filesize

    248KB

  • memory/3380-186-0x0000000004F80000-0x0000000004F90000-memory.dmp
    Filesize

    64KB

  • memory/3380-188-0x0000000004F80000-0x0000000004F90000-memory.dmp
    Filesize

    64KB

  • memory/3380-187-0x00000000028D0000-0x000000000290E000-memory.dmp
    Filesize

    248KB

  • memory/3380-190-0x0000000004F80000-0x0000000004F90000-memory.dmp
    Filesize

    64KB

  • memory/3380-191-0x00000000028D0000-0x000000000290E000-memory.dmp
    Filesize

    248KB

  • memory/3380-193-0x00000000028D0000-0x000000000290E000-memory.dmp
    Filesize

    248KB

  • memory/3380-195-0x00000000028D0000-0x000000000290E000-memory.dmp
    Filesize

    248KB

  • memory/3380-197-0x00000000028D0000-0x000000000290E000-memory.dmp
    Filesize

    248KB

  • memory/3380-199-0x00000000028D0000-0x000000000290E000-memory.dmp
    Filesize

    248KB

  • memory/3380-201-0x00000000028D0000-0x000000000290E000-memory.dmp
    Filesize

    248KB

  • memory/3380-203-0x00000000028D0000-0x000000000290E000-memory.dmp
    Filesize

    248KB

  • memory/3380-205-0x00000000028D0000-0x000000000290E000-memory.dmp
    Filesize

    248KB

  • memory/3380-207-0x00000000028D0000-0x000000000290E000-memory.dmp
    Filesize

    248KB

  • memory/3380-209-0x00000000028D0000-0x000000000290E000-memory.dmp
    Filesize

    248KB

  • memory/3380-211-0x00000000028D0000-0x000000000290E000-memory.dmp
    Filesize

    248KB

  • memory/3380-213-0x00000000028D0000-0x000000000290E000-memory.dmp
    Filesize

    248KB

  • memory/3380-215-0x00000000028D0000-0x000000000290E000-memory.dmp
    Filesize

    248KB

  • memory/3380-217-0x00000000028D0000-0x000000000290E000-memory.dmp
    Filesize

    248KB

  • memory/3380-219-0x00000000028D0000-0x000000000290E000-memory.dmp
    Filesize

    248KB

  • memory/3380-221-0x00000000028D0000-0x000000000290E000-memory.dmp
    Filesize

    248KB

  • memory/3380-1064-0x0000000005540000-0x0000000005B58000-memory.dmp
    Filesize

    6.1MB

  • memory/3380-1065-0x0000000004DE0000-0x0000000004EEA000-memory.dmp
    Filesize

    1.0MB

  • memory/3380-1066-0x0000000004F20000-0x0000000004F32000-memory.dmp
    Filesize

    72KB

  • memory/3380-1067-0x0000000004F40000-0x0000000004F7C000-memory.dmp
    Filesize

    240KB

  • memory/3380-1068-0x0000000004F80000-0x0000000004F90000-memory.dmp
    Filesize

    64KB

  • memory/3380-1069-0x0000000005E10000-0x0000000005E76000-memory.dmp
    Filesize

    408KB

  • memory/3380-1071-0x0000000006610000-0x00000000066A2000-memory.dmp
    Filesize

    584KB

  • memory/3380-1072-0x0000000006810000-0x0000000006886000-memory.dmp
    Filesize

    472KB

  • memory/3380-1073-0x0000000006890000-0x00000000068E0000-memory.dmp
    Filesize

    320KB

  • memory/3380-1074-0x0000000004F80000-0x0000000004F90000-memory.dmp
    Filesize

    64KB

  • memory/3380-1075-0x0000000004F80000-0x0000000004F90000-memory.dmp
    Filesize

    64KB

  • memory/3380-1076-0x0000000006B00000-0x0000000006CC2000-memory.dmp
    Filesize

    1.8MB

  • memory/3380-1077-0x0000000006CD0000-0x00000000071FC000-memory.dmp
    Filesize

    5.2MB

  • memory/3380-1078-0x0000000004F80000-0x0000000004F90000-memory.dmp
    Filesize

    64KB

  • memory/3696-147-0x0000000000680000-0x000000000068A000-memory.dmp
    Filesize

    40KB

  • memory/4676-1084-0x0000000000470000-0x00000000004A2000-memory.dmp
    Filesize

    200KB

  • memory/4676-1085-0x00000000050D0000-0x00000000050E0000-memory.dmp
    Filesize

    64KB