Analysis
-
max time kernel
57s -
max time network
59s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
23/03/2023, 20:37 UTC
General
-
Target
9a4de5508379fd1a3879217b02bff52b64c556a08d86a54979340a0ae3ed731e.exe
-
Size
544KB
-
MD5
bd05df9bbce1d69c9605755ddf7af88b
-
SHA1
855746685a67cf1198136f175adaf7d1385cc62e
-
SHA256
9a4de5508379fd1a3879217b02bff52b64c556a08d86a54979340a0ae3ed731e
-
SHA512
2934f265f953af8b8235afa8e915a009bc37c57c997ee58bb07e7be532fba16b669a4d53312f22af80c26d213c75dc5c1fa3987e628ad40e799918124a5aa452
-
SSDEEP
12288:DMrIy90bfj36Qkdo65Mryt8j/GcEqgUHMLqwhK+pPHK:fyg76NG6S+G/ACMe6pPq
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
real
193.233.20.31:4125
-
auth_value
bb22a50228754849387d5f4d1611e71b
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 36 IoCs
-
Executes dropped EXE 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 1 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a4de5508379fd1a3879217b02bff52b64c556a08d86a54979340a0ae3ed731e.exe"C:\Users\Admin\AppData\Local\Temp\9a4de5508379fd1a3879217b02bff52b64c556a08d86a54979340a0ae3ed731e.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio3036.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio3036.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7637.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7637.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7562.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7562.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si097466.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si097466.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
-
DNS31.20.233.193.in-addr.arpaRemote address:8.8.8.8:53Request31.20.233.193.in-addr.arpaIN PTRResponse -
DNS203.151.224.20.in-addr.arpaRemote address:8.8.8.8:53Request203.151.224.20.in-addr.arpaIN PTRResponse
-
193.233.20.31:4125 -
20.50.201.195:443 -
88.221.25.155:80
-
193.233.20.31:4125
-
8.8.8.8:5331.20.233.193.in-addr.arpadns
DNS Request
31.20.233.193.in-addr.arpa
-
8.8.8.8:53203.151.224.20.in-addr.arpadns
DNS Request
203.151.224.20.in-addr.arpa
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD541707338e1e2d868aa699ac0dd2e77b0
SHA136e0dfba09f9fb409faf0f9a99217d0d0c524b82
SHA2568d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557
SHA51280c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2
-
Filesize
175KB
MD541707338e1e2d868aa699ac0dd2e77b0
SHA136e0dfba09f9fb409faf0f9a99217d0d0c524b82
SHA2568d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557
SHA51280c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2
-
Filesize
402KB
MD58e2004f13d056ac0fcb6e7e5bfd1b6c6
SHA16ffc51af6349c0e8b27fee720f8ff18e2519c0c8
SHA256bfa68a410323d7bbb01ccaab23630431562e62a3064fa3a133ebe115fb7cf15d
SHA5123b0737aaba991e828eae4df8c2bdcb7d41bd9432945ccd15e3b02b4b6e57cbad5fdd7a824d37c62736cd1b29612864ed9c2d540eb3cbd01afe4608b0f91f1c4b
-
Filesize
402KB
MD58e2004f13d056ac0fcb6e7e5bfd1b6c6
SHA16ffc51af6349c0e8b27fee720f8ff18e2519c0c8
SHA256bfa68a410323d7bbb01ccaab23630431562e62a3064fa3a133ebe115fb7cf15d
SHA5123b0737aaba991e828eae4df8c2bdcb7d41bd9432945ccd15e3b02b4b6e57cbad5fdd7a824d37c62736cd1b29612864ed9c2d540eb3cbd01afe4608b0f91f1c4b
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
349KB
MD58f0e2e16185c0ae19a6757f478c95180
SHA1f5f19b962dd23bb3988b2bf1cf1a49035fa1b2cb
SHA256282b26b6b3ba7190e068d55702c46fa501f20846217c0e91f3faaf186266c548
SHA512504d7927d0e7628b4c8598c1ba1badbca56b346efa53a4032759505adc56c81983e5aa52371c3a81f4b73d12bfb014b4cd245187abbaaab4b75da0fb6783aaa6
-
Filesize
349KB
MD58f0e2e16185c0ae19a6757f478c95180
SHA1f5f19b962dd23bb3988b2bf1cf1a49035fa1b2cb
SHA256282b26b6b3ba7190e068d55702c46fa501f20846217c0e91f3faaf186266c548
SHA512504d7927d0e7628b4c8598c1ba1badbca56b346efa53a4032759505adc56c81983e5aa52371c3a81f4b73d12bfb014b4cd245187abbaaab4b75da0fb6783aaa6
-
Filesize
200KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
5.0MB
-
Filesize
272KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
280KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
6.0MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
248KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
584KB
-
Filesize
300KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
472KB
-
Filesize
320KB