Analysis

  • max time kernel
    85s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-03-2023 21:49

General

  • Target

    d9a18daa0115896bff37f82c1f4c57f9a8ae0359157cd337143c1b993ea22cef.exe

  • Size

    553KB

  • MD5

    4c727279ca96055675d0432a2204ae2d

  • SHA1

    25678f74ea36e8eac19c908406c2f44a5971c26e

  • SHA256

    d9a18daa0115896bff37f82c1f4c57f9a8ae0359157cd337143c1b993ea22cef

  • SHA512

    f82c16d987ef43d65101fdc17a20a170b87191a3d6fc7b609dd552c89388fbf2c62733eb91f734288cc2da9e96c9b07be7c8e78db3f3498958a1cd27a79ae0dc

  • SSDEEP

    12288:3MrNy90cPixptkhpjNLgKJBWVcDKxA4Ir:OyiCh/LXJYOAA4K

Malware Config

Extracted

Family

redline

Botnet

boris

C2

193.233.20.32:4125

Attributes
  • auth_value

    766b5bdf6dbefcf7ca223351952fc38f

Extracted

Family

redline

Botnet

lida

C2

193.233.20.32:4125

Attributes
  • auth_value

    24052aa2e9b85984a98d80cf08623e8d

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 33 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d9a18daa0115896bff37f82c1f4c57f9a8ae0359157cd337143c1b993ea22cef.exe
    "C:\Users\Admin\AppData\Local\Temp\d9a18daa0115896bff37f82c1f4c57f9a8ae0359157cd337143c1b993ea22cef.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4400
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba0419.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba0419.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2764
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h89RM12.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h89RM12.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4072
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iuhFA54.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iuhFA54.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3548
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 1328
          4⤵
          • Program crash
          PID:2276
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l94ai90.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l94ai90.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4188
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3548 -ip 3548
    1⤵
      PID:3456

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Modify Existing Service

    1
    T1031

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    3
    T1112

    Disabling Security Tools

    2
    T1089

    Credential Access

    Credentials in Files

    2
    T1081

    Discovery

    Query Registry

    1
    T1012

    Collection

    Data from Local System

    2
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l94ai90.exe
      Filesize

      175KB

      MD5

      6b06147bf5fd26306978a93fe83127a4

      SHA1

      7b14ff42f4441b985591ef5b7d4cc703f0bbcdfa

      SHA256

      11e6d45ae92fc4505f14f550d01d97a42fba91a999b900daf843251772c755e0

      SHA512

      603007d99e52da5739040fee891c193123dc5741985de1c3dde091dd07e759336ec749312e4ab95d05c1c6681f10e56b4e9aee67d633a97b6aa25c5119f4d6b4

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l94ai90.exe
      Filesize

      175KB

      MD5

      6b06147bf5fd26306978a93fe83127a4

      SHA1

      7b14ff42f4441b985591ef5b7d4cc703f0bbcdfa

      SHA256

      11e6d45ae92fc4505f14f550d01d97a42fba91a999b900daf843251772c755e0

      SHA512

      603007d99e52da5739040fee891c193123dc5741985de1c3dde091dd07e759336ec749312e4ab95d05c1c6681f10e56b4e9aee67d633a97b6aa25c5119f4d6b4

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba0419.exe
      Filesize

      412KB

      MD5

      47b59e9cc6a9ccf9d858585738259949

      SHA1

      33e4006bc63bb85575097fa5a3772ba4eed4316f

      SHA256

      04857159ad4778d3d8f18d783b7a995ebe6a02aae5547d4ce37008a1d37d5a0d

      SHA512

      66efeb16afbae1e8d37e00f6facf8aed9365128786f0a53b9d93187dbf8b2cda7dc814f7fdc77e2ceb2a892be986c5b6aa974964cdf53c4d3308fc47263d1b3f

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba0419.exe
      Filesize

      412KB

      MD5

      47b59e9cc6a9ccf9d858585738259949

      SHA1

      33e4006bc63bb85575097fa5a3772ba4eed4316f

      SHA256

      04857159ad4778d3d8f18d783b7a995ebe6a02aae5547d4ce37008a1d37d5a0d

      SHA512

      66efeb16afbae1e8d37e00f6facf8aed9365128786f0a53b9d93187dbf8b2cda7dc814f7fdc77e2ceb2a892be986c5b6aa974964cdf53c4d3308fc47263d1b3f

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h89RM12.exe
      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h89RM12.exe
      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iuhFA54.exe
      Filesize

      387KB

      MD5

      6d7c6518aa0009ce6b37328154bae689

      SHA1

      0242f0c4affcb7dc1fc017bc935de97efdb81a71

      SHA256

      2f8618667c182a0a87aa45a99f306d4174cd5840b82be64c20c8eccbce51038b

      SHA512

      b52d9007a69479e1e3d422754d25606bbdbf270116eb19536ed61fea80be1a367d4177cffc7942c18a8d3c475682dea5719caae18f9635f3eb64a84c275d9c17

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iuhFA54.exe
      Filesize

      387KB

      MD5

      6d7c6518aa0009ce6b37328154bae689

      SHA1

      0242f0c4affcb7dc1fc017bc935de97efdb81a71

      SHA256

      2f8618667c182a0a87aa45a99f306d4174cd5840b82be64c20c8eccbce51038b

      SHA512

      b52d9007a69479e1e3d422754d25606bbdbf270116eb19536ed61fea80be1a367d4177cffc7942c18a8d3c475682dea5719caae18f9635f3eb64a84c275d9c17

    • memory/3548-153-0x0000000007170000-0x0000000007714000-memory.dmp
      Filesize

      5.6MB

    • memory/3548-154-0x0000000002C80000-0x0000000002CCB000-memory.dmp
      Filesize

      300KB

    • memory/3548-155-0x0000000007720000-0x000000000775F000-memory.dmp
      Filesize

      252KB

    • memory/3548-157-0x0000000007720000-0x000000000775F000-memory.dmp
      Filesize

      252KB

    • memory/3548-156-0x0000000007160000-0x0000000007170000-memory.dmp
      Filesize

      64KB

    • memory/3548-158-0x0000000007160000-0x0000000007170000-memory.dmp
      Filesize

      64KB

    • memory/3548-160-0x0000000007160000-0x0000000007170000-memory.dmp
      Filesize

      64KB

    • memory/3548-163-0x0000000007720000-0x000000000775F000-memory.dmp
      Filesize

      252KB

    • memory/3548-161-0x0000000007720000-0x000000000775F000-memory.dmp
      Filesize

      252KB

    • memory/3548-165-0x0000000007720000-0x000000000775F000-memory.dmp
      Filesize

      252KB

    • memory/3548-167-0x0000000007720000-0x000000000775F000-memory.dmp
      Filesize

      252KB

    • memory/3548-169-0x0000000007720000-0x000000000775F000-memory.dmp
      Filesize

      252KB

    • memory/3548-171-0x0000000007720000-0x000000000775F000-memory.dmp
      Filesize

      252KB

    • memory/3548-173-0x0000000007720000-0x000000000775F000-memory.dmp
      Filesize

      252KB

    • memory/3548-175-0x0000000007720000-0x000000000775F000-memory.dmp
      Filesize

      252KB

    • memory/3548-177-0x0000000007720000-0x000000000775F000-memory.dmp
      Filesize

      252KB

    • memory/3548-179-0x0000000007720000-0x000000000775F000-memory.dmp
      Filesize

      252KB

    • memory/3548-181-0x0000000007720000-0x000000000775F000-memory.dmp
      Filesize

      252KB

    • memory/3548-183-0x0000000007720000-0x000000000775F000-memory.dmp
      Filesize

      252KB

    • memory/3548-185-0x0000000007720000-0x000000000775F000-memory.dmp
      Filesize

      252KB

    • memory/3548-187-0x0000000007720000-0x000000000775F000-memory.dmp
      Filesize

      252KB

    • memory/3548-189-0x0000000007720000-0x000000000775F000-memory.dmp
      Filesize

      252KB

    • memory/3548-191-0x0000000007720000-0x000000000775F000-memory.dmp
      Filesize

      252KB

    • memory/3548-193-0x0000000007720000-0x000000000775F000-memory.dmp
      Filesize

      252KB

    • memory/3548-195-0x0000000007720000-0x000000000775F000-memory.dmp
      Filesize

      252KB

    • memory/3548-197-0x0000000007720000-0x000000000775F000-memory.dmp
      Filesize

      252KB

    • memory/3548-199-0x0000000007720000-0x000000000775F000-memory.dmp
      Filesize

      252KB

    • memory/3548-201-0x0000000007720000-0x000000000775F000-memory.dmp
      Filesize

      252KB

    • memory/3548-203-0x0000000007720000-0x000000000775F000-memory.dmp
      Filesize

      252KB

    • memory/3548-205-0x0000000007720000-0x000000000775F000-memory.dmp
      Filesize

      252KB

    • memory/3548-207-0x0000000007720000-0x000000000775F000-memory.dmp
      Filesize

      252KB

    • memory/3548-209-0x0000000007720000-0x000000000775F000-memory.dmp
      Filesize

      252KB

    • memory/3548-211-0x0000000007720000-0x000000000775F000-memory.dmp
      Filesize

      252KB

    • memory/3548-213-0x0000000007720000-0x000000000775F000-memory.dmp
      Filesize

      252KB

    • memory/3548-215-0x0000000007720000-0x000000000775F000-memory.dmp
      Filesize

      252KB

    • memory/3548-217-0x0000000007720000-0x000000000775F000-memory.dmp
      Filesize

      252KB

    • memory/3548-219-0x0000000007720000-0x000000000775F000-memory.dmp
      Filesize

      252KB

    • memory/3548-221-0x0000000007720000-0x000000000775F000-memory.dmp
      Filesize

      252KB

    • memory/3548-1064-0x0000000007790000-0x0000000007DA8000-memory.dmp
      Filesize

      6.1MB

    • memory/3548-1065-0x0000000007E30000-0x0000000007F3A000-memory.dmp
      Filesize

      1.0MB

    • memory/3548-1066-0x0000000007F70000-0x0000000007F82000-memory.dmp
      Filesize

      72KB

    • memory/3548-1067-0x0000000007F90000-0x0000000007FCC000-memory.dmp
      Filesize

      240KB

    • memory/3548-1068-0x0000000007160000-0x0000000007170000-memory.dmp
      Filesize

      64KB

    • memory/3548-1069-0x0000000008280000-0x00000000082E6000-memory.dmp
      Filesize

      408KB

    • memory/3548-1071-0x0000000008950000-0x00000000089E2000-memory.dmp
      Filesize

      584KB

    • memory/3548-1072-0x0000000007160000-0x0000000007170000-memory.dmp
      Filesize

      64KB

    • memory/3548-1073-0x0000000007160000-0x0000000007170000-memory.dmp
      Filesize

      64KB

    • memory/3548-1074-0x0000000007160000-0x0000000007170000-memory.dmp
      Filesize

      64KB

    • memory/3548-1075-0x0000000008B40000-0x0000000008BB6000-memory.dmp
      Filesize

      472KB

    • memory/3548-1076-0x0000000008BD0000-0x0000000008C20000-memory.dmp
      Filesize

      320KB

    • memory/3548-1077-0x0000000008C30000-0x0000000008DF2000-memory.dmp
      Filesize

      1.8MB

    • memory/3548-1078-0x0000000008E00000-0x000000000932C000-memory.dmp
      Filesize

      5.2MB

    • memory/3548-1080-0x0000000007160000-0x0000000007170000-memory.dmp
      Filesize

      64KB

    • memory/4072-147-0x00000000008A0000-0x00000000008AA000-memory.dmp
      Filesize

      40KB

    • memory/4188-1085-0x00000000005E0000-0x0000000000612000-memory.dmp
      Filesize

      200KB

    • memory/4188-1086-0x0000000004EF0000-0x0000000004F00000-memory.dmp
      Filesize

      64KB