Analysis

  • max time kernel
    55s
  • max time network
    57s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    24-03-2023 00:55

General

  • Target

    932d7d8f6645cc94c6696c108dc3d366f6f00f3ebb14730c7707785e95601a93.exe

  • Size

    546KB

  • MD5

    c65721d9adee68c2e23c3f1bde2f912d

  • SHA1

    cdcf00980670bc1153eb98d8cc86bdba17ac518f

  • SHA256

    932d7d8f6645cc94c6696c108dc3d366f6f00f3ebb14730c7707785e95601a93

  • SHA512

    0302763c20b5129b91f66783cdb849abcd492c632e9969b189c274e57b773048d44ce3b0d052ec44294e36fe35ded761ac8c6c90608c660f50f18f4265912472

  • SSDEEP

    12288:vMroy90Nmf+UcaSUNaha9Dd5LVSjmst2wLlZ9TdFJfKDn:XyFYaVNas9XLVk7F39TtKDn

Malware Config

Extracted

Family

redline

Botnet

down

C2

193.233.20.31:4125

Attributes
  • auth_value

    12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

real

C2

193.233.20.31:4125

Attributes
  • auth_value

    bb22a50228754849387d5f4d1611e71b

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\932d7d8f6645cc94c6696c108dc3d366f6f00f3ebb14730c7707785e95601a93.exe
    "C:\Users\Admin\AppData\Local\Temp\932d7d8f6645cc94c6696c108dc3d366f6f00f3ebb14730c7707785e95601a93.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3540
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio7440.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio7440.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4188
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1958.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1958.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4360
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1685.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1685.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2096
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si719778.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si719778.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1108

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

3
T1112

Disabling Security Tools

2
T1089

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si719778.exe
    Filesize

    175KB

    MD5

    41707338e1e2d868aa699ac0dd2e77b0

    SHA1

    36e0dfba09f9fb409faf0f9a99217d0d0c524b82

    SHA256

    8d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557

    SHA512

    80c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si719778.exe
    Filesize

    175KB

    MD5

    41707338e1e2d868aa699ac0dd2e77b0

    SHA1

    36e0dfba09f9fb409faf0f9a99217d0d0c524b82

    SHA256

    8d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557

    SHA512

    80c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio7440.exe
    Filesize

    404KB

    MD5

    9cdc368f54bc4885bd67ce7b2adcce76

    SHA1

    7177cec33c58d9afd517466c361d8b0b50e62d54

    SHA256

    7da7ea08e13318cc66062568e15c89ba5779c41ec4b370709717fdb8c8818231

    SHA512

    0b300b1f57f22bccff68d1c59d80bc79ebd0b9f2412d7407a34ab3acceeed1a003b481ec30da8b7b1a4d823efde3982e8cc456e37757ea1ba1af3e5484226218

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio7440.exe
    Filesize

    404KB

    MD5

    9cdc368f54bc4885bd67ce7b2adcce76

    SHA1

    7177cec33c58d9afd517466c361d8b0b50e62d54

    SHA256

    7da7ea08e13318cc66062568e15c89ba5779c41ec4b370709717fdb8c8818231

    SHA512

    0b300b1f57f22bccff68d1c59d80bc79ebd0b9f2412d7407a34ab3acceeed1a003b481ec30da8b7b1a4d823efde3982e8cc456e37757ea1ba1af3e5484226218

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1958.exe
    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1958.exe
    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1685.exe
    Filesize

    358KB

    MD5

    df33eec96f12023b5654f101f19a1246

    SHA1

    c620966956c5ce278e72782128db05d29e05d337

    SHA256

    cec6d3ed1697aef7922e641dcdff39a0093f80dd8e82642e0d215e5677bac8a6

    SHA512

    8d1f8044800f1666bd27b2a9f05f53b17501bf192a8a7edbdf6826ff8658562fe5d671b5a5daf0d7579f9d472f828b82de2dc46d5cc222245ff612d6950d989e

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1685.exe
    Filesize

    358KB

    MD5

    df33eec96f12023b5654f101f19a1246

    SHA1

    c620966956c5ce278e72782128db05d29e05d337

    SHA256

    cec6d3ed1697aef7922e641dcdff39a0093f80dd8e82642e0d215e5677bac8a6

    SHA512

    8d1f8044800f1666bd27b2a9f05f53b17501bf192a8a7edbdf6826ff8658562fe5d671b5a5daf0d7579f9d472f828b82de2dc46d5cc222245ff612d6950d989e

  • memory/1108-1071-0x0000000000A70000-0x0000000000AA2000-memory.dmp
    Filesize

    200KB

  • memory/1108-1072-0x00000000054B0000-0x00000000054FB000-memory.dmp
    Filesize

    300KB

  • memory/1108-1074-0x00000000055C0000-0x00000000055D0000-memory.dmp
    Filesize

    64KB

  • memory/1108-1073-0x00000000055C0000-0x00000000055D0000-memory.dmp
    Filesize

    64KB

  • memory/2096-177-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
    Filesize

    248KB

  • memory/2096-187-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
    Filesize

    248KB

  • memory/2096-141-0x0000000004D50000-0x0000000004D60000-memory.dmp
    Filesize

    64KB

  • memory/2096-143-0x0000000004CF0000-0x0000000004D34000-memory.dmp
    Filesize

    272KB

  • memory/2096-142-0x0000000004D50000-0x0000000004D60000-memory.dmp
    Filesize

    64KB

  • memory/2096-144-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
    Filesize

    248KB

  • memory/2096-145-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
    Filesize

    248KB

  • memory/2096-147-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
    Filesize

    248KB

  • memory/2096-149-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
    Filesize

    248KB

  • memory/2096-151-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
    Filesize

    248KB

  • memory/2096-153-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
    Filesize

    248KB

  • memory/2096-155-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
    Filesize

    248KB

  • memory/2096-157-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
    Filesize

    248KB

  • memory/2096-159-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
    Filesize

    248KB

  • memory/2096-161-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
    Filesize

    248KB

  • memory/2096-163-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
    Filesize

    248KB

  • memory/2096-165-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
    Filesize

    248KB

  • memory/2096-167-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
    Filesize

    248KB

  • memory/2096-169-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
    Filesize

    248KB

  • memory/2096-171-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
    Filesize

    248KB

  • memory/2096-173-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
    Filesize

    248KB

  • memory/2096-175-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
    Filesize

    248KB

  • memory/2096-140-0x0000000004D60000-0x000000000525E000-memory.dmp
    Filesize

    5.0MB

  • memory/2096-179-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
    Filesize

    248KB

  • memory/2096-181-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
    Filesize

    248KB

  • memory/2096-183-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
    Filesize

    248KB

  • memory/2096-185-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
    Filesize

    248KB

  • memory/2096-139-0x0000000004D50000-0x0000000004D60000-memory.dmp
    Filesize

    64KB

  • memory/2096-189-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
    Filesize

    248KB

  • memory/2096-191-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
    Filesize

    248KB

  • memory/2096-193-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
    Filesize

    248KB

  • memory/2096-195-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
    Filesize

    248KB

  • memory/2096-197-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
    Filesize

    248KB

  • memory/2096-199-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
    Filesize

    248KB

  • memory/2096-201-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
    Filesize

    248KB

  • memory/2096-203-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
    Filesize

    248KB

  • memory/2096-205-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
    Filesize

    248KB

  • memory/2096-207-0x0000000004CF0000-0x0000000004D2E000-memory.dmp
    Filesize

    248KB

  • memory/2096-1050-0x0000000005260000-0x0000000005866000-memory.dmp
    Filesize

    6.0MB

  • memory/2096-1051-0x00000000058C0000-0x00000000059CA000-memory.dmp
    Filesize

    1.0MB

  • memory/2096-1052-0x0000000005A00000-0x0000000005A12000-memory.dmp
    Filesize

    72KB

  • memory/2096-1053-0x0000000005A20000-0x0000000005A5E000-memory.dmp
    Filesize

    248KB

  • memory/2096-1054-0x0000000004D50000-0x0000000004D60000-memory.dmp
    Filesize

    64KB

  • memory/2096-1055-0x0000000005B70000-0x0000000005BBB000-memory.dmp
    Filesize

    300KB

  • memory/2096-1058-0x0000000004D50000-0x0000000004D60000-memory.dmp
    Filesize

    64KB

  • memory/2096-1059-0x0000000005D00000-0x0000000005D66000-memory.dmp
    Filesize

    408KB

  • memory/2096-1057-0x0000000004D50000-0x0000000004D60000-memory.dmp
    Filesize

    64KB

  • memory/2096-1060-0x00000000063F0000-0x0000000006482000-memory.dmp
    Filesize

    584KB

  • memory/2096-1061-0x0000000002710000-0x0000000002786000-memory.dmp
    Filesize

    472KB

  • memory/2096-138-0x0000000000720000-0x000000000076B000-memory.dmp
    Filesize

    300KB

  • memory/2096-137-0x0000000004C70000-0x0000000004CB6000-memory.dmp
    Filesize

    280KB

  • memory/2096-1062-0x0000000007740000-0x0000000007790000-memory.dmp
    Filesize

    320KB

  • memory/2096-1063-0x0000000004D50000-0x0000000004D60000-memory.dmp
    Filesize

    64KB

  • memory/2096-1064-0x0000000007890000-0x0000000007A52000-memory.dmp
    Filesize

    1.8MB

  • memory/2096-1065-0x0000000007A60000-0x0000000007F8C000-memory.dmp
    Filesize

    5.2MB

  • memory/4360-131-0x0000000000420000-0x000000000042A000-memory.dmp
    Filesize

    40KB