Analysis

  • max time kernel
    79s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-03-2023 00:59

General

  • Target

    602c06422816c81b6e81593dbbe7d68ee0f2ef8ed7c08c83d816f77fd28e5f96.exe

  • Size

    690KB

  • MD5

    9b85b7a26be240c5e328811c1ae5f370

  • SHA1

    eb7ead7e87b0978b76820d17e2d1983623f92bab

  • SHA256

    602c06422816c81b6e81593dbbe7d68ee0f2ef8ed7c08c83d816f77fd28e5f96

  • SHA512

    b4934766124378108b707a08fa3588f86699430a9055d5052be789fc0c5224091608f6757f5fef149f1decc7a62f4bb8a28d34776b814e2be8c533e1ca93e322

  • SSDEEP

    12288:8UjIXjpVmeRF7euMA4AFtz53CdFNBPT/0TI3VEN+5Q8oe4yY:8UEH9beq7Ftz53CdP6T+V7SF

Malware Config

Extracted

Family

redline

Botnet

down

C2

193.233.20.31:4125

Attributes
  • auth_value

    12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

real

C2

193.233.20.31:4125

Attributes
  • auth_value

    bb22a50228754849387d5f4d1611e71b

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 33 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\602c06422816c81b6e81593dbbe7d68ee0f2ef8ed7c08c83d816f77fd28e5f96.exe
    "C:\Users\Admin\AppData\Local\Temp\602c06422816c81b6e81593dbbe7d68ee0f2ef8ed7c08c83d816f77fd28e5f96.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2044
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zinL7582.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zinL7582.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2984
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr520732.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr520732.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1108
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku168402.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku168402.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2776
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 1352
          4⤵
          • Program crash
          PID:1660
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr143335.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr143335.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2212
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 484
      2⤵
      • Program crash
      PID:3304
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2776 -ip 2776
    1⤵
      PID:1344
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2044 -ip 2044
      1⤵
        PID:2452

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Persistence

      Modify Existing Service

      1
      T1031

      Registry Run Keys / Startup Folder

      1
      T1060

      Defense Evasion

      Modify Registry

      3
      T1112

      Disabling Security Tools

      2
      T1089

      Credential Access

      Credentials in Files

      2
      T1081

      Discovery

      Query Registry

      1
      T1012

      Collection

      Data from Local System

      2
      T1005

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr143335.exe
        Filesize

        175KB

        MD5

        41707338e1e2d868aa699ac0dd2e77b0

        SHA1

        36e0dfba09f9fb409faf0f9a99217d0d0c524b82

        SHA256

        8d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557

        SHA512

        80c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr143335.exe
        Filesize

        175KB

        MD5

        41707338e1e2d868aa699ac0dd2e77b0

        SHA1

        36e0dfba09f9fb409faf0f9a99217d0d0c524b82

        SHA256

        8d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557

        SHA512

        80c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zinL7582.exe
        Filesize

        404KB

        MD5

        d715da6658524cd30303b7cb638c6263

        SHA1

        ed0b406f5759da89df3b45895f9430ec55acbf2c

        SHA256

        90684394c3e785fa7e12cf4540208c18579280d230649b87b595554095d0e775

        SHA512

        00cc07b04cf7ee7c5d2b57f0b57e50d8f3790b0f7c75089aa3baf063bb18c696cd5ef1777c62596b35959c6937cec6750bd7304e0d748ce4f108a10587661f36

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zinL7582.exe
        Filesize

        404KB

        MD5

        d715da6658524cd30303b7cb638c6263

        SHA1

        ed0b406f5759da89df3b45895f9430ec55acbf2c

        SHA256

        90684394c3e785fa7e12cf4540208c18579280d230649b87b595554095d0e775

        SHA512

        00cc07b04cf7ee7c5d2b57f0b57e50d8f3790b0f7c75089aa3baf063bb18c696cd5ef1777c62596b35959c6937cec6750bd7304e0d748ce4f108a10587661f36

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr520732.exe
        Filesize

        11KB

        MD5

        7e93bacbbc33e6652e147e7fe07572a0

        SHA1

        421a7167da01c8da4dc4d5234ca3dd84e319e762

        SHA256

        850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

        SHA512

        250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr520732.exe
        Filesize

        11KB

        MD5

        7e93bacbbc33e6652e147e7fe07572a0

        SHA1

        421a7167da01c8da4dc4d5234ca3dd84e319e762

        SHA256

        850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

        SHA512

        250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku168402.exe
        Filesize

        358KB

        MD5

        7a4a29c15ffeb297ac2c51d45d1383bf

        SHA1

        e2a84c12b5a483680548d45f4602584161b7a9ae

        SHA256

        1686f802a3863f6f45409ec31a29d5a3eda39e1f45135004d9ea852edcb382b6

        SHA512

        856105aa0cfb2e0a02e597a73a9e725bb7cd8a690b9f34fa0ea5d91b20c5687e0d902814927168142ad6254555f52e4f9a9074bfa35e3c99b540766b678e5532

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku168402.exe
        Filesize

        358KB

        MD5

        7a4a29c15ffeb297ac2c51d45d1383bf

        SHA1

        e2a84c12b5a483680548d45f4602584161b7a9ae

        SHA256

        1686f802a3863f6f45409ec31a29d5a3eda39e1f45135004d9ea852edcb382b6

        SHA512

        856105aa0cfb2e0a02e597a73a9e725bb7cd8a690b9f34fa0ea5d91b20c5687e0d902814927168142ad6254555f52e4f9a9074bfa35e3c99b540766b678e5532

      • memory/1108-149-0x0000000000420000-0x000000000042A000-memory.dmp
        Filesize

        40KB

      • memory/2044-134-0x0000000002570000-0x00000000025FA000-memory.dmp
        Filesize

        552KB

      • memory/2044-150-0x0000000000400000-0x000000000076F000-memory.dmp
        Filesize

        3.4MB

      • memory/2212-1091-0x00000000056E0000-0x00000000056F0000-memory.dmp
        Filesize

        64KB

      • memory/2212-1089-0x0000000000B60000-0x0000000000B92000-memory.dmp
        Filesize

        200KB

      • memory/2776-199-0x0000000004CC0000-0x0000000004CFE000-memory.dmp
        Filesize

        248KB

      • memory/2776-206-0x0000000004D60000-0x0000000004D70000-memory.dmp
        Filesize

        64KB

      • memory/2776-161-0x0000000004CC0000-0x0000000004CFE000-memory.dmp
        Filesize

        248KB

      • memory/2776-163-0x0000000004CC0000-0x0000000004CFE000-memory.dmp
        Filesize

        248KB

      • memory/2776-165-0x0000000004CC0000-0x0000000004CFE000-memory.dmp
        Filesize

        248KB

      • memory/2776-167-0x0000000004CC0000-0x0000000004CFE000-memory.dmp
        Filesize

        248KB

      • memory/2776-169-0x0000000004CC0000-0x0000000004CFE000-memory.dmp
        Filesize

        248KB

      • memory/2776-171-0x0000000004CC0000-0x0000000004CFE000-memory.dmp
        Filesize

        248KB

      • memory/2776-173-0x0000000004CC0000-0x0000000004CFE000-memory.dmp
        Filesize

        248KB

      • memory/2776-175-0x0000000004CC0000-0x0000000004CFE000-memory.dmp
        Filesize

        248KB

      • memory/2776-177-0x0000000004CC0000-0x0000000004CFE000-memory.dmp
        Filesize

        248KB

      • memory/2776-179-0x0000000004CC0000-0x0000000004CFE000-memory.dmp
        Filesize

        248KB

      • memory/2776-181-0x0000000004CC0000-0x0000000004CFE000-memory.dmp
        Filesize

        248KB

      • memory/2776-183-0x0000000004CC0000-0x0000000004CFE000-memory.dmp
        Filesize

        248KB

      • memory/2776-185-0x0000000004CC0000-0x0000000004CFE000-memory.dmp
        Filesize

        248KB

      • memory/2776-187-0x0000000004CC0000-0x0000000004CFE000-memory.dmp
        Filesize

        248KB

      • memory/2776-195-0x0000000004CC0000-0x0000000004CFE000-memory.dmp
        Filesize

        248KB

      • memory/2776-197-0x0000000004CC0000-0x0000000004CFE000-memory.dmp
        Filesize

        248KB

      • memory/2776-193-0x0000000004CC0000-0x0000000004CFE000-memory.dmp
        Filesize

        248KB

      • memory/2776-158-0x0000000004CC0000-0x0000000004CFE000-memory.dmp
        Filesize

        248KB

      • memory/2776-191-0x0000000004CC0000-0x0000000004CFE000-memory.dmp
        Filesize

        248KB

      • memory/2776-189-0x0000000004CC0000-0x0000000004CFE000-memory.dmp
        Filesize

        248KB

      • memory/2776-202-0x0000000004D60000-0x0000000004D70000-memory.dmp
        Filesize

        64KB

      • memory/2776-204-0x0000000004D60000-0x0000000004D70000-memory.dmp
        Filesize

        64KB

      • memory/2776-201-0x0000000004CC0000-0x0000000004CFE000-memory.dmp
        Filesize

        248KB

      • memory/2776-159-0x0000000004CC0000-0x0000000004CFE000-memory.dmp
        Filesize

        248KB

      • memory/2776-205-0x0000000004CC0000-0x0000000004CFE000-memory.dmp
        Filesize

        248KB

      • memory/2776-208-0x0000000004CC0000-0x0000000004CFE000-memory.dmp
        Filesize

        248KB

      • memory/2776-214-0x0000000004CC0000-0x0000000004CFE000-memory.dmp
        Filesize

        248KB

      • memory/2776-212-0x0000000004CC0000-0x0000000004CFE000-memory.dmp
        Filesize

        248KB

      • memory/2776-210-0x0000000004CC0000-0x0000000004CFE000-memory.dmp
        Filesize

        248KB

      • memory/2776-216-0x0000000004CC0000-0x0000000004CFE000-memory.dmp
        Filesize

        248KB

      • memory/2776-220-0x0000000004CC0000-0x0000000004CFE000-memory.dmp
        Filesize

        248KB

      • memory/2776-218-0x0000000004CC0000-0x0000000004CFE000-memory.dmp
        Filesize

        248KB

      • memory/2776-222-0x0000000004CC0000-0x0000000004CFE000-memory.dmp
        Filesize

        248KB

      • memory/2776-1067-0x0000000005460000-0x0000000005A78000-memory.dmp
        Filesize

        6.1MB

      • memory/2776-1068-0x0000000005B00000-0x0000000005C0A000-memory.dmp
        Filesize

        1.0MB

      • memory/2776-1069-0x0000000005C40000-0x0000000005C52000-memory.dmp
        Filesize

        72KB

      • memory/2776-1070-0x0000000005C60000-0x0000000005C9C000-memory.dmp
        Filesize

        240KB

      • memory/2776-1071-0x0000000004D60000-0x0000000004D70000-memory.dmp
        Filesize

        64KB

      • memory/2776-1074-0x0000000005F50000-0x0000000005FE2000-memory.dmp
        Filesize

        584KB

      • memory/2776-1075-0x0000000004D60000-0x0000000004D70000-memory.dmp
        Filesize

        64KB

      • memory/2776-1076-0x0000000004D60000-0x0000000004D70000-memory.dmp
        Filesize

        64KB

      • memory/2776-1077-0x0000000004D60000-0x0000000004D70000-memory.dmp
        Filesize

        64KB

      • memory/2776-1078-0x0000000005FF0000-0x0000000006056000-memory.dmp
        Filesize

        408KB

      • memory/2776-1079-0x0000000006720000-0x0000000006796000-memory.dmp
        Filesize

        472KB

      • memory/2776-1080-0x00000000067A0000-0x00000000067F0000-memory.dmp
        Filesize

        320KB

      • memory/2776-1081-0x0000000006900000-0x0000000006AC2000-memory.dmp
        Filesize

        1.8MB

      • memory/2776-157-0x0000000004D70000-0x0000000005314000-memory.dmp
        Filesize

        5.6MB

      • memory/2776-156-0x00000000009A0000-0x00000000009EB000-memory.dmp
        Filesize

        300KB

      • memory/2776-1082-0x0000000006AD0000-0x0000000006FFC000-memory.dmp
        Filesize

        5.2MB

      • memory/2776-1083-0x0000000004D60000-0x0000000004D70000-memory.dmp
        Filesize

        64KB