Analysis

  • max time kernel
    147s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-03-2023 01:04

General

  • Target

    9a1ba981b77e7173be7e6617565293945d215ca65bc397c29e8ed163587b998a.exe

  • Size

    546KB

  • MD5

    a80ed652772d1d332f7f5bc717b09f7c

  • SHA1

    427feb145d6caa97ef270d1599b649d96453d30e

  • SHA256

    9a1ba981b77e7173be7e6617565293945d215ca65bc397c29e8ed163587b998a

  • SHA512

    64a08fb81abbc21df2d9f24df5c12ea807a0fb0de6a1f5eb9d6e5295d37426a4c653e5ce26bc74d0cb76e145c641977e7a8174b778e85841cf3a88fb1a6ece5f

  • SSDEEP

    12288:eMriy90waarI7Fer+/K7/lXfCH3wt2wLg1M2GY:gycUr7/lXf+gpCM2GY

Malware Config

Extracted

Family

redline

Botnet

down

C2

193.233.20.31:4125

Attributes
  • auth_value

    12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

real

C2

193.233.20.31:4125

Attributes
  • auth_value

    bb22a50228754849387d5f4d1611e71b

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 32 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9a1ba981b77e7173be7e6617565293945d215ca65bc397c29e8ed163587b998a.exe
    "C:\Users\Admin\AppData\Local\Temp\9a1ba981b77e7173be7e6617565293945d215ca65bc397c29e8ed163587b998a.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1380
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio5189.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio5189.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3476
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4441.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4441.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1908
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9025.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9025.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5024
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 1328
          4⤵
          • Program crash
          PID:640
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si244577.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si244577.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2008
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5024 -ip 5024
    1⤵
      PID:4848
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start wuauserv
      1⤵
      • Launches sc.exe
      PID:1680

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Modify Existing Service

    1
    T1031

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    3
    T1112

    Disabling Security Tools

    2
    T1089

    Credential Access

    Credentials in Files

    2
    T1081

    Discovery

    Query Registry

    1
    T1012

    Collection

    Data from Local System

    2
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si244577.exe
      Filesize

      175KB

      MD5

      41707338e1e2d868aa699ac0dd2e77b0

      SHA1

      36e0dfba09f9fb409faf0f9a99217d0d0c524b82

      SHA256

      8d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557

      SHA512

      80c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si244577.exe
      Filesize

      175KB

      MD5

      41707338e1e2d868aa699ac0dd2e77b0

      SHA1

      36e0dfba09f9fb409faf0f9a99217d0d0c524b82

      SHA256

      8d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557

      SHA512

      80c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio5189.exe
      Filesize

      404KB

      MD5

      278dc5520b93028c45b5dd6a7f73f53f

      SHA1

      c2eceafa89d5ff929754f5c19a7e9412b1119e2b

      SHA256

      1be4a75d6b2a3ec7923ba7b0e25862b5abc6c3c09dddef30e62d7cc0ec1d056b

      SHA512

      4eee5d66d590131832ef47d06e6f4c46c406c68c0e83f3d58da255415991ee488a971b634d2c1de7daf9c437f90ca8d11d7210f0e70644c8b0366cf75c150253

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio5189.exe
      Filesize

      404KB

      MD5

      278dc5520b93028c45b5dd6a7f73f53f

      SHA1

      c2eceafa89d5ff929754f5c19a7e9412b1119e2b

      SHA256

      1be4a75d6b2a3ec7923ba7b0e25862b5abc6c3c09dddef30e62d7cc0ec1d056b

      SHA512

      4eee5d66d590131832ef47d06e6f4c46c406c68c0e83f3d58da255415991ee488a971b634d2c1de7daf9c437f90ca8d11d7210f0e70644c8b0366cf75c150253

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4441.exe
      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4441.exe
      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9025.exe
      Filesize

      358KB

      MD5

      d8a5f4be8de14642657fb9e50384a21c

      SHA1

      ea1ba22b0903ffad1b46da5ebfaf7c13af759759

      SHA256

      505b9c17a3380432e4a185de435d00905b3d4b8773d60117e0ca7c8a182451f6

      SHA512

      e28e53006aacf5e7261625abfb1d512077057489247460ed9adefa7f4923dd1e9da31d11b7b2c551d4039ebb1dadd1acda360778aa6d31449729a374ec76a338

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9025.exe
      Filesize

      358KB

      MD5

      d8a5f4be8de14642657fb9e50384a21c

      SHA1

      ea1ba22b0903ffad1b46da5ebfaf7c13af759759

      SHA256

      505b9c17a3380432e4a185de435d00905b3d4b8773d60117e0ca7c8a182451f6

      SHA512

      e28e53006aacf5e7261625abfb1d512077057489247460ed9adefa7f4923dd1e9da31d11b7b2c551d4039ebb1dadd1acda360778aa6d31449729a374ec76a338

    • memory/1908-147-0x00000000004F0000-0x00000000004FA000-memory.dmp
      Filesize

      40KB

    • memory/1908-148-0x000000001B000000-0x000000001B14E000-memory.dmp
      Filesize

      1.3MB

    • memory/1908-150-0x000000001B000000-0x000000001B14E000-memory.dmp
      Filesize

      1.3MB

    • memory/2008-1086-0x0000000000260000-0x0000000000292000-memory.dmp
      Filesize

      200KB

    • memory/2008-1087-0x0000000004E60000-0x0000000004E70000-memory.dmp
      Filesize

      64KB

    • memory/5024-190-0x0000000004CD0000-0x0000000004D0E000-memory.dmp
      Filesize

      248KB

    • memory/5024-202-0x0000000004CD0000-0x0000000004D0E000-memory.dmp
      Filesize

      248KB

    • memory/5024-157-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
      Filesize

      64KB

    • memory/5024-159-0x0000000004CD0000-0x0000000004D0E000-memory.dmp
      Filesize

      248KB

    • memory/5024-160-0x0000000004CD0000-0x0000000004D0E000-memory.dmp
      Filesize

      248KB

    • memory/5024-162-0x0000000004CD0000-0x0000000004D0E000-memory.dmp
      Filesize

      248KB

    • memory/5024-164-0x0000000004CD0000-0x0000000004D0E000-memory.dmp
      Filesize

      248KB

    • memory/5024-166-0x0000000004CD0000-0x0000000004D0E000-memory.dmp
      Filesize

      248KB

    • memory/5024-168-0x0000000004CD0000-0x0000000004D0E000-memory.dmp
      Filesize

      248KB

    • memory/5024-170-0x0000000004CD0000-0x0000000004D0E000-memory.dmp
      Filesize

      248KB

    • memory/5024-172-0x0000000004CD0000-0x0000000004D0E000-memory.dmp
      Filesize

      248KB

    • memory/5024-174-0x0000000004CD0000-0x0000000004D0E000-memory.dmp
      Filesize

      248KB

    • memory/5024-176-0x0000000004CD0000-0x0000000004D0E000-memory.dmp
      Filesize

      248KB

    • memory/5024-178-0x0000000004CD0000-0x0000000004D0E000-memory.dmp
      Filesize

      248KB

    • memory/5024-180-0x0000000004CD0000-0x0000000004D0E000-memory.dmp
      Filesize

      248KB

    • memory/5024-184-0x0000000004CD0000-0x0000000004D0E000-memory.dmp
      Filesize

      248KB

    • memory/5024-186-0x0000000004CD0000-0x0000000004D0E000-memory.dmp
      Filesize

      248KB

    • memory/5024-182-0x0000000004CD0000-0x0000000004D0E000-memory.dmp
      Filesize

      248KB

    • memory/5024-188-0x0000000004CD0000-0x0000000004D0E000-memory.dmp
      Filesize

      248KB

    • memory/5024-156-0x0000000000880000-0x00000000008CB000-memory.dmp
      Filesize

      300KB

    • memory/5024-192-0x0000000004CD0000-0x0000000004D0E000-memory.dmp
      Filesize

      248KB

    • memory/5024-194-0x0000000004CD0000-0x0000000004D0E000-memory.dmp
      Filesize

      248KB

    • memory/5024-196-0x0000000004CD0000-0x0000000004D0E000-memory.dmp
      Filesize

      248KB

    • memory/5024-198-0x0000000004CD0000-0x0000000004D0E000-memory.dmp
      Filesize

      248KB

    • memory/5024-200-0x0000000004CD0000-0x0000000004D0E000-memory.dmp
      Filesize

      248KB

    • memory/5024-158-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
      Filesize

      64KB

    • memory/5024-204-0x0000000004CD0000-0x0000000004D0E000-memory.dmp
      Filesize

      248KB

    • memory/5024-206-0x0000000004CD0000-0x0000000004D0E000-memory.dmp
      Filesize

      248KB

    • memory/5024-208-0x0000000004CD0000-0x0000000004D0E000-memory.dmp
      Filesize

      248KB

    • memory/5024-210-0x0000000004CD0000-0x0000000004D0E000-memory.dmp
      Filesize

      248KB

    • memory/5024-212-0x0000000004CD0000-0x0000000004D0E000-memory.dmp
      Filesize

      248KB

    • memory/5024-214-0x0000000004CD0000-0x0000000004D0E000-memory.dmp
      Filesize

      248KB

    • memory/5024-216-0x0000000004CD0000-0x0000000004D0E000-memory.dmp
      Filesize

      248KB

    • memory/5024-218-0x0000000004CD0000-0x0000000004D0E000-memory.dmp
      Filesize

      248KB

    • memory/5024-220-0x0000000004CD0000-0x0000000004D0E000-memory.dmp
      Filesize

      248KB

    • memory/5024-1065-0x0000000005470000-0x0000000005A88000-memory.dmp
      Filesize

      6.1MB

    • memory/5024-1066-0x0000000005A90000-0x0000000005B9A000-memory.dmp
      Filesize

      1.0MB

    • memory/5024-1067-0x0000000004E10000-0x0000000004E22000-memory.dmp
      Filesize

      72KB

    • memory/5024-1068-0x0000000004E30000-0x0000000004E6C000-memory.dmp
      Filesize

      240KB

    • memory/5024-1069-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
      Filesize

      64KB

    • memory/5024-1071-0x0000000005E10000-0x0000000005E76000-memory.dmp
      Filesize

      408KB

    • memory/5024-1072-0x00000000064D0000-0x0000000006562000-memory.dmp
      Filesize

      584KB

    • memory/5024-1073-0x00000000065B0000-0x0000000006626000-memory.dmp
      Filesize

      472KB

    • memory/5024-1074-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
      Filesize

      64KB

    • memory/5024-1077-0x0000000006640000-0x0000000006690000-memory.dmp
      Filesize

      320KB

    • memory/5024-1076-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
      Filesize

      64KB

    • memory/5024-1075-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
      Filesize

      64KB

    • memory/5024-155-0x0000000004EC0000-0x0000000005464000-memory.dmp
      Filesize

      5.6MB

    • memory/5024-1078-0x0000000006C50000-0x0000000006E12000-memory.dmp
      Filesize

      1.8MB

    • memory/5024-1079-0x0000000006E20000-0x000000000734C000-memory.dmp
      Filesize

      5.2MB

    • memory/5024-1080-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
      Filesize

      64KB