Analysis

  • max time kernel
    143s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-03-2023 07:22

General

  • Target

    b119fe84b68642d55c695a7ea897193de15882d99927309b5d8a4d89c8de8a4f.exe

  • Size

    539KB

  • MD5

    863cab4c5dd6e8ff99e719ef1a59ae19

  • SHA1

    4f0afa43e82c95b9de7bf490e6199e626f8ed36e

  • SHA256

    b119fe84b68642d55c695a7ea897193de15882d99927309b5d8a4d89c8de8a4f

  • SHA512

    8c253bea7cacedc65bc97d60532881ef37f0a4307455e37bc7b772bc1968acaadd329d0dbe298c53e0b969747c5cbde97c4e04d18d435e9ce83b096b39cc3263

  • SSDEEP

    12288:cMrky906nndlx6rJSIhDPTYN+MjpWxLN9iGb90gfVK:4y1vErJ1hDGpWxLHiM97c

Malware Config

Extracted

Family

redline

Botnet

down

C2

193.233.20.31:4125

Attributes
  • auth_value

    12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

hero

C2

193.233.20.31:4125

Attributes
  • auth_value

    11f3c75a88ca461bcc8d6bf60a1193e3

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 33 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b119fe84b68642d55c695a7ea897193de15882d99927309b5d8a4d89c8de8a4f.exe
    "C:\Users\Admin\AppData\Local\Temp\b119fe84b68642d55c695a7ea897193de15882d99927309b5d8a4d89c8de8a4f.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:684
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio9882.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio9882.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4936
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3395.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3395.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3988
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1586.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1586.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:212
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 212 -s 1352
          4⤵
          • Program crash
          PID:4416
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si357358.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si357358.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2568
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 212 -ip 212
    1⤵
      PID:2104

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si357358.exe

      Filesize

      175KB

      MD5

      7c11dfe7837f2079d50113de0e973682

      SHA1

      fae072addd4d56ab67d08ab82da4aac5d7223960

      SHA256

      442d9cc0073a6d45abbed64eb9891912091d444fe4dd368924d1b8cf7c59e65b

      SHA512

      06085d23ead5955185736af64754c343a796af98b68c8013ba20b19a5c52eb92066698b86633d54438fe6ad5455c3c3c4625cf03d15439ab486e22388bd8cab7

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si357358.exe

      Filesize

      175KB

      MD5

      7c11dfe7837f2079d50113de0e973682

      SHA1

      fae072addd4d56ab67d08ab82da4aac5d7223960

      SHA256

      442d9cc0073a6d45abbed64eb9891912091d444fe4dd368924d1b8cf7c59e65b

      SHA512

      06085d23ead5955185736af64754c343a796af98b68c8013ba20b19a5c52eb92066698b86633d54438fe6ad5455c3c3c4625cf03d15439ab486e22388bd8cab7

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio9882.exe

      Filesize

      397KB

      MD5

      3abd4dc1d906a5ab3a993e762f2e2506

      SHA1

      2564c7621ca17bfbd99f6c7632855416a4f918a7

      SHA256

      05e1dfaaf81a9472aae17c320e3bdace68141138eaa56743322b63c19443a0de

      SHA512

      616e51a4c5f46535ff8ea9ebe72de8b08864ce85f7832f5e904662c70f0e72ed6a69d0f48615f89a1339cdba7c72d5e6915e00afeee59d7295d3f0e1f9976802

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio9882.exe

      Filesize

      397KB

      MD5

      3abd4dc1d906a5ab3a993e762f2e2506

      SHA1

      2564c7621ca17bfbd99f6c7632855416a4f918a7

      SHA256

      05e1dfaaf81a9472aae17c320e3bdace68141138eaa56743322b63c19443a0de

      SHA512

      616e51a4c5f46535ff8ea9ebe72de8b08864ce85f7832f5e904662c70f0e72ed6a69d0f48615f89a1339cdba7c72d5e6915e00afeee59d7295d3f0e1f9976802

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3395.exe

      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3395.exe

      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1586.exe

      Filesize

      355KB

      MD5

      2017112a2158c2ee0149b0f89235caa3

      SHA1

      e976b96db85016ca9ec897d978d2da6d6aa2245d

      SHA256

      bfc14e5a62e8ebc940ded59ec3df1a90102e9b1e8d280624309b8f10bde963fb

      SHA512

      23e9d598f1309b438e2952bba82ef975699c3694f437982f36d2fe5d94e8daad7ba2c41e0e0d2a7f6029af3b3efaa45845f2c0b6baf22b6fbeb0a4a49b6bbe08

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1586.exe

      Filesize

      355KB

      MD5

      2017112a2158c2ee0149b0f89235caa3

      SHA1

      e976b96db85016ca9ec897d978d2da6d6aa2245d

      SHA256

      bfc14e5a62e8ebc940ded59ec3df1a90102e9b1e8d280624309b8f10bde963fb

      SHA512

      23e9d598f1309b438e2952bba82ef975699c3694f437982f36d2fe5d94e8daad7ba2c41e0e0d2a7f6029af3b3efaa45845f2c0b6baf22b6fbeb0a4a49b6bbe08

    • memory/212-153-0x0000000007300000-0x00000000078A4000-memory.dmp

      Filesize

      5.6MB

    • memory/212-154-0x0000000002B90000-0x0000000002BDB000-memory.dmp

      Filesize

      300KB

    • memory/212-156-0x0000000004A10000-0x0000000004A20000-memory.dmp

      Filesize

      64KB

    • memory/212-155-0x0000000004A10000-0x0000000004A20000-memory.dmp

      Filesize

      64KB

    • memory/212-157-0x0000000004A10000-0x0000000004A20000-memory.dmp

      Filesize

      64KB

    • memory/212-158-0x00000000078B0000-0x00000000078EE000-memory.dmp

      Filesize

      248KB

    • memory/212-161-0x00000000078B0000-0x00000000078EE000-memory.dmp

      Filesize

      248KB

    • memory/212-159-0x00000000078B0000-0x00000000078EE000-memory.dmp

      Filesize

      248KB

    • memory/212-163-0x00000000078B0000-0x00000000078EE000-memory.dmp

      Filesize

      248KB

    • memory/212-165-0x00000000078B0000-0x00000000078EE000-memory.dmp

      Filesize

      248KB

    • memory/212-167-0x00000000078B0000-0x00000000078EE000-memory.dmp

      Filesize

      248KB

    • memory/212-169-0x00000000078B0000-0x00000000078EE000-memory.dmp

      Filesize

      248KB

    • memory/212-171-0x00000000078B0000-0x00000000078EE000-memory.dmp

      Filesize

      248KB

    • memory/212-173-0x00000000078B0000-0x00000000078EE000-memory.dmp

      Filesize

      248KB

    • memory/212-175-0x00000000078B0000-0x00000000078EE000-memory.dmp

      Filesize

      248KB

    • memory/212-177-0x00000000078B0000-0x00000000078EE000-memory.dmp

      Filesize

      248KB

    • memory/212-179-0x00000000078B0000-0x00000000078EE000-memory.dmp

      Filesize

      248KB

    • memory/212-181-0x00000000078B0000-0x00000000078EE000-memory.dmp

      Filesize

      248KB

    • memory/212-183-0x00000000078B0000-0x00000000078EE000-memory.dmp

      Filesize

      248KB

    • memory/212-185-0x00000000078B0000-0x00000000078EE000-memory.dmp

      Filesize

      248KB

    • memory/212-187-0x00000000078B0000-0x00000000078EE000-memory.dmp

      Filesize

      248KB

    • memory/212-189-0x00000000078B0000-0x00000000078EE000-memory.dmp

      Filesize

      248KB

    • memory/212-191-0x00000000078B0000-0x00000000078EE000-memory.dmp

      Filesize

      248KB

    • memory/212-193-0x00000000078B0000-0x00000000078EE000-memory.dmp

      Filesize

      248KB

    • memory/212-195-0x00000000078B0000-0x00000000078EE000-memory.dmp

      Filesize

      248KB

    • memory/212-197-0x00000000078B0000-0x00000000078EE000-memory.dmp

      Filesize

      248KB

    • memory/212-203-0x00000000078B0000-0x00000000078EE000-memory.dmp

      Filesize

      248KB

    • memory/212-201-0x00000000078B0000-0x00000000078EE000-memory.dmp

      Filesize

      248KB

    • memory/212-205-0x00000000078B0000-0x00000000078EE000-memory.dmp

      Filesize

      248KB

    • memory/212-199-0x00000000078B0000-0x00000000078EE000-memory.dmp

      Filesize

      248KB

    • memory/212-207-0x00000000078B0000-0x00000000078EE000-memory.dmp

      Filesize

      248KB

    • memory/212-209-0x00000000078B0000-0x00000000078EE000-memory.dmp

      Filesize

      248KB

    • memory/212-211-0x00000000078B0000-0x00000000078EE000-memory.dmp

      Filesize

      248KB

    • memory/212-213-0x00000000078B0000-0x00000000078EE000-memory.dmp

      Filesize

      248KB

    • memory/212-215-0x00000000078B0000-0x00000000078EE000-memory.dmp

      Filesize

      248KB

    • memory/212-217-0x00000000078B0000-0x00000000078EE000-memory.dmp

      Filesize

      248KB

    • memory/212-219-0x00000000078B0000-0x00000000078EE000-memory.dmp

      Filesize

      248KB

    • memory/212-221-0x00000000078B0000-0x00000000078EE000-memory.dmp

      Filesize

      248KB

    • memory/212-1064-0x00000000078F0000-0x0000000007F08000-memory.dmp

      Filesize

      6.1MB

    • memory/212-1065-0x0000000007F70000-0x000000000807A000-memory.dmp

      Filesize

      1.0MB

    • memory/212-1066-0x00000000080B0000-0x00000000080C2000-memory.dmp

      Filesize

      72KB

    • memory/212-1067-0x00000000080D0000-0x000000000810C000-memory.dmp

      Filesize

      240KB

    • memory/212-1068-0x0000000004A10000-0x0000000004A20000-memory.dmp

      Filesize

      64KB

    • memory/212-1070-0x00000000083C0000-0x0000000008426000-memory.dmp

      Filesize

      408KB

    • memory/212-1071-0x0000000008A80000-0x0000000008B12000-memory.dmp

      Filesize

      584KB

    • memory/212-1072-0x0000000004A10000-0x0000000004A20000-memory.dmp

      Filesize

      64KB

    • memory/212-1073-0x0000000004A10000-0x0000000004A20000-memory.dmp

      Filesize

      64KB

    • memory/212-1074-0x000000000B1E0000-0x000000000B3A2000-memory.dmp

      Filesize

      1.8MB

    • memory/212-1075-0x000000000B3C0000-0x000000000B8EC000-memory.dmp

      Filesize

      5.2MB

    • memory/212-1076-0x0000000004A10000-0x0000000004A20000-memory.dmp

      Filesize

      64KB

    • memory/212-1077-0x00000000048C0000-0x0000000004936000-memory.dmp

      Filesize

      472KB

    • memory/212-1078-0x0000000009E30000-0x0000000009E80000-memory.dmp

      Filesize

      320KB

    • memory/2568-1084-0x00000000006B0000-0x00000000006E2000-memory.dmp

      Filesize

      200KB

    • memory/2568-1085-0x0000000004F70000-0x0000000004F80000-memory.dmp

      Filesize

      64KB

    • memory/3988-147-0x00000000009B0000-0x00000000009BA000-memory.dmp

      Filesize

      40KB