Analysis

  • max time kernel
    129s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-03-2023 08:16

General

  • Target

    a34b5253ad8a6ad67bac7ce6b5e30dfb014f51936ee8997793afc7e547cfc4c9.exe

  • Size

    538KB

  • MD5

    c87cc918579dc9eba8f2b35b969ee3e8

  • SHA1

    2d3628d3d2e65511f05c9be9bbed319905ae0bfa

  • SHA256

    a34b5253ad8a6ad67bac7ce6b5e30dfb014f51936ee8997793afc7e547cfc4c9

  • SHA512

    320b510b119fcd15f1bbcc92a0b4bfb152c61302121a2d18e2a888d42179c3e05405eb934ac9b6520740250d84fe2171cb50fc88970f66d2d4250435d1792737

  • SSDEEP

    12288:jMray90xB65QX1OfdRNKfj0vBwe7Y8xOI4+YVSrdj4uIRRk0Tk:5ysoQX8Bz7YcnAm4Rk0o

Malware Config

Extracted

Family

redline

Botnet

down

C2

193.233.20.31:4125

Attributes
  • auth_value

    12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

hero

C2

193.233.20.31:4125

Attributes
  • auth_value

    11f3c75a88ca461bcc8d6bf60a1193e3

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 33 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a34b5253ad8a6ad67bac7ce6b5e30dfb014f51936ee8997793afc7e547cfc4c9.exe
    "C:\Users\Admin\AppData\Local\Temp\a34b5253ad8a6ad67bac7ce6b5e30dfb014f51936ee8997793afc7e547cfc4c9.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1772
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio8624.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio8624.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1312
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3173.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3173.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4492
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1574.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1574.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:264
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 264 -s 1932
          4⤵
          • Program crash
          PID:4748
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si930744.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si930744.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1264
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 264 -ip 264
    1⤵
      PID:4356

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si930744.exe

      Filesize

      175KB

      MD5

      7c11dfe7837f2079d50113de0e973682

      SHA1

      fae072addd4d56ab67d08ab82da4aac5d7223960

      SHA256

      442d9cc0073a6d45abbed64eb9891912091d444fe4dd368924d1b8cf7c59e65b

      SHA512

      06085d23ead5955185736af64754c343a796af98b68c8013ba20b19a5c52eb92066698b86633d54438fe6ad5455c3c3c4625cf03d15439ab486e22388bd8cab7

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si930744.exe

      Filesize

      175KB

      MD5

      7c11dfe7837f2079d50113de0e973682

      SHA1

      fae072addd4d56ab67d08ab82da4aac5d7223960

      SHA256

      442d9cc0073a6d45abbed64eb9891912091d444fe4dd368924d1b8cf7c59e65b

      SHA512

      06085d23ead5955185736af64754c343a796af98b68c8013ba20b19a5c52eb92066698b86633d54438fe6ad5455c3c3c4625cf03d15439ab486e22388bd8cab7

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio8624.exe

      Filesize

      396KB

      MD5

      cb7ca9191cd3311c6e22d76f00ec6e2d

      SHA1

      5a66f7d82fd01e1c127d9e939237622318d74d76

      SHA256

      68404d874a7a02e30c2159fd11ceabae3bf7738dc07ffe2d61f490eb38a3aea0

      SHA512

      64068b7ecf912bd350f3a636cd2dded75f7c042565ab3e340577327c4260fb8a7dcf67250e0af16759754d2c79e169675cd470375716898ddaa493c2aa2cbb87

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio8624.exe

      Filesize

      396KB

      MD5

      cb7ca9191cd3311c6e22d76f00ec6e2d

      SHA1

      5a66f7d82fd01e1c127d9e939237622318d74d76

      SHA256

      68404d874a7a02e30c2159fd11ceabae3bf7738dc07ffe2d61f490eb38a3aea0

      SHA512

      64068b7ecf912bd350f3a636cd2dded75f7c042565ab3e340577327c4260fb8a7dcf67250e0af16759754d2c79e169675cd470375716898ddaa493c2aa2cbb87

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3173.exe

      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3173.exe

      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1574.exe

      Filesize

      355KB

      MD5

      e33c5fee5ca3e65d6ad165b665cca8c3

      SHA1

      8b193e676b144399b354ac79c24a8e4db2d0f7da

      SHA256

      cb75478a33425d4fae19681ef8c285e5b178dcbf079f0f7d3501cef31132b74f

      SHA512

      01d2aebb5bc2fba5746ee6b6438f94f9ed3b18e93a0955eecc330dda073a7150d274a772af588025abfe98b5eb1f5ab63a59615bb171e4851bb43b190b04169b

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1574.exe

      Filesize

      355KB

      MD5

      e33c5fee5ca3e65d6ad165b665cca8c3

      SHA1

      8b193e676b144399b354ac79c24a8e4db2d0f7da

      SHA256

      cb75478a33425d4fae19681ef8c285e5b178dcbf079f0f7d3501cef31132b74f

      SHA512

      01d2aebb5bc2fba5746ee6b6438f94f9ed3b18e93a0955eecc330dda073a7150d274a772af588025abfe98b5eb1f5ab63a59615bb171e4851bb43b190b04169b

    • memory/264-153-0x0000000007350000-0x00000000078F4000-memory.dmp

      Filesize

      5.6MB

    • memory/264-155-0x0000000007340000-0x0000000007350000-memory.dmp

      Filesize

      64KB

    • memory/264-154-0x0000000002D20000-0x0000000002D6B000-memory.dmp

      Filesize

      300KB

    • memory/264-156-0x0000000007340000-0x0000000007350000-memory.dmp

      Filesize

      64KB

    • memory/264-157-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

      Filesize

      248KB

    • memory/264-160-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

      Filesize

      248KB

    • memory/264-162-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

      Filesize

      248KB

    • memory/264-164-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

      Filesize

      248KB

    • memory/264-158-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

      Filesize

      248KB

    • memory/264-166-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

      Filesize

      248KB

    • memory/264-168-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

      Filesize

      248KB

    • memory/264-170-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

      Filesize

      248KB

    • memory/264-172-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

      Filesize

      248KB

    • memory/264-174-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

      Filesize

      248KB

    • memory/264-176-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

      Filesize

      248KB

    • memory/264-178-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

      Filesize

      248KB

    • memory/264-180-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

      Filesize

      248KB

    • memory/264-182-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

      Filesize

      248KB

    • memory/264-184-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

      Filesize

      248KB

    • memory/264-186-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

      Filesize

      248KB

    • memory/264-188-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

      Filesize

      248KB

    • memory/264-190-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

      Filesize

      248KB

    • memory/264-192-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

      Filesize

      248KB

    • memory/264-194-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

      Filesize

      248KB

    • memory/264-196-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

      Filesize

      248KB

    • memory/264-198-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

      Filesize

      248KB

    • memory/264-200-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

      Filesize

      248KB

    • memory/264-202-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

      Filesize

      248KB

    • memory/264-204-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

      Filesize

      248KB

    • memory/264-206-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

      Filesize

      248KB

    • memory/264-208-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

      Filesize

      248KB

    • memory/264-210-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

      Filesize

      248KB

    • memory/264-212-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

      Filesize

      248KB

    • memory/264-214-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

      Filesize

      248KB

    • memory/264-216-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

      Filesize

      248KB

    • memory/264-218-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

      Filesize

      248KB

    • memory/264-220-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

      Filesize

      248KB

    • memory/264-1063-0x0000000007900000-0x0000000007F18000-memory.dmp

      Filesize

      6.1MB

    • memory/264-1064-0x0000000007F70000-0x000000000807A000-memory.dmp

      Filesize

      1.0MB

    • memory/264-1065-0x00000000080B0000-0x00000000080C2000-memory.dmp

      Filesize

      72KB

    • memory/264-1066-0x00000000080D0000-0x000000000810C000-memory.dmp

      Filesize

      240KB

    • memory/264-1067-0x0000000007340000-0x0000000007350000-memory.dmp

      Filesize

      64KB

    • memory/264-1069-0x00000000083C0000-0x0000000008426000-memory.dmp

      Filesize

      408KB

    • memory/264-1070-0x0000000007340000-0x0000000007350000-memory.dmp

      Filesize

      64KB

    • memory/264-1071-0x0000000007340000-0x0000000007350000-memory.dmp

      Filesize

      64KB

    • memory/264-1072-0x0000000008BC0000-0x0000000008C52000-memory.dmp

      Filesize

      584KB

    • memory/264-1073-0x0000000008CC0000-0x0000000008E82000-memory.dmp

      Filesize

      1.8MB

    • memory/264-1074-0x0000000008E90000-0x00000000093BC000-memory.dmp

      Filesize

      5.2MB

    • memory/264-1075-0x0000000009800000-0x0000000009876000-memory.dmp

      Filesize

      472KB

    • memory/264-1076-0x0000000007340000-0x0000000007350000-memory.dmp

      Filesize

      64KB

    • memory/264-1077-0x0000000009890000-0x00000000098E0000-memory.dmp

      Filesize

      320KB

    • memory/1264-1083-0x0000000000270000-0x00000000002A2000-memory.dmp

      Filesize

      200KB

    • memory/1264-1084-0x0000000004E80000-0x0000000004E90000-memory.dmp

      Filesize

      64KB

    • memory/4492-147-0x00000000008E0000-0x00000000008EA000-memory.dmp

      Filesize

      40KB