Analysis

  • max time kernel
    57s
  • max time network
    152s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    24-03-2023 08:01

General

  • Target

    6a4be25653fe60b2717d2949569a22e8c34f32fb504844421822add18010879a.exe

  • Size

    687KB

  • MD5

    4e08caab5e33ec01f0f4d34f5ab49de6

  • SHA1

    00dbb00fda77e1f64389ed7bbffb23cb13f0d21b

  • SHA256

    6a4be25653fe60b2717d2949569a22e8c34f32fb504844421822add18010879a

  • SHA512

    6f699f2fcc290c41a085db26b7c83d558b5f9a28976a0a3dc65f800241c2c6eb7b657ef240d6387438580004068f80f841156dc060fe16976388b7251af7cf55

  • SSDEEP

    12288:C3KZUuB2nyy4KS3el7XLT5a2uZdAeZ0lgt1Pf53IejQGR7:CrE2nyy4DQLLEJZdP06RYejZV

Malware Config

Extracted

Family

redline

Botnet

down

C2

193.233.20.31:4125

Attributes
  • auth_value

    12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

hero

C2

193.233.20.31:4125

Attributes
  • auth_value

    11f3c75a88ca461bcc8d6bf60a1193e3

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 34 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6a4be25653fe60b2717d2949569a22e8c34f32fb504844421822add18010879a.exe
    "C:\Users\Admin\AppData\Local\Temp\6a4be25653fe60b2717d2949569a22e8c34f32fb504844421822add18010879a.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3232
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zilH1185.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zilH1185.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4048
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr194876.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr194876.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1684
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku843123.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku843123.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4480
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr790315.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr790315.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2044

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr790315.exe

    Filesize

    175KB

    MD5

    7c11dfe7837f2079d50113de0e973682

    SHA1

    fae072addd4d56ab67d08ab82da4aac5d7223960

    SHA256

    442d9cc0073a6d45abbed64eb9891912091d444fe4dd368924d1b8cf7c59e65b

    SHA512

    06085d23ead5955185736af64754c343a796af98b68c8013ba20b19a5c52eb92066698b86633d54438fe6ad5455c3c3c4625cf03d15439ab486e22388bd8cab7

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr790315.exe

    Filesize

    175KB

    MD5

    7c11dfe7837f2079d50113de0e973682

    SHA1

    fae072addd4d56ab67d08ab82da4aac5d7223960

    SHA256

    442d9cc0073a6d45abbed64eb9891912091d444fe4dd368924d1b8cf7c59e65b

    SHA512

    06085d23ead5955185736af64754c343a796af98b68c8013ba20b19a5c52eb92066698b86633d54438fe6ad5455c3c3c4625cf03d15439ab486e22388bd8cab7

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zilH1185.exe

    Filesize

    404KB

    MD5

    fc26679ca223c30d775882fc2fd4ced4

    SHA1

    e26c8a65b3a6c0b52a88876f6cae0bf3bf806f6b

    SHA256

    6c34804ae1fb2383ce034c8a68be5bb16984c3aa5638f25ba50ab9111eea1b32

    SHA512

    dd8f3e2840220662794bdd3342c2e6d1cb63b08bfc36fd4066ff0a6e13a0ee8dd633271891ec36805d4d4f9f4fc31a3829fe5e8eddb5d7ebdabd557179202c90

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zilH1185.exe

    Filesize

    404KB

    MD5

    fc26679ca223c30d775882fc2fd4ced4

    SHA1

    e26c8a65b3a6c0b52a88876f6cae0bf3bf806f6b

    SHA256

    6c34804ae1fb2383ce034c8a68be5bb16984c3aa5638f25ba50ab9111eea1b32

    SHA512

    dd8f3e2840220662794bdd3342c2e6d1cb63b08bfc36fd4066ff0a6e13a0ee8dd633271891ec36805d4d4f9f4fc31a3829fe5e8eddb5d7ebdabd557179202c90

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr194876.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr194876.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku843123.exe

    Filesize

    358KB

    MD5

    ccef72544333fb6d240d7834c6529657

    SHA1

    4598184479cc118f51717408313b47d146c66443

    SHA256

    5e0cdfa2cd6aeb1b3d3e6f41296227ea63449dea84439f42db0ff32383c05782

    SHA512

    d889137ab8d1f242dbac3815c33b7509681327aa93b381cbdd894d722ae1b625c7c4e6adb0c13c4f099d85ca95f5c5f82c06a3b72f954f969fb2c88370307564

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku843123.exe

    Filesize

    358KB

    MD5

    ccef72544333fb6d240d7834c6529657

    SHA1

    4598184479cc118f51717408313b47d146c66443

    SHA256

    5e0cdfa2cd6aeb1b3d3e6f41296227ea63449dea84439f42db0ff32383c05782

    SHA512

    d889137ab8d1f242dbac3815c33b7509681327aa93b381cbdd894d722ae1b625c7c4e6adb0c13c4f099d85ca95f5c5f82c06a3b72f954f969fb2c88370307564

  • memory/1684-134-0x0000000000F30000-0x0000000000F3A000-memory.dmp

    Filesize

    40KB

  • memory/2044-1077-0x0000000000150000-0x0000000000182000-memory.dmp

    Filesize

    200KB

  • memory/2044-1079-0x0000000004D00000-0x0000000004D10000-memory.dmp

    Filesize

    64KB

  • memory/2044-1078-0x0000000004B80000-0x0000000004BCB000-memory.dmp

    Filesize

    300KB

  • memory/3232-135-0x0000000006A60000-0x0000000006AEA000-memory.dmp

    Filesize

    552KB

  • memory/3232-136-0x0000000000400000-0x0000000002BDA000-memory.dmp

    Filesize

    39.9MB

  • memory/4480-182-0x0000000004F20000-0x0000000004F30000-memory.dmp

    Filesize

    64KB

  • memory/4480-192-0x00000000029D0000-0x0000000002A0E000-memory.dmp

    Filesize

    248KB

  • memory/4480-146-0x00000000029D0000-0x0000000002A14000-memory.dmp

    Filesize

    272KB

  • memory/4480-147-0x00000000029D0000-0x0000000002A0E000-memory.dmp

    Filesize

    248KB

  • memory/4480-148-0x00000000029D0000-0x0000000002A0E000-memory.dmp

    Filesize

    248KB

  • memory/4480-150-0x00000000029D0000-0x0000000002A0E000-memory.dmp

    Filesize

    248KB

  • memory/4480-152-0x00000000029D0000-0x0000000002A0E000-memory.dmp

    Filesize

    248KB

  • memory/4480-154-0x00000000029D0000-0x0000000002A0E000-memory.dmp

    Filesize

    248KB

  • memory/4480-156-0x00000000029D0000-0x0000000002A0E000-memory.dmp

    Filesize

    248KB

  • memory/4480-158-0x00000000029D0000-0x0000000002A0E000-memory.dmp

    Filesize

    248KB

  • memory/4480-160-0x00000000029D0000-0x0000000002A0E000-memory.dmp

    Filesize

    248KB

  • memory/4480-162-0x00000000029D0000-0x0000000002A0E000-memory.dmp

    Filesize

    248KB

  • memory/4480-164-0x00000000029D0000-0x0000000002A0E000-memory.dmp

    Filesize

    248KB

  • memory/4480-166-0x00000000029D0000-0x0000000002A0E000-memory.dmp

    Filesize

    248KB

  • memory/4480-168-0x00000000029D0000-0x0000000002A0E000-memory.dmp

    Filesize

    248KB

  • memory/4480-170-0x00000000029D0000-0x0000000002A0E000-memory.dmp

    Filesize

    248KB

  • memory/4480-172-0x00000000029D0000-0x0000000002A0E000-memory.dmp

    Filesize

    248KB

  • memory/4480-174-0x00000000029D0000-0x0000000002A0E000-memory.dmp

    Filesize

    248KB

  • memory/4480-176-0x00000000029D0000-0x0000000002A0E000-memory.dmp

    Filesize

    248KB

  • memory/4480-178-0x00000000029D0000-0x0000000002A0E000-memory.dmp

    Filesize

    248KB

  • memory/4480-144-0x0000000004F20000-0x0000000004F30000-memory.dmp

    Filesize

    64KB

  • memory/4480-181-0x00000000029D0000-0x0000000002A0E000-memory.dmp

    Filesize

    248KB

  • memory/4480-180-0x0000000004F20000-0x0000000004F30000-memory.dmp

    Filesize

    64KB

  • memory/4480-184-0x00000000029D0000-0x0000000002A0E000-memory.dmp

    Filesize

    248KB

  • memory/4480-186-0x00000000029D0000-0x0000000002A0E000-memory.dmp

    Filesize

    248KB

  • memory/4480-188-0x00000000029D0000-0x0000000002A0E000-memory.dmp

    Filesize

    248KB

  • memory/4480-190-0x00000000029D0000-0x0000000002A0E000-memory.dmp

    Filesize

    248KB

  • memory/4480-145-0x0000000004F30000-0x000000000542E000-memory.dmp

    Filesize

    5.0MB

  • memory/4480-194-0x00000000029D0000-0x0000000002A0E000-memory.dmp

    Filesize

    248KB

  • memory/4480-196-0x00000000029D0000-0x0000000002A0E000-memory.dmp

    Filesize

    248KB

  • memory/4480-198-0x00000000029D0000-0x0000000002A0E000-memory.dmp

    Filesize

    248KB

  • memory/4480-200-0x00000000029D0000-0x0000000002A0E000-memory.dmp

    Filesize

    248KB

  • memory/4480-202-0x00000000029D0000-0x0000000002A0E000-memory.dmp

    Filesize

    248KB

  • memory/4480-204-0x00000000029D0000-0x0000000002A0E000-memory.dmp

    Filesize

    248KB

  • memory/4480-206-0x00000000029D0000-0x0000000002A0E000-memory.dmp

    Filesize

    248KB

  • memory/4480-208-0x00000000029D0000-0x0000000002A0E000-memory.dmp

    Filesize

    248KB

  • memory/4480-210-0x00000000029D0000-0x0000000002A0E000-memory.dmp

    Filesize

    248KB

  • memory/4480-1055-0x0000000005A40000-0x0000000006046000-memory.dmp

    Filesize

    6.0MB

  • memory/4480-1056-0x0000000005430000-0x000000000553A000-memory.dmp

    Filesize

    1.0MB

  • memory/4480-1057-0x0000000005540000-0x0000000005552000-memory.dmp

    Filesize

    72KB

  • memory/4480-1058-0x0000000005560000-0x000000000559E000-memory.dmp

    Filesize

    248KB

  • memory/4480-1059-0x00000000056A0000-0x00000000056EB000-memory.dmp

    Filesize

    300KB

  • memory/4480-1060-0x0000000004F20000-0x0000000004F30000-memory.dmp

    Filesize

    64KB

  • memory/4480-1063-0x0000000005830000-0x0000000005896000-memory.dmp

    Filesize

    408KB

  • memory/4480-1064-0x0000000006530000-0x00000000065C2000-memory.dmp

    Filesize

    584KB

  • memory/4480-1065-0x0000000004F20000-0x0000000004F30000-memory.dmp

    Filesize

    64KB

  • memory/4480-1066-0x0000000004F20000-0x0000000004F30000-memory.dmp

    Filesize

    64KB

  • memory/4480-1067-0x0000000004F20000-0x0000000004F30000-memory.dmp

    Filesize

    64KB

  • memory/4480-1068-0x0000000006830000-0x00000000068A6000-memory.dmp

    Filesize

    472KB

  • memory/4480-143-0x00000000007F0000-0x000000000083B000-memory.dmp

    Filesize

    300KB

  • memory/4480-142-0x0000000002350000-0x0000000002396000-memory.dmp

    Filesize

    280KB

  • memory/4480-1069-0x00000000068B0000-0x0000000006900000-memory.dmp

    Filesize

    320KB

  • memory/4480-1070-0x0000000006920000-0x0000000006AE2000-memory.dmp

    Filesize

    1.8MB

  • memory/4480-1071-0x0000000006AF0000-0x000000000701C000-memory.dmp

    Filesize

    5.2MB