Analysis

  • max time kernel
    143s
  • max time network
    122s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-03-2023 11:58

General

  • Target

    ca3174f751e19772b0f5bcc37d1d7a5c465cdd125b8919019de91dadfe66ec98.exe

  • Size

    539KB

  • MD5

    26d5734b2496bbab967363a490c09707

  • SHA1

    a846b97892c13febc7c6c0a70a6566bbc2b07e4a

  • SHA256

    ca3174f751e19772b0f5bcc37d1d7a5c465cdd125b8919019de91dadfe66ec98

  • SHA512

    68c3424f20048de055632c6a9a53c2b7f35af1ed4d7a634454e19b1d285e57a4842bbb3935116b3e7d2e498eef88fd29b95c5ffc2feeced3f6ff3d19006e16f7

  • SSDEEP

    12288:2MrIy90TIBgv3I118a09UEcQC+dV2VCesFh/tJW9gK:6yOax118jcmdVhhrW9gK

Malware Config

Extracted

Family

redline

Botnet

down

C2

193.233.20.31:4125

Attributes
  • auth_value

    12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

hero

C2

193.233.20.31:4125

Attributes
  • auth_value

    11f3c75a88ca461bcc8d6bf60a1193e3

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 33 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ca3174f751e19772b0f5bcc37d1d7a5c465cdd125b8919019de91dadfe66ec98.exe
    "C:\Users\Admin\AppData\Local\Temp\ca3174f751e19772b0f5bcc37d1d7a5c465cdd125b8919019de91dadfe66ec98.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3488
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio1025.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio1025.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:400
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2203.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2203.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2644
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6985.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6985.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1700
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 1976
          4⤵
          • Program crash
          PID:864
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si400226.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si400226.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4424
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1700 -ip 1700
    1⤵
      PID:4692

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Modify Existing Service

    1
    T1031

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    3
    T1112

    Disabling Security Tools

    2
    T1089

    Credential Access

    Credentials in Files

    2
    T1081

    Discovery

    Query Registry

    1
    T1012

    Collection

    Data from Local System

    2
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si400226.exe
      Filesize

      175KB

      MD5

      7c11dfe7837f2079d50113de0e973682

      SHA1

      fae072addd4d56ab67d08ab82da4aac5d7223960

      SHA256

      442d9cc0073a6d45abbed64eb9891912091d444fe4dd368924d1b8cf7c59e65b

      SHA512

      06085d23ead5955185736af64754c343a796af98b68c8013ba20b19a5c52eb92066698b86633d54438fe6ad5455c3c3c4625cf03d15439ab486e22388bd8cab7

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si400226.exe
      Filesize

      175KB

      MD5

      7c11dfe7837f2079d50113de0e973682

      SHA1

      fae072addd4d56ab67d08ab82da4aac5d7223960

      SHA256

      442d9cc0073a6d45abbed64eb9891912091d444fe4dd368924d1b8cf7c59e65b

      SHA512

      06085d23ead5955185736af64754c343a796af98b68c8013ba20b19a5c52eb92066698b86633d54438fe6ad5455c3c3c4625cf03d15439ab486e22388bd8cab7

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio1025.exe
      Filesize

      397KB

      MD5

      c7aec12b4afbb0ea0c043d880b0833bc

      SHA1

      2841f6fa8b0c3899d2b74fddb766dbadc03eed78

      SHA256

      f4b0ce519f5e8e24c7fad10372bdeebd6f8543fddd2371f9c3afa83b9db58d50

      SHA512

      148921aba65f58b948145ce9564624962debc44d2e85a009332f1577b0b395a280f894bc39884ca18806c63dc0b4a9132651cf45c09e11aa6bebd3b6c16ac296

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio1025.exe
      Filesize

      397KB

      MD5

      c7aec12b4afbb0ea0c043d880b0833bc

      SHA1

      2841f6fa8b0c3899d2b74fddb766dbadc03eed78

      SHA256

      f4b0ce519f5e8e24c7fad10372bdeebd6f8543fddd2371f9c3afa83b9db58d50

      SHA512

      148921aba65f58b948145ce9564624962debc44d2e85a009332f1577b0b395a280f894bc39884ca18806c63dc0b4a9132651cf45c09e11aa6bebd3b6c16ac296

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2203.exe
      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2203.exe
      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6985.exe
      Filesize

      356KB

      MD5

      8611b8ab5495b0fc0360b5d4f57c815b

      SHA1

      d5210de807a6eda245dd5b1826185204e4f419f6

      SHA256

      279932d449195748738c097fd2a49490262e5a9eef982a49fb92e9d0b38abca4

      SHA512

      384b112bfa3a13a0e688ccb888e50e6e3f5dc760564cfa5108728e139838f214838d9e7e71de2cbd91eaf58714d9456e66860aeaa16933df7d06350cf59537a4

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6985.exe
      Filesize

      356KB

      MD5

      8611b8ab5495b0fc0360b5d4f57c815b

      SHA1

      d5210de807a6eda245dd5b1826185204e4f419f6

      SHA256

      279932d449195748738c097fd2a49490262e5a9eef982a49fb92e9d0b38abca4

      SHA512

      384b112bfa3a13a0e688ccb888e50e6e3f5dc760564cfa5108728e139838f214838d9e7e71de2cbd91eaf58714d9456e66860aeaa16933df7d06350cf59537a4

    • memory/1700-153-0x0000000007380000-0x0000000007924000-memory.dmp
      Filesize

      5.6MB

    • memory/1700-154-0x0000000002CC0000-0x0000000002D0B000-memory.dmp
      Filesize

      300KB

    • memory/1700-155-0x0000000004B70000-0x0000000004B80000-memory.dmp
      Filesize

      64KB

    • memory/1700-156-0x0000000004B70000-0x0000000004B80000-memory.dmp
      Filesize

      64KB

    • memory/1700-157-0x0000000004D20000-0x0000000004D5E000-memory.dmp
      Filesize

      248KB

    • memory/1700-158-0x0000000004D20000-0x0000000004D5E000-memory.dmp
      Filesize

      248KB

    • memory/1700-160-0x0000000004D20000-0x0000000004D5E000-memory.dmp
      Filesize

      248KB

    • memory/1700-162-0x0000000004D20000-0x0000000004D5E000-memory.dmp
      Filesize

      248KB

    • memory/1700-164-0x0000000004D20000-0x0000000004D5E000-memory.dmp
      Filesize

      248KB

    • memory/1700-166-0x0000000004D20000-0x0000000004D5E000-memory.dmp
      Filesize

      248KB

    • memory/1700-168-0x0000000004D20000-0x0000000004D5E000-memory.dmp
      Filesize

      248KB

    • memory/1700-170-0x0000000004D20000-0x0000000004D5E000-memory.dmp
      Filesize

      248KB

    • memory/1700-172-0x0000000004D20000-0x0000000004D5E000-memory.dmp
      Filesize

      248KB

    • memory/1700-174-0x0000000004D20000-0x0000000004D5E000-memory.dmp
      Filesize

      248KB

    • memory/1700-176-0x0000000004D20000-0x0000000004D5E000-memory.dmp
      Filesize

      248KB

    • memory/1700-178-0x0000000004D20000-0x0000000004D5E000-memory.dmp
      Filesize

      248KB

    • memory/1700-180-0x0000000004D20000-0x0000000004D5E000-memory.dmp
      Filesize

      248KB

    • memory/1700-182-0x0000000004D20000-0x0000000004D5E000-memory.dmp
      Filesize

      248KB

    • memory/1700-184-0x0000000004D20000-0x0000000004D5E000-memory.dmp
      Filesize

      248KB

    • memory/1700-186-0x0000000004D20000-0x0000000004D5E000-memory.dmp
      Filesize

      248KB

    • memory/1700-188-0x0000000004D20000-0x0000000004D5E000-memory.dmp
      Filesize

      248KB

    • memory/1700-190-0x0000000004D20000-0x0000000004D5E000-memory.dmp
      Filesize

      248KB

    • memory/1700-192-0x0000000004D20000-0x0000000004D5E000-memory.dmp
      Filesize

      248KB

    • memory/1700-194-0x0000000004D20000-0x0000000004D5E000-memory.dmp
      Filesize

      248KB

    • memory/1700-196-0x0000000004D20000-0x0000000004D5E000-memory.dmp
      Filesize

      248KB

    • memory/1700-198-0x0000000004D20000-0x0000000004D5E000-memory.dmp
      Filesize

      248KB

    • memory/1700-200-0x0000000004D20000-0x0000000004D5E000-memory.dmp
      Filesize

      248KB

    • memory/1700-202-0x0000000004D20000-0x0000000004D5E000-memory.dmp
      Filesize

      248KB

    • memory/1700-204-0x0000000004D20000-0x0000000004D5E000-memory.dmp
      Filesize

      248KB

    • memory/1700-206-0x0000000004D20000-0x0000000004D5E000-memory.dmp
      Filesize

      248KB

    • memory/1700-208-0x0000000004D20000-0x0000000004D5E000-memory.dmp
      Filesize

      248KB

    • memory/1700-210-0x0000000004D20000-0x0000000004D5E000-memory.dmp
      Filesize

      248KB

    • memory/1700-212-0x0000000004D20000-0x0000000004D5E000-memory.dmp
      Filesize

      248KB

    • memory/1700-214-0x0000000004D20000-0x0000000004D5E000-memory.dmp
      Filesize

      248KB

    • memory/1700-216-0x0000000004D20000-0x0000000004D5E000-memory.dmp
      Filesize

      248KB

    • memory/1700-218-0x0000000004D20000-0x0000000004D5E000-memory.dmp
      Filesize

      248KB

    • memory/1700-220-0x0000000004D20000-0x0000000004D5E000-memory.dmp
      Filesize

      248KB

    • memory/1700-1063-0x0000000007930000-0x0000000007F48000-memory.dmp
      Filesize

      6.1MB

    • memory/1700-1064-0x0000000007F70000-0x000000000807A000-memory.dmp
      Filesize

      1.0MB

    • memory/1700-1065-0x0000000004B70000-0x0000000004B80000-memory.dmp
      Filesize

      64KB

    • memory/1700-1066-0x00000000080B0000-0x00000000080C2000-memory.dmp
      Filesize

      72KB

    • memory/1700-1067-0x00000000080D0000-0x000000000810C000-memory.dmp
      Filesize

      240KB

    • memory/1700-1069-0x00000000083C0000-0x0000000008426000-memory.dmp
      Filesize

      408KB

    • memory/1700-1070-0x0000000008A80000-0x0000000008B12000-memory.dmp
      Filesize

      584KB

    • memory/1700-1071-0x0000000004B70000-0x0000000004B80000-memory.dmp
      Filesize

      64KB

    • memory/1700-1072-0x0000000004B70000-0x0000000004B80000-memory.dmp
      Filesize

      64KB

    • memory/1700-1073-0x0000000004B70000-0x0000000004B80000-memory.dmp
      Filesize

      64KB

    • memory/1700-1074-0x0000000004B70000-0x0000000004B80000-memory.dmp
      Filesize

      64KB

    • memory/1700-1075-0x0000000008C80000-0x0000000008CF6000-memory.dmp
      Filesize

      472KB

    • memory/1700-1076-0x0000000008D20000-0x0000000008D70000-memory.dmp
      Filesize

      320KB

    • memory/1700-1077-0x0000000008DA0000-0x0000000008F62000-memory.dmp
      Filesize

      1.8MB

    • memory/1700-1078-0x0000000008F70000-0x000000000949C000-memory.dmp
      Filesize

      5.2MB

    • memory/2644-147-0x00000000005B0000-0x00000000005BA000-memory.dmp
      Filesize

      40KB

    • memory/4424-1084-0x00000000002B0000-0x00000000002E2000-memory.dmp
      Filesize

      200KB

    • memory/4424-1085-0x0000000004CB0000-0x0000000004CC0000-memory.dmp
      Filesize

      64KB