Analysis

  • max time kernel
    55s
  • max time network
    58s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    24-03-2023 12:04

General

  • Target

    c097803972e942c112586daada62f5a685eed10fdab4f77aca274a3e78a1583f.exe

  • Size

    540KB

  • MD5

    4360af6f8a2ccaf3131cbc49a339b464

  • SHA1

    c973dbc179a99270ad9a3ae2a19c84b805ff1706

  • SHA256

    c097803972e942c112586daada62f5a685eed10fdab4f77aca274a3e78a1583f

  • SHA512

    31d680fdc06be4313a3e3420bcc4e7307071aa7d7f12232e128d30a09e1072c8688b6d20e236af67c4a63ced11a937f270f61902cf5bf1882f5049ed9b7edb6b

  • SSDEEP

    12288:QMr+y90pskdwkPwBwNJlOs9UtQyCaArmdwSGi7:+yivPwBwduQUVj

Malware Config

Extracted

Family

redline

Botnet

down

C2

193.233.20.31:4125

Attributes
  • auth_value

    12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

hero

C2

193.233.20.31:4125

Attributes
  • auth_value

    11f3c75a88ca461bcc8d6bf60a1193e3

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c097803972e942c112586daada62f5a685eed10fdab4f77aca274a3e78a1583f.exe
    "C:\Users\Admin\AppData\Local\Temp\c097803972e942c112586daada62f5a685eed10fdab4f77aca274a3e78a1583f.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1880
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio4777.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio4777.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2016
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2469.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2469.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2440
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5456.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5456.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2524
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si229073.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si229073.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1080

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

3
T1112

Disabling Security Tools

2
T1089

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si229073.exe
    Filesize

    175KB

    MD5

    7c11dfe7837f2079d50113de0e973682

    SHA1

    fae072addd4d56ab67d08ab82da4aac5d7223960

    SHA256

    442d9cc0073a6d45abbed64eb9891912091d444fe4dd368924d1b8cf7c59e65b

    SHA512

    06085d23ead5955185736af64754c343a796af98b68c8013ba20b19a5c52eb92066698b86633d54438fe6ad5455c3c3c4625cf03d15439ab486e22388bd8cab7

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si229073.exe
    Filesize

    175KB

    MD5

    7c11dfe7837f2079d50113de0e973682

    SHA1

    fae072addd4d56ab67d08ab82da4aac5d7223960

    SHA256

    442d9cc0073a6d45abbed64eb9891912091d444fe4dd368924d1b8cf7c59e65b

    SHA512

    06085d23ead5955185736af64754c343a796af98b68c8013ba20b19a5c52eb92066698b86633d54438fe6ad5455c3c3c4625cf03d15439ab486e22388bd8cab7

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio4777.exe
    Filesize

    397KB

    MD5

    541efb94d9acc9afcedccf8b3ed0e511

    SHA1

    80a6eb09d4c9c07b1069d693be258b00a1299567

    SHA256

    9d1f4882e7cdf57ecfca42d05443a3a9eb005c897e5ae5e8f002d47b3af9a7f7

    SHA512

    4ea1d5390ac4c6416871a052c36fa149dd8d17c17299dc0b54c5670b748dcdfe31a9d6d874c0863c3b974bf3a9908e6bfbf3d703739ce62e10fea7aa493582a0

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio4777.exe
    Filesize

    397KB

    MD5

    541efb94d9acc9afcedccf8b3ed0e511

    SHA1

    80a6eb09d4c9c07b1069d693be258b00a1299567

    SHA256

    9d1f4882e7cdf57ecfca42d05443a3a9eb005c897e5ae5e8f002d47b3af9a7f7

    SHA512

    4ea1d5390ac4c6416871a052c36fa149dd8d17c17299dc0b54c5670b748dcdfe31a9d6d874c0863c3b974bf3a9908e6bfbf3d703739ce62e10fea7aa493582a0

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2469.exe
    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2469.exe
    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5456.exe
    Filesize

    356KB

    MD5

    cfbf7fc7ea305caee7688c454ecfe4e0

    SHA1

    14fb42b7bef7872939de3f156a5cfb668427bc30

    SHA256

    ec4b88ba3e616091cf052ba53f5a372660a376b86cc199a4c36cbd1b50606e16

    SHA512

    3a953b832047eb8b3dbb1135a63ea704688b3466d0d4bb56e3ac68dd05989a30427ff53abf4547ed41f1cae44b6b27817ae1a386b8be97b837a093d9ca3bf304

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5456.exe
    Filesize

    356KB

    MD5

    cfbf7fc7ea305caee7688c454ecfe4e0

    SHA1

    14fb42b7bef7872939de3f156a5cfb668427bc30

    SHA256

    ec4b88ba3e616091cf052ba53f5a372660a376b86cc199a4c36cbd1b50606e16

    SHA512

    3a953b832047eb8b3dbb1135a63ea704688b3466d0d4bb56e3ac68dd05989a30427ff53abf4547ed41f1cae44b6b27817ae1a386b8be97b837a093d9ca3bf304

  • memory/1080-1069-0x0000000000B60000-0x0000000000B92000-memory.dmp
    Filesize

    200KB

  • memory/1080-1070-0x0000000005440000-0x000000000548B000-memory.dmp
    Filesize

    300KB

  • memory/1080-1071-0x00000000053D0000-0x00000000053E0000-memory.dmp
    Filesize

    64KB

  • memory/2440-132-0x00000000003D0000-0x00000000003DA000-memory.dmp
    Filesize

    40KB

  • memory/2524-178-0x0000000007670000-0x00000000076AE000-memory.dmp
    Filesize

    248KB

  • memory/2524-182-0x0000000007670000-0x00000000076AE000-memory.dmp
    Filesize

    248KB

  • memory/2524-141-0x0000000007170000-0x000000000766E000-memory.dmp
    Filesize

    5.0MB

  • memory/2524-142-0x0000000007670000-0x00000000076B4000-memory.dmp
    Filesize

    272KB

  • memory/2524-143-0x0000000007670000-0x00000000076AE000-memory.dmp
    Filesize

    248KB

  • memory/2524-144-0x0000000007670000-0x00000000076AE000-memory.dmp
    Filesize

    248KB

  • memory/2524-146-0x0000000007670000-0x00000000076AE000-memory.dmp
    Filesize

    248KB

  • memory/2524-152-0x0000000007670000-0x00000000076AE000-memory.dmp
    Filesize

    248KB

  • memory/2524-154-0x0000000007670000-0x00000000076AE000-memory.dmp
    Filesize

    248KB

  • memory/2524-150-0x0000000007670000-0x00000000076AE000-memory.dmp
    Filesize

    248KB

  • memory/2524-148-0x0000000007670000-0x00000000076AE000-memory.dmp
    Filesize

    248KB

  • memory/2524-156-0x0000000007670000-0x00000000076AE000-memory.dmp
    Filesize

    248KB

  • memory/2524-158-0x0000000007670000-0x00000000076AE000-memory.dmp
    Filesize

    248KB

  • memory/2524-160-0x0000000007670000-0x00000000076AE000-memory.dmp
    Filesize

    248KB

  • memory/2524-164-0x0000000007670000-0x00000000076AE000-memory.dmp
    Filesize

    248KB

  • memory/2524-166-0x0000000007670000-0x00000000076AE000-memory.dmp
    Filesize

    248KB

  • memory/2524-168-0x0000000007670000-0x00000000076AE000-memory.dmp
    Filesize

    248KB

  • memory/2524-170-0x0000000007670000-0x00000000076AE000-memory.dmp
    Filesize

    248KB

  • memory/2524-172-0x0000000007670000-0x00000000076AE000-memory.dmp
    Filesize

    248KB

  • memory/2524-174-0x0000000007670000-0x00000000076AE000-memory.dmp
    Filesize

    248KB

  • memory/2524-139-0x00000000070D0000-0x0000000007116000-memory.dmp
    Filesize

    280KB

  • memory/2524-176-0x0000000007670000-0x00000000076AE000-memory.dmp
    Filesize

    248KB

  • memory/2524-162-0x0000000007670000-0x00000000076AE000-memory.dmp
    Filesize

    248KB

  • memory/2524-184-0x0000000007670000-0x00000000076AE000-memory.dmp
    Filesize

    248KB

  • memory/2524-186-0x0000000007670000-0x00000000076AE000-memory.dmp
    Filesize

    248KB

  • memory/2524-140-0x0000000007160000-0x0000000007170000-memory.dmp
    Filesize

    64KB

  • memory/2524-188-0x0000000007670000-0x00000000076AE000-memory.dmp
    Filesize

    248KB

  • memory/2524-192-0x0000000007670000-0x00000000076AE000-memory.dmp
    Filesize

    248KB

  • memory/2524-196-0x0000000007670000-0x00000000076AE000-memory.dmp
    Filesize

    248KB

  • memory/2524-198-0x0000000007670000-0x00000000076AE000-memory.dmp
    Filesize

    248KB

  • memory/2524-200-0x0000000007670000-0x00000000076AE000-memory.dmp
    Filesize

    248KB

  • memory/2524-202-0x0000000007670000-0x00000000076AE000-memory.dmp
    Filesize

    248KB

  • memory/2524-206-0x0000000007670000-0x00000000076AE000-memory.dmp
    Filesize

    248KB

  • memory/2524-204-0x0000000007670000-0x00000000076AE000-memory.dmp
    Filesize

    248KB

  • memory/2524-194-0x0000000007670000-0x00000000076AE000-memory.dmp
    Filesize

    248KB

  • memory/2524-190-0x0000000007670000-0x00000000076AE000-memory.dmp
    Filesize

    248KB

  • memory/2524-180-0x0000000007670000-0x00000000076AE000-memory.dmp
    Filesize

    248KB

  • memory/2524-1049-0x0000000007CC0000-0x00000000082C6000-memory.dmp
    Filesize

    6.0MB

  • memory/2524-1050-0x0000000007720000-0x000000000782A000-memory.dmp
    Filesize

    1.0MB

  • memory/2524-1051-0x0000000007860000-0x0000000007872000-memory.dmp
    Filesize

    72KB

  • memory/2524-1052-0x0000000007880000-0x00000000078BE000-memory.dmp
    Filesize

    248KB

  • memory/2524-1053-0x00000000079D0000-0x0000000007A1B000-memory.dmp
    Filesize

    300KB

  • memory/2524-1054-0x0000000007160000-0x0000000007170000-memory.dmp
    Filesize

    64KB

  • memory/2524-1056-0x0000000007160000-0x0000000007170000-memory.dmp
    Filesize

    64KB

  • memory/2524-1057-0x0000000007B60000-0x0000000007BC6000-memory.dmp
    Filesize

    408KB

  • memory/2524-1058-0x0000000008860000-0x00000000088F2000-memory.dmp
    Filesize

    584KB

  • memory/2524-1059-0x0000000008A50000-0x0000000008C12000-memory.dmp
    Filesize

    1.8MB

  • memory/2524-138-0x0000000002B90000-0x0000000002BDB000-memory.dmp
    Filesize

    300KB

  • memory/2524-1060-0x0000000008C40000-0x000000000916C000-memory.dmp
    Filesize

    5.2MB

  • memory/2524-1061-0x000000000A520000-0x000000000A596000-memory.dmp
    Filesize

    472KB

  • memory/2524-1062-0x000000000A5B0000-0x000000000A600000-memory.dmp
    Filesize

    320KB

  • memory/2524-1063-0x0000000007160000-0x0000000007170000-memory.dmp
    Filesize

    64KB