Analysis

  • max time kernel
    136s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-03-2023 12:07

General

  • Target

    15ac086f07be9ada33cd8412f8d7d5840a35f9db68a4490e2d8cb70e67703ab2.exe

  • Size

    540KB

  • MD5

    917dc70160a2452d16d4ba67d45e1b4a

  • SHA1

    58f9dba55f6f19ad2a34cbe7c71441d98528b2c5

  • SHA256

    15ac086f07be9ada33cd8412f8d7d5840a35f9db68a4490e2d8cb70e67703ab2

  • SHA512

    cd8f7cf9224b43bfb331367b8a2c88d0c4dc7943910901db3a56041b57f557110c91fcf3558a5654d97824dae03bf29bf621deeb75647a3001da3641b3bc041e

  • SSDEEP

    12288:MMrky90F6MkxI4l56+e9OaI9UQQkCk+8N2A8dBJ5:oys6MabOO/Q388dH

Malware Config

Extracted

Family

redline

Botnet

down

C2

193.233.20.31:4125

Attributes
  • auth_value

    12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

hero

C2

193.233.20.31:4125

Attributes
  • auth_value

    11f3c75a88ca461bcc8d6bf60a1193e3

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 34 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\15ac086f07be9ada33cd8412f8d7d5840a35f9db68a4490e2d8cb70e67703ab2.exe
    "C:\Users\Admin\AppData\Local\Temp\15ac086f07be9ada33cd8412f8d7d5840a35f9db68a4490e2d8cb70e67703ab2.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:548
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio2256.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio2256.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1992
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8552.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8552.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4028
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8286.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8286.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4896
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 1800
          4⤵
          • Program crash
          PID:4660
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si587662.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si587662.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4068
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4896 -ip 4896
    1⤵
      PID:4872
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start wuauserv
      1⤵
      • Launches sc.exe
      PID:3732

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Modify Existing Service

    1
    T1031

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    3
    T1112

    Disabling Security Tools

    2
    T1089

    Credential Access

    Credentials in Files

    2
    T1081

    Discovery

    Query Registry

    1
    T1012

    Collection

    Data from Local System

    2
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si587662.exe
      Filesize

      175KB

      MD5

      7c11dfe7837f2079d50113de0e973682

      SHA1

      fae072addd4d56ab67d08ab82da4aac5d7223960

      SHA256

      442d9cc0073a6d45abbed64eb9891912091d444fe4dd368924d1b8cf7c59e65b

      SHA512

      06085d23ead5955185736af64754c343a796af98b68c8013ba20b19a5c52eb92066698b86633d54438fe6ad5455c3c3c4625cf03d15439ab486e22388bd8cab7

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si587662.exe
      Filesize

      175KB

      MD5

      7c11dfe7837f2079d50113de0e973682

      SHA1

      fae072addd4d56ab67d08ab82da4aac5d7223960

      SHA256

      442d9cc0073a6d45abbed64eb9891912091d444fe4dd368924d1b8cf7c59e65b

      SHA512

      06085d23ead5955185736af64754c343a796af98b68c8013ba20b19a5c52eb92066698b86633d54438fe6ad5455c3c3c4625cf03d15439ab486e22388bd8cab7

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio2256.exe
      Filesize

      397KB

      MD5

      6cc0cdf041789d5e0909e87669a0d250

      SHA1

      672dabe3f93978b1c2aa0906980c202a3b101160

      SHA256

      350176c82d94b7083fead4f137a163b5db09756dee33ed241fad6899ca121ca9

      SHA512

      80997ec2fdb14e46894f2bcb7ca1cc8a7c005db66e3303e006d8119ab388b81e664b84a12cabf5d0d51c3a5f005c8005d0142969d3a35cf35cad4bef0cacf978

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio2256.exe
      Filesize

      397KB

      MD5

      6cc0cdf041789d5e0909e87669a0d250

      SHA1

      672dabe3f93978b1c2aa0906980c202a3b101160

      SHA256

      350176c82d94b7083fead4f137a163b5db09756dee33ed241fad6899ca121ca9

      SHA512

      80997ec2fdb14e46894f2bcb7ca1cc8a7c005db66e3303e006d8119ab388b81e664b84a12cabf5d0d51c3a5f005c8005d0142969d3a35cf35cad4bef0cacf978

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8552.exe
      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8552.exe
      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8286.exe
      Filesize

      356KB

      MD5

      fd5a7bcac4b56895a470b74174f0974d

      SHA1

      2e90700a773e2edf49a2bec18a17709ab36b7e69

      SHA256

      0aedbd0efeea0bcb4e03e18243a20a1d5b916436616282ee7c6146a1ba8d4db6

      SHA512

      c74497189f3424f6916ace4518b2c4bfeb3426bfc188c03e48f11ea5bdf533626dddbaeb02a54ef5acba4b73528c741b29314647d4258e0d94348ff661e32067

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8286.exe
      Filesize

      356KB

      MD5

      fd5a7bcac4b56895a470b74174f0974d

      SHA1

      2e90700a773e2edf49a2bec18a17709ab36b7e69

      SHA256

      0aedbd0efeea0bcb4e03e18243a20a1d5b916436616282ee7c6146a1ba8d4db6

      SHA512

      c74497189f3424f6916ace4518b2c4bfeb3426bfc188c03e48f11ea5bdf533626dddbaeb02a54ef5acba4b73528c741b29314647d4258e0d94348ff661e32067

    • memory/4028-147-0x0000000000C80000-0x0000000000C8A000-memory.dmp
      Filesize

      40KB

    • memory/4068-1085-0x0000000000DD0000-0x0000000000E02000-memory.dmp
      Filesize

      200KB

    • memory/4068-1086-0x00000000059B0000-0x00000000059C0000-memory.dmp
      Filesize

      64KB

    • memory/4068-1087-0x00000000059B0000-0x00000000059C0000-memory.dmp
      Filesize

      64KB

    • memory/4896-189-0x0000000007170000-0x00000000071AE000-memory.dmp
      Filesize

      248KB

    • memory/4896-203-0x0000000007170000-0x00000000071AE000-memory.dmp
      Filesize

      248KB

    • memory/4896-156-0x0000000007170000-0x00000000071AE000-memory.dmp
      Filesize

      248KB

    • memory/4896-158-0x0000000007170000-0x00000000071AE000-memory.dmp
      Filesize

      248KB

    • memory/4896-160-0x0000000007170000-0x00000000071AE000-memory.dmp
      Filesize

      248KB

    • memory/4896-162-0x0000000007170000-0x00000000071AE000-memory.dmp
      Filesize

      248KB

    • memory/4896-164-0x0000000007170000-0x00000000071AE000-memory.dmp
      Filesize

      248KB

    • memory/4896-166-0x0000000007170000-0x00000000071AE000-memory.dmp
      Filesize

      248KB

    • memory/4896-168-0x0000000007170000-0x00000000071AE000-memory.dmp
      Filesize

      248KB

    • memory/4896-170-0x0000000007170000-0x00000000071AE000-memory.dmp
      Filesize

      248KB

    • memory/4896-172-0x0000000007170000-0x00000000071AE000-memory.dmp
      Filesize

      248KB

    • memory/4896-174-0x0000000007170000-0x00000000071AE000-memory.dmp
      Filesize

      248KB

    • memory/4896-177-0x0000000007260000-0x0000000007270000-memory.dmp
      Filesize

      64KB

    • memory/4896-176-0x0000000007170000-0x00000000071AE000-memory.dmp
      Filesize

      248KB

    • memory/4896-178-0x0000000007260000-0x0000000007270000-memory.dmp
      Filesize

      64KB

    • memory/4896-181-0x0000000007260000-0x0000000007270000-memory.dmp
      Filesize

      64KB

    • memory/4896-180-0x0000000007170000-0x00000000071AE000-memory.dmp
      Filesize

      248KB

    • memory/4896-183-0x0000000007170000-0x00000000071AE000-memory.dmp
      Filesize

      248KB

    • memory/4896-185-0x0000000007170000-0x00000000071AE000-memory.dmp
      Filesize

      248KB

    • memory/4896-187-0x0000000007170000-0x00000000071AE000-memory.dmp
      Filesize

      248KB

    • memory/4896-154-0x0000000007270000-0x0000000007814000-memory.dmp
      Filesize

      5.6MB

    • memory/4896-191-0x0000000007170000-0x00000000071AE000-memory.dmp
      Filesize

      248KB

    • memory/4896-193-0x0000000007170000-0x00000000071AE000-memory.dmp
      Filesize

      248KB

    • memory/4896-195-0x0000000007170000-0x00000000071AE000-memory.dmp
      Filesize

      248KB

    • memory/4896-197-0x0000000007170000-0x00000000071AE000-memory.dmp
      Filesize

      248KB

    • memory/4896-199-0x0000000007170000-0x00000000071AE000-memory.dmp
      Filesize

      248KB

    • memory/4896-201-0x0000000007170000-0x00000000071AE000-memory.dmp
      Filesize

      248KB

    • memory/4896-155-0x0000000007170000-0x00000000071AE000-memory.dmp
      Filesize

      248KB

    • memory/4896-205-0x0000000007170000-0x00000000071AE000-memory.dmp
      Filesize

      248KB

    • memory/4896-207-0x0000000007170000-0x00000000071AE000-memory.dmp
      Filesize

      248KB

    • memory/4896-209-0x0000000007170000-0x00000000071AE000-memory.dmp
      Filesize

      248KB

    • memory/4896-211-0x0000000007170000-0x00000000071AE000-memory.dmp
      Filesize

      248KB

    • memory/4896-213-0x0000000007170000-0x00000000071AE000-memory.dmp
      Filesize

      248KB

    • memory/4896-215-0x0000000007170000-0x00000000071AE000-memory.dmp
      Filesize

      248KB

    • memory/4896-217-0x0000000007170000-0x00000000071AE000-memory.dmp
      Filesize

      248KB

    • memory/4896-219-0x0000000007170000-0x00000000071AE000-memory.dmp
      Filesize

      248KB

    • memory/4896-221-0x0000000007170000-0x00000000071AE000-memory.dmp
      Filesize

      248KB

    • memory/4896-1064-0x0000000007920000-0x0000000007F38000-memory.dmp
      Filesize

      6.1MB

    • memory/4896-1065-0x0000000007F70000-0x000000000807A000-memory.dmp
      Filesize

      1.0MB

    • memory/4896-1066-0x00000000080B0000-0x00000000080C2000-memory.dmp
      Filesize

      72KB

    • memory/4896-1067-0x00000000080D0000-0x000000000810C000-memory.dmp
      Filesize

      240KB

    • memory/4896-1068-0x0000000007260000-0x0000000007270000-memory.dmp
      Filesize

      64KB

    • memory/4896-1069-0x00000000083C0000-0x0000000008452000-memory.dmp
      Filesize

      584KB

    • memory/4896-1070-0x0000000008460000-0x00000000084C6000-memory.dmp
      Filesize

      408KB

    • memory/4896-1072-0x0000000008B80000-0x0000000008BF6000-memory.dmp
      Filesize

      472KB

    • memory/4896-1073-0x0000000008C00000-0x0000000008C50000-memory.dmp
      Filesize

      320KB

    • memory/4896-1074-0x0000000007260000-0x0000000007270000-memory.dmp
      Filesize

      64KB

    • memory/4896-1075-0x0000000007260000-0x0000000007270000-memory.dmp
      Filesize

      64KB

    • memory/4896-153-0x0000000002B90000-0x0000000002BDB000-memory.dmp
      Filesize

      300KB

    • memory/4896-1076-0x0000000007260000-0x0000000007270000-memory.dmp
      Filesize

      64KB

    • memory/4896-1077-0x0000000008EC0000-0x0000000009082000-memory.dmp
      Filesize

      1.8MB

    • memory/4896-1078-0x0000000009090000-0x00000000095BC000-memory.dmp
      Filesize

      5.2MB

    • memory/4896-1079-0x0000000007260000-0x0000000007270000-memory.dmp
      Filesize

      64KB