Analysis

  • max time kernel
    141s
  • max time network
    90s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-03-2023 12:10

General

  • Target

    0aeb42bb79bcdbda42c893aabb212e09ff7276a4eb6c6bc489ec7fe992a6877d.exe

  • Size

    540KB

  • MD5

    7ffd2ddd4ba7ba47c9d4868573d68038

  • SHA1

    b00f2323791a3263d6c19b4ed004020767e97caa

  • SHA256

    0aeb42bb79bcdbda42c893aabb212e09ff7276a4eb6c6bc489ec7fe992a6877d

  • SHA512

    b2f64721c6fbbbec8e8b44bc4b9e594139b23a52cfe1bce439ac53506be66393edea80e0149c9ce550220b0096ccb9609e18ee45775ad5d0536a15f80f3d8419

  • SSDEEP

    12288:1MrEy90mUy50typIKLUEk9UzQQCOquaDOe/uIA0x:FydHx4CQGCDXuIx

Malware Config

Extracted

Family

redline

Botnet

down

C2

193.233.20.31:4125

Attributes
  • auth_value

    12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

hero

C2

193.233.20.31:4125

Attributes
  • auth_value

    11f3c75a88ca461bcc8d6bf60a1193e3

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 33 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0aeb42bb79bcdbda42c893aabb212e09ff7276a4eb6c6bc489ec7fe992a6877d.exe
    "C:\Users\Admin\AppData\Local\Temp\0aeb42bb79bcdbda42c893aabb212e09ff7276a4eb6c6bc489ec7fe992a6877d.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3804
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio4833.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio4833.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3580
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1773.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1773.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5056
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2829.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2829.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4304
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 1472
          4⤵
          • Program crash
          PID:3308
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si464595.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si464595.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2132
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4304 -ip 4304
    1⤵
      PID:2864

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Modify Existing Service

    1
    T1031

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    3
    T1112

    Disabling Security Tools

    2
    T1089

    Credential Access

    Credentials in Files

    2
    T1081

    Discovery

    Query Registry

    1
    T1012

    Collection

    Data from Local System

    2
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si464595.exe
      Filesize

      175KB

      MD5

      7c11dfe7837f2079d50113de0e973682

      SHA1

      fae072addd4d56ab67d08ab82da4aac5d7223960

      SHA256

      442d9cc0073a6d45abbed64eb9891912091d444fe4dd368924d1b8cf7c59e65b

      SHA512

      06085d23ead5955185736af64754c343a796af98b68c8013ba20b19a5c52eb92066698b86633d54438fe6ad5455c3c3c4625cf03d15439ab486e22388bd8cab7

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si464595.exe
      Filesize

      175KB

      MD5

      7c11dfe7837f2079d50113de0e973682

      SHA1

      fae072addd4d56ab67d08ab82da4aac5d7223960

      SHA256

      442d9cc0073a6d45abbed64eb9891912091d444fe4dd368924d1b8cf7c59e65b

      SHA512

      06085d23ead5955185736af64754c343a796af98b68c8013ba20b19a5c52eb92066698b86633d54438fe6ad5455c3c3c4625cf03d15439ab486e22388bd8cab7

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio4833.exe
      Filesize

      397KB

      MD5

      ad7559ce0d79d82bdd6b1d82307835bf

      SHA1

      c1cfb7eaf7cb1db7965fdd6537c90014da72e4b4

      SHA256

      e133010cc2b4613122d0c5211a514f37b4b8223450ad5e7299e6634bca8282d6

      SHA512

      6be971740286dd6e5c22f50ef1e031bcb6792ed98883487c9167734769e64d1e8d23b7ffd34398841ea4fd7ab96618c8294ec119bfecf5062bc15fc1343f5b4e

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio4833.exe
      Filesize

      397KB

      MD5

      ad7559ce0d79d82bdd6b1d82307835bf

      SHA1

      c1cfb7eaf7cb1db7965fdd6537c90014da72e4b4

      SHA256

      e133010cc2b4613122d0c5211a514f37b4b8223450ad5e7299e6634bca8282d6

      SHA512

      6be971740286dd6e5c22f50ef1e031bcb6792ed98883487c9167734769e64d1e8d23b7ffd34398841ea4fd7ab96618c8294ec119bfecf5062bc15fc1343f5b4e

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1773.exe
      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1773.exe
      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2829.exe
      Filesize

      356KB

      MD5

      663898eeac0cde901150a9f5a0d700ad

      SHA1

      bd296b25405c6673e0bf328a03a9c950fe9da9ad

      SHA256

      e8cba0a4ce301d4c4890599c8e696b0c980e1074d53af7c0f52be521d21a773b

      SHA512

      a67fb8d61c32424921ed8a24ec3c83a4633093b30f834f27e597d99951604b4875847b46f1115565f10a99fa7b8619767609f3716bea9a380ea6548a6ed7fbb9

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2829.exe
      Filesize

      356KB

      MD5

      663898eeac0cde901150a9f5a0d700ad

      SHA1

      bd296b25405c6673e0bf328a03a9c950fe9da9ad

      SHA256

      e8cba0a4ce301d4c4890599c8e696b0c980e1074d53af7c0f52be521d21a773b

      SHA512

      a67fb8d61c32424921ed8a24ec3c83a4633093b30f834f27e597d99951604b4875847b46f1115565f10a99fa7b8619767609f3716bea9a380ea6548a6ed7fbb9

    • memory/2132-1084-0x0000000000D80000-0x0000000000DB2000-memory.dmp
      Filesize

      200KB

    • memory/2132-1085-0x0000000005650000-0x0000000005660000-memory.dmp
      Filesize

      64KB

    • memory/4304-188-0x0000000007830000-0x000000000786E000-memory.dmp
      Filesize

      248KB

    • memory/4304-202-0x0000000007830000-0x000000000786E000-memory.dmp
      Filesize

      248KB

    • memory/4304-155-0x0000000007210000-0x0000000007220000-memory.dmp
      Filesize

      64KB

    • memory/4304-156-0x0000000007210000-0x0000000007220000-memory.dmp
      Filesize

      64KB

    • memory/4304-157-0x0000000007830000-0x000000000786E000-memory.dmp
      Filesize

      248KB

    • memory/4304-160-0x0000000007830000-0x000000000786E000-memory.dmp
      Filesize

      248KB

    • memory/4304-162-0x0000000007830000-0x000000000786E000-memory.dmp
      Filesize

      248KB

    • memory/4304-158-0x0000000007830000-0x000000000786E000-memory.dmp
      Filesize

      248KB

    • memory/4304-164-0x0000000007830000-0x000000000786E000-memory.dmp
      Filesize

      248KB

    • memory/4304-166-0x0000000007830000-0x000000000786E000-memory.dmp
      Filesize

      248KB

    • memory/4304-168-0x0000000007830000-0x000000000786E000-memory.dmp
      Filesize

      248KB

    • memory/4304-172-0x0000000007830000-0x000000000786E000-memory.dmp
      Filesize

      248KB

    • memory/4304-174-0x0000000007830000-0x000000000786E000-memory.dmp
      Filesize

      248KB

    • memory/4304-170-0x0000000007830000-0x000000000786E000-memory.dmp
      Filesize

      248KB

    • memory/4304-176-0x0000000007830000-0x000000000786E000-memory.dmp
      Filesize

      248KB

    • memory/4304-178-0x0000000007830000-0x000000000786E000-memory.dmp
      Filesize

      248KB

    • memory/4304-180-0x0000000007830000-0x000000000786E000-memory.dmp
      Filesize

      248KB

    • memory/4304-182-0x0000000007830000-0x000000000786E000-memory.dmp
      Filesize

      248KB

    • memory/4304-184-0x0000000007830000-0x000000000786E000-memory.dmp
      Filesize

      248KB

    • memory/4304-186-0x0000000007830000-0x000000000786E000-memory.dmp
      Filesize

      248KB

    • memory/4304-153-0x0000000007240000-0x00000000077E4000-memory.dmp
      Filesize

      5.6MB

    • memory/4304-190-0x0000000007830000-0x000000000786E000-memory.dmp
      Filesize

      248KB

    • memory/4304-192-0x0000000007830000-0x000000000786E000-memory.dmp
      Filesize

      248KB

    • memory/4304-194-0x0000000007830000-0x000000000786E000-memory.dmp
      Filesize

      248KB

    • memory/4304-196-0x0000000007830000-0x000000000786E000-memory.dmp
      Filesize

      248KB

    • memory/4304-198-0x0000000007830000-0x000000000786E000-memory.dmp
      Filesize

      248KB

    • memory/4304-200-0x0000000007830000-0x000000000786E000-memory.dmp
      Filesize

      248KB

    • memory/4304-154-0x0000000002C60000-0x0000000002CAB000-memory.dmp
      Filesize

      300KB

    • memory/4304-204-0x0000000007830000-0x000000000786E000-memory.dmp
      Filesize

      248KB

    • memory/4304-206-0x0000000007830000-0x000000000786E000-memory.dmp
      Filesize

      248KB

    • memory/4304-208-0x0000000007830000-0x000000000786E000-memory.dmp
      Filesize

      248KB

    • memory/4304-210-0x0000000007830000-0x000000000786E000-memory.dmp
      Filesize

      248KB

    • memory/4304-212-0x0000000007830000-0x000000000786E000-memory.dmp
      Filesize

      248KB

    • memory/4304-214-0x0000000007830000-0x000000000786E000-memory.dmp
      Filesize

      248KB

    • memory/4304-216-0x0000000007830000-0x000000000786E000-memory.dmp
      Filesize

      248KB

    • memory/4304-218-0x0000000007830000-0x000000000786E000-memory.dmp
      Filesize

      248KB

    • memory/4304-220-0x0000000007830000-0x000000000786E000-memory.dmp
      Filesize

      248KB

    • memory/4304-1063-0x00000000078D0000-0x0000000007EE8000-memory.dmp
      Filesize

      6.1MB

    • memory/4304-1064-0x0000000007F70000-0x000000000807A000-memory.dmp
      Filesize

      1.0MB

    • memory/4304-1065-0x00000000080B0000-0x00000000080C2000-memory.dmp
      Filesize

      72KB

    • memory/4304-1066-0x0000000007210000-0x0000000007220000-memory.dmp
      Filesize

      64KB

    • memory/4304-1067-0x00000000080D0000-0x000000000810C000-memory.dmp
      Filesize

      240KB

    • memory/4304-1069-0x00000000083C0000-0x0000000008426000-memory.dmp
      Filesize

      408KB

    • memory/4304-1070-0x0000000008A90000-0x0000000008B22000-memory.dmp
      Filesize

      584KB

    • memory/4304-1071-0x0000000007210000-0x0000000007220000-memory.dmp
      Filesize

      64KB

    • memory/4304-1072-0x0000000007210000-0x0000000007220000-memory.dmp
      Filesize

      64KB

    • memory/4304-1073-0x0000000007210000-0x0000000007220000-memory.dmp
      Filesize

      64KB

    • memory/4304-1074-0x0000000008C80000-0x0000000008E42000-memory.dmp
      Filesize

      1.8MB

    • memory/4304-1075-0x0000000008E60000-0x000000000938C000-memory.dmp
      Filesize

      5.2MB

    • memory/4304-1076-0x0000000007210000-0x0000000007220000-memory.dmp
      Filesize

      64KB

    • memory/4304-1077-0x000000000A7A0000-0x000000000A816000-memory.dmp
      Filesize

      472KB

    • memory/4304-1078-0x000000000A820000-0x000000000A870000-memory.dmp
      Filesize

      320KB

    • memory/5056-147-0x0000000000A30000-0x0000000000A3A000-memory.dmp
      Filesize

      40KB