Analysis

  • max time kernel
    143s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/03/2023, 18:58

General

  • Target

    b3b3fbad4ded5b56e4b5a39566f9ed2236c63e4ade12a5999a53259a33036528.exe

  • Size

    553KB

  • MD5

    73af8637814cfe247b91630653616037

  • SHA1

    e9bf44f73ff9128813c77e5db5a3e7b058f21fd9

  • SHA256

    b3b3fbad4ded5b56e4b5a39566f9ed2236c63e4ade12a5999a53259a33036528

  • SHA512

    41f070a0c7635ae4543ff5bd096e0c3b4169de5ed1432dd6c0afeb8f3aee27851ec148d568bd757d861f0a9b3fe13b65c4170d63fc14b10c45459ba6d15566c5

  • SSDEEP

    12288:8MrHy901zffgSD2SmjnIpQXc5FdKyGiJso54TN/AJCzMv:zycP9mrHMzz54TNopv

Malware Config

Extracted

Family

redline

Botnet

boris

C2

193.233.20.32:4125

Attributes
  • auth_value

    766b5bdf6dbefcf7ca223351952fc38f

Extracted

Family

redline

Botnet

gena

C2

193.233.20.32:4125

Attributes
  • auth_value

    93c20961cb6b06b2d5781c212db6201e

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 33 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b3b3fbad4ded5b56e4b5a39566f9ed2236c63e4ade12a5999a53259a33036528.exe
    "C:\Users\Admin\AppData\Local\Temp\b3b3fbad4ded5b56e4b5a39566f9ed2236c63e4ade12a5999a53259a33036528.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2020
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio1467.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio1467.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4360
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1357.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1357.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4132
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7175.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7175.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3664
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 1824
          4⤵
          • Program crash
          PID:880
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si265097.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si265097.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5076
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3664 -ip 3664
    1⤵
      PID:3160

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si265097.exe

            Filesize

            175KB

            MD5

            f50023c2c4bad1bbf51efde95c575b28

            SHA1

            9e02fe5ecc82f471d8c078a0d4b9ce02fdf69ce1

            SHA256

            a491d4a9a89a7103f18f402d20df34f1ae56d18bc779ff8a4681f52a3e65cbdb

            SHA512

            d869c3c475811fdce251a700556018d98c639c28ec838f31e0fb3a9f91743843393d77735f14b992a7407356d109b680e2b9687385bae2ed7ffaef88b7c9fa57

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si265097.exe

            Filesize

            175KB

            MD5

            f50023c2c4bad1bbf51efde95c575b28

            SHA1

            9e02fe5ecc82f471d8c078a0d4b9ce02fdf69ce1

            SHA256

            a491d4a9a89a7103f18f402d20df34f1ae56d18bc779ff8a4681f52a3e65cbdb

            SHA512

            d869c3c475811fdce251a700556018d98c639c28ec838f31e0fb3a9f91743843393d77735f14b992a7407356d109b680e2b9687385bae2ed7ffaef88b7c9fa57

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio1467.exe

            Filesize

            411KB

            MD5

            df0e5ec6ab4f55ee976916603763680d

            SHA1

            f3db612d5231afe1f73b89d8158dab9b0d581ff5

            SHA256

            1b55d7a5bf38f42433bb43281e63e34fe81a359602dda985b3f5139d7eebee5e

            SHA512

            5980d79c8b95ba194fadde7ed6fbf6b5ddb1cbb12f5eda9a524798d2e972cdfc2b602cc9930682ad17e97a54510c40b5fbd6c73dbdc4a424d8f93502e9a49566

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio1467.exe

            Filesize

            411KB

            MD5

            df0e5ec6ab4f55ee976916603763680d

            SHA1

            f3db612d5231afe1f73b89d8158dab9b0d581ff5

            SHA256

            1b55d7a5bf38f42433bb43281e63e34fe81a359602dda985b3f5139d7eebee5e

            SHA512

            5980d79c8b95ba194fadde7ed6fbf6b5ddb1cbb12f5eda9a524798d2e972cdfc2b602cc9930682ad17e97a54510c40b5fbd6c73dbdc4a424d8f93502e9a49566

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1357.exe

            Filesize

            11KB

            MD5

            7e93bacbbc33e6652e147e7fe07572a0

            SHA1

            421a7167da01c8da4dc4d5234ca3dd84e319e762

            SHA256

            850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

            SHA512

            250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1357.exe

            Filesize

            11KB

            MD5

            7e93bacbbc33e6652e147e7fe07572a0

            SHA1

            421a7167da01c8da4dc4d5234ca3dd84e319e762

            SHA256

            850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

            SHA512

            250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7175.exe

            Filesize

            386KB

            MD5

            7d5c9a892a6a0bdca94047067593daa6

            SHA1

            9c45ac072361729e2149ee4acd6aa3e46e7a619f

            SHA256

            d39c6a082fbded75aa1335939f8df1ad288e02becd066ce6dfd8b4d04bc4e2af

            SHA512

            2942742722bd94f51e4ad729c7d2065bee12744522c1bbc0d33d7c226a6fa531190a03de3aaeddb8447bff9494d56e6ebfae5c8fc7cb619b5adda0e37ce96f20

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7175.exe

            Filesize

            386KB

            MD5

            7d5c9a892a6a0bdca94047067593daa6

            SHA1

            9c45ac072361729e2149ee4acd6aa3e46e7a619f

            SHA256

            d39c6a082fbded75aa1335939f8df1ad288e02becd066ce6dfd8b4d04bc4e2af

            SHA512

            2942742722bd94f51e4ad729c7d2065bee12744522c1bbc0d33d7c226a6fa531190a03de3aaeddb8447bff9494d56e6ebfae5c8fc7cb619b5adda0e37ce96f20

          • memory/3664-153-0x0000000002B90000-0x0000000002BDB000-memory.dmp

            Filesize

            300KB

          • memory/3664-154-0x0000000007210000-0x0000000007220000-memory.dmp

            Filesize

            64KB

          • memory/3664-155-0x0000000007210000-0x0000000007220000-memory.dmp

            Filesize

            64KB

          • memory/3664-156-0x0000000007220000-0x00000000077C4000-memory.dmp

            Filesize

            5.6MB

          • memory/3664-157-0x0000000007150000-0x000000000718F000-memory.dmp

            Filesize

            252KB

          • memory/3664-158-0x0000000007150000-0x000000000718F000-memory.dmp

            Filesize

            252KB

          • memory/3664-160-0x0000000007150000-0x000000000718F000-memory.dmp

            Filesize

            252KB

          • memory/3664-162-0x0000000007150000-0x000000000718F000-memory.dmp

            Filesize

            252KB

          • memory/3664-164-0x0000000007150000-0x000000000718F000-memory.dmp

            Filesize

            252KB

          • memory/3664-166-0x0000000007150000-0x000000000718F000-memory.dmp

            Filesize

            252KB

          • memory/3664-168-0x0000000007150000-0x000000000718F000-memory.dmp

            Filesize

            252KB

          • memory/3664-172-0x0000000007150000-0x000000000718F000-memory.dmp

            Filesize

            252KB

          • memory/3664-170-0x0000000007150000-0x000000000718F000-memory.dmp

            Filesize

            252KB

          • memory/3664-174-0x0000000007150000-0x000000000718F000-memory.dmp

            Filesize

            252KB

          • memory/3664-182-0x0000000007150000-0x000000000718F000-memory.dmp

            Filesize

            252KB

          • memory/3664-184-0x0000000007150000-0x000000000718F000-memory.dmp

            Filesize

            252KB

          • memory/3664-180-0x0000000007150000-0x000000000718F000-memory.dmp

            Filesize

            252KB

          • memory/3664-186-0x0000000007150000-0x000000000718F000-memory.dmp

            Filesize

            252KB

          • memory/3664-178-0x0000000007150000-0x000000000718F000-memory.dmp

            Filesize

            252KB

          • memory/3664-176-0x0000000007150000-0x000000000718F000-memory.dmp

            Filesize

            252KB

          • memory/3664-194-0x0000000007150000-0x000000000718F000-memory.dmp

            Filesize

            252KB

          • memory/3664-202-0x0000000007150000-0x000000000718F000-memory.dmp

            Filesize

            252KB

          • memory/3664-204-0x0000000007150000-0x000000000718F000-memory.dmp

            Filesize

            252KB

          • memory/3664-200-0x0000000007150000-0x000000000718F000-memory.dmp

            Filesize

            252KB

          • memory/3664-198-0x0000000007150000-0x000000000718F000-memory.dmp

            Filesize

            252KB

          • memory/3664-196-0x0000000007150000-0x000000000718F000-memory.dmp

            Filesize

            252KB

          • memory/3664-210-0x0000000007150000-0x000000000718F000-memory.dmp

            Filesize

            252KB

          • memory/3664-208-0x0000000007150000-0x000000000718F000-memory.dmp

            Filesize

            252KB

          • memory/3664-206-0x0000000007150000-0x000000000718F000-memory.dmp

            Filesize

            252KB

          • memory/3664-216-0x0000000007150000-0x000000000718F000-memory.dmp

            Filesize

            252KB

          • memory/3664-220-0x0000000007150000-0x000000000718F000-memory.dmp

            Filesize

            252KB

          • memory/3664-218-0x0000000007150000-0x000000000718F000-memory.dmp

            Filesize

            252KB

          • memory/3664-214-0x0000000007150000-0x000000000718F000-memory.dmp

            Filesize

            252KB

          • memory/3664-212-0x0000000007150000-0x000000000718F000-memory.dmp

            Filesize

            252KB

          • memory/3664-192-0x0000000007150000-0x000000000718F000-memory.dmp

            Filesize

            252KB

          • memory/3664-190-0x0000000007150000-0x000000000718F000-memory.dmp

            Filesize

            252KB

          • memory/3664-188-0x0000000007150000-0x000000000718F000-memory.dmp

            Filesize

            252KB

          • memory/3664-1063-0x00000000077D0000-0x0000000007DE8000-memory.dmp

            Filesize

            6.1MB

          • memory/3664-1064-0x0000000007E30000-0x0000000007F3A000-memory.dmp

            Filesize

            1.0MB

          • memory/3664-1065-0x0000000007F70000-0x0000000007F82000-memory.dmp

            Filesize

            72KB

          • memory/3664-1066-0x0000000007F90000-0x0000000007FCC000-memory.dmp

            Filesize

            240KB

          • memory/3664-1067-0x0000000007210000-0x0000000007220000-memory.dmp

            Filesize

            64KB

          • memory/3664-1069-0x0000000007210000-0x0000000007220000-memory.dmp

            Filesize

            64KB

          • memory/3664-1070-0x0000000007210000-0x0000000007220000-memory.dmp

            Filesize

            64KB

          • memory/3664-1071-0x0000000007210000-0x0000000007220000-memory.dmp

            Filesize

            64KB

          • memory/3664-1072-0x0000000008280000-0x0000000008312000-memory.dmp

            Filesize

            584KB

          • memory/3664-1073-0x0000000008320000-0x0000000008386000-memory.dmp

            Filesize

            408KB

          • memory/3664-1074-0x0000000008B80000-0x0000000008D42000-memory.dmp

            Filesize

            1.8MB

          • memory/3664-1075-0x0000000008D60000-0x000000000928C000-memory.dmp

            Filesize

            5.2MB

          • memory/3664-1076-0x0000000007210000-0x0000000007220000-memory.dmp

            Filesize

            64KB

          • memory/3664-1077-0x00000000095F0000-0x0000000009666000-memory.dmp

            Filesize

            472KB

          • memory/3664-1078-0x0000000009690000-0x00000000096E0000-memory.dmp

            Filesize

            320KB

          • memory/4132-147-0x0000000000FA0000-0x0000000000FAA000-memory.dmp

            Filesize

            40KB

          • memory/5076-1085-0x00000000003B0000-0x00000000003E2000-memory.dmp

            Filesize

            200KB

          • memory/5076-1086-0x0000000004C40000-0x0000000004C50000-memory.dmp

            Filesize

            64KB