Analysis

  • max time kernel
    42s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    25-03-2023 08:01

General

  • Target

    36c21c81577ce3b5977ecedac15b6070.exe

  • Size

    556KB

  • MD5

    36c21c81577ce3b5977ecedac15b6070

  • SHA1

    6338cf262bb5c2c1a705f34a9d7b4aa42bbb7169

  • SHA256

    c20988d5e429617c0ef0816e7a7743b0d8d4f3faec4b9b272747b86b4bc2299d

  • SHA512

    11bcca63b2f97c971d9715bfc8f9232c861ec155f67ec4e3d27aeb9679f2de3daa0be091877f3c95e7efd6ef4ab1ac7c10eb31069ff1f70c968c77d0b5606408

  • SSDEEP

    12288:/Mrmy90JZ4CqpX5aV9TmgBkw+aiNfg80EDHj1adtYJILC8U:1y24NppY91ifhyC8U

Malware Config

Extracted

Family

redline

Botnet

boris

C2

193.233.20.32:4125

Attributes
  • auth_value

    766b5bdf6dbefcf7ca223351952fc38f

Extracted

Family

redline

Botnet

lida

C2

193.233.20.32:4125

Attributes
  • auth_value

    24052aa2e9b85984a98d80cf08623e8d

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 37 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\36c21c81577ce3b5977ecedac15b6070.exe
    "C:\Users\Admin\AppData\Local\Temp\36c21c81577ce3b5977ecedac15b6070.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:308
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba2740.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba2740.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1564
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h88gR03.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h88gR03.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1116
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iXXiS84.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iXXiS84.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:812
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l95wt23.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l95wt23.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1976

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

3
T1112

Disabling Security Tools

2
T1089

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l95wt23.exe
    Filesize

    175KB

    MD5

    6b06147bf5fd26306978a93fe83127a4

    SHA1

    7b14ff42f4441b985591ef5b7d4cc703f0bbcdfa

    SHA256

    11e6d45ae92fc4505f14f550d01d97a42fba91a999b900daf843251772c755e0

    SHA512

    603007d99e52da5739040fee891c193123dc5741985de1c3dde091dd07e759336ec749312e4ab95d05c1c6681f10e56b4e9aee67d633a97b6aa25c5119f4d6b4

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l95wt23.exe
    Filesize

    175KB

    MD5

    6b06147bf5fd26306978a93fe83127a4

    SHA1

    7b14ff42f4441b985591ef5b7d4cc703f0bbcdfa

    SHA256

    11e6d45ae92fc4505f14f550d01d97a42fba91a999b900daf843251772c755e0

    SHA512

    603007d99e52da5739040fee891c193123dc5741985de1c3dde091dd07e759336ec749312e4ab95d05c1c6681f10e56b4e9aee67d633a97b6aa25c5119f4d6b4

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba2740.exe
    Filesize

    414KB

    MD5

    1784c2a94aa4aed5eb3ab1d5b2cc9a15

    SHA1

    30a0d056c477a83a8e19597d2ca64fe54b10b4b7

    SHA256

    63fb3a58e08c81366853f9a5bc25570bf99a9e1b77155c4ebc536d2301ba7b1b

    SHA512

    d39909b2123b42d0b3ab5d7cf46904304e73b7f005de05d7615a3cc492effd0222043846a29e11c63dc851efcec91d01f75bc4903b1538862f80d3dc3faa2ab3

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba2740.exe
    Filesize

    414KB

    MD5

    1784c2a94aa4aed5eb3ab1d5b2cc9a15

    SHA1

    30a0d056c477a83a8e19597d2ca64fe54b10b4b7

    SHA256

    63fb3a58e08c81366853f9a5bc25570bf99a9e1b77155c4ebc536d2301ba7b1b

    SHA512

    d39909b2123b42d0b3ab5d7cf46904304e73b7f005de05d7615a3cc492effd0222043846a29e11c63dc851efcec91d01f75bc4903b1538862f80d3dc3faa2ab3

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h88gR03.exe
    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h88gR03.exe
    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iXXiS84.exe
    Filesize

    387KB

    MD5

    53e0d827554e6642bc746414e200a6b4

    SHA1

    334ceef47ba8dcd2376a6ac9a2729d002f276da1

    SHA256

    db176f0725c7c27361cfd4ee031515236789cdc1943db94293e24cf33f6b4380

    SHA512

    8175de24009b67caa51d9157d593ab004ed084e53e444fb9539a19777603866d8177adf651adef5e120330fbfa115975ea52426598d3f68e7c5587472d46c2ad

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iXXiS84.exe
    Filesize

    387KB

    MD5

    53e0d827554e6642bc746414e200a6b4

    SHA1

    334ceef47ba8dcd2376a6ac9a2729d002f276da1

    SHA256

    db176f0725c7c27361cfd4ee031515236789cdc1943db94293e24cf33f6b4380

    SHA512

    8175de24009b67caa51d9157d593ab004ed084e53e444fb9539a19777603866d8177adf651adef5e120330fbfa115975ea52426598d3f68e7c5587472d46c2ad

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iXXiS84.exe
    Filesize

    387KB

    MD5

    53e0d827554e6642bc746414e200a6b4

    SHA1

    334ceef47ba8dcd2376a6ac9a2729d002f276da1

    SHA256

    db176f0725c7c27361cfd4ee031515236789cdc1943db94293e24cf33f6b4380

    SHA512

    8175de24009b67caa51d9157d593ab004ed084e53e444fb9539a19777603866d8177adf651adef5e120330fbfa115975ea52426598d3f68e7c5587472d46c2ad

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\l95wt23.exe
    Filesize

    175KB

    MD5

    6b06147bf5fd26306978a93fe83127a4

    SHA1

    7b14ff42f4441b985591ef5b7d4cc703f0bbcdfa

    SHA256

    11e6d45ae92fc4505f14f550d01d97a42fba91a999b900daf843251772c755e0

    SHA512

    603007d99e52da5739040fee891c193123dc5741985de1c3dde091dd07e759336ec749312e4ab95d05c1c6681f10e56b4e9aee67d633a97b6aa25c5119f4d6b4

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\l95wt23.exe
    Filesize

    175KB

    MD5

    6b06147bf5fd26306978a93fe83127a4

    SHA1

    7b14ff42f4441b985591ef5b7d4cc703f0bbcdfa

    SHA256

    11e6d45ae92fc4505f14f550d01d97a42fba91a999b900daf843251772c755e0

    SHA512

    603007d99e52da5739040fee891c193123dc5741985de1c3dde091dd07e759336ec749312e4ab95d05c1c6681f10e56b4e9aee67d633a97b6aa25c5119f4d6b4

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\niba2740.exe
    Filesize

    414KB

    MD5

    1784c2a94aa4aed5eb3ab1d5b2cc9a15

    SHA1

    30a0d056c477a83a8e19597d2ca64fe54b10b4b7

    SHA256

    63fb3a58e08c81366853f9a5bc25570bf99a9e1b77155c4ebc536d2301ba7b1b

    SHA512

    d39909b2123b42d0b3ab5d7cf46904304e73b7f005de05d7615a3cc492effd0222043846a29e11c63dc851efcec91d01f75bc4903b1538862f80d3dc3faa2ab3

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\niba2740.exe
    Filesize

    414KB

    MD5

    1784c2a94aa4aed5eb3ab1d5b2cc9a15

    SHA1

    30a0d056c477a83a8e19597d2ca64fe54b10b4b7

    SHA256

    63fb3a58e08c81366853f9a5bc25570bf99a9e1b77155c4ebc536d2301ba7b1b

    SHA512

    d39909b2123b42d0b3ab5d7cf46904304e73b7f005de05d7615a3cc492effd0222043846a29e11c63dc851efcec91d01f75bc4903b1538862f80d3dc3faa2ab3

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\h88gR03.exe
    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\iXXiS84.exe
    Filesize

    387KB

    MD5

    53e0d827554e6642bc746414e200a6b4

    SHA1

    334ceef47ba8dcd2376a6ac9a2729d002f276da1

    SHA256

    db176f0725c7c27361cfd4ee031515236789cdc1943db94293e24cf33f6b4380

    SHA512

    8175de24009b67caa51d9157d593ab004ed084e53e444fb9539a19777603866d8177adf651adef5e120330fbfa115975ea52426598d3f68e7c5587472d46c2ad

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\iXXiS84.exe
    Filesize

    387KB

    MD5

    53e0d827554e6642bc746414e200a6b4

    SHA1

    334ceef47ba8dcd2376a6ac9a2729d002f276da1

    SHA256

    db176f0725c7c27361cfd4ee031515236789cdc1943db94293e24cf33f6b4380

    SHA512

    8175de24009b67caa51d9157d593ab004ed084e53e444fb9539a19777603866d8177adf651adef5e120330fbfa115975ea52426598d3f68e7c5587472d46c2ad

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\iXXiS84.exe
    Filesize

    387KB

    MD5

    53e0d827554e6642bc746414e200a6b4

    SHA1

    334ceef47ba8dcd2376a6ac9a2729d002f276da1

    SHA256

    db176f0725c7c27361cfd4ee031515236789cdc1943db94293e24cf33f6b4380

    SHA512

    8175de24009b67caa51d9157d593ab004ed084e53e444fb9539a19777603866d8177adf651adef5e120330fbfa115975ea52426598d3f68e7c5587472d46c2ad

  • memory/812-109-0x0000000004AA0000-0x0000000004ADF000-memory.dmp
    Filesize

    252KB

  • memory/812-129-0x0000000004AA0000-0x0000000004ADF000-memory.dmp
    Filesize

    252KB

  • memory/812-91-0x0000000004AA0000-0x0000000004ADF000-memory.dmp
    Filesize

    252KB

  • memory/812-93-0x0000000004AA0000-0x0000000004ADF000-memory.dmp
    Filesize

    252KB

  • memory/812-95-0x0000000004AA0000-0x0000000004ADF000-memory.dmp
    Filesize

    252KB

  • memory/812-97-0x0000000004AA0000-0x0000000004ADF000-memory.dmp
    Filesize

    252KB

  • memory/812-99-0x0000000004AA0000-0x0000000004ADF000-memory.dmp
    Filesize

    252KB

  • memory/812-101-0x0000000004AA0000-0x0000000004ADF000-memory.dmp
    Filesize

    252KB

  • memory/812-103-0x0000000004AA0000-0x0000000004ADF000-memory.dmp
    Filesize

    252KB

  • memory/812-105-0x0000000004AA0000-0x0000000004ADF000-memory.dmp
    Filesize

    252KB

  • memory/812-107-0x0000000004AA0000-0x0000000004ADF000-memory.dmp
    Filesize

    252KB

  • memory/812-87-0x0000000004AA0000-0x0000000004ADF000-memory.dmp
    Filesize

    252KB

  • memory/812-111-0x0000000004AA0000-0x0000000004ADF000-memory.dmp
    Filesize

    252KB

  • memory/812-113-0x0000000004AA0000-0x0000000004ADF000-memory.dmp
    Filesize

    252KB

  • memory/812-115-0x0000000004AA0000-0x0000000004ADF000-memory.dmp
    Filesize

    252KB

  • memory/812-117-0x0000000004AA0000-0x0000000004ADF000-memory.dmp
    Filesize

    252KB

  • memory/812-119-0x0000000004AA0000-0x0000000004ADF000-memory.dmp
    Filesize

    252KB

  • memory/812-121-0x0000000004AA0000-0x0000000004ADF000-memory.dmp
    Filesize

    252KB

  • memory/812-123-0x0000000004AA0000-0x0000000004ADF000-memory.dmp
    Filesize

    252KB

  • memory/812-125-0x0000000004AA0000-0x0000000004ADF000-memory.dmp
    Filesize

    252KB

  • memory/812-127-0x0000000004AA0000-0x0000000004ADF000-memory.dmp
    Filesize

    252KB

  • memory/812-89-0x0000000004AA0000-0x0000000004ADF000-memory.dmp
    Filesize

    252KB

  • memory/812-131-0x0000000004AA0000-0x0000000004ADF000-memory.dmp
    Filesize

    252KB

  • memory/812-133-0x0000000004AA0000-0x0000000004ADF000-memory.dmp
    Filesize

    252KB

  • memory/812-135-0x0000000004AA0000-0x0000000004ADF000-memory.dmp
    Filesize

    252KB

  • memory/812-137-0x0000000004AA0000-0x0000000004ADF000-memory.dmp
    Filesize

    252KB

  • memory/812-139-0x0000000004AA0000-0x0000000004ADF000-memory.dmp
    Filesize

    252KB

  • memory/812-141-0x0000000004AA0000-0x0000000004ADF000-memory.dmp
    Filesize

    252KB

  • memory/812-143-0x0000000004AA0000-0x0000000004ADF000-memory.dmp
    Filesize

    252KB

  • memory/812-145-0x0000000004AA0000-0x0000000004ADF000-memory.dmp
    Filesize

    252KB

  • memory/812-147-0x0000000004AA0000-0x0000000004ADF000-memory.dmp
    Filesize

    252KB

  • memory/812-149-0x0000000004AA0000-0x0000000004ADF000-memory.dmp
    Filesize

    252KB

  • memory/812-353-0x0000000004840000-0x0000000004880000-memory.dmp
    Filesize

    256KB

  • memory/812-355-0x0000000004840000-0x0000000004880000-memory.dmp
    Filesize

    256KB

  • memory/812-994-0x0000000004840000-0x0000000004880000-memory.dmp
    Filesize

    256KB

  • memory/812-86-0x0000000004AA0000-0x0000000004ADF000-memory.dmp
    Filesize

    252KB

  • memory/812-85-0x0000000004AA0000-0x0000000004AE4000-memory.dmp
    Filesize

    272KB

  • memory/812-84-0x00000000046E0000-0x0000000004726000-memory.dmp
    Filesize

    280KB

  • memory/812-83-0x0000000002EC0000-0x0000000002F0B000-memory.dmp
    Filesize

    300KB

  • memory/1116-72-0x0000000001390000-0x000000000139A000-memory.dmp
    Filesize

    40KB

  • memory/1976-1003-0x0000000000CC0000-0x0000000000CF2000-memory.dmp
    Filesize

    200KB

  • memory/1976-1004-0x0000000004F90000-0x0000000004FD0000-memory.dmp
    Filesize

    256KB