Analysis

  • max time kernel
    44s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    26-03-2023 01:07

General

  • Target

    4dd8787a20228e45c582eac16ecde7e6ca03ad78639473d1b091bc3bcfbf5c75.exe

  • Size

    553KB

  • MD5

    17d42baeb0167521ced4f3a0010283f3

  • SHA1

    e92bf79d017426dec346ca09b083856cec2b7807

  • SHA256

    4dd8787a20228e45c582eac16ecde7e6ca03ad78639473d1b091bc3bcfbf5c75

  • SHA512

    822c5e741c68d9b0cac0d49e6fd6e4fd64d5567a5a60a8932064f455c1172ba0c4123578655218ab72659bd7dfe5c902c9a7aaab4ae3ca4b9d38f665b50549ea

  • SSDEEP

    12288:7Mrmy90aOW9ZLSiOBF2LcyWold06WMdWto+/4d/zzyCV:tyIW/evBQvWolyM/9dV

Malware Config

Extracted

Family

redline

Botnet

boris

C2

193.233.20.32:4125

Attributes
  • auth_value

    766b5bdf6dbefcf7ca223351952fc38f

Extracted

Family

redline

Botnet

lida

C2

193.233.20.32:4125

Attributes
  • auth_value

    24052aa2e9b85984a98d80cf08623e8d

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 36 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4dd8787a20228e45c582eac16ecde7e6ca03ad78639473d1b091bc3bcfbf5c75.exe
    "C:\Users\Admin\AppData\Local\Temp\4dd8787a20228e45c582eac16ecde7e6ca03ad78639473d1b091bc3bcfbf5c75.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1544
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba9792.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba9792.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1312
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h61PA59.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h61PA59.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1104
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ilbBw14.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ilbBw14.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1100
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l60bY99.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l60bY99.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1980

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

3
T1112

Disabling Security Tools

2
T1089

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l60bY99.exe
    Filesize

    175KB

    MD5

    6b06147bf5fd26306978a93fe83127a4

    SHA1

    7b14ff42f4441b985591ef5b7d4cc703f0bbcdfa

    SHA256

    11e6d45ae92fc4505f14f550d01d97a42fba91a999b900daf843251772c755e0

    SHA512

    603007d99e52da5739040fee891c193123dc5741985de1c3dde091dd07e759336ec749312e4ab95d05c1c6681f10e56b4e9aee67d633a97b6aa25c5119f4d6b4

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l60bY99.exe
    Filesize

    175KB

    MD5

    6b06147bf5fd26306978a93fe83127a4

    SHA1

    7b14ff42f4441b985591ef5b7d4cc703f0bbcdfa

    SHA256

    11e6d45ae92fc4505f14f550d01d97a42fba91a999b900daf843251772c755e0

    SHA512

    603007d99e52da5739040fee891c193123dc5741985de1c3dde091dd07e759336ec749312e4ab95d05c1c6681f10e56b4e9aee67d633a97b6aa25c5119f4d6b4

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba9792.exe
    Filesize

    412KB

    MD5

    cc5231b4c8f7a3e4777cdc70f31c0816

    SHA1

    a1885dbec8bbcc18dc16b7a82da57810aae25b28

    SHA256

    676ddc0e4f4aed0327651eb52210018e81b7ec0014d3754b0c8e43b581608be2

    SHA512

    b7e5c48ae3dc2931e94ca1319cb4567a12bfaf34e56fe1753b2b2b840d9440f3b7874d9c96f1269d226edf41d3b3f268e73be0481b29774f800cebf3aa55931f

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba9792.exe
    Filesize

    412KB

    MD5

    cc5231b4c8f7a3e4777cdc70f31c0816

    SHA1

    a1885dbec8bbcc18dc16b7a82da57810aae25b28

    SHA256

    676ddc0e4f4aed0327651eb52210018e81b7ec0014d3754b0c8e43b581608be2

    SHA512

    b7e5c48ae3dc2931e94ca1319cb4567a12bfaf34e56fe1753b2b2b840d9440f3b7874d9c96f1269d226edf41d3b3f268e73be0481b29774f800cebf3aa55931f

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h61PA59.exe
    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h61PA59.exe
    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ilbBw14.exe
    Filesize

    386KB

    MD5

    5793de4a77aa9c69a3da85ba173339a5

    SHA1

    2be589e85476b8f9e8faf81a47807addfbfaa2df

    SHA256

    c3ee6a395e4ee0d8a7b364ab5ee8445b06822013002224813065bff1534227ea

    SHA512

    3f10ec508f41a9541d71e003da5716b11db13145a66815e9af16c6e5a75d34fff94e90b7ac39bfed32fe9de9acda6b18d89b30c5ab736230f0c5336e71e76dd7

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ilbBw14.exe
    Filesize

    386KB

    MD5

    5793de4a77aa9c69a3da85ba173339a5

    SHA1

    2be589e85476b8f9e8faf81a47807addfbfaa2df

    SHA256

    c3ee6a395e4ee0d8a7b364ab5ee8445b06822013002224813065bff1534227ea

    SHA512

    3f10ec508f41a9541d71e003da5716b11db13145a66815e9af16c6e5a75d34fff94e90b7ac39bfed32fe9de9acda6b18d89b30c5ab736230f0c5336e71e76dd7

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ilbBw14.exe
    Filesize

    386KB

    MD5

    5793de4a77aa9c69a3da85ba173339a5

    SHA1

    2be589e85476b8f9e8faf81a47807addfbfaa2df

    SHA256

    c3ee6a395e4ee0d8a7b364ab5ee8445b06822013002224813065bff1534227ea

    SHA512

    3f10ec508f41a9541d71e003da5716b11db13145a66815e9af16c6e5a75d34fff94e90b7ac39bfed32fe9de9acda6b18d89b30c5ab736230f0c5336e71e76dd7

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\l60bY99.exe
    Filesize

    175KB

    MD5

    6b06147bf5fd26306978a93fe83127a4

    SHA1

    7b14ff42f4441b985591ef5b7d4cc703f0bbcdfa

    SHA256

    11e6d45ae92fc4505f14f550d01d97a42fba91a999b900daf843251772c755e0

    SHA512

    603007d99e52da5739040fee891c193123dc5741985de1c3dde091dd07e759336ec749312e4ab95d05c1c6681f10e56b4e9aee67d633a97b6aa25c5119f4d6b4

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\l60bY99.exe
    Filesize

    175KB

    MD5

    6b06147bf5fd26306978a93fe83127a4

    SHA1

    7b14ff42f4441b985591ef5b7d4cc703f0bbcdfa

    SHA256

    11e6d45ae92fc4505f14f550d01d97a42fba91a999b900daf843251772c755e0

    SHA512

    603007d99e52da5739040fee891c193123dc5741985de1c3dde091dd07e759336ec749312e4ab95d05c1c6681f10e56b4e9aee67d633a97b6aa25c5119f4d6b4

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\niba9792.exe
    Filesize

    412KB

    MD5

    cc5231b4c8f7a3e4777cdc70f31c0816

    SHA1

    a1885dbec8bbcc18dc16b7a82da57810aae25b28

    SHA256

    676ddc0e4f4aed0327651eb52210018e81b7ec0014d3754b0c8e43b581608be2

    SHA512

    b7e5c48ae3dc2931e94ca1319cb4567a12bfaf34e56fe1753b2b2b840d9440f3b7874d9c96f1269d226edf41d3b3f268e73be0481b29774f800cebf3aa55931f

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\niba9792.exe
    Filesize

    412KB

    MD5

    cc5231b4c8f7a3e4777cdc70f31c0816

    SHA1

    a1885dbec8bbcc18dc16b7a82da57810aae25b28

    SHA256

    676ddc0e4f4aed0327651eb52210018e81b7ec0014d3754b0c8e43b581608be2

    SHA512

    b7e5c48ae3dc2931e94ca1319cb4567a12bfaf34e56fe1753b2b2b840d9440f3b7874d9c96f1269d226edf41d3b3f268e73be0481b29774f800cebf3aa55931f

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\h61PA59.exe
    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\ilbBw14.exe
    Filesize

    386KB

    MD5

    5793de4a77aa9c69a3da85ba173339a5

    SHA1

    2be589e85476b8f9e8faf81a47807addfbfaa2df

    SHA256

    c3ee6a395e4ee0d8a7b364ab5ee8445b06822013002224813065bff1534227ea

    SHA512

    3f10ec508f41a9541d71e003da5716b11db13145a66815e9af16c6e5a75d34fff94e90b7ac39bfed32fe9de9acda6b18d89b30c5ab736230f0c5336e71e76dd7

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\ilbBw14.exe
    Filesize

    386KB

    MD5

    5793de4a77aa9c69a3da85ba173339a5

    SHA1

    2be589e85476b8f9e8faf81a47807addfbfaa2df

    SHA256

    c3ee6a395e4ee0d8a7b364ab5ee8445b06822013002224813065bff1534227ea

    SHA512

    3f10ec508f41a9541d71e003da5716b11db13145a66815e9af16c6e5a75d34fff94e90b7ac39bfed32fe9de9acda6b18d89b30c5ab736230f0c5336e71e76dd7

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\ilbBw14.exe
    Filesize

    386KB

    MD5

    5793de4a77aa9c69a3da85ba173339a5

    SHA1

    2be589e85476b8f9e8faf81a47807addfbfaa2df

    SHA256

    c3ee6a395e4ee0d8a7b364ab5ee8445b06822013002224813065bff1534227ea

    SHA512

    3f10ec508f41a9541d71e003da5716b11db13145a66815e9af16c6e5a75d34fff94e90b7ac39bfed32fe9de9acda6b18d89b30c5ab736230f0c5336e71e76dd7

  • memory/1100-108-0x00000000048A0000-0x00000000048DF000-memory.dmp
    Filesize

    252KB

  • memory/1100-128-0x00000000048A0000-0x00000000048DF000-memory.dmp
    Filesize

    252KB

  • memory/1100-92-0x00000000048A0000-0x00000000048DF000-memory.dmp
    Filesize

    252KB

  • memory/1100-88-0x00000000002C0000-0x000000000030B000-memory.dmp
    Filesize

    300KB

  • memory/1100-94-0x00000000048A0000-0x00000000048DF000-memory.dmp
    Filesize

    252KB

  • memory/1100-96-0x00000000048A0000-0x00000000048DF000-memory.dmp
    Filesize

    252KB

  • memory/1100-98-0x00000000048A0000-0x00000000048DF000-memory.dmp
    Filesize

    252KB

  • memory/1100-100-0x00000000048A0000-0x00000000048DF000-memory.dmp
    Filesize

    252KB

  • memory/1100-102-0x00000000048A0000-0x00000000048DF000-memory.dmp
    Filesize

    252KB

  • memory/1100-104-0x00000000048A0000-0x00000000048DF000-memory.dmp
    Filesize

    252KB

  • memory/1100-106-0x00000000048A0000-0x00000000048DF000-memory.dmp
    Filesize

    252KB

  • memory/1100-89-0x00000000048A0000-0x00000000048DF000-memory.dmp
    Filesize

    252KB

  • memory/1100-110-0x00000000048A0000-0x00000000048DF000-memory.dmp
    Filesize

    252KB

  • memory/1100-112-0x00000000048A0000-0x00000000048DF000-memory.dmp
    Filesize

    252KB

  • memory/1100-114-0x00000000048A0000-0x00000000048DF000-memory.dmp
    Filesize

    252KB

  • memory/1100-116-0x00000000048A0000-0x00000000048DF000-memory.dmp
    Filesize

    252KB

  • memory/1100-118-0x00000000048A0000-0x00000000048DF000-memory.dmp
    Filesize

    252KB

  • memory/1100-120-0x00000000048A0000-0x00000000048DF000-memory.dmp
    Filesize

    252KB

  • memory/1100-122-0x00000000048A0000-0x00000000048DF000-memory.dmp
    Filesize

    252KB

  • memory/1100-124-0x00000000048A0000-0x00000000048DF000-memory.dmp
    Filesize

    252KB

  • memory/1100-126-0x00000000048A0000-0x00000000048DF000-memory.dmp
    Filesize

    252KB

  • memory/1100-91-0x0000000007210000-0x0000000007250000-memory.dmp
    Filesize

    256KB

  • memory/1100-130-0x00000000048A0000-0x00000000048DF000-memory.dmp
    Filesize

    252KB

  • memory/1100-132-0x00000000048A0000-0x00000000048DF000-memory.dmp
    Filesize

    252KB

  • memory/1100-134-0x00000000048A0000-0x00000000048DF000-memory.dmp
    Filesize

    252KB

  • memory/1100-136-0x00000000048A0000-0x00000000048DF000-memory.dmp
    Filesize

    252KB

  • memory/1100-138-0x00000000048A0000-0x00000000048DF000-memory.dmp
    Filesize

    252KB

  • memory/1100-140-0x00000000048A0000-0x00000000048DF000-memory.dmp
    Filesize

    252KB

  • memory/1100-142-0x00000000048A0000-0x00000000048DF000-memory.dmp
    Filesize

    252KB

  • memory/1100-144-0x00000000048A0000-0x00000000048DF000-memory.dmp
    Filesize

    252KB

  • memory/1100-146-0x00000000048A0000-0x00000000048DF000-memory.dmp
    Filesize

    252KB

  • memory/1100-148-0x00000000048A0000-0x00000000048DF000-memory.dmp
    Filesize

    252KB

  • memory/1100-150-0x00000000048A0000-0x00000000048DF000-memory.dmp
    Filesize

    252KB

  • memory/1100-993-0x0000000007210000-0x0000000007250000-memory.dmp
    Filesize

    256KB

  • memory/1100-86-0x00000000048A0000-0x00000000048DF000-memory.dmp
    Filesize

    252KB

  • memory/1100-85-0x00000000048A0000-0x00000000048DF000-memory.dmp
    Filesize

    252KB

  • memory/1100-84-0x00000000048A0000-0x00000000048E4000-memory.dmp
    Filesize

    272KB

  • memory/1100-83-0x0000000004800000-0x0000000004846000-memory.dmp
    Filesize

    280KB

  • memory/1104-72-0x0000000000170000-0x000000000017A000-memory.dmp
    Filesize

    40KB

  • memory/1980-1002-0x00000000003B0000-0x00000000003E2000-memory.dmp
    Filesize

    200KB

  • memory/1980-1003-0x0000000004F60000-0x0000000004FA0000-memory.dmp
    Filesize

    256KB