Analysis
-
max time kernel
54s -
max time network
70s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
27-03-2023 22:14
General
-
Target
7ed85964df4b32ae8dd7384563b7702bfd61becc1d1c34143f347ddc4e447322.exe
-
Size
705KB
-
MD5
e336df6ba187ad38db4b028d686f74d6
-
SHA1
f62a0ee0f0b25b8176f603b31101bb1427139eae
-
SHA256
7ed85964df4b32ae8dd7384563b7702bfd61becc1d1c34143f347ddc4e447322
-
SHA512
5389cfdbd61f75bdc1f007c6256baaf73d9f5816c8ef31ab784525cf7c66e058767ed81c714d3e11c3031cc4b1d3d6279b4a383a45762e0418bb02d39e5c7821
-
SSDEEP
12288:kQ8/I5IsZj2qAcsbAWDLCHSJnITSFpVudjtcKl7R9ntzafhs46FeTkH:kQ8SZ2qdD8gqITyGdhcKtntufhspFeTI
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 34 IoCs
-
Executes dropped EXE 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 1 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ed85964df4b32ae8dd7384563b7702bfd61becc1d1c34143f347ddc4e447322.exe"C:\Users\Admin\AppData\Local\Temp\7ed85964df4b32ae8dd7384563b7702bfd61becc1d1c34143f347ddc4e447322.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zixa0029.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zixa0029.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr244922.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr244922.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku320196.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku320196.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr162196.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr162196.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD55bb02e63a347f74e2963002fb5e55d1a
SHA158dddba23d4339039638c6ab4a905951f0cdec26
SHA2562d44c3d9e28ae480b643a65f8a5968762217a8f9b08cb75d4c63ab07f37ef98d
SHA51296ca4d675e07c00e9446030235eac97b123181a610c8b13561650344f31e7c673a6107d8ba51e989ecd7143f4c19d04b671789d0a1895284d9cf7ab5b766b122
-
Filesize
175KB
MD55bb02e63a347f74e2963002fb5e55d1a
SHA158dddba23d4339039638c6ab4a905951f0cdec26
SHA2562d44c3d9e28ae480b643a65f8a5968762217a8f9b08cb75d4c63ab07f37ef98d
SHA51296ca4d675e07c00e9446030235eac97b123181a610c8b13561650344f31e7c673a6107d8ba51e989ecd7143f4c19d04b671789d0a1895284d9cf7ab5b766b122
-
Filesize
412KB
MD598aea2525af8428049d9edd0c5fe468f
SHA1c2881de85db38ba3209f1e96a7d651053dea76b4
SHA25608cb6372f53cb14e6a50b9f552320224b1ac7806ec9ad8b52cc7a35670faef1c
SHA51208e4008ef19857b31788b7780c5018b50742719b3046e3517c1b8a1f49beb0536fcbdc07643c723dbbd57f996f50a29a7fdc6de84dd04ec6cf8b2f35e742d4a7
-
Filesize
412KB
MD598aea2525af8428049d9edd0c5fe468f
SHA1c2881de85db38ba3209f1e96a7d651053dea76b4
SHA25608cb6372f53cb14e6a50b9f552320224b1ac7806ec9ad8b52cc7a35670faef1c
SHA51208e4008ef19857b31788b7780c5018b50742719b3046e3517c1b8a1f49beb0536fcbdc07643c723dbbd57f996f50a29a7fdc6de84dd04ec6cf8b2f35e742d4a7
-
Filesize
13KB
MD5a2849dbe3f93e366e9a67ebc4abff929
SHA11ae8fe57c346b216947e566ffd6edc876b0ceb47
SHA256465ea78f81e664508c552a11f6e0c48c9352211045f97e546d1fcde7a482d124
SHA5127d632a738f2d43ccc9fc9bca2ae12ff093cdbf69b19e912acd4cf02afdabed25476ef6f5c20fac2a3bf543bfc723a3758e4b9b041efc6e90950d002336367e0a
-
Filesize
13KB
MD5a2849dbe3f93e366e9a67ebc4abff929
SHA11ae8fe57c346b216947e566ffd6edc876b0ceb47
SHA256465ea78f81e664508c552a11f6e0c48c9352211045f97e546d1fcde7a482d124
SHA5127d632a738f2d43ccc9fc9bca2ae12ff093cdbf69b19e912acd4cf02afdabed25476ef6f5c20fac2a3bf543bfc723a3758e4b9b041efc6e90950d002336367e0a
-
Filesize
366KB
MD51ea6aa594b262e5e55fe0e73586b88ad
SHA192017ca7de0477474f4955d77b9fe071982dad8e
SHA25616fcb7a452fdd507dea26986176b11382ca7420667b8f9ed200fb70b6112413f
SHA5129e4e1949df7625746a24775bb53b1abdf2e692ecd2dcdeefe557645c59e181d691ba6da4bd0bbc78cac9a308606f57cacfecb452b3d93fa4a451d28a2a5812f9
-
Filesize
366KB
MD51ea6aa594b262e5e55fe0e73586b88ad
SHA192017ca7de0477474f4955d77b9fe071982dad8e
SHA25616fcb7a452fdd507dea26986176b11382ca7420667b8f9ed200fb70b6112413f
SHA5129e4e1949df7625746a24775bb53b1abdf2e692ecd2dcdeefe557645c59e181d691ba6da4bd0bbc78cac9a308606f57cacfecb452b3d93fa4a451d28a2a5812f9
-
Filesize
560KB
-
Filesize
3.4MB
-
Filesize
40KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
272KB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
5.0MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
300KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
6.0MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
248KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
472KB
-
Filesize
320KB
-
Filesize
280KB
-
Filesize
64KB
-
Filesize
200KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
64KB