Analysis
-
max time kernel
50s -
max time network
176s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
27-03-2023 22:17
General
-
Target
44b258fae2ab8d53fa338a2888df5032af4d2559e807b43d09db623cc50a0a61.exe
-
Size
705KB
-
MD5
b3ead806c04ed54a75c3ddb5339f2f9c
-
SHA1
1d4ac76a5cdeaca75994cbc93540f93a7d478254
-
SHA256
44b258fae2ab8d53fa338a2888df5032af4d2559e807b43d09db623cc50a0a61
-
SHA512
017019725d4c4c1c549c804fafb3da44ddc6e46d5e1a0c878eb7edf4e7c7053a60f0887ff9ba4aaeaf61a2d03cb13ffe1dbb0670906a7cf96d8f461c9ee9af7f
-
SSDEEP
12288:be42StnJqYU2E8wGHAoYuYvX2M8tA2NLLMcWKdAo:be4tMY9EMHAS5lkKdAo
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
-
Executes dropped EXE 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 1 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\44b258fae2ab8d53fa338a2888df5032af4d2559e807b43d09db623cc50a0a61.exe"C:\Users\Admin\AppData\Local\Temp\44b258fae2ab8d53fa338a2888df5032af4d2559e807b43d09db623cc50a0a61.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zigm3131.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zigm3131.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr219208.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr219208.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku920385.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku920385.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr826811.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr826811.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD5932a6f58e5bc64dd878861f91ac7cbf0
SHA118c827032ec818af17f8afe9e4b45f075d83b657
SHA25646f3a3fbf0b4534c1348f9955b9ce0c06325980da5c874af4dd2aef7802f9f58
SHA51248104962db4087c986aeaadae40452a7cadee21973717bd5eb94350a3bb233f10d09353f4b36a9462d5769cb7865a4e824b6590506340c30ac3fc16e8da796e9
-
Filesize
175KB
MD5932a6f58e5bc64dd878861f91ac7cbf0
SHA118c827032ec818af17f8afe9e4b45f075d83b657
SHA25646f3a3fbf0b4534c1348f9955b9ce0c06325980da5c874af4dd2aef7802f9f58
SHA51248104962db4087c986aeaadae40452a7cadee21973717bd5eb94350a3bb233f10d09353f4b36a9462d5769cb7865a4e824b6590506340c30ac3fc16e8da796e9
-
Filesize
413KB
MD55a79c32fdb49be7fa83478e78644bfa9
SHA140752abae6038844460e651a663f59f03bc088a5
SHA256a1c9068ef36337eec44ec4422519d9ee0c71f6e10bf4816a4f4101bf6c8b478b
SHA512673b7ae49b62424af6e798364c721a988bd5dad791d11d8ca60cc1a1010d4df241a3e3f2188b39cbd014ac037ab39c00a8c2378f583dec5420b8c8ec737b075b
-
Filesize
413KB
MD55a79c32fdb49be7fa83478e78644bfa9
SHA140752abae6038844460e651a663f59f03bc088a5
SHA256a1c9068ef36337eec44ec4422519d9ee0c71f6e10bf4816a4f4101bf6c8b478b
SHA512673b7ae49b62424af6e798364c721a988bd5dad791d11d8ca60cc1a1010d4df241a3e3f2188b39cbd014ac037ab39c00a8c2378f583dec5420b8c8ec737b075b
-
Filesize
13KB
MD5509a43f278645c0b9dd10497db99a1ad
SHA11f7e1fc91c81f6c7a2b09bea8caf2ad2b756c71c
SHA2569c229f2174392b7bb35cc5761384796f2a05d4b00503979e7b3b0ddad6c8672e
SHA5121af8fc70063b33ac9df31d6e510511fe37f685017383fbe6a702fd2012954809cfeaf6c8b3e186839f0df80b947ace931d604c216e53fa11a47302cf7b604fe8
-
Filesize
13KB
MD5509a43f278645c0b9dd10497db99a1ad
SHA11f7e1fc91c81f6c7a2b09bea8caf2ad2b756c71c
SHA2569c229f2174392b7bb35cc5761384796f2a05d4b00503979e7b3b0ddad6c8672e
SHA5121af8fc70063b33ac9df31d6e510511fe37f685017383fbe6a702fd2012954809cfeaf6c8b3e186839f0df80b947ace931d604c216e53fa11a47302cf7b604fe8
-
Filesize
366KB
MD51db7ddeeb37c9274f031263ad2022274
SHA144377ce985b07caca113b40013179d5ff1ef0daf
SHA2567217e9e99079181fe3cf9464c7b36eb247b4ea22d07c0564a93aa4573c787a61
SHA51272f723dd4a3e54cfc7e48d2370d4d53501fc32aec70b79d8875ed5f75a990647bc38620c52fbad2976b997214a833ad734309a47c636a4b19a8c622012dcc47d
-
Filesize
366KB
MD51db7ddeeb37c9274f031263ad2022274
SHA144377ce985b07caca113b40013179d5ff1ef0daf
SHA2567217e9e99079181fe3cf9464c7b36eb247b4ea22d07c0564a93aa4573c787a61
SHA51272f723dd4a3e54cfc7e48d2370d4d53501fc32aec70b79d8875ed5f75a990647bc38620c52fbad2976b997214a833ad734309a47c636a4b19a8c622012dcc47d
-
Filesize
560KB
-
Filesize
3.4MB
-
Filesize
40KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
300KB
-
Filesize
272KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
280KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
5.0MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
6.0MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
248KB
-
Filesize
64KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
64KB
-
Filesize
472KB
-
Filesize
320KB
-
Filesize
200KB
-
Filesize
64KB
-
Filesize
300KB
-
Filesize
64KB