Analysis

  • max time kernel
    95s
  • max time network
    98s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-03-2023 22:17

General

  • Target

    8225c0c17261072f34834c2efb8115e696d85f9e293c4d1fc1a3f37f2a6f8495.exe

  • Size

    699KB

  • MD5

    8538ef52091c15483f2f58d3b2499450

  • SHA1

    da8a8da427e1ce9ff9a761cd3cffe89e05ab04a0

  • SHA256

    8225c0c17261072f34834c2efb8115e696d85f9e293c4d1fc1a3f37f2a6f8495

  • SHA512

    4d38ccebe941497d331e3054bf49c1a6f35af51d6660efa1667dcc7cd7adabd2e5132737b13521f09c34dc6a99fe3e4720eeffb1e7632279ea906c81839e5cf2

  • SSDEEP

    12288:NMrDy90HbGIOaEgW4CP/e5WTTC8VVJd8RbdmNHJrSQgz0j7TCYfwhX+KUPNReuCI:Gyb1aEgWPmCCEVJdadi00HTPfwhXgtFF

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

from

C2

176.113.115.145:4125

Attributes
  • auth_value

    8633e283485822a4a48f0a41d5397566

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 19 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8225c0c17261072f34834c2efb8115e696d85f9e293c4d1fc1a3f37f2a6f8495.exe
    "C:\Users\Admin\AppData\Local\Temp\8225c0c17261072f34834c2efb8115e696d85f9e293c4d1fc1a3f37f2a6f8495.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3032
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un433462.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un433462.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4624
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9120.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9120.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1196
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 1080
          4⤵
          • Program crash
          PID:4144
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1646.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1646.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2616
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 1360
          4⤵
          • Program crash
          PID:2332
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si505509.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si505509.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2776
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1196 -ip 1196
    1⤵
      PID:4244
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2616 -ip 2616
      1⤵
        PID:2632

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si505509.exe

        Filesize

        175KB

        MD5

        7d33f5a07dd185d3dfadf6024e44fd7d

        SHA1

        497644065ea93ed1e58b457f6641a2d5379370c1

        SHA256

        1aab48b1e0e4c8baa3bc69c6b5bf43b00dc29e956c13bfc7c70cee15b69649c3

        SHA512

        1256c843dddcb74856e995446368cf2547bbb24b28fa0db69b1345a9b4f08ad680ebdec29dcc3e95ac1ee59e5f4f9d81bddf3dcd6543cda0dc097c9e2b116171

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si505509.exe

        Filesize

        175KB

        MD5

        7d33f5a07dd185d3dfadf6024e44fd7d

        SHA1

        497644065ea93ed1e58b457f6641a2d5379370c1

        SHA256

        1aab48b1e0e4c8baa3bc69c6b5bf43b00dc29e956c13bfc7c70cee15b69649c3

        SHA512

        1256c843dddcb74856e995446368cf2547bbb24b28fa0db69b1345a9b4f08ad680ebdec29dcc3e95ac1ee59e5f4f9d81bddf3dcd6543cda0dc097c9e2b116171

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un433462.exe

        Filesize

        557KB

        MD5

        d12a8a815429844087f84c038fcb6b06

        SHA1

        3178ac53a26c6675e1b6809845a89d4f113b05d9

        SHA256

        1b09d1101ed60f10b81bb02eb5b5d429e8015e1693f2cd08794d1888ad048ac2

        SHA512

        b06521fac4d7938cb53224b3d5a4048076222d6840dde6d19fc0df4c4a78f04c7bfc0535266954de8e6bc5e62d92aa308940fefdd2c8870f734ece7c44f04986

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un433462.exe

        Filesize

        557KB

        MD5

        d12a8a815429844087f84c038fcb6b06

        SHA1

        3178ac53a26c6675e1b6809845a89d4f113b05d9

        SHA256

        1b09d1101ed60f10b81bb02eb5b5d429e8015e1693f2cd08794d1888ad048ac2

        SHA512

        b06521fac4d7938cb53224b3d5a4048076222d6840dde6d19fc0df4c4a78f04c7bfc0535266954de8e6bc5e62d92aa308940fefdd2c8870f734ece7c44f04986

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9120.exe

        Filesize

        307KB

        MD5

        62f91574f96733e84730563c5a6c2263

        SHA1

        0ef9077bf577d7366309a4bfacf1455fe206f793

        SHA256

        f46ad95745ca09a16e81f7795651378d1c5360593ab7b3f315c0aa2f24a38cb1

        SHA512

        9ec679650f81d79500be0ca67f859d609f225fe15f8c5cb51255c849ac9d818898d3e093e0f2dd9a22ef4fbfcc0514429285e229dc5af4af043b26e3720f366a

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9120.exe

        Filesize

        307KB

        MD5

        62f91574f96733e84730563c5a6c2263

        SHA1

        0ef9077bf577d7366309a4bfacf1455fe206f793

        SHA256

        f46ad95745ca09a16e81f7795651378d1c5360593ab7b3f315c0aa2f24a38cb1

        SHA512

        9ec679650f81d79500be0ca67f859d609f225fe15f8c5cb51255c849ac9d818898d3e093e0f2dd9a22ef4fbfcc0514429285e229dc5af4af043b26e3720f366a

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1646.exe

        Filesize

        365KB

        MD5

        ad7c7d02c0e9a7a51e50f0b22c59781e

        SHA1

        6d76bbb0591681f94c212d318ed750b311b1486d

        SHA256

        8d75acda4b34a0c6a9ccf6cd6d62f2004a63c78b7197130cdcf3becb2b1af3b5

        SHA512

        1aebeb452e8f755c197619300aeedb6249c6b2cc333ba39bb02bafddbb5fd2b9f18f98971e20aabe135f36c094a31503aa4742591ddf77179f53ad27896f607a

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1646.exe

        Filesize

        365KB

        MD5

        ad7c7d02c0e9a7a51e50f0b22c59781e

        SHA1

        6d76bbb0591681f94c212d318ed750b311b1486d

        SHA256

        8d75acda4b34a0c6a9ccf6cd6d62f2004a63c78b7197130cdcf3becb2b1af3b5

        SHA512

        1aebeb452e8f755c197619300aeedb6249c6b2cc333ba39bb02bafddbb5fd2b9f18f98971e20aabe135f36c094a31503aa4742591ddf77179f53ad27896f607a

      • memory/1196-160-0x0000000005230000-0x0000000005242000-memory.dmp

        Filesize

        72KB

      • memory/1196-170-0x0000000005230000-0x0000000005242000-memory.dmp

        Filesize

        72KB

      • memory/1196-150-0x0000000002730000-0x0000000002740000-memory.dmp

        Filesize

        64KB

      • memory/1196-152-0x0000000002730000-0x0000000002740000-memory.dmp

        Filesize

        64KB

      • memory/1196-154-0x0000000005230000-0x0000000005242000-memory.dmp

        Filesize

        72KB

      • memory/1196-153-0x0000000005230000-0x0000000005242000-memory.dmp

        Filesize

        72KB

      • memory/1196-156-0x0000000005230000-0x0000000005242000-memory.dmp

        Filesize

        72KB

      • memory/1196-158-0x0000000005230000-0x0000000005242000-memory.dmp

        Filesize

        72KB

      • memory/1196-151-0x0000000002730000-0x0000000002740000-memory.dmp

        Filesize

        64KB

      • memory/1196-162-0x0000000005230000-0x0000000005242000-memory.dmp

        Filesize

        72KB

      • memory/1196-164-0x0000000005230000-0x0000000005242000-memory.dmp

        Filesize

        72KB

      • memory/1196-166-0x0000000005230000-0x0000000005242000-memory.dmp

        Filesize

        72KB

      • memory/1196-168-0x0000000005230000-0x0000000005242000-memory.dmp

        Filesize

        72KB

      • memory/1196-149-0x0000000000710000-0x000000000073D000-memory.dmp

        Filesize

        180KB

      • memory/1196-172-0x0000000005230000-0x0000000005242000-memory.dmp

        Filesize

        72KB

      • memory/1196-174-0x0000000005230000-0x0000000005242000-memory.dmp

        Filesize

        72KB

      • memory/1196-176-0x0000000005230000-0x0000000005242000-memory.dmp

        Filesize

        72KB

      • memory/1196-178-0x0000000005230000-0x0000000005242000-memory.dmp

        Filesize

        72KB

      • memory/1196-180-0x0000000005230000-0x0000000005242000-memory.dmp

        Filesize

        72KB

      • memory/1196-181-0x0000000000400000-0x000000000070F000-memory.dmp

        Filesize

        3.1MB

      • memory/1196-182-0x0000000002730000-0x0000000002740000-memory.dmp

        Filesize

        64KB

      • memory/1196-183-0x0000000002730000-0x0000000002740000-memory.dmp

        Filesize

        64KB

      • memory/1196-184-0x0000000002730000-0x0000000002740000-memory.dmp

        Filesize

        64KB

      • memory/1196-186-0x0000000000400000-0x000000000070F000-memory.dmp

        Filesize

        3.1MB

      • memory/1196-148-0x0000000004C30000-0x00000000051D4000-memory.dmp

        Filesize

        5.6MB

      • memory/2616-198-0x0000000002870000-0x00000000028AF000-memory.dmp

        Filesize

        252KB

      • memory/2616-226-0x0000000002870000-0x00000000028AF000-memory.dmp

        Filesize

        252KB

      • memory/2616-196-0x0000000002870000-0x00000000028AF000-memory.dmp

        Filesize

        252KB

      • memory/2616-192-0x0000000002870000-0x00000000028AF000-memory.dmp

        Filesize

        252KB

      • memory/2616-200-0x0000000002870000-0x00000000028AF000-memory.dmp

        Filesize

        252KB

      • memory/2616-202-0x0000000002870000-0x00000000028AF000-memory.dmp

        Filesize

        252KB

      • memory/2616-204-0x0000000002870000-0x00000000028AF000-memory.dmp

        Filesize

        252KB

      • memory/2616-207-0x00000000007F0000-0x000000000083B000-memory.dmp

        Filesize

        300KB

      • memory/2616-206-0x0000000002870000-0x00000000028AF000-memory.dmp

        Filesize

        252KB

      • memory/2616-208-0x0000000002860000-0x0000000002870000-memory.dmp

        Filesize

        64KB

      • memory/2616-210-0x0000000002860000-0x0000000002870000-memory.dmp

        Filesize

        64KB

      • memory/2616-212-0x0000000002860000-0x0000000002870000-memory.dmp

        Filesize

        64KB

      • memory/2616-211-0x0000000002870000-0x00000000028AF000-memory.dmp

        Filesize

        252KB

      • memory/2616-214-0x0000000002870000-0x00000000028AF000-memory.dmp

        Filesize

        252KB

      • memory/2616-216-0x0000000002870000-0x00000000028AF000-memory.dmp

        Filesize

        252KB

      • memory/2616-218-0x0000000002870000-0x00000000028AF000-memory.dmp

        Filesize

        252KB

      • memory/2616-220-0x0000000002870000-0x00000000028AF000-memory.dmp

        Filesize

        252KB

      • memory/2616-222-0x0000000002870000-0x00000000028AF000-memory.dmp

        Filesize

        252KB

      • memory/2616-224-0x0000000002870000-0x00000000028AF000-memory.dmp

        Filesize

        252KB

      • memory/2616-194-0x0000000002870000-0x00000000028AF000-memory.dmp

        Filesize

        252KB

      • memory/2616-228-0x0000000002870000-0x00000000028AF000-memory.dmp

        Filesize

        252KB

      • memory/2616-1101-0x0000000005460000-0x0000000005A78000-memory.dmp

        Filesize

        6.1MB

      • memory/2616-1102-0x0000000005B00000-0x0000000005C0A000-memory.dmp

        Filesize

        1.0MB

      • memory/2616-1103-0x0000000005C40000-0x0000000005C52000-memory.dmp

        Filesize

        72KB

      • memory/2616-1104-0x0000000005C60000-0x0000000005C9C000-memory.dmp

        Filesize

        240KB

      • memory/2616-1105-0x0000000002860000-0x0000000002870000-memory.dmp

        Filesize

        64KB

      • memory/2616-1106-0x0000000005F50000-0x0000000005FE2000-memory.dmp

        Filesize

        584KB

      • memory/2616-1107-0x0000000005FF0000-0x0000000006056000-memory.dmp

        Filesize

        408KB

      • memory/2616-1109-0x0000000002860000-0x0000000002870000-memory.dmp

        Filesize

        64KB

      • memory/2616-1110-0x0000000002860000-0x0000000002870000-memory.dmp

        Filesize

        64KB

      • memory/2616-1111-0x0000000002860000-0x0000000002870000-memory.dmp

        Filesize

        64KB

      • memory/2616-1112-0x0000000006930000-0x00000000069A6000-memory.dmp

        Filesize

        472KB

      • memory/2616-1113-0x00000000069C0000-0x0000000006A10000-memory.dmp

        Filesize

        320KB

      • memory/2616-1114-0x0000000006A40000-0x0000000006C02000-memory.dmp

        Filesize

        1.8MB

      • memory/2616-1115-0x0000000006C10000-0x000000000713C000-memory.dmp

        Filesize

        5.2MB

      • memory/2616-191-0x0000000002870000-0x00000000028AF000-memory.dmp

        Filesize

        252KB

      • memory/2616-1116-0x0000000002860000-0x0000000002870000-memory.dmp

        Filesize

        64KB

      • memory/2776-1122-0x0000000000F00000-0x0000000000F32000-memory.dmp

        Filesize

        200KB

      • memory/2776-1123-0x00000000057A0000-0x00000000057B0000-memory.dmp

        Filesize

        64KB