Analysis

  • max time kernel
    146s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-03-2023 21:50

General

  • Target

    b850adc15323e2f0aba72c0c576d98d34dddc9d38dd31ab90d8afa8227539847.exe

  • Size

    700KB

  • MD5

    92b45563d499965952595cb97465d1e9

  • SHA1

    4c571d9dc9a99899f4bea9233a30f427c7f2fb8f

  • SHA256

    b850adc15323e2f0aba72c0c576d98d34dddc9d38dd31ab90d8afa8227539847

  • SHA512

    b829ee2df0d6f7af57f43df48b534b459268b6dd8530d0a61e758245d39a8b6ef30079ee5bbe159b8eca3c3563c4b02fd18ddb8ecba4f5c83e9f0c77124e29c0

  • SSDEEP

    12288:YMrDy90EhFSFQDr+Eg9DSlcAXeuBG8F3lTEjByGquY2JIt7:rythDHzXeuBG8V2Vy7uY2Js

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

from

C2

176.113.115.145:4125

Attributes
  • auth_value

    8633e283485822a4a48f0a41d5397566

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b850adc15323e2f0aba72c0c576d98d34dddc9d38dd31ab90d8afa8227539847.exe
    "C:\Users\Admin\AppData\Local\Temp\b850adc15323e2f0aba72c0c576d98d34dddc9d38dd31ab90d8afa8227539847.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3968
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un315603.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un315603.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4216
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2054.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2054.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4540
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 1080
          4⤵
          • Program crash
          PID:2324
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9409.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9409.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4912
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 1356
          4⤵
          • Program crash
          PID:3164
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si044880.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si044880.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4828
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4540 -ip 4540
    1⤵
      PID:1828
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4912 -ip 4912
      1⤵
        PID:2908

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si044880.exe

        Filesize

        175KB

        MD5

        6a1a080bf7f081b4a95e1518f666189a

        SHA1

        790cd7ada9324abbe3765f878e31a6cc7b5d72de

        SHA256

        9efaad4d6598f701b71e37f3c3a73f46ee8d12e6873efb5ef18c4d9d54285bc1

        SHA512

        2070e437ccf45c14fec6197c7e6aa87cc79df3854a2dd186bec99091481401bea576ce2aab9b0149fff5165ef51b8d2076352eb2b1bb5724498de25d6864d0b7

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si044880.exe

        Filesize

        175KB

        MD5

        6a1a080bf7f081b4a95e1518f666189a

        SHA1

        790cd7ada9324abbe3765f878e31a6cc7b5d72de

        SHA256

        9efaad4d6598f701b71e37f3c3a73f46ee8d12e6873efb5ef18c4d9d54285bc1

        SHA512

        2070e437ccf45c14fec6197c7e6aa87cc79df3854a2dd186bec99091481401bea576ce2aab9b0149fff5165ef51b8d2076352eb2b1bb5724498de25d6864d0b7

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un315603.exe

        Filesize

        558KB

        MD5

        d47569f9fbe7663303fa25a482b09c11

        SHA1

        28d5d1ee9b19b906a6249f2466dc76bfb40b3d9e

        SHA256

        54d46f25fdd881623fd7fafc93beb707f2142b44e51a9d9b77f42ba01c3fef3a

        SHA512

        610ff5a0ce9b4077384be698741e18bd47cd93d68e51892a83d5b69b6febaa44aac2631c52bba0aa8f34054a5e437327097489c0289f628df11408026cf6c471

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un315603.exe

        Filesize

        558KB

        MD5

        d47569f9fbe7663303fa25a482b09c11

        SHA1

        28d5d1ee9b19b906a6249f2466dc76bfb40b3d9e

        SHA256

        54d46f25fdd881623fd7fafc93beb707f2142b44e51a9d9b77f42ba01c3fef3a

        SHA512

        610ff5a0ce9b4077384be698741e18bd47cd93d68e51892a83d5b69b6febaa44aac2631c52bba0aa8f34054a5e437327097489c0289f628df11408026cf6c471

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2054.exe

        Filesize

        307KB

        MD5

        cab16996c80b7fcca4c31fb644877d42

        SHA1

        9feb782fcbb80b9aeda0887422579d00bda543fa

        SHA256

        a35d42544db1c1cc4567f64c208fb239c25429b259340e5bfb89035616664c0c

        SHA512

        1dd3de093b7b3dd167d70463206d6f53e6a1f40cde8fcd4d3c8c7710073fa4f5c2f14bd0f66932c873288caff82709961c28ea23c5d2a57105a7af7149aff211

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2054.exe

        Filesize

        307KB

        MD5

        cab16996c80b7fcca4c31fb644877d42

        SHA1

        9feb782fcbb80b9aeda0887422579d00bda543fa

        SHA256

        a35d42544db1c1cc4567f64c208fb239c25429b259340e5bfb89035616664c0c

        SHA512

        1dd3de093b7b3dd167d70463206d6f53e6a1f40cde8fcd4d3c8c7710073fa4f5c2f14bd0f66932c873288caff82709961c28ea23c5d2a57105a7af7149aff211

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9409.exe

        Filesize

        365KB

        MD5

        fc5e230798c885b86956f56b4285f9f3

        SHA1

        e2f60bcd6c06e0360b86ac0020dbcd63d5c04dd7

        SHA256

        dd247b1772646bb6c44dc597d728bdd49dc1aef02afc56fbfd2b87c2cebd2e58

        SHA512

        78880e4a777c89598584be3af0dfe80fc092beb3ab09e2a48167058ddf4b6e62a7d7864fbcaab405e2bcd73fab7a2baffa3fccdfcfe51089cf34c23b052dae5f

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9409.exe

        Filesize

        365KB

        MD5

        fc5e230798c885b86956f56b4285f9f3

        SHA1

        e2f60bcd6c06e0360b86ac0020dbcd63d5c04dd7

        SHA256

        dd247b1772646bb6c44dc597d728bdd49dc1aef02afc56fbfd2b87c2cebd2e58

        SHA512

        78880e4a777c89598584be3af0dfe80fc092beb3ab09e2a48167058ddf4b6e62a7d7864fbcaab405e2bcd73fab7a2baffa3fccdfcfe51089cf34c23b052dae5f

      • memory/4540-148-0x00000000007E0000-0x000000000080D000-memory.dmp

        Filesize

        180KB

      • memory/4540-149-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

        Filesize

        64KB

      • memory/4540-150-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

        Filesize

        64KB

      • memory/4540-151-0x0000000004DC0000-0x0000000005364000-memory.dmp

        Filesize

        5.6MB

      • memory/4540-152-0x0000000004D80000-0x0000000004D92000-memory.dmp

        Filesize

        72KB

      • memory/4540-153-0x0000000004D80000-0x0000000004D92000-memory.dmp

        Filesize

        72KB

      • memory/4540-155-0x0000000004D80000-0x0000000004D92000-memory.dmp

        Filesize

        72KB

      • memory/4540-157-0x0000000004D80000-0x0000000004D92000-memory.dmp

        Filesize

        72KB

      • memory/4540-159-0x0000000004D80000-0x0000000004D92000-memory.dmp

        Filesize

        72KB

      • memory/4540-161-0x0000000004D80000-0x0000000004D92000-memory.dmp

        Filesize

        72KB

      • memory/4540-163-0x0000000004D80000-0x0000000004D92000-memory.dmp

        Filesize

        72KB

      • memory/4540-165-0x0000000004D80000-0x0000000004D92000-memory.dmp

        Filesize

        72KB

      • memory/4540-167-0x0000000004D80000-0x0000000004D92000-memory.dmp

        Filesize

        72KB

      • memory/4540-169-0x0000000004D80000-0x0000000004D92000-memory.dmp

        Filesize

        72KB

      • memory/4540-171-0x0000000004D80000-0x0000000004D92000-memory.dmp

        Filesize

        72KB

      • memory/4540-173-0x0000000004D80000-0x0000000004D92000-memory.dmp

        Filesize

        72KB

      • memory/4540-175-0x0000000004D80000-0x0000000004D92000-memory.dmp

        Filesize

        72KB

      • memory/4540-177-0x0000000004D80000-0x0000000004D92000-memory.dmp

        Filesize

        72KB

      • memory/4540-179-0x0000000004D80000-0x0000000004D92000-memory.dmp

        Filesize

        72KB

      • memory/4540-180-0x0000000000400000-0x000000000070F000-memory.dmp

        Filesize

        3.1MB

      • memory/4540-182-0x0000000000400000-0x000000000070F000-memory.dmp

        Filesize

        3.1MB

      • memory/4828-1117-0x0000000000780000-0x00000000007B2000-memory.dmp

        Filesize

        200KB

      • memory/4828-1118-0x0000000005320000-0x0000000005330000-memory.dmp

        Filesize

        64KB

      • memory/4912-192-0x00000000027C0000-0x00000000027FF000-memory.dmp

        Filesize

        252KB

      • memory/4912-277-0x00000000007F0000-0x000000000083B000-memory.dmp

        Filesize

        300KB

      • memory/4912-194-0x00000000027C0000-0x00000000027FF000-memory.dmp

        Filesize

        252KB

      • memory/4912-190-0x00000000027C0000-0x00000000027FF000-memory.dmp

        Filesize

        252KB

      • memory/4912-196-0x00000000027C0000-0x00000000027FF000-memory.dmp

        Filesize

        252KB

      • memory/4912-198-0x00000000027C0000-0x00000000027FF000-memory.dmp

        Filesize

        252KB

      • memory/4912-200-0x00000000027C0000-0x00000000027FF000-memory.dmp

        Filesize

        252KB

      • memory/4912-202-0x00000000027C0000-0x00000000027FF000-memory.dmp

        Filesize

        252KB

      • memory/4912-204-0x00000000027C0000-0x00000000027FF000-memory.dmp

        Filesize

        252KB

      • memory/4912-206-0x00000000027C0000-0x00000000027FF000-memory.dmp

        Filesize

        252KB

      • memory/4912-208-0x00000000027C0000-0x00000000027FF000-memory.dmp

        Filesize

        252KB

      • memory/4912-210-0x00000000027C0000-0x00000000027FF000-memory.dmp

        Filesize

        252KB

      • memory/4912-212-0x00000000027C0000-0x00000000027FF000-memory.dmp

        Filesize

        252KB

      • memory/4912-214-0x00000000027C0000-0x00000000027FF000-memory.dmp

        Filesize

        252KB

      • memory/4912-216-0x00000000027C0000-0x00000000027FF000-memory.dmp

        Filesize

        252KB

      • memory/4912-218-0x00000000027C0000-0x00000000027FF000-memory.dmp

        Filesize

        252KB

      • memory/4912-220-0x00000000027C0000-0x00000000027FF000-memory.dmp

        Filesize

        252KB

      • memory/4912-188-0x00000000027C0000-0x00000000027FF000-memory.dmp

        Filesize

        252KB

      • memory/4912-279-0x00000000022A0000-0x00000000022B0000-memory.dmp

        Filesize

        64KB

      • memory/4912-282-0x00000000022A0000-0x00000000022B0000-memory.dmp

        Filesize

        64KB

      • memory/4912-281-0x00000000022A0000-0x00000000022B0000-memory.dmp

        Filesize

        64KB

      • memory/4912-1097-0x0000000005510000-0x0000000005B28000-memory.dmp

        Filesize

        6.1MB

      • memory/4912-1098-0x0000000005B30000-0x0000000005C3A000-memory.dmp

        Filesize

        1.0MB

      • memory/4912-1099-0x0000000005C40000-0x0000000005C52000-memory.dmp

        Filesize

        72KB

      • memory/4912-1100-0x0000000005C60000-0x0000000005C9C000-memory.dmp

        Filesize

        240KB

      • memory/4912-1101-0x00000000022A0000-0x00000000022B0000-memory.dmp

        Filesize

        64KB

      • memory/4912-1102-0x0000000005F50000-0x0000000005FE2000-memory.dmp

        Filesize

        584KB

      • memory/4912-1103-0x0000000005FF0000-0x0000000006056000-memory.dmp

        Filesize

        408KB

      • memory/4912-1105-0x00000000022A0000-0x00000000022B0000-memory.dmp

        Filesize

        64KB

      • memory/4912-1106-0x00000000022A0000-0x00000000022B0000-memory.dmp

        Filesize

        64KB

      • memory/4912-1107-0x0000000006950000-0x0000000006B12000-memory.dmp

        Filesize

        1.8MB

      • memory/4912-1108-0x0000000006B30000-0x000000000705C000-memory.dmp

        Filesize

        5.2MB

      • memory/4912-187-0x00000000027C0000-0x00000000027FF000-memory.dmp

        Filesize

        252KB

      • memory/4912-1109-0x00000000071A0000-0x0000000007216000-memory.dmp

        Filesize

        472KB

      • memory/4912-1110-0x0000000007220000-0x0000000007270000-memory.dmp

        Filesize

        320KB

      • memory/4912-1111-0x00000000022A0000-0x00000000022B0000-memory.dmp

        Filesize

        64KB