Analysis
-
max time kernel
54s -
max time network
70s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
27-03-2023 21:51
General
-
Target
62ac5ae23210e52e5d25b84b20c156b4b8ec77a0af0b42f76ee32078a27611a6.exe
-
Size
700KB
-
MD5
5152d0d019561b65b01749eb4276ce84
-
SHA1
d95293451b7fd2008b5113bb70f55ca13cc96685
-
SHA256
62ac5ae23210e52e5d25b84b20c156b4b8ec77a0af0b42f76ee32078a27611a6
-
SHA512
e2e479766b727e9e3eb42f2554a4ae9cc402a35f9644a656a0ac0512d26d69b9821c9b8cba9691956a1e0a29fd32f8d00f92da8e332e513d9718d623859ec216
-
SSDEEP
12288:KMrfy90UWjTQnt1z9D/GcAo4NkN+qOgolhe36ndRt:1yzAymo4VqWP/nPt
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Executes dropped EXE 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 2 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\62ac5ae23210e52e5d25b84b20c156b4b8ec77a0af0b42f76ee32078a27611a6.exe"C:\Users\Admin\AppData\Local\Temp\62ac5ae23210e52e5d25b84b20c156b4b8ec77a0af0b42f76ee32078a27611a6.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un400451.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un400451.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2279.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2279.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9633.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9633.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si204294.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si204294.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD55d21cdf471b65f93b8d323e682a63e7d
SHA1457a95043ddc4088eea5f734e3a344880566e34f
SHA256e8e615073e5430b2dafff6b0e5844626a426d2837968c8aaa2a4ee306a640eb3
SHA512801770d9d9f443c6d7c76fd8fabd21c545d097cb706f112fa18140ade75342d1c23fe80f2b83589d371c223040e5dfc8863b319bb3537d085c2cae0ab27b4cf7
-
Filesize
175KB
MD55d21cdf471b65f93b8d323e682a63e7d
SHA1457a95043ddc4088eea5f734e3a344880566e34f
SHA256e8e615073e5430b2dafff6b0e5844626a426d2837968c8aaa2a4ee306a640eb3
SHA512801770d9d9f443c6d7c76fd8fabd21c545d097cb706f112fa18140ade75342d1c23fe80f2b83589d371c223040e5dfc8863b319bb3537d085c2cae0ab27b4cf7
-
Filesize
558KB
MD59f4e12818bb5b8767492cab182d1eaac
SHA188a24b4a3e114feac4629487fae280f3eeb439e1
SHA2565b49080da43ad03d4cae2e2d44595923d955de2ceea4220056e2f19ad7ca55c8
SHA5120a75a980e462fbd22d42c9eda3aadc52d75f79b37b2a502d02e189db07d6242a207fa6a78bf85500e4b6fa9c104806cacd36295a27813a703cccb7528ce8110e
-
Filesize
558KB
MD59f4e12818bb5b8767492cab182d1eaac
SHA188a24b4a3e114feac4629487fae280f3eeb439e1
SHA2565b49080da43ad03d4cae2e2d44595923d955de2ceea4220056e2f19ad7ca55c8
SHA5120a75a980e462fbd22d42c9eda3aadc52d75f79b37b2a502d02e189db07d6242a207fa6a78bf85500e4b6fa9c104806cacd36295a27813a703cccb7528ce8110e
-
Filesize
307KB
MD53d2219686042a8b38afe8493a6b9ab07
SHA12c49cd4f0f8d0636ffff783b78d5e433a24b5595
SHA25671365ff34072934beab80a95220b25486800639a50f9301638736f14da062bc0
SHA512624f1855441d9d7b631ed57ddd10652537ba497b3c573bfe96d84690536a41b83884ef258e5688ba6390037d7f322ecc2771374020e9d3f9e5e5ebf55759d7d9
-
Filesize
307KB
MD53d2219686042a8b38afe8493a6b9ab07
SHA12c49cd4f0f8d0636ffff783b78d5e433a24b5595
SHA25671365ff34072934beab80a95220b25486800639a50f9301638736f14da062bc0
SHA512624f1855441d9d7b631ed57ddd10652537ba497b3c573bfe96d84690536a41b83884ef258e5688ba6390037d7f322ecc2771374020e9d3f9e5e5ebf55759d7d9
-
Filesize
365KB
MD53808713edcf8cd6bc3edc66d5c1eb8cd
SHA1627c710153b30878c647143e4f88e82eca07d105
SHA2568e9c0ce18087bb9e8bf6a94cc52b91b25fdd605e98926511d885fa99e45ebc54
SHA512bb809414d11cfe8011e6970db23db2ccde4c76a0bba1a54b4852ac1cc659ef830d6e9cc4f585ba5811549b5ba7a9d064e9cb5a8712f1afab6edcbb2334248a8a
-
Filesize
365KB
MD53808713edcf8cd6bc3edc66d5c1eb8cd
SHA1627c710153b30878c647143e4f88e82eca07d105
SHA2568e9c0ce18087bb9e8bf6a94cc52b91b25fdd605e98926511d885fa99e45ebc54
SHA512bb809414d11cfe8011e6970db23db2ccde4c76a0bba1a54b4852ac1cc659ef830d6e9cc4f585ba5811549b5ba7a9d064e9cb5a8712f1afab6edcbb2334248a8a
-
Filesize
6.0MB
-
Filesize
248KB
-
Filesize
300KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
64KB
-
Filesize
320KB
-
Filesize
472KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
5.2MB
-
Filesize
1.8MB
-
Filesize
584KB
-
Filesize
408KB
-
Filesize
252KB
-
Filesize
64KB
-
Filesize
300KB
-
Filesize
252KB
-
Filesize
72KB
-
Filesize
1.0MB
-
Filesize
64KB
-
Filesize
280KB
-
Filesize
272KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
200KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
3.1MB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
180KB
-
Filesize
96KB
-
Filesize
64KB
-
Filesize
3.1MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
5.0MB
-
Filesize
104KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
64KB