Analysis
-
max time kernel
55s -
max time network
149s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
27-03-2023 22:54
General
-
Target
e45d4f49ecc96f0f547227a02f637f7c9efffbb707a3d6e925ae1c59058be757.exe
-
Size
700KB
-
MD5
545ae6221d77b17dface82c531f1cce9
-
SHA1
2b5253d1b21c0f7d38e6fca82cb5a1cdd80cde67
-
SHA256
e45d4f49ecc96f0f547227a02f637f7c9efffbb707a3d6e925ae1c59058be757
-
SHA512
6b8236d73b76dfc3b496f1fe75511856a2fd4e248e58926aeb09ef43d5bca77d4656d2ef4068020cb94bc770de9d6813d4d56d82fcabf14754f611af3b96719f
-
SSDEEP
12288:1Mr/y9062ZdylVnQ49DVFcAD8F/d9bq6UeNXHfISHmUi4tdwyM9yXmmvech:CylRD8hd9m6UeNXnmat6Gh
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 21 IoCs
-
Executes dropped EXE 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 2 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e45d4f49ecc96f0f547227a02f637f7c9efffbb707a3d6e925ae1c59058be757.exe"C:\Users\Admin\AppData\Local\Temp\e45d4f49ecc96f0f547227a02f637f7c9efffbb707a3d6e925ae1c59058be757.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un653868.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un653868.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5984.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5984.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0165.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0165.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si455646.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si455646.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD517cf6f1223eea737f806279383b50e34
SHA1ac8ec22195ea2af285e1dbc0cfabee06bc89136d
SHA256012de5546a60b759542d809456c7c3a2c79d5bb2ee03f1318af99ec2f3008bd4
SHA51267001a4dde983253324ae785c6dabe8c7a45f80dae8e62f4f79c99430aca62fe0c166014b5552626f05956aa038c16bd958e424d41275e660be3b090442287d9
-
Filesize
175KB
MD517cf6f1223eea737f806279383b50e34
SHA1ac8ec22195ea2af285e1dbc0cfabee06bc89136d
SHA256012de5546a60b759542d809456c7c3a2c79d5bb2ee03f1318af99ec2f3008bd4
SHA51267001a4dde983253324ae785c6dabe8c7a45f80dae8e62f4f79c99430aca62fe0c166014b5552626f05956aa038c16bd958e424d41275e660be3b090442287d9
-
Filesize
558KB
MD5c3639594a4ae487c98c05f367745d8ec
SHA17fa3b3ea2f539b3c651412b85ddef5b9196a233b
SHA2567591e5c826d7f42928708a66eee27812db82b289431763718feb90e3963620ce
SHA51245a2d8a9c8ddefe8c56bcd108bf1c34399aa03f305ca3f4cf73f2010a89628fd686f799726411fa39ef44b5ba4703794f461d963728ac6c3d20b9c75d4eec700
-
Filesize
558KB
MD5c3639594a4ae487c98c05f367745d8ec
SHA17fa3b3ea2f539b3c651412b85ddef5b9196a233b
SHA2567591e5c826d7f42928708a66eee27812db82b289431763718feb90e3963620ce
SHA51245a2d8a9c8ddefe8c56bcd108bf1c34399aa03f305ca3f4cf73f2010a89628fd686f799726411fa39ef44b5ba4703794f461d963728ac6c3d20b9c75d4eec700
-
Filesize
307KB
MD5e530f7db9e4bdcea56c9bc9a61922a5a
SHA1904b6d85e213a8344685f8de05085c77eab34d30
SHA2561ae73d30a75a61b2c02dff719f0258944841c2e3e8f0ef6efa2f8c4b244951d8
SHA5121a9547e36dae26cdf024a8febaa2f6970cec84d89999d98f21384974a02329dd8cac8c43f4b7fd2f7e00da924c3b20038fcdd718aef817ee2b4e25a9c6c3507c
-
Filesize
307KB
MD5e530f7db9e4bdcea56c9bc9a61922a5a
SHA1904b6d85e213a8344685f8de05085c77eab34d30
SHA2561ae73d30a75a61b2c02dff719f0258944841c2e3e8f0ef6efa2f8c4b244951d8
SHA5121a9547e36dae26cdf024a8febaa2f6970cec84d89999d98f21384974a02329dd8cac8c43f4b7fd2f7e00da924c3b20038fcdd718aef817ee2b4e25a9c6c3507c
-
Filesize
365KB
MD56809553befd28601967675c44eafeeab
SHA1bdae22fd794a2c522f4134fbff927370b0022229
SHA25613e1e9ee54410582dd874b81cc51bc42c3be88b54d2cd859ae9a15c516432064
SHA5120d103b8e56702652bbd625191fe4ad784911bf81c6bf271946fccff50a11f59eedcb8fce23398da0389222ccd1d4715130710ca135b926b2566f5034f04377e2
-
Filesize
365KB
MD56809553befd28601967675c44eafeeab
SHA1bdae22fd794a2c522f4134fbff927370b0022229
SHA25613e1e9ee54410582dd874b81cc51bc42c3be88b54d2cd859ae9a15c516432064
SHA5120d103b8e56702652bbd625191fe4ad784911bf81c6bf271946fccff50a11f59eedcb8fce23398da0389222ccd1d4715130710ca135b926b2566f5034f04377e2
-
Filesize
6.0MB
-
Filesize
1.0MB
-
Filesize
5.2MB
-
Filesize
252KB
-
Filesize
1.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
320KB
-
Filesize
472KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
300KB
-
Filesize
248KB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
280KB
-
Filesize
272KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
300KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
3.1MB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
180KB
-
Filesize
64KB
-
Filesize
3.1MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
96KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
5.0MB
-
Filesize
104KB
-
Filesize
200KB
-
Filesize
64KB
-
Filesize
300KB
-
Filesize
64KB