Analysis
-
max time kernel
57s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
27-03-2023 23:25
General
-
Target
d9488427707a4265a6798f28bb6ef5b785c0f1b4b3774316f284fe7924e432cf.exe
-
Size
700KB
-
MD5
de2f6c36c6e5930613bf5a2481677344
-
SHA1
5323fbe08707afe1e00a3aa1ebdc1eeeb0b53964
-
SHA256
d9488427707a4265a6798f28bb6ef5b785c0f1b4b3774316f284fe7924e432cf
-
SHA512
093491a396a566c70f59cb8edb5486a651adb4d06a66a7d6a665abf61681dcdbef298d44452966c35c41531ed405e95f2bfd17330475f4402d191503a207f912
-
SSDEEP
12288:GMr9y90p5lEFV0OsvDVNG59DGTcAGuA8F3UTE9uZc3ixgt0L3:DyZviDVN7G58VH9uK3ixz
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 21 IoCs
-
Executes dropped EXE 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 2 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9488427707a4265a6798f28bb6ef5b785c0f1b4b3774316f284fe7924e432cf.exe"C:\Users\Admin\AppData\Local\Temp\d9488427707a4265a6798f28bb6ef5b785c0f1b4b3774316f284fe7924e432cf.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un365905.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un365905.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7626.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7626.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8482.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8482.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si006095.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si006095.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD54cee8bb49c8eccc42d380d62c9cdf4d7
SHA14cc290b2425fbab806b2dd63c257aebffd5dbc33
SHA256f8014d5364a76c45281a91fdb3839914126bba5c958d47e4fe393d40925e24a3
SHA51299830710c3c64edc9692bf9a0fad13d58d51d5b5e66957ef8e67b60e262fc292568d9dcd2d59c6965e22450a48b746d716addc21f5c07e8f8dac3550c6f2a146
-
Filesize
175KB
MD54cee8bb49c8eccc42d380d62c9cdf4d7
SHA14cc290b2425fbab806b2dd63c257aebffd5dbc33
SHA256f8014d5364a76c45281a91fdb3839914126bba5c958d47e4fe393d40925e24a3
SHA51299830710c3c64edc9692bf9a0fad13d58d51d5b5e66957ef8e67b60e262fc292568d9dcd2d59c6965e22450a48b746d716addc21f5c07e8f8dac3550c6f2a146
-
Filesize
558KB
MD53f27745489033e1f3c4dc3a5b8bf97d0
SHA105541870f58770553d5196b7af8e1d54ed23cd73
SHA2561e0ad32496d317f49c1f2ca323c6a16f294b298afb168782af97521b70b1e6e4
SHA51250dcc80d4aa1e8d49630e3f72ae4e4579c656cc6d63c35baf47ad28b90b111eb9f9fa14bf56616788aef72fe1e88313c475f68e5f7d55b2e7121b204ab4d27fc
-
Filesize
558KB
MD53f27745489033e1f3c4dc3a5b8bf97d0
SHA105541870f58770553d5196b7af8e1d54ed23cd73
SHA2561e0ad32496d317f49c1f2ca323c6a16f294b298afb168782af97521b70b1e6e4
SHA51250dcc80d4aa1e8d49630e3f72ae4e4579c656cc6d63c35baf47ad28b90b111eb9f9fa14bf56616788aef72fe1e88313c475f68e5f7d55b2e7121b204ab4d27fc
-
Filesize
307KB
MD5dfe1de0e45e77954c4962b26e78b8155
SHA175ea624aa6e027bde0be2af7b414fea8da9bd659
SHA2563806f610eafb581a0ee7081ec664d67efe5be40916a6ae0b7f1ad12577a7d351
SHA51259f369d17becd39e63a1b41041fb0ea7c6e8dc582d0d8f2cc03cd1eea4de47280a63b114ed2044881fb8eab23e808146770b433c1a4f66acb649ffb7b6aca4fc
-
Filesize
307KB
MD5dfe1de0e45e77954c4962b26e78b8155
SHA175ea624aa6e027bde0be2af7b414fea8da9bd659
SHA2563806f610eafb581a0ee7081ec664d67efe5be40916a6ae0b7f1ad12577a7d351
SHA51259f369d17becd39e63a1b41041fb0ea7c6e8dc582d0d8f2cc03cd1eea4de47280a63b114ed2044881fb8eab23e808146770b433c1a4f66acb649ffb7b6aca4fc
-
Filesize
365KB
MD57d702fc23e73cd9b1153809a76fc7fbb
SHA16ca9cb3003d216ce00d92ea74635a73e34ab49a4
SHA256ba22b16a1616be6dcb9926ea9fb33d1218e748dd0423500faf52760a655d6aab
SHA512b9c4b0e0a26b6d0738f72a89bd65063e04b80cb2e1e1660fa691d93ce00ab5c04c3300a2f0303877c69f9196ef19d70c824ee286d0b3c6dae6c12158eb9e3a78
-
Filesize
365KB
MD57d702fc23e73cd9b1153809a76fc7fbb
SHA16ca9cb3003d216ce00d92ea74635a73e34ab49a4
SHA256ba22b16a1616be6dcb9926ea9fb33d1218e748dd0423500faf52760a655d6aab
SHA512b9c4b0e0a26b6d0738f72a89bd65063e04b80cb2e1e1660fa691d93ce00ab5c04c3300a2f0303877c69f9196ef19d70c824ee286d0b3c6dae6c12158eb9e3a78
-
Filesize
64KB
-
Filesize
300KB
-
Filesize
200KB
-
Filesize
6.0MB
-
Filesize
248KB
-
Filesize
64KB
-
Filesize
320KB
-
Filesize
472KB
-
Filesize
5.2MB
-
Filesize
1.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
300KB
-
Filesize
72KB
-
Filesize
1.0MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
280KB
-
Filesize
272KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
72KB
-
Filesize
104KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
3.1MB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
3.1MB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
180KB
-
Filesize
96KB
-
Filesize
5.0MB
-
Filesize
72KB