Analysis
-
max time kernel
49s -
max time network
56s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
27-03-2023 23:54
General
-
Target
ee87cb92008da554c8ef4bf21ca92fb4ce507fe6ff434bbad5a057ccf6b48290.exe
-
Size
704KB
-
MD5
685673cb7af8f2241b8dff0e252cc15a
-
SHA1
6896a6e63e3b799b7ad8e7fca712fd084e591a88
-
SHA256
ee87cb92008da554c8ef4bf21ca92fb4ce507fe6ff434bbad5a057ccf6b48290
-
SHA512
4716c250c2708aac39d31b90188cfe25fa8670417852abad35de3bca5b57404967ce73da0b71edbe190e2197a0989ccb0b6c682d4e33736ceb32eddf6c6a8e07
-
SSDEEP
12288:P4I1uIXAI9mewElrO5A/0cw1OZ7wFcW8ChGtMI+vcFFd:P4IXQ6mewcrXZw1OZ7jWFhGCBkD
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 34 IoCs
-
Executes dropped EXE 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 1 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee87cb92008da554c8ef4bf21ca92fb4ce507fe6ff434bbad5a057ccf6b48290.exe"C:\Users\Admin\AppData\Local\Temp\ee87cb92008da554c8ef4bf21ca92fb4ce507fe6ff434bbad5a057ccf6b48290.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziWN9837.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziWN9837.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr442228.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr442228.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku242230.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku242230.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr858066.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr858066.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD51b3d3d0bf1647846b849417c66e1eb61
SHA140f6bdf5d300c13ff57027aacc86e9014411be3d
SHA25632c9fff9e4880f6467fb1f2afb1f8496e249aac09aff74664854ef97c5315f79
SHA51292e1ad76f815de419a37f0b110c60a84e9b84da8aa67697857048303d50e6b8f7b862d51f880600c94a14ca6ad1907c9ea006f44b32c67bc1f42da5b83a63a3c
-
Filesize
175KB
MD51b3d3d0bf1647846b849417c66e1eb61
SHA140f6bdf5d300c13ff57027aacc86e9014411be3d
SHA25632c9fff9e4880f6467fb1f2afb1f8496e249aac09aff74664854ef97c5315f79
SHA51292e1ad76f815de419a37f0b110c60a84e9b84da8aa67697857048303d50e6b8f7b862d51f880600c94a14ca6ad1907c9ea006f44b32c67bc1f42da5b83a63a3c
-
Filesize
412KB
MD5919bda41ac3a51959a04239e18ae15f5
SHA1d22c97a616604dc7b8e40d076d53248c951e01eb
SHA256fe731f162020686b125737a3122f0da5da067d03c96b59518b08f0e378da52cc
SHA51222f6d9efffe89643c8662017b11a608937c112ecf77bb872017deda930b98c84a32a32a84b15eec601216e85c0b72551e19be86c36b591f7abb021f90e3bb29e
-
Filesize
412KB
MD5919bda41ac3a51959a04239e18ae15f5
SHA1d22c97a616604dc7b8e40d076d53248c951e01eb
SHA256fe731f162020686b125737a3122f0da5da067d03c96b59518b08f0e378da52cc
SHA51222f6d9efffe89643c8662017b11a608937c112ecf77bb872017deda930b98c84a32a32a84b15eec601216e85c0b72551e19be86c36b591f7abb021f90e3bb29e
-
Filesize
11KB
MD53411190db00a24305e218735da30dd43
SHA1f3eab1bbd0107864958415ba9540e961d6608ac1
SHA25658414c076a849c89a7bae1b4465cac97e6a5a1d4124acb9e3a72fd17cb955b6c
SHA5127e11fb765506bb47d43c6a0ed4a756ce5cf05751c19b9f7d27efe3ad15a6437dbb9a1fdfc3b771b7596cae96a1b17d01766f214e90fa264194cbfd7bc8e948e8
-
Filesize
11KB
MD53411190db00a24305e218735da30dd43
SHA1f3eab1bbd0107864958415ba9540e961d6608ac1
SHA25658414c076a849c89a7bae1b4465cac97e6a5a1d4124acb9e3a72fd17cb955b6c
SHA5127e11fb765506bb47d43c6a0ed4a756ce5cf05751c19b9f7d27efe3ad15a6437dbb9a1fdfc3b771b7596cae96a1b17d01766f214e90fa264194cbfd7bc8e948e8
-
Filesize
365KB
MD510e54a934dcf8cc1a605932adaa1e52b
SHA1d5159b84191c3b070dd33bb09b8749dddc8bc8db
SHA2568d9f9001387f6f8917dccead652d66d05642c4fa72f07745e0755e4dfda36ccc
SHA51240a0efe89f4246c1c23f5dd701aec060305b99a0734bedf6d612be14e40995f924764e62d9450ca3098e268290485dc75732543939df5699335800115d4e90c1
-
Filesize
365KB
MD510e54a934dcf8cc1a605932adaa1e52b
SHA1d5159b84191c3b070dd33bb09b8749dddc8bc8db
SHA2568d9f9001387f6f8917dccead652d66d05642c4fa72f07745e0755e4dfda36ccc
SHA51240a0efe89f4246c1c23f5dd701aec060305b99a0734bedf6d612be14e40995f924764e62d9450ca3098e268290485dc75732543939df5699335800115d4e90c1
-
Filesize
560KB
-
Filesize
3.4MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
272KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
280KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
5.0MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
6.0MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
248KB
-
Filesize
64KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
408KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
472KB
-
Filesize
320KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
200KB
-
Filesize
300KB
-
Filesize
64KB