Analysis

  • max time kernel
    94s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-03-2023 15:50

General

  • Target

    c4f9bd7209f416a48965ab1f667f98c059dbf6b99007414075e272c64508a9f1.exe

  • Size

    700KB

  • MD5

    fb7128be2a459f0ec1d5c5d1fec02f10

  • SHA1

    14ab361843b2168e566a7178b6cd25419e356e59

  • SHA256

    c4f9bd7209f416a48965ab1f667f98c059dbf6b99007414075e272c64508a9f1

  • SHA512

    b0be4c20cc9204f74db73716ff1a5d4b06e42cd0b6656235d04983aa09cbb8ec315a476fd07c95afb7ac27a0b76029db2b6fd4714d75fcdd719ccc983e606f17

  • SSDEEP

    12288:6MrSy90GfNPozqu9T6mbkdZqAymLmhAOqajl3Khua8tLB+o1kYRBRvTPIYbgiKOV:IydVP89T603mL6rvjl6itLAoeYRXjbgG

Malware Config

Extracted

Family

redline

Botnet

sony

C2

193.233.20.33:4125

Attributes
  • auth_value

    1d93d1744381eeb4fcfd7c23ffe0f0b4

Extracted

Family

redline

Botnet

nice

C2

193.233.20.33:4125

Attributes
  • auth_value

    a7371b75699e8bc7c51fb960e8ac9e81

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c4f9bd7209f416a48965ab1f667f98c059dbf6b99007414075e272c64508a9f1.exe
    "C:\Users\Admin\AppData\Local\Temp\c4f9bd7209f416a48965ab1f667f98c059dbf6b99007414075e272c64508a9f1.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4260
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un682922.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un682922.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4544
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7897.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7897.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1404
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 1084
          4⤵
          • Program crash
          PID:808
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0985.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0985.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3796
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 2000
          4⤵
          • Program crash
          PID:4732
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si221627.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si221627.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:668
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1404 -ip 1404
    1⤵
      PID:904
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3796 -ip 3796
      1⤵
        PID:5112

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si221627.exe

        Filesize

        175KB

        MD5

        6959648898d36fbc60d5d22b9f89107b

        SHA1

        202461078a1d8fe0e992662b963e628c312ea4ac

        SHA256

        49cc6c4f972b37b464c6eb9603b772d60ac0f6fedcc49293bea770e8315c39b7

        SHA512

        9f7a289d3a9b989f4e27f96b8a24baad6ee07609c30adf0ba780176a4608f17ccf77f494daf4562470aa14af47dd4a7acf5dc654c492532bb555089ea8374c85

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si221627.exe

        Filesize

        175KB

        MD5

        6959648898d36fbc60d5d22b9f89107b

        SHA1

        202461078a1d8fe0e992662b963e628c312ea4ac

        SHA256

        49cc6c4f972b37b464c6eb9603b772d60ac0f6fedcc49293bea770e8315c39b7

        SHA512

        9f7a289d3a9b989f4e27f96b8a24baad6ee07609c30adf0ba780176a4608f17ccf77f494daf4562470aa14af47dd4a7acf5dc654c492532bb555089ea8374c85

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un682922.exe

        Filesize

        558KB

        MD5

        c409f25936661bb73bf987e09c577c7e

        SHA1

        7f6d80151fab256cc8a3b1f5dc7637b1981aac22

        SHA256

        4d14eaf8e8c70f02babbc1796ba150f8b256bd8f2e9c87f4de638c079c020d44

        SHA512

        e8d76694691b3c079625f93ce9239a1970aa7968a675b5cda7f388394714eb83723ade65e57fdbde652dc5adcd0ca8070942ff8f9ec8839fd2a87e747e1025f9

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un682922.exe

        Filesize

        558KB

        MD5

        c409f25936661bb73bf987e09c577c7e

        SHA1

        7f6d80151fab256cc8a3b1f5dc7637b1981aac22

        SHA256

        4d14eaf8e8c70f02babbc1796ba150f8b256bd8f2e9c87f4de638c079c020d44

        SHA512

        e8d76694691b3c079625f93ce9239a1970aa7968a675b5cda7f388394714eb83723ade65e57fdbde652dc5adcd0ca8070942ff8f9ec8839fd2a87e747e1025f9

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7897.exe

        Filesize

        308KB

        MD5

        13ec9799ee0b9fc0e79730eaae5b3763

        SHA1

        63d043f8c00cf4a3ab0b91b786aa8f37f3fab3bc

        SHA256

        862af8b337cd2a39d19f11855b94875f0cecfb2ef5414b8bdbfec18a15d7e85d

        SHA512

        62611ecf0d416aae95db0f29da37b455aae4fc7ae9e5d2f2a7b615d6a3c0f76f9fa86131955650588f2078503adb176d41776a44e8b9fe80fed7ffda2cbf31ec

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7897.exe

        Filesize

        308KB

        MD5

        13ec9799ee0b9fc0e79730eaae5b3763

        SHA1

        63d043f8c00cf4a3ab0b91b786aa8f37f3fab3bc

        SHA256

        862af8b337cd2a39d19f11855b94875f0cecfb2ef5414b8bdbfec18a15d7e85d

        SHA512

        62611ecf0d416aae95db0f29da37b455aae4fc7ae9e5d2f2a7b615d6a3c0f76f9fa86131955650588f2078503adb176d41776a44e8b9fe80fed7ffda2cbf31ec

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0985.exe

        Filesize

        366KB

        MD5

        1ebcfab5fa047a0acb065f5c4e32467f

        SHA1

        58575c41039198dba2310f1e3d33cf90b547df94

        SHA256

        8156ac23e7b5f2440e377834b9aa8ec746e3e13d2cf82de2113edd882a03ea19

        SHA512

        ccebf1d446152fce2dfeb02e12489a253be45275f3e090d7da5cdd40e7db6cbd7f163a9c6b68b2f99055afd53b79a4ec3b67be55c3183a4e7bceaa6142ea11e2

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0985.exe

        Filesize

        366KB

        MD5

        1ebcfab5fa047a0acb065f5c4e32467f

        SHA1

        58575c41039198dba2310f1e3d33cf90b547df94

        SHA256

        8156ac23e7b5f2440e377834b9aa8ec746e3e13d2cf82de2113edd882a03ea19

        SHA512

        ccebf1d446152fce2dfeb02e12489a253be45275f3e090d7da5cdd40e7db6cbd7f163a9c6b68b2f99055afd53b79a4ec3b67be55c3183a4e7bceaa6142ea11e2

      • memory/668-1122-0x0000000000550000-0x0000000000582000-memory.dmp

        Filesize

        200KB

      • memory/668-1123-0x0000000005110000-0x0000000005120000-memory.dmp

        Filesize

        64KB

      • memory/1404-159-0x00000000026F0000-0x0000000002702000-memory.dmp

        Filesize

        72KB

      • memory/1404-173-0x00000000026F0000-0x0000000002702000-memory.dmp

        Filesize

        72KB

      • memory/1404-151-0x00000000026F0000-0x0000000002702000-memory.dmp

        Filesize

        72KB

      • memory/1404-153-0x00000000026F0000-0x0000000002702000-memory.dmp

        Filesize

        72KB

      • memory/1404-155-0x00000000026F0000-0x0000000002702000-memory.dmp

        Filesize

        72KB

      • memory/1404-157-0x00000000026F0000-0x0000000002702000-memory.dmp

        Filesize

        72KB

      • memory/1404-149-0x0000000004D00000-0x00000000052A4000-memory.dmp

        Filesize

        5.6MB

      • memory/1404-161-0x00000000026F0000-0x0000000002702000-memory.dmp

        Filesize

        72KB

      • memory/1404-163-0x00000000026F0000-0x0000000002702000-memory.dmp

        Filesize

        72KB

      • memory/1404-165-0x00000000026F0000-0x0000000002702000-memory.dmp

        Filesize

        72KB

      • memory/1404-167-0x00000000026F0000-0x0000000002702000-memory.dmp

        Filesize

        72KB

      • memory/1404-169-0x00000000026F0000-0x0000000002702000-memory.dmp

        Filesize

        72KB

      • memory/1404-171-0x00000000026F0000-0x0000000002702000-memory.dmp

        Filesize

        72KB

      • memory/1404-150-0x00000000026F0000-0x0000000002702000-memory.dmp

        Filesize

        72KB

      • memory/1404-175-0x00000000026F0000-0x0000000002702000-memory.dmp

        Filesize

        72KB

      • memory/1404-177-0x00000000026F0000-0x0000000002702000-memory.dmp

        Filesize

        72KB

      • memory/1404-178-0x0000000002830000-0x0000000002840000-memory.dmp

        Filesize

        64KB

      • memory/1404-179-0x0000000002830000-0x0000000002840000-memory.dmp

        Filesize

        64KB

      • memory/1404-180-0x0000000002830000-0x0000000002840000-memory.dmp

        Filesize

        64KB

      • memory/1404-181-0x0000000000400000-0x0000000000710000-memory.dmp

        Filesize

        3.1MB

      • memory/1404-183-0x0000000002830000-0x0000000002840000-memory.dmp

        Filesize

        64KB

      • memory/1404-184-0x0000000002830000-0x0000000002840000-memory.dmp

        Filesize

        64KB

      • memory/1404-185-0x0000000002830000-0x0000000002840000-memory.dmp

        Filesize

        64KB

      • memory/1404-186-0x0000000000400000-0x0000000000710000-memory.dmp

        Filesize

        3.1MB

      • memory/1404-148-0x0000000000710000-0x000000000073D000-memory.dmp

        Filesize

        180KB

      • memory/3796-191-0x00000000026C0000-0x00000000026FE000-memory.dmp

        Filesize

        248KB

      • memory/3796-357-0x0000000004DA0000-0x0000000004DB0000-memory.dmp

        Filesize

        64KB

      • memory/3796-196-0x00000000026C0000-0x00000000026FE000-memory.dmp

        Filesize

        248KB

      • memory/3796-198-0x00000000026C0000-0x00000000026FE000-memory.dmp

        Filesize

        248KB

      • memory/3796-200-0x00000000026C0000-0x00000000026FE000-memory.dmp

        Filesize

        248KB

      • memory/3796-204-0x00000000026C0000-0x00000000026FE000-memory.dmp

        Filesize

        248KB

      • memory/3796-202-0x00000000026C0000-0x00000000026FE000-memory.dmp

        Filesize

        248KB

      • memory/3796-206-0x00000000026C0000-0x00000000026FE000-memory.dmp

        Filesize

        248KB

      • memory/3796-208-0x00000000026C0000-0x00000000026FE000-memory.dmp

        Filesize

        248KB

      • memory/3796-210-0x00000000026C0000-0x00000000026FE000-memory.dmp

        Filesize

        248KB

      • memory/3796-212-0x00000000026C0000-0x00000000026FE000-memory.dmp

        Filesize

        248KB

      • memory/3796-214-0x00000000026C0000-0x00000000026FE000-memory.dmp

        Filesize

        248KB

      • memory/3796-218-0x00000000026C0000-0x00000000026FE000-memory.dmp

        Filesize

        248KB

      • memory/3796-216-0x00000000026C0000-0x00000000026FE000-memory.dmp

        Filesize

        248KB

      • memory/3796-220-0x00000000026C0000-0x00000000026FE000-memory.dmp

        Filesize

        248KB

      • memory/3796-222-0x00000000026C0000-0x00000000026FE000-memory.dmp

        Filesize

        248KB

      • memory/3796-224-0x00000000026C0000-0x00000000026FE000-memory.dmp

        Filesize

        248KB

      • memory/3796-354-0x0000000000840000-0x000000000088B000-memory.dmp

        Filesize

        300KB

      • memory/3796-355-0x0000000004DA0000-0x0000000004DB0000-memory.dmp

        Filesize

        64KB

      • memory/3796-194-0x00000000026C0000-0x00000000026FE000-memory.dmp

        Filesize

        248KB

      • memory/3796-358-0x0000000004DA0000-0x0000000004DB0000-memory.dmp

        Filesize

        64KB

      • memory/3796-1101-0x0000000005560000-0x0000000005B78000-memory.dmp

        Filesize

        6.1MB

      • memory/3796-1102-0x0000000005B80000-0x0000000005C8A000-memory.dmp

        Filesize

        1.0MB

      • memory/3796-1104-0x0000000004DA0000-0x0000000004DB0000-memory.dmp

        Filesize

        64KB

      • memory/3796-1103-0x0000000004D50000-0x0000000004D62000-memory.dmp

        Filesize

        72KB

      • memory/3796-1105-0x0000000005C90000-0x0000000005CCC000-memory.dmp

        Filesize

        240KB

      • memory/3796-1106-0x0000000005F50000-0x0000000005FE2000-memory.dmp

        Filesize

        584KB

      • memory/3796-1107-0x0000000005FF0000-0x0000000006056000-memory.dmp

        Filesize

        408KB

      • memory/3796-1108-0x0000000006810000-0x00000000069D2000-memory.dmp

        Filesize

        1.8MB

      • memory/3796-1109-0x00000000069F0000-0x0000000006F1C000-memory.dmp

        Filesize

        5.2MB

      • memory/3796-1111-0x0000000004DA0000-0x0000000004DB0000-memory.dmp

        Filesize

        64KB

      • memory/3796-1112-0x0000000004DA0000-0x0000000004DB0000-memory.dmp

        Filesize

        64KB

      • memory/3796-1113-0x0000000004DA0000-0x0000000004DB0000-memory.dmp

        Filesize

        64KB

      • memory/3796-192-0x00000000026C0000-0x00000000026FE000-memory.dmp

        Filesize

        248KB

      • memory/3796-1114-0x0000000004DA0000-0x0000000004DB0000-memory.dmp

        Filesize

        64KB

      • memory/3796-1115-0x0000000007390000-0x0000000007406000-memory.dmp

        Filesize

        472KB

      • memory/3796-1116-0x0000000007420000-0x0000000007470000-memory.dmp

        Filesize

        320KB