Analysis
-
max time kernel
53s -
max time network
74s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
27-03-2023 15:27
General
-
Target
f3eaae38db2861e74e8e34e4d008b63543193aea3ead2fe3796d125146b25b7c.exe
-
Size
680KB
-
MD5
ab1b5f2489678f478b988fe0721f0e45
-
SHA1
c8286285a08b69b6cd9642751b8f417c1e20ad23
-
SHA256
f3eaae38db2861e74e8e34e4d008b63543193aea3ead2fe3796d125146b25b7c
-
SHA512
52b33c7a12e65bf9a673af11239d33d95c7f67d8c7972c9220e75276333cda8c436ebe6cd27a60f457496782bdfec3d1c261db3f51b417bb534315b18faac288
-
SSDEEP
12288:y6gKv6OXMd+PoUzOyWIuQ9QkYro8uiQhAfwpCQvoWevi7XxCkI0uob/:d5VX3PnrKkYPuphAYsQ1t7XxtIw/
Malware Config
Extracted
redline
sony
193.233.20.33:4125
-
auth_value
1d93d1744381eeb4fcfd7c23ffe0f0b4
Extracted
redline
nice
193.233.20.33:4125
-
auth_value
a7371b75699e8bc7c51fb960e8ac9e81
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 34 IoCs
-
Executes dropped EXE 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 1 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3eaae38db2861e74e8e34e4d008b63543193aea3ead2fe3796d125146b25b7c.exe"C:\Users\Admin\AppData\Local\Temp\f3eaae38db2861e74e8e34e4d008b63543193aea3ead2fe3796d125146b25b7c.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPV5636.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPV5636.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr247149.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr247149.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku493232.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku493232.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr905874.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr905874.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD5ab3003e6ebc98cf86aa495f259303e0f
SHA16366ac26e8598bb949c36a8d7cd22a176f17a791
SHA256dae682152cea59915f784a31d833e3ae3a80e8a0174d9c2d455953d3009f895a
SHA5126d3257c801a240cd348ab6882d9217668d1772ef2aa7c37d67e791fe699b439e47e91135f3d429301172ceea788d610102e7308e75cf9bf2e7f0a49d208ce5ba
-
Filesize
175KB
MD5ab3003e6ebc98cf86aa495f259303e0f
SHA16366ac26e8598bb949c36a8d7cd22a176f17a791
SHA256dae682152cea59915f784a31d833e3ae3a80e8a0174d9c2d455953d3009f895a
SHA5126d3257c801a240cd348ab6882d9217668d1772ef2aa7c37d67e791fe699b439e47e91135f3d429301172ceea788d610102e7308e75cf9bf2e7f0a49d208ce5ba
-
Filesize
403KB
MD5b25155268ddf34f55b5e0a8d1c92de52
SHA15579f1cbc8298290de2a3fc0f9edfb72a7df824b
SHA256e20f4e60e7b8d90552cde344ecb9b034264fb6a212403b56088ec4052afa1d2b
SHA5122ad238414b68286599ec8e040bc43992c11b33299810aab4dc3a1a438def650c4cbe338ae55e1f3f025358f84bf9f6d672ce5b08e44599a4524692dc577afa63
-
Filesize
403KB
MD5b25155268ddf34f55b5e0a8d1c92de52
SHA15579f1cbc8298290de2a3fc0f9edfb72a7df824b
SHA256e20f4e60e7b8d90552cde344ecb9b034264fb6a212403b56088ec4052afa1d2b
SHA5122ad238414b68286599ec8e040bc43992c11b33299810aab4dc3a1a438def650c4cbe338ae55e1f3f025358f84bf9f6d672ce5b08e44599a4524692dc577afa63
-
Filesize
12KB
MD5d81abf887301bc1fd97cc7593348a5bf
SHA14e6d98dd66f1fd734ff958a2ca088cff709f9c74
SHA25691560e84e8e0257ab12db2669eed8c5a5ba3bbaa537be93005aaaaff206bacbe
SHA512d7b5b67ff81c6c9ebaeacac4434fb530933fc5765f32610372d7a15c2a0e137c204065a3ceb1ffd5aa6afc34802b79ad636e98f5660d3b6a3f97bb0a302d2cb2
-
Filesize
12KB
MD5d81abf887301bc1fd97cc7593348a5bf
SHA14e6d98dd66f1fd734ff958a2ca088cff709f9c74
SHA25691560e84e8e0257ab12db2669eed8c5a5ba3bbaa537be93005aaaaff206bacbe
SHA512d7b5b67ff81c6c9ebaeacac4434fb530933fc5765f32610372d7a15c2a0e137c204065a3ceb1ffd5aa6afc34802b79ad636e98f5660d3b6a3f97bb0a302d2cb2
-
Filesize
350KB
MD57a7c172bc39da6195b009137d7074025
SHA1adede58202ac295ceab6cc1e76a8cb9f00236b17
SHA256a77e9383f964ca874c2c5769fa458342bfc9e8586e9f3d7af88bb8c06f793f44
SHA512cf874ad3212d1d6c2d11a0b90677842f65e3c2283a2e7711318b6e13c7473b81c9e83496a4871a5349798d8a1d74d36885907326435aeb578e7ec7ca600898f7
-
Filesize
350KB
MD57a7c172bc39da6195b009137d7074025
SHA1adede58202ac295ceab6cc1e76a8cb9f00236b17
SHA256a77e9383f964ca874c2c5769fa458342bfc9e8586e9f3d7af88bb8c06f793f44
SHA512cf874ad3212d1d6c2d11a0b90677842f65e3c2283a2e7711318b6e13c7473b81c9e83496a4871a5349798d8a1d74d36885907326435aeb578e7ec7ca600898f7
-
Filesize
40KB
-
Filesize
552KB
-
Filesize
3.4MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
272KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
280KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
5.0MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
6.0MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
300KB
-
Filesize
408KB
-
Filesize
584KB
-
Filesize
472KB
-
Filesize
320KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
200KB
-
Filesize
300KB
-
Filesize
64KB