Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
27-03-2023 16:17
General
-
Target
7398fba9c05738e6830443a55be15e290091d590136bd5b001989a5446f9f796.exe
-
Size
700KB
-
MD5
6bd3474d74cc15ee8439c043a4dccc31
-
SHA1
c4a2fa40275d7a83b8c2bfed9917bf30af0a70e3
-
SHA256
7398fba9c05738e6830443a55be15e290091d590136bd5b001989a5446f9f796
-
SHA512
76f74d03e742005c64e05b293940b3a2227bf61228705f83d571e7ac134065548b3bc08c42ebf4d7e18d703e3f316538fdd20bd5c9d7f09eed7d58dfa0ef562b
-
SSDEEP
12288:0Mrdy90KeJk7S6W6MHoCjpPA/qR6kIxMOymPbcbPBRvW4h5B67:Zy2JYW6I5pPCXk0y6sPKu5B67
Malware Config
Extracted
redline
sony
193.233.20.33:4125
-
auth_value
1d93d1744381eeb4fcfd7c23ffe0f0b4
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7398fba9c05738e6830443a55be15e290091d590136bd5b001989a5446f9f796.exe"C:\Users\Admin\AppData\Local\Temp\7398fba9c05738e6830443a55be15e290091d590136bd5b001989a5446f9f796.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un537963.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un537963.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1368.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1368.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3481.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3481.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
558KB
MD588a93186ef14cc16e07cb0a07f6edb5a
SHA1a33f4af357e00a3e2c90bdf89895fb52939c7d52
SHA256780cfae8bdfbd22bea35827ce73cb48e74a895e84e80d7086061ceff3bb19f65
SHA5120edee50ef5202c84fa2b5a8f45169b9a8474a074190284c72a75e7b8ef767317fa071661d01c5fc1884ce33296a568edf8bd091fae21df65838e2236158f2807
-
Filesize
558KB
MD588a93186ef14cc16e07cb0a07f6edb5a
SHA1a33f4af357e00a3e2c90bdf89895fb52939c7d52
SHA256780cfae8bdfbd22bea35827ce73cb48e74a895e84e80d7086061ceff3bb19f65
SHA5120edee50ef5202c84fa2b5a8f45169b9a8474a074190284c72a75e7b8ef767317fa071661d01c5fc1884ce33296a568edf8bd091fae21df65838e2236158f2807
-
Filesize
308KB
MD5d28416bfac9716c7eb1eea42f114d3c8
SHA11b87a5fc18976c9b9fe9152acf58ae9985168dd6
SHA2560a816a443ff49be398ec52c896d34ac53ee9f4ce06c55bf5e1408dc4089edcd2
SHA512a12a2854f4ef922661a558c79fbc9fac7669e7066f9408437f452452882f92732fd416ec22944c1a652580a08da8c17ed3945b396aef5eb855e413ca2e2cd506
-
Filesize
308KB
MD5d28416bfac9716c7eb1eea42f114d3c8
SHA11b87a5fc18976c9b9fe9152acf58ae9985168dd6
SHA2560a816a443ff49be398ec52c896d34ac53ee9f4ce06c55bf5e1408dc4089edcd2
SHA512a12a2854f4ef922661a558c79fbc9fac7669e7066f9408437f452452882f92732fd416ec22944c1a652580a08da8c17ed3945b396aef5eb855e413ca2e2cd506
-
Filesize
366KB
MD520ea85df096fef86b81ae29ed4d5d562
SHA12d665f08cf59a770d2393ebb8119649db324a26e
SHA2566ececa3d894fec0447d58bf7f49f33ef39f1d22bdd1cc09f02580060c4b916db
SHA512aa513b94832181c026b021ebdd50388dc9a66b8a25401fc6e2d52fe8cff22225abe6f526cb5a86c6b76b11645d38641ebd554fa6943fa2bfe4f5ae29ba6476d6
-
Filesize
366KB
MD520ea85df096fef86b81ae29ed4d5d562
SHA12d665f08cf59a770d2393ebb8119649db324a26e
SHA2566ececa3d894fec0447d58bf7f49f33ef39f1d22bdd1cc09f02580060c4b916db
SHA512aa513b94832181c026b021ebdd50388dc9a66b8a25401fc6e2d52fe8cff22225abe6f526cb5a86c6b76b11645d38641ebd554fa6943fa2bfe4f5ae29ba6476d6
-
Filesize
104KB
-
Filesize
5.0MB
-
Filesize
96KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
180KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
280KB
-
Filesize
272KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
6.0MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
248KB
-
Filesize
64KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB