Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
27-03-2023 16:20
General
-
Target
cb6a51b3cd2bb6faff938a73d11394312a29439899e08823444762137b82b339.exe
-
Size
700KB
-
MD5
a71b3f40e6af3642ae2095897248e533
-
SHA1
940b6a420eabe26341dbc0fbae075b55f6880f30
-
SHA256
cb6a51b3cd2bb6faff938a73d11394312a29439899e08823444762137b82b339
-
SHA512
73b1030aed8e57598b95df8ba4a7b6e34e36160525a1fc09cd23ece1ac4b96bde895b012aad27ebb8020c9536f89ae126b2bd7e26dc7017d70dcaa92b4ebadb7
-
SSDEEP
12288:nMr3y90X4OM+7csJOd2/8h+/uAzq8bjxuAtoicuBRvtzUuV59pAYIYbnC:UygIiOd2Mz23jZuRuhv5MYw
Malware Config
Extracted
redline
sony
193.233.20.33:4125
-
auth_value
1d93d1744381eeb4fcfd7c23ffe0f0b4
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 21 IoCs
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb6a51b3cd2bb6faff938a73d11394312a29439899e08823444762137b82b339.exe"C:\Users\Admin\AppData\Local\Temp\cb6a51b3cd2bb6faff938a73d11394312a29439899e08823444762137b82b339.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un611502.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un611502.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5232.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5232.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6868.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6868.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
558KB
MD577da9168403e94bfbd69d9b7790db942
SHA16c06f7a9538627511d49340adc841bd580cc6486
SHA25640e216579dd814dd8872e1b976967a5bb46ee403fcdd81fbf56c638c2e53768b
SHA512e56d7d2efb8dc9f3296df0f0dd0e34e6ceff22d74cb946ead6189fc769d601f32d38835630b3cc82eee5acb3a3ac7ea7f4d9571910267fd8d874972585c26b34
-
Filesize
558KB
MD577da9168403e94bfbd69d9b7790db942
SHA16c06f7a9538627511d49340adc841bd580cc6486
SHA25640e216579dd814dd8872e1b976967a5bb46ee403fcdd81fbf56c638c2e53768b
SHA512e56d7d2efb8dc9f3296df0f0dd0e34e6ceff22d74cb946ead6189fc769d601f32d38835630b3cc82eee5acb3a3ac7ea7f4d9571910267fd8d874972585c26b34
-
Filesize
308KB
MD51f478246d7793a6bf8ed552df2ea5a85
SHA1db9b07fe158f3bbd8c3cacb47cd4085663ef46c0
SHA256ab5e31e4552f89804bdae0131472486d87ef9a3a5c190f779764c574722b1b15
SHA512911474cae4b0d467a671cbf8313c80124601c6efa1aaa6d2bd92633d114db47dabb3d27c8ac3fcb38e1628046afc3952d0b7d1ee621c0a44a5384ae3f817e458
-
Filesize
308KB
MD51f478246d7793a6bf8ed552df2ea5a85
SHA1db9b07fe158f3bbd8c3cacb47cd4085663ef46c0
SHA256ab5e31e4552f89804bdae0131472486d87ef9a3a5c190f779764c574722b1b15
SHA512911474cae4b0d467a671cbf8313c80124601c6efa1aaa6d2bd92633d114db47dabb3d27c8ac3fcb38e1628046afc3952d0b7d1ee621c0a44a5384ae3f817e458
-
Filesize
366KB
MD5e204aecdea90ae8999ece07aa73ce12d
SHA149ebd9e05df623e8a21161619f9b338e6aa09a9c
SHA25646981fdd51a9551b0980cedf06bb82d7b33067972a593c6f41f397aa3b8b4a0c
SHA512e45eb02acc20796e766e5dc4d60440acc7cc8274c221e0e2355d37455a7645bf11d05cde7e7ab66df634cd352d7ec2e452bcdd0d752d074cbd28072ff510dc53
-
Filesize
366KB
MD5e204aecdea90ae8999ece07aa73ce12d
SHA149ebd9e05df623e8a21161619f9b338e6aa09a9c
SHA25646981fdd51a9551b0980cedf06bb82d7b33067972a593c6f41f397aa3b8b4a0c
SHA512e45eb02acc20796e766e5dc4d60440acc7cc8274c221e0e2355d37455a7645bf11d05cde7e7ab66df634cd352d7ec2e452bcdd0d752d074cbd28072ff510dc53
-
Filesize
72KB
-
Filesize
180KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
3.1MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
3.1MB
-
Filesize
5.0MB
-
Filesize
104KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
280KB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
272KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
6.0MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
64KB
-
Filesize
64KB