Analysis

  • max time kernel
    114s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-03-2023 17:36

General

  • Target

    257c92bb1efa773db8c7bb9c089dd628ad053dbe1d23e5ece82d2292343ff93c.exe

  • Size

    695KB

  • MD5

    9dc56e356c8ddba17d733cb68cca4ccf

  • SHA1

    154b02e22182a56f6fee46258715416029743d0f

  • SHA256

    257c92bb1efa773db8c7bb9c089dd628ad053dbe1d23e5ece82d2292343ff93c

  • SHA512

    1b35d0f6eeba92282b6849c9a03c77ba9a31e2060205fbd0ac902c9cb64abffb98005569e2d89b57d8e856dc97462c62e513d85fe368e9a6ac6954b3211210de

  • SSDEEP

    12288:PMrvy90hVtrXjaW4mlJcN9/nF/7xGNQX3RO9k4jrbK0y18tMil5slnhy12pZFM:QyITtJcrF/7xGNShOnjrbS18tMil5sdy

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

from

C2

176.113.115.145:4125

Attributes
  • auth_value

    8633e283485822a4a48f0a41d5397566

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 18 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\257c92bb1efa773db8c7bb9c089dd628ad053dbe1d23e5ece82d2292343ff93c.exe
    "C:\Users\Admin\AppData\Local\Temp\257c92bb1efa773db8c7bb9c089dd628ad053dbe1d23e5ece82d2292343ff93c.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3204
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un827736.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un827736.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1744
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7222.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7222.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2032
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 1084
          4⤵
          • Program crash
          PID:692
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5684.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5684.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2852
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 1768
          4⤵
          • Program crash
          PID:3976
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si640602.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si640602.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3268
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2032 -ip 2032
    1⤵
      PID:4748
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2852 -ip 2852
      1⤵
        PID:1784

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si640602.exe

        Filesize

        175KB

        MD5

        5cdd46448ed57dce7e99b3c950f99423

        SHA1

        038164c5b4c182ad579f9aed38da8d117c74fd3f

        SHA256

        f93c93820ac31f2bb533f2661669c9a508e5eed7616567855465bbb42bccf231

        SHA512

        8df99c4db1ae001b7499372c7081ca95b57c2f3c8b0aaa5e10cea3633741d6db84724db4e5e1d8232fb919a0c796211abffdab6b0eed9170ef7f353550642705

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si640602.exe

        Filesize

        175KB

        MD5

        5cdd46448ed57dce7e99b3c950f99423

        SHA1

        038164c5b4c182ad579f9aed38da8d117c74fd3f

        SHA256

        f93c93820ac31f2bb533f2661669c9a508e5eed7616567855465bbb42bccf231

        SHA512

        8df99c4db1ae001b7499372c7081ca95b57c2f3c8b0aaa5e10cea3633741d6db84724db4e5e1d8232fb919a0c796211abffdab6b0eed9170ef7f353550642705

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un827736.exe

        Filesize

        554KB

        MD5

        ff53656e50fa11e20664b753779903b8

        SHA1

        ce9bd6748ab6d63d4b30d9de65f5fab22996e740

        SHA256

        44e99346a090610d43b2feded4ce7b7d0b68ce2bd58c0cc04ff7f3cc43d1585f

        SHA512

        0a074ed25781fcda5ce9c3a2e045a8462995dec0ffbca2899b1ccc6b9c556c519c530ca0d1e91ebf5ee47096622ef3d0da3d75f8f32106b00acc0d95394b1efb

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un827736.exe

        Filesize

        554KB

        MD5

        ff53656e50fa11e20664b753779903b8

        SHA1

        ce9bd6748ab6d63d4b30d9de65f5fab22996e740

        SHA256

        44e99346a090610d43b2feded4ce7b7d0b68ce2bd58c0cc04ff7f3cc43d1585f

        SHA512

        0a074ed25781fcda5ce9c3a2e045a8462995dec0ffbca2899b1ccc6b9c556c519c530ca0d1e91ebf5ee47096622ef3d0da3d75f8f32106b00acc0d95394b1efb

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7222.exe

        Filesize

        308KB

        MD5

        f3f42eecd56b14199f05c3551056a4d5

        SHA1

        c14a0c1c7379a2bd3091d1d5d0a01b23056e20ab

        SHA256

        475ef34b1ab26ddadaeb24b5cc6c95c9be5e9e68ddc96cd031b3d0e97b9c1336

        SHA512

        7c3b732119cfd85a97e638ef180e98803939fbc01b57647a02a6686eb663d08db520f6c8085b338fd3014fde0025e90bc53e54b40911d62f9ef00ce2e020139a

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7222.exe

        Filesize

        308KB

        MD5

        f3f42eecd56b14199f05c3551056a4d5

        SHA1

        c14a0c1c7379a2bd3091d1d5d0a01b23056e20ab

        SHA256

        475ef34b1ab26ddadaeb24b5cc6c95c9be5e9e68ddc96cd031b3d0e97b9c1336

        SHA512

        7c3b732119cfd85a97e638ef180e98803939fbc01b57647a02a6686eb663d08db520f6c8085b338fd3014fde0025e90bc53e54b40911d62f9ef00ce2e020139a

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5684.exe

        Filesize

        366KB

        MD5

        26c6986af3f1cfe40d4331b78cbad761

        SHA1

        6600570e2fa48794a8bbfce1e2c24fa683634f52

        SHA256

        4341ca72c5686c3179ebe6cb5cdf7df6e392dba2f45795895cece0076c3badd8

        SHA512

        37c28b30d994e4d1998ed72d699928345b96052194deeeb03d87248817e42039142b0403b0480a4e1ef657c3681480a987de7720390f733c135a95c43f1bfeb1

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5684.exe

        Filesize

        366KB

        MD5

        26c6986af3f1cfe40d4331b78cbad761

        SHA1

        6600570e2fa48794a8bbfce1e2c24fa683634f52

        SHA256

        4341ca72c5686c3179ebe6cb5cdf7df6e392dba2f45795895cece0076c3badd8

        SHA512

        37c28b30d994e4d1998ed72d699928345b96052194deeeb03d87248817e42039142b0403b0480a4e1ef657c3681480a987de7720390f733c135a95c43f1bfeb1

      • memory/2032-148-0x0000000004F10000-0x00000000054B4000-memory.dmp

        Filesize

        5.6MB

      • memory/2032-149-0x00000000020C0000-0x00000000020ED000-memory.dmp

        Filesize

        180KB

      • memory/2032-150-0x0000000004F00000-0x0000000004F10000-memory.dmp

        Filesize

        64KB

      • memory/2032-151-0x0000000004F00000-0x0000000004F10000-memory.dmp

        Filesize

        64KB

      • memory/2032-152-0x0000000004F00000-0x0000000004F10000-memory.dmp

        Filesize

        64KB

      • memory/2032-153-0x0000000002830000-0x0000000002842000-memory.dmp

        Filesize

        72KB

      • memory/2032-154-0x0000000002830000-0x0000000002842000-memory.dmp

        Filesize

        72KB

      • memory/2032-156-0x0000000002830000-0x0000000002842000-memory.dmp

        Filesize

        72KB

      • memory/2032-158-0x0000000002830000-0x0000000002842000-memory.dmp

        Filesize

        72KB

      • memory/2032-160-0x0000000002830000-0x0000000002842000-memory.dmp

        Filesize

        72KB

      • memory/2032-162-0x0000000002830000-0x0000000002842000-memory.dmp

        Filesize

        72KB

      • memory/2032-164-0x0000000002830000-0x0000000002842000-memory.dmp

        Filesize

        72KB

      • memory/2032-166-0x0000000002830000-0x0000000002842000-memory.dmp

        Filesize

        72KB

      • memory/2032-168-0x0000000002830000-0x0000000002842000-memory.dmp

        Filesize

        72KB

      • memory/2032-170-0x0000000002830000-0x0000000002842000-memory.dmp

        Filesize

        72KB

      • memory/2032-172-0x0000000002830000-0x0000000002842000-memory.dmp

        Filesize

        72KB

      • memory/2032-174-0x0000000002830000-0x0000000002842000-memory.dmp

        Filesize

        72KB

      • memory/2032-176-0x0000000002830000-0x0000000002842000-memory.dmp

        Filesize

        72KB

      • memory/2032-178-0x0000000002830000-0x0000000002842000-memory.dmp

        Filesize

        72KB

      • memory/2032-180-0x0000000002830000-0x0000000002842000-memory.dmp

        Filesize

        72KB

      • memory/2032-181-0x0000000000400000-0x0000000000710000-memory.dmp

        Filesize

        3.1MB

      • memory/2032-183-0x0000000004F00000-0x0000000004F10000-memory.dmp

        Filesize

        64KB

      • memory/2032-182-0x0000000004F00000-0x0000000004F10000-memory.dmp

        Filesize

        64KB

      • memory/2032-185-0x0000000000400000-0x0000000000710000-memory.dmp

        Filesize

        3.1MB

      • memory/2852-190-0x0000000004C30000-0x0000000004C6F000-memory.dmp

        Filesize

        252KB

      • memory/2852-193-0x0000000004C30000-0x0000000004C6F000-memory.dmp

        Filesize

        252KB

      • memory/2852-191-0x0000000004C30000-0x0000000004C6F000-memory.dmp

        Filesize

        252KB

      • memory/2852-195-0x0000000004C30000-0x0000000004C6F000-memory.dmp

        Filesize

        252KB

      • memory/2852-197-0x0000000004C30000-0x0000000004C6F000-memory.dmp

        Filesize

        252KB

      • memory/2852-199-0x00000000007F0000-0x000000000083B000-memory.dmp

        Filesize

        300KB

      • memory/2852-201-0x0000000004C70000-0x0000000004C80000-memory.dmp

        Filesize

        64KB

      • memory/2852-203-0x0000000004C70000-0x0000000004C80000-memory.dmp

        Filesize

        64KB

      • memory/2852-200-0x0000000004C30000-0x0000000004C6F000-memory.dmp

        Filesize

        252KB

      • memory/2852-204-0x0000000004C30000-0x0000000004C6F000-memory.dmp

        Filesize

        252KB

      • memory/2852-208-0x0000000004C30000-0x0000000004C6F000-memory.dmp

        Filesize

        252KB

      • memory/2852-206-0x0000000004C30000-0x0000000004C6F000-memory.dmp

        Filesize

        252KB

      • memory/2852-210-0x0000000004C30000-0x0000000004C6F000-memory.dmp

        Filesize

        252KB

      • memory/2852-212-0x0000000004C30000-0x0000000004C6F000-memory.dmp

        Filesize

        252KB

      • memory/2852-214-0x0000000004C30000-0x0000000004C6F000-memory.dmp

        Filesize

        252KB

      • memory/2852-216-0x0000000004C30000-0x0000000004C6F000-memory.dmp

        Filesize

        252KB

      • memory/2852-218-0x0000000004C30000-0x0000000004C6F000-memory.dmp

        Filesize

        252KB

      • memory/2852-220-0x0000000004C30000-0x0000000004C6F000-memory.dmp

        Filesize

        252KB

      • memory/2852-222-0x0000000004C30000-0x0000000004C6F000-memory.dmp

        Filesize

        252KB

      • memory/2852-224-0x0000000004C30000-0x0000000004C6F000-memory.dmp

        Filesize

        252KB

      • memory/2852-226-0x0000000004C30000-0x0000000004C6F000-memory.dmp

        Filesize

        252KB

      • memory/2852-1099-0x0000000005470000-0x0000000005A88000-memory.dmp

        Filesize

        6.1MB

      • memory/2852-1100-0x0000000005B00000-0x0000000005C0A000-memory.dmp

        Filesize

        1.0MB

      • memory/2852-1101-0x0000000005C40000-0x0000000005C52000-memory.dmp

        Filesize

        72KB

      • memory/2852-1102-0x0000000005C60000-0x0000000005C9C000-memory.dmp

        Filesize

        240KB

      • memory/2852-1103-0x0000000004C70000-0x0000000004C80000-memory.dmp

        Filesize

        64KB

      • memory/2852-1104-0x0000000005F50000-0x0000000005FB6000-memory.dmp

        Filesize

        408KB

      • memory/2852-1105-0x0000000006610000-0x00000000066A2000-memory.dmp

        Filesize

        584KB

      • memory/2852-1107-0x0000000004C70000-0x0000000004C80000-memory.dmp

        Filesize

        64KB

      • memory/2852-1108-0x0000000004C70000-0x0000000004C80000-memory.dmp

        Filesize

        64KB

      • memory/2852-1109-0x0000000004C70000-0x0000000004C80000-memory.dmp

        Filesize

        64KB

      • memory/2852-1110-0x00000000067F0000-0x0000000006866000-memory.dmp

        Filesize

        472KB

      • memory/2852-1111-0x0000000006880000-0x00000000068D0000-memory.dmp

        Filesize

        320KB

      • memory/2852-1112-0x0000000004C70000-0x0000000004C80000-memory.dmp

        Filesize

        64KB

      • memory/2852-1113-0x0000000007BC0000-0x0000000007D82000-memory.dmp

        Filesize

        1.8MB

      • memory/2852-1114-0x0000000007D90000-0x00000000082BC000-memory.dmp

        Filesize

        5.2MB

      • memory/3268-1120-0x0000000000610000-0x0000000000642000-memory.dmp

        Filesize

        200KB

      • memory/3268-1121-0x0000000004F20000-0x0000000004F30000-memory.dmp

        Filesize

        64KB

      • memory/3268-1122-0x0000000004F20000-0x0000000004F30000-memory.dmp

        Filesize

        64KB