Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
27-03-2023 16:51
General
-
Target
0dbe073c6ae4a80af04922a048094daeabfbb5d634908aaabb99e34e0972261d.exe
-
Size
700KB
-
MD5
4f4fa1b1e67b102bd08a7461b8b7d663
-
SHA1
c884129e2fdb124615c5305a008cf14fbbca86a4
-
SHA256
0dbe073c6ae4a80af04922a048094daeabfbb5d634908aaabb99e34e0972261d
-
SHA512
5e873f7ced8a60af623082bb5c08747adaeb47812a5cb289a01b601d3133436c64c73e8d0b96b79d0035d45108651ca350ab179f79faa92e87424b16d4c2daf1
-
SSDEEP
12288:eMr6y90FD9Wk9q7BS9LJ0+pHVKHqGVHV2cu4dhrxwP4BRvwJ55TycsZV68wegOw:MyKeGGu4KGLjxwP4cJ5tjs/6V
Malware Config
Extracted
redline
sony
193.233.20.33:4125
-
auth_value
1d93d1744381eeb4fcfd7c23ffe0f0b4
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 21 IoCs
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0dbe073c6ae4a80af04922a048094daeabfbb5d634908aaabb99e34e0972261d.exe"C:\Users\Admin\AppData\Local\Temp\0dbe073c6ae4a80af04922a048094daeabfbb5d634908aaabb99e34e0972261d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un376479.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un376479.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7974.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7974.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3404.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3404.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
558KB
MD5872f9ea117bad7307eae3e4038843478
SHA1794a82771b3b9838e5f2657fc60d210be60c53f8
SHA256a2891d86f0fcd966906ab90aa83a512ef4bbecfdff2c416226d2b029ef0e90a5
SHA5124d52812bee958177e2cb419cbe7b012e213cbdc0a2e6e026a3dd3da5d8e5347e8edae5545c9d54fbe132ea8f7d2f266844d6651d6bbabf05eb72910d4c882a49
-
Filesize
558KB
MD5872f9ea117bad7307eae3e4038843478
SHA1794a82771b3b9838e5f2657fc60d210be60c53f8
SHA256a2891d86f0fcd966906ab90aa83a512ef4bbecfdff2c416226d2b029ef0e90a5
SHA5124d52812bee958177e2cb419cbe7b012e213cbdc0a2e6e026a3dd3da5d8e5347e8edae5545c9d54fbe132ea8f7d2f266844d6651d6bbabf05eb72910d4c882a49
-
Filesize
308KB
MD544fbd0a6ad46079a01984ddab80ddc98
SHA1212888ad18e772a22e4b0c4e01c6417cf13df636
SHA2564a5d7f932161770da5b746ae8af772527b1a3505c429297c8ba04166505cfad1
SHA5123d84f2ee122049ffbbb430c5803c56c03bb33ce7a850f125279c36b5a0274cefe46297b6d49e1621a4023050b426ce9bac5409254e0f2f5159e8db9a6f4cfa70
-
Filesize
308KB
MD544fbd0a6ad46079a01984ddab80ddc98
SHA1212888ad18e772a22e4b0c4e01c6417cf13df636
SHA2564a5d7f932161770da5b746ae8af772527b1a3505c429297c8ba04166505cfad1
SHA5123d84f2ee122049ffbbb430c5803c56c03bb33ce7a850f125279c36b5a0274cefe46297b6d49e1621a4023050b426ce9bac5409254e0f2f5159e8db9a6f4cfa70
-
Filesize
366KB
MD53dacd10becab3626127c9e2de7fcd594
SHA15342ffbbd1ef197a7e25a304d166cef7ff2da9f9
SHA256673aa1fe5e34de2b7badc43a2fedc789cf190d57e543601a29446aaf5fdccbb6
SHA512407a56da33a917ae2a5e971af84e26de03176cc774c9f10142981304989c58318ff22509e79a9eae9f7220bd886a4d7679b3cac831189d68a7b231a8453a6efb
-
Filesize
366KB
MD53dacd10becab3626127c9e2de7fcd594
SHA15342ffbbd1ef197a7e25a304d166cef7ff2da9f9
SHA256673aa1fe5e34de2b7badc43a2fedc789cf190d57e543601a29446aaf5fdccbb6
SHA512407a56da33a917ae2a5e971af84e26de03176cc774c9f10142981304989c58318ff22509e79a9eae9f7220bd886a4d7679b3cac831189d68a7b231a8453a6efb
-
Filesize
180KB
-
Filesize
104KB
-
Filesize
5.0MB
-
Filesize
96KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
280KB
-
Filesize
272KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
6.0MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
248KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB