Analysis
-
max time kernel
52s -
max time network
146s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
27-03-2023 18:11
General
-
Target
e289012b84f755ea827cb29ae2e9951643c09f06f0f33a2ae8abcf29d3459d69.exe
-
Size
700KB
-
MD5
41acc3686738265f33c685e6108e42bc
-
SHA1
d06788b1e8295dd5594ecad9cfadd2d2f1c0a4ae
-
SHA256
e289012b84f755ea827cb29ae2e9951643c09f06f0f33a2ae8abcf29d3459d69
-
SHA512
9d48227af7e3d56e284f3e4a925bdeb2aaf7e8fb9479ce68d5f719551af78df3bc8ce2440bfa84dfb5960076993b55fe02e698bab5b22cb240d59a140e129f48
-
SSDEEP
12288:4Mr7y90xauQ/EkVBJkiwRyZ/K1hqeCW6KHnNwPVCLpMFF4Jxk3uTaiVL:DynJEmXfwAZ/K1DHnNAV4pMFF4JoCPN
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 21 IoCs
-
Executes dropped EXE 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 2 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e289012b84f755ea827cb29ae2e9951643c09f06f0f33a2ae8abcf29d3459d69.exe"C:\Users\Admin\AppData\Local\Temp\e289012b84f755ea827cb29ae2e9951643c09f06f0f33a2ae8abcf29d3459d69.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un097788.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un097788.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2174.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2174.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6315.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6315.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si599660.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si599660.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD56ad9fa7b49b3b130697e866532d86b2b
SHA148ef54a6b6f9657f313ea90cb199f774f3c44136
SHA25671beece728fdc39c03dca4dd84d30ffe229ca171a66a76dd2452a6ce9434054a
SHA512d8948ba80aa49c5c7a5e6a03dd3721f5055b0cfacc321a35e898602670565047ab746045ea07732d698d841eec9cc70eb97914f00ca301eda3191581054fb396
-
Filesize
175KB
MD56ad9fa7b49b3b130697e866532d86b2b
SHA148ef54a6b6f9657f313ea90cb199f774f3c44136
SHA25671beece728fdc39c03dca4dd84d30ffe229ca171a66a76dd2452a6ce9434054a
SHA512d8948ba80aa49c5c7a5e6a03dd3721f5055b0cfacc321a35e898602670565047ab746045ea07732d698d841eec9cc70eb97914f00ca301eda3191581054fb396
-
Filesize
558KB
MD50889e8610b0de69e17447748591124ce
SHA1caa2176828f6ce4096917c39b3a76746bf3c6f59
SHA2565a0ed8cf3a38efb4129878831995cadde0f315be2ca641442616574b145192f6
SHA512f8ed9fbdb976e88a2a95c64e951ef1392a1bdc3f852e02f5d6b4af138171937dfd1b205d3e4d94d520c2ee3556f0ebb49b30fa980e0b49531cdb123a3c9970e9
-
Filesize
558KB
MD50889e8610b0de69e17447748591124ce
SHA1caa2176828f6ce4096917c39b3a76746bf3c6f59
SHA2565a0ed8cf3a38efb4129878831995cadde0f315be2ca641442616574b145192f6
SHA512f8ed9fbdb976e88a2a95c64e951ef1392a1bdc3f852e02f5d6b4af138171937dfd1b205d3e4d94d520c2ee3556f0ebb49b30fa980e0b49531cdb123a3c9970e9
-
Filesize
307KB
MD514f93888b1b2a8e6cab73a4f34a35433
SHA19853496bb6bdd1683d461bb49fa207a6d4e346e0
SHA256d04c31afdabf41216b7f9f675825deeaa580c40c96eb297ee9ca6a35cb8b218e
SHA5121ce390236dff49074853554d84ce38cb8348ccf164b7faec75ee2b41b665c59d336c2649a5111df9f37f75ca12653ff871b350a52e717110cc4bd7f02ffdd2f0
-
Filesize
307KB
MD514f93888b1b2a8e6cab73a4f34a35433
SHA19853496bb6bdd1683d461bb49fa207a6d4e346e0
SHA256d04c31afdabf41216b7f9f675825deeaa580c40c96eb297ee9ca6a35cb8b218e
SHA5121ce390236dff49074853554d84ce38cb8348ccf164b7faec75ee2b41b665c59d336c2649a5111df9f37f75ca12653ff871b350a52e717110cc4bd7f02ffdd2f0
-
Filesize
366KB
MD55da169740e275c171adb5e35f6d3df3d
SHA12daa25d55c838916018245fe3e98864d8e0ab1e5
SHA25657d4fd15c40963dc5c23ae21dcc8d1714dd8775ed32ec4e8eaa75086d8c5e128
SHA5121d7fb17b34a6cc289141dd2d7614702f035b2da14f81e20d46c2cc70764cca38944e5c8f6f241351299bcc3882d84ca476220fe79c4853f562eab74ebfb28e6f
-
Filesize
366KB
MD55da169740e275c171adb5e35f6d3df3d
SHA12daa25d55c838916018245fe3e98864d8e0ab1e5
SHA25657d4fd15c40963dc5c23ae21dcc8d1714dd8775ed32ec4e8eaa75086d8c5e128
SHA5121d7fb17b34a6cc289141dd2d7614702f035b2da14f81e20d46c2cc70764cca38944e5c8f6f241351299bcc3882d84ca476220fe79c4853f562eab74ebfb28e6f
-
Filesize
6.0MB
-
Filesize
1.0MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
320KB
-
Filesize
472KB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
5.2MB
-
Filesize
1.8MB
-
Filesize
584KB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
300KB
-
Filesize
248KB
-
Filesize
72KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
280KB
-
Filesize
272KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
300KB
-
Filesize
252KB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
200KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
3.1MB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
180KB
-
Filesize
64KB
-
Filesize
3.1MB
-
Filesize
96KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
5.0MB
-
Filesize
104KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
64KB