Analysis

  • max time kernel
    59s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-03-2023 20:16

General

  • Target

    4a6c509011d3ee93d696bbf9611ac02e80e4238e666d51083d782e67d0119e1a.exe

  • Size

    695KB

  • MD5

    7af23cf5fdb1719d672745444cb60665

  • SHA1

    5cd72549348625529d99839933688a20e6434a50

  • SHA256

    4a6c509011d3ee93d696bbf9611ac02e80e4238e666d51083d782e67d0119e1a

  • SHA512

    84635b722d88c65a8cef5e2452e5082d238dacd14ce9008251c8380d4c446496296c3f31c9aaa2b422acdd59026f6b1aecdde752beae2ee127d765a626ffdc78

  • SSDEEP

    12288:8Mrby90h6Zk5okfpVmakRK+6ZDt2YYcluPl/KA/f/hQQFzR3JJvpktHu4iC:Xyy6Zk5o6VmakRKJZxtYclel/pX/tFRm

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

from

C2

176.113.115.145:4125

Attributes
  • auth_value

    8633e283485822a4a48f0a41d5397566

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 19 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4a6c509011d3ee93d696bbf9611ac02e80e4238e666d51083d782e67d0119e1a.exe
    "C:\Users\Admin\AppData\Local\Temp\4a6c509011d3ee93d696bbf9611ac02e80e4238e666d51083d782e67d0119e1a.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2492
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un465584.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un465584.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:228
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2977.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2977.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3028
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0379.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0379.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1244
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si463531.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si463531.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3944

Network

  • flag-us
    DNS
    217.106.137.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.106.137.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    36.146.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    36.146.190.20.in-addr.arpa
    IN PTR
    Response
    36.146.190.20.in-addr.arpa
    IN CNAME
    36.0-26.146.190.20.in-addr.arpa
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    209.205.72.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    209.205.72.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    104.219.191.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    104.219.191.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    145.115.113.176.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    145.115.113.176.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    86.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    86.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    44.8.109.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    44.8.109.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    2.36.159.162.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    2.36.159.162.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    226.101.242.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    226.101.242.52.in-addr.arpa
    IN PTR
    Response
  • 176.113.115.145:4125
    qu0379.exe
    1.3MB
    21.9kB
    986
    393
  • 176.113.115.145:4125
    si463531.exe
    1.3MB
    25.1kB
    992
    430
  • 52.152.108.96:443
    260 B
    5
  • 40.79.141.154:443
    322 B
    7
  • 93.184.221.240:80
    322 B
    7
  • 93.184.221.240:80
    322 B
    7
  • 93.184.221.240:80
    322 B
    7
  • 173.223.113.164:443
    322 B
    7
  • 173.223.113.131:80
    322 B
    7
  • 204.79.197.203:80
    322 B
    7
  • 8.8.8.8:53
    217.106.137.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    217.106.137.52.in-addr.arpa

  • 8.8.8.8:53
    36.146.190.20.in-addr.arpa
    dns
    72 B
    168 B
    1
    1

    DNS Request

    36.146.190.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    209.205.72.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    209.205.72.20.in-addr.arpa

  • 8.8.8.8:53
    104.219.191.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    104.219.191.52.in-addr.arpa

  • 8.8.8.8:53
    145.115.113.176.in-addr.arpa
    dns
    74 B
    134 B
    1
    1

    DNS Request

    145.115.113.176.in-addr.arpa

  • 8.8.8.8:53
    86.23.85.13.in-addr.arpa
    dns
    70 B
    144 B
    1
    1

    DNS Request

    86.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    18.31.95.13.in-addr.arpa
    dns
    70 B
    144 B
    1
    1

    DNS Request

    18.31.95.13.in-addr.arpa

  • 8.8.8.8:53
    44.8.109.52.in-addr.arpa
    dns
    70 B
    144 B
    1
    1

    DNS Request

    44.8.109.52.in-addr.arpa

  • 8.8.8.8:53
    2.36.159.162.in-addr.arpa
    dns
    71 B
    133 B
    1
    1

    DNS Request

    2.36.159.162.in-addr.arpa

  • 8.8.8.8:53
    226.101.242.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    226.101.242.52.in-addr.arpa

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si463531.exe

    Filesize

    175KB

    MD5

    84772ccc983c5ce29df2dc94cbaa5c83

    SHA1

    3241cde2f727418ddbabb9badc0bb651a1e6ef9b

    SHA256

    82e78d1eb5e64abab80c2d3393ee2bce79d90ce3e7f3fffce7b0df02b251f1e7

    SHA512

    72df0ce39a546a910f200b97436d281b25278ec25e9b902441667fa24498d4acd069b210623a6bae0ca90b98dd9f67825355f6fc4b80dc97a9725b74924623c0

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si463531.exe

    Filesize

    175KB

    MD5

    84772ccc983c5ce29df2dc94cbaa5c83

    SHA1

    3241cde2f727418ddbabb9badc0bb651a1e6ef9b

    SHA256

    82e78d1eb5e64abab80c2d3393ee2bce79d90ce3e7f3fffce7b0df02b251f1e7

    SHA512

    72df0ce39a546a910f200b97436d281b25278ec25e9b902441667fa24498d4acd069b210623a6bae0ca90b98dd9f67825355f6fc4b80dc97a9725b74924623c0

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un465584.exe

    Filesize

    553KB

    MD5

    b9ec853afeb979cc6bef1995837d4d38

    SHA1

    e294a2c711dafbe25786f793d65682ffa2c4c255

    SHA256

    c6c4696013853b05dddb9d0a4ac8b3ec497e504c5a128c4262b5af0ee6231d3f

    SHA512

    b6f1e808f596b5f5c387d2ec7153a81f8dede9644066cf51e0cc884d4f3117340cc3b397bd91870b260270ca84a9b931d4f53ad4c7aade51f83d8d444165a9f7

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un465584.exe

    Filesize

    553KB

    MD5

    b9ec853afeb979cc6bef1995837d4d38

    SHA1

    e294a2c711dafbe25786f793d65682ffa2c4c255

    SHA256

    c6c4696013853b05dddb9d0a4ac8b3ec497e504c5a128c4262b5af0ee6231d3f

    SHA512

    b6f1e808f596b5f5c387d2ec7153a81f8dede9644066cf51e0cc884d4f3117340cc3b397bd91870b260270ca84a9b931d4f53ad4c7aade51f83d8d444165a9f7

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2977.exe

    Filesize

    308KB

    MD5

    5ae343a6269dede83d3f4bb912363ca9

    SHA1

    4c378ac8f450d60f7039056d4de278f3af37368e

    SHA256

    a1916e1ef75f55e36b3716b3f598cb4c3ebc9e3d4595074f518d18833e344788

    SHA512

    84e6b161e29c887a996521368afb193ee371c20df56f79d88e4f64c96a3e165567cfbe194bb95046c61421e7f859b9bd1cd10413a69b4c0745df0bc9ac40deec

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2977.exe

    Filesize

    308KB

    MD5

    5ae343a6269dede83d3f4bb912363ca9

    SHA1

    4c378ac8f450d60f7039056d4de278f3af37368e

    SHA256

    a1916e1ef75f55e36b3716b3f598cb4c3ebc9e3d4595074f518d18833e344788

    SHA512

    84e6b161e29c887a996521368afb193ee371c20df56f79d88e4f64c96a3e165567cfbe194bb95046c61421e7f859b9bd1cd10413a69b4c0745df0bc9ac40deec

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0379.exe

    Filesize

    366KB

    MD5

    1199dc0f5ac7d72b7aaf6e2fcf405fa5

    SHA1

    e602d94573c1e4b402ec99ff9a0a860bc3f7e94e

    SHA256

    c87aef107ceac671d0dca372eb89caac79ff18ee6804eeee11692805c3136f8c

    SHA512

    52a60b4f5e852613e4655f79e4a6eda27312b9da922c3f2a022612b1fb562d50d5ee43a74e8751d074179b6b9850b404d1fe7006f4fa3b9860c16a517a999d4e

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0379.exe

    Filesize

    366KB

    MD5

    1199dc0f5ac7d72b7aaf6e2fcf405fa5

    SHA1

    e602d94573c1e4b402ec99ff9a0a860bc3f7e94e

    SHA256

    c87aef107ceac671d0dca372eb89caac79ff18ee6804eeee11692805c3136f8c

    SHA512

    52a60b4f5e852613e4655f79e4a6eda27312b9da922c3f2a022612b1fb562d50d5ee43a74e8751d074179b6b9850b404d1fe7006f4fa3b9860c16a517a999d4e

  • memory/1244-1099-0x0000000005B50000-0x0000000005C5A000-memory.dmp

    Filesize

    1.0MB

  • memory/1244-1102-0x0000000005C60000-0x0000000005C9C000-memory.dmp

    Filesize

    240KB

  • memory/1244-1113-0x0000000007360000-0x00000000073B0000-memory.dmp

    Filesize

    320KB

  • memory/1244-1112-0x00000000072E0000-0x0000000007356000-memory.dmp

    Filesize

    472KB

  • memory/1244-1111-0x0000000004F70000-0x0000000004F80000-memory.dmp

    Filesize

    64KB

  • memory/1244-1110-0x0000000006B30000-0x000000000705C000-memory.dmp

    Filesize

    5.2MB

  • memory/1244-1109-0x0000000006950000-0x0000000006B12000-memory.dmp

    Filesize

    1.8MB

  • memory/1244-1108-0x0000000004F70000-0x0000000004F80000-memory.dmp

    Filesize

    64KB

  • memory/1244-1107-0x0000000004F70000-0x0000000004F80000-memory.dmp

    Filesize

    64KB

  • memory/1244-1106-0x0000000004F70000-0x0000000004F80000-memory.dmp

    Filesize

    64KB

  • memory/1244-1104-0x0000000005FF0000-0x0000000006056000-memory.dmp

    Filesize

    408KB

  • memory/1244-1103-0x0000000005F50000-0x0000000005FE2000-memory.dmp

    Filesize

    584KB

  • memory/1244-1101-0x0000000004F70000-0x0000000004F80000-memory.dmp

    Filesize

    64KB

  • memory/1244-1100-0x0000000004F50000-0x0000000004F62000-memory.dmp

    Filesize

    72KB

  • memory/1244-1098-0x0000000005530000-0x0000000005B48000-memory.dmp

    Filesize

    6.1MB

  • memory/1244-273-0x0000000004F70000-0x0000000004F80000-memory.dmp

    Filesize

    64KB

  • memory/1244-269-0x0000000004F70000-0x0000000004F80000-memory.dmp

    Filesize

    64KB

  • memory/1244-271-0x0000000004F70000-0x0000000004F80000-memory.dmp

    Filesize

    64KB

  • memory/1244-267-0x0000000000770000-0x00000000007BB000-memory.dmp

    Filesize

    300KB

  • memory/1244-221-0x00000000028E0000-0x000000000291F000-memory.dmp

    Filesize

    252KB

  • memory/1244-188-0x00000000028E0000-0x000000000291F000-memory.dmp

    Filesize

    252KB

  • memory/1244-189-0x00000000028E0000-0x000000000291F000-memory.dmp

    Filesize

    252KB

  • memory/1244-191-0x00000000028E0000-0x000000000291F000-memory.dmp

    Filesize

    252KB

  • memory/1244-193-0x00000000028E0000-0x000000000291F000-memory.dmp

    Filesize

    252KB

  • memory/1244-195-0x00000000028E0000-0x000000000291F000-memory.dmp

    Filesize

    252KB

  • memory/1244-197-0x00000000028E0000-0x000000000291F000-memory.dmp

    Filesize

    252KB

  • memory/1244-199-0x00000000028E0000-0x000000000291F000-memory.dmp

    Filesize

    252KB

  • memory/1244-201-0x00000000028E0000-0x000000000291F000-memory.dmp

    Filesize

    252KB

  • memory/1244-205-0x00000000028E0000-0x000000000291F000-memory.dmp

    Filesize

    252KB

  • memory/1244-203-0x00000000028E0000-0x000000000291F000-memory.dmp

    Filesize

    252KB

  • memory/1244-207-0x00000000028E0000-0x000000000291F000-memory.dmp

    Filesize

    252KB

  • memory/1244-209-0x00000000028E0000-0x000000000291F000-memory.dmp

    Filesize

    252KB

  • memory/1244-211-0x00000000028E0000-0x000000000291F000-memory.dmp

    Filesize

    252KB

  • memory/1244-213-0x00000000028E0000-0x000000000291F000-memory.dmp

    Filesize

    252KB

  • memory/1244-215-0x00000000028E0000-0x000000000291F000-memory.dmp

    Filesize

    252KB

  • memory/1244-217-0x00000000028E0000-0x000000000291F000-memory.dmp

    Filesize

    252KB

  • memory/1244-219-0x00000000028E0000-0x000000000291F000-memory.dmp

    Filesize

    252KB

  • memory/3028-171-0x0000000002690000-0x00000000026A2000-memory.dmp

    Filesize

    72KB

  • memory/3028-148-0x0000000000710000-0x000000000073D000-memory.dmp

    Filesize

    180KB

  • memory/3028-183-0x0000000000400000-0x000000000070F000-memory.dmp

    Filesize

    3.1MB

  • memory/3028-181-0x0000000000400000-0x000000000070F000-memory.dmp

    Filesize

    3.1MB

  • memory/3028-180-0x0000000002580000-0x0000000002590000-memory.dmp

    Filesize

    64KB

  • memory/3028-178-0x0000000002690000-0x00000000026A2000-memory.dmp

    Filesize

    72KB

  • memory/3028-150-0x0000000002690000-0x00000000026A2000-memory.dmp

    Filesize

    72KB

  • memory/3028-179-0x0000000002580000-0x0000000002590000-memory.dmp

    Filesize

    64KB

  • memory/3028-177-0x0000000002580000-0x0000000002590000-memory.dmp

    Filesize

    64KB

  • memory/3028-155-0x0000000002690000-0x00000000026A2000-memory.dmp

    Filesize

    72KB

  • memory/3028-175-0x0000000002690000-0x00000000026A2000-memory.dmp

    Filesize

    72KB

  • memory/3028-153-0x0000000002690000-0x00000000026A2000-memory.dmp

    Filesize

    72KB

  • memory/3028-169-0x0000000002690000-0x00000000026A2000-memory.dmp

    Filesize

    72KB

  • memory/3028-167-0x0000000002690000-0x00000000026A2000-memory.dmp

    Filesize

    72KB

  • memory/3028-151-0x0000000002690000-0x00000000026A2000-memory.dmp

    Filesize

    72KB

  • memory/3028-165-0x0000000002690000-0x00000000026A2000-memory.dmp

    Filesize

    72KB

  • memory/3028-163-0x0000000002690000-0x00000000026A2000-memory.dmp

    Filesize

    72KB

  • memory/3028-161-0x0000000002690000-0x00000000026A2000-memory.dmp

    Filesize

    72KB

  • memory/3028-159-0x0000000002690000-0x00000000026A2000-memory.dmp

    Filesize

    72KB

  • memory/3028-157-0x0000000002690000-0x00000000026A2000-memory.dmp

    Filesize

    72KB

  • memory/3028-149-0x0000000004CD0000-0x0000000005274000-memory.dmp

    Filesize

    5.6MB

  • memory/3028-173-0x0000000002690000-0x00000000026A2000-memory.dmp

    Filesize

    72KB

  • memory/3944-1119-0x00000000002B0000-0x00000000002E2000-memory.dmp

    Filesize

    200KB

  • memory/3944-1120-0x0000000004B90000-0x0000000004BA0000-memory.dmp

    Filesize

    64KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.