Analysis

  • max time kernel
    72s
  • max time network
    122s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/03/2023, 20:04

General

  • Target

    604c2b7486db6e9976a4c15fac6100370f68bb2b35cb38a0541c5af6ed444164.exe

  • Size

    695KB

  • MD5

    32992ae9c3073904e96d894a9e78e1a6

  • SHA1

    6f7a96c6e7c20fa9cb832b2c2089559a2a44422c

  • SHA256

    604c2b7486db6e9976a4c15fac6100370f68bb2b35cb38a0541c5af6ed444164

  • SHA512

    9b5888548b6c37277b4fed4333e3ed6fa5c8981c98f6f1f88beeff954208da40d23bdf8967fd1d4b84e408ad798638ba0f471b048394d0b8931f09bb810f1d8e

  • SSDEEP

    12288:3Mr/y90x9EDVtNeYuDtlxi1MuPlmPMYPFAla1jHPsTkzFnEJ57aDrx2BlPu:EyMERjeYuxS1MelmPHP2a1LUTMFEnylH

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

from

C2

176.113.115.145:4125

Attributes
  • auth_value

    8633e283485822a4a48f0a41d5397566

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 19 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\604c2b7486db6e9976a4c15fac6100370f68bb2b35cb38a0541c5af6ed444164.exe
    "C:\Users\Admin\AppData\Local\Temp\604c2b7486db6e9976a4c15fac6100370f68bb2b35cb38a0541c5af6ed444164.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4896
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un092411.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un092411.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4044
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9883.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9883.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1164
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6708.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6708.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4552
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si513258.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si513258.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2136

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si513258.exe

    Filesize

    175KB

    MD5

    9167f35c605cdfbeeb7bb2cad181e153

    SHA1

    f305a89fe355e8b696b730d126685f598f7bea9d

    SHA256

    1c1ad7eb84b533eea3f321ef54f5f8a2fa47551a6bf0798b6c35ef8ba575936b

    SHA512

    25e5cd8359653b79520a2f7ff472616e8d725bfd490d5fd7f8ba8a5ff9b62ad5dabf5f6df76b8e3d0a39af832f17504b7291f8464972b893a664b3fbac3f80dc

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si513258.exe

    Filesize

    175KB

    MD5

    9167f35c605cdfbeeb7bb2cad181e153

    SHA1

    f305a89fe355e8b696b730d126685f598f7bea9d

    SHA256

    1c1ad7eb84b533eea3f321ef54f5f8a2fa47551a6bf0798b6c35ef8ba575936b

    SHA512

    25e5cd8359653b79520a2f7ff472616e8d725bfd490d5fd7f8ba8a5ff9b62ad5dabf5f6df76b8e3d0a39af832f17504b7291f8464972b893a664b3fbac3f80dc

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un092411.exe

    Filesize

    553KB

    MD5

    adccf2fbbdf209a4de4dba070e1a9b6b

    SHA1

    37e05d95f7222e38f93418a6a44b65900ed7eb02

    SHA256

    ac246ca687f2274ad08494b6aa8cb0ff00d8372eedecbd66305a2b4ebcfbed4d

    SHA512

    8d3ce6fa7dd64bcf5b320ac25061b45e607eb9ebd7b0b44343297c2e04e643937c1ca735367ebad746befd973cbe6b148c08d06471d1b6c45e4daf2a12f3d542

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un092411.exe

    Filesize

    553KB

    MD5

    adccf2fbbdf209a4de4dba070e1a9b6b

    SHA1

    37e05d95f7222e38f93418a6a44b65900ed7eb02

    SHA256

    ac246ca687f2274ad08494b6aa8cb0ff00d8372eedecbd66305a2b4ebcfbed4d

    SHA512

    8d3ce6fa7dd64bcf5b320ac25061b45e607eb9ebd7b0b44343297c2e04e643937c1ca735367ebad746befd973cbe6b148c08d06471d1b6c45e4daf2a12f3d542

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9883.exe

    Filesize

    308KB

    MD5

    f2d3052173f278fff1b75d3d3428177f

    SHA1

    061f6089f807d3f36d3cae07abae5f5242f2e044

    SHA256

    96e81ab711b6569e30764916029b7a661c653523405f482c9bc7fa18f6ce959a

    SHA512

    98d3c75a17cb0aa360df7e8a88c65661e4732bb26ac3892b8f00a8a02ea577eb26598ea9693ea2e9234a06a535ae670b18e54d5ad545467dc7112cffe58f655a

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9883.exe

    Filesize

    308KB

    MD5

    f2d3052173f278fff1b75d3d3428177f

    SHA1

    061f6089f807d3f36d3cae07abae5f5242f2e044

    SHA256

    96e81ab711b6569e30764916029b7a661c653523405f482c9bc7fa18f6ce959a

    SHA512

    98d3c75a17cb0aa360df7e8a88c65661e4732bb26ac3892b8f00a8a02ea577eb26598ea9693ea2e9234a06a535ae670b18e54d5ad545467dc7112cffe58f655a

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6708.exe

    Filesize

    366KB

    MD5

    ebba8bd1d8fb83895fe66bdc730b7a42

    SHA1

    f46abd283167109a6ea3fc621af6c4c1be8b8d17

    SHA256

    7db01c62a6aeab100751e0deefdd1aff1e3909f3bd439301a42030a7efa1c121

    SHA512

    53810409c992406ed67143a3fd74204de0d71e84887e54f7b0a3660139576a4f6748028b21d9a410b3f516219716c8b46ec04e80e2a1f116e38042f14a6be863

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6708.exe

    Filesize

    366KB

    MD5

    ebba8bd1d8fb83895fe66bdc730b7a42

    SHA1

    f46abd283167109a6ea3fc621af6c4c1be8b8d17

    SHA256

    7db01c62a6aeab100751e0deefdd1aff1e3909f3bd439301a42030a7efa1c121

    SHA512

    53810409c992406ed67143a3fd74204de0d71e84887e54f7b0a3660139576a4f6748028b21d9a410b3f516219716c8b46ec04e80e2a1f116e38042f14a6be863

  • memory/1164-149-0x0000000004E40000-0x00000000053E4000-memory.dmp

    Filesize

    5.6MB

  • memory/1164-150-0x0000000004E30000-0x0000000004E40000-memory.dmp

    Filesize

    64KB

  • memory/1164-148-0x0000000000710000-0x000000000073D000-memory.dmp

    Filesize

    180KB

  • memory/1164-151-0x0000000004E30000-0x0000000004E40000-memory.dmp

    Filesize

    64KB

  • memory/1164-152-0x0000000004E30000-0x0000000004E40000-memory.dmp

    Filesize

    64KB

  • memory/1164-153-0x0000000002790000-0x00000000027A2000-memory.dmp

    Filesize

    72KB

  • memory/1164-154-0x0000000002790000-0x00000000027A2000-memory.dmp

    Filesize

    72KB

  • memory/1164-156-0x0000000002790000-0x00000000027A2000-memory.dmp

    Filesize

    72KB

  • memory/1164-158-0x0000000002790000-0x00000000027A2000-memory.dmp

    Filesize

    72KB

  • memory/1164-160-0x0000000002790000-0x00000000027A2000-memory.dmp

    Filesize

    72KB

  • memory/1164-162-0x0000000002790000-0x00000000027A2000-memory.dmp

    Filesize

    72KB

  • memory/1164-164-0x0000000002790000-0x00000000027A2000-memory.dmp

    Filesize

    72KB

  • memory/1164-166-0x0000000002790000-0x00000000027A2000-memory.dmp

    Filesize

    72KB

  • memory/1164-168-0x0000000002790000-0x00000000027A2000-memory.dmp

    Filesize

    72KB

  • memory/1164-170-0x0000000002790000-0x00000000027A2000-memory.dmp

    Filesize

    72KB

  • memory/1164-172-0x0000000002790000-0x00000000027A2000-memory.dmp

    Filesize

    72KB

  • memory/1164-174-0x0000000002790000-0x00000000027A2000-memory.dmp

    Filesize

    72KB

  • memory/1164-176-0x0000000002790000-0x00000000027A2000-memory.dmp

    Filesize

    72KB

  • memory/1164-178-0x0000000002790000-0x00000000027A2000-memory.dmp

    Filesize

    72KB

  • memory/1164-180-0x0000000002790000-0x00000000027A2000-memory.dmp

    Filesize

    72KB

  • memory/1164-181-0x0000000000400000-0x000000000070F000-memory.dmp

    Filesize

    3.1MB

  • memory/1164-182-0x0000000004E30000-0x0000000004E40000-memory.dmp

    Filesize

    64KB

  • memory/1164-183-0x0000000004E30000-0x0000000004E40000-memory.dmp

    Filesize

    64KB

  • memory/1164-184-0x0000000004E30000-0x0000000004E40000-memory.dmp

    Filesize

    64KB

  • memory/1164-186-0x0000000000400000-0x000000000070F000-memory.dmp

    Filesize

    3.1MB

  • memory/2136-1123-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

    Filesize

    64KB

  • memory/2136-1122-0x0000000000240000-0x0000000000272000-memory.dmp

    Filesize

    200KB

  • memory/4552-194-0x0000000002870000-0x00000000028AF000-memory.dmp

    Filesize

    252KB

  • memory/4552-604-0x0000000004EF0000-0x0000000004F00000-memory.dmp

    Filesize

    64KB

  • memory/4552-195-0x0000000002870000-0x00000000028AF000-memory.dmp

    Filesize

    252KB

  • memory/4552-197-0x0000000002870000-0x00000000028AF000-memory.dmp

    Filesize

    252KB

  • memory/4552-199-0x0000000002870000-0x00000000028AF000-memory.dmp

    Filesize

    252KB

  • memory/4552-201-0x0000000002870000-0x00000000028AF000-memory.dmp

    Filesize

    252KB

  • memory/4552-203-0x0000000002870000-0x00000000028AF000-memory.dmp

    Filesize

    252KB

  • memory/4552-205-0x0000000002870000-0x00000000028AF000-memory.dmp

    Filesize

    252KB

  • memory/4552-207-0x0000000002870000-0x00000000028AF000-memory.dmp

    Filesize

    252KB

  • memory/4552-209-0x0000000002870000-0x00000000028AF000-memory.dmp

    Filesize

    252KB

  • memory/4552-211-0x0000000002870000-0x00000000028AF000-memory.dmp

    Filesize

    252KB

  • memory/4552-213-0x0000000002870000-0x00000000028AF000-memory.dmp

    Filesize

    252KB

  • memory/4552-215-0x0000000002870000-0x00000000028AF000-memory.dmp

    Filesize

    252KB

  • memory/4552-217-0x0000000002870000-0x00000000028AF000-memory.dmp

    Filesize

    252KB

  • memory/4552-219-0x0000000002870000-0x00000000028AF000-memory.dmp

    Filesize

    252KB

  • memory/4552-221-0x0000000002870000-0x00000000028AF000-memory.dmp

    Filesize

    252KB

  • memory/4552-223-0x0000000002870000-0x00000000028AF000-memory.dmp

    Filesize

    252KB

  • memory/4552-225-0x0000000002870000-0x00000000028AF000-memory.dmp

    Filesize

    252KB

  • memory/4552-227-0x0000000002870000-0x00000000028AF000-memory.dmp

    Filesize

    252KB

  • memory/4552-193-0x0000000004EF0000-0x0000000004F00000-memory.dmp

    Filesize

    64KB

  • memory/4552-1101-0x00000000054B0000-0x0000000005AC8000-memory.dmp

    Filesize

    6.1MB

  • memory/4552-1102-0x0000000004DE0000-0x0000000004EEA000-memory.dmp

    Filesize

    1.0MB

  • memory/4552-1103-0x0000000005B00000-0x0000000005B12000-memory.dmp

    Filesize

    72KB

  • memory/4552-1104-0x0000000004EF0000-0x0000000004F00000-memory.dmp

    Filesize

    64KB

  • memory/4552-1105-0x0000000005B20000-0x0000000005B5C000-memory.dmp

    Filesize

    240KB

  • memory/4552-1106-0x0000000005E10000-0x0000000005EA2000-memory.dmp

    Filesize

    584KB

  • memory/4552-1107-0x0000000005EB0000-0x0000000005F16000-memory.dmp

    Filesize

    408KB

  • memory/4552-1109-0x0000000004EF0000-0x0000000004F00000-memory.dmp

    Filesize

    64KB

  • memory/4552-1110-0x0000000004EF0000-0x0000000004F00000-memory.dmp

    Filesize

    64KB

  • memory/4552-1111-0x0000000004EF0000-0x0000000004F00000-memory.dmp

    Filesize

    64KB

  • memory/4552-1112-0x0000000006820000-0x00000000069E2000-memory.dmp

    Filesize

    1.8MB

  • memory/4552-1113-0x00000000069F0000-0x0000000006F1C000-memory.dmp

    Filesize

    5.2MB

  • memory/4552-1114-0x0000000004EF0000-0x0000000004F00000-memory.dmp

    Filesize

    64KB

  • memory/4552-192-0x0000000004EF0000-0x0000000004F00000-memory.dmp

    Filesize

    64KB

  • memory/4552-191-0x00000000007F0000-0x000000000083B000-memory.dmp

    Filesize

    300KB

  • memory/4552-1115-0x0000000007050000-0x00000000070C6000-memory.dmp

    Filesize

    472KB

  • memory/4552-1116-0x00000000070E0000-0x0000000007130000-memory.dmp

    Filesize

    320KB