Analysis

  • max time kernel
    94s
  • max time network
    109s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/03/2023, 20:12

General

  • Target

    48339abee5415a99ac9715fa54a9c3e9a1fe14b9d764d74607243b636b3a89d3.exe

  • Size

    695KB

  • MD5

    6c0e1220214801694bc8447d9dd07aeb

  • SHA1

    952fa017bf9b15cb62ea275c71a34457baf383fe

  • SHA256

    48339abee5415a99ac9715fa54a9c3e9a1fe14b9d764d74607243b636b3a89d3

  • SHA512

    8c667d35e9b5474f43065157b5c895c5742d77ff2429b182a595d1f234fb910f640b8ec48bfe9e9bd528499964f2883351f6c83a110267db1ed4dad2c58d6b4d

  • SSDEEP

    12288:xMr/y90WGHAxS8sH1OlNX1Af7DvvPSxze0mJPzJUwVtNv6tA:6ytj5mu1AXyxen16wnotA

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

from

C2

176.113.115.145:4125

Attributes
  • auth_value

    8633e283485822a4a48f0a41d5397566

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 19 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\48339abee5415a99ac9715fa54a9c3e9a1fe14b9d764d74607243b636b3a89d3.exe
    "C:\Users\Admin\AppData\Local\Temp\48339abee5415a99ac9715fa54a9c3e9a1fe14b9d764d74607243b636b3a89d3.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4960
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un401953.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un401953.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1084
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6937.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6937.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4732
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7809.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7809.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3244
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si325780.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si325780.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:828

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si325780.exe

    Filesize

    175KB

    MD5

    81af3725719a8498d2140d526a6990b7

    SHA1

    304290031c8d5ea3992f3f584b39f87876a9d13c

    SHA256

    9e084a47c909fc6546216c7d58d34e50d541122958db5a02967db993462e9f4f

    SHA512

    7f85b64ed7fc735c788ccc30deaa31fdcffb1da03f88ebdbf928719df727398e85c4ff4e842d76ad38e3cd7b1bc46a29c3f8933686734fc4de2372d9defb14e3

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si325780.exe

    Filesize

    175KB

    MD5

    81af3725719a8498d2140d526a6990b7

    SHA1

    304290031c8d5ea3992f3f584b39f87876a9d13c

    SHA256

    9e084a47c909fc6546216c7d58d34e50d541122958db5a02967db993462e9f4f

    SHA512

    7f85b64ed7fc735c788ccc30deaa31fdcffb1da03f88ebdbf928719df727398e85c4ff4e842d76ad38e3cd7b1bc46a29c3f8933686734fc4de2372d9defb14e3

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un401953.exe

    Filesize

    553KB

    MD5

    6eece9b7f6c9fc90cd48622b1d62f3fb

    SHA1

    7c0086a9f76cbc639a4ffe42b5dd17661e3d2235

    SHA256

    5a3f9773c93e06d70930d748b5e4c4ebf55e9b528e9c07290362c7d8de681e66

    SHA512

    5d0cfe1716317086d63259b82833f07812012ac4d31bb5e25b3d51e7fe04ef091b29564f90bb40f7f82d2368371e6d9b146dd0de4be3a256ee46588a2976c68a

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un401953.exe

    Filesize

    553KB

    MD5

    6eece9b7f6c9fc90cd48622b1d62f3fb

    SHA1

    7c0086a9f76cbc639a4ffe42b5dd17661e3d2235

    SHA256

    5a3f9773c93e06d70930d748b5e4c4ebf55e9b528e9c07290362c7d8de681e66

    SHA512

    5d0cfe1716317086d63259b82833f07812012ac4d31bb5e25b3d51e7fe04ef091b29564f90bb40f7f82d2368371e6d9b146dd0de4be3a256ee46588a2976c68a

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6937.exe

    Filesize

    308KB

    MD5

    1cb87dc827a3370224d17b37daff80a5

    SHA1

    8ae0341de97febcaf57e9667e62774f47ff6f90c

    SHA256

    9a125c2fcfc60f00b57e02cb10747c01a4fb4ceb1d98195a5cf188f52eb1179e

    SHA512

    50d6515565ae26866ddf1f4d6ababe2c547d90093676deb71151772b61b6bc2e2cb01e6e6106324a89897e654241002a59fdd223d3fcd7f1da042624113268a0

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6937.exe

    Filesize

    308KB

    MD5

    1cb87dc827a3370224d17b37daff80a5

    SHA1

    8ae0341de97febcaf57e9667e62774f47ff6f90c

    SHA256

    9a125c2fcfc60f00b57e02cb10747c01a4fb4ceb1d98195a5cf188f52eb1179e

    SHA512

    50d6515565ae26866ddf1f4d6ababe2c547d90093676deb71151772b61b6bc2e2cb01e6e6106324a89897e654241002a59fdd223d3fcd7f1da042624113268a0

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7809.exe

    Filesize

    366KB

    MD5

    990aea06ea19b51a04e8ef4f6030575f

    SHA1

    a72723b02344f6a6aed26e382fb4be1b439e9a53

    SHA256

    e8ea6810af3002e50370f15d881e6af17365e9b79621f32d0d19bf0d55281397

    SHA512

    ad408f008809a2510654c94102979843dd27cc7436330daa95cb4a54f8c94c656f890a254e661f9040f07dd07a462190f33b27d3d8174809164eab3b16bffdb0

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7809.exe

    Filesize

    366KB

    MD5

    990aea06ea19b51a04e8ef4f6030575f

    SHA1

    a72723b02344f6a6aed26e382fb4be1b439e9a53

    SHA256

    e8ea6810af3002e50370f15d881e6af17365e9b79621f32d0d19bf0d55281397

    SHA512

    ad408f008809a2510654c94102979843dd27cc7436330daa95cb4a54f8c94c656f890a254e661f9040f07dd07a462190f33b27d3d8174809164eab3b16bffdb0

  • memory/828-1122-0x0000000004CD0000-0x0000000004CE0000-memory.dmp

    Filesize

    64KB

  • memory/828-1121-0x0000000000390000-0x00000000003C2000-memory.dmp

    Filesize

    200KB

  • memory/3244-470-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

    Filesize

    64KB

  • memory/3244-1104-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

    Filesize

    64KB

  • memory/3244-1115-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

    Filesize

    64KB

  • memory/3244-1114-0x00000000070E0000-0x0000000007130000-memory.dmp

    Filesize

    320KB

  • memory/3244-1113-0x0000000007040000-0x00000000070B6000-memory.dmp

    Filesize

    472KB

  • memory/3244-1112-0x00000000069F0000-0x0000000006F1C000-memory.dmp

    Filesize

    5.2MB

  • memory/3244-1111-0x0000000006810000-0x00000000069D2000-memory.dmp

    Filesize

    1.8MB

  • memory/3244-1110-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

    Filesize

    64KB

  • memory/3244-1109-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

    Filesize

    64KB

  • memory/3244-1108-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

    Filesize

    64KB

  • memory/3244-1106-0x0000000005FF0000-0x0000000006056000-memory.dmp

    Filesize

    408KB

  • memory/3244-1105-0x0000000005F50000-0x0000000005FE2000-memory.dmp

    Filesize

    584KB

  • memory/3244-1103-0x0000000005C60000-0x0000000005C9C000-memory.dmp

    Filesize

    240KB

  • memory/3244-1102-0x0000000005C40000-0x0000000005C52000-memory.dmp

    Filesize

    72KB

  • memory/3244-1101-0x0000000005B00000-0x0000000005C0A000-memory.dmp

    Filesize

    1.0MB

  • memory/3244-1100-0x0000000005480000-0x0000000005A98000-memory.dmp

    Filesize

    6.1MB

  • memory/3244-468-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

    Filesize

    64KB

  • memory/3244-466-0x0000000000820000-0x000000000086B000-memory.dmp

    Filesize

    300KB

  • memory/3244-224-0x0000000004D20000-0x0000000004D5F000-memory.dmp

    Filesize

    252KB

  • memory/3244-222-0x0000000004D20000-0x0000000004D5F000-memory.dmp

    Filesize

    252KB

  • memory/3244-220-0x0000000004D20000-0x0000000004D5F000-memory.dmp

    Filesize

    252KB

  • memory/3244-191-0x0000000004D20000-0x0000000004D5F000-memory.dmp

    Filesize

    252KB

  • memory/3244-192-0x0000000004D20000-0x0000000004D5F000-memory.dmp

    Filesize

    252KB

  • memory/3244-194-0x0000000004D20000-0x0000000004D5F000-memory.dmp

    Filesize

    252KB

  • memory/3244-196-0x0000000004D20000-0x0000000004D5F000-memory.dmp

    Filesize

    252KB

  • memory/3244-198-0x0000000004D20000-0x0000000004D5F000-memory.dmp

    Filesize

    252KB

  • memory/3244-200-0x0000000004D20000-0x0000000004D5F000-memory.dmp

    Filesize

    252KB

  • memory/3244-202-0x0000000004D20000-0x0000000004D5F000-memory.dmp

    Filesize

    252KB

  • memory/3244-204-0x0000000004D20000-0x0000000004D5F000-memory.dmp

    Filesize

    252KB

  • memory/3244-206-0x0000000004D20000-0x0000000004D5F000-memory.dmp

    Filesize

    252KB

  • memory/3244-208-0x0000000004D20000-0x0000000004D5F000-memory.dmp

    Filesize

    252KB

  • memory/3244-210-0x0000000004D20000-0x0000000004D5F000-memory.dmp

    Filesize

    252KB

  • memory/3244-212-0x0000000004D20000-0x0000000004D5F000-memory.dmp

    Filesize

    252KB

  • memory/3244-214-0x0000000004D20000-0x0000000004D5F000-memory.dmp

    Filesize

    252KB

  • memory/3244-216-0x0000000004D20000-0x0000000004D5F000-memory.dmp

    Filesize

    252KB

  • memory/3244-218-0x0000000004D20000-0x0000000004D5F000-memory.dmp

    Filesize

    252KB

  • memory/4732-174-0x0000000002820000-0x0000000002832000-memory.dmp

    Filesize

    72KB

  • memory/4732-151-0x0000000004E80000-0x0000000004E90000-memory.dmp

    Filesize

    64KB

  • memory/4732-186-0x0000000000400000-0x000000000070F000-memory.dmp

    Filesize

    3.1MB

  • memory/4732-184-0x0000000004E80000-0x0000000004E90000-memory.dmp

    Filesize

    64KB

  • memory/4732-183-0x0000000004E80000-0x0000000004E90000-memory.dmp

    Filesize

    64KB

  • memory/4732-152-0x0000000004E80000-0x0000000004E90000-memory.dmp

    Filesize

    64KB

  • memory/4732-182-0x0000000004E80000-0x0000000004E90000-memory.dmp

    Filesize

    64KB

  • memory/4732-181-0x0000000000400000-0x000000000070F000-memory.dmp

    Filesize

    3.1MB

  • memory/4732-180-0x0000000002820000-0x0000000002832000-memory.dmp

    Filesize

    72KB

  • memory/4732-178-0x0000000002820000-0x0000000002832000-memory.dmp

    Filesize

    72KB

  • memory/4732-156-0x0000000002820000-0x0000000002832000-memory.dmp

    Filesize

    72KB

  • memory/4732-176-0x0000000002820000-0x0000000002832000-memory.dmp

    Filesize

    72KB

  • memory/4732-154-0x0000000002820000-0x0000000002832000-memory.dmp

    Filesize

    72KB

  • memory/4732-170-0x0000000002820000-0x0000000002832000-memory.dmp

    Filesize

    72KB

  • memory/4732-153-0x0000000002820000-0x0000000002832000-memory.dmp

    Filesize

    72KB

  • memory/4732-168-0x0000000002820000-0x0000000002832000-memory.dmp

    Filesize

    72KB

  • memory/4732-166-0x0000000002820000-0x0000000002832000-memory.dmp

    Filesize

    72KB

  • memory/4732-164-0x0000000002820000-0x0000000002832000-memory.dmp

    Filesize

    72KB

  • memory/4732-162-0x0000000002820000-0x0000000002832000-memory.dmp

    Filesize

    72KB

  • memory/4732-160-0x0000000002820000-0x0000000002832000-memory.dmp

    Filesize

    72KB

  • memory/4732-158-0x0000000002820000-0x0000000002832000-memory.dmp

    Filesize

    72KB

  • memory/4732-172-0x0000000002820000-0x0000000002832000-memory.dmp

    Filesize

    72KB

  • memory/4732-150-0x0000000004E80000-0x0000000004E90000-memory.dmp

    Filesize

    64KB

  • memory/4732-149-0x0000000000710000-0x000000000073D000-memory.dmp

    Filesize

    180KB

  • memory/4732-148-0x0000000004E90000-0x0000000005434000-memory.dmp

    Filesize

    5.6MB