Analysis

  • max time kernel
    144s
  • max time network
    146s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    27-03-2023 21:16

General

  • Target

    77246a61f33ca4a9ddbeca0456c48aa57035f870df55e5c160f56bda1e7ba2f8.exe

  • Size

    696KB

  • MD5

    956ba4c93e218c1194c87d8c6a818bd8

  • SHA1

    7b2c6dbb7ee964e539499d5f1c2e47223a134cd0

  • SHA256

    77246a61f33ca4a9ddbeca0456c48aa57035f870df55e5c160f56bda1e7ba2f8

  • SHA512

    d292afeabdf98d1778ad6b7b8c8b38a8b7d25beb2eb05fbe285374b856421e783668e14eb205d7e1ed5677f7e9570fe42e7220b0132d3d97192e4d2a9637f4d3

  • SSDEEP

    12288:9MrXy90XRF1GGD659aSUBULBoEf5R0fcBT1vdfxjzNX1JTtE3q2r6+y6t:WyCTImUTf5R0fcrPNFTESV6t

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

from

C2

176.113.115.145:4125

Attributes
  • auth_value

    8633e283485822a4a48f0a41d5397566

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 21 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\77246a61f33ca4a9ddbeca0456c48aa57035f870df55e5c160f56bda1e7ba2f8.exe
    "C:\Users\Admin\AppData\Local\Temp\77246a61f33ca4a9ddbeca0456c48aa57035f870df55e5c160f56bda1e7ba2f8.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2076
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un118457.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un118457.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2316
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7969.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7969.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2412
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1438.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1438.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3912
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si061947.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si061947.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2692

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si061947.exe

    Filesize

    175KB

    MD5

    31105263fedecde0a59f328433c88d30

    SHA1

    8dcf807df5eea7a16a770cb3c0a353739ebf5059

    SHA256

    c1f5a155b6adfd8aa39f4aeec33382474ddba2654980dc628389462445f45e18

    SHA512

    6022b90d004ea224f6bd92b159d91677db41197e8a4f452f0adb438bca45060ae9d3b3ca00f99e5e636b822cd9310cec42e977428a29c1e8e068d9251d86396d

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si061947.exe

    Filesize

    175KB

    MD5

    31105263fedecde0a59f328433c88d30

    SHA1

    8dcf807df5eea7a16a770cb3c0a353739ebf5059

    SHA256

    c1f5a155b6adfd8aa39f4aeec33382474ddba2654980dc628389462445f45e18

    SHA512

    6022b90d004ea224f6bd92b159d91677db41197e8a4f452f0adb438bca45060ae9d3b3ca00f99e5e636b822cd9310cec42e977428a29c1e8e068d9251d86396d

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un118457.exe

    Filesize

    553KB

    MD5

    9657a9f0ac0a9c3438d7e74cc497a209

    SHA1

    26d7e2d400001c522d38d72ce14ac8ef39169299

    SHA256

    7019fbc12b995f0bf206b8edb8a0a066386dffd249a296b2865546a8f43eb3a3

    SHA512

    06d875885f6c975fd3517cea99d49e7c39c39f661045ce21377b59362d1f96b0bc6a51a5f15245f1aeb88f0b56acd6620406e4c895d5b6e2e11c571aaed58176

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un118457.exe

    Filesize

    553KB

    MD5

    9657a9f0ac0a9c3438d7e74cc497a209

    SHA1

    26d7e2d400001c522d38d72ce14ac8ef39169299

    SHA256

    7019fbc12b995f0bf206b8edb8a0a066386dffd249a296b2865546a8f43eb3a3

    SHA512

    06d875885f6c975fd3517cea99d49e7c39c39f661045ce21377b59362d1f96b0bc6a51a5f15245f1aeb88f0b56acd6620406e4c895d5b6e2e11c571aaed58176

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7969.exe

    Filesize

    308KB

    MD5

    7619322e5b7fb7dc968106aa3a2a926e

    SHA1

    a94117438c7fd1988068c8b6ea48a8501d8f9ddb

    SHA256

    71bbc27f1c7e1f1784f141cd3b92169b8b4ea548ee0f0479ba28522d65849247

    SHA512

    317807a91a8a771105b37c7126ffa011482624f43597df84f21f42ff6f566250d36148ac889133b1b19efd4eb80383c5f2e8cc474eac32a66b553715a29b66a8

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7969.exe

    Filesize

    308KB

    MD5

    7619322e5b7fb7dc968106aa3a2a926e

    SHA1

    a94117438c7fd1988068c8b6ea48a8501d8f9ddb

    SHA256

    71bbc27f1c7e1f1784f141cd3b92169b8b4ea548ee0f0479ba28522d65849247

    SHA512

    317807a91a8a771105b37c7126ffa011482624f43597df84f21f42ff6f566250d36148ac889133b1b19efd4eb80383c5f2e8cc474eac32a66b553715a29b66a8

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1438.exe

    Filesize

    366KB

    MD5

    9ef14ba15159a1350a483f9571b683be

    SHA1

    88bb359dc8215d9622af31af79d81d06d7b70191

    SHA256

    e6f0db800b42d85f17c187065e00510929ba7c4a79f29ccbdc819a23444ffb98

    SHA512

    bc1efb26fe878d3a502572f2c8f8197cffaee64b45efd207a25f828f31154566725338f909defcd6600515bde071fdef832929dd8d2f60eb62fd9082919e38c7

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1438.exe

    Filesize

    366KB

    MD5

    9ef14ba15159a1350a483f9571b683be

    SHA1

    88bb359dc8215d9622af31af79d81d06d7b70191

    SHA256

    e6f0db800b42d85f17c187065e00510929ba7c4a79f29ccbdc819a23444ffb98

    SHA512

    bc1efb26fe878d3a502572f2c8f8197cffaee64b45efd207a25f828f31154566725338f909defcd6600515bde071fdef832929dd8d2f60eb62fd9082919e38c7

  • memory/2412-145-0x00000000022A0000-0x00000000022B2000-memory.dmp

    Filesize

    72KB

  • memory/2412-155-0x00000000022A0000-0x00000000022B2000-memory.dmp

    Filesize

    72KB

  • memory/2412-135-0x0000000004D30000-0x000000000522E000-memory.dmp

    Filesize

    5.0MB

  • memory/2412-136-0x00000000022A0000-0x00000000022B8000-memory.dmp

    Filesize

    96KB

  • memory/2412-137-0x0000000002250000-0x0000000002260000-memory.dmp

    Filesize

    64KB

  • memory/2412-138-0x0000000002250000-0x0000000002260000-memory.dmp

    Filesize

    64KB

  • memory/2412-139-0x0000000002250000-0x0000000002260000-memory.dmp

    Filesize

    64KB

  • memory/2412-140-0x00000000022A0000-0x00000000022B2000-memory.dmp

    Filesize

    72KB

  • memory/2412-141-0x00000000022A0000-0x00000000022B2000-memory.dmp

    Filesize

    72KB

  • memory/2412-143-0x00000000022A0000-0x00000000022B2000-memory.dmp

    Filesize

    72KB

  • memory/2412-133-0x00000000001D0000-0x00000000001FD000-memory.dmp

    Filesize

    180KB

  • memory/2412-147-0x00000000022A0000-0x00000000022B2000-memory.dmp

    Filesize

    72KB

  • memory/2412-149-0x00000000022A0000-0x00000000022B2000-memory.dmp

    Filesize

    72KB

  • memory/2412-151-0x00000000022A0000-0x00000000022B2000-memory.dmp

    Filesize

    72KB

  • memory/2412-153-0x00000000022A0000-0x00000000022B2000-memory.dmp

    Filesize

    72KB

  • memory/2412-134-0x0000000002230000-0x000000000224A000-memory.dmp

    Filesize

    104KB

  • memory/2412-157-0x00000000022A0000-0x00000000022B2000-memory.dmp

    Filesize

    72KB

  • memory/2412-159-0x00000000022A0000-0x00000000022B2000-memory.dmp

    Filesize

    72KB

  • memory/2412-161-0x00000000022A0000-0x00000000022B2000-memory.dmp

    Filesize

    72KB

  • memory/2412-163-0x00000000022A0000-0x00000000022B2000-memory.dmp

    Filesize

    72KB

  • memory/2412-165-0x00000000022A0000-0x00000000022B2000-memory.dmp

    Filesize

    72KB

  • memory/2412-167-0x00000000022A0000-0x00000000022B2000-memory.dmp

    Filesize

    72KB

  • memory/2412-168-0x0000000000400000-0x000000000070F000-memory.dmp

    Filesize

    3.1MB

  • memory/2412-169-0x0000000002250000-0x0000000002260000-memory.dmp

    Filesize

    64KB

  • memory/2412-170-0x0000000002250000-0x0000000002260000-memory.dmp

    Filesize

    64KB

  • memory/2412-172-0x0000000000400000-0x000000000070F000-memory.dmp

    Filesize

    3.1MB

  • memory/2692-1109-0x0000000000B40000-0x0000000000B72000-memory.dmp

    Filesize

    200KB

  • memory/2692-1111-0x0000000005860000-0x0000000005870000-memory.dmp

    Filesize

    64KB

  • memory/2692-1110-0x0000000005450000-0x000000000549B000-memory.dmp

    Filesize

    300KB

  • memory/3912-178-0x00000000051D0000-0x0000000005214000-memory.dmp

    Filesize

    272KB

  • memory/3912-212-0x00000000021A0000-0x00000000021B0000-memory.dmp

    Filesize

    64KB

  • memory/3912-182-0x00000000051D0000-0x000000000520F000-memory.dmp

    Filesize

    252KB

  • memory/3912-184-0x00000000051D0000-0x000000000520F000-memory.dmp

    Filesize

    252KB

  • memory/3912-186-0x00000000051D0000-0x000000000520F000-memory.dmp

    Filesize

    252KB

  • memory/3912-188-0x00000000051D0000-0x000000000520F000-memory.dmp

    Filesize

    252KB

  • memory/3912-190-0x00000000051D0000-0x000000000520F000-memory.dmp

    Filesize

    252KB

  • memory/3912-192-0x00000000051D0000-0x000000000520F000-memory.dmp

    Filesize

    252KB

  • memory/3912-194-0x00000000051D0000-0x000000000520F000-memory.dmp

    Filesize

    252KB

  • memory/3912-196-0x00000000051D0000-0x000000000520F000-memory.dmp

    Filesize

    252KB

  • memory/3912-198-0x00000000051D0000-0x000000000520F000-memory.dmp

    Filesize

    252KB

  • memory/3912-200-0x00000000051D0000-0x000000000520F000-memory.dmp

    Filesize

    252KB

  • memory/3912-202-0x00000000051D0000-0x000000000520F000-memory.dmp

    Filesize

    252KB

  • memory/3912-204-0x00000000051D0000-0x000000000520F000-memory.dmp

    Filesize

    252KB

  • memory/3912-206-0x00000000051D0000-0x000000000520F000-memory.dmp

    Filesize

    252KB

  • memory/3912-209-0x00000000008F0000-0x000000000093B000-memory.dmp

    Filesize

    300KB

  • memory/3912-208-0x00000000051D0000-0x000000000520F000-memory.dmp

    Filesize

    252KB

  • memory/3912-211-0x00000000021A0000-0x00000000021B0000-memory.dmp

    Filesize

    64KB

  • memory/3912-213-0x00000000051D0000-0x000000000520F000-memory.dmp

    Filesize

    252KB

  • memory/3912-180-0x00000000051D0000-0x000000000520F000-memory.dmp

    Filesize

    252KB

  • memory/3912-215-0x00000000051D0000-0x000000000520F000-memory.dmp

    Filesize

    252KB

  • memory/3912-1088-0x0000000005230000-0x0000000005836000-memory.dmp

    Filesize

    6.0MB

  • memory/3912-1089-0x00000000058C0000-0x00000000059CA000-memory.dmp

    Filesize

    1.0MB

  • memory/3912-1090-0x0000000005A00000-0x0000000005A12000-memory.dmp

    Filesize

    72KB

  • memory/3912-1091-0x0000000005A20000-0x0000000005A5E000-memory.dmp

    Filesize

    248KB

  • memory/3912-1092-0x0000000005B70000-0x0000000005BBB000-memory.dmp

    Filesize

    300KB

  • memory/3912-1093-0x00000000021A0000-0x00000000021B0000-memory.dmp

    Filesize

    64KB

  • memory/3912-1095-0x00000000021A0000-0x00000000021B0000-memory.dmp

    Filesize

    64KB

  • memory/3912-1096-0x00000000021A0000-0x00000000021B0000-memory.dmp

    Filesize

    64KB

  • memory/3912-1097-0x0000000005D00000-0x0000000005D66000-memory.dmp

    Filesize

    408KB

  • memory/3912-1098-0x00000000062A0000-0x0000000006332000-memory.dmp

    Filesize

    584KB

  • memory/3912-1099-0x00000000064B0000-0x0000000006526000-memory.dmp

    Filesize

    472KB

  • memory/3912-1100-0x0000000006530000-0x0000000006580000-memory.dmp

    Filesize

    320KB

  • memory/3912-179-0x00000000051D0000-0x000000000520F000-memory.dmp

    Filesize

    252KB

  • memory/3912-177-0x0000000004C50000-0x0000000004C96000-memory.dmp

    Filesize

    280KB

  • memory/3912-1101-0x00000000066A0000-0x0000000006862000-memory.dmp

    Filesize

    1.8MB

  • memory/3912-1102-0x0000000006870000-0x0000000006D9C000-memory.dmp

    Filesize

    5.2MB

  • memory/3912-1103-0x00000000021A0000-0x00000000021B0000-memory.dmp

    Filesize

    64KB