Analysis

  • max time kernel
    135s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-03-2023 20:30

General

  • Target

    f68ad49780257599c5a663d70ad14b8b8814465b681fd14fce247ebe1e40bef7.exe

  • Size

    695KB

  • MD5

    a7113779acd35c2fd2c69082c89482e5

  • SHA1

    583b0c792780f08eccc509d0569c6c098b6c1036

  • SHA256

    f68ad49780257599c5a663d70ad14b8b8814465b681fd14fce247ebe1e40bef7

  • SHA512

    15630253ac62eeb1097bcaf4cac8a3ecc54aff2678621c32dd5852b5370e7ace5d3f504229e0f7496b6eed1494b69bb41d8f3ef00cd97037307c0d704967df8e

  • SSDEEP

    12288:kMrFy90VTNiV3jSFvJZkYBe6f7fsr5wMylUk/KKUWMTrvPSlzQHWJkwQTmkjL:xy5VTXYBvdMylUk/BUWMTrylQ2sTmkjL

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

from

C2

176.113.115.145:4125

Attributes
  • auth_value

    8633e283485822a4a48f0a41d5397566

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 18 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f68ad49780257599c5a663d70ad14b8b8814465b681fd14fce247ebe1e40bef7.exe
    "C:\Users\Admin\AppData\Local\Temp\f68ad49780257599c5a663d70ad14b8b8814465b681fd14fce247ebe1e40bef7.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4524
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un752609.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un752609.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3016
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1777.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1777.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:592
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6651.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6651.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2520
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si500351.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si500351.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4780

Network

  • flag-us
    DNS
    196.249.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    196.249.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    73.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    73.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    42.220.44.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    42.220.44.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    145.115.113.176.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    145.115.113.176.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    44.8.109.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    44.8.109.52.in-addr.arpa
    IN PTR
    Response
  • 176.113.115.145:4125
    qu6651.exe
    71.6kB
    7.9kB
    81
    42
  • 176.113.115.145:4125
    si500351.exe
    69.1kB
    7.6kB
    77
    37
  • 52.152.110.14:443
    260 B
    5
  • 52.182.141.63:443
    322 B
    7
  • 173.223.113.164:443
    322 B
    7
  • 204.79.197.203:80
    322 B
    7
  • 52.152.110.14:443
    260 B
    5
  • 13.107.4.50:80
    322 B
    7
  • 52.152.110.14:443
    260 B
    5
  • 52.152.110.14:443
    260 B
    5
  • 52.152.110.14:443
    260 B
    5
  • 52.152.110.14:443
    208 B
    4
  • 8.8.8.8:53
    196.249.167.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    196.249.167.52.in-addr.arpa

  • 8.8.8.8:53
    73.159.190.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    73.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    42.220.44.20.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    42.220.44.20.in-addr.arpa

  • 8.8.8.8:53
    145.115.113.176.in-addr.arpa
    dns
    74 B
    134 B
    1
    1

    DNS Request

    145.115.113.176.in-addr.arpa

  • 8.8.8.8:53
    44.8.109.52.in-addr.arpa
    dns
    70 B
    144 B
    1
    1

    DNS Request

    44.8.109.52.in-addr.arpa

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si500351.exe

    Filesize

    175KB

    MD5

    ebc9b541738fa45408885d9446a6ed55

    SHA1

    a4d298183b4ee5fced6ba2d9cc1b6f7c4fa00d81

    SHA256

    e79da3bdb9abdca71a6af6f226814a785f7c111dee4de4e6964d23329ca1d7e9

    SHA512

    46a5d73d9f9b360a5d7b21e36d55f35b02a7060d5ac7210af9559f9e1a557c65edf6a68a3e628782f27aa34e718f1623f94baf358dd8258ed14ad3871dee992a

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si500351.exe

    Filesize

    175KB

    MD5

    ebc9b541738fa45408885d9446a6ed55

    SHA1

    a4d298183b4ee5fced6ba2d9cc1b6f7c4fa00d81

    SHA256

    e79da3bdb9abdca71a6af6f226814a785f7c111dee4de4e6964d23329ca1d7e9

    SHA512

    46a5d73d9f9b360a5d7b21e36d55f35b02a7060d5ac7210af9559f9e1a557c65edf6a68a3e628782f27aa34e718f1623f94baf358dd8258ed14ad3871dee992a

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un752609.exe

    Filesize

    553KB

    MD5

    4d4f9be560d9774506c803a62f7f05a7

    SHA1

    6142561ee5bc3cb445153eaabb29b18cd9eaf52f

    SHA256

    825d0f7afb55766f4fa8f8b1ba5000e27bf54547bb7a10b631614ebac70dd251

    SHA512

    aa9932c01ee3305966befcbd763a4e181285133ded13d5a3d46b3629198143cc2336b93810b8dac342d642ad22839b9388ea7637e829bbc6365b96e684d0492c

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un752609.exe

    Filesize

    553KB

    MD5

    4d4f9be560d9774506c803a62f7f05a7

    SHA1

    6142561ee5bc3cb445153eaabb29b18cd9eaf52f

    SHA256

    825d0f7afb55766f4fa8f8b1ba5000e27bf54547bb7a10b631614ebac70dd251

    SHA512

    aa9932c01ee3305966befcbd763a4e181285133ded13d5a3d46b3629198143cc2336b93810b8dac342d642ad22839b9388ea7637e829bbc6365b96e684d0492c

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1777.exe

    Filesize

    308KB

    MD5

    ff2cd23ea95ec473d92e687ec352e81d

    SHA1

    3f1aa8346d95c90c0f091bbf7cd8b79e0d1258cb

    SHA256

    df3ad4549c16aa9247a3218951df919509fc1a1996426c6cd31ea798263dc7c2

    SHA512

    41a11de00c7454084cd63d2b969abed1db34a3a6cd1b22688ae142164bf039c806811efa18601e2e48c5908699c1d6e64cb4400dc52ac9b5ce9a955e90d5a704

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1777.exe

    Filesize

    308KB

    MD5

    ff2cd23ea95ec473d92e687ec352e81d

    SHA1

    3f1aa8346d95c90c0f091bbf7cd8b79e0d1258cb

    SHA256

    df3ad4549c16aa9247a3218951df919509fc1a1996426c6cd31ea798263dc7c2

    SHA512

    41a11de00c7454084cd63d2b969abed1db34a3a6cd1b22688ae142164bf039c806811efa18601e2e48c5908699c1d6e64cb4400dc52ac9b5ce9a955e90d5a704

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6651.exe

    Filesize

    366KB

    MD5

    dea80da79f7ea5fa5955318a64f098ec

    SHA1

    8504b356b034c35673008f2e5df431b2876df413

    SHA256

    0a805ba190ce47e14a161db2ed243fcead2c1d0bba7f3f755ecfaa890e414c00

    SHA512

    a133fdae8e4a1d362997b4e4b04793e2ea7e379628350ba56de327966af0274f17d1ee80976a6c0a154039eee9c674af31850ce6143b62ce7864162dd89ebd7d

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6651.exe

    Filesize

    366KB

    MD5

    dea80da79f7ea5fa5955318a64f098ec

    SHA1

    8504b356b034c35673008f2e5df431b2876df413

    SHA256

    0a805ba190ce47e14a161db2ed243fcead2c1d0bba7f3f755ecfaa890e414c00

    SHA512

    a133fdae8e4a1d362997b4e4b04793e2ea7e379628350ba56de327966af0274f17d1ee80976a6c0a154039eee9c674af31850ce6143b62ce7864162dd89ebd7d

  • memory/592-148-0x00000000007E0000-0x000000000080D000-memory.dmp

    Filesize

    180KB

  • memory/592-149-0x0000000004E50000-0x00000000053F4000-memory.dmp

    Filesize

    5.6MB

  • memory/592-150-0x0000000002A70000-0x0000000002A82000-memory.dmp

    Filesize

    72KB

  • memory/592-151-0x0000000002A70000-0x0000000002A82000-memory.dmp

    Filesize

    72KB

  • memory/592-153-0x0000000002A70000-0x0000000002A82000-memory.dmp

    Filesize

    72KB

  • memory/592-155-0x0000000002A70000-0x0000000002A82000-memory.dmp

    Filesize

    72KB

  • memory/592-157-0x0000000002A70000-0x0000000002A82000-memory.dmp

    Filesize

    72KB

  • memory/592-159-0x0000000002A70000-0x0000000002A82000-memory.dmp

    Filesize

    72KB

  • memory/592-161-0x0000000002A70000-0x0000000002A82000-memory.dmp

    Filesize

    72KB

  • memory/592-163-0x0000000002A70000-0x0000000002A82000-memory.dmp

    Filesize

    72KB

  • memory/592-165-0x0000000002A70000-0x0000000002A82000-memory.dmp

    Filesize

    72KB

  • memory/592-167-0x0000000002A70000-0x0000000002A82000-memory.dmp

    Filesize

    72KB

  • memory/592-169-0x0000000002A70000-0x0000000002A82000-memory.dmp

    Filesize

    72KB

  • memory/592-171-0x0000000002A70000-0x0000000002A82000-memory.dmp

    Filesize

    72KB

  • memory/592-173-0x0000000002A70000-0x0000000002A82000-memory.dmp

    Filesize

    72KB

  • memory/592-175-0x0000000002A70000-0x0000000002A82000-memory.dmp

    Filesize

    72KB

  • memory/592-177-0x0000000002A70000-0x0000000002A82000-memory.dmp

    Filesize

    72KB

  • memory/592-178-0x0000000002530000-0x0000000002540000-memory.dmp

    Filesize

    64KB

  • memory/592-179-0x0000000002530000-0x0000000002540000-memory.dmp

    Filesize

    64KB

  • memory/592-180-0x0000000002530000-0x0000000002540000-memory.dmp

    Filesize

    64KB

  • memory/592-181-0x0000000000400000-0x000000000070F000-memory.dmp

    Filesize

    3.1MB

  • memory/592-183-0x0000000000400000-0x000000000070F000-memory.dmp

    Filesize

    3.1MB

  • memory/2520-188-0x00000000052B0000-0x00000000052EF000-memory.dmp

    Filesize

    252KB

  • memory/2520-189-0x00000000052B0000-0x00000000052EF000-memory.dmp

    Filesize

    252KB

  • memory/2520-191-0x00000000052B0000-0x00000000052EF000-memory.dmp

    Filesize

    252KB

  • memory/2520-193-0x00000000052B0000-0x00000000052EF000-memory.dmp

    Filesize

    252KB

  • memory/2520-195-0x00000000052B0000-0x00000000052EF000-memory.dmp

    Filesize

    252KB

  • memory/2520-197-0x00000000052B0000-0x00000000052EF000-memory.dmp

    Filesize

    252KB

  • memory/2520-199-0x00000000052B0000-0x00000000052EF000-memory.dmp

    Filesize

    252KB

  • memory/2520-201-0x00000000052B0000-0x00000000052EF000-memory.dmp

    Filesize

    252KB

  • memory/2520-203-0x00000000052B0000-0x00000000052EF000-memory.dmp

    Filesize

    252KB

  • memory/2520-205-0x00000000052B0000-0x00000000052EF000-memory.dmp

    Filesize

    252KB

  • memory/2520-207-0x00000000052B0000-0x00000000052EF000-memory.dmp

    Filesize

    252KB

  • memory/2520-209-0x00000000052B0000-0x00000000052EF000-memory.dmp

    Filesize

    252KB

  • memory/2520-211-0x00000000052B0000-0x00000000052EF000-memory.dmp

    Filesize

    252KB

  • memory/2520-213-0x00000000052B0000-0x00000000052EF000-memory.dmp

    Filesize

    252KB

  • memory/2520-215-0x00000000052B0000-0x00000000052EF000-memory.dmp

    Filesize

    252KB

  • memory/2520-217-0x00000000052B0000-0x00000000052EF000-memory.dmp

    Filesize

    252KB

  • memory/2520-219-0x00000000052B0000-0x00000000052EF000-memory.dmp

    Filesize

    252KB

  • memory/2520-221-0x00000000052B0000-0x00000000052EF000-memory.dmp

    Filesize

    252KB

  • memory/2520-378-0x0000000002730000-0x0000000002740000-memory.dmp

    Filesize

    64KB

  • memory/2520-376-0x0000000000800000-0x000000000084B000-memory.dmp

    Filesize

    300KB

  • memory/2520-380-0x0000000002730000-0x0000000002740000-memory.dmp

    Filesize

    64KB

  • memory/2520-383-0x0000000002730000-0x0000000002740000-memory.dmp

    Filesize

    64KB

  • memory/2520-1098-0x0000000005320000-0x0000000005938000-memory.dmp

    Filesize

    6.1MB

  • memory/2520-1099-0x00000000059C0000-0x0000000005ACA000-memory.dmp

    Filesize

    1.0MB

  • memory/2520-1100-0x0000000005B00000-0x0000000005B12000-memory.dmp

    Filesize

    72KB

  • memory/2520-1101-0x0000000005B20000-0x0000000005B5C000-memory.dmp

    Filesize

    240KB

  • memory/2520-1102-0x0000000002730000-0x0000000002740000-memory.dmp

    Filesize

    64KB

  • memory/2520-1103-0x0000000005E10000-0x0000000005EA2000-memory.dmp

    Filesize

    584KB

  • memory/2520-1104-0x0000000005EB0000-0x0000000005F16000-memory.dmp

    Filesize

    408KB

  • memory/2520-1106-0x0000000002730000-0x0000000002740000-memory.dmp

    Filesize

    64KB

  • memory/2520-1107-0x0000000002730000-0x0000000002740000-memory.dmp

    Filesize

    64KB

  • memory/2520-1108-0x0000000002730000-0x0000000002740000-memory.dmp

    Filesize

    64KB

  • memory/2520-1109-0x00000000067F0000-0x0000000006866000-memory.dmp

    Filesize

    472KB

  • memory/2520-1110-0x0000000006890000-0x00000000068E0000-memory.dmp

    Filesize

    320KB

  • memory/2520-1111-0x0000000006900000-0x0000000006AC2000-memory.dmp

    Filesize

    1.8MB

  • memory/2520-1112-0x0000000006AE0000-0x000000000700C000-memory.dmp

    Filesize

    5.2MB

  • memory/2520-1113-0x0000000002730000-0x0000000002740000-memory.dmp

    Filesize

    64KB

  • memory/4780-1119-0x0000000000A70000-0x0000000000AA2000-memory.dmp

    Filesize

    200KB

  • memory/4780-1120-0x00000000053F0000-0x0000000005400000-memory.dmp

    Filesize

    64KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.