Analysis

  • max time kernel
    86s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-03-2023 20:35

General

  • Target

    4ee2a2676c57d925c359be2d4af3b37be85a3f1733a104aaf55fb93650ccb96b.exe

  • Size

    695KB

  • MD5

    39a5d719823b7a9091496ee134b89d79

  • SHA1

    c263f229c69bb5c94f9f8b5adf834bd4e06187d1

  • SHA256

    4ee2a2676c57d925c359be2d4af3b37be85a3f1733a104aaf55fb93650ccb96b

  • SHA512

    ce927fd35563b489a78481fab66a38dd34add34862c585910e65b5f9670b4d95b8e82158ca75b9d1ce13e834c53ab40fe8062294451f0968b175a67c195efa39

  • SSDEEP

    12288:HMr9y90ajuzPgl6b9Dt3NWNuPly1O4H4kQ5zGAbJ57Wt9UeJ:aytizPgl6b9xANely1Ov/GU89PJ

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

from

C2

176.113.115.145:4125

Attributes
  • auth_value

    8633e283485822a4a48f0a41d5397566

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 18 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4ee2a2676c57d925c359be2d4af3b37be85a3f1733a104aaf55fb93650ccb96b.exe
    "C:\Users\Admin\AppData\Local\Temp\4ee2a2676c57d925c359be2d4af3b37be85a3f1733a104aaf55fb93650ccb96b.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4400
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un549877.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un549877.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1524
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9781.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9781.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:644
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7213.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7213.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2012
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si776228.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si776228.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2452

Network

  • flag-us
    DNS
    104.219.191.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    104.219.191.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    145.115.113.176.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    145.115.113.176.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    151.122.125.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    151.122.125.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    97.17.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    97.17.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    86.8.109.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    86.8.109.52.in-addr.arpa
    IN PTR
    Response
  • 93.184.220.29:80
    322 B
    7
  • 93.184.220.29:80
    322 B
    7
  • 176.113.115.145:4125
    qu7213.exe
    877.1kB
    16.6kB
    616
    261
  • 176.113.115.145:4125
    si776228.exe
    876.9kB
    15.3kB
    614
    230
  • 20.189.173.5:443
    322 B
    7
  • 173.223.113.164:443
    322 B
    7
  • 173.223.113.131:80
    322 B
    7
  • 8.238.177.126:80
    322 B
    7
  • 8.8.8.8:53
    104.219.191.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    104.219.191.52.in-addr.arpa

  • 8.8.8.8:53
    145.115.113.176.in-addr.arpa
    dns
    74 B
    134 B
    1
    1

    DNS Request

    145.115.113.176.in-addr.arpa

  • 8.8.8.8:53
    151.122.125.40.in-addr.arpa
    dns
    73 B
    159 B
    1
    1

    DNS Request

    151.122.125.40.in-addr.arpa

  • 8.8.8.8:53
    97.17.167.52.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    97.17.167.52.in-addr.arpa

  • 8.8.8.8:53
    86.8.109.52.in-addr.arpa
    dns
    70 B
    144 B
    1
    1

    DNS Request

    86.8.109.52.in-addr.arpa

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si776228.exe

    Filesize

    175KB

    MD5

    8d44b3cef18991a189b9db910648df65

    SHA1

    1444721c1fbc678ecbcdedb0b93767f7e6723330

    SHA256

    d150f76833071403885ec11ffc17b84d93a4dbaa39294df9ad4eb2b810f9c169

    SHA512

    acb60b9d9d1e40ad7b62790267a980c27b8574386e9e7042112a97863d2919bd7a131883db6e14dd32fa3725a2fcf364d84a061b94e3c7548f9674cf0013bd6f

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si776228.exe

    Filesize

    175KB

    MD5

    8d44b3cef18991a189b9db910648df65

    SHA1

    1444721c1fbc678ecbcdedb0b93767f7e6723330

    SHA256

    d150f76833071403885ec11ffc17b84d93a4dbaa39294df9ad4eb2b810f9c169

    SHA512

    acb60b9d9d1e40ad7b62790267a980c27b8574386e9e7042112a97863d2919bd7a131883db6e14dd32fa3725a2fcf364d84a061b94e3c7548f9674cf0013bd6f

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un549877.exe

    Filesize

    553KB

    MD5

    47be47368f2a44200457a0be69a971ea

    SHA1

    68557738aa8c3f4813e8e55b6a3cc3551d485bc2

    SHA256

    63a8887bcc853d875c5b571916df10d5ba7c263d009baad6287c469284f765a3

    SHA512

    96e92869b84e4aac938ea6c0d3956649cb632d5cb68e33a3c6f320540ad0f7b230ebb9b521dfd0d35b4e51dd37d6b8cd3e97c17dac999c791836ff15d9fd92f5

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un549877.exe

    Filesize

    553KB

    MD5

    47be47368f2a44200457a0be69a971ea

    SHA1

    68557738aa8c3f4813e8e55b6a3cc3551d485bc2

    SHA256

    63a8887bcc853d875c5b571916df10d5ba7c263d009baad6287c469284f765a3

    SHA512

    96e92869b84e4aac938ea6c0d3956649cb632d5cb68e33a3c6f320540ad0f7b230ebb9b521dfd0d35b4e51dd37d6b8cd3e97c17dac999c791836ff15d9fd92f5

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9781.exe

    Filesize

    308KB

    MD5

    be260eed04cfbc7617eab55184052413

    SHA1

    0c911b54a67e8549e4cb87567965183b4d49782e

    SHA256

    880eaf2d2b7104fd95a5e855ede63e3a3fe01167ca764e3e1922e3e94f63da9c

    SHA512

    d2ef466025cfafe6fe7bfc33e5bf835f082112174c201f834e411ce7eaf13802a9a16016488ce73800438dfeaf2ced6bb8ed6e0428073ecd4d66f3540d8354b6

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9781.exe

    Filesize

    308KB

    MD5

    be260eed04cfbc7617eab55184052413

    SHA1

    0c911b54a67e8549e4cb87567965183b4d49782e

    SHA256

    880eaf2d2b7104fd95a5e855ede63e3a3fe01167ca764e3e1922e3e94f63da9c

    SHA512

    d2ef466025cfafe6fe7bfc33e5bf835f082112174c201f834e411ce7eaf13802a9a16016488ce73800438dfeaf2ced6bb8ed6e0428073ecd4d66f3540d8354b6

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7213.exe

    Filesize

    366KB

    MD5

    f756ccb608c7153c5c72013e1800e274

    SHA1

    52349f21a7e4e977662df685e7f66cafd4a15ae2

    SHA256

    65cf40b3724d8075dfb6c753063bfb284a9e2ff35acd6ced796f59d39c5cd1e3

    SHA512

    e42f9a99a33b721704ae54e835a8071729c0865b42ff8804c36c1cb4f67a9076af31787cc4b49fe53e61138cbc8f5e77d583373346be9f1bad69f8ff85555e8e

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7213.exe

    Filesize

    366KB

    MD5

    f756ccb608c7153c5c72013e1800e274

    SHA1

    52349f21a7e4e977662df685e7f66cafd4a15ae2

    SHA256

    65cf40b3724d8075dfb6c753063bfb284a9e2ff35acd6ced796f59d39c5cd1e3

    SHA512

    e42f9a99a33b721704ae54e835a8071729c0865b42ff8804c36c1cb4f67a9076af31787cc4b49fe53e61138cbc8f5e77d583373346be9f1bad69f8ff85555e8e

  • memory/644-149-0x0000000004ED0000-0x0000000005474000-memory.dmp

    Filesize

    5.6MB

  • memory/644-150-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

    Filesize

    64KB

  • memory/644-148-0x0000000000710000-0x000000000073D000-memory.dmp

    Filesize

    180KB

  • memory/644-151-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

    Filesize

    64KB

  • memory/644-152-0x0000000002330000-0x0000000002342000-memory.dmp

    Filesize

    72KB

  • memory/644-153-0x0000000002330000-0x0000000002342000-memory.dmp

    Filesize

    72KB

  • memory/644-155-0x0000000002330000-0x0000000002342000-memory.dmp

    Filesize

    72KB

  • memory/644-157-0x0000000002330000-0x0000000002342000-memory.dmp

    Filesize

    72KB

  • memory/644-159-0x0000000002330000-0x0000000002342000-memory.dmp

    Filesize

    72KB

  • memory/644-161-0x0000000002330000-0x0000000002342000-memory.dmp

    Filesize

    72KB

  • memory/644-163-0x0000000002330000-0x0000000002342000-memory.dmp

    Filesize

    72KB

  • memory/644-165-0x0000000002330000-0x0000000002342000-memory.dmp

    Filesize

    72KB

  • memory/644-167-0x0000000002330000-0x0000000002342000-memory.dmp

    Filesize

    72KB

  • memory/644-169-0x0000000002330000-0x0000000002342000-memory.dmp

    Filesize

    72KB

  • memory/644-171-0x0000000002330000-0x0000000002342000-memory.dmp

    Filesize

    72KB

  • memory/644-173-0x0000000002330000-0x0000000002342000-memory.dmp

    Filesize

    72KB

  • memory/644-175-0x0000000002330000-0x0000000002342000-memory.dmp

    Filesize

    72KB

  • memory/644-177-0x0000000002330000-0x0000000002342000-memory.dmp

    Filesize

    72KB

  • memory/644-179-0x0000000002330000-0x0000000002342000-memory.dmp

    Filesize

    72KB

  • memory/644-180-0x0000000000400000-0x000000000070F000-memory.dmp

    Filesize

    3.1MB

  • memory/644-181-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

    Filesize

    64KB

  • memory/644-182-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

    Filesize

    64KB

  • memory/644-183-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

    Filesize

    64KB

  • memory/644-185-0x0000000000400000-0x000000000070F000-memory.dmp

    Filesize

    3.1MB

  • memory/2012-190-0x0000000004CE0000-0x0000000004D1F000-memory.dmp

    Filesize

    252KB

  • memory/2012-193-0x0000000004CE0000-0x0000000004D1F000-memory.dmp

    Filesize

    252KB

  • memory/2012-191-0x0000000004CE0000-0x0000000004D1F000-memory.dmp

    Filesize

    252KB

  • memory/2012-195-0x0000000004CE0000-0x0000000004D1F000-memory.dmp

    Filesize

    252KB

  • memory/2012-197-0x0000000004CE0000-0x0000000004D1F000-memory.dmp

    Filesize

    252KB

  • memory/2012-199-0x0000000004CE0000-0x0000000004D1F000-memory.dmp

    Filesize

    252KB

  • memory/2012-201-0x0000000004CE0000-0x0000000004D1F000-memory.dmp

    Filesize

    252KB

  • memory/2012-203-0x0000000004CE0000-0x0000000004D1F000-memory.dmp

    Filesize

    252KB

  • memory/2012-205-0x0000000004CE0000-0x0000000004D1F000-memory.dmp

    Filesize

    252KB

  • memory/2012-207-0x0000000004CE0000-0x0000000004D1F000-memory.dmp

    Filesize

    252KB

  • memory/2012-209-0x0000000004CE0000-0x0000000004D1F000-memory.dmp

    Filesize

    252KB

  • memory/2012-211-0x0000000004CE0000-0x0000000004D1F000-memory.dmp

    Filesize

    252KB

  • memory/2012-213-0x0000000004CE0000-0x0000000004D1F000-memory.dmp

    Filesize

    252KB

  • memory/2012-215-0x0000000004CE0000-0x0000000004D1F000-memory.dmp

    Filesize

    252KB

  • memory/2012-217-0x0000000004CE0000-0x0000000004D1F000-memory.dmp

    Filesize

    252KB

  • memory/2012-220-0x0000000000750000-0x000000000079B000-memory.dmp

    Filesize

    300KB

  • memory/2012-219-0x0000000004CE0000-0x0000000004D1F000-memory.dmp

    Filesize

    252KB

  • memory/2012-222-0x0000000004E60000-0x0000000004E70000-memory.dmp

    Filesize

    64KB

  • memory/2012-224-0x0000000004CE0000-0x0000000004D1F000-memory.dmp

    Filesize

    252KB

  • memory/2012-227-0x0000000004CE0000-0x0000000004D1F000-memory.dmp

    Filesize

    252KB

  • memory/2012-225-0x0000000004E60000-0x0000000004E70000-memory.dmp

    Filesize

    64KB

  • memory/2012-223-0x0000000004E60000-0x0000000004E70000-memory.dmp

    Filesize

    64KB

  • memory/2012-1100-0x0000000005520000-0x0000000005B38000-memory.dmp

    Filesize

    6.1MB

  • memory/2012-1101-0x0000000005B40000-0x0000000005C4A000-memory.dmp

    Filesize

    1.0MB

  • memory/2012-1102-0x0000000004E60000-0x0000000004E70000-memory.dmp

    Filesize

    64KB

  • memory/2012-1103-0x0000000005C50000-0x0000000005C62000-memory.dmp

    Filesize

    72KB

  • memory/2012-1104-0x0000000005C70000-0x0000000005CAC000-memory.dmp

    Filesize

    240KB

  • memory/2012-1106-0x0000000005F50000-0x0000000005FB6000-memory.dmp

    Filesize

    408KB

  • memory/2012-1107-0x0000000006600000-0x0000000006692000-memory.dmp

    Filesize

    584KB

  • memory/2012-1108-0x00000000066F0000-0x0000000006766000-memory.dmp

    Filesize

    472KB

  • memory/2012-1109-0x0000000006780000-0x00000000067D0000-memory.dmp

    Filesize

    320KB

  • memory/2012-1110-0x0000000004E60000-0x0000000004E70000-memory.dmp

    Filesize

    64KB

  • memory/2012-1112-0x0000000004E60000-0x0000000004E70000-memory.dmp

    Filesize

    64KB

  • memory/2012-1111-0x0000000004E60000-0x0000000004E70000-memory.dmp

    Filesize

    64KB

  • memory/2012-1113-0x00000000068F0000-0x0000000006AB2000-memory.dmp

    Filesize

    1.8MB

  • memory/2012-1114-0x0000000006AD0000-0x0000000006FFC000-memory.dmp

    Filesize

    5.2MB

  • memory/2012-1115-0x0000000004E60000-0x0000000004E70000-memory.dmp

    Filesize

    64KB

  • memory/2452-1121-0x0000000000970000-0x00000000009A2000-memory.dmp

    Filesize

    200KB

  • memory/2452-1122-0x00000000055D0000-0x00000000055E0000-memory.dmp

    Filesize

    64KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.