Analysis
-
max time kernel
144s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
28-03-2023 00:41
General
-
Target
8fb89e7915630164ce388dcc48caff2fb425d93e570cc26b64b7a73d9aec19d4.exe
-
Size
690KB
-
MD5
18dd54cf38ed9d12d03073a8b29fa347
-
SHA1
3c646221303c3c258934796922a7aa2c18bb843d
-
SHA256
8fb89e7915630164ce388dcc48caff2fb425d93e570cc26b64b7a73d9aec19d4
-
SHA512
a741a6f3b2af66fcfee2361c83c05a301abeb85b9663b71d6995cf91cfdd23a7ae76400c8e7aedef02d856769ebf6dd1f8558d34b67a744324055cb1e626801d
-
SSDEEP
12288:VMrqy90wbFXE5f1n80ZR5bsrrIq0Ulj/e5mWXFHqbRfdNoUQhhTjgy:Hyble8C4rkqh7UmWCIBhhT8y
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
-
Executes dropped EXE 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 2 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8fb89e7915630164ce388dcc48caff2fb425d93e570cc26b64b7a73d9aec19d4.exe"C:\Users\Admin\AppData\Local\Temp\8fb89e7915630164ce388dcc48caff2fb425d93e570cc26b64b7a73d9aec19d4.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un958577.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un958577.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1418.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1418.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 10844⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1782.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1782.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4852 -ip 48521⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
549KB
MD54482c075e8e3c8e1daae8386908235fc
SHA1b1df800f4b56288ec65b4a6490156ec543ed67e8
SHA256c6d0bfd8ed6f7724949ceb81c43b82eac3e47ce39693fc02629ce339c4540faf
SHA5122905ea3dcfd85672489639ccfacbeafca980d91b8b5be74efdb239c6f7399377d4caaea7d2f7292a7de1654f2d3ec46030214e8e31d59c9757b882fc71911eb5
-
Filesize
549KB
MD54482c075e8e3c8e1daae8386908235fc
SHA1b1df800f4b56288ec65b4a6490156ec543ed67e8
SHA256c6d0bfd8ed6f7724949ceb81c43b82eac3e47ce39693fc02629ce339c4540faf
SHA5122905ea3dcfd85672489639ccfacbeafca980d91b8b5be74efdb239c6f7399377d4caaea7d2f7292a7de1654f2d3ec46030214e8e31d59c9757b882fc71911eb5
-
Filesize
291KB
MD534cd6b6387390489459fef85dc68e1ca
SHA166940014ee16bb59ac3598e00f31b284fd5c6198
SHA2565acaeef4f31ac06a733563b4c6e1eed2337b850abdf54d11686c909073477221
SHA512d98a80812f87bc669131ab628f0432c472e13b160f752a1bdb1dd0aa3bcee56dfa3dbb57343352d0c4aa95045f8094ab7345af19cc7bb4e1a30ad25c1cae0369
-
Filesize
291KB
MD534cd6b6387390489459fef85dc68e1ca
SHA166940014ee16bb59ac3598e00f31b284fd5c6198
SHA2565acaeef4f31ac06a733563b4c6e1eed2337b850abdf54d11686c909073477221
SHA512d98a80812f87bc669131ab628f0432c472e13b160f752a1bdb1dd0aa3bcee56dfa3dbb57343352d0c4aa95045f8094ab7345af19cc7bb4e1a30ad25c1cae0369
-
Filesize
350KB
MD537f79014c812d6796f6f65476ca2e45d
SHA1f6f57930a12c73abb7b211bfd25f84dbb2abeb70
SHA2567635ad0bf24f1a41eac13367e8451528e034de2399119694710365fcb15c94bf
SHA5126e6b02fe1dbebe13fa8bedd2b2f45a093c48fc21f3fc1dae7d29f06ef1202f6a5d3b95984a2cecfe3b5bfa4f95f52a52af21b3cb73046cb532b9ad68b5fdc354
-
Filesize
350KB
MD537f79014c812d6796f6f65476ca2e45d
SHA1f6f57930a12c73abb7b211bfd25f84dbb2abeb70
SHA2567635ad0bf24f1a41eac13367e8451528e034de2399119694710365fcb15c94bf
SHA5126e6b02fe1dbebe13fa8bedd2b2f45a093c48fc21f3fc1dae7d29f06ef1202f6a5d3b95984a2cecfe3b5bfa4f95f52a52af21b3cb73046cb532b9ad68b5fdc354
-
Filesize
252KB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
64KB
-
Filesize
5.2MB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
1.8MB
-
Filesize
320KB
-
Filesize
472KB
-
Filesize
584KB
-
Filesize
408KB
-
Filesize
240KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
1.0MB
-
Filesize
6.1MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
180KB
-
Filesize
64KB
-
Filesize
3.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
5.6MB
-
Filesize
64KB
-
Filesize
3.0MB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB