Analysis

  • max time kernel
    141s
  • max time network
    105s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-03-2023 00:02

General

  • Target

    0c9d93c696b994b66349ae331bf9afba1d34b730486dae290c57e10c43775fc7.exe

  • Size

    700KB

  • MD5

    cb336194f462fa3800eed2a2570f997c

  • SHA1

    69f1d922eea27a00d9bf70bde8f36d7b8c8e72ab

  • SHA256

    0c9d93c696b994b66349ae331bf9afba1d34b730486dae290c57e10c43775fc7

  • SHA512

    a428b4f01e29ce0f8bf7d38ffb2c9ea8ff1ba94b1d144eee89b6b2dc463d4d247bf432c278da55548058f21bec0d0e2b966bfaf69c9823b22b378c85134cfa3b

  • SSDEEP

    12288:HMr8y90Mn3sIS/c9DMVcA5u+7Ht0zTTx7L/DZ:PyPnn05u+7Ht0PTxn/DZ

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

from

C2

176.113.115.145:4125

Attributes
  • auth_value

    8633e283485822a4a48f0a41d5397566

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 18 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0c9d93c696b994b66349ae331bf9afba1d34b730486dae290c57e10c43775fc7.exe
    "C:\Users\Admin\AppData\Local\Temp\0c9d93c696b994b66349ae331bf9afba1d34b730486dae290c57e10c43775fc7.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2364
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un267242.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un267242.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4560
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8081.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8081.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3480
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 1080
          4⤵
          • Program crash
          PID:3284
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7982.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7982.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4572
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 1336
          4⤵
          • Program crash
          PID:3308
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si846597.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si846597.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1344
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3480 -ip 3480
    1⤵
      PID:3436
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4572 -ip 4572
      1⤵
        PID:1204
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe start wuauserv
        1⤵
        • Launches sc.exe
        PID:3768

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si846597.exe

        Filesize

        175KB

        MD5

        1d6f6eb9aa656c59ecc288c6a869eca4

        SHA1

        3920c627d25eab201a94daed786e996cc5ffc843

        SHA256

        785def4c9cab6166964c509003209684a494c980ce69eff356a9bc9f3370db8c

        SHA512

        813f337927a16c3a36baa1df4515ef4bf693e69b8c63ee83596df0f705e0bf99b4aa06333e9877423101a1b89e6d38eabab7c5110f8f2cd72ad9e99938273f19

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si846597.exe

        Filesize

        175KB

        MD5

        1d6f6eb9aa656c59ecc288c6a869eca4

        SHA1

        3920c627d25eab201a94daed786e996cc5ffc843

        SHA256

        785def4c9cab6166964c509003209684a494c980ce69eff356a9bc9f3370db8c

        SHA512

        813f337927a16c3a36baa1df4515ef4bf693e69b8c63ee83596df0f705e0bf99b4aa06333e9877423101a1b89e6d38eabab7c5110f8f2cd72ad9e99938273f19

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un267242.exe

        Filesize

        558KB

        MD5

        05a0c9a78cc956d88fb25f3fd7a47b5d

        SHA1

        6b4d6d6dba3b32900ce3924e39769d54e8f27592

        SHA256

        319f4ece7555d3d08879599341ebd61e4936284b0b8cc87de06b8f0396e45384

        SHA512

        ad5a1799ac2f1e9e4b0bd1dad313a1f7e54eacb86eb3a0a77c357c1a8e7f75b182aaf292864c1325bab07d13d38699fc912d126d90fc00a648cb59e021527c0b

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un267242.exe

        Filesize

        558KB

        MD5

        05a0c9a78cc956d88fb25f3fd7a47b5d

        SHA1

        6b4d6d6dba3b32900ce3924e39769d54e8f27592

        SHA256

        319f4ece7555d3d08879599341ebd61e4936284b0b8cc87de06b8f0396e45384

        SHA512

        ad5a1799ac2f1e9e4b0bd1dad313a1f7e54eacb86eb3a0a77c357c1a8e7f75b182aaf292864c1325bab07d13d38699fc912d126d90fc00a648cb59e021527c0b

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8081.exe

        Filesize

        307KB

        MD5

        d7f5583b0e06e13db2917a7f5bbeaa3e

        SHA1

        068ee95d2bcc2833a9a6f433bdbb6de6e1bb8b60

        SHA256

        97912495cd985b5300be7cc1b33b7a15c7057b654d82ed1e8edb8789c789f66b

        SHA512

        f9d37729841286507151835ef59e30d63f465abc2660c64174f72339698da6542cf7fe3bb349678ed5e8b1e5cc2ee68b2d9eecb5c5d33d8ec1594bf6d2a64fb7

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8081.exe

        Filesize

        307KB

        MD5

        d7f5583b0e06e13db2917a7f5bbeaa3e

        SHA1

        068ee95d2bcc2833a9a6f433bdbb6de6e1bb8b60

        SHA256

        97912495cd985b5300be7cc1b33b7a15c7057b654d82ed1e8edb8789c789f66b

        SHA512

        f9d37729841286507151835ef59e30d63f465abc2660c64174f72339698da6542cf7fe3bb349678ed5e8b1e5cc2ee68b2d9eecb5c5d33d8ec1594bf6d2a64fb7

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7982.exe

        Filesize

        365KB

        MD5

        6dc37eb2d96e72659142c1cfa1396cff

        SHA1

        fd6f302c4df439567b0c9a946d69f25ce206217b

        SHA256

        86be5736993b55ef2f452c3fda54d2ee6035836e4dbcc2b28086ecb0b7f830e8

        SHA512

        e0367417d70f858c4b67822ee08f27912c26c0b347bfe6479173c5ff36305a12dbed6fe91b7967566d4b385b4014648f1176446a370e8a2df1f46be1fe08677e

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7982.exe

        Filesize

        365KB

        MD5

        6dc37eb2d96e72659142c1cfa1396cff

        SHA1

        fd6f302c4df439567b0c9a946d69f25ce206217b

        SHA256

        86be5736993b55ef2f452c3fda54d2ee6035836e4dbcc2b28086ecb0b7f830e8

        SHA512

        e0367417d70f858c4b67822ee08f27912c26c0b347bfe6479173c5ff36305a12dbed6fe91b7967566d4b385b4014648f1176446a370e8a2df1f46be1fe08677e

      • memory/1344-1120-0x0000000000040000-0x0000000000072000-memory.dmp

        Filesize

        200KB

      • memory/1344-1121-0x0000000004C70000-0x0000000004C80000-memory.dmp

        Filesize

        64KB

      • memory/3480-156-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/3480-166-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/3480-152-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

        Filesize

        64KB

      • memory/3480-151-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

        Filesize

        64KB

      • memory/3480-153-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/3480-154-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/3480-149-0x0000000000710000-0x000000000073D000-memory.dmp

        Filesize

        180KB

      • memory/3480-158-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/3480-160-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/3480-162-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/3480-164-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/3480-150-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

        Filesize

        64KB

      • memory/3480-168-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/3480-170-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/3480-172-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/3480-174-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/3480-176-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/3480-178-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/3480-180-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/3480-181-0x0000000000400000-0x000000000070F000-memory.dmp

        Filesize

        3.1MB

      • memory/3480-182-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

        Filesize

        64KB

      • memory/3480-183-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

        Filesize

        64KB

      • memory/3480-185-0x0000000000400000-0x000000000070F000-memory.dmp

        Filesize

        3.1MB

      • memory/3480-148-0x0000000004DC0000-0x0000000005364000-memory.dmp

        Filesize

        5.6MB

      • memory/4572-193-0x0000000002890000-0x00000000028CF000-memory.dmp

        Filesize

        252KB

      • memory/4572-414-0x0000000000810000-0x000000000085B000-memory.dmp

        Filesize

        300KB

      • memory/4572-195-0x0000000002890000-0x00000000028CF000-memory.dmp

        Filesize

        252KB

      • memory/4572-197-0x0000000002890000-0x00000000028CF000-memory.dmp

        Filesize

        252KB

      • memory/4572-199-0x0000000002890000-0x00000000028CF000-memory.dmp

        Filesize

        252KB

      • memory/4572-201-0x0000000002890000-0x00000000028CF000-memory.dmp

        Filesize

        252KB

      • memory/4572-203-0x0000000002890000-0x00000000028CF000-memory.dmp

        Filesize

        252KB

      • memory/4572-205-0x0000000002890000-0x00000000028CF000-memory.dmp

        Filesize

        252KB

      • memory/4572-207-0x0000000002890000-0x00000000028CF000-memory.dmp

        Filesize

        252KB

      • memory/4572-209-0x0000000002890000-0x00000000028CF000-memory.dmp

        Filesize

        252KB

      • memory/4572-213-0x0000000002890000-0x00000000028CF000-memory.dmp

        Filesize

        252KB

      • memory/4572-211-0x0000000002890000-0x00000000028CF000-memory.dmp

        Filesize

        252KB

      • memory/4572-215-0x0000000002890000-0x00000000028CF000-memory.dmp

        Filesize

        252KB

      • memory/4572-217-0x0000000002890000-0x00000000028CF000-memory.dmp

        Filesize

        252KB

      • memory/4572-219-0x0000000002890000-0x00000000028CF000-memory.dmp

        Filesize

        252KB

      • memory/4572-221-0x0000000002890000-0x00000000028CF000-memory.dmp

        Filesize

        252KB

      • memory/4572-223-0x0000000002890000-0x00000000028CF000-memory.dmp

        Filesize

        252KB

      • memory/4572-191-0x0000000002890000-0x00000000028CF000-memory.dmp

        Filesize

        252KB

      • memory/4572-416-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

        Filesize

        64KB

      • memory/4572-418-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

        Filesize

        64KB

      • memory/4572-420-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

        Filesize

        64KB

      • memory/4572-1100-0x0000000005490000-0x0000000005AA8000-memory.dmp

        Filesize

        6.1MB

      • memory/4572-1101-0x0000000005AB0000-0x0000000005BBA000-memory.dmp

        Filesize

        1.0MB

      • memory/4572-1102-0x0000000004E10000-0x0000000004E22000-memory.dmp

        Filesize

        72KB

      • memory/4572-1103-0x0000000004E30000-0x0000000004E6C000-memory.dmp

        Filesize

        240KB

      • memory/4572-1104-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

        Filesize

        64KB

      • memory/4572-1105-0x0000000005E10000-0x0000000005EA2000-memory.dmp

        Filesize

        584KB

      • memory/4572-1106-0x0000000005EB0000-0x0000000005F16000-memory.dmp

        Filesize

        408KB

      • memory/4572-1107-0x00000000065B0000-0x0000000006626000-memory.dmp

        Filesize

        472KB

      • memory/4572-1108-0x0000000006640000-0x0000000006690000-memory.dmp

        Filesize

        320KB

      • memory/4572-1110-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

        Filesize

        64KB

      • memory/4572-1111-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

        Filesize

        64KB

      • memory/4572-190-0x0000000002890000-0x00000000028CF000-memory.dmp

        Filesize

        252KB

      • memory/4572-1112-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

        Filesize

        64KB

      • memory/4572-1113-0x0000000006C70000-0x0000000006E32000-memory.dmp

        Filesize

        1.8MB

      • memory/4572-1114-0x0000000006E40000-0x000000000736C000-memory.dmp

        Filesize

        5.2MB