Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
28-03-2023 00:10
General
-
Target
ad742900a2401bdf38005e834e7f9ef45ec5904ef9234126cd7748679eaec096.exe
-
Size
700KB
-
MD5
534dd6d182950f2c33dd6a4b95c8ba5f
-
SHA1
49537e779c94e07b73b3df96e5ae25537e78ee8b
-
SHA256
ad742900a2401bdf38005e834e7f9ef45ec5904ef9234126cd7748679eaec096
-
SHA512
b2e223bf3666eccb230e44b754afd7fa4ded0a1107e5d49c202be1c149d3d261bffd2d3bb4f707b9a8113ca8e7ca725e43e57a89c44cc5e0c971f62b260af334
-
SSDEEP
12288:kMrly905HCX5MgCcaisl2LA9D/scAQDNTqKadHM7PHB2+V7Zdwc:hywH4PaiSEcqTi7pFfec
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 22 IoCs
-
Executes dropped EXE 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 2 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad742900a2401bdf38005e834e7f9ef45ec5904ef9234126cd7748679eaec096.exe"C:\Users\Admin\AppData\Local\Temp\ad742900a2401bdf38005e834e7f9ef45ec5904ef9234126cd7748679eaec096.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un627165.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un627165.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6369.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6369.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9398.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9398.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si508124.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si508124.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD53d634df736615c0cf8b72449b5c82900
SHA1c289c4ec638a8d67c04d15a1c166198cf51bdeca
SHA256b3e2a50e88889e45b3276bca82d7a8a5ec2b9a463c91212a3528a734bb566837
SHA512f5abb6450fb41957a3195e632aee7a36ba56252e79bd2a573288796d1b90ad9e029f63e1a0afa82b7cb3276d17942b9440d5f2069ce0ce1338eb18cd97209a53
-
Filesize
175KB
MD53d634df736615c0cf8b72449b5c82900
SHA1c289c4ec638a8d67c04d15a1c166198cf51bdeca
SHA256b3e2a50e88889e45b3276bca82d7a8a5ec2b9a463c91212a3528a734bb566837
SHA512f5abb6450fb41957a3195e632aee7a36ba56252e79bd2a573288796d1b90ad9e029f63e1a0afa82b7cb3276d17942b9440d5f2069ce0ce1338eb18cd97209a53
-
Filesize
558KB
MD56b5e31b3572b71944792c2af26843fab
SHA1a06d62b84969810bbd42ea2cfc0adb999bea78fb
SHA256df1abe5235a07790284e2ec9e10dc1e86124aca085296c9e66c0a0bdd657af79
SHA5125160a151100f1a0c60a89949e55c43a6b3eeee51f9bbc2051ad0c5c51291d37e35bfc5a6f373b15c6a388f3bf6d1a56352670b318309fc268c7258650b181592
-
Filesize
558KB
MD56b5e31b3572b71944792c2af26843fab
SHA1a06d62b84969810bbd42ea2cfc0adb999bea78fb
SHA256df1abe5235a07790284e2ec9e10dc1e86124aca085296c9e66c0a0bdd657af79
SHA5125160a151100f1a0c60a89949e55c43a6b3eeee51f9bbc2051ad0c5c51291d37e35bfc5a6f373b15c6a388f3bf6d1a56352670b318309fc268c7258650b181592
-
Filesize
307KB
MD53ec460e72d4ceb97a82f5e48be0855dd
SHA1dccf7f9cf406e3ffcae4af9dfa448be8d6961b51
SHA256d05b7327c20f61b671e45f88000f68cb7c29a0a1cf4106c11f61ea7ed6186f73
SHA5125724fc0e4c4ca8c74685167a19a365ff1b8e75eff2c02e0733fea7772d5d179033cdf8f001521e6edf28ce461d56fd332e72e1caed94863f1f368dc84adfd714
-
Filesize
307KB
MD53ec460e72d4ceb97a82f5e48be0855dd
SHA1dccf7f9cf406e3ffcae4af9dfa448be8d6961b51
SHA256d05b7327c20f61b671e45f88000f68cb7c29a0a1cf4106c11f61ea7ed6186f73
SHA5125724fc0e4c4ca8c74685167a19a365ff1b8e75eff2c02e0733fea7772d5d179033cdf8f001521e6edf28ce461d56fd332e72e1caed94863f1f368dc84adfd714
-
Filesize
365KB
MD5b8f7a39fc7ba067ae17ec5fee7b1ab6e
SHA18e2b3649d8ec7fb554b6f482f0e9f5a1544d2122
SHA256bc6e27d19f8ed17bf418f257f5e254087a6eb4f678db120f14ea39e9ff451b5c
SHA512cf4e9183432e1f5493b96fea5e5b6ce1d1060d335322330934a11f1bbdfa052d3039d4578742ba96a285fe5e2b88b56086a834cf076d56c1e21913ccc01c9e88
-
Filesize
365KB
MD5b8f7a39fc7ba067ae17ec5fee7b1ab6e
SHA18e2b3649d8ec7fb554b6f482f0e9f5a1544d2122
SHA256bc6e27d19f8ed17bf418f257f5e254087a6eb4f678db120f14ea39e9ff451b5c
SHA512cf4e9183432e1f5493b96fea5e5b6ce1d1060d335322330934a11f1bbdfa052d3039d4578742ba96a285fe5e2b88b56086a834cf076d56c1e21913ccc01c9e88
-
Filesize
180KB
-
Filesize
104KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
5.0MB
-
Filesize
96KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
3.1MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
3.1MB
-
Filesize
200KB
-
Filesize
64KB
-
Filesize
300KB
-
Filesize
252KB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
300KB
-
Filesize
252KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
6.0MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
248KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
472KB
-
Filesize
272KB
-
Filesize
280KB
-
Filesize
320KB
-
Filesize
1.8MB
-
Filesize
5.2MB