Analysis

  • max time kernel
    44s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    28-03-2023 00:56

General

  • Target

    setup.exe

  • Size

    700KB

  • MD5

    3ba8e5a66e46b2d296c0c10e4562c0ae

  • SHA1

    57d7f1e72edfd573928bf6ba137315d121e4016f

  • SHA256

    077a94a553b463f27857dfe6bd3cd19092c286c385c94ea8cb64c9890f757897

  • SHA512

    093d9075b18afeef6192f5fa9653c41dfcb4704ff7a8e0eeaf818a9ca97a077f66d066d8172492c6b604def967234437d52f23efa784610c0dbc3c26b0101d5e

  • SSDEEP

    12288:dMrLy907Q13mUT9NhflO39D/acAS8F5dABIcTJW3yDDzCK2:6yG0nhxOmS8zdAB5U3yr2

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

from

C2

176.113.115.145:4125

Attributes
  • auth_value

    8633e283485822a4a48f0a41d5397566

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 21 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 10 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2032
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un881713.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un881713.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1668
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0670.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0670.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1736
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2114.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2114.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:940
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si966985.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si966985.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1240

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si966985.exe

    Filesize

    175KB

    MD5

    13099f5fabd280d4381d12910cf18553

    SHA1

    95e9692b98e4c6ca60bbdfbdd212540390407091

    SHA256

    00a4aaa0ad4fad6156b9857fe284abc32e3c9f1a9302a725a8a07573afddf9ff

    SHA512

    5af1f0153c69e625c62f46d658b00a7322ad823dfd6667211ca35968d534023b9022c2c0ea9b13174fcefb92ecf104452c6183680331f514d0360ccb21013150

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si966985.exe

    Filesize

    175KB

    MD5

    13099f5fabd280d4381d12910cf18553

    SHA1

    95e9692b98e4c6ca60bbdfbdd212540390407091

    SHA256

    00a4aaa0ad4fad6156b9857fe284abc32e3c9f1a9302a725a8a07573afddf9ff

    SHA512

    5af1f0153c69e625c62f46d658b00a7322ad823dfd6667211ca35968d534023b9022c2c0ea9b13174fcefb92ecf104452c6183680331f514d0360ccb21013150

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un881713.exe

    Filesize

    558KB

    MD5

    92586ab2eddf36244d69faba4ebc33c5

    SHA1

    315c8c17a880061e19de95fe4b3cd7ccecef70c1

    SHA256

    d61fc74643c788696a38940fdab6df2c9507f1652c40d2a676260b567012527f

    SHA512

    69800a97cc1f62d535ed8aa5ea1d1cf3262bab14e3186a3c63475b019b11f7a1a206b912e07ee4125c7892ef6cb3a07251bd5d4c05d85fbda917995e5d079157

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un881713.exe

    Filesize

    558KB

    MD5

    92586ab2eddf36244d69faba4ebc33c5

    SHA1

    315c8c17a880061e19de95fe4b3cd7ccecef70c1

    SHA256

    d61fc74643c788696a38940fdab6df2c9507f1652c40d2a676260b567012527f

    SHA512

    69800a97cc1f62d535ed8aa5ea1d1cf3262bab14e3186a3c63475b019b11f7a1a206b912e07ee4125c7892ef6cb3a07251bd5d4c05d85fbda917995e5d079157

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0670.exe

    Filesize

    307KB

    MD5

    b632a71f76b5f2b67fd6c237160b9cf0

    SHA1

    9fe9b5c79714ec2b598d0879540b97e78234e62b

    SHA256

    4e5fa0ef2ee6340cc25612768ac3f2d42b96b62a5f274cb6197f67dbbaea749c

    SHA512

    240ddf14c0d3610fb63eae8c4a05a00e7d66e03fe52596af377c60ffadf5608b4250a23860b4cc51e5695d384c671ad9b4e229bb6489b90c92d16ab7ae4fec21

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0670.exe

    Filesize

    307KB

    MD5

    b632a71f76b5f2b67fd6c237160b9cf0

    SHA1

    9fe9b5c79714ec2b598d0879540b97e78234e62b

    SHA256

    4e5fa0ef2ee6340cc25612768ac3f2d42b96b62a5f274cb6197f67dbbaea749c

    SHA512

    240ddf14c0d3610fb63eae8c4a05a00e7d66e03fe52596af377c60ffadf5608b4250a23860b4cc51e5695d384c671ad9b4e229bb6489b90c92d16ab7ae4fec21

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0670.exe

    Filesize

    307KB

    MD5

    b632a71f76b5f2b67fd6c237160b9cf0

    SHA1

    9fe9b5c79714ec2b598d0879540b97e78234e62b

    SHA256

    4e5fa0ef2ee6340cc25612768ac3f2d42b96b62a5f274cb6197f67dbbaea749c

    SHA512

    240ddf14c0d3610fb63eae8c4a05a00e7d66e03fe52596af377c60ffadf5608b4250a23860b4cc51e5695d384c671ad9b4e229bb6489b90c92d16ab7ae4fec21

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2114.exe

    Filesize

    365KB

    MD5

    45dc41608596d4d987ddf88ffdf08c2f

    SHA1

    5abc931107c368bcfaf75041a2749961c4bc8d76

    SHA256

    69667a3700f5b0c4974257d210e3e78b78858fafc5f38c6955b46c596064b988

    SHA512

    b615ded9fc61b0265111538e7fb60063827f2989cd74fc01f966ce0ea0c2d241941d5e2ae8e52e055b384f2e2b620def7b0632e6bebb5a606f64534b0baf492d

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2114.exe

    Filesize

    365KB

    MD5

    45dc41608596d4d987ddf88ffdf08c2f

    SHA1

    5abc931107c368bcfaf75041a2749961c4bc8d76

    SHA256

    69667a3700f5b0c4974257d210e3e78b78858fafc5f38c6955b46c596064b988

    SHA512

    b615ded9fc61b0265111538e7fb60063827f2989cd74fc01f966ce0ea0c2d241941d5e2ae8e52e055b384f2e2b620def7b0632e6bebb5a606f64534b0baf492d

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2114.exe

    Filesize

    365KB

    MD5

    45dc41608596d4d987ddf88ffdf08c2f

    SHA1

    5abc931107c368bcfaf75041a2749961c4bc8d76

    SHA256

    69667a3700f5b0c4974257d210e3e78b78858fafc5f38c6955b46c596064b988

    SHA512

    b615ded9fc61b0265111538e7fb60063827f2989cd74fc01f966ce0ea0c2d241941d5e2ae8e52e055b384f2e2b620def7b0632e6bebb5a606f64534b0baf492d

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\si966985.exe

    Filesize

    175KB

    MD5

    13099f5fabd280d4381d12910cf18553

    SHA1

    95e9692b98e4c6ca60bbdfbdd212540390407091

    SHA256

    00a4aaa0ad4fad6156b9857fe284abc32e3c9f1a9302a725a8a07573afddf9ff

    SHA512

    5af1f0153c69e625c62f46d658b00a7322ad823dfd6667211ca35968d534023b9022c2c0ea9b13174fcefb92ecf104452c6183680331f514d0360ccb21013150

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\si966985.exe

    Filesize

    175KB

    MD5

    13099f5fabd280d4381d12910cf18553

    SHA1

    95e9692b98e4c6ca60bbdfbdd212540390407091

    SHA256

    00a4aaa0ad4fad6156b9857fe284abc32e3c9f1a9302a725a8a07573afddf9ff

    SHA512

    5af1f0153c69e625c62f46d658b00a7322ad823dfd6667211ca35968d534023b9022c2c0ea9b13174fcefb92ecf104452c6183680331f514d0360ccb21013150

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\un881713.exe

    Filesize

    558KB

    MD5

    92586ab2eddf36244d69faba4ebc33c5

    SHA1

    315c8c17a880061e19de95fe4b3cd7ccecef70c1

    SHA256

    d61fc74643c788696a38940fdab6df2c9507f1652c40d2a676260b567012527f

    SHA512

    69800a97cc1f62d535ed8aa5ea1d1cf3262bab14e3186a3c63475b019b11f7a1a206b912e07ee4125c7892ef6cb3a07251bd5d4c05d85fbda917995e5d079157

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\un881713.exe

    Filesize

    558KB

    MD5

    92586ab2eddf36244d69faba4ebc33c5

    SHA1

    315c8c17a880061e19de95fe4b3cd7ccecef70c1

    SHA256

    d61fc74643c788696a38940fdab6df2c9507f1652c40d2a676260b567012527f

    SHA512

    69800a97cc1f62d535ed8aa5ea1d1cf3262bab14e3186a3c63475b019b11f7a1a206b912e07ee4125c7892ef6cb3a07251bd5d4c05d85fbda917995e5d079157

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0670.exe

    Filesize

    307KB

    MD5

    b632a71f76b5f2b67fd6c237160b9cf0

    SHA1

    9fe9b5c79714ec2b598d0879540b97e78234e62b

    SHA256

    4e5fa0ef2ee6340cc25612768ac3f2d42b96b62a5f274cb6197f67dbbaea749c

    SHA512

    240ddf14c0d3610fb63eae8c4a05a00e7d66e03fe52596af377c60ffadf5608b4250a23860b4cc51e5695d384c671ad9b4e229bb6489b90c92d16ab7ae4fec21

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0670.exe

    Filesize

    307KB

    MD5

    b632a71f76b5f2b67fd6c237160b9cf0

    SHA1

    9fe9b5c79714ec2b598d0879540b97e78234e62b

    SHA256

    4e5fa0ef2ee6340cc25612768ac3f2d42b96b62a5f274cb6197f67dbbaea749c

    SHA512

    240ddf14c0d3610fb63eae8c4a05a00e7d66e03fe52596af377c60ffadf5608b4250a23860b4cc51e5695d384c671ad9b4e229bb6489b90c92d16ab7ae4fec21

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0670.exe

    Filesize

    307KB

    MD5

    b632a71f76b5f2b67fd6c237160b9cf0

    SHA1

    9fe9b5c79714ec2b598d0879540b97e78234e62b

    SHA256

    4e5fa0ef2ee6340cc25612768ac3f2d42b96b62a5f274cb6197f67dbbaea749c

    SHA512

    240ddf14c0d3610fb63eae8c4a05a00e7d66e03fe52596af377c60ffadf5608b4250a23860b4cc51e5695d384c671ad9b4e229bb6489b90c92d16ab7ae4fec21

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2114.exe

    Filesize

    365KB

    MD5

    45dc41608596d4d987ddf88ffdf08c2f

    SHA1

    5abc931107c368bcfaf75041a2749961c4bc8d76

    SHA256

    69667a3700f5b0c4974257d210e3e78b78858fafc5f38c6955b46c596064b988

    SHA512

    b615ded9fc61b0265111538e7fb60063827f2989cd74fc01f966ce0ea0c2d241941d5e2ae8e52e055b384f2e2b620def7b0632e6bebb5a606f64534b0baf492d

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2114.exe

    Filesize

    365KB

    MD5

    45dc41608596d4d987ddf88ffdf08c2f

    SHA1

    5abc931107c368bcfaf75041a2749961c4bc8d76

    SHA256

    69667a3700f5b0c4974257d210e3e78b78858fafc5f38c6955b46c596064b988

    SHA512

    b615ded9fc61b0265111538e7fb60063827f2989cd74fc01f966ce0ea0c2d241941d5e2ae8e52e055b384f2e2b620def7b0632e6bebb5a606f64534b0baf492d

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2114.exe

    Filesize

    365KB

    MD5

    45dc41608596d4d987ddf88ffdf08c2f

    SHA1

    5abc931107c368bcfaf75041a2749961c4bc8d76

    SHA256

    69667a3700f5b0c4974257d210e3e78b78858fafc5f38c6955b46c596064b988

    SHA512

    b615ded9fc61b0265111538e7fb60063827f2989cd74fc01f966ce0ea0c2d241941d5e2ae8e52e055b384f2e2b620def7b0632e6bebb5a606f64534b0baf492d

  • memory/940-146-0x0000000002680000-0x00000000026BF000-memory.dmp

    Filesize

    252KB

  • memory/940-152-0x0000000002680000-0x00000000026BF000-memory.dmp

    Filesize

    252KB

  • memory/940-1034-0x0000000004CE0000-0x0000000004D20000-memory.dmp

    Filesize

    256KB

  • memory/940-213-0x0000000004CE0000-0x0000000004D20000-memory.dmp

    Filesize

    256KB

  • memory/940-211-0x0000000004CE0000-0x0000000004D20000-memory.dmp

    Filesize

    256KB

  • memory/940-209-0x0000000000260000-0x00000000002AB000-memory.dmp

    Filesize

    300KB

  • memory/940-158-0x0000000002680000-0x00000000026BF000-memory.dmp

    Filesize

    252KB

  • memory/940-156-0x0000000002680000-0x00000000026BF000-memory.dmp

    Filesize

    252KB

  • memory/940-154-0x0000000002680000-0x00000000026BF000-memory.dmp

    Filesize

    252KB

  • memory/940-150-0x0000000002680000-0x00000000026BF000-memory.dmp

    Filesize

    252KB

  • memory/940-148-0x0000000002680000-0x00000000026BF000-memory.dmp

    Filesize

    252KB

  • memory/940-144-0x0000000002680000-0x00000000026BF000-memory.dmp

    Filesize

    252KB

  • memory/940-142-0x0000000002680000-0x00000000026BF000-memory.dmp

    Filesize

    252KB

  • memory/940-140-0x0000000002680000-0x00000000026BF000-memory.dmp

    Filesize

    252KB

  • memory/940-138-0x0000000002680000-0x00000000026BF000-memory.dmp

    Filesize

    252KB

  • memory/940-136-0x0000000002680000-0x00000000026BF000-memory.dmp

    Filesize

    252KB

  • memory/940-134-0x0000000002680000-0x00000000026BF000-memory.dmp

    Filesize

    252KB

  • memory/940-132-0x0000000002680000-0x00000000026BF000-memory.dmp

    Filesize

    252KB

  • memory/940-123-0x0000000002640000-0x0000000002686000-memory.dmp

    Filesize

    280KB

  • memory/940-124-0x0000000002680000-0x00000000026C4000-memory.dmp

    Filesize

    272KB

  • memory/940-125-0x0000000002680000-0x00000000026BF000-memory.dmp

    Filesize

    252KB

  • memory/940-126-0x0000000002680000-0x00000000026BF000-memory.dmp

    Filesize

    252KB

  • memory/940-128-0x0000000002680000-0x00000000026BF000-memory.dmp

    Filesize

    252KB

  • memory/940-130-0x0000000002680000-0x00000000026BF000-memory.dmp

    Filesize

    252KB

  • memory/1240-1043-0x00000000000A0000-0x00000000000D2000-memory.dmp

    Filesize

    200KB

  • memory/1240-1044-0x0000000005110000-0x0000000005150000-memory.dmp

    Filesize

    256KB

  • memory/1736-109-0x0000000002100000-0x0000000002112000-memory.dmp

    Filesize

    72KB

  • memory/1736-89-0x0000000002100000-0x0000000002112000-memory.dmp

    Filesize

    72KB

  • memory/1736-103-0x0000000002100000-0x0000000002112000-memory.dmp

    Filesize

    72KB

  • memory/1736-95-0x0000000002100000-0x0000000002112000-memory.dmp

    Filesize

    72KB

  • memory/1736-112-0x0000000000400000-0x000000000070F000-memory.dmp

    Filesize

    3.1MB

  • memory/1736-82-0x0000000002100000-0x0000000002112000-memory.dmp

    Filesize

    72KB

  • memory/1736-111-0x0000000000400000-0x000000000070F000-memory.dmp

    Filesize

    3.1MB

  • memory/1736-110-0x0000000004E00000-0x0000000004E40000-memory.dmp

    Filesize

    256KB

  • memory/1736-105-0x0000000002100000-0x0000000002112000-memory.dmp

    Filesize

    72KB

  • memory/1736-107-0x0000000002100000-0x0000000002112000-memory.dmp

    Filesize

    72KB

  • memory/1736-85-0x0000000002100000-0x0000000002112000-memory.dmp

    Filesize

    72KB

  • memory/1736-91-0x0000000002100000-0x0000000002112000-memory.dmp

    Filesize

    72KB

  • memory/1736-93-0x0000000002100000-0x0000000002112000-memory.dmp

    Filesize

    72KB

  • memory/1736-99-0x0000000002100000-0x0000000002112000-memory.dmp

    Filesize

    72KB

  • memory/1736-101-0x0000000002100000-0x0000000002112000-memory.dmp

    Filesize

    72KB

  • memory/1736-97-0x0000000002100000-0x0000000002112000-memory.dmp

    Filesize

    72KB

  • memory/1736-81-0x0000000002100000-0x0000000002118000-memory.dmp

    Filesize

    96KB

  • memory/1736-80-0x0000000004E00000-0x0000000004E40000-memory.dmp

    Filesize

    256KB

  • memory/1736-79-0x00000000002D0000-0x00000000002FD000-memory.dmp

    Filesize

    180KB

  • memory/1736-78-0x00000000003C0000-0x00000000003DA000-memory.dmp

    Filesize

    104KB

  • memory/1736-87-0x0000000002100000-0x0000000002112000-memory.dmp

    Filesize

    72KB

  • memory/1736-83-0x0000000002100000-0x0000000002112000-memory.dmp

    Filesize

    72KB