Analysis

  • max time kernel
    102s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-03-2023 00:56

General

  • Target

    setup.exe

  • Size

    700KB

  • MD5

    3ba8e5a66e46b2d296c0c10e4562c0ae

  • SHA1

    57d7f1e72edfd573928bf6ba137315d121e4016f

  • SHA256

    077a94a553b463f27857dfe6bd3cd19092c286c385c94ea8cb64c9890f757897

  • SHA512

    093d9075b18afeef6192f5fa9653c41dfcb4704ff7a8e0eeaf818a9ca97a077f66d066d8172492c6b604def967234437d52f23efa784610c0dbc3c26b0101d5e

  • SSDEEP

    12288:dMrLy907Q13mUT9NhflO39D/acAS8F5dABIcTJW3yDDzCK2:6yG0nhxOmS8zdAB5U3yr2

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

from

C2

176.113.115.145:4125

Attributes
  • auth_value

    8633e283485822a4a48f0a41d5397566

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1500
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un881713.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un881713.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2728
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0670.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0670.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4808
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 1084
          4⤵
          • Program crash
          PID:4460
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2114.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2114.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4132
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 1680
          4⤵
          • Program crash
          PID:376
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si966985.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si966985.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3416
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4808 -ip 4808
    1⤵
      PID:4484
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4132 -ip 4132
      1⤵
        PID:5092

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si966985.exe
        Filesize

        175KB

        MD5

        13099f5fabd280d4381d12910cf18553

        SHA1

        95e9692b98e4c6ca60bbdfbdd212540390407091

        SHA256

        00a4aaa0ad4fad6156b9857fe284abc32e3c9f1a9302a725a8a07573afddf9ff

        SHA512

        5af1f0153c69e625c62f46d658b00a7322ad823dfd6667211ca35968d534023b9022c2c0ea9b13174fcefb92ecf104452c6183680331f514d0360ccb21013150

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si966985.exe
        Filesize

        175KB

        MD5

        13099f5fabd280d4381d12910cf18553

        SHA1

        95e9692b98e4c6ca60bbdfbdd212540390407091

        SHA256

        00a4aaa0ad4fad6156b9857fe284abc32e3c9f1a9302a725a8a07573afddf9ff

        SHA512

        5af1f0153c69e625c62f46d658b00a7322ad823dfd6667211ca35968d534023b9022c2c0ea9b13174fcefb92ecf104452c6183680331f514d0360ccb21013150

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un881713.exe
        Filesize

        558KB

        MD5

        92586ab2eddf36244d69faba4ebc33c5

        SHA1

        315c8c17a880061e19de95fe4b3cd7ccecef70c1

        SHA256

        d61fc74643c788696a38940fdab6df2c9507f1652c40d2a676260b567012527f

        SHA512

        69800a97cc1f62d535ed8aa5ea1d1cf3262bab14e3186a3c63475b019b11f7a1a206b912e07ee4125c7892ef6cb3a07251bd5d4c05d85fbda917995e5d079157

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un881713.exe
        Filesize

        558KB

        MD5

        92586ab2eddf36244d69faba4ebc33c5

        SHA1

        315c8c17a880061e19de95fe4b3cd7ccecef70c1

        SHA256

        d61fc74643c788696a38940fdab6df2c9507f1652c40d2a676260b567012527f

        SHA512

        69800a97cc1f62d535ed8aa5ea1d1cf3262bab14e3186a3c63475b019b11f7a1a206b912e07ee4125c7892ef6cb3a07251bd5d4c05d85fbda917995e5d079157

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0670.exe
        Filesize

        307KB

        MD5

        b632a71f76b5f2b67fd6c237160b9cf0

        SHA1

        9fe9b5c79714ec2b598d0879540b97e78234e62b

        SHA256

        4e5fa0ef2ee6340cc25612768ac3f2d42b96b62a5f274cb6197f67dbbaea749c

        SHA512

        240ddf14c0d3610fb63eae8c4a05a00e7d66e03fe52596af377c60ffadf5608b4250a23860b4cc51e5695d384c671ad9b4e229bb6489b90c92d16ab7ae4fec21

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0670.exe
        Filesize

        307KB

        MD5

        b632a71f76b5f2b67fd6c237160b9cf0

        SHA1

        9fe9b5c79714ec2b598d0879540b97e78234e62b

        SHA256

        4e5fa0ef2ee6340cc25612768ac3f2d42b96b62a5f274cb6197f67dbbaea749c

        SHA512

        240ddf14c0d3610fb63eae8c4a05a00e7d66e03fe52596af377c60ffadf5608b4250a23860b4cc51e5695d384c671ad9b4e229bb6489b90c92d16ab7ae4fec21

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2114.exe
        Filesize

        365KB

        MD5

        45dc41608596d4d987ddf88ffdf08c2f

        SHA1

        5abc931107c368bcfaf75041a2749961c4bc8d76

        SHA256

        69667a3700f5b0c4974257d210e3e78b78858fafc5f38c6955b46c596064b988

        SHA512

        b615ded9fc61b0265111538e7fb60063827f2989cd74fc01f966ce0ea0c2d241941d5e2ae8e52e055b384f2e2b620def7b0632e6bebb5a606f64534b0baf492d

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2114.exe
        Filesize

        365KB

        MD5

        45dc41608596d4d987ddf88ffdf08c2f

        SHA1

        5abc931107c368bcfaf75041a2749961c4bc8d76

        SHA256

        69667a3700f5b0c4974257d210e3e78b78858fafc5f38c6955b46c596064b988

        SHA512

        b615ded9fc61b0265111538e7fb60063827f2989cd74fc01f966ce0ea0c2d241941d5e2ae8e52e055b384f2e2b620def7b0632e6bebb5a606f64534b0baf492d

      • memory/3416-1122-0x00000000049E0000-0x00000000049F0000-memory.dmp
        Filesize

        64KB

      • memory/3416-1121-0x00000000000F0000-0x0000000000122000-memory.dmp
        Filesize

        200KB

      • memory/4132-227-0x0000000004D10000-0x0000000004D4F000-memory.dmp
        Filesize

        252KB

      • memory/4132-1104-0x0000000004E50000-0x0000000004E60000-memory.dmp
        Filesize

        64KB

      • memory/4132-1115-0x0000000004E50000-0x0000000004E60000-memory.dmp
        Filesize

        64KB

      • memory/4132-1114-0x0000000006F90000-0x00000000074BC000-memory.dmp
        Filesize

        5.2MB

      • memory/4132-1113-0x0000000006B80000-0x0000000006D42000-memory.dmp
        Filesize

        1.8MB

      • memory/4132-1112-0x0000000004E50000-0x0000000004E60000-memory.dmp
        Filesize

        64KB

      • memory/4132-1111-0x0000000004E50000-0x0000000004E60000-memory.dmp
        Filesize

        64KB

      • memory/4132-1110-0x0000000004E50000-0x0000000004E60000-memory.dmp
        Filesize

        64KB

      • memory/4132-1108-0x00000000069C0000-0x0000000006A10000-memory.dmp
        Filesize

        320KB

      • memory/4132-1107-0x0000000006930000-0x00000000069A6000-memory.dmp
        Filesize

        472KB

      • memory/4132-1106-0x0000000005FF0000-0x0000000006056000-memory.dmp
        Filesize

        408KB

      • memory/4132-1105-0x0000000005F50000-0x0000000005FE2000-memory.dmp
        Filesize

        584KB

      • memory/4132-1103-0x0000000005C60000-0x0000000005C9C000-memory.dmp
        Filesize

        240KB

      • memory/4132-1102-0x0000000005C40000-0x0000000005C52000-memory.dmp
        Filesize

        72KB

      • memory/4132-1101-0x0000000005B30000-0x0000000005C3A000-memory.dmp
        Filesize

        1.0MB

      • memory/4132-1100-0x0000000005510000-0x0000000005B28000-memory.dmp
        Filesize

        6.1MB

      • memory/4132-225-0x0000000004D10000-0x0000000004D4F000-memory.dmp
        Filesize

        252KB

      • memory/4132-223-0x0000000004D10000-0x0000000004D4F000-memory.dmp
        Filesize

        252KB

      • memory/4132-221-0x0000000004D10000-0x0000000004D4F000-memory.dmp
        Filesize

        252KB

      • memory/4132-219-0x0000000004D10000-0x0000000004D4F000-memory.dmp
        Filesize

        252KB

      • memory/4132-190-0x0000000004D10000-0x0000000004D4F000-memory.dmp
        Filesize

        252KB

      • memory/4132-191-0x0000000004D10000-0x0000000004D4F000-memory.dmp
        Filesize

        252KB

      • memory/4132-193-0x0000000004D10000-0x0000000004D4F000-memory.dmp
        Filesize

        252KB

      • memory/4132-195-0x0000000004D10000-0x0000000004D4F000-memory.dmp
        Filesize

        252KB

      • memory/4132-197-0x0000000004D10000-0x0000000004D4F000-memory.dmp
        Filesize

        252KB

      • memory/4132-199-0x0000000004D10000-0x0000000004D4F000-memory.dmp
        Filesize

        252KB

      • memory/4132-201-0x0000000004D10000-0x0000000004D4F000-memory.dmp
        Filesize

        252KB

      • memory/4132-203-0x0000000000920000-0x000000000096B000-memory.dmp
        Filesize

        300KB

      • memory/4132-205-0x0000000004E50000-0x0000000004E60000-memory.dmp
        Filesize

        64KB

      • memory/4132-207-0x0000000004E50000-0x0000000004E60000-memory.dmp
        Filesize

        64KB

      • memory/4132-204-0x0000000004D10000-0x0000000004D4F000-memory.dmp
        Filesize

        252KB

      • memory/4132-209-0x0000000004E50000-0x0000000004E60000-memory.dmp
        Filesize

        64KB

      • memory/4132-208-0x0000000004D10000-0x0000000004D4F000-memory.dmp
        Filesize

        252KB

      • memory/4132-211-0x0000000004D10000-0x0000000004D4F000-memory.dmp
        Filesize

        252KB

      • memory/4132-213-0x0000000004D10000-0x0000000004D4F000-memory.dmp
        Filesize

        252KB

      • memory/4132-215-0x0000000004D10000-0x0000000004D4F000-memory.dmp
        Filesize

        252KB

      • memory/4132-217-0x0000000004D10000-0x0000000004D4F000-memory.dmp
        Filesize

        252KB

      • memory/4808-172-0x00000000025B0000-0x00000000025C2000-memory.dmp
        Filesize

        72KB

      • memory/4808-151-0x0000000005030000-0x0000000005040000-memory.dmp
        Filesize

        64KB

      • memory/4808-185-0x0000000000400000-0x000000000070F000-memory.dmp
        Filesize

        3.1MB

      • memory/4808-183-0x0000000005030000-0x0000000005040000-memory.dmp
        Filesize

        64KB

      • memory/4808-152-0x0000000005030000-0x0000000005040000-memory.dmp
        Filesize

        64KB

      • memory/4808-182-0x0000000005030000-0x0000000005040000-memory.dmp
        Filesize

        64KB

      • memory/4808-181-0x0000000000400000-0x000000000070F000-memory.dmp
        Filesize

        3.1MB

      • memory/4808-180-0x00000000025B0000-0x00000000025C2000-memory.dmp
        Filesize

        72KB

      • memory/4808-178-0x00000000025B0000-0x00000000025C2000-memory.dmp
        Filesize

        72KB

      • memory/4808-156-0x00000000025B0000-0x00000000025C2000-memory.dmp
        Filesize

        72KB

      • memory/4808-148-0x0000000005040000-0x00000000055E4000-memory.dmp
        Filesize

        5.6MB

      • memory/4808-154-0x00000000025B0000-0x00000000025C2000-memory.dmp
        Filesize

        72KB

      • memory/4808-168-0x00000000025B0000-0x00000000025C2000-memory.dmp
        Filesize

        72KB

      • memory/4808-170-0x00000000025B0000-0x00000000025C2000-memory.dmp
        Filesize

        72KB

      • memory/4808-153-0x00000000025B0000-0x00000000025C2000-memory.dmp
        Filesize

        72KB

      • memory/4808-166-0x00000000025B0000-0x00000000025C2000-memory.dmp
        Filesize

        72KB

      • memory/4808-164-0x00000000025B0000-0x00000000025C2000-memory.dmp
        Filesize

        72KB

      • memory/4808-162-0x00000000025B0000-0x00000000025C2000-memory.dmp
        Filesize

        72KB

      • memory/4808-160-0x00000000025B0000-0x00000000025C2000-memory.dmp
        Filesize

        72KB

      • memory/4808-158-0x00000000025B0000-0x00000000025C2000-memory.dmp
        Filesize

        72KB

      • memory/4808-150-0x0000000005030000-0x0000000005040000-memory.dmp
        Filesize

        64KB

      • memory/4808-174-0x00000000025B0000-0x00000000025C2000-memory.dmp
        Filesize

        72KB

      • memory/4808-149-0x00000000007E0000-0x000000000080D000-memory.dmp
        Filesize

        180KB

      • memory/4808-176-0x00000000025B0000-0x00000000025C2000-memory.dmp
        Filesize

        72KB