Analysis

  • max time kernel
    43s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    28-03-2023 00:56

General

  • Target

    2e2c7d12ed2568f0ed1eef166c06cc62.exe

  • Size

    689KB

  • MD5

    2e2c7d12ed2568f0ed1eef166c06cc62

  • SHA1

    6cb1c13586f01d1550126015df22838b80ad5138

  • SHA256

    bbf72aab1b599c033a800301c088e7934d560034f1c5327f4f4fc1957d840745

  • SHA512

    c7b0d06103784d0fbf8c06a394b37dcba1654891e96f6a08987fb2d1e1981d1435baabae45e2ed76b404cb38979bb2675f20b4a8993a8b214ad6c2bb3c2b6569

  • SSDEEP

    12288:9GwUX0PE9LEv2jYWT9BY4DvfOkRTJDfXR0cMQ18gJl24dAIrO:9G70PWrjYG9e4zvDhRGgr24d1O

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

from

C2

176.113.115.145:4125

Attributes
  • auth_value

    8633e283485822a4a48f0a41d5397566

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2e2c7d12ed2568f0ed1eef166c06cc62.exe
    "C:\Users\Admin\AppData\Local\Temp\2e2c7d12ed2568f0ed1eef166c06cc62.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1744
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziWN9837.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziWN9837.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1752
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr442228.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr442228.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:968
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku242230.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku242230.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1148
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr858066.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr858066.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:572

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr858066.exe

    Filesize

    175KB

    MD5

    1b3d3d0bf1647846b849417c66e1eb61

    SHA1

    40f6bdf5d300c13ff57027aacc86e9014411be3d

    SHA256

    32c9fff9e4880f6467fb1f2afb1f8496e249aac09aff74664854ef97c5315f79

    SHA512

    92e1ad76f815de419a37f0b110c60a84e9b84da8aa67697857048303d50e6b8f7b862d51f880600c94a14ca6ad1907c9ea006f44b32c67bc1f42da5b83a63a3c

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr858066.exe

    Filesize

    175KB

    MD5

    1b3d3d0bf1647846b849417c66e1eb61

    SHA1

    40f6bdf5d300c13ff57027aacc86e9014411be3d

    SHA256

    32c9fff9e4880f6467fb1f2afb1f8496e249aac09aff74664854ef97c5315f79

    SHA512

    92e1ad76f815de419a37f0b110c60a84e9b84da8aa67697857048303d50e6b8f7b862d51f880600c94a14ca6ad1907c9ea006f44b32c67bc1f42da5b83a63a3c

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziWN9837.exe

    Filesize

    412KB

    MD5

    919bda41ac3a51959a04239e18ae15f5

    SHA1

    d22c97a616604dc7b8e40d076d53248c951e01eb

    SHA256

    fe731f162020686b125737a3122f0da5da067d03c96b59518b08f0e378da52cc

    SHA512

    22f6d9efffe89643c8662017b11a608937c112ecf77bb872017deda930b98c84a32a32a84b15eec601216e85c0b72551e19be86c36b591f7abb021f90e3bb29e

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziWN9837.exe

    Filesize

    412KB

    MD5

    919bda41ac3a51959a04239e18ae15f5

    SHA1

    d22c97a616604dc7b8e40d076d53248c951e01eb

    SHA256

    fe731f162020686b125737a3122f0da5da067d03c96b59518b08f0e378da52cc

    SHA512

    22f6d9efffe89643c8662017b11a608937c112ecf77bb872017deda930b98c84a32a32a84b15eec601216e85c0b72551e19be86c36b591f7abb021f90e3bb29e

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr442228.exe

    Filesize

    11KB

    MD5

    3411190db00a24305e218735da30dd43

    SHA1

    f3eab1bbd0107864958415ba9540e961d6608ac1

    SHA256

    58414c076a849c89a7bae1b4465cac97e6a5a1d4124acb9e3a72fd17cb955b6c

    SHA512

    7e11fb765506bb47d43c6a0ed4a756ce5cf05751c19b9f7d27efe3ad15a6437dbb9a1fdfc3b771b7596cae96a1b17d01766f214e90fa264194cbfd7bc8e948e8

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr442228.exe

    Filesize

    11KB

    MD5

    3411190db00a24305e218735da30dd43

    SHA1

    f3eab1bbd0107864958415ba9540e961d6608ac1

    SHA256

    58414c076a849c89a7bae1b4465cac97e6a5a1d4124acb9e3a72fd17cb955b6c

    SHA512

    7e11fb765506bb47d43c6a0ed4a756ce5cf05751c19b9f7d27efe3ad15a6437dbb9a1fdfc3b771b7596cae96a1b17d01766f214e90fa264194cbfd7bc8e948e8

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku242230.exe

    Filesize

    365KB

    MD5

    10e54a934dcf8cc1a605932adaa1e52b

    SHA1

    d5159b84191c3b070dd33bb09b8749dddc8bc8db

    SHA256

    8d9f9001387f6f8917dccead652d66d05642c4fa72f07745e0755e4dfda36ccc

    SHA512

    40a0efe89f4246c1c23f5dd701aec060305b99a0734bedf6d612be14e40995f924764e62d9450ca3098e268290485dc75732543939df5699335800115d4e90c1

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku242230.exe

    Filesize

    365KB

    MD5

    10e54a934dcf8cc1a605932adaa1e52b

    SHA1

    d5159b84191c3b070dd33bb09b8749dddc8bc8db

    SHA256

    8d9f9001387f6f8917dccead652d66d05642c4fa72f07745e0755e4dfda36ccc

    SHA512

    40a0efe89f4246c1c23f5dd701aec060305b99a0734bedf6d612be14e40995f924764e62d9450ca3098e268290485dc75732543939df5699335800115d4e90c1

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku242230.exe

    Filesize

    365KB

    MD5

    10e54a934dcf8cc1a605932adaa1e52b

    SHA1

    d5159b84191c3b070dd33bb09b8749dddc8bc8db

    SHA256

    8d9f9001387f6f8917dccead652d66d05642c4fa72f07745e0755e4dfda36ccc

    SHA512

    40a0efe89f4246c1c23f5dd701aec060305b99a0734bedf6d612be14e40995f924764e62d9450ca3098e268290485dc75732543939df5699335800115d4e90c1

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\lr858066.exe

    Filesize

    175KB

    MD5

    1b3d3d0bf1647846b849417c66e1eb61

    SHA1

    40f6bdf5d300c13ff57027aacc86e9014411be3d

    SHA256

    32c9fff9e4880f6467fb1f2afb1f8496e249aac09aff74664854ef97c5315f79

    SHA512

    92e1ad76f815de419a37f0b110c60a84e9b84da8aa67697857048303d50e6b8f7b862d51f880600c94a14ca6ad1907c9ea006f44b32c67bc1f42da5b83a63a3c

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\ziWN9837.exe

    Filesize

    412KB

    MD5

    919bda41ac3a51959a04239e18ae15f5

    SHA1

    d22c97a616604dc7b8e40d076d53248c951e01eb

    SHA256

    fe731f162020686b125737a3122f0da5da067d03c96b59518b08f0e378da52cc

    SHA512

    22f6d9efffe89643c8662017b11a608937c112ecf77bb872017deda930b98c84a32a32a84b15eec601216e85c0b72551e19be86c36b591f7abb021f90e3bb29e

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\ziWN9837.exe

    Filesize

    412KB

    MD5

    919bda41ac3a51959a04239e18ae15f5

    SHA1

    d22c97a616604dc7b8e40d076d53248c951e01eb

    SHA256

    fe731f162020686b125737a3122f0da5da067d03c96b59518b08f0e378da52cc

    SHA512

    22f6d9efffe89643c8662017b11a608937c112ecf77bb872017deda930b98c84a32a32a84b15eec601216e85c0b72551e19be86c36b591f7abb021f90e3bb29e

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\jr442228.exe

    Filesize

    11KB

    MD5

    3411190db00a24305e218735da30dd43

    SHA1

    f3eab1bbd0107864958415ba9540e961d6608ac1

    SHA256

    58414c076a849c89a7bae1b4465cac97e6a5a1d4124acb9e3a72fd17cb955b6c

    SHA512

    7e11fb765506bb47d43c6a0ed4a756ce5cf05751c19b9f7d27efe3ad15a6437dbb9a1fdfc3b771b7596cae96a1b17d01766f214e90fa264194cbfd7bc8e948e8

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\ku242230.exe

    Filesize

    365KB

    MD5

    10e54a934dcf8cc1a605932adaa1e52b

    SHA1

    d5159b84191c3b070dd33bb09b8749dddc8bc8db

    SHA256

    8d9f9001387f6f8917dccead652d66d05642c4fa72f07745e0755e4dfda36ccc

    SHA512

    40a0efe89f4246c1c23f5dd701aec060305b99a0734bedf6d612be14e40995f924764e62d9450ca3098e268290485dc75732543939df5699335800115d4e90c1

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\ku242230.exe

    Filesize

    365KB

    MD5

    10e54a934dcf8cc1a605932adaa1e52b

    SHA1

    d5159b84191c3b070dd33bb09b8749dddc8bc8db

    SHA256

    8d9f9001387f6f8917dccead652d66d05642c4fa72f07745e0755e4dfda36ccc

    SHA512

    40a0efe89f4246c1c23f5dd701aec060305b99a0734bedf6d612be14e40995f924764e62d9450ca3098e268290485dc75732543939df5699335800115d4e90c1

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\ku242230.exe

    Filesize

    365KB

    MD5

    10e54a934dcf8cc1a605932adaa1e52b

    SHA1

    d5159b84191c3b070dd33bb09b8749dddc8bc8db

    SHA256

    8d9f9001387f6f8917dccead652d66d05642c4fa72f07745e0755e4dfda36ccc

    SHA512

    40a0efe89f4246c1c23f5dd701aec060305b99a0734bedf6d612be14e40995f924764e62d9450ca3098e268290485dc75732543939df5699335800115d4e90c1

  • memory/572-1006-0x0000000000BF0000-0x0000000000C22000-memory.dmp

    Filesize

    200KB

  • memory/572-1007-0x0000000004760000-0x00000000047A0000-memory.dmp

    Filesize

    256KB

  • memory/968-73-0x00000000002B0000-0x00000000002BA000-memory.dmp

    Filesize

    40KB

  • memory/1148-105-0x0000000002220000-0x000000000225F000-memory.dmp

    Filesize

    252KB

  • memory/1148-125-0x0000000002220000-0x000000000225F000-memory.dmp

    Filesize

    252KB

  • memory/1148-93-0x0000000002220000-0x000000000225F000-memory.dmp

    Filesize

    252KB

  • memory/1148-96-0x0000000002220000-0x000000000225F000-memory.dmp

    Filesize

    252KB

  • memory/1148-98-0x0000000004FD0000-0x0000000005010000-memory.dmp

    Filesize

    256KB

  • memory/1148-99-0x0000000002220000-0x000000000225F000-memory.dmp

    Filesize

    252KB

  • memory/1148-95-0x0000000000240000-0x000000000028B000-memory.dmp

    Filesize

    300KB

  • memory/1148-101-0x0000000002220000-0x000000000225F000-memory.dmp

    Filesize

    252KB

  • memory/1148-103-0x0000000002220000-0x000000000225F000-memory.dmp

    Filesize

    252KB

  • memory/1148-91-0x0000000002220000-0x000000000225F000-memory.dmp

    Filesize

    252KB

  • memory/1148-107-0x0000000002220000-0x000000000225F000-memory.dmp

    Filesize

    252KB

  • memory/1148-109-0x0000000002220000-0x000000000225F000-memory.dmp

    Filesize

    252KB

  • memory/1148-111-0x0000000002220000-0x000000000225F000-memory.dmp

    Filesize

    252KB

  • memory/1148-113-0x0000000002220000-0x000000000225F000-memory.dmp

    Filesize

    252KB

  • memory/1148-115-0x0000000002220000-0x000000000225F000-memory.dmp

    Filesize

    252KB

  • memory/1148-117-0x0000000002220000-0x000000000225F000-memory.dmp

    Filesize

    252KB

  • memory/1148-119-0x0000000002220000-0x000000000225F000-memory.dmp

    Filesize

    252KB

  • memory/1148-121-0x0000000002220000-0x000000000225F000-memory.dmp

    Filesize

    252KB

  • memory/1148-123-0x0000000002220000-0x000000000225F000-memory.dmp

    Filesize

    252KB

  • memory/1148-89-0x0000000002220000-0x000000000225F000-memory.dmp

    Filesize

    252KB

  • memory/1148-127-0x0000000002220000-0x000000000225F000-memory.dmp

    Filesize

    252KB

  • memory/1148-129-0x0000000002220000-0x000000000225F000-memory.dmp

    Filesize

    252KB

  • memory/1148-131-0x0000000002220000-0x000000000225F000-memory.dmp

    Filesize

    252KB

  • memory/1148-133-0x0000000002220000-0x000000000225F000-memory.dmp

    Filesize

    252KB

  • memory/1148-135-0x0000000002220000-0x000000000225F000-memory.dmp

    Filesize

    252KB

  • memory/1148-137-0x0000000002220000-0x000000000225F000-memory.dmp

    Filesize

    252KB

  • memory/1148-139-0x0000000002220000-0x000000000225F000-memory.dmp

    Filesize

    252KB

  • memory/1148-141-0x0000000002220000-0x000000000225F000-memory.dmp

    Filesize

    252KB

  • memory/1148-143-0x0000000002220000-0x000000000225F000-memory.dmp

    Filesize

    252KB

  • memory/1148-145-0x0000000002220000-0x000000000225F000-memory.dmp

    Filesize

    252KB

  • memory/1148-147-0x0000000002220000-0x000000000225F000-memory.dmp

    Filesize

    252KB

  • memory/1148-149-0x0000000002220000-0x000000000225F000-memory.dmp

    Filesize

    252KB

  • memory/1148-151-0x0000000002220000-0x000000000225F000-memory.dmp

    Filesize

    252KB

  • memory/1148-996-0x0000000004FD0000-0x0000000005010000-memory.dmp

    Filesize

    256KB

  • memory/1148-88-0x0000000002220000-0x000000000225F000-memory.dmp

    Filesize

    252KB

  • memory/1148-87-0x0000000002220000-0x0000000002264000-memory.dmp

    Filesize

    272KB

  • memory/1148-86-0x0000000000B10000-0x0000000000B56000-memory.dmp

    Filesize

    280KB

  • memory/1744-74-0x0000000002020000-0x00000000020AC000-memory.dmp

    Filesize

    560KB

  • memory/1744-54-0x0000000001F90000-0x0000000002012000-memory.dmp

    Filesize

    520KB

  • memory/1744-75-0x0000000000400000-0x000000000076F000-memory.dmp

    Filesize

    3.4MB