Analysis

  • max time kernel
    105s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-03-2023 01:09

General

  • Target

    e7f602c0768d84a897ccf1ec16918b97d86ff772e36e4cc094f6340bbd8ad92b.exe

  • Size

    689KB

  • MD5

    b99d2d2c45c84cc3753989d8b6b0814a

  • SHA1

    337c5b310c7d39701c441243c3fb6e592d4bc09a

  • SHA256

    e7f602c0768d84a897ccf1ec16918b97d86ff772e36e4cc094f6340bbd8ad92b

  • SHA512

    c39744679ae21413ada5f79bca0bf435b231d9b9bf140ac05e72d4a8d7bc76523e04b27616c3753ad9adb38196ab7af91f8386aa58a9989e04ed815a8b7a1905

  • SSDEEP

    12288:EMrcy90YzSGQMFR7GjR/FzcKntoyY65hLuVwzoag8JMBJ+OgmJ2v+FEjfigYEd3O:wytlHocKtpXfa6g8J4g/mJ26EjagYEde

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

from

C2

176.113.115.145:4125

Attributes
  • auth_value

    8633e283485822a4a48f0a41d5397566

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 18 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e7f602c0768d84a897ccf1ec16918b97d86ff772e36e4cc094f6340bbd8ad92b.exe
    "C:\Users\Admin\AppData\Local\Temp\e7f602c0768d84a897ccf1ec16918b97d86ff772e36e4cc094f6340bbd8ad92b.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4252
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un768069.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un768069.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2012
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6215.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6215.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3384
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 1084
          4⤵
          • Program crash
          PID:856
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3084.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3084.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2484
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 1828
          4⤵
          • Program crash
          PID:3280
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si010712.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si010712.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:60
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3384 -ip 3384
    1⤵
      PID:2692
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2484 -ip 2484
      1⤵
        PID:4368

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si010712.exe

        Filesize

        175KB

        MD5

        ccac3ee75d221ec382036061a329e5d2

        SHA1

        d5ba3e99e65965437f727064f47ce1206a3f3234

        SHA256

        e6c5941c8920dee39fe3029e52be4b33df9cab552e1fed1aa0941d066641d8ea

        SHA512

        93fb26549ba87c5bf079ffba4f0a96e40f1e84027e5dcca014f2658d1b19b511060db873d27e2ddc33e5eea900c0b3a789bb58fae89b49ebd1293b62c9b47a6c

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si010712.exe

        Filesize

        175KB

        MD5

        ccac3ee75d221ec382036061a329e5d2

        SHA1

        d5ba3e99e65965437f727064f47ce1206a3f3234

        SHA256

        e6c5941c8920dee39fe3029e52be4b33df9cab552e1fed1aa0941d066641d8ea

        SHA512

        93fb26549ba87c5bf079ffba4f0a96e40f1e84027e5dcca014f2658d1b19b511060db873d27e2ddc33e5eea900c0b3a789bb58fae89b49ebd1293b62c9b47a6c

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un768069.exe

        Filesize

        547KB

        MD5

        2147afb19b7630015310edaf9eba0288

        SHA1

        9193ccb846b1a9fea43d09b1cc69f9e864ff6b52

        SHA256

        486affad1cd3d6fc9a7324afdb3cea75b6aa2b4fce7f4753cb7ab7b983909a3f

        SHA512

        c4592d29d1f9d7f0e436889d77cbd03b0f4cefce47a36c53270ea1988c8cdcccf3c8e82f41dd7e01c952051062f7e836f7e6d8aef4a33fab666f182aef165c64

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un768069.exe

        Filesize

        547KB

        MD5

        2147afb19b7630015310edaf9eba0288

        SHA1

        9193ccb846b1a9fea43d09b1cc69f9e864ff6b52

        SHA256

        486affad1cd3d6fc9a7324afdb3cea75b6aa2b4fce7f4753cb7ab7b983909a3f

        SHA512

        c4592d29d1f9d7f0e436889d77cbd03b0f4cefce47a36c53270ea1988c8cdcccf3c8e82f41dd7e01c952051062f7e836f7e6d8aef4a33fab666f182aef165c64

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6215.exe

        Filesize

        291KB

        MD5

        a47440ddb3970f801c4dacfb482bba99

        SHA1

        780bba5bdaba4dc3add52b0ace390295584049f6

        SHA256

        0beb7f6c85da9e2bfd456c5213de2e7d6e5c86671b19d621870e005b1c579863

        SHA512

        2d3b32912c0450060fb5a8e5f24d2894b8c45ccc868460b6ffeb48d091afa6a112784e5cadba2a9c49883138264b575b140710700485c21776fb78841d74a190

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6215.exe

        Filesize

        291KB

        MD5

        a47440ddb3970f801c4dacfb482bba99

        SHA1

        780bba5bdaba4dc3add52b0ace390295584049f6

        SHA256

        0beb7f6c85da9e2bfd456c5213de2e7d6e5c86671b19d621870e005b1c579863

        SHA512

        2d3b32912c0450060fb5a8e5f24d2894b8c45ccc868460b6ffeb48d091afa6a112784e5cadba2a9c49883138264b575b140710700485c21776fb78841d74a190

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3084.exe

        Filesize

        345KB

        MD5

        197907df1528d04a6774ab78a33464b2

        SHA1

        25d3c1413eefe5e521ea422bcaa8289abcc8f1dc

        SHA256

        4a73710089d41704a4de23f963ceabcad044e8d366c3d398ecb9f60ca83b2301

        SHA512

        3be396e5817ae4b0736fc6bb3adc8d78c20063c75ede5dc6b2612811286d209eb7ddb15e3a50022b010acd96afb155b8cbc941ecffa6598f670e1bc6559b2289

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3084.exe

        Filesize

        345KB

        MD5

        197907df1528d04a6774ab78a33464b2

        SHA1

        25d3c1413eefe5e521ea422bcaa8289abcc8f1dc

        SHA256

        4a73710089d41704a4de23f963ceabcad044e8d366c3d398ecb9f60ca83b2301

        SHA512

        3be396e5817ae4b0736fc6bb3adc8d78c20063c75ede5dc6b2612811286d209eb7ddb15e3a50022b010acd96afb155b8cbc941ecffa6598f670e1bc6559b2289

      • memory/60-1123-0x0000000005530000-0x0000000005540000-memory.dmp

        Filesize

        64KB

      • memory/60-1122-0x00000000008F0000-0x0000000000922000-memory.dmp

        Filesize

        200KB

      • memory/2484-227-0x0000000005FE0000-0x000000000601F000-memory.dmp

        Filesize

        252KB

      • memory/2484-1104-0x0000000006070000-0x0000000006080000-memory.dmp

        Filesize

        64KB

      • memory/2484-1115-0x0000000007F20000-0x000000000844C000-memory.dmp

        Filesize

        5.2MB

      • memory/2484-1114-0x0000000007D50000-0x0000000007F12000-memory.dmp

        Filesize

        1.8MB

      • memory/2484-1113-0x0000000007CD0000-0x0000000007D20000-memory.dmp

        Filesize

        320KB

      • memory/2484-1112-0x0000000007C50000-0x0000000007CC6000-memory.dmp

        Filesize

        472KB

      • memory/2484-1111-0x0000000007440000-0x00000000074A6000-memory.dmp

        Filesize

        408KB

      • memory/2484-1110-0x00000000073A0000-0x0000000007432000-memory.dmp

        Filesize

        584KB

      • memory/2484-1109-0x0000000006070000-0x0000000006080000-memory.dmp

        Filesize

        64KB

      • memory/2484-1107-0x0000000006070000-0x0000000006080000-memory.dmp

        Filesize

        64KB

      • memory/2484-1108-0x0000000006070000-0x0000000006080000-memory.dmp

        Filesize

        64KB

      • memory/2484-1106-0x0000000006070000-0x0000000006080000-memory.dmp

        Filesize

        64KB

      • memory/2484-1103-0x0000000006F70000-0x0000000006FAC000-memory.dmp

        Filesize

        240KB

      • memory/2484-1102-0x0000000006F50000-0x0000000006F62000-memory.dmp

        Filesize

        72KB

      • memory/2484-1101-0x0000000006E10000-0x0000000006F1A000-memory.dmp

        Filesize

        1.0MB

      • memory/2484-1100-0x0000000006770000-0x0000000006D88000-memory.dmp

        Filesize

        6.1MB

      • memory/2484-225-0x0000000005FE0000-0x000000000601F000-memory.dmp

        Filesize

        252KB

      • memory/2484-223-0x0000000005FE0000-0x000000000601F000-memory.dmp

        Filesize

        252KB

      • memory/2484-221-0x0000000005FE0000-0x000000000601F000-memory.dmp

        Filesize

        252KB

      • memory/2484-219-0x0000000005FE0000-0x000000000601F000-memory.dmp

        Filesize

        252KB

      • memory/2484-217-0x0000000005FE0000-0x000000000601F000-memory.dmp

        Filesize

        252KB

      • memory/2484-191-0x0000000001A30000-0x0000000001A7B000-memory.dmp

        Filesize

        300KB

      • memory/2484-192-0x0000000006070000-0x0000000006080000-memory.dmp

        Filesize

        64KB

      • memory/2484-194-0x0000000005FE0000-0x000000000601F000-memory.dmp

        Filesize

        252KB

      • memory/2484-193-0x0000000006070000-0x0000000006080000-memory.dmp

        Filesize

        64KB

      • memory/2484-195-0x0000000005FE0000-0x000000000601F000-memory.dmp

        Filesize

        252KB

      • memory/2484-197-0x0000000005FE0000-0x000000000601F000-memory.dmp

        Filesize

        252KB

      • memory/2484-199-0x0000000005FE0000-0x000000000601F000-memory.dmp

        Filesize

        252KB

      • memory/2484-201-0x0000000005FE0000-0x000000000601F000-memory.dmp

        Filesize

        252KB

      • memory/2484-203-0x0000000005FE0000-0x000000000601F000-memory.dmp

        Filesize

        252KB

      • memory/2484-205-0x0000000005FE0000-0x000000000601F000-memory.dmp

        Filesize

        252KB

      • memory/2484-209-0x0000000005FE0000-0x000000000601F000-memory.dmp

        Filesize

        252KB

      • memory/2484-207-0x0000000005FE0000-0x000000000601F000-memory.dmp

        Filesize

        252KB

      • memory/2484-211-0x0000000005FE0000-0x000000000601F000-memory.dmp

        Filesize

        252KB

      • memory/2484-213-0x0000000005FE0000-0x000000000601F000-memory.dmp

        Filesize

        252KB

      • memory/2484-215-0x0000000005FE0000-0x000000000601F000-memory.dmp

        Filesize

        252KB

      • memory/3384-174-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/3384-183-0x0000000004CA0000-0x0000000004CB0000-memory.dmp

        Filesize

        64KB

      • memory/3384-153-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/3384-184-0x0000000004CA0000-0x0000000004CB0000-memory.dmp

        Filesize

        64KB

      • memory/3384-172-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/3384-152-0x0000000004CA0000-0x0000000004CB0000-memory.dmp

        Filesize

        64KB

      • memory/3384-182-0x0000000004CA0000-0x0000000004CB0000-memory.dmp

        Filesize

        64KB

      • memory/3384-170-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/3384-180-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/3384-178-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/3384-156-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/3384-176-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/3384-186-0x0000000000400000-0x000000000070B000-memory.dmp

        Filesize

        3.0MB

      • memory/3384-154-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/3384-181-0x0000000000400000-0x000000000070B000-memory.dmp

        Filesize

        3.0MB

      • memory/3384-168-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/3384-166-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/3384-164-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/3384-162-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/3384-160-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/3384-158-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/3384-151-0x0000000004CA0000-0x0000000004CB0000-memory.dmp

        Filesize

        64KB

      • memory/3384-150-0x0000000004CA0000-0x0000000004CB0000-memory.dmp

        Filesize

        64KB

      • memory/3384-149-0x0000000000710000-0x000000000073D000-memory.dmp

        Filesize

        180KB

      • memory/3384-148-0x0000000004CB0000-0x0000000005254000-memory.dmp

        Filesize

        5.6MB