Analysis
-
max time kernel
50s -
max time network
70s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
28-03-2023 01:29
General
-
Target
1c07989d482c86a2d49ba44b55f25049f595c70fab0218cf0c59c842a728f2a8.exe
-
Size
689KB
-
MD5
2269976bf22c6efa85a0e3e8fdaa6d96
-
SHA1
6e8099e126f0b397c2a095d871dec5c32685ad91
-
SHA256
1c07989d482c86a2d49ba44b55f25049f595c70fab0218cf0c59c842a728f2a8
-
SHA512
fee51354c6571aeec3646039420d86e79427891aeee35d134416876b5e39c382d6fadf62f58b15ba1eab4b8640a8b75c8e2c808231737320d803bbe14e884f3e
-
SSDEEP
12288:FMrsy90bwtl4mk1hMllNx1yn1IUM9e+DT4Tid2LBU/cajWKmJ+vHF/bfigfjNGk6:Zy+wtam3lNQTj+DTyTU/hNmJ+9/bagJi
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Executes dropped EXE 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 2 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c07989d482c86a2d49ba44b55f25049f595c70fab0218cf0c59c842a728f2a8.exe"C:\Users\Admin\AppData\Local\Temp\1c07989d482c86a2d49ba44b55f25049f595c70fab0218cf0c59c842a728f2a8.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un579031.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un579031.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7183.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7183.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6364.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6364.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si907339.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si907339.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD5822c1099af8d8b27b979af5ac4515156
SHA1c4e3d5f45a7536b20f1fa5d825edb322f5ff7f2a
SHA256520c74bdbea2800fca83034be7eadb4c1dc312372aa6f0ae1ffb2641faf8936f
SHA512d7c699ac35fe29853e969e4fc6af4ef1c712fe0d47ad5408d564d45dde1a6fd89a655787c99db4934e30ee7c0d58aeaac339bb9a963914a3a8eb00f6902371db
-
Filesize
175KB
MD5822c1099af8d8b27b979af5ac4515156
SHA1c4e3d5f45a7536b20f1fa5d825edb322f5ff7f2a
SHA256520c74bdbea2800fca83034be7eadb4c1dc312372aa6f0ae1ffb2641faf8936f
SHA512d7c699ac35fe29853e969e4fc6af4ef1c712fe0d47ad5408d564d45dde1a6fd89a655787c99db4934e30ee7c0d58aeaac339bb9a963914a3a8eb00f6902371db
-
Filesize
547KB
MD57e4b0fc66e112ae4c187e06c6ccaea49
SHA1311fdf93876be095987388f3b3acb0cf7ff9e6a1
SHA2567449c7ba37ea8eb6c358b322623fbc2f8e3cf2df60a8b7c98f3bfbe97998f4a9
SHA512ed350fbe0a97ec67fdba9edfd0d9ee07cb1b754053df16c955f3d0a80d7bf8766a4c51dbe689334958e33116618a72f415d4297ffc1af20fae7350e9dba44573
-
Filesize
547KB
MD57e4b0fc66e112ae4c187e06c6ccaea49
SHA1311fdf93876be095987388f3b3acb0cf7ff9e6a1
SHA2567449c7ba37ea8eb6c358b322623fbc2f8e3cf2df60a8b7c98f3bfbe97998f4a9
SHA512ed350fbe0a97ec67fdba9edfd0d9ee07cb1b754053df16c955f3d0a80d7bf8766a4c51dbe689334958e33116618a72f415d4297ffc1af20fae7350e9dba44573
-
Filesize
291KB
MD53dea52574689499f45a399be4aae6a90
SHA16c1a00a73f0d450dd3d765617d75c8565a523be8
SHA2567c2eb5163b958987aca85adba577b3a4388892783696727278912f3f653c27f8
SHA512ae9f7bcb23dd08ea08977c4df74cd6644598f3c6837085bb5841eb0a750904101c6e3b460cbc3d9b11f3d038605b41abca92c83cfe830091ad7e0cb7ba9cd9f0
-
Filesize
291KB
MD53dea52574689499f45a399be4aae6a90
SHA16c1a00a73f0d450dd3d765617d75c8565a523be8
SHA2567c2eb5163b958987aca85adba577b3a4388892783696727278912f3f653c27f8
SHA512ae9f7bcb23dd08ea08977c4df74cd6644598f3c6837085bb5841eb0a750904101c6e3b460cbc3d9b11f3d038605b41abca92c83cfe830091ad7e0cb7ba9cd9f0
-
Filesize
345KB
MD550a54580b905e38fb607a1548f45d7d9
SHA131bc27f9baadbd00476085ff89998e7e59a4eaa1
SHA2567dbb90280949eac85caaecccbf7b58d14674e9471c44b5913cede6c3ea31a534
SHA512550c3fe675572de1650f060b24516a192cc4738abe08945bc0bf36aa5fc983b0c7de64e781afc772292cb017243fd4014bde3ca10ce6bd55a778b12b2a5f9330
-
Filesize
345KB
MD550a54580b905e38fb607a1548f45d7d9
SHA131bc27f9baadbd00476085ff89998e7e59a4eaa1
SHA2567dbb90280949eac85caaecccbf7b58d14674e9471c44b5913cede6c3ea31a534
SHA512550c3fe675572de1650f060b24516a192cc4738abe08945bc0bf36aa5fc983b0c7de64e781afc772292cb017243fd4014bde3ca10ce6bd55a778b12b2a5f9330
-
Filesize
72KB
-
Filesize
252KB
-
Filesize
5.2MB
-
Filesize
1.8MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
64KB
-
Filesize
320KB
-
Filesize
472KB
-
Filesize
584KB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
1.0MB
-
Filesize
6.0MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
280KB
-
Filesize
272KB
-
Filesize
64KB
-
Filesize
300KB
-
Filesize
252KB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
3.0MB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
64KB
-
Filesize
3.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
180KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
5.0MB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
104KB
-
Filesize
180KB
-
Filesize
200KB
-
Filesize
64KB
-
Filesize
300KB
-
Filesize
64KB