Analysis

  • max time kernel
    55s
  • max time network
    182s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    28-03-2023 03:37

General

  • Target

    4011153d88f0ee86c96fc32f11ae0c334b787dd4f1cde886540e83cb01567f13.exe

  • Size

    689KB

  • MD5

    c85548b6946888e2a7fb365c1724d5cf

  • SHA1

    32c66e64d1cc558782cb306fc89cac89b8540623

  • SHA256

    4011153d88f0ee86c96fc32f11ae0c334b787dd4f1cde886540e83cb01567f13

  • SHA512

    1606f9b776900d5d537a48b3f3af09d9fc8ac2fcc387c63504d668be1f2df8c164eba7a45e7c72e8da30e0de5513c5c37209f5c496b4b809099395d7c158957f

  • SSDEEP

    12288:KMrcy90OY2IdlfEUuOyu65hLuWaMSKx3b1mdfOJ/3fvkFblfig7gTz9D5vmh/rfe:Cy5rVL1faWaLw3hOEP8blag8BD5v8e

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

from

C2

176.113.115.145:4125

Attributes
  • auth_value

    8633e283485822a4a48f0a41d5397566

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 21 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4011153d88f0ee86c96fc32f11ae0c334b787dd4f1cde886540e83cb01567f13.exe
    "C:\Users\Admin\AppData\Local\Temp\4011153d88f0ee86c96fc32f11ae0c334b787dd4f1cde886540e83cb01567f13.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1804
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un721044.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un721044.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2144
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8273.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8273.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2512
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3031.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3031.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5000
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si407314.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si407314.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4824

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si407314.exe

    Filesize

    175KB

    MD5

    b17d163cab93fb6128accfec989d5954

    SHA1

    03fd854eff4e73b14c8eb5549db7df4ddbb1f5ff

    SHA256

    aee8f9d9da9d5c1d8d60d90ae41603396de64d2a84b3102ec7e538e41238b77d

    SHA512

    5d6264d24292a0396376ea0c161c7e0fca2f44d2f4f46530ceb86449606292bf62b72dd2a190467f2a7f36465a88c07ccc8ce7a7c763bd88bc960d970733f50b

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si407314.exe

    Filesize

    175KB

    MD5

    b17d163cab93fb6128accfec989d5954

    SHA1

    03fd854eff4e73b14c8eb5549db7df4ddbb1f5ff

    SHA256

    aee8f9d9da9d5c1d8d60d90ae41603396de64d2a84b3102ec7e538e41238b77d

    SHA512

    5d6264d24292a0396376ea0c161c7e0fca2f44d2f4f46530ceb86449606292bf62b72dd2a190467f2a7f36465a88c07ccc8ce7a7c763bd88bc960d970733f50b

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un721044.exe

    Filesize

    548KB

    MD5

    9ada29e54fd6f74ec56398e531c5db61

    SHA1

    3dad9eb9e047eaf98d22248db26e992e06dcf877

    SHA256

    dc79794239171a96eac0bff86415cf9e5b997612ee0b4331ec21353a5ac291d3

    SHA512

    e31e29a009e5a7b74b12ddecbed0f58bb254963dc389c09a31c3a39b56de0a4707d3d22eb747e245c2481c4bc4e15094137a988989072c92e5e336cfdd61fcb9

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un721044.exe

    Filesize

    548KB

    MD5

    9ada29e54fd6f74ec56398e531c5db61

    SHA1

    3dad9eb9e047eaf98d22248db26e992e06dcf877

    SHA256

    dc79794239171a96eac0bff86415cf9e5b997612ee0b4331ec21353a5ac291d3

    SHA512

    e31e29a009e5a7b74b12ddecbed0f58bb254963dc389c09a31c3a39b56de0a4707d3d22eb747e245c2481c4bc4e15094137a988989072c92e5e336cfdd61fcb9

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8273.exe

    Filesize

    291KB

    MD5

    2d736d5d272c6368d1317311a5fadea2

    SHA1

    4e0129472a38b236634423862da9b1291aea91f2

    SHA256

    86d2dc4dcfb919efaf433a2263b5e59252d8f823c5125e22befe8d16075f011b

    SHA512

    97778ddf6d3316af47776e35d86fdbefd9ae566af4203fbed311141246881d4a46c17a46cf72a68c0a571e06fc444c58fc76601bb0fa057d4635075020897657

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8273.exe

    Filesize

    291KB

    MD5

    2d736d5d272c6368d1317311a5fadea2

    SHA1

    4e0129472a38b236634423862da9b1291aea91f2

    SHA256

    86d2dc4dcfb919efaf433a2263b5e59252d8f823c5125e22befe8d16075f011b

    SHA512

    97778ddf6d3316af47776e35d86fdbefd9ae566af4203fbed311141246881d4a46c17a46cf72a68c0a571e06fc444c58fc76601bb0fa057d4635075020897657

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3031.exe

    Filesize

    345KB

    MD5

    123d4ad0b6ff03500edba05b11c1671b

    SHA1

    91e37cea652c56fa4a1392d23e81631f8a8a9e5f

    SHA256

    295a967765f271e81098a48ad70905c64973266742d655e18c27369d00f13280

    SHA512

    db03c1c4e8389706821820af0514faefda358f9ae3a9efd5a34bac78fd50dae8bc95498b3fd545e839cdd916373a7ebe1da8ddd8efa69b8029f891b780d0d9af

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3031.exe

    Filesize

    345KB

    MD5

    123d4ad0b6ff03500edba05b11c1671b

    SHA1

    91e37cea652c56fa4a1392d23e81631f8a8a9e5f

    SHA256

    295a967765f271e81098a48ad70905c64973266742d655e18c27369d00f13280

    SHA512

    db03c1c4e8389706821820af0514faefda358f9ae3a9efd5a34bac78fd50dae8bc95498b3fd545e839cdd916373a7ebe1da8ddd8efa69b8029f891b780d0d9af

  • memory/2512-135-0x00000000024B0000-0x00000000024CA000-memory.dmp

    Filesize

    104KB

  • memory/2512-136-0x0000000004C20000-0x000000000511E000-memory.dmp

    Filesize

    5.0MB

  • memory/2512-137-0x0000000005140000-0x0000000005158000-memory.dmp

    Filesize

    96KB

  • memory/2512-138-0x00000000020B0000-0x00000000020DD000-memory.dmp

    Filesize

    180KB

  • memory/2512-139-0x00000000024A0000-0x00000000024B0000-memory.dmp

    Filesize

    64KB

  • memory/2512-140-0x00000000024A0000-0x00000000024B0000-memory.dmp

    Filesize

    64KB

  • memory/2512-141-0x00000000024A0000-0x00000000024B0000-memory.dmp

    Filesize

    64KB

  • memory/2512-142-0x0000000005140000-0x0000000005152000-memory.dmp

    Filesize

    72KB

  • memory/2512-143-0x0000000005140000-0x0000000005152000-memory.dmp

    Filesize

    72KB

  • memory/2512-145-0x0000000005140000-0x0000000005152000-memory.dmp

    Filesize

    72KB

  • memory/2512-147-0x0000000005140000-0x0000000005152000-memory.dmp

    Filesize

    72KB

  • memory/2512-149-0x0000000005140000-0x0000000005152000-memory.dmp

    Filesize

    72KB

  • memory/2512-151-0x0000000005140000-0x0000000005152000-memory.dmp

    Filesize

    72KB

  • memory/2512-153-0x0000000005140000-0x0000000005152000-memory.dmp

    Filesize

    72KB

  • memory/2512-155-0x0000000005140000-0x0000000005152000-memory.dmp

    Filesize

    72KB

  • memory/2512-157-0x0000000005140000-0x0000000005152000-memory.dmp

    Filesize

    72KB

  • memory/2512-159-0x0000000005140000-0x0000000005152000-memory.dmp

    Filesize

    72KB

  • memory/2512-161-0x0000000005140000-0x0000000005152000-memory.dmp

    Filesize

    72KB

  • memory/2512-163-0x0000000005140000-0x0000000005152000-memory.dmp

    Filesize

    72KB

  • memory/2512-165-0x0000000005140000-0x0000000005152000-memory.dmp

    Filesize

    72KB

  • memory/2512-167-0x0000000005140000-0x0000000005152000-memory.dmp

    Filesize

    72KB

  • memory/2512-169-0x0000000005140000-0x0000000005152000-memory.dmp

    Filesize

    72KB

  • memory/2512-170-0x0000000000400000-0x000000000070B000-memory.dmp

    Filesize

    3.0MB

  • memory/2512-171-0x00000000024A0000-0x00000000024B0000-memory.dmp

    Filesize

    64KB

  • memory/2512-172-0x00000000024A0000-0x00000000024B0000-memory.dmp

    Filesize

    64KB

  • memory/2512-173-0x00000000024A0000-0x00000000024B0000-memory.dmp

    Filesize

    64KB

  • memory/2512-175-0x0000000000400000-0x000000000070B000-memory.dmp

    Filesize

    3.0MB

  • memory/4824-1114-0x0000000000FE0000-0x0000000001012000-memory.dmp

    Filesize

    200KB

  • memory/4824-1116-0x0000000005C20000-0x0000000005C30000-memory.dmp

    Filesize

    64KB

  • memory/4824-1115-0x00000000058B0000-0x00000000058FB000-memory.dmp

    Filesize

    300KB

  • memory/5000-182-0x0000000003B50000-0x0000000003B8F000-memory.dmp

    Filesize

    252KB

  • memory/5000-215-0x0000000003B50000-0x0000000003B8F000-memory.dmp

    Filesize

    252KB

  • memory/5000-185-0x0000000003B50000-0x0000000003B8F000-memory.dmp

    Filesize

    252KB

  • memory/5000-187-0x0000000003B50000-0x0000000003B8F000-memory.dmp

    Filesize

    252KB

  • memory/5000-189-0x0000000003B50000-0x0000000003B8F000-memory.dmp

    Filesize

    252KB

  • memory/5000-191-0x0000000003B50000-0x0000000003B8F000-memory.dmp

    Filesize

    252KB

  • memory/5000-193-0x0000000003B50000-0x0000000003B8F000-memory.dmp

    Filesize

    252KB

  • memory/5000-195-0x0000000003B50000-0x0000000003B8F000-memory.dmp

    Filesize

    252KB

  • memory/5000-197-0x0000000003B50000-0x0000000003B8F000-memory.dmp

    Filesize

    252KB

  • memory/5000-201-0x0000000003B50000-0x0000000003B8F000-memory.dmp

    Filesize

    252KB

  • memory/5000-199-0x0000000003B50000-0x0000000003B8F000-memory.dmp

    Filesize

    252KB

  • memory/5000-203-0x0000000003B50000-0x0000000003B8F000-memory.dmp

    Filesize

    252KB

  • memory/5000-205-0x0000000001A30000-0x0000000001A7B000-memory.dmp

    Filesize

    300KB

  • memory/5000-207-0x00000000062E0000-0x00000000062F0000-memory.dmp

    Filesize

    64KB

  • memory/5000-208-0x00000000062E0000-0x00000000062F0000-memory.dmp

    Filesize

    64KB

  • memory/5000-206-0x0000000003B50000-0x0000000003B8F000-memory.dmp

    Filesize

    252KB

  • memory/5000-211-0x0000000003B50000-0x0000000003B8F000-memory.dmp

    Filesize

    252KB

  • memory/5000-210-0x00000000062E0000-0x00000000062F0000-memory.dmp

    Filesize

    64KB

  • memory/5000-213-0x0000000003B50000-0x0000000003B8F000-memory.dmp

    Filesize

    252KB

  • memory/5000-183-0x0000000003B50000-0x0000000003B8F000-memory.dmp

    Filesize

    252KB

  • memory/5000-217-0x0000000003B50000-0x0000000003B8F000-memory.dmp

    Filesize

    252KB

  • memory/5000-219-0x0000000003B50000-0x0000000003B8F000-memory.dmp

    Filesize

    252KB

  • memory/5000-1092-0x0000000006E00000-0x0000000007406000-memory.dmp

    Filesize

    6.0MB

  • memory/5000-1093-0x00000000067F0000-0x00000000068FA000-memory.dmp

    Filesize

    1.0MB

  • memory/5000-1094-0x0000000003DD0000-0x0000000003DE2000-memory.dmp

    Filesize

    72KB

  • memory/5000-1095-0x0000000003DF0000-0x0000000003E2E000-memory.dmp

    Filesize

    248KB

  • memory/5000-1096-0x0000000006290000-0x00000000062DB000-memory.dmp

    Filesize

    300KB

  • memory/5000-1097-0x00000000062E0000-0x00000000062F0000-memory.dmp

    Filesize

    64KB

  • memory/5000-1098-0x0000000006B40000-0x0000000006BA6000-memory.dmp

    Filesize

    408KB

  • memory/5000-1099-0x0000000007810000-0x00000000078A2000-memory.dmp

    Filesize

    584KB

  • memory/5000-1100-0x00000000078B0000-0x0000000007926000-memory.dmp

    Filesize

    472KB

  • memory/5000-1101-0x0000000007950000-0x00000000079A0000-memory.dmp

    Filesize

    320KB

  • memory/5000-1103-0x00000000062E0000-0x00000000062F0000-memory.dmp

    Filesize

    64KB

  • memory/5000-1104-0x00000000062E0000-0x00000000062F0000-memory.dmp

    Filesize

    64KB

  • memory/5000-1105-0x00000000062E0000-0x00000000062F0000-memory.dmp

    Filesize

    64KB

  • memory/5000-181-0x0000000003B50000-0x0000000003B94000-memory.dmp

    Filesize

    272KB

  • memory/5000-180-0x00000000037B0000-0x00000000037F6000-memory.dmp

    Filesize

    280KB

  • memory/5000-1106-0x00000000062E0000-0x00000000062F0000-memory.dmp

    Filesize

    64KB

  • memory/5000-1107-0x0000000007C30000-0x0000000007DF2000-memory.dmp

    Filesize

    1.8MB

  • memory/5000-1108-0x0000000007E00000-0x000000000832C000-memory.dmp

    Filesize

    5.2MB