Analysis

  • max time kernel
    44s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    28-03-2023 03:38

General

  • Target

    6be2cf09ec4c932f5943f99cfee44638fbb20c5ec8c167f0610f912b4c361639.exe

  • Size

    664KB

  • MD5

    a31b85730f3b6dcad09c7d948c2810e9

  • SHA1

    5b7fe6f52861735f6c0a39d961368131ad76e0d7

  • SHA256

    6be2cf09ec4c932f5943f99cfee44638fbb20c5ec8c167f0610f912b4c361639

  • SHA512

    adff75da0cb693bcb5127748d0d97a2a8ee5994399fe060120ec8c1677845722173b25fdc87c2cef44597600087a9d2c0741a40d6c2b616f761e56d677e31d8c

  • SSDEEP

    12288:ZVaVtadukTDcT7VqrPl/eo2E+4YoOOvpv0V7f40cKkyRluPsyM06u44CexnI:ZVCiIfMr9/12EbYo9xUf40cKkyn9yM0a

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

from

C2

176.113.115.145:4125

Attributes
  • auth_value

    8633e283485822a4a48f0a41d5397566

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6be2cf09ec4c932f5943f99cfee44638fbb20c5ec8c167f0610f912b4c361639.exe
    "C:\Users\Admin\AppData\Local\Temp\6be2cf09ec4c932f5943f99cfee44638fbb20c5ec8c167f0610f912b4c361639.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1928
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziQC9687.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziQC9687.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1220
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr510069.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr510069.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1064
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku260293.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku260293.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1432
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr097905.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr097905.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1280

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr097905.exe

    Filesize

    175KB

    MD5

    5f975b4331673c30c9ac4d5489f3cd63

    SHA1

    bbb4c7f8fcbe773d2998c301a0e4c1d5f802baff

    SHA256

    0a72e4acc80b7c72d377d96bc308c972f6aac8bbf180570a52152f71f9f3f5a9

    SHA512

    0d6db9c03d06ece44fb3780bd25ffc5ef975ad14347bcce1349b006c1db266f82e5b18e33f75152c1127ec935067e330e363b045543fbcd8801bdab9d878975c

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr097905.exe

    Filesize

    175KB

    MD5

    5f975b4331673c30c9ac4d5489f3cd63

    SHA1

    bbb4c7f8fcbe773d2998c301a0e4c1d5f802baff

    SHA256

    0a72e4acc80b7c72d377d96bc308c972f6aac8bbf180570a52152f71f9f3f5a9

    SHA512

    0d6db9c03d06ece44fb3780bd25ffc5ef975ad14347bcce1349b006c1db266f82e5b18e33f75152c1127ec935067e330e363b045543fbcd8801bdab9d878975c

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziQC9687.exe

    Filesize

    387KB

    MD5

    53caf17adc839a4667992c6c0ea06d36

    SHA1

    733ef02662f6384bc3a76e8bbc6064793315030c

    SHA256

    be6e81f0b16af02d9133ddf034057fd31fa315165517125f1c348d676001527f

    SHA512

    eb8c2b9ada459f27163a234c84efad7ee04b8ddede5f28e58ff500b190eba4a14467843e546d644e04fc460049a59bbce0e1843474fdcfd48f7d411e05c326b7

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziQC9687.exe

    Filesize

    387KB

    MD5

    53caf17adc839a4667992c6c0ea06d36

    SHA1

    733ef02662f6384bc3a76e8bbc6064793315030c

    SHA256

    be6e81f0b16af02d9133ddf034057fd31fa315165517125f1c348d676001527f

    SHA512

    eb8c2b9ada459f27163a234c84efad7ee04b8ddede5f28e58ff500b190eba4a14467843e546d644e04fc460049a59bbce0e1843474fdcfd48f7d411e05c326b7

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr510069.exe

    Filesize

    11KB

    MD5

    c9c3eb9eabfde6272d553187852e20d1

    SHA1

    ca3e3be1439463bda64a3d248e9203e310625691

    SHA256

    c1b3bfd5b1c3d5d13640d753e45a63c6df8856cbe52733a84be60b0ba9942542

    SHA512

    42bbbc7f0c2822610c74ce732f9bb231fe8b947d1b3115adfab0e86a478f42f309311d6c61d4c48b52f9ca47acd03fcd729f755243ab89651ec7198f4583efed

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr510069.exe

    Filesize

    11KB

    MD5

    c9c3eb9eabfde6272d553187852e20d1

    SHA1

    ca3e3be1439463bda64a3d248e9203e310625691

    SHA256

    c1b3bfd5b1c3d5d13640d753e45a63c6df8856cbe52733a84be60b0ba9942542

    SHA512

    42bbbc7f0c2822610c74ce732f9bb231fe8b947d1b3115adfab0e86a478f42f309311d6c61d4c48b52f9ca47acd03fcd729f755243ab89651ec7198f4583efed

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku260293.exe

    Filesize

    345KB

    MD5

    c2b4517fec935d1bb36b3e9ada66a492

    SHA1

    8a35e3edae871bef9042f063dd2c1808e21d1033

    SHA256

    2dae1f45f8df7cd6879329e22c470f539402fdda4e430e10a1f3801ef240ee0b

    SHA512

    ad5dc41d34f74d0c687765b9418441f6299d7d75d2e642e8a462220123e073fa8239eed66ee7168768bd183ace5570cec6dc7a38a32332a2cb0e8a754997c000

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku260293.exe

    Filesize

    345KB

    MD5

    c2b4517fec935d1bb36b3e9ada66a492

    SHA1

    8a35e3edae871bef9042f063dd2c1808e21d1033

    SHA256

    2dae1f45f8df7cd6879329e22c470f539402fdda4e430e10a1f3801ef240ee0b

    SHA512

    ad5dc41d34f74d0c687765b9418441f6299d7d75d2e642e8a462220123e073fa8239eed66ee7168768bd183ace5570cec6dc7a38a32332a2cb0e8a754997c000

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku260293.exe

    Filesize

    345KB

    MD5

    c2b4517fec935d1bb36b3e9ada66a492

    SHA1

    8a35e3edae871bef9042f063dd2c1808e21d1033

    SHA256

    2dae1f45f8df7cd6879329e22c470f539402fdda4e430e10a1f3801ef240ee0b

    SHA512

    ad5dc41d34f74d0c687765b9418441f6299d7d75d2e642e8a462220123e073fa8239eed66ee7168768bd183ace5570cec6dc7a38a32332a2cb0e8a754997c000

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\lr097905.exe

    Filesize

    175KB

    MD5

    5f975b4331673c30c9ac4d5489f3cd63

    SHA1

    bbb4c7f8fcbe773d2998c301a0e4c1d5f802baff

    SHA256

    0a72e4acc80b7c72d377d96bc308c972f6aac8bbf180570a52152f71f9f3f5a9

    SHA512

    0d6db9c03d06ece44fb3780bd25ffc5ef975ad14347bcce1349b006c1db266f82e5b18e33f75152c1127ec935067e330e363b045543fbcd8801bdab9d878975c

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\ziQC9687.exe

    Filesize

    387KB

    MD5

    53caf17adc839a4667992c6c0ea06d36

    SHA1

    733ef02662f6384bc3a76e8bbc6064793315030c

    SHA256

    be6e81f0b16af02d9133ddf034057fd31fa315165517125f1c348d676001527f

    SHA512

    eb8c2b9ada459f27163a234c84efad7ee04b8ddede5f28e58ff500b190eba4a14467843e546d644e04fc460049a59bbce0e1843474fdcfd48f7d411e05c326b7

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\ziQC9687.exe

    Filesize

    387KB

    MD5

    53caf17adc839a4667992c6c0ea06d36

    SHA1

    733ef02662f6384bc3a76e8bbc6064793315030c

    SHA256

    be6e81f0b16af02d9133ddf034057fd31fa315165517125f1c348d676001527f

    SHA512

    eb8c2b9ada459f27163a234c84efad7ee04b8ddede5f28e58ff500b190eba4a14467843e546d644e04fc460049a59bbce0e1843474fdcfd48f7d411e05c326b7

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\jr510069.exe

    Filesize

    11KB

    MD5

    c9c3eb9eabfde6272d553187852e20d1

    SHA1

    ca3e3be1439463bda64a3d248e9203e310625691

    SHA256

    c1b3bfd5b1c3d5d13640d753e45a63c6df8856cbe52733a84be60b0ba9942542

    SHA512

    42bbbc7f0c2822610c74ce732f9bb231fe8b947d1b3115adfab0e86a478f42f309311d6c61d4c48b52f9ca47acd03fcd729f755243ab89651ec7198f4583efed

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\ku260293.exe

    Filesize

    345KB

    MD5

    c2b4517fec935d1bb36b3e9ada66a492

    SHA1

    8a35e3edae871bef9042f063dd2c1808e21d1033

    SHA256

    2dae1f45f8df7cd6879329e22c470f539402fdda4e430e10a1f3801ef240ee0b

    SHA512

    ad5dc41d34f74d0c687765b9418441f6299d7d75d2e642e8a462220123e073fa8239eed66ee7168768bd183ace5570cec6dc7a38a32332a2cb0e8a754997c000

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\ku260293.exe

    Filesize

    345KB

    MD5

    c2b4517fec935d1bb36b3e9ada66a492

    SHA1

    8a35e3edae871bef9042f063dd2c1808e21d1033

    SHA256

    2dae1f45f8df7cd6879329e22c470f539402fdda4e430e10a1f3801ef240ee0b

    SHA512

    ad5dc41d34f74d0c687765b9418441f6299d7d75d2e642e8a462220123e073fa8239eed66ee7168768bd183ace5570cec6dc7a38a32332a2cb0e8a754997c000

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\ku260293.exe

    Filesize

    345KB

    MD5

    c2b4517fec935d1bb36b3e9ada66a492

    SHA1

    8a35e3edae871bef9042f063dd2c1808e21d1033

    SHA256

    2dae1f45f8df7cd6879329e22c470f539402fdda4e430e10a1f3801ef240ee0b

    SHA512

    ad5dc41d34f74d0c687765b9418441f6299d7d75d2e642e8a462220123e073fa8239eed66ee7168768bd183ace5570cec6dc7a38a32332a2cb0e8a754997c000

  • memory/1064-73-0x0000000001000000-0x000000000100A000-memory.dmp

    Filesize

    40KB

  • memory/1280-1005-0x0000000000D30000-0x0000000000D62000-memory.dmp

    Filesize

    200KB

  • memory/1280-1007-0x0000000000CB0000-0x0000000000CF0000-memory.dmp

    Filesize

    256KB

  • memory/1432-107-0x0000000005ED0000-0x0000000005F0F000-memory.dmp

    Filesize

    252KB

  • memory/1432-125-0x0000000005ED0000-0x0000000005F0F000-memory.dmp

    Filesize

    252KB

  • memory/1432-91-0x0000000005ED0000-0x0000000005F0F000-memory.dmp

    Filesize

    252KB

  • memory/1432-95-0x0000000005ED0000-0x0000000005F0F000-memory.dmp

    Filesize

    252KB

  • memory/1432-97-0x0000000005ED0000-0x0000000005F0F000-memory.dmp

    Filesize

    252KB

  • memory/1432-99-0x0000000005ED0000-0x0000000005F0F000-memory.dmp

    Filesize

    252KB

  • memory/1432-101-0x0000000005ED0000-0x0000000005F0F000-memory.dmp

    Filesize

    252KB

  • memory/1432-103-0x0000000005ED0000-0x0000000005F0F000-memory.dmp

    Filesize

    252KB

  • memory/1432-105-0x0000000005ED0000-0x0000000005F0F000-memory.dmp

    Filesize

    252KB

  • memory/1432-89-0x0000000005ED0000-0x0000000005F0F000-memory.dmp

    Filesize

    252KB

  • memory/1432-109-0x00000000003A0000-0x00000000003EB000-memory.dmp

    Filesize

    300KB

  • memory/1432-111-0x0000000005FB0000-0x0000000005FF0000-memory.dmp

    Filesize

    256KB

  • memory/1432-110-0x0000000005ED0000-0x0000000005F0F000-memory.dmp

    Filesize

    252KB

  • memory/1432-113-0x0000000005ED0000-0x0000000005F0F000-memory.dmp

    Filesize

    252KB

  • memory/1432-115-0x0000000005ED0000-0x0000000005F0F000-memory.dmp

    Filesize

    252KB

  • memory/1432-117-0x0000000005ED0000-0x0000000005F0F000-memory.dmp

    Filesize

    252KB

  • memory/1432-119-0x0000000005ED0000-0x0000000005F0F000-memory.dmp

    Filesize

    252KB

  • memory/1432-121-0x0000000005ED0000-0x0000000005F0F000-memory.dmp

    Filesize

    252KB

  • memory/1432-123-0x0000000005ED0000-0x0000000005F0F000-memory.dmp

    Filesize

    252KB

  • memory/1432-93-0x0000000005ED0000-0x0000000005F0F000-memory.dmp

    Filesize

    252KB

  • memory/1432-127-0x0000000005ED0000-0x0000000005F0F000-memory.dmp

    Filesize

    252KB

  • memory/1432-129-0x0000000005ED0000-0x0000000005F0F000-memory.dmp

    Filesize

    252KB

  • memory/1432-131-0x0000000005ED0000-0x0000000005F0F000-memory.dmp

    Filesize

    252KB

  • memory/1432-133-0x0000000005ED0000-0x0000000005F0F000-memory.dmp

    Filesize

    252KB

  • memory/1432-135-0x0000000005ED0000-0x0000000005F0F000-memory.dmp

    Filesize

    252KB

  • memory/1432-137-0x0000000005ED0000-0x0000000005F0F000-memory.dmp

    Filesize

    252KB

  • memory/1432-139-0x0000000005ED0000-0x0000000005F0F000-memory.dmp

    Filesize

    252KB

  • memory/1432-141-0x0000000005ED0000-0x0000000005F0F000-memory.dmp

    Filesize

    252KB

  • memory/1432-143-0x0000000005ED0000-0x0000000005F0F000-memory.dmp

    Filesize

    252KB

  • memory/1432-145-0x0000000005ED0000-0x0000000005F0F000-memory.dmp

    Filesize

    252KB

  • memory/1432-147-0x0000000005ED0000-0x0000000005F0F000-memory.dmp

    Filesize

    252KB

  • memory/1432-149-0x0000000005ED0000-0x0000000005F0F000-memory.dmp

    Filesize

    252KB

  • memory/1432-151-0x0000000005ED0000-0x0000000005F0F000-memory.dmp

    Filesize

    252KB

  • memory/1432-996-0x0000000005FB0000-0x0000000005FF0000-memory.dmp

    Filesize

    256KB

  • memory/1432-88-0x0000000005ED0000-0x0000000005F0F000-memory.dmp

    Filesize

    252KB

  • memory/1432-87-0x0000000005ED0000-0x0000000005F14000-memory.dmp

    Filesize

    272KB

  • memory/1432-86-0x0000000003920000-0x0000000003966000-memory.dmp

    Filesize

    280KB

  • memory/1928-75-0x0000000000400000-0x0000000000769000-memory.dmp

    Filesize

    3.4MB

  • memory/1928-74-0x0000000000770000-0x00000000007F6000-memory.dmp

    Filesize

    536KB