Analysis
-
max time kernel
54s -
max time network
146s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
28-03-2023 02:48
General
-
Target
2cd7e337e09ecc4765bed877ac6d1acecbb0d46684d316b7903d7b177f0a767c.exe
-
Size
689KB
-
MD5
b8e1c8ef5918b9f41d1a20549f015ab2
-
SHA1
407f61853ec180808dafefc14c4752a4302c9493
-
SHA256
2cd7e337e09ecc4765bed877ac6d1acecbb0d46684d316b7903d7b177f0a767c
-
SHA512
3caf04112298a3b9694d1c3270a901aad8f808ae2279f0d73e69a1da96cc02c590fec3773da9ec3e13806182b1d5523f00a225022325ad57a9df662c69c14cf0
-
SSDEEP
12288:XMr8y90Ly3AqQkNS0Au/5ROBIlmyI65hLuAg5K3YuShZRyGLff04mJMvZFlWfigX:7yrwqQw/5R3lznfa55KouklM4mJMblW9
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Executes dropped EXE 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 2 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2cd7e337e09ecc4765bed877ac6d1acecbb0d46684d316b7903d7b177f0a767c.exe"C:\Users\Admin\AppData\Local\Temp\2cd7e337e09ecc4765bed877ac6d1acecbb0d46684d316b7903d7b177f0a767c.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un500169.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un500169.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0081.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0081.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0701.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0701.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si656465.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si656465.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD55de128676fa2973b2133223ca1f223f0
SHA1024fd5f1b178a2c26931eead296ad5029caa356f
SHA256639f023bad34010c91a1de6c6c21d7bfc24144c592b6d1594b177e2fa871fa2a
SHA5128a710c906ec28e3389eb645d29ebf4d1e80ba172582e6d7ed4c09b7049047dad006093c341996e73e981b5528d6f2a2d18ce02079ab5e5698ac4f88ab34350f4
-
Filesize
175KB
MD55de128676fa2973b2133223ca1f223f0
SHA1024fd5f1b178a2c26931eead296ad5029caa356f
SHA256639f023bad34010c91a1de6c6c21d7bfc24144c592b6d1594b177e2fa871fa2a
SHA5128a710c906ec28e3389eb645d29ebf4d1e80ba172582e6d7ed4c09b7049047dad006093c341996e73e981b5528d6f2a2d18ce02079ab5e5698ac4f88ab34350f4
-
Filesize
547KB
MD5dc6f48546fd2a4dd82b17418b997604f
SHA13346cbac398afedbe407d2dd892ce34fdf672972
SHA25659b58785db816a5f105f6366d66ac0b2eea512c84d85cb7f37ad331b113fce40
SHA512cca2ef7c21fc533f8e671135b550ae0ec93e816063e38cf084febffa3e72c7568f83069862e72d697a3e022009b791c27db38274eaef70f41a0405f09ea7e43a
-
Filesize
547KB
MD5dc6f48546fd2a4dd82b17418b997604f
SHA13346cbac398afedbe407d2dd892ce34fdf672972
SHA25659b58785db816a5f105f6366d66ac0b2eea512c84d85cb7f37ad331b113fce40
SHA512cca2ef7c21fc533f8e671135b550ae0ec93e816063e38cf084febffa3e72c7568f83069862e72d697a3e022009b791c27db38274eaef70f41a0405f09ea7e43a
-
Filesize
291KB
MD519de3f6506cabcbc26fc76e1da9c45b0
SHA165ab5496b998fc7041bfad4ea3c133dcc3b03871
SHA2561e3c1cc18dbe5fec640ab1bffa43853fd3bffaff33e907ebbda438e229c7ef66
SHA512d306d9aad5079254ec966798b3e0cabf79dad3879fcc838df3cbc9356c953420ec97cb5cf5a3ddadde1fd0ccce7ee6ea278730b424fb0b7e8f5a648b0fa9d930
-
Filesize
291KB
MD519de3f6506cabcbc26fc76e1da9c45b0
SHA165ab5496b998fc7041bfad4ea3c133dcc3b03871
SHA2561e3c1cc18dbe5fec640ab1bffa43853fd3bffaff33e907ebbda438e229c7ef66
SHA512d306d9aad5079254ec966798b3e0cabf79dad3879fcc838df3cbc9356c953420ec97cb5cf5a3ddadde1fd0ccce7ee6ea278730b424fb0b7e8f5a648b0fa9d930
-
Filesize
345KB
MD5a019c0084ad6c865e8fade8eb62dd51e
SHA16b2793b7ab6fedba12c1a5e34d6a5809c00e006e
SHA25656848c47ba7dd47f878273aff37052b0afadd2000d40d8f1c259b39d5444283b
SHA5120b6b37e205fba5683035b3ef290cc96ae771e0b96810438a362478b61eacc9fbbbd47a94311165b9b8c946cc7966e5dbe18c196d1fa0022c1acd06f50aa0544e
-
Filesize
345KB
MD5a019c0084ad6c865e8fade8eb62dd51e
SHA16b2793b7ab6fedba12c1a5e34d6a5809c00e006e
SHA25656848c47ba7dd47f878273aff37052b0afadd2000d40d8f1c259b39d5444283b
SHA5120b6b37e205fba5683035b3ef290cc96ae771e0b96810438a362478b61eacc9fbbbd47a94311165b9b8c946cc7966e5dbe18c196d1fa0022c1acd06f50aa0544e
-
Filesize
6.0MB
-
Filesize
1.0MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
64KB
-
Filesize
320KB
-
Filesize
472KB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
5.2MB
-
Filesize
1.8MB
-
Filesize
408KB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
300KB
-
Filesize
248KB
-
Filesize
72KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
280KB
-
Filesize
272KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
200KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
3.0MB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
96KB
-
Filesize
3.0MB
-
Filesize
180KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
5.0MB
-
Filesize
104KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
64KB