Analysis
-
max time kernel
54s -
max time network
139s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
28-03-2023 03:15
General
-
Target
34752ea27e3426df68627345d5152e9f195029bf60a8d22067e23361f2ea4ccb.exe
-
Size
690KB
-
MD5
32febfa3ee9da606e7f0dbd3fbc72854
-
SHA1
6d4097795426c8ae5e8feda997bfe496b2ec8392
-
SHA256
34752ea27e3426df68627345d5152e9f195029bf60a8d22067e23361f2ea4ccb
-
SHA512
7fa1c6972e3f120dca09f0cc636ec9fe41fa4f905103f07673d5be606e5579300863f9d7ebf8858c3bb66395e94252b9e03d0083ce453fcf5fff4663f5a96432
-
SSDEEP
12288:8Mriy90k9ei7vGLnGmpfLPOhh9Gyj65hLubq6/bs+pvLfDHm2DovmF7LfigTT5zz:Wyb9V7eKqfLKTufab5/bs+V7HtDoC7LH
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Executes dropped EXE 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 2 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\34752ea27e3426df68627345d5152e9f195029bf60a8d22067e23361f2ea4ccb.exe"C:\Users\Admin\AppData\Local\Temp\34752ea27e3426df68627345d5152e9f195029bf60a8d22067e23361f2ea4ccb.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un173117.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un173117.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7416.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7416.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5305.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5305.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si883945.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si883945.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD5096476980714c11dcf53176dadab1db3
SHA14ac1ac946b441c82dec0f71ceb8c5b28f91c707a
SHA256f8e95e21568225b09baf5ad26242dfd6eb6a25a29def67eb722874752532b76b
SHA512f5d88d06c4e580d1433da8d023f9a7f9c1e1f588822c8195b4300af986ff398400ffeb71a1d005dabb1157e88d6661a01cf0130b4806835155e3f77ce1b3f59a
-
Filesize
175KB
MD5096476980714c11dcf53176dadab1db3
SHA14ac1ac946b441c82dec0f71ceb8c5b28f91c707a
SHA256f8e95e21568225b09baf5ad26242dfd6eb6a25a29def67eb722874752532b76b
SHA512f5d88d06c4e580d1433da8d023f9a7f9c1e1f588822c8195b4300af986ff398400ffeb71a1d005dabb1157e88d6661a01cf0130b4806835155e3f77ce1b3f59a
-
Filesize
548KB
MD5cb0e520d966832dab6b71813e5cdb9ba
SHA1fc591742fe4535a409e52f39f0a9d428d9ff230e
SHA2568859044c0848d5c258ef1d3b465b28c3778b203675f7b99c8424b44162be818e
SHA512be690442e1432401d48b6680e395d30846986e30342609d293a88e8fbf266706ac9ddadd39e200b4d2261f48da14774d26704f892364231363276bf4379c2410
-
Filesize
548KB
MD5cb0e520d966832dab6b71813e5cdb9ba
SHA1fc591742fe4535a409e52f39f0a9d428d9ff230e
SHA2568859044c0848d5c258ef1d3b465b28c3778b203675f7b99c8424b44162be818e
SHA512be690442e1432401d48b6680e395d30846986e30342609d293a88e8fbf266706ac9ddadd39e200b4d2261f48da14774d26704f892364231363276bf4379c2410
-
Filesize
291KB
MD5c807da8e36b2ef8f5cedfabc9ff06665
SHA1b52acca14ff9387bf40a41ff7d380310e261ff18
SHA2568a6d7cac90bf122124ea127f2179ce2128318ddd4093b56c453f989bf4dc099c
SHA51270695dcf04b971790d20e93584bb5013074440955ff2e4bf87cb2f1b411b2ab48a5a70f53695c0418278bd9c98f23109277dcea080f41461bcf0def39764a2eb
-
Filesize
291KB
MD5c807da8e36b2ef8f5cedfabc9ff06665
SHA1b52acca14ff9387bf40a41ff7d380310e261ff18
SHA2568a6d7cac90bf122124ea127f2179ce2128318ddd4093b56c453f989bf4dc099c
SHA51270695dcf04b971790d20e93584bb5013074440955ff2e4bf87cb2f1b411b2ab48a5a70f53695c0418278bd9c98f23109277dcea080f41461bcf0def39764a2eb
-
Filesize
345KB
MD5cc8db76073d1f98c9941407baceed231
SHA1844d7e7e440bbb55d670c342102bd71c5ebd38a3
SHA2561e7ece3eed58788cce283b994b09d3e3cda7585934692971d2ec7a679e3d680a
SHA512e6bf9b7b5a443dc8173d55623d1ee4d60ce3eca6f5a9fa37391f8fe71f1f683bcfe9a61c3833794e06422cf16cdbb844711dd3665425431e72aff300bdc57654
-
Filesize
345KB
MD5cc8db76073d1f98c9941407baceed231
SHA1844d7e7e440bbb55d670c342102bd71c5ebd38a3
SHA2561e7ece3eed58788cce283b994b09d3e3cda7585934692971d2ec7a679e3d680a
SHA512e6bf9b7b5a443dc8173d55623d1ee4d60ce3eca6f5a9fa37391f8fe71f1f683bcfe9a61c3833794e06422cf16cdbb844711dd3665425431e72aff300bdc57654
-
Filesize
64KB
-
Filesize
200KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
96KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
3.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
3.0MB
-
Filesize
180KB
-
Filesize
5.0MB
-
Filesize
104KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
6.0MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
248KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
252KB
-
Filesize
272KB
-
Filesize
280KB
-
Filesize
472KB
-
Filesize
320KB
-
Filesize
64KB