Analysis

  • max time kernel
    93s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-03-2023 03:18

General

  • Target

    cd2bc10f5d089ede0e3f5c95543439a19115a2ff928062dee10eb2b671651d5d.exe

  • Size

    689KB

  • MD5

    7ebaf5a7419dadd3c01a236b401a50ac

  • SHA1

    0d0e21bc1535370c7ed21c80aa0176c6e8b1dfd8

  • SHA256

    cd2bc10f5d089ede0e3f5c95543439a19115a2ff928062dee10eb2b671651d5d

  • SHA512

    cddc7b23b98024814f2a203e0e5cb5a1e2f5a4f5654b93e9dac7137f04dadecbb4e9457f05be52cfd681e4701c32b7518dd6ed77143bf923880a9e0175995dfd

  • SSDEEP

    12288:XMray90O1uPy00XHz2X+gp+yV65hLuZw8oaF/6b6mJ5vFFqPfigBeV0qRVpUx1Z/:5yn2gyXF7IfaL4b6mJ5HqPagUjXS1V

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

from

C2

176.113.115.145:4125

Attributes
  • auth_value

    8633e283485822a4a48f0a41d5397566

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 18 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cd2bc10f5d089ede0e3f5c95543439a19115a2ff928062dee10eb2b671651d5d.exe
    "C:\Users\Admin\AppData\Local\Temp\cd2bc10f5d089ede0e3f5c95543439a19115a2ff928062dee10eb2b671651d5d.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4644
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un335986.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un335986.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2740
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3011.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3011.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2704
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 1084
          4⤵
          • Program crash
          PID:1128
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4027.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4027.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4888
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 1952
          4⤵
          • Program crash
          PID:1172
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si976434.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si976434.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3448
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2704 -ip 2704
    1⤵
      PID:2152
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4888 -ip 4888
      1⤵
        PID:4504

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si976434.exe

        Filesize

        175KB

        MD5

        65356ac12865263bdce6e161520bef01

        SHA1

        68294da5d17e33564c4441a6a2c768a72d36814c

        SHA256

        893f6e2e2b28c77e239326f4ed4655d584b60f86df4e58536bd4ed0e3079f7ef

        SHA512

        74692599c35a0df9d0ecf9e674f0e110a0a5ec43eeb31d462e65e31b79a2d6ff4dd0258ca297e08bb1d481bf6b976eab65010d213067aefe2d6d1d58f7d762c6

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si976434.exe

        Filesize

        175KB

        MD5

        65356ac12865263bdce6e161520bef01

        SHA1

        68294da5d17e33564c4441a6a2c768a72d36814c

        SHA256

        893f6e2e2b28c77e239326f4ed4655d584b60f86df4e58536bd4ed0e3079f7ef

        SHA512

        74692599c35a0df9d0ecf9e674f0e110a0a5ec43eeb31d462e65e31b79a2d6ff4dd0258ca297e08bb1d481bf6b976eab65010d213067aefe2d6d1d58f7d762c6

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un335986.exe

        Filesize

        547KB

        MD5

        cfa498df1b94cabf76cd049d7b7869ce

        SHA1

        23df19754af578e5ad06360b09a3938ec9a54f0e

        SHA256

        b0d5af0f04342df79781bc4cc584800875eba32f6e76b91a2b311a5012aa451a

        SHA512

        855d8fa1dab0978c7c8985113dc72ac3fae2c5d660cab84f46dacce6e2765eff4e405f1ee16540e7eb2e26885cd7c11fb2458cb55f4f9e82c3ed0cda42467e05

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un335986.exe

        Filesize

        547KB

        MD5

        cfa498df1b94cabf76cd049d7b7869ce

        SHA1

        23df19754af578e5ad06360b09a3938ec9a54f0e

        SHA256

        b0d5af0f04342df79781bc4cc584800875eba32f6e76b91a2b311a5012aa451a

        SHA512

        855d8fa1dab0978c7c8985113dc72ac3fae2c5d660cab84f46dacce6e2765eff4e405f1ee16540e7eb2e26885cd7c11fb2458cb55f4f9e82c3ed0cda42467e05

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3011.exe

        Filesize

        291KB

        MD5

        97a8dd71e2581e40f604b5c3ead52ef6

        SHA1

        acf5ce2db368e418ac70cf0dc2410d11ca32fc48

        SHA256

        4fe66cb96e7759b5507e87fe3af178c1f01dc173f4f1d03b63224e7fccd79623

        SHA512

        c403b4be67d42c5d6e66da59355f72d1a64d93227e327c470aa4b71f3208f2f97115a62372d03fa1a7d8f4fe181f74e483f0cdd45fbc6d31da4605d81f30a7e7

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3011.exe

        Filesize

        291KB

        MD5

        97a8dd71e2581e40f604b5c3ead52ef6

        SHA1

        acf5ce2db368e418ac70cf0dc2410d11ca32fc48

        SHA256

        4fe66cb96e7759b5507e87fe3af178c1f01dc173f4f1d03b63224e7fccd79623

        SHA512

        c403b4be67d42c5d6e66da59355f72d1a64d93227e327c470aa4b71f3208f2f97115a62372d03fa1a7d8f4fe181f74e483f0cdd45fbc6d31da4605d81f30a7e7

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4027.exe

        Filesize

        345KB

        MD5

        1223144b5d77182e1a55ab16f18b0644

        SHA1

        11ee1f5afb911b1b2021b3227e3512698e2a97a4

        SHA256

        0dbb2653ac6916042975e90a0de9bb642881d94c4ee13dbb48a69bdfad25903e

        SHA512

        6c38981a2eb2934ef243cfa3188ca113a3c0d6875f82acd599a775593369e17eca25f8d5a83bcadd52b88be43f821217ae3365ff59140a51281e29a55b09cc7e

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4027.exe

        Filesize

        345KB

        MD5

        1223144b5d77182e1a55ab16f18b0644

        SHA1

        11ee1f5afb911b1b2021b3227e3512698e2a97a4

        SHA256

        0dbb2653ac6916042975e90a0de9bb642881d94c4ee13dbb48a69bdfad25903e

        SHA512

        6c38981a2eb2934ef243cfa3188ca113a3c0d6875f82acd599a775593369e17eca25f8d5a83bcadd52b88be43f821217ae3365ff59140a51281e29a55b09cc7e

      • memory/2704-148-0x0000000004D80000-0x0000000005324000-memory.dmp

        Filesize

        5.6MB

      • memory/2704-149-0x0000000000710000-0x000000000073D000-memory.dmp

        Filesize

        180KB

      • memory/2704-151-0x00000000027E0000-0x00000000027F2000-memory.dmp

        Filesize

        72KB

      • memory/2704-150-0x0000000004D70000-0x0000000004D80000-memory.dmp

        Filesize

        64KB

      • memory/2704-152-0x0000000004D70000-0x0000000004D80000-memory.dmp

        Filesize

        64KB

      • memory/2704-155-0x00000000027E0000-0x00000000027F2000-memory.dmp

        Filesize

        72KB

      • memory/2704-153-0x00000000027E0000-0x00000000027F2000-memory.dmp

        Filesize

        72KB

      • memory/2704-159-0x00000000027E0000-0x00000000027F2000-memory.dmp

        Filesize

        72KB

      • memory/2704-157-0x00000000027E0000-0x00000000027F2000-memory.dmp

        Filesize

        72KB

      • memory/2704-161-0x00000000027E0000-0x00000000027F2000-memory.dmp

        Filesize

        72KB

      • memory/2704-163-0x00000000027E0000-0x00000000027F2000-memory.dmp

        Filesize

        72KB

      • memory/2704-165-0x00000000027E0000-0x00000000027F2000-memory.dmp

        Filesize

        72KB

      • memory/2704-167-0x00000000027E0000-0x00000000027F2000-memory.dmp

        Filesize

        72KB

      • memory/2704-169-0x00000000027E0000-0x00000000027F2000-memory.dmp

        Filesize

        72KB

      • memory/2704-171-0x00000000027E0000-0x00000000027F2000-memory.dmp

        Filesize

        72KB

      • memory/2704-173-0x00000000027E0000-0x00000000027F2000-memory.dmp

        Filesize

        72KB

      • memory/2704-175-0x00000000027E0000-0x00000000027F2000-memory.dmp

        Filesize

        72KB

      • memory/2704-177-0x00000000027E0000-0x00000000027F2000-memory.dmp

        Filesize

        72KB

      • memory/2704-179-0x00000000027E0000-0x00000000027F2000-memory.dmp

        Filesize

        72KB

      • memory/2704-180-0x0000000000400000-0x000000000070B000-memory.dmp

        Filesize

        3.0MB

      • memory/2704-181-0x0000000004D70000-0x0000000004D80000-memory.dmp

        Filesize

        64KB

      • memory/2704-182-0x0000000004D70000-0x0000000004D80000-memory.dmp

        Filesize

        64KB

      • memory/2704-184-0x0000000000400000-0x000000000070B000-memory.dmp

        Filesize

        3.0MB

      • memory/3448-1120-0x0000000000970000-0x00000000009A2000-memory.dmp

        Filesize

        200KB

      • memory/3448-1123-0x00000000052A0000-0x00000000052B0000-memory.dmp

        Filesize

        64KB

      • memory/3448-1121-0x00000000052A0000-0x00000000052B0000-memory.dmp

        Filesize

        64KB

      • memory/4888-192-0x0000000006640000-0x000000000667F000-memory.dmp

        Filesize

        252KB

      • memory/4888-226-0x0000000006640000-0x000000000667F000-memory.dmp

        Filesize

        252KB

      • memory/4888-196-0x0000000006640000-0x000000000667F000-memory.dmp

        Filesize

        252KB

      • memory/4888-198-0x0000000006640000-0x000000000667F000-memory.dmp

        Filesize

        252KB

      • memory/4888-200-0x0000000001B00000-0x0000000001B4B000-memory.dmp

        Filesize

        300KB

      • memory/4888-201-0x0000000006640000-0x000000000667F000-memory.dmp

        Filesize

        252KB

      • memory/4888-202-0x0000000003A90000-0x0000000003AA0000-memory.dmp

        Filesize

        64KB

      • memory/4888-204-0x0000000003A90000-0x0000000003AA0000-memory.dmp

        Filesize

        64KB

      • memory/4888-205-0x0000000006640000-0x000000000667F000-memory.dmp

        Filesize

        252KB

      • memory/4888-207-0x0000000003A90000-0x0000000003AA0000-memory.dmp

        Filesize

        64KB

      • memory/4888-208-0x0000000006640000-0x000000000667F000-memory.dmp

        Filesize

        252KB

      • memory/4888-210-0x0000000006640000-0x000000000667F000-memory.dmp

        Filesize

        252KB

      • memory/4888-212-0x0000000006640000-0x000000000667F000-memory.dmp

        Filesize

        252KB

      • memory/4888-214-0x0000000006640000-0x000000000667F000-memory.dmp

        Filesize

        252KB

      • memory/4888-216-0x0000000006640000-0x000000000667F000-memory.dmp

        Filesize

        252KB

      • memory/4888-218-0x0000000006640000-0x000000000667F000-memory.dmp

        Filesize

        252KB

      • memory/4888-220-0x0000000006640000-0x000000000667F000-memory.dmp

        Filesize

        252KB

      • memory/4888-222-0x0000000006640000-0x000000000667F000-memory.dmp

        Filesize

        252KB

      • memory/4888-224-0x0000000006640000-0x000000000667F000-memory.dmp

        Filesize

        252KB

      • memory/4888-194-0x0000000006640000-0x000000000667F000-memory.dmp

        Filesize

        252KB

      • memory/4888-1099-0x00000000067C0000-0x0000000006DD8000-memory.dmp

        Filesize

        6.1MB

      • memory/4888-1100-0x0000000006E20000-0x0000000006F2A000-memory.dmp

        Filesize

        1.0MB

      • memory/4888-1101-0x0000000006F50000-0x0000000006F62000-memory.dmp

        Filesize

        72KB

      • memory/4888-1102-0x0000000006F70000-0x0000000006FAC000-memory.dmp

        Filesize

        240KB

      • memory/4888-1103-0x0000000003A90000-0x0000000003AA0000-memory.dmp

        Filesize

        64KB

      • memory/4888-1104-0x0000000007260000-0x00000000072C6000-memory.dmp

        Filesize

        408KB

      • memory/4888-1105-0x0000000007920000-0x00000000079B2000-memory.dmp

        Filesize

        584KB

      • memory/4888-1106-0x0000000007A00000-0x0000000007A76000-memory.dmp

        Filesize

        472KB

      • memory/4888-1107-0x0000000007A90000-0x0000000007AE0000-memory.dmp

        Filesize

        320KB

      • memory/4888-1109-0x0000000003A90000-0x0000000003AA0000-memory.dmp

        Filesize

        64KB

      • memory/4888-1110-0x0000000003A90000-0x0000000003AA0000-memory.dmp

        Filesize

        64KB

      • memory/4888-1111-0x0000000003A90000-0x0000000003AA0000-memory.dmp

        Filesize

        64KB

      • memory/4888-190-0x0000000006640000-0x000000000667F000-memory.dmp

        Filesize

        252KB

      • memory/4888-189-0x0000000006640000-0x000000000667F000-memory.dmp

        Filesize

        252KB

      • memory/4888-1112-0x0000000007D40000-0x0000000007F02000-memory.dmp

        Filesize

        1.8MB

      • memory/4888-1113-0x0000000007F60000-0x000000000848C000-memory.dmp

        Filesize

        5.2MB

      • memory/4888-1114-0x0000000003A90000-0x0000000003AA0000-memory.dmp

        Filesize

        64KB