Analysis
-
max time kernel
56s -
max time network
75s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
28-03-2023 05:44
General
-
Target
f236e2ac8ae59ad6f69e1cdab9f5bda571610dfccb5fd61fb2d7422b640caef5.exe
-
Size
713KB
-
MD5
ead56ee95babb18a07a095a4e7676af0
-
SHA1
1f3f877e539ab73d68ac713e7879a6526c3711a2
-
SHA256
f236e2ac8ae59ad6f69e1cdab9f5bda571610dfccb5fd61fb2d7422b640caef5
-
SHA512
3a8ccab2b1a7fdf5f43f55fb0a2f84b71eabb373bc43386e6e7bef36608c5dac3f144b6ed9c3e4939e33e4f6debdc40acc1266a7bfadc24288f1a511da3cc182
-
SSDEEP
12288:qMrSy905LaamLIGILCKxorB2TM609DHuvJPvoI7J6uJG+xMv7ZuRfigX8F1vzrqt:QyhFI7LCvoQSRPJ6uJ2NuRagX8F9Gt
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 21 IoCs
-
Executes dropped EXE 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 2 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f236e2ac8ae59ad6f69e1cdab9f5bda571610dfccb5fd61fb2d7422b640caef5.exe"C:\Users\Admin\AppData\Local\Temp\f236e2ac8ae59ad6f69e1cdab9f5bda571610dfccb5fd61fb2d7422b640caef5.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un279746.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un279746.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5678.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5678.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6237.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6237.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si701762.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si701762.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD55c826cf31fee0131fa634a5460731f4c
SHA11d6c21fb9951e228553a0161602b8900dd43ee26
SHA2560307cacfa80a28dbf957faf4d4b42863b281dc4ea6fd38d05972f99ffd70f290
SHA512fd377fa6ccce0add22a2132d2c48a36ff77e1f9d68401214dc3b1d645184e55a05efbb5fca5faf606943459f6d84631895213a54d681a16f8fa9f28bdea44f4d
-
Filesize
175KB
MD55c826cf31fee0131fa634a5460731f4c
SHA11d6c21fb9951e228553a0161602b8900dd43ee26
SHA2560307cacfa80a28dbf957faf4d4b42863b281dc4ea6fd38d05972f99ffd70f290
SHA512fd377fa6ccce0add22a2132d2c48a36ff77e1f9d68401214dc3b1d645184e55a05efbb5fca5faf606943459f6d84631895213a54d681a16f8fa9f28bdea44f4d
-
Filesize
571KB
MD58e3fbe06f509a188f10053a8d4ab6aa6
SHA15481f8ebda1c17dfa29cbcb1e5ce2a56d9b319a7
SHA25686b6c6d9104efb81565f5239d33aed89a216993161d268b7b561f0bad905f8d9
SHA5129d4e64419cf3962a36caa36184d76b157f6fabc4554a81e66c8a4ef65effe307462e933442d71fd63e54da77bae2a494fb0b21e3217e163c7eb36e1e15f2a17c
-
Filesize
571KB
MD58e3fbe06f509a188f10053a8d4ab6aa6
SHA15481f8ebda1c17dfa29cbcb1e5ce2a56d9b319a7
SHA25686b6c6d9104efb81565f5239d33aed89a216993161d268b7b561f0bad905f8d9
SHA5129d4e64419cf3962a36caa36184d76b157f6fabc4554a81e66c8a4ef65effe307462e933442d71fd63e54da77bae2a494fb0b21e3217e163c7eb36e1e15f2a17c
-
Filesize
322KB
MD5f6c2cdb6ee48252a9c9aa0b55920e5f6
SHA1751969cb1dde41c54aba469f7a2df689d2b194df
SHA256178778ed38ec4e2bce51ef94c36434a44ca14a3cad9a30a75840e1c3755d8f20
SHA512fa9bf6bef65e1308fb238fce2f8368a37c61d9ee778afac721979f07ef21f3c73a104330183b47b4547a4e731963e12f5a6265b89b41e17e0751438756a945cc
-
Filesize
322KB
MD5f6c2cdb6ee48252a9c9aa0b55920e5f6
SHA1751969cb1dde41c54aba469f7a2df689d2b194df
SHA256178778ed38ec4e2bce51ef94c36434a44ca14a3cad9a30a75840e1c3755d8f20
SHA512fa9bf6bef65e1308fb238fce2f8368a37c61d9ee778afac721979f07ef21f3c73a104330183b47b4547a4e731963e12f5a6265b89b41e17e0751438756a945cc
-
Filesize
345KB
MD5d08aa2d3db7c4b7cfffb60a3294a3511
SHA1fbfadf2f8278e5a4fc808d21cbd0288c413ffc82
SHA2561c6b0dc0b1104be74da8844715996db1d280d8f64816bc449b2a30bf6d17d8fa
SHA512f482fbfe3de0409dedd3febcf1a8ed316d101a58c497c169e8b7f7afe5f6d1d2857247ecf210bf6c97e3a4b2ca6534993e6a9989d32960cc081e33cba2d1f86e
-
Filesize
345KB
MD5d08aa2d3db7c4b7cfffb60a3294a3511
SHA1fbfadf2f8278e5a4fc808d21cbd0288c413ffc82
SHA2561c6b0dc0b1104be74da8844715996db1d280d8f64816bc449b2a30bf6d17d8fa
SHA512f482fbfe3de0409dedd3febcf1a8ed316d101a58c497c169e8b7f7afe5f6d1d2857247ecf210bf6c97e3a4b2ca6534993e6a9989d32960cc081e33cba2d1f86e
-
Filesize
104KB
-
Filesize
5.0MB
-
Filesize
180KB
-
Filesize
64KB
-
Filesize
96KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
39.5MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
39.5MB
-
Filesize
200KB
-
Filesize
64KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
6.0MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
248KB
-
Filesize
64KB
-
Filesize
300KB
-
Filesize
584KB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
272KB
-
Filesize
280KB
-
Filesize
64KB
-
Filesize
472KB
-
Filesize
320KB