Analysis
-
max time kernel
49s -
max time network
56s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
28/03/2023, 08:18
General
-
Target
0ae7852b91dd1199043cc98e363fc1af3fa6b94b46d19daa7af89f6e5bd93b2f.exe
-
Size
694KB
-
MD5
d512bc8a90daf72808e21e80924a7603
-
SHA1
f429b91c7b81a9e409058135d779850837494a58
-
SHA256
0ae7852b91dd1199043cc98e363fc1af3fa6b94b46d19daa7af89f6e5bd93b2f
-
SHA512
74bad56afae57f8074c84747adb16b5432d9b9baadf97d8a482e3d04aeef3574593db327acc7ef0971fc922553dd5c38a1617d83b367c6bac91f063d5b4b0415
-
SSDEEP
12288:ioK7SPhtwSwKdNGHv+3jk5I00xBFQjwnS1PEqvMTsPpD6WdpB:eu5tjwKd0HWzk5NcKZEqldFH
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
-
Executes dropped EXE 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 1 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ae7852b91dd1199043cc98e363fc1af3fa6b94b46d19daa7af89f6e5bd93b2f.exe"C:\Users\Admin\AppData\Local\Temp\0ae7852b91dd1199043cc98e363fc1af3fa6b94b46d19daa7af89f6e5bd93b2f.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zibm2610.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zibm2610.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr307728.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr307728.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku031366.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku031366.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr901123.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr901123.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD5a3b183310744431c1ae8c6a9e5a8c00c
SHA1e14ba80f5a6c45928c2c1920d36aff461080361a
SHA25610f1c5840d50c1b7f270e354b6f28280a1f19336b37735dfe10069ca7990b9dc
SHA51248a2d4d43b4b4c71301a0feb33c6b4c702c6b4052b79b1b55790ada8dcf52850ad7746ee02d0b408e4390ac91e7f834fea4b03ad90324a03bcdf8df261fd95aa
-
Filesize
175KB
MD5a3b183310744431c1ae8c6a9e5a8c00c
SHA1e14ba80f5a6c45928c2c1920d36aff461080361a
SHA25610f1c5840d50c1b7f270e354b6f28280a1f19336b37735dfe10069ca7990b9dc
SHA51248a2d4d43b4b4c71301a0feb33c6b4c702c6b4052b79b1b55790ada8dcf52850ad7746ee02d0b408e4390ac91e7f834fea4b03ad90324a03bcdf8df261fd95aa
-
Filesize
388KB
MD57da91d63c271024c618c9988ce1f4604
SHA1f2173e9758baffce0ad82ce1b73523b803de1f99
SHA256403314199f08f27a5ddda772c8447ffc00b9034c49bd4e5d760a0446ae3ab3bc
SHA5123b78c1493e26375ba7f8561dd92f59c00b63c21a88a08473393c77951547774e2c9ebb63d4ddb467b320c44c35060726d81fdb3bf453d9e18d0c3ad51edde387
-
Filesize
388KB
MD57da91d63c271024c618c9988ce1f4604
SHA1f2173e9758baffce0ad82ce1b73523b803de1f99
SHA256403314199f08f27a5ddda772c8447ffc00b9034c49bd4e5d760a0446ae3ab3bc
SHA5123b78c1493e26375ba7f8561dd92f59c00b63c21a88a08473393c77951547774e2c9ebb63d4ddb467b320c44c35060726d81fdb3bf453d9e18d0c3ad51edde387
-
Filesize
11KB
MD55b143b7f6940e9de958b67626b1dbd87
SHA15ba04498673d2351a6be4139cb39f971a17fa3af
SHA2560e19dc7d29ce59c27cb95ee236362e67132028eef5142897003a78a0395297d2
SHA512bb35a3466ba62ab60d0861bf40be658dd2efbdd839aa4f4e7b3b631b2e39da4ab4674f583cd0319e143b4aa3c2bfd2b7988aaae790b7c3e7e6d4e2efcb04bcaa
-
Filesize
11KB
MD55b143b7f6940e9de958b67626b1dbd87
SHA15ba04498673d2351a6be4139cb39f971a17fa3af
SHA2560e19dc7d29ce59c27cb95ee236362e67132028eef5142897003a78a0395297d2
SHA512bb35a3466ba62ab60d0861bf40be658dd2efbdd839aa4f4e7b3b631b2e39da4ab4674f583cd0319e143b4aa3c2bfd2b7988aaae790b7c3e7e6d4e2efcb04bcaa
-
Filesize
345KB
MD58a012bcfba83ac9642a3556bbbb63d03
SHA149c2d3e80367abd491353781d6596dd5eeb76962
SHA256df403a44af2b45dcfdb80f7d89e8f186f41fce7fa4e819f8efa68b4e30b29613
SHA51222f59aa00e0748f84d575cb67cb1ff1bdb6d45c1cf6ea6e377dea9c8759540375dc89e572bd4f500deeb23981d4a79de89fb6213cb6225df07c5e2a6b9c00518
-
Filesize
345KB
MD58a012bcfba83ac9642a3556bbbb63d03
SHA149c2d3e80367abd491353781d6596dd5eeb76962
SHA256df403a44af2b45dcfdb80f7d89e8f186f41fce7fa4e819f8efa68b4e30b29613
SHA51222f59aa00e0748f84d575cb67cb1ff1bdb6d45c1cf6ea6e377dea9c8759540375dc89e572bd4f500deeb23981d4a79de89fb6213cb6225df07c5e2a6b9c00518
-
Filesize
536KB
-
Filesize
39.9MB
-
Filesize
40KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
272KB
-
Filesize
64KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
280KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
5.0MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
6.0MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
300KB
-
Filesize
584KB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
472KB
-
Filesize
320KB
-
Filesize
64KB
-
Filesize
200KB
-
Filesize
300KB
-
Filesize
64KB