Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
28/03/2023, 20:05
General
-
Target
f789b6a10d5ebe4ac93b8dd714707e449725cf49c945456efeb2c554c54a8719.exe
-
Size
693KB
-
MD5
61d612079867f35d97b425f6c7fb371a
-
SHA1
d0bb9bc260cee545a0b70ae3de5b4bbfec4a22cf
-
SHA256
f789b6a10d5ebe4ac93b8dd714707e449725cf49c945456efeb2c554c54a8719
-
SHA512
ae75508fcac3e7c6aae9599c8e030ca5c1aec06b32117695c9aba16fc1f438ac614951ab821e84dcc1443eba90abcc65fed8979ad6f4c4af552bac7bea474bbf
-
SSDEEP
12288:oMrLy90MfQliUZbJ80yBeSR2BGtqOR1uzlRCbQyi0DolGR2nUH6oN7CZTRp:zy+lPZV8x6GtqA1vnMlZUHN63
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
muse
176.113.115.145:4125
-
auth_value
b91988a63a24940038d9262827a5320c
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 21 IoCs
-
Executes dropped EXE 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 2 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f789b6a10d5ebe4ac93b8dd714707e449725cf49c945456efeb2c554c54a8719.exe"C:\Users\Admin\AppData\Local\Temp\f789b6a10d5ebe4ac93b8dd714707e449725cf49c945456efeb2c554c54a8719.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un905314.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un905314.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2316.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2316.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3077.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3077.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si846214.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si846214.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD571be210d2cef8cba16c1a16f77db8a4e
SHA15a019419d3db8e0d5a9dfe25d9a42973473d90b3
SHA25643006bc20df2c1efb5935ce4af6e20d2d7a88cf09c46c33513b58d7c7cce6b56
SHA5126bbe3496ea473d757412bbc81f7b4c3222ad38b3f2ad4a1f4a5e827b66dbe513bde8046dc7ebc3d9bc6cb52d025e4f8114bf24922a294b49dbebbc9497528ae5
-
Filesize
175KB
MD571be210d2cef8cba16c1a16f77db8a4e
SHA15a019419d3db8e0d5a9dfe25d9a42973473d90b3
SHA25643006bc20df2c1efb5935ce4af6e20d2d7a88cf09c46c33513b58d7c7cce6b56
SHA5126bbe3496ea473d757412bbc81f7b4c3222ad38b3f2ad4a1f4a5e827b66dbe513bde8046dc7ebc3d9bc6cb52d025e4f8114bf24922a294b49dbebbc9497528ae5
-
Filesize
552KB
MD50dad81df77548880cb7a24d54de53cca
SHA179df1ffcce929dfe15c2687daa0c323e08b6165c
SHA256bd65f2bbcd35f7b2568883416aa9a0cc9d582afab8d855fa4d607f492ad9479a
SHA512edd3b0d5d122852b60e8d4c047bc43e8ea5814a616198d1d82eea14297a3d69820a03412b99e3a2123fc2495ce5c89de0aaf0864487047852ce640b0f548f372
-
Filesize
552KB
MD50dad81df77548880cb7a24d54de53cca
SHA179df1ffcce929dfe15c2687daa0c323e08b6165c
SHA256bd65f2bbcd35f7b2568883416aa9a0cc9d582afab8d855fa4d607f492ad9479a
SHA512edd3b0d5d122852b60e8d4c047bc43e8ea5814a616198d1d82eea14297a3d69820a03412b99e3a2123fc2495ce5c89de0aaf0864487047852ce640b0f548f372
-
Filesize
345KB
MD541e4f708e5350e1fb8c16a1ff389b06d
SHA1f344a1bce665f6cd686e2660279c4c05b032b378
SHA256b515f5c4e4446249cfaba72725f76bdf3797d1bac02fc340345a751cd1c5d48e
SHA512e2854ac73cdbb42282b0ed7176a75028ff37b1583736532a0fbe9f11b0bfb4ed8ebfe35b42343917d0a0032f28529d23cdfbad3141667e793de3fed17d87b390
-
Filesize
345KB
MD541e4f708e5350e1fb8c16a1ff389b06d
SHA1f344a1bce665f6cd686e2660279c4c05b032b378
SHA256b515f5c4e4446249cfaba72725f76bdf3797d1bac02fc340345a751cd1c5d48e
SHA512e2854ac73cdbb42282b0ed7176a75028ff37b1583736532a0fbe9f11b0bfb4ed8ebfe35b42343917d0a0032f28529d23cdfbad3141667e793de3fed17d87b390
-
Filesize
403KB
MD50d69f3f53799fc7febb34a626417c8d3
SHA1f23771ec7a1bd2b65fba7377349185b87b812ad4
SHA256583386f50d5979e27a071dffc72a987ca13942de6a04f68caf6473a533a84bb3
SHA5125c36ed1c5df328161c9633def3caba357a99d7d7828016a71f7bbc0be1275ac1fd89130d433f393a95a72329320abcf31420750d8b6f11671ed425d6a673fcfb
-
Filesize
403KB
MD50d69f3f53799fc7febb34a626417c8d3
SHA1f23771ec7a1bd2b65fba7377349185b87b812ad4
SHA256583386f50d5979e27a071dffc72a987ca13942de6a04f68caf6473a533a84bb3
SHA5125c36ed1c5df328161c9633def3caba357a99d7d7828016a71f7bbc0be1275ac1fd89130d433f393a95a72329320abcf31420750d8b6f11671ed425d6a673fcfb
-
Filesize
6.0MB
-
Filesize
1.0MB
-
Filesize
252KB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
64KB
-
Filesize
320KB
-
Filesize
472KB
-
Filesize
64KB
-
Filesize
5.2MB
-
Filesize
1.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
300KB
-
Filesize
252KB
-
Filesize
248KB
-
Filesize
72KB
-
Filesize
252KB
-
Filesize
300KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
280KB
-
Filesize
272KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
200KB
-
Filesize
64KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
39.5MB
-
Filesize
64KB
-
Filesize
96KB
-
Filesize
64KB
-
Filesize
5.0MB
-
Filesize
39.5MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
180KB
-
Filesize
104KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB