Analysis

  • max time kernel
    145s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-03-2023 20:35

General

  • Target

    4d61c2e3f5414c5ad81295eaf2d7857bb5af7c72fd798c8ee707ced2618c8683.exe

  • Size

    672KB

  • MD5

    164c4b69d7d801fdeda54ff2e0d27c9b

  • SHA1

    94c1bae224ea65010376e19c931410e117074f11

  • SHA256

    4d61c2e3f5414c5ad81295eaf2d7857bb5af7c72fd798c8ee707ced2618c8683

  • SHA512

    db80bc25ca33d4d28926303b6b47ac4d201596286d92a015aa957cbea9d0437a4de32e84c6af60460b15412614bdeafc396a08b258bf1a77439778c980e73e77

  • SSDEEP

    12288:0Mruy90FQXEIn928TUCsnE3EDQHCTbfn699Oa7rR3Lq2lUAldyz:KyaIkCsn44/haXR3G2iAvyz

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

spora

C2

176.113.115.145:4125

Attributes
  • auth_value

    441b39ab37774b2ca9931c31e1bc6071

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 18 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4d61c2e3f5414c5ad81295eaf2d7857bb5af7c72fd798c8ee707ced2618c8683.exe
    "C:\Users\Admin\AppData\Local\Temp\4d61c2e3f5414c5ad81295eaf2d7857bb5af7c72fd798c8ee707ced2618c8683.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3040
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un434984.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un434984.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2584
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5071.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5071.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4316
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 1084
          4⤵
          • Program crash
          PID:1680
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3267.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3267.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4868
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 1380
          4⤵
          • Program crash
          PID:1192
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si871085.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si871085.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3608
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4316 -ip 4316
    1⤵
      PID:2060
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4868 -ip 4868
      1⤵
        PID:1480
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe start wuauserv
        1⤵
        • Launches sc.exe
        PID:2500

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Persistence

      Modify Existing Service

      1
      T1031

      Registry Run Keys / Startup Folder

      1
      T1060

      Defense Evasion

      Modify Registry

      3
      T1112

      Disabling Security Tools

      2
      T1089

      Credential Access

      Credentials in Files

      2
      T1081

      Discovery

      Query Registry

      1
      T1012

      Collection

      Data from Local System

      2
      T1005

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si871085.exe
        Filesize

        175KB

        MD5

        589dbc73ab01c33abb13ca1864ec6849

        SHA1

        dc5b5be94fdfaa98f05acd81bb23ecb3736f6894

        SHA256

        91120e339286c976d33c040e8ea7173f7be5bf1f4801a0c92a525aca159afb71

        SHA512

        4974505cf0bdf889c02cc9840040d03c764c18064c8c5f0d9178798f6912d0beced51647aa8aef76efc67c544865fc9f53de9df7b3788e05418a0ed4b46fd67b

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si871085.exe
        Filesize

        175KB

        MD5

        589dbc73ab01c33abb13ca1864ec6849

        SHA1

        dc5b5be94fdfaa98f05acd81bb23ecb3736f6894

        SHA256

        91120e339286c976d33c040e8ea7173f7be5bf1f4801a0c92a525aca159afb71

        SHA512

        4974505cf0bdf889c02cc9840040d03c764c18064c8c5f0d9178798f6912d0beced51647aa8aef76efc67c544865fc9f53de9df7b3788e05418a0ed4b46fd67b

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un434984.exe
        Filesize

        530KB

        MD5

        0093851ca9530cfce9a1c3c08a6611b9

        SHA1

        aadb12ca043634afe113f5d974a04e87f938e368

        SHA256

        69e55d30a4a567ce07c622bb65f9c552dd5a8f38a881c8bbfb812afe666a585b

        SHA512

        e5623d0caf7b196484bb7ffac8b3af01ecbe28656c48fb23c2440eb62aac16b696f7b5c475dc1a10a2d4a1aca34f9d9adb657b83a6d0f206998843125329071f

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un434984.exe
        Filesize

        530KB

        MD5

        0093851ca9530cfce9a1c3c08a6611b9

        SHA1

        aadb12ca043634afe113f5d974a04e87f938e368

        SHA256

        69e55d30a4a567ce07c622bb65f9c552dd5a8f38a881c8bbfb812afe666a585b

        SHA512

        e5623d0caf7b196484bb7ffac8b3af01ecbe28656c48fb23c2440eb62aac16b696f7b5c475dc1a10a2d4a1aca34f9d9adb657b83a6d0f206998843125329071f

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5071.exe
        Filesize

        301KB

        MD5

        8c6276b4c9f35ec93a97518f2315f827

        SHA1

        97e38cb5911ad24bf483009c4c86d799afd9e6e8

        SHA256

        522ce3b35dd77cef260b6796e3a522a5315bd0575960200badb714a36ce2de12

        SHA512

        f4cce77611aeaff5d09fe886c77be2dfe5eafe7b6f329afc0c280d12fdb9f1e1f6e0be5b74a5043c574aec3cfba617b712ae6f1bffd1997d9b8e0f89a6ebbcb9

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5071.exe
        Filesize

        301KB

        MD5

        8c6276b4c9f35ec93a97518f2315f827

        SHA1

        97e38cb5911ad24bf483009c4c86d799afd9e6e8

        SHA256

        522ce3b35dd77cef260b6796e3a522a5315bd0575960200badb714a36ce2de12

        SHA512

        f4cce77611aeaff5d09fe886c77be2dfe5eafe7b6f329afc0c280d12fdb9f1e1f6e0be5b74a5043c574aec3cfba617b712ae6f1bffd1997d9b8e0f89a6ebbcb9

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3267.exe
        Filesize

        359KB

        MD5

        c99279b75be79d7a25f5addce97f1b06

        SHA1

        c91dc9838ac308eea672e485c1b213751f852c03

        SHA256

        dd682a84d28c08c34552141ac28ba823e524a6ab1a3224ab9aef39b7c6843ec7

        SHA512

        a6601e8423f69d43d28a1bb68cfd867021ba8a024ff59d52877e53d81ee8d1a30fba939e7c59cdc633f97364757c499981ef6667ff431bfdb652680ef300634a

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3267.exe
        Filesize

        359KB

        MD5

        c99279b75be79d7a25f5addce97f1b06

        SHA1

        c91dc9838ac308eea672e485c1b213751f852c03

        SHA256

        dd682a84d28c08c34552141ac28ba823e524a6ab1a3224ab9aef39b7c6843ec7

        SHA512

        a6601e8423f69d43d28a1bb68cfd867021ba8a024ff59d52877e53d81ee8d1a30fba939e7c59cdc633f97364757c499981ef6667ff431bfdb652680ef300634a

      • memory/3608-1124-0x0000000005340000-0x0000000005350000-memory.dmp
        Filesize

        64KB

      • memory/3608-1123-0x0000000000A40000-0x0000000000A72000-memory.dmp
        Filesize

        200KB

      • memory/3608-1125-0x0000000005340000-0x0000000005350000-memory.dmp
        Filesize

        64KB

      • memory/4316-162-0x0000000003A90000-0x0000000003AA2000-memory.dmp
        Filesize

        72KB

      • memory/4316-172-0x0000000003A90000-0x0000000003AA2000-memory.dmp
        Filesize

        72KB

      • memory/4316-151-0x0000000003A90000-0x0000000003AA2000-memory.dmp
        Filesize

        72KB

      • memory/4316-155-0x0000000003A90000-0x0000000003AA2000-memory.dmp
        Filesize

        72KB

      • memory/4316-158-0x00000000062D0000-0x00000000062E0000-memory.dmp
        Filesize

        64KB

      • memory/4316-157-0x0000000003A90000-0x0000000003AA2000-memory.dmp
        Filesize

        72KB

      • memory/4316-159-0x00000000062D0000-0x00000000062E0000-memory.dmp
        Filesize

        64KB

      • memory/4316-150-0x0000000003A90000-0x0000000003AA2000-memory.dmp
        Filesize

        72KB

      • memory/4316-161-0x00000000062D0000-0x00000000062E0000-memory.dmp
        Filesize

        64KB

      • memory/4316-164-0x0000000003A90000-0x0000000003AA2000-memory.dmp
        Filesize

        72KB

      • memory/4316-166-0x0000000003A90000-0x0000000003AA2000-memory.dmp
        Filesize

        72KB

      • memory/4316-168-0x0000000003A90000-0x0000000003AA2000-memory.dmp
        Filesize

        72KB

      • memory/4316-170-0x0000000003A90000-0x0000000003AA2000-memory.dmp
        Filesize

        72KB

      • memory/4316-153-0x0000000003A90000-0x0000000003AA2000-memory.dmp
        Filesize

        72KB

      • memory/4316-174-0x0000000003A90000-0x0000000003AA2000-memory.dmp
        Filesize

        72KB

      • memory/4316-176-0x0000000003A90000-0x0000000003AA2000-memory.dmp
        Filesize

        72KB

      • memory/4316-178-0x0000000003A90000-0x0000000003AA2000-memory.dmp
        Filesize

        72KB

      • memory/4316-180-0x0000000003A90000-0x0000000003AA2000-memory.dmp
        Filesize

        72KB

      • memory/4316-181-0x0000000000400000-0x0000000001AE3000-memory.dmp
        Filesize

        22.9MB

      • memory/4316-182-0x0000000001C40000-0x0000000001C6D000-memory.dmp
        Filesize

        180KB

      • memory/4316-183-0x00000000062D0000-0x00000000062E0000-memory.dmp
        Filesize

        64KB

      • memory/4316-184-0x00000000062D0000-0x00000000062E0000-memory.dmp
        Filesize

        64KB

      • memory/4316-185-0x00000000062D0000-0x00000000062E0000-memory.dmp
        Filesize

        64KB

      • memory/4316-187-0x0000000000400000-0x0000000001AE3000-memory.dmp
        Filesize

        22.9MB

      • memory/4316-149-0x00000000062E0000-0x0000000006884000-memory.dmp
        Filesize

        5.6MB

      • memory/4316-148-0x0000000001C40000-0x0000000001C6D000-memory.dmp
        Filesize

        180KB

      • memory/4868-193-0x0000000003B50000-0x0000000003B8F000-memory.dmp
        Filesize

        252KB

      • memory/4868-197-0x0000000006410000-0x0000000006420000-memory.dmp
        Filesize

        64KB

      • memory/4868-199-0x0000000006410000-0x0000000006420000-memory.dmp
        Filesize

        64KB

      • memory/4868-203-0x0000000003B50000-0x0000000003B8F000-memory.dmp
        Filesize

        252KB

      • memory/4868-201-0x0000000003B50000-0x0000000003B8F000-memory.dmp
        Filesize

        252KB

      • memory/4868-198-0x0000000003B50000-0x0000000003B8F000-memory.dmp
        Filesize

        252KB

      • memory/4868-194-0x0000000006410000-0x0000000006420000-memory.dmp
        Filesize

        64KB

      • memory/4868-205-0x0000000003B50000-0x0000000003B8F000-memory.dmp
        Filesize

        252KB

      • memory/4868-207-0x0000000003B50000-0x0000000003B8F000-memory.dmp
        Filesize

        252KB

      • memory/4868-209-0x0000000003B50000-0x0000000003B8F000-memory.dmp
        Filesize

        252KB

      • memory/4868-211-0x0000000003B50000-0x0000000003B8F000-memory.dmp
        Filesize

        252KB

      • memory/4868-213-0x0000000003B50000-0x0000000003B8F000-memory.dmp
        Filesize

        252KB

      • memory/4868-215-0x0000000003B50000-0x0000000003B8F000-memory.dmp
        Filesize

        252KB

      • memory/4868-217-0x0000000003B50000-0x0000000003B8F000-memory.dmp
        Filesize

        252KB

      • memory/4868-219-0x0000000003B50000-0x0000000003B8F000-memory.dmp
        Filesize

        252KB

      • memory/4868-221-0x0000000003B50000-0x0000000003B8F000-memory.dmp
        Filesize

        252KB

      • memory/4868-223-0x0000000003B50000-0x0000000003B8F000-memory.dmp
        Filesize

        252KB

      • memory/4868-225-0x0000000003B50000-0x0000000003B8F000-memory.dmp
        Filesize

        252KB

      • memory/4868-227-0x0000000003B50000-0x0000000003B8F000-memory.dmp
        Filesize

        252KB

      • memory/4868-229-0x0000000003B50000-0x0000000003B8F000-memory.dmp
        Filesize

        252KB

      • memory/4868-1102-0x00000000069D0000-0x0000000006FE8000-memory.dmp
        Filesize

        6.1MB

      • memory/4868-1103-0x0000000006FF0000-0x00000000070FA000-memory.dmp
        Filesize

        1.0MB

      • memory/4868-1104-0x0000000003CE0000-0x0000000003CF2000-memory.dmp
        Filesize

        72KB

      • memory/4868-1105-0x0000000006360000-0x000000000639C000-memory.dmp
        Filesize

        240KB

      • memory/4868-1106-0x0000000006410000-0x0000000006420000-memory.dmp
        Filesize

        64KB

      • memory/4868-1107-0x0000000007330000-0x0000000007396000-memory.dmp
        Filesize

        408KB

      • memory/4868-1109-0x00000000079F0000-0x0000000007A82000-memory.dmp
        Filesize

        584KB

      • memory/4868-1110-0x0000000006410000-0x0000000006420000-memory.dmp
        Filesize

        64KB

      • memory/4868-1111-0x0000000006410000-0x0000000006420000-memory.dmp
        Filesize

        64KB

      • memory/4868-1112-0x0000000006410000-0x0000000006420000-memory.dmp
        Filesize

        64KB

      • memory/4868-1113-0x0000000007D40000-0x0000000007DB6000-memory.dmp
        Filesize

        472KB

      • memory/4868-1114-0x0000000007DC0000-0x0000000007E10000-memory.dmp
        Filesize

        320KB

      • memory/4868-195-0x0000000003B50000-0x0000000003B8F000-memory.dmp
        Filesize

        252KB

      • memory/4868-192-0x0000000003670000-0x00000000036BB000-memory.dmp
        Filesize

        300KB

      • memory/4868-1115-0x0000000007E30000-0x0000000007FF2000-memory.dmp
        Filesize

        1.8MB

      • memory/4868-1116-0x0000000006410000-0x0000000006420000-memory.dmp
        Filesize

        64KB

      • memory/4868-1117-0x0000000008000000-0x000000000852C000-memory.dmp
        Filesize

        5.2MB