Analysis

  • max time kernel
    135s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-03-2023 20:38

General

  • Target

    b7c225f0e3d4554ab6476899c3ae44280dd839f44f1e8bf5881219326393c355.exe

  • Size

    671KB

  • MD5

    3e8672c566fc3386c3ac1a4776e2aff9

  • SHA1

    24fd46de105dbf442e8ee2afddb8dd7178fcc661

  • SHA256

    b7c225f0e3d4554ab6476899c3ae44280dd839f44f1e8bf5881219326393c355

  • SHA512

    53da3dc3f8846d39d3737d66b4f757787fb341e69d49311feaaacf36279cc13ac59b004c5522416e689ca978fa0fa1796fcf326e9fa61d78339c9913827e05d2

  • SSDEEP

    12288:dMrEy90+jf2MQY0uprU/GZDAJK7X225A50fgVkkL6VZxnxhKRnX73LqfsVjJAF8:RyHmgU/GlNX225A50fb46VZxCxX73GfM

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

spora

C2

176.113.115.145:4125

Attributes
  • auth_value

    441b39ab37774b2ca9931c31e1bc6071

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 19 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b7c225f0e3d4554ab6476899c3ae44280dd839f44f1e8bf5881219326393c355.exe
    "C:\Users\Admin\AppData\Local\Temp\b7c225f0e3d4554ab6476899c3ae44280dd839f44f1e8bf5881219326393c355.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1428
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un546408.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un546408.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1068
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1318.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1318.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1104
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 1084
          4⤵
          • Program crash
          PID:3572
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9080.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9080.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:232
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 232 -s 1928
          4⤵
          • Program crash
          PID:744
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si505126.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si505126.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:992
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1104 -ip 1104
    1⤵
      PID:4216
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 232 -ip 232
      1⤵
        PID:1708

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Persistence

      Modify Existing Service

      1
      T1031

      Registry Run Keys / Startup Folder

      1
      T1060

      Defense Evasion

      Modify Registry

      3
      T1112

      Disabling Security Tools

      2
      T1089

      Credential Access

      Credentials in Files

      2
      T1081

      Discovery

      Query Registry

      1
      T1012

      Collection

      Data from Local System

      2
      T1005

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si505126.exe
        Filesize

        175KB

        MD5

        cf0996241a9dc0fa19bd43977d4fd0c3

        SHA1

        93bda3b40dc24362e01f0b764b1b60564d710df1

        SHA256

        0adefe49611e8c4349a3ffd17b4bbc1147a1e883b94ce07265d7ad4d12db292c

        SHA512

        b3b16a6740d633d9c8b0b910cb1b405dec59c1fcdb5c9c86beb3087e2da977656260775f3293a9829e7085258b01e772a9cc65de05f6dd95e8d269afbc17ea1d

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si505126.exe
        Filesize

        175KB

        MD5

        cf0996241a9dc0fa19bd43977d4fd0c3

        SHA1

        93bda3b40dc24362e01f0b764b1b60564d710df1

        SHA256

        0adefe49611e8c4349a3ffd17b4bbc1147a1e883b94ce07265d7ad4d12db292c

        SHA512

        b3b16a6740d633d9c8b0b910cb1b405dec59c1fcdb5c9c86beb3087e2da977656260775f3293a9829e7085258b01e772a9cc65de05f6dd95e8d269afbc17ea1d

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un546408.exe
        Filesize

        529KB

        MD5

        f2c18edda02739aff983b2209e38fe82

        SHA1

        a209e6beb9f99594fd14c8b411fb251fcee0fc49

        SHA256

        635384a09b68cb3f216ed7d0fd86fbd426b563f4c74a9b29f2f2212b7cd3ed8f

        SHA512

        eabc20483c6531a6688f51ac88da7ed71473a3abfc63cca0495192ad80dc974fa047087bc8d92903ec9ff4eee3d84708a08ea0799a0539cc9cb3f6c43c7606fc

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un546408.exe
        Filesize

        529KB

        MD5

        f2c18edda02739aff983b2209e38fe82

        SHA1

        a209e6beb9f99594fd14c8b411fb251fcee0fc49

        SHA256

        635384a09b68cb3f216ed7d0fd86fbd426b563f4c74a9b29f2f2212b7cd3ed8f

        SHA512

        eabc20483c6531a6688f51ac88da7ed71473a3abfc63cca0495192ad80dc974fa047087bc8d92903ec9ff4eee3d84708a08ea0799a0539cc9cb3f6c43c7606fc

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1318.exe
        Filesize

        301KB

        MD5

        2b968ec62c2d85c7f558bc9d0006d41f

        SHA1

        067096d49c4a53bbf13307387324c235e4cfe672

        SHA256

        d18d4b912061331ce8e685ccda28f9287e39a038db07812c26ba525546479a41

        SHA512

        44adbed69bc58f291b84bfb53be7d96d08730fa0d2cab46d315b29da54c1c0986ef240c58867436f834acc8c27d6cd130d4815e342df3609c699b5569016f853

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1318.exe
        Filesize

        301KB

        MD5

        2b968ec62c2d85c7f558bc9d0006d41f

        SHA1

        067096d49c4a53bbf13307387324c235e4cfe672

        SHA256

        d18d4b912061331ce8e685ccda28f9287e39a038db07812c26ba525546479a41

        SHA512

        44adbed69bc58f291b84bfb53be7d96d08730fa0d2cab46d315b29da54c1c0986ef240c58867436f834acc8c27d6cd130d4815e342df3609c699b5569016f853

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9080.exe
        Filesize

        359KB

        MD5

        cd9b8fd8b703c7ed673e2a23f6ffa136

        SHA1

        c3f4d8466f450f9f8de76da9163b57a7f706b2a0

        SHA256

        03466228adb715901d8860585783f551d781d84173850726344a58755e2506e0

        SHA512

        66aa74b4989f6a8b43ffb09034926765cb321937e53d8ad6b61398fab81bcb067b6e26b7cdeae8f984c8bdbf14ec5ada1a5e575b7a1fbaf995db2edc5b482a0e

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9080.exe
        Filesize

        359KB

        MD5

        cd9b8fd8b703c7ed673e2a23f6ffa136

        SHA1

        c3f4d8466f450f9f8de76da9163b57a7f706b2a0

        SHA256

        03466228adb715901d8860585783f551d781d84173850726344a58755e2506e0

        SHA512

        66aa74b4989f6a8b43ffb09034926765cb321937e53d8ad6b61398fab81bcb067b6e26b7cdeae8f984c8bdbf14ec5ada1a5e575b7a1fbaf995db2edc5b482a0e

      • memory/232-227-0x00000000060A0000-0x00000000060DF000-memory.dmp
        Filesize

        252KB

      • memory/232-1102-0x0000000006EE0000-0x0000000006EF2000-memory.dmp
        Filesize

        72KB

      • memory/232-1115-0x0000000008380000-0x00000000083D0000-memory.dmp
        Filesize

        320KB

      • memory/232-1114-0x00000000082F0000-0x0000000008366000-memory.dmp
        Filesize

        472KB

      • memory/232-1113-0x0000000006130000-0x0000000006140000-memory.dmp
        Filesize

        64KB

      • memory/232-1112-0x0000000007C90000-0x00000000081BC000-memory.dmp
        Filesize

        5.2MB

      • memory/232-1111-0x0000000007AB0000-0x0000000007C72000-memory.dmp
        Filesize

        1.8MB

      • memory/232-1110-0x0000000006130000-0x0000000006140000-memory.dmp
        Filesize

        64KB

      • memory/232-1109-0x0000000006130000-0x0000000006140000-memory.dmp
        Filesize

        64KB

      • memory/232-1108-0x0000000006130000-0x0000000006140000-memory.dmp
        Filesize

        64KB

      • memory/232-1107-0x0000000007290000-0x00000000072F6000-memory.dmp
        Filesize

        408KB

      • memory/232-1106-0x00000000071F0000-0x0000000007282000-memory.dmp
        Filesize

        584KB

      • memory/232-1104-0x0000000006130000-0x0000000006140000-memory.dmp
        Filesize

        64KB

      • memory/232-1103-0x0000000006F00000-0x0000000006F3C000-memory.dmp
        Filesize

        240KB

      • memory/232-1101-0x0000000006DA0000-0x0000000006EAA000-memory.dmp
        Filesize

        1.0MB

      • memory/232-1100-0x0000000006700000-0x0000000006D18000-memory.dmp
        Filesize

        6.1MB

      • memory/232-225-0x00000000060A0000-0x00000000060DF000-memory.dmp
        Filesize

        252KB

      • memory/232-223-0x00000000060A0000-0x00000000060DF000-memory.dmp
        Filesize

        252KB

      • memory/232-221-0x00000000060A0000-0x00000000060DF000-memory.dmp
        Filesize

        252KB

      • memory/232-219-0x00000000060A0000-0x00000000060DF000-memory.dmp
        Filesize

        252KB

      • memory/232-217-0x00000000060A0000-0x00000000060DF000-memory.dmp
        Filesize

        252KB

      • memory/232-216-0x0000000006130000-0x0000000006140000-memory.dmp
        Filesize

        64KB

      • memory/232-190-0x00000000060A0000-0x00000000060DF000-memory.dmp
        Filesize

        252KB

      • memory/232-191-0x00000000060A0000-0x00000000060DF000-memory.dmp
        Filesize

        252KB

      • memory/232-193-0x00000000060A0000-0x00000000060DF000-memory.dmp
        Filesize

        252KB

      • memory/232-195-0x00000000060A0000-0x00000000060DF000-memory.dmp
        Filesize

        252KB

      • memory/232-197-0x00000000060A0000-0x00000000060DF000-memory.dmp
        Filesize

        252KB

      • memory/232-199-0x00000000060A0000-0x00000000060DF000-memory.dmp
        Filesize

        252KB

      • memory/232-201-0x00000000060A0000-0x00000000060DF000-memory.dmp
        Filesize

        252KB

      • memory/232-203-0x00000000060A0000-0x00000000060DF000-memory.dmp
        Filesize

        252KB

      • memory/232-205-0x00000000060A0000-0x00000000060DF000-memory.dmp
        Filesize

        252KB

      • memory/232-207-0x00000000060A0000-0x00000000060DF000-memory.dmp
        Filesize

        252KB

      • memory/232-209-0x0000000003730000-0x000000000377B000-memory.dmp
        Filesize

        300KB

      • memory/232-210-0x00000000060A0000-0x00000000060DF000-memory.dmp
        Filesize

        252KB

      • memory/232-212-0x0000000006130000-0x0000000006140000-memory.dmp
        Filesize

        64KB

      • memory/232-213-0x00000000060A0000-0x00000000060DF000-memory.dmp
        Filesize

        252KB

      • memory/232-214-0x0000000006130000-0x0000000006140000-memory.dmp
        Filesize

        64KB

      • memory/992-1121-0x00000000008D0000-0x0000000000902000-memory.dmp
        Filesize

        200KB

      • memory/992-1122-0x0000000005230000-0x0000000005240000-memory.dmp
        Filesize

        64KB

      • memory/1104-174-0x0000000003A40000-0x0000000003A52000-memory.dmp
        Filesize

        72KB

      • memory/1104-148-0x0000000001C80000-0x0000000001CAD000-memory.dmp
        Filesize

        180KB

      • memory/1104-183-0x00000000062F0000-0x0000000006300000-memory.dmp
        Filesize

        64KB

      • memory/1104-181-0x0000000000400000-0x0000000001AE3000-memory.dmp
        Filesize

        22.9MB

      • memory/1104-150-0x0000000006300000-0x00000000068A4000-memory.dmp
        Filesize

        5.6MB

      • memory/1104-180-0x00000000062F0000-0x0000000006300000-memory.dmp
        Filesize

        64KB

      • memory/1104-179-0x00000000062F0000-0x0000000006300000-memory.dmp
        Filesize

        64KB

      • memory/1104-154-0x0000000003A40000-0x0000000003A52000-memory.dmp
        Filesize

        72KB

      • memory/1104-178-0x0000000003A40000-0x0000000003A52000-memory.dmp
        Filesize

        72KB

      • memory/1104-176-0x0000000003A40000-0x0000000003A52000-memory.dmp
        Filesize

        72KB

      • memory/1104-152-0x0000000003A40000-0x0000000003A52000-memory.dmp
        Filesize

        72KB

      • memory/1104-184-0x00000000062F0000-0x0000000006300000-memory.dmp
        Filesize

        64KB

      • memory/1104-166-0x0000000003A40000-0x0000000003A52000-memory.dmp
        Filesize

        72KB

      • memory/1104-168-0x0000000003A40000-0x0000000003A52000-memory.dmp
        Filesize

        72KB

      • memory/1104-170-0x0000000003A40000-0x0000000003A52000-memory.dmp
        Filesize

        72KB

      • memory/1104-164-0x0000000003A40000-0x0000000003A52000-memory.dmp
        Filesize

        72KB

      • memory/1104-162-0x0000000003A40000-0x0000000003A52000-memory.dmp
        Filesize

        72KB

      • memory/1104-160-0x0000000003A40000-0x0000000003A52000-memory.dmp
        Filesize

        72KB

      • memory/1104-158-0x0000000003A40000-0x0000000003A52000-memory.dmp
        Filesize

        72KB

      • memory/1104-156-0x0000000003A40000-0x0000000003A52000-memory.dmp
        Filesize

        72KB

      • memory/1104-149-0x00000000062F0000-0x0000000006300000-memory.dmp
        Filesize

        64KB

      • memory/1104-172-0x0000000003A40000-0x0000000003A52000-memory.dmp
        Filesize

        72KB

      • memory/1104-185-0x0000000000400000-0x0000000001AE3000-memory.dmp
        Filesize

        22.9MB

      • memory/1104-151-0x0000000003A40000-0x0000000003A52000-memory.dmp
        Filesize

        72KB