Analysis

  • max time kernel
    117s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-03-2023 20:45

General

  • Target

    5d48166a05928ad74625ecfc9a4a06896bd86fd3699f99b34633249a0828ce9f.exe

  • Size

    534KB

  • MD5

    8a0cda156646143044756cfd48b991af

  • SHA1

    7281c772e7a2f235b9ff7448d139b9c5503fb7e0

  • SHA256

    5d48166a05928ad74625ecfc9a4a06896bd86fd3699f99b34633249a0828ce9f

  • SHA512

    ec323e6e85c0a8958ddfdc54b7d408c9bf8d72242b8e4a0d5617b5820b9e9c7a15d50481d4c97081839c0b2651c7aaf21217d96b38dec2dc7fce96e11d2c4dd9

  • SSDEEP

    12288:VMr8y905SWEYtCSZVHAxUDJsY43LqKeRPSMM4Tms:pyIgSZVH1CY43GTRzp

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

spora

C2

176.113.115.145:4125

Attributes
  • auth_value

    441b39ab37774b2ca9931c31e1bc6071

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 33 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5d48166a05928ad74625ecfc9a4a06896bd86fd3699f99b34633249a0828ce9f.exe
    "C:\Users\Admin\AppData\Local\Temp\5d48166a05928ad74625ecfc9a4a06896bd86fd3699f99b34633249a0828ce9f.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4508
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziGw6184.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziGw6184.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3096
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr214516.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr214516.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1896
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku673959.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku673959.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:804
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 1752
          4⤵
          • Program crash
          PID:2872
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr719554.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr719554.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4404
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 804 -ip 804
    1⤵
      PID:1552

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Modify Existing Service

    1
    T1031

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    3
    T1112

    Disabling Security Tools

    2
    T1089

    Credential Access

    Credentials in Files

    2
    T1081

    Discovery

    Query Registry

    1
    T1012

    Collection

    Data from Local System

    2
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr719554.exe
      Filesize

      175KB

      MD5

      6d64dc29cba44df3ac3725a7fe71c04e

      SHA1

      1ceea91639b05fe3c3ae8d85cfe2425533fad7a3

      SHA256

      d27d84976d40ba2a118392465bba54c137dea18a7ea4ce664cda728e24522212

      SHA512

      4728296a94c653a142d1e56b982a456d21895890121032a65f0d8cb499fad9aadb8d13a38357bb7e325814fa783612cd36a824919caa6d0e2ff9d474cbfd78f9

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr719554.exe
      Filesize

      175KB

      MD5

      6d64dc29cba44df3ac3725a7fe71c04e

      SHA1

      1ceea91639b05fe3c3ae8d85cfe2425533fad7a3

      SHA256

      d27d84976d40ba2a118392465bba54c137dea18a7ea4ce664cda728e24522212

      SHA512

      4728296a94c653a142d1e56b982a456d21895890121032a65f0d8cb499fad9aadb8d13a38357bb7e325814fa783612cd36a824919caa6d0e2ff9d474cbfd78f9

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziGw6184.exe
      Filesize

      391KB

      MD5

      7b6a3d976ddcb89d336f9fa2b7159fe1

      SHA1

      527133f3a6c869b6816296b1a37e8990029087d9

      SHA256

      e3649ce775782cc95f9263f452484714b352ba376d5174f7101b076e0f5401f9

      SHA512

      73f70e2aacdd5d816cec6ab52fda1edb480c82271cdc641bf21d7f3ac608f06d885ffbd0ea4413aebbf873b1b28ba857818f5b63bd6cbcb787ac67459ea413b1

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziGw6184.exe
      Filesize

      391KB

      MD5

      7b6a3d976ddcb89d336f9fa2b7159fe1

      SHA1

      527133f3a6c869b6816296b1a37e8990029087d9

      SHA256

      e3649ce775782cc95f9263f452484714b352ba376d5174f7101b076e0f5401f9

      SHA512

      73f70e2aacdd5d816cec6ab52fda1edb480c82271cdc641bf21d7f3ac608f06d885ffbd0ea4413aebbf873b1b28ba857818f5b63bd6cbcb787ac67459ea413b1

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr214516.exe
      Filesize

      11KB

      MD5

      24ad6a411edb549f724649d0966b6be7

      SHA1

      767266eec600afcaeece76682b6655c329bf0347

      SHA256

      82d65c0f238c9df18dc07a750a02f08dc6699024431e9e33d4b635010f2269af

      SHA512

      3949a62dcf7e162dfb5f6272ea35fe7c937e3b7c3f06e046331ca761fd0691057fc1e6632aa0d6dabd45bf09fedfe9aa3edcf78ad2ce0ef34cdde07e1ddecf09

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr214516.exe
      Filesize

      11KB

      MD5

      24ad6a411edb549f724649d0966b6be7

      SHA1

      767266eec600afcaeece76682b6655c329bf0347

      SHA256

      82d65c0f238c9df18dc07a750a02f08dc6699024431e9e33d4b635010f2269af

      SHA512

      3949a62dcf7e162dfb5f6272ea35fe7c937e3b7c3f06e046331ca761fd0691057fc1e6632aa0d6dabd45bf09fedfe9aa3edcf78ad2ce0ef34cdde07e1ddecf09

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku673959.exe
      Filesize

      359KB

      MD5

      5c71abcf0810bc61e6c9a15617ff1c8f

      SHA1

      998a2f6626760c715f26e4cff7185b3ca47a0471

      SHA256

      71b7f85c8481979487f2e5c001df9b1649b5ac43dd2c8d4ca5833fc08efdf4c8

      SHA512

      75b5bffd28865abc154028cd8bf8e36c6f1425bb08fb8cbf6b7a66f8a42bb5e2acf24bd6b18ddcdcdcdc0844667f53f0f47181a63e507bc121f36a07cc6581fe

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku673959.exe
      Filesize

      359KB

      MD5

      5c71abcf0810bc61e6c9a15617ff1c8f

      SHA1

      998a2f6626760c715f26e4cff7185b3ca47a0471

      SHA256

      71b7f85c8481979487f2e5c001df9b1649b5ac43dd2c8d4ca5833fc08efdf4c8

      SHA512

      75b5bffd28865abc154028cd8bf8e36c6f1425bb08fb8cbf6b7a66f8a42bb5e2acf24bd6b18ddcdcdcdc0844667f53f0f47181a63e507bc121f36a07cc6581fe

    • memory/804-153-0x00000000062E0000-0x0000000006884000-memory.dmp
      Filesize

      5.6MB

    • memory/804-154-0x0000000003710000-0x000000000375B000-memory.dmp
      Filesize

      300KB

    • memory/804-156-0x00000000062D0000-0x00000000062E0000-memory.dmp
      Filesize

      64KB

    • memory/804-155-0x00000000062D0000-0x00000000062E0000-memory.dmp
      Filesize

      64KB

    • memory/804-157-0x00000000062D0000-0x00000000062E0000-memory.dmp
      Filesize

      64KB

    • memory/804-158-0x00000000060F0000-0x000000000612F000-memory.dmp
      Filesize

      252KB

    • memory/804-159-0x00000000060F0000-0x000000000612F000-memory.dmp
      Filesize

      252KB

    • memory/804-161-0x00000000060F0000-0x000000000612F000-memory.dmp
      Filesize

      252KB

    • memory/804-163-0x00000000060F0000-0x000000000612F000-memory.dmp
      Filesize

      252KB

    • memory/804-165-0x00000000060F0000-0x000000000612F000-memory.dmp
      Filesize

      252KB

    • memory/804-167-0x00000000060F0000-0x000000000612F000-memory.dmp
      Filesize

      252KB

    • memory/804-169-0x00000000060F0000-0x000000000612F000-memory.dmp
      Filesize

      252KB

    • memory/804-171-0x00000000060F0000-0x000000000612F000-memory.dmp
      Filesize

      252KB

    • memory/804-173-0x00000000060F0000-0x000000000612F000-memory.dmp
      Filesize

      252KB

    • memory/804-175-0x00000000060F0000-0x000000000612F000-memory.dmp
      Filesize

      252KB

    • memory/804-177-0x00000000060F0000-0x000000000612F000-memory.dmp
      Filesize

      252KB

    • memory/804-179-0x00000000060F0000-0x000000000612F000-memory.dmp
      Filesize

      252KB

    • memory/804-181-0x00000000060F0000-0x000000000612F000-memory.dmp
      Filesize

      252KB

    • memory/804-183-0x00000000060F0000-0x000000000612F000-memory.dmp
      Filesize

      252KB

    • memory/804-185-0x00000000060F0000-0x000000000612F000-memory.dmp
      Filesize

      252KB

    • memory/804-187-0x00000000060F0000-0x000000000612F000-memory.dmp
      Filesize

      252KB

    • memory/804-189-0x00000000060F0000-0x000000000612F000-memory.dmp
      Filesize

      252KB

    • memory/804-191-0x00000000060F0000-0x000000000612F000-memory.dmp
      Filesize

      252KB

    • memory/804-193-0x00000000060F0000-0x000000000612F000-memory.dmp
      Filesize

      252KB

    • memory/804-195-0x00000000060F0000-0x000000000612F000-memory.dmp
      Filesize

      252KB

    • memory/804-197-0x00000000060F0000-0x000000000612F000-memory.dmp
      Filesize

      252KB

    • memory/804-199-0x00000000060F0000-0x000000000612F000-memory.dmp
      Filesize

      252KB

    • memory/804-201-0x00000000060F0000-0x000000000612F000-memory.dmp
      Filesize

      252KB

    • memory/804-203-0x00000000060F0000-0x000000000612F000-memory.dmp
      Filesize

      252KB

    • memory/804-207-0x00000000060F0000-0x000000000612F000-memory.dmp
      Filesize

      252KB

    • memory/804-205-0x00000000060F0000-0x000000000612F000-memory.dmp
      Filesize

      252KB

    • memory/804-209-0x00000000060F0000-0x000000000612F000-memory.dmp
      Filesize

      252KB

    • memory/804-211-0x00000000060F0000-0x000000000612F000-memory.dmp
      Filesize

      252KB

    • memory/804-213-0x00000000060F0000-0x000000000612F000-memory.dmp
      Filesize

      252KB

    • memory/804-215-0x00000000060F0000-0x000000000612F000-memory.dmp
      Filesize

      252KB

    • memory/804-217-0x00000000060F0000-0x000000000612F000-memory.dmp
      Filesize

      252KB

    • memory/804-219-0x00000000060F0000-0x000000000612F000-memory.dmp
      Filesize

      252KB

    • memory/804-221-0x00000000060F0000-0x000000000612F000-memory.dmp
      Filesize

      252KB

    • memory/804-1064-0x0000000006890000-0x0000000006EA8000-memory.dmp
      Filesize

      6.1MB

    • memory/804-1065-0x0000000006EE0000-0x0000000006FEA000-memory.dmp
      Filesize

      1.0MB

    • memory/804-1066-0x0000000007020000-0x0000000007032000-memory.dmp
      Filesize

      72KB

    • memory/804-1068-0x00000000062D0000-0x00000000062E0000-memory.dmp
      Filesize

      64KB

    • memory/804-1067-0x0000000007040000-0x000000000707C000-memory.dmp
      Filesize

      240KB

    • memory/804-1070-0x0000000007330000-0x00000000073C2000-memory.dmp
      Filesize

      584KB

    • memory/804-1071-0x00000000062D0000-0x00000000062E0000-memory.dmp
      Filesize

      64KB

    • memory/804-1072-0x00000000062D0000-0x00000000062E0000-memory.dmp
      Filesize

      64KB

    • memory/804-1073-0x00000000062D0000-0x00000000062E0000-memory.dmp
      Filesize

      64KB

    • memory/804-1074-0x00000000073D0000-0x0000000007436000-memory.dmp
      Filesize

      408KB

    • memory/804-1075-0x0000000007BD0000-0x0000000007C46000-memory.dmp
      Filesize

      472KB

    • memory/804-1076-0x0000000007C60000-0x0000000007CB0000-memory.dmp
      Filesize

      320KB

    • memory/804-1077-0x0000000007CE0000-0x0000000007EA2000-memory.dmp
      Filesize

      1.8MB

    • memory/804-1078-0x0000000007EB0000-0x00000000083DC000-memory.dmp
      Filesize

      5.2MB

    • memory/804-1079-0x00000000062D0000-0x00000000062E0000-memory.dmp
      Filesize

      64KB

    • memory/1896-147-0x00000000009E0000-0x00000000009EA000-memory.dmp
      Filesize

      40KB

    • memory/4404-1086-0x0000000000B30000-0x0000000000B62000-memory.dmp
      Filesize

      200KB

    • memory/4404-1087-0x00000000058E0000-0x00000000058F0000-memory.dmp
      Filesize

      64KB

    • memory/4404-1088-0x00000000058E0000-0x00000000058F0000-memory.dmp
      Filesize

      64KB