Analysis

  • max time kernel
    54s
  • max time network
    72s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    31-03-2023 20:48

General

  • Target

    a97c776b2f9a11a6a840b11566eb14fc6f4f3591762b1a996642788c8dc19bd6.exe

  • Size

    672KB

  • MD5

    af8ad7dc44bad7be7894f36f84ce9332

  • SHA1

    47bc9ecf65b8213a5aac0e12804a1062b6569e7c

  • SHA256

    a97c776b2f9a11a6a840b11566eb14fc6f4f3591762b1a996642788c8dc19bd6

  • SHA512

    52fc376e24bdc1e61e764656202ad79efbe4aecbeab4da6d13571a246477e7e37292ed0e2e097071d72779eb6eabc8e9f1604c298c05a311cc7a574d555a794f

  • SSDEEP

    12288:sMrMy90YGVnGtNgHtGQnk4JaHKx1qp8xKVd3LqaJx9s/527DarVGDB:4yntcDkX+q8ed3GaJxO8vPDB

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

spora

C2

176.113.115.145:4125

Attributes
  • auth_value

    441b39ab37774b2ca9931c31e1bc6071

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 21 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a97c776b2f9a11a6a840b11566eb14fc6f4f3591762b1a996642788c8dc19bd6.exe
    "C:\Users\Admin\AppData\Local\Temp\a97c776b2f9a11a6a840b11566eb14fc6f4f3591762b1a996642788c8dc19bd6.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1596
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un222484.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un222484.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:364
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5962.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5962.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3504
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1581.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1581.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4732
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si583401.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si583401.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4816

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

3
T1112

Disabling Security Tools

2
T1089

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si583401.exe
    Filesize

    175KB

    MD5

    3df95578fc2f6f109a10f3a806fdf62b

    SHA1

    e3736cd1fd792bfcee7e0dd9639eb07676d96b4e

    SHA256

    640227a96e94c25217afb8834bb391546ddde1022b55265087ca3539705ce766

    SHA512

    488f3cc6207a1bd259947436a1f09dcb4256cb93b23c2a5f13c8f832d2717c8a6986490cfd4806aae69f7303060d302bd0b838fafee467696af8f2eb2b5d4d01

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si583401.exe
    Filesize

    175KB

    MD5

    3df95578fc2f6f109a10f3a806fdf62b

    SHA1

    e3736cd1fd792bfcee7e0dd9639eb07676d96b4e

    SHA256

    640227a96e94c25217afb8834bb391546ddde1022b55265087ca3539705ce766

    SHA512

    488f3cc6207a1bd259947436a1f09dcb4256cb93b23c2a5f13c8f832d2717c8a6986490cfd4806aae69f7303060d302bd0b838fafee467696af8f2eb2b5d4d01

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un222484.exe
    Filesize

    530KB

    MD5

    b6bd54771d2feb5d83ee728f6f6ecb85

    SHA1

    fa56da698171ca6a73f89670a2914d93b42c227f

    SHA256

    cee830478546fdacc69964843839d6e9bbf0869e5cd7cf1425a4f2a00a5b4b11

    SHA512

    1a1746b4d6a4b7bfebad936dc1d1ecb03b85be0f9ddba4552f3ac929fd811761c7a3c3b379d7eb250980a9173f2cb4dee7b379826e033de1e4eed45927c1fbcf

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un222484.exe
    Filesize

    530KB

    MD5

    b6bd54771d2feb5d83ee728f6f6ecb85

    SHA1

    fa56da698171ca6a73f89670a2914d93b42c227f

    SHA256

    cee830478546fdacc69964843839d6e9bbf0869e5cd7cf1425a4f2a00a5b4b11

    SHA512

    1a1746b4d6a4b7bfebad936dc1d1ecb03b85be0f9ddba4552f3ac929fd811761c7a3c3b379d7eb250980a9173f2cb4dee7b379826e033de1e4eed45927c1fbcf

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5962.exe
    Filesize

    301KB

    MD5

    30a07069423c84adcd565156c92edf64

    SHA1

    fa4c2173a7aebfd1fab7410b0eaa2e1d85b5f65b

    SHA256

    74331f5ad8d8cc1825edc3ea554dd682f0584371cafa11db3a3924a572a5e758

    SHA512

    a3a2e43190a089cc23d82c41474eb93e228ca078f5015e24d1c60ce57b0e5caf11611420dd2959757156771e06a4043cd4588a6fd6cd64c7f804bf45515f831b

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5962.exe
    Filesize

    301KB

    MD5

    30a07069423c84adcd565156c92edf64

    SHA1

    fa4c2173a7aebfd1fab7410b0eaa2e1d85b5f65b

    SHA256

    74331f5ad8d8cc1825edc3ea554dd682f0584371cafa11db3a3924a572a5e758

    SHA512

    a3a2e43190a089cc23d82c41474eb93e228ca078f5015e24d1c60ce57b0e5caf11611420dd2959757156771e06a4043cd4588a6fd6cd64c7f804bf45515f831b

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1581.exe
    Filesize

    359KB

    MD5

    b9b5469d3fe379acb19b12a77bb36a53

    SHA1

    eb5f544179b824060d7570e6977dfa91697ceecf

    SHA256

    4f47ac32374d0d6201a1ce14cf7f6ce08c7f35b0eb00801594a5d3e4ab93a26b

    SHA512

    858f725e654bdc79cbbc60a8996e63fb60c0cc32b2d081fc770887c0a97ec232c89305ce1793e2ec0cb4bde5c7a31d0b307887fe09deacd44dacf376f825c9d4

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1581.exe
    Filesize

    359KB

    MD5

    b9b5469d3fe379acb19b12a77bb36a53

    SHA1

    eb5f544179b824060d7570e6977dfa91697ceecf

    SHA256

    4f47ac32374d0d6201a1ce14cf7f6ce08c7f35b0eb00801594a5d3e4ab93a26b

    SHA512

    858f725e654bdc79cbbc60a8996e63fb60c0cc32b2d081fc770887c0a97ec232c89305ce1793e2ec0cb4bde5c7a31d0b307887fe09deacd44dacf376f825c9d4

  • memory/3504-134-0x00000000037D0000-0x00000000037EA000-memory.dmp
    Filesize

    104KB

  • memory/3504-135-0x0000000001BC0000-0x0000000001BED000-memory.dmp
    Filesize

    180KB

  • memory/3504-136-0x00000000060D0000-0x00000000060E0000-memory.dmp
    Filesize

    64KB

  • memory/3504-137-0x00000000060E0000-0x00000000065DE000-memory.dmp
    Filesize

    5.0MB

  • memory/3504-138-0x0000000006010000-0x0000000006028000-memory.dmp
    Filesize

    96KB

  • memory/3504-139-0x0000000006010000-0x0000000006022000-memory.dmp
    Filesize

    72KB

  • memory/3504-140-0x0000000006010000-0x0000000006022000-memory.dmp
    Filesize

    72KB

  • memory/3504-142-0x0000000006010000-0x0000000006022000-memory.dmp
    Filesize

    72KB

  • memory/3504-146-0x00000000060D0000-0x00000000060E0000-memory.dmp
    Filesize

    64KB

  • memory/3504-145-0x0000000006010000-0x0000000006022000-memory.dmp
    Filesize

    72KB

  • memory/3504-144-0x00000000060D0000-0x00000000060E0000-memory.dmp
    Filesize

    64KB

  • memory/3504-148-0x0000000006010000-0x0000000006022000-memory.dmp
    Filesize

    72KB

  • memory/3504-150-0x0000000006010000-0x0000000006022000-memory.dmp
    Filesize

    72KB

  • memory/3504-152-0x0000000006010000-0x0000000006022000-memory.dmp
    Filesize

    72KB

  • memory/3504-154-0x0000000006010000-0x0000000006022000-memory.dmp
    Filesize

    72KB

  • memory/3504-156-0x0000000006010000-0x0000000006022000-memory.dmp
    Filesize

    72KB

  • memory/3504-158-0x0000000006010000-0x0000000006022000-memory.dmp
    Filesize

    72KB

  • memory/3504-160-0x0000000006010000-0x0000000006022000-memory.dmp
    Filesize

    72KB

  • memory/3504-162-0x0000000006010000-0x0000000006022000-memory.dmp
    Filesize

    72KB

  • memory/3504-164-0x0000000006010000-0x0000000006022000-memory.dmp
    Filesize

    72KB

  • memory/3504-166-0x0000000006010000-0x0000000006022000-memory.dmp
    Filesize

    72KB

  • memory/3504-168-0x0000000006010000-0x0000000006022000-memory.dmp
    Filesize

    72KB

  • memory/3504-169-0x0000000000400000-0x0000000001AE3000-memory.dmp
    Filesize

    22.9MB

  • memory/3504-170-0x00000000060D0000-0x00000000060E0000-memory.dmp
    Filesize

    64KB

  • memory/3504-173-0x00000000060D0000-0x00000000060E0000-memory.dmp
    Filesize

    64KB

  • memory/3504-172-0x0000000000400000-0x0000000001AE3000-memory.dmp
    Filesize

    22.9MB

  • memory/4732-178-0x0000000003660000-0x00000000036A6000-memory.dmp
    Filesize

    280KB

  • memory/4732-179-0x0000000003B50000-0x0000000003B94000-memory.dmp
    Filesize

    272KB

  • memory/4732-180-0x0000000003B50000-0x0000000003B8F000-memory.dmp
    Filesize

    252KB

  • memory/4732-181-0x0000000003B50000-0x0000000003B8F000-memory.dmp
    Filesize

    252KB

  • memory/4732-183-0x0000000003B50000-0x0000000003B8F000-memory.dmp
    Filesize

    252KB

  • memory/4732-185-0x0000000003B50000-0x0000000003B8F000-memory.dmp
    Filesize

    252KB

  • memory/4732-187-0x0000000003B50000-0x0000000003B8F000-memory.dmp
    Filesize

    252KB

  • memory/4732-189-0x0000000003B50000-0x0000000003B8F000-memory.dmp
    Filesize

    252KB

  • memory/4732-191-0x0000000003B50000-0x0000000003B8F000-memory.dmp
    Filesize

    252KB

  • memory/4732-193-0x0000000003B50000-0x0000000003B8F000-memory.dmp
    Filesize

    252KB

  • memory/4732-195-0x0000000003B50000-0x0000000003B8F000-memory.dmp
    Filesize

    252KB

  • memory/4732-197-0x0000000003B50000-0x0000000003B8F000-memory.dmp
    Filesize

    252KB

  • memory/4732-199-0x0000000003B50000-0x0000000003B8F000-memory.dmp
    Filesize

    252KB

  • memory/4732-201-0x0000000003B50000-0x0000000003B8F000-memory.dmp
    Filesize

    252KB

  • memory/4732-203-0x0000000003B50000-0x0000000003B8F000-memory.dmp
    Filesize

    252KB

  • memory/4732-205-0x0000000003B50000-0x0000000003B8F000-memory.dmp
    Filesize

    252KB

  • memory/4732-207-0x0000000003B50000-0x0000000003B8F000-memory.dmp
    Filesize

    252KB

  • memory/4732-209-0x0000000003B50000-0x0000000003B8F000-memory.dmp
    Filesize

    252KB

  • memory/4732-211-0x0000000003B50000-0x0000000003B8F000-memory.dmp
    Filesize

    252KB

  • memory/4732-213-0x0000000003B50000-0x0000000003B8F000-memory.dmp
    Filesize

    252KB

  • memory/4732-231-0x0000000001BD0000-0x0000000001C1B000-memory.dmp
    Filesize

    300KB

  • memory/4732-233-0x0000000003BF0000-0x0000000003C00000-memory.dmp
    Filesize

    64KB

  • memory/4732-235-0x0000000003BF0000-0x0000000003C00000-memory.dmp
    Filesize

    64KB

  • memory/4732-238-0x0000000003BF0000-0x0000000003C00000-memory.dmp
    Filesize

    64KB

  • memory/4732-1090-0x0000000006650000-0x0000000006C56000-memory.dmp
    Filesize

    6.0MB

  • memory/4732-1091-0x0000000006CA0000-0x0000000006DAA000-memory.dmp
    Filesize

    1.0MB

  • memory/4732-1092-0x0000000006DE0000-0x0000000006DF2000-memory.dmp
    Filesize

    72KB

  • memory/4732-1093-0x0000000003BF0000-0x0000000003C00000-memory.dmp
    Filesize

    64KB

  • memory/4732-1094-0x0000000006E00000-0x0000000006E3E000-memory.dmp
    Filesize

    248KB

  • memory/4732-1095-0x0000000006F50000-0x0000000006F9B000-memory.dmp
    Filesize

    300KB

  • memory/4732-1097-0x00000000070E0000-0x0000000007172000-memory.dmp
    Filesize

    584KB

  • memory/4732-1098-0x0000000007180000-0x00000000071E6000-memory.dmp
    Filesize

    408KB

  • memory/4732-1099-0x0000000003BF0000-0x0000000003C00000-memory.dmp
    Filesize

    64KB

  • memory/4732-1100-0x0000000003BF0000-0x0000000003C00000-memory.dmp
    Filesize

    64KB

  • memory/4732-1101-0x0000000003BF0000-0x0000000003C00000-memory.dmp
    Filesize

    64KB

  • memory/4732-1102-0x0000000003BF0000-0x0000000003C00000-memory.dmp
    Filesize

    64KB

  • memory/4732-1103-0x0000000007AC0000-0x0000000007B36000-memory.dmp
    Filesize

    472KB

  • memory/4732-1104-0x0000000007B50000-0x0000000007BA0000-memory.dmp
    Filesize

    320KB

  • memory/4732-1105-0x0000000007BC0000-0x0000000007D82000-memory.dmp
    Filesize

    1.8MB

  • memory/4732-1106-0x0000000007D90000-0x00000000082BC000-memory.dmp
    Filesize

    5.2MB

  • memory/4816-1112-0x0000000000A00000-0x0000000000A32000-memory.dmp
    Filesize

    200KB

  • memory/4816-1113-0x00000000055E0000-0x00000000055F0000-memory.dmp
    Filesize

    64KB

  • memory/4816-1114-0x0000000005440000-0x000000000548B000-memory.dmp
    Filesize

    300KB

  • memory/4816-1115-0x00000000055E0000-0x00000000055F0000-memory.dmp
    Filesize

    64KB