Analysis

  • max time kernel
    66s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-03-2023 20:50

General

  • Target

    7f0d174d82b92eb9545fceffa41c1ca7f9114d6d883a42dabb95ac9d7d20e532.exe

  • Size

    534KB

  • MD5

    9c7f01d188acc229fb6fc945df343e4b

  • SHA1

    50d434532839f2c5858d415f2ca62363212cedb6

  • SHA256

    7f0d174d82b92eb9545fceffa41c1ca7f9114d6d883a42dabb95ac9d7d20e532

  • SHA512

    df8b236aa87ae711a41c616e59784f34786bd3028e5be43217c5cd4b6df77182e5b90da28278e7b9bb5058b7ef17b3523d62fcbd12032b08bcdd065f8b4999a9

  • SSDEEP

    12288:AMrsy90eSlcDM0t8VqwrWM+cN3LqR9mZSYd1XB:8ykzPXN3GfiSYdb

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

spora

C2

176.113.115.145:4125

Attributes
  • auth_value

    441b39ab37774b2ca9931c31e1bc6071

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 33 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7f0d174d82b92eb9545fceffa41c1ca7f9114d6d883a42dabb95ac9d7d20e532.exe
    "C:\Users\Admin\AppData\Local\Temp\7f0d174d82b92eb9545fceffa41c1ca7f9114d6d883a42dabb95ac9d7d20e532.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3536
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziqi1919.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziqi1919.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:704
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr199324.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr199324.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1972
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku166628.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku166628.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2200
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 1572
          4⤵
          • Program crash
          PID:4964
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr922087.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr922087.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4324
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2200 -ip 2200
    1⤵
      PID:4392

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Modify Existing Service

    1
    T1031

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    3
    T1112

    Disabling Security Tools

    2
    T1089

    Credential Access

    Credentials in Files

    2
    T1081

    Discovery

    Query Registry

    1
    T1012

    Collection

    Data from Local System

    2
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr922087.exe
      Filesize

      175KB

      MD5

      5764dd2dcc7a163331b445aecd9b4108

      SHA1

      bb35c69c413db59f0cafee44a23294d0dd53329b

      SHA256

      6f771f923578a8a3232479b3e01c2fd0ffd0f86d0684fff8138a003fbcf002b8

      SHA512

      cc48ea31178d3001e4a77cd862f2bd4b0891b74e42153aa1d88f5f2c6770ef8533fcdf9967ae24dc41e1adc04c18093b76dde6390a330729710d1895d4a2159f

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr922087.exe
      Filesize

      175KB

      MD5

      5764dd2dcc7a163331b445aecd9b4108

      SHA1

      bb35c69c413db59f0cafee44a23294d0dd53329b

      SHA256

      6f771f923578a8a3232479b3e01c2fd0ffd0f86d0684fff8138a003fbcf002b8

      SHA512

      cc48ea31178d3001e4a77cd862f2bd4b0891b74e42153aa1d88f5f2c6770ef8533fcdf9967ae24dc41e1adc04c18093b76dde6390a330729710d1895d4a2159f

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziqi1919.exe
      Filesize

      392KB

      MD5

      7921937f7e26c105e6ad806482eab804

      SHA1

      453ab7758d01d63338b2526dd5956b043686a91c

      SHA256

      807f30a989a42fe669ee226c02b6678ccbe175a4ab795a252715ff7b8b84ae2f

      SHA512

      d64d07902d94d1e89a662ea510dd28e4bf54eb7f9a633955a2b9b4b6ed1c78eca24f84ec74ee018f0bd11420cf808f978410212df449cce6ef9ce8f471c8178a

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziqi1919.exe
      Filesize

      392KB

      MD5

      7921937f7e26c105e6ad806482eab804

      SHA1

      453ab7758d01d63338b2526dd5956b043686a91c

      SHA256

      807f30a989a42fe669ee226c02b6678ccbe175a4ab795a252715ff7b8b84ae2f

      SHA512

      d64d07902d94d1e89a662ea510dd28e4bf54eb7f9a633955a2b9b4b6ed1c78eca24f84ec74ee018f0bd11420cf808f978410212df449cce6ef9ce8f471c8178a

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr199324.exe
      Filesize

      11KB

      MD5

      55ff8bcf4c276737ff54aff7e87ed3b8

      SHA1

      8d90aa72c09d23bc5926819db252a1bbbf3fbeb5

      SHA256

      a8f6b6e48e6dec4208693f88710c67015c0b1e35863efb89cd9be786fc00b100

      SHA512

      d510505e65bb84dd2ccb18eeb29f296b14a163359c1ddd7d0bf7137f1a906645cd46f07d56a02106e4bb1c5f0a8b429c179d499f4dc34594aa74d0afdd48245a

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr199324.exe
      Filesize

      11KB

      MD5

      55ff8bcf4c276737ff54aff7e87ed3b8

      SHA1

      8d90aa72c09d23bc5926819db252a1bbbf3fbeb5

      SHA256

      a8f6b6e48e6dec4208693f88710c67015c0b1e35863efb89cd9be786fc00b100

      SHA512

      d510505e65bb84dd2ccb18eeb29f296b14a163359c1ddd7d0bf7137f1a906645cd46f07d56a02106e4bb1c5f0a8b429c179d499f4dc34594aa74d0afdd48245a

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku166628.exe
      Filesize

      359KB

      MD5

      34c740e6054187e4861d0689e687d63f

      SHA1

      997528b89f1d4417329d4d111919fb6db3ed850d

      SHA256

      e2c940a47fab2681dfe81dd1e464e15f868acc1bd6825321dd10e1c56febe0cc

      SHA512

      5962acfabca2a16108d0417328a2addf1e38914ac687f281a8618def8052a403e61c86cc1019404472716866d9fb30d8abed50d802f7650998ee5ffbc190cf7e

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku166628.exe
      Filesize

      359KB

      MD5

      34c740e6054187e4861d0689e687d63f

      SHA1

      997528b89f1d4417329d4d111919fb6db3ed850d

      SHA256

      e2c940a47fab2681dfe81dd1e464e15f868acc1bd6825321dd10e1c56febe0cc

      SHA512

      5962acfabca2a16108d0417328a2addf1e38914ac687f281a8618def8052a403e61c86cc1019404472716866d9fb30d8abed50d802f7650998ee5ffbc190cf7e

    • memory/1972-147-0x0000000000940000-0x000000000094A000-memory.dmp
      Filesize

      40KB

    • memory/2200-153-0x0000000003790000-0x00000000037DB000-memory.dmp
      Filesize

      300KB

    • memory/2200-154-0x00000000061B0000-0x00000000061C0000-memory.dmp
      Filesize

      64KB

    • memory/2200-155-0x00000000061C0000-0x0000000006764000-memory.dmp
      Filesize

      5.6MB

    • memory/2200-156-0x00000000060A0000-0x00000000060DF000-memory.dmp
      Filesize

      252KB

    • memory/2200-159-0x00000000060A0000-0x00000000060DF000-memory.dmp
      Filesize

      252KB

    • memory/2200-157-0x00000000060A0000-0x00000000060DF000-memory.dmp
      Filesize

      252KB

    • memory/2200-161-0x00000000060A0000-0x00000000060DF000-memory.dmp
      Filesize

      252KB

    • memory/2200-163-0x00000000060A0000-0x00000000060DF000-memory.dmp
      Filesize

      252KB

    • memory/2200-165-0x00000000060A0000-0x00000000060DF000-memory.dmp
      Filesize

      252KB

    • memory/2200-167-0x00000000060A0000-0x00000000060DF000-memory.dmp
      Filesize

      252KB

    • memory/2200-169-0x00000000060A0000-0x00000000060DF000-memory.dmp
      Filesize

      252KB

    • memory/2200-171-0x00000000060A0000-0x00000000060DF000-memory.dmp
      Filesize

      252KB

    • memory/2200-173-0x00000000060A0000-0x00000000060DF000-memory.dmp
      Filesize

      252KB

    • memory/2200-175-0x00000000060A0000-0x00000000060DF000-memory.dmp
      Filesize

      252KB

    • memory/2200-177-0x00000000060A0000-0x00000000060DF000-memory.dmp
      Filesize

      252KB

    • memory/2200-179-0x00000000060A0000-0x00000000060DF000-memory.dmp
      Filesize

      252KB

    • memory/2200-181-0x00000000060A0000-0x00000000060DF000-memory.dmp
      Filesize

      252KB

    • memory/2200-183-0x00000000060A0000-0x00000000060DF000-memory.dmp
      Filesize

      252KB

    • memory/2200-185-0x00000000060A0000-0x00000000060DF000-memory.dmp
      Filesize

      252KB

    • memory/2200-187-0x00000000060A0000-0x00000000060DF000-memory.dmp
      Filesize

      252KB

    • memory/2200-189-0x00000000060A0000-0x00000000060DF000-memory.dmp
      Filesize

      252KB

    • memory/2200-191-0x00000000060A0000-0x00000000060DF000-memory.dmp
      Filesize

      252KB

    • memory/2200-193-0x00000000060A0000-0x00000000060DF000-memory.dmp
      Filesize

      252KB

    • memory/2200-195-0x00000000060A0000-0x00000000060DF000-memory.dmp
      Filesize

      252KB

    • memory/2200-197-0x00000000060A0000-0x00000000060DF000-memory.dmp
      Filesize

      252KB

    • memory/2200-199-0x00000000060A0000-0x00000000060DF000-memory.dmp
      Filesize

      252KB

    • memory/2200-201-0x00000000060A0000-0x00000000060DF000-memory.dmp
      Filesize

      252KB

    • memory/2200-203-0x00000000060A0000-0x00000000060DF000-memory.dmp
      Filesize

      252KB

    • memory/2200-205-0x00000000060A0000-0x00000000060DF000-memory.dmp
      Filesize

      252KB

    • memory/2200-207-0x00000000060A0000-0x00000000060DF000-memory.dmp
      Filesize

      252KB

    • memory/2200-209-0x00000000060A0000-0x00000000060DF000-memory.dmp
      Filesize

      252KB

    • memory/2200-211-0x00000000060A0000-0x00000000060DF000-memory.dmp
      Filesize

      252KB

    • memory/2200-213-0x00000000060A0000-0x00000000060DF000-memory.dmp
      Filesize

      252KB

    • memory/2200-215-0x00000000060A0000-0x00000000060DF000-memory.dmp
      Filesize

      252KB

    • memory/2200-217-0x00000000060A0000-0x00000000060DF000-memory.dmp
      Filesize

      252KB

    • memory/2200-219-0x00000000060A0000-0x00000000060DF000-memory.dmp
      Filesize

      252KB

    • memory/2200-1063-0x0000000006870000-0x0000000006E88000-memory.dmp
      Filesize

      6.1MB

    • memory/2200-1064-0x0000000006EE0000-0x0000000006FEA000-memory.dmp
      Filesize

      1.0MB

    • memory/2200-1065-0x0000000007020000-0x0000000007032000-memory.dmp
      Filesize

      72KB

    • memory/2200-1066-0x0000000007140000-0x000000000717C000-memory.dmp
      Filesize

      240KB

    • memory/2200-1067-0x00000000061B0000-0x00000000061C0000-memory.dmp
      Filesize

      64KB

    • memory/2200-1068-0x0000000007330000-0x00000000073C2000-memory.dmp
      Filesize

      584KB

    • memory/2200-1069-0x00000000073D0000-0x0000000007436000-memory.dmp
      Filesize

      408KB

    • memory/2200-1071-0x0000000008EA0000-0x0000000009062000-memory.dmp
      Filesize

      1.8MB

    • memory/2200-1072-0x00000000090C0000-0x00000000095EC000-memory.dmp
      Filesize

      5.2MB

    • memory/2200-1073-0x00000000061B0000-0x00000000061C0000-memory.dmp
      Filesize

      64KB

    • memory/2200-1074-0x00000000038D0000-0x0000000003946000-memory.dmp
      Filesize

      472KB

    • memory/2200-1075-0x00000000098E0000-0x0000000009930000-memory.dmp
      Filesize

      320KB

    • memory/4324-1081-0x0000000000ED0000-0x0000000000F02000-memory.dmp
      Filesize

      200KB

    • memory/4324-1082-0x00000000034C0000-0x00000000034D0000-memory.dmp
      Filesize

      64KB

    • memory/4324-1083-0x00000000034C0000-0x00000000034D0000-memory.dmp
      Filesize

      64KB