Analysis

  • max time kernel
    66s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/03/2023, 20:50 UTC

General

  • Target

    7f0d174d82b92eb9545fceffa41c1ca7f9114d6d883a42dabb95ac9d7d20e532.exe

  • Size

    534KB

  • MD5

    9c7f01d188acc229fb6fc945df343e4b

  • SHA1

    50d434532839f2c5858d415f2ca62363212cedb6

  • SHA256

    7f0d174d82b92eb9545fceffa41c1ca7f9114d6d883a42dabb95ac9d7d20e532

  • SHA512

    df8b236aa87ae711a41c616e59784f34786bd3028e5be43217c5cd4b6df77182e5b90da28278e7b9bb5058b7ef17b3523d62fcbd12032b08bcdd065f8b4999a9

  • SSDEEP

    12288:AMrsy90eSlcDM0t8VqwrWM+cN3LqR9mZSYd1XB:8ykzPXN3GfiSYdb

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

spora

C2

176.113.115.145:4125

Attributes
  • auth_value

    441b39ab37774b2ca9931c31e1bc6071

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 33 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7f0d174d82b92eb9545fceffa41c1ca7f9114d6d883a42dabb95ac9d7d20e532.exe
    "C:\Users\Admin\AppData\Local\Temp\7f0d174d82b92eb9545fceffa41c1ca7f9114d6d883a42dabb95ac9d7d20e532.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3536
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziqi1919.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziqi1919.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:704
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr199324.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr199324.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1972
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku166628.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku166628.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2200
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 1572
          4⤵
          • Program crash
          PID:4964
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr922087.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr922087.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4324
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2200 -ip 2200
    1⤵
      PID:4392

    Network

    • flag-us
      DNS
      28.118.140.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      28.118.140.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      17.160.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      17.160.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      58.55.71.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      58.55.71.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      13.86.106.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      13.86.106.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      145.115.113.176.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      145.115.113.176.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      63.13.109.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      63.13.109.52.in-addr.arpa
      IN PTR
      Response
    • 176.113.115.145:4125
      ku166628.exe
      3.9MB
      54.4kB
      2892
      1159
    • 20.189.173.3:443
      322 B
      7
    • 209.197.3.8:80
      322 B
      7
    • 173.223.113.164:443
      322 B
      7
    • 173.223.113.131:80
      322 B
      7
    • 204.79.197.203:80
      322 B
      7
    • 176.113.115.145:4125
      lr922087.exe
      3.9MB
      52.3kB
      2879
      1154
    • 209.197.3.8:80
      322 B
      7
    • 8.8.8.8:53
      28.118.140.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      28.118.140.52.in-addr.arpa

    • 8.8.8.8:53
      17.160.190.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      17.160.190.20.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
      144 B
      1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      58.55.71.13.in-addr.arpa
      dns
      70 B
      144 B
      1
      1

      DNS Request

      58.55.71.13.in-addr.arpa

    • 8.8.8.8:53
      13.86.106.20.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      13.86.106.20.in-addr.arpa

    • 8.8.8.8:53
      145.115.113.176.in-addr.arpa
      dns
      74 B
      134 B
      1
      1

      DNS Request

      145.115.113.176.in-addr.arpa

    • 8.8.8.8:53
      63.13.109.52.in-addr.arpa
      dns
      71 B
      145 B
      1
      1

      DNS Request

      63.13.109.52.in-addr.arpa

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr922087.exe

      Filesize

      175KB

      MD5

      5764dd2dcc7a163331b445aecd9b4108

      SHA1

      bb35c69c413db59f0cafee44a23294d0dd53329b

      SHA256

      6f771f923578a8a3232479b3e01c2fd0ffd0f86d0684fff8138a003fbcf002b8

      SHA512

      cc48ea31178d3001e4a77cd862f2bd4b0891b74e42153aa1d88f5f2c6770ef8533fcdf9967ae24dc41e1adc04c18093b76dde6390a330729710d1895d4a2159f

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr922087.exe

      Filesize

      175KB

      MD5

      5764dd2dcc7a163331b445aecd9b4108

      SHA1

      bb35c69c413db59f0cafee44a23294d0dd53329b

      SHA256

      6f771f923578a8a3232479b3e01c2fd0ffd0f86d0684fff8138a003fbcf002b8

      SHA512

      cc48ea31178d3001e4a77cd862f2bd4b0891b74e42153aa1d88f5f2c6770ef8533fcdf9967ae24dc41e1adc04c18093b76dde6390a330729710d1895d4a2159f

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziqi1919.exe

      Filesize

      392KB

      MD5

      7921937f7e26c105e6ad806482eab804

      SHA1

      453ab7758d01d63338b2526dd5956b043686a91c

      SHA256

      807f30a989a42fe669ee226c02b6678ccbe175a4ab795a252715ff7b8b84ae2f

      SHA512

      d64d07902d94d1e89a662ea510dd28e4bf54eb7f9a633955a2b9b4b6ed1c78eca24f84ec74ee018f0bd11420cf808f978410212df449cce6ef9ce8f471c8178a

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziqi1919.exe

      Filesize

      392KB

      MD5

      7921937f7e26c105e6ad806482eab804

      SHA1

      453ab7758d01d63338b2526dd5956b043686a91c

      SHA256

      807f30a989a42fe669ee226c02b6678ccbe175a4ab795a252715ff7b8b84ae2f

      SHA512

      d64d07902d94d1e89a662ea510dd28e4bf54eb7f9a633955a2b9b4b6ed1c78eca24f84ec74ee018f0bd11420cf808f978410212df449cce6ef9ce8f471c8178a

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr199324.exe

      Filesize

      11KB

      MD5

      55ff8bcf4c276737ff54aff7e87ed3b8

      SHA1

      8d90aa72c09d23bc5926819db252a1bbbf3fbeb5

      SHA256

      a8f6b6e48e6dec4208693f88710c67015c0b1e35863efb89cd9be786fc00b100

      SHA512

      d510505e65bb84dd2ccb18eeb29f296b14a163359c1ddd7d0bf7137f1a906645cd46f07d56a02106e4bb1c5f0a8b429c179d499f4dc34594aa74d0afdd48245a

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr199324.exe

      Filesize

      11KB

      MD5

      55ff8bcf4c276737ff54aff7e87ed3b8

      SHA1

      8d90aa72c09d23bc5926819db252a1bbbf3fbeb5

      SHA256

      a8f6b6e48e6dec4208693f88710c67015c0b1e35863efb89cd9be786fc00b100

      SHA512

      d510505e65bb84dd2ccb18eeb29f296b14a163359c1ddd7d0bf7137f1a906645cd46f07d56a02106e4bb1c5f0a8b429c179d499f4dc34594aa74d0afdd48245a

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku166628.exe

      Filesize

      359KB

      MD5

      34c740e6054187e4861d0689e687d63f

      SHA1

      997528b89f1d4417329d4d111919fb6db3ed850d

      SHA256

      e2c940a47fab2681dfe81dd1e464e15f868acc1bd6825321dd10e1c56febe0cc

      SHA512

      5962acfabca2a16108d0417328a2addf1e38914ac687f281a8618def8052a403e61c86cc1019404472716866d9fb30d8abed50d802f7650998ee5ffbc190cf7e

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku166628.exe

      Filesize

      359KB

      MD5

      34c740e6054187e4861d0689e687d63f

      SHA1

      997528b89f1d4417329d4d111919fb6db3ed850d

      SHA256

      e2c940a47fab2681dfe81dd1e464e15f868acc1bd6825321dd10e1c56febe0cc

      SHA512

      5962acfabca2a16108d0417328a2addf1e38914ac687f281a8618def8052a403e61c86cc1019404472716866d9fb30d8abed50d802f7650998ee5ffbc190cf7e

    • memory/1972-147-0x0000000000940000-0x000000000094A000-memory.dmp

      Filesize

      40KB

    • memory/2200-153-0x0000000003790000-0x00000000037DB000-memory.dmp

      Filesize

      300KB

    • memory/2200-154-0x00000000061B0000-0x00000000061C0000-memory.dmp

      Filesize

      64KB

    • memory/2200-155-0x00000000061C0000-0x0000000006764000-memory.dmp

      Filesize

      5.6MB

    • memory/2200-156-0x00000000060A0000-0x00000000060DF000-memory.dmp

      Filesize

      252KB

    • memory/2200-159-0x00000000060A0000-0x00000000060DF000-memory.dmp

      Filesize

      252KB

    • memory/2200-157-0x00000000060A0000-0x00000000060DF000-memory.dmp

      Filesize

      252KB

    • memory/2200-161-0x00000000060A0000-0x00000000060DF000-memory.dmp

      Filesize

      252KB

    • memory/2200-163-0x00000000060A0000-0x00000000060DF000-memory.dmp

      Filesize

      252KB

    • memory/2200-165-0x00000000060A0000-0x00000000060DF000-memory.dmp

      Filesize

      252KB

    • memory/2200-167-0x00000000060A0000-0x00000000060DF000-memory.dmp

      Filesize

      252KB

    • memory/2200-169-0x00000000060A0000-0x00000000060DF000-memory.dmp

      Filesize

      252KB

    • memory/2200-171-0x00000000060A0000-0x00000000060DF000-memory.dmp

      Filesize

      252KB

    • memory/2200-173-0x00000000060A0000-0x00000000060DF000-memory.dmp

      Filesize

      252KB

    • memory/2200-175-0x00000000060A0000-0x00000000060DF000-memory.dmp

      Filesize

      252KB

    • memory/2200-177-0x00000000060A0000-0x00000000060DF000-memory.dmp

      Filesize

      252KB

    • memory/2200-179-0x00000000060A0000-0x00000000060DF000-memory.dmp

      Filesize

      252KB

    • memory/2200-181-0x00000000060A0000-0x00000000060DF000-memory.dmp

      Filesize

      252KB

    • memory/2200-183-0x00000000060A0000-0x00000000060DF000-memory.dmp

      Filesize

      252KB

    • memory/2200-185-0x00000000060A0000-0x00000000060DF000-memory.dmp

      Filesize

      252KB

    • memory/2200-187-0x00000000060A0000-0x00000000060DF000-memory.dmp

      Filesize

      252KB

    • memory/2200-189-0x00000000060A0000-0x00000000060DF000-memory.dmp

      Filesize

      252KB

    • memory/2200-191-0x00000000060A0000-0x00000000060DF000-memory.dmp

      Filesize

      252KB

    • memory/2200-193-0x00000000060A0000-0x00000000060DF000-memory.dmp

      Filesize

      252KB

    • memory/2200-195-0x00000000060A0000-0x00000000060DF000-memory.dmp

      Filesize

      252KB

    • memory/2200-197-0x00000000060A0000-0x00000000060DF000-memory.dmp

      Filesize

      252KB

    • memory/2200-199-0x00000000060A0000-0x00000000060DF000-memory.dmp

      Filesize

      252KB

    • memory/2200-201-0x00000000060A0000-0x00000000060DF000-memory.dmp

      Filesize

      252KB

    • memory/2200-203-0x00000000060A0000-0x00000000060DF000-memory.dmp

      Filesize

      252KB

    • memory/2200-205-0x00000000060A0000-0x00000000060DF000-memory.dmp

      Filesize

      252KB

    • memory/2200-207-0x00000000060A0000-0x00000000060DF000-memory.dmp

      Filesize

      252KB

    • memory/2200-209-0x00000000060A0000-0x00000000060DF000-memory.dmp

      Filesize

      252KB

    • memory/2200-211-0x00000000060A0000-0x00000000060DF000-memory.dmp

      Filesize

      252KB

    • memory/2200-213-0x00000000060A0000-0x00000000060DF000-memory.dmp

      Filesize

      252KB

    • memory/2200-215-0x00000000060A0000-0x00000000060DF000-memory.dmp

      Filesize

      252KB

    • memory/2200-217-0x00000000060A0000-0x00000000060DF000-memory.dmp

      Filesize

      252KB

    • memory/2200-219-0x00000000060A0000-0x00000000060DF000-memory.dmp

      Filesize

      252KB

    • memory/2200-1063-0x0000000006870000-0x0000000006E88000-memory.dmp

      Filesize

      6.1MB

    • memory/2200-1064-0x0000000006EE0000-0x0000000006FEA000-memory.dmp

      Filesize

      1.0MB

    • memory/2200-1065-0x0000000007020000-0x0000000007032000-memory.dmp

      Filesize

      72KB

    • memory/2200-1066-0x0000000007140000-0x000000000717C000-memory.dmp

      Filesize

      240KB

    • memory/2200-1067-0x00000000061B0000-0x00000000061C0000-memory.dmp

      Filesize

      64KB

    • memory/2200-1068-0x0000000007330000-0x00000000073C2000-memory.dmp

      Filesize

      584KB

    • memory/2200-1069-0x00000000073D0000-0x0000000007436000-memory.dmp

      Filesize

      408KB

    • memory/2200-1071-0x0000000008EA0000-0x0000000009062000-memory.dmp

      Filesize

      1.8MB

    • memory/2200-1072-0x00000000090C0000-0x00000000095EC000-memory.dmp

      Filesize

      5.2MB

    • memory/2200-1073-0x00000000061B0000-0x00000000061C0000-memory.dmp

      Filesize

      64KB

    • memory/2200-1074-0x00000000038D0000-0x0000000003946000-memory.dmp

      Filesize

      472KB

    • memory/2200-1075-0x00000000098E0000-0x0000000009930000-memory.dmp

      Filesize

      320KB

    • memory/4324-1081-0x0000000000ED0000-0x0000000000F02000-memory.dmp

      Filesize

      200KB

    • memory/4324-1082-0x00000000034C0000-0x00000000034D0000-memory.dmp

      Filesize

      64KB

    • memory/4324-1083-0x00000000034C0000-0x00000000034D0000-memory.dmp

      Filesize

      64KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.