Analysis
-
max time kernel
67s -
max time network
131s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
01/04/2023, 23:12
General
-
Target
298b188a4095fd30d359e815daf6f3b374cdf889a2f514bba7b31f0b83d2bbb0.exe
-
Size
530KB
-
MD5
5c29c5eb7fdf50a36e51ee5dfeb71b79
-
SHA1
f9e82815ad422d37f40a1acd14a74abdd68327c6
-
SHA256
298b188a4095fd30d359e815daf6f3b374cdf889a2f514bba7b31f0b83d2bbb0
-
SHA512
fd96e854dc759f4416513f3f2f911711634b159b9f5af625f37488e7661eeb57f90b42ee21f1d84a82516dfc424a61945a90bbd47957c463a3fd1f79a964fc07
-
SSDEEP
12288:JMrsy902CCrPMkZDGIF3pWf5KXa/gGqbNhI:dyDPM+GIFIA/nbzI
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
-
Executes dropped EXE 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 1 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\298b188a4095fd30d359e815daf6f3b374cdf889a2f514bba7b31f0b83d2bbb0.exe"C:\Users\Admin\AppData\Local\Temp\298b188a4095fd30d359e815daf6f3b374cdf889a2f514bba7b31f0b83d2bbb0.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zidB7635.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zidB7635.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr776726.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr776726.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku670314.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku670314.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr213930.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr213930.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
176KB
MD51b027bc6bb8f59e9970822c608f8ff27
SHA1a70a2a394db6c4c710f7c792b6376f235e361b7e
SHA256d8869c42d80df896995cd9352b688285d7e23affaf4d677bbd57ade047f451fb
SHA5127754cfb1fd44dc7f050fc7e1abbee812f5149ee49bbcdc2031b78b5e81201bac96f98c6bdbb196b09a06689930daedb4c58c3ac7b3d19bf09ab51e3efebadb34
-
Filesize
176KB
MD51b027bc6bb8f59e9970822c608f8ff27
SHA1a70a2a394db6c4c710f7c792b6376f235e361b7e
SHA256d8869c42d80df896995cd9352b688285d7e23affaf4d677bbd57ade047f451fb
SHA5127754cfb1fd44dc7f050fc7e1abbee812f5149ee49bbcdc2031b78b5e81201bac96f98c6bdbb196b09a06689930daedb4c58c3ac7b3d19bf09ab51e3efebadb34
-
Filesize
388KB
MD5675761bca8202713381c896f940fbddf
SHA119e956783db4cf5061af3bcd48dcc268e268e638
SHA256106be0d150ad2821a2c1487082f58f29dc89593a356542b58ae3db2bd3eced67
SHA51252016da45ce1725fbeea0b8179b4e84c3c7ba6f7d1be471a38cddaf75f91d3c08e085996fd4e05dc391531ae740b9b7b611d5a5ce610fc1a1fe40e2fb78ffbcc
-
Filesize
388KB
MD5675761bca8202713381c896f940fbddf
SHA119e956783db4cf5061af3bcd48dcc268e268e638
SHA256106be0d150ad2821a2c1487082f58f29dc89593a356542b58ae3db2bd3eced67
SHA51252016da45ce1725fbeea0b8179b4e84c3c7ba6f7d1be471a38cddaf75f91d3c08e085996fd4e05dc391531ae740b9b7b611d5a5ce610fc1a1fe40e2fb78ffbcc
-
Filesize
11KB
MD5992f840b8844279765e9956933b71c9a
SHA154817a24a05a39181f0ca7e232411a8c3a22180c
SHA2562091b6ccd6133f4c7fd3d0787be78f5584c500f2fb9cd3acd0a8de0d67a38aa7
SHA51247a8dae101736fec9586a47195758137d04fb7fd3f5cb73e6ae8b43c400b5630458a9ca8a04ffb68a1974035addb46f7ae2a74fc267ca26e4bed780c823923aa
-
Filesize
11KB
MD5992f840b8844279765e9956933b71c9a
SHA154817a24a05a39181f0ca7e232411a8c3a22180c
SHA2562091b6ccd6133f4c7fd3d0787be78f5584c500f2fb9cd3acd0a8de0d67a38aa7
SHA51247a8dae101736fec9586a47195758137d04fb7fd3f5cb73e6ae8b43c400b5630458a9ca8a04ffb68a1974035addb46f7ae2a74fc267ca26e4bed780c823923aa
-
Filesize
434KB
MD56d982eeb8c7fd8066938b086e5876663
SHA1d8c41c2a51005257313dfd7514a09d5703741e90
SHA256723dbf2efe20c5dff74a32fdc89e93cd2b243e856e62f55c54a96fef527e21f5
SHA5127db2475e85f71ea17c9fe33ac83fe993f5a5fab4a9ca46f855c2cfc89f8649940ed844e15b1782e627842c469529d6bed7f040626e91d521af380a4e51f15b5e
-
Filesize
434KB
MD56d982eeb8c7fd8066938b086e5876663
SHA1d8c41c2a51005257313dfd7514a09d5703741e90
SHA256723dbf2efe20c5dff74a32fdc89e93cd2b243e856e62f55c54a96fef527e21f5
SHA5127db2475e85f71ea17c9fe33ac83fe993f5a5fab4a9ca46f855c2cfc89f8649940ed844e15b1782e627842c469529d6bed7f040626e91d521af380a4e51f15b5e
-
Filesize
40KB
-
Filesize
280KB
-
Filesize
5.0MB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
272KB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
6.0MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
584KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
472KB
-
Filesize
320KB
-
Filesize
64KB
-
Filesize
200KB
-
Filesize
300KB
-
Filesize
64KB