Analysis
-
max time kernel
61s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
01/04/2023, 03:14
General
-
Target
261c49f0fa159dbdfe53d00786d7421348e79f88a6726a160c8a1ef04ab5c114.exe
-
Size
534KB
-
MD5
660f1f541b900fff4a1d5a8dbab43b20
-
SHA1
285938ef84bb1068f988d95c2fd2a62c8235abe0
-
SHA256
261c49f0fa159dbdfe53d00786d7421348e79f88a6726a160c8a1ef04ab5c114
-
SHA512
05e3a221d5f77317a426ea42a408ffddd3130e89d46393366ea73993310826a2643e8a17515a1aa3aacd200f78b286f4c6e8a09bf27d746f9548b6bf435738d8
-
SSDEEP
12288:0Mrfy90byM5cOx8EGSVcYOu6LmvbDaNc5jZC5B4UTR:LyicfiVcupTDqojsTR
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 34 IoCs
-
Executes dropped EXE 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 1 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\261c49f0fa159dbdfe53d00786d7421348e79f88a6726a160c8a1ef04ab5c114.exe"C:\Users\Admin\AppData\Local\Temp\261c49f0fa159dbdfe53d00786d7421348e79f88a6726a160c8a1ef04ab5c114.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziDR3246.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziDR3246.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr667059.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr667059.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku851076.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku851076.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 232 -s 13364⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr871316.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr871316.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 232 -ip 2321⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
176KB
MD533fa7c5e7e94f7ca5dd59b0a493f8606
SHA1b725ab3900a0506cce44236b27a1f1393b87b7d7
SHA256306b1997e9389ca958c967f6dbde09bd85989bafb4c85b9a22f557ec1358a060
SHA512098b467d6c3212104108d0164cd86d0b4092f1fda8938f07df804c1b993ba3a11f983c9df261614f5accf572bd4a43a0e8db64987b857e5d8f5c46f044bf5b03
-
Filesize
176KB
MD533fa7c5e7e94f7ca5dd59b0a493f8606
SHA1b725ab3900a0506cce44236b27a1f1393b87b7d7
SHA256306b1997e9389ca958c967f6dbde09bd85989bafb4c85b9a22f557ec1358a060
SHA512098b467d6c3212104108d0164cd86d0b4092f1fda8938f07df804c1b993ba3a11f983c9df261614f5accf572bd4a43a0e8db64987b857e5d8f5c46f044bf5b03
-
Filesize
392KB
MD5ead02747983740add10fda58f7c378b9
SHA1815ac8a8c86055c537ccb9ab4d713139a8219386
SHA25649389679771c966583e2ce00c9644acf550d3330ab06047bd54262386919f753
SHA5128348da523010e5f80edc18f1c5d6469d0c41663d062cce8e4639d2cee61c5434e6ff11829fe52f267860b57028b3b3332a8ccec342bc6511568773265bcb4823
-
Filesize
392KB
MD5ead02747983740add10fda58f7c378b9
SHA1815ac8a8c86055c537ccb9ab4d713139a8219386
SHA25649389679771c966583e2ce00c9644acf550d3330ab06047bd54262386919f753
SHA5128348da523010e5f80edc18f1c5d6469d0c41663d062cce8e4639d2cee61c5434e6ff11829fe52f267860b57028b3b3332a8ccec342bc6511568773265bcb4823
-
Filesize
12KB
MD5eefade2259e5eccead278c81d6acbd06
SHA138c9e026b32d2f2e38f5c310cdcd1fc590c82982
SHA256851c7eb2dcd7c7f810547c28a737814a161d947bb72de7898c16e1bbac4efe34
SHA512c4d8174af35eeb9589bc916478dd432f46b295393400b682441fd97e145db7c7b8a5922556e97c9515a7efca50d422dc758c52655a9c155d67d4b294ac0ab5d3
-
Filesize
12KB
MD5eefade2259e5eccead278c81d6acbd06
SHA138c9e026b32d2f2e38f5c310cdcd1fc590c82982
SHA256851c7eb2dcd7c7f810547c28a737814a161d947bb72de7898c16e1bbac4efe34
SHA512c4d8174af35eeb9589bc916478dd432f46b295393400b682441fd97e145db7c7b8a5922556e97c9515a7efca50d422dc758c52655a9c155d67d4b294ac0ab5d3
-
Filesize
319KB
MD59879930c362e8b330ff5e7bc753f48ce
SHA137376c69388de4be4316df9b6f892c3c6779d636
SHA256918ee52af17185054e92eb651be219586b87b5f1069fc0004548cdeabe534f21
SHA512833409a03667cf148c75ba9f48bd0fd31a0ed79a927a21ee2b9a20851c4f8186d70d3acbb0bfbf1d90f0e94cbc0a257800e9d28124475afa1244c7a34e3d0fff
-
Filesize
319KB
MD59879930c362e8b330ff5e7bc753f48ce
SHA137376c69388de4be4316df9b6f892c3c6779d636
SHA256918ee52af17185054e92eb651be219586b87b5f1069fc0004548cdeabe534f21
SHA512833409a03667cf148c75ba9f48bd0fd31a0ed79a927a21ee2b9a20851c4f8186d70d3acbb0bfbf1d90f0e94cbc0a257800e9d28124475afa1244c7a34e3d0fff
-
Filesize
300KB
-
Filesize
5.6MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
472KB
-
Filesize
320KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
200KB
-
Filesize
64KB
-
Filesize
40KB