Analysis

  • max time kernel
    61s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/04/2023, 09:02

General

  • Target

    653a4c748bb35f724a975d4c2d94ce29399b4f03a5f48163e7a319e5d5db1ee3.exe

  • Size

    529KB

  • MD5

    2edeed5a0b4e38a18add2a1c4bca506e

  • SHA1

    f54e12995f6c164482dc8ae44b25ee8b55f6c1a0

  • SHA256

    653a4c748bb35f724a975d4c2d94ce29399b4f03a5f48163e7a319e5d5db1ee3

  • SHA512

    d709ab38dc823d44dec52e3e49299dc0e10adcbb806c18234ea33044328a54fcf272af4991037b249cb7caeb29eaca799ecc5c734d801abe5bad678ace6fefcf

  • SSDEEP

    12288:mMrAy90u8qFtWkqN+rPnWnlgFOJNl4I4Nbnsf:CyV8qtdqYrPnWnlgFOi9Nnsf

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

spora

C2

176.113.115.145:4125

Attributes
  • auth_value

    441b39ab37774b2ca9931c31e1bc6071

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 33 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\653a4c748bb35f724a975d4c2d94ce29399b4f03a5f48163e7a319e5d5db1ee3.exe
    "C:\Users\Admin\AppData\Local\Temp\653a4c748bb35f724a975d4c2d94ce29399b4f03a5f48163e7a319e5d5db1ee3.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:748
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziiN1560.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziiN1560.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3116
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr917794.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr917794.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1940
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku369100.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku369100.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4368
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 1540
          4⤵
          • Program crash
          PID:1868
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr487916.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr487916.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4672
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4368 -ip 4368
    1⤵
      PID:4636

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr487916.exe

      Filesize

      176KB

      MD5

      15954d71cd070d7675b363819d360c7a

      SHA1

      4175d5c67812d67190232a666f36623fd9d24d16

      SHA256

      2f5198d54113edd7adef1139c3e4845c00f058d06510beac04b60a1d3b1eb25a

      SHA512

      5d492b47438ad220b7ca701cb394921f94c50e5c700ba4c9c49ab7dc30652925e252528a30b684b789a8bd77e6adac568ea17c3974dacf464be7c36b9e1e5cd3

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr487916.exe

      Filesize

      176KB

      MD5

      15954d71cd070d7675b363819d360c7a

      SHA1

      4175d5c67812d67190232a666f36623fd9d24d16

      SHA256

      2f5198d54113edd7adef1139c3e4845c00f058d06510beac04b60a1d3b1eb25a

      SHA512

      5d492b47438ad220b7ca701cb394921f94c50e5c700ba4c9c49ab7dc30652925e252528a30b684b789a8bd77e6adac568ea17c3974dacf464be7c36b9e1e5cd3

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziiN1560.exe

      Filesize

      387KB

      MD5

      5c96db2e509715448aaaebd743fc0321

      SHA1

      9713360d6b0d920e56902aa1eee505be696eb621

      SHA256

      36cf1850762fdcefc3ae89be47a7a048ffbe15a1ad9a99df061c6f02c6cca9cc

      SHA512

      350b06648b30216f2bd6a1c60b1da5f41bd5452d9f4ec2b5e109c07d11296e20e875a47ce5b33ef45a84c6dca5ee8d40dcf68b2be718f54c09b11042ed12c5ca

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziiN1560.exe

      Filesize

      387KB

      MD5

      5c96db2e509715448aaaebd743fc0321

      SHA1

      9713360d6b0d920e56902aa1eee505be696eb621

      SHA256

      36cf1850762fdcefc3ae89be47a7a048ffbe15a1ad9a99df061c6f02c6cca9cc

      SHA512

      350b06648b30216f2bd6a1c60b1da5f41bd5452d9f4ec2b5e109c07d11296e20e875a47ce5b33ef45a84c6dca5ee8d40dcf68b2be718f54c09b11042ed12c5ca

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr917794.exe

      Filesize

      12KB

      MD5

      6ac66d1a98c37c51da386bd2208dd012

      SHA1

      08daef8e147afa47fe8b0138334dcafea531e7cb

      SHA256

      a0d613cf1f9606ffd5a7df4c085cb8fb82b0b3b5c4ef6ea3101ef5f49c89ffbe

      SHA512

      0d0d46e7a443890e55d32ad29ee3f10c25e50c10b8b2901207cbf827ea36ceb6ddc61e02e3a9a80043d7a8e7c9af5a6a32e575f9a3c8a0ca3e88d4745026f358

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr917794.exe

      Filesize

      12KB

      MD5

      6ac66d1a98c37c51da386bd2208dd012

      SHA1

      08daef8e147afa47fe8b0138334dcafea531e7cb

      SHA256

      a0d613cf1f9606ffd5a7df4c085cb8fb82b0b3b5c4ef6ea3101ef5f49c89ffbe

      SHA512

      0d0d46e7a443890e55d32ad29ee3f10c25e50c10b8b2901207cbf827ea36ceb6ddc61e02e3a9a80043d7a8e7c9af5a6a32e575f9a3c8a0ca3e88d4745026f358

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku369100.exe

      Filesize

      342KB

      MD5

      9d7fd4e29776137b72cbe8126bd24068

      SHA1

      eda9df70acc5d11bf6e570e00d696b1eba9f249e

      SHA256

      868d29a7a80fb39da5f85da67957c0bfa9d28ce15a215a69856db8ecaad351d6

      SHA512

      eb83dca0618600f9d38c81ac4c0dd4a1e3576ac0e21246fc8d13de87de48a31c5f6aa4f029c7bd2914f63210b467163bb9376d94ea52567dbf1e6c550fc3750c

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku369100.exe

      Filesize

      342KB

      MD5

      9d7fd4e29776137b72cbe8126bd24068

      SHA1

      eda9df70acc5d11bf6e570e00d696b1eba9f249e

      SHA256

      868d29a7a80fb39da5f85da67957c0bfa9d28ce15a215a69856db8ecaad351d6

      SHA512

      eb83dca0618600f9d38c81ac4c0dd4a1e3576ac0e21246fc8d13de87de48a31c5f6aa4f029c7bd2914f63210b467163bb9376d94ea52567dbf1e6c550fc3750c

    • memory/1940-147-0x0000000000E90000-0x0000000000E9A000-memory.dmp

      Filesize

      40KB

    • memory/4368-153-0x00000000030C0000-0x000000000310B000-memory.dmp

      Filesize

      300KB

    • memory/4368-154-0x0000000007270000-0x0000000007280000-memory.dmp

      Filesize

      64KB

    • memory/4368-155-0x0000000007270000-0x0000000007280000-memory.dmp

      Filesize

      64KB

    • memory/4368-156-0x0000000007270000-0x0000000007280000-memory.dmp

      Filesize

      64KB

    • memory/4368-157-0x0000000007280000-0x0000000007824000-memory.dmp

      Filesize

      5.6MB

    • memory/4368-158-0x0000000007160000-0x000000000719F000-memory.dmp

      Filesize

      252KB

    • memory/4368-161-0x0000000007160000-0x000000000719F000-memory.dmp

      Filesize

      252KB

    • memory/4368-159-0x0000000007160000-0x000000000719F000-memory.dmp

      Filesize

      252KB

    • memory/4368-163-0x0000000007160000-0x000000000719F000-memory.dmp

      Filesize

      252KB

    • memory/4368-165-0x0000000007160000-0x000000000719F000-memory.dmp

      Filesize

      252KB

    • memory/4368-167-0x0000000007160000-0x000000000719F000-memory.dmp

      Filesize

      252KB

    • memory/4368-169-0x0000000007160000-0x000000000719F000-memory.dmp

      Filesize

      252KB

    • memory/4368-171-0x0000000007160000-0x000000000719F000-memory.dmp

      Filesize

      252KB

    • memory/4368-173-0x0000000007160000-0x000000000719F000-memory.dmp

      Filesize

      252KB

    • memory/4368-175-0x0000000007160000-0x000000000719F000-memory.dmp

      Filesize

      252KB

    • memory/4368-177-0x0000000007160000-0x000000000719F000-memory.dmp

      Filesize

      252KB

    • memory/4368-179-0x0000000007160000-0x000000000719F000-memory.dmp

      Filesize

      252KB

    • memory/4368-181-0x0000000007160000-0x000000000719F000-memory.dmp

      Filesize

      252KB

    • memory/4368-183-0x0000000007160000-0x000000000719F000-memory.dmp

      Filesize

      252KB

    • memory/4368-185-0x0000000007160000-0x000000000719F000-memory.dmp

      Filesize

      252KB

    • memory/4368-187-0x0000000007160000-0x000000000719F000-memory.dmp

      Filesize

      252KB

    • memory/4368-189-0x0000000007160000-0x000000000719F000-memory.dmp

      Filesize

      252KB

    • memory/4368-191-0x0000000007160000-0x000000000719F000-memory.dmp

      Filesize

      252KB

    • memory/4368-193-0x0000000007160000-0x000000000719F000-memory.dmp

      Filesize

      252KB

    • memory/4368-195-0x0000000007160000-0x000000000719F000-memory.dmp

      Filesize

      252KB

    • memory/4368-197-0x0000000007160000-0x000000000719F000-memory.dmp

      Filesize

      252KB

    • memory/4368-199-0x0000000007160000-0x000000000719F000-memory.dmp

      Filesize

      252KB

    • memory/4368-201-0x0000000007160000-0x000000000719F000-memory.dmp

      Filesize

      252KB

    • memory/4368-203-0x0000000007160000-0x000000000719F000-memory.dmp

      Filesize

      252KB

    • memory/4368-205-0x0000000007160000-0x000000000719F000-memory.dmp

      Filesize

      252KB

    • memory/4368-207-0x0000000007160000-0x000000000719F000-memory.dmp

      Filesize

      252KB

    • memory/4368-209-0x0000000007160000-0x000000000719F000-memory.dmp

      Filesize

      252KB

    • memory/4368-211-0x0000000007160000-0x000000000719F000-memory.dmp

      Filesize

      252KB

    • memory/4368-213-0x0000000007160000-0x000000000719F000-memory.dmp

      Filesize

      252KB

    • memory/4368-215-0x0000000007160000-0x000000000719F000-memory.dmp

      Filesize

      252KB

    • memory/4368-217-0x0000000007160000-0x000000000719F000-memory.dmp

      Filesize

      252KB

    • memory/4368-219-0x0000000007160000-0x000000000719F000-memory.dmp

      Filesize

      252KB

    • memory/4368-221-0x0000000007160000-0x000000000719F000-memory.dmp

      Filesize

      252KB

    • memory/4368-1064-0x0000000007830000-0x0000000007E48000-memory.dmp

      Filesize

      6.1MB

    • memory/4368-1065-0x0000000007E50000-0x0000000007F5A000-memory.dmp

      Filesize

      1.0MB

    • memory/4368-1066-0x0000000007F70000-0x0000000007F82000-memory.dmp

      Filesize

      72KB

    • memory/4368-1067-0x0000000007270000-0x0000000007280000-memory.dmp

      Filesize

      64KB

    • memory/4368-1068-0x0000000007F90000-0x0000000007FCC000-memory.dmp

      Filesize

      240KB

    • memory/4368-1070-0x0000000007270000-0x0000000007280000-memory.dmp

      Filesize

      64KB

    • memory/4368-1071-0x0000000008280000-0x0000000008312000-memory.dmp

      Filesize

      584KB

    • memory/4368-1072-0x0000000008320000-0x0000000008386000-memory.dmp

      Filesize

      408KB

    • memory/4368-1073-0x0000000008A50000-0x0000000008C12000-memory.dmp

      Filesize

      1.8MB

    • memory/4368-1074-0x0000000008C20000-0x000000000914C000-memory.dmp

      Filesize

      5.2MB

    • memory/4368-1075-0x0000000007270000-0x0000000007280000-memory.dmp

      Filesize

      64KB

    • memory/4368-1076-0x00000000095F0000-0x0000000009666000-memory.dmp

      Filesize

      472KB

    • memory/4368-1077-0x0000000009680000-0x00000000096D0000-memory.dmp

      Filesize

      320KB

    • memory/4672-1084-0x0000000000960000-0x0000000000992000-memory.dmp

      Filesize

      200KB

    • memory/4672-1085-0x0000000005230000-0x0000000005240000-memory.dmp

      Filesize

      64KB