Analysis
-
max time kernel
58s -
max time network
72s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
01/04/2023, 14:52
General
-
Target
cf6145fce156810f68329b15c1e9ac6951dbc67ebb32ff8149a38c63af66e6ed.exe
-
Size
530KB
-
MD5
76315ad3045dd58e1c40834f91e36708
-
SHA1
c88f5e6d260b88f159ef47f79c84f357e44ccc52
-
SHA256
cf6145fce156810f68329b15c1e9ac6951dbc67ebb32ff8149a38c63af66e6ed
-
SHA512
0e34013e2525aa461d55f989e86db941f55718bf0d9f232b7b21584da320041991037e3ca6b22bfb46f96cab06316249bf26affee3a9474bd363a5a909eff50a
-
SSDEEP
12288:6Mruy90AGRaBm6vm97h1jCQgf0+EqAwKy/QzqBbFTqHkW86FYP:gyTasxvG7s0+EqANaQWmY68
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
-
Executes dropped EXE 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 1 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf6145fce156810f68329b15c1e9ac6951dbc67ebb32ff8149a38c63af66e6ed.exe"C:\Users\Admin\AppData\Local\Temp\cf6145fce156810f68329b15c1e9ac6951dbc67ebb32ff8149a38c63af66e6ed.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPY1084.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPY1084.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr795347.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr795347.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku711835.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku711835.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr045559.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr045559.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD56ded39b3a52e5a99ad5c7d16e73a6b65
SHA146f2e47ad04111dd075f89ad82d2d8a5b57818f2
SHA256173d063350cd9a952527eda2b7e3067bc0c9d8bd1042bcae6217305a2a53c162
SHA512f3a0fb73e3e98ce6ffe7a626ff0808885d9f273ec0cfd4f2e885d47bcad59607e5d12646af8fa4806467ab4103ad0782a9c6b2a7de4540d7443b50428c0636d1
-
Filesize
175KB
MD56ded39b3a52e5a99ad5c7d16e73a6b65
SHA146f2e47ad04111dd075f89ad82d2d8a5b57818f2
SHA256173d063350cd9a952527eda2b7e3067bc0c9d8bd1042bcae6217305a2a53c162
SHA512f3a0fb73e3e98ce6ffe7a626ff0808885d9f273ec0cfd4f2e885d47bcad59607e5d12646af8fa4806467ab4103ad0782a9c6b2a7de4540d7443b50428c0636d1
-
Filesize
388KB
MD5ee8ce3cc0ba67fecd3e06087f87474da
SHA17c8d579d04d82294e8dee6342da01e0fbda46cae
SHA2563ecdb5ae22814ff183907d77606376ae1abaaaf6b69248faeff2269a846c8341
SHA512fa11ed7235c34160a330a32edc87587adbef522b40a63122d77061ccb6fb8888beb923bd34bc25c5865e0392189c7608c14b26722b36d866945b46c1db98f61d
-
Filesize
388KB
MD5ee8ce3cc0ba67fecd3e06087f87474da
SHA17c8d579d04d82294e8dee6342da01e0fbda46cae
SHA2563ecdb5ae22814ff183907d77606376ae1abaaaf6b69248faeff2269a846c8341
SHA512fa11ed7235c34160a330a32edc87587adbef522b40a63122d77061ccb6fb8888beb923bd34bc25c5865e0392189c7608c14b26722b36d866945b46c1db98f61d
-
Filesize
11KB
MD537e2a66b42c4fe831687ff9ab9df4c26
SHA15ab6dace7ae92427986c98a4851ccee3997b83be
SHA256bf1f0306c54b28f012253c033d68e92867b877ffd217f63cae4c766488ee5801
SHA512877cc32e344218d6332baa67b45490e554efd1cc7521773acb448368df85ac3fe5d2c3343b4219fffcdeb40990e039603527cb63acaac2790064f154f51af637
-
Filesize
11KB
MD537e2a66b42c4fe831687ff9ab9df4c26
SHA15ab6dace7ae92427986c98a4851ccee3997b83be
SHA256bf1f0306c54b28f012253c033d68e92867b877ffd217f63cae4c766488ee5801
SHA512877cc32e344218d6332baa67b45490e554efd1cc7521773acb448368df85ac3fe5d2c3343b4219fffcdeb40990e039603527cb63acaac2790064f154f51af637
-
Filesize
354KB
MD5d1ab43bf9b3215ec9019b57f91532c84
SHA12076259fa39864362f28491a61b4b87624ecc408
SHA2566da7d45e99ce6a00f9b907fa7ef93a6b01a991700da03a7fc02a690624940811
SHA512901c41acae27129ced362babaf0070d8c52ed72346d5debf7628ad7ddb89ab0f93c9f143a9026872d3e082f2f9cd63b1bc4f6b81f62fb913f49f187cf83b7ed1
-
Filesize
354KB
MD5d1ab43bf9b3215ec9019b57f91532c84
SHA12076259fa39864362f28491a61b4b87624ecc408
SHA2566da7d45e99ce6a00f9b907fa7ef93a6b01a991700da03a7fc02a690624940811
SHA512901c41acae27129ced362babaf0070d8c52ed72346d5debf7628ad7ddb89ab0f93c9f143a9026872d3e082f2f9cd63b1bc4f6b81f62fb913f49f187cf83b7ed1
-
Filesize
280KB
-
Filesize
5.0MB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
272KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
6.0MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
248KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
472KB
-
Filesize
320KB
-
Filesize
64KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
200KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
40KB