Analysis

  • max time kernel
    137s
  • max time network
    116s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-04-2023 08:37

General

  • Target

    9c55b7c731c3bf85b78a85cbdc06e4f7899572f76c10cb24d67e32660bfe3d05.exe

  • Size

    659KB

  • MD5

    858d004d1b9b856f706a0d97fbb9d0ab

  • SHA1

    350a2913035e977c1453d5787370236029834408

  • SHA256

    9c55b7c731c3bf85b78a85cbdc06e4f7899572f76c10cb24d67e32660bfe3d05

  • SHA512

    55309767f7bf668ef76a409bbc93d00c5e80ba40d891bc2356050f25a471c87379248968dc72ad0596c630e7f71040d0cc7e8bfb108742059ed6645327e61990

  • SSDEEP

    12288:QMrqy90tMPJme/yD1sV+hkpQHd9wCVaoNPHixeFBlRLZeaOKeUw7ZeS+:qyVJmPCU6pQHd9UqHixeFX5OKep7V+

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

spora

C2

176.113.115.145:4125

Attributes
  • auth_value

    441b39ab37774b2ca9931c31e1bc6071

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 18 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9c55b7c731c3bf85b78a85cbdc06e4f7899572f76c10cb24d67e32660bfe3d05.exe
    "C:\Users\Admin\AppData\Local\Temp\9c55b7c731c3bf85b78a85cbdc06e4f7899572f76c10cb24d67e32660bfe3d05.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4104
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un580426.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un580426.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1708
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8097.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8097.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:868
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 1080
          4⤵
          • Program crash
          PID:5072
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9436.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9436.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5040
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 1948
          4⤵
          • Program crash
          PID:2712
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si611358.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si611358.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4320
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 868 -ip 868
    1⤵
      PID:796
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5040 -ip 5040
      1⤵
        PID:5024
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe start wuauserv
        1⤵
        • Launches sc.exe
        PID:1308

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si611358.exe

        Filesize

        176KB

        MD5

        b9b31e723583035633294169a7c114f4

        SHA1

        81fc639a1a056bb99e1253e122e5d8116cd7e36b

        SHA256

        223b50264cfd52440a77c9edc843418fc2a0d6d6f2b407711542d2bd03c75d87

        SHA512

        9ed4b45ff4cdd30b54ae01210f22d2f98d195220300ce2028f6d4a80ce7f26be252dabad0ae478ecfe67ff598f3dc0ddde65240bb0531ebba87e32b5ecf0ed69

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si611358.exe

        Filesize

        176KB

        MD5

        b9b31e723583035633294169a7c114f4

        SHA1

        81fc639a1a056bb99e1253e122e5d8116cd7e36b

        SHA256

        223b50264cfd52440a77c9edc843418fc2a0d6d6f2b407711542d2bd03c75d87

        SHA512

        9ed4b45ff4cdd30b54ae01210f22d2f98d195220300ce2028f6d4a80ce7f26be252dabad0ae478ecfe67ff598f3dc0ddde65240bb0531ebba87e32b5ecf0ed69

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un580426.exe

        Filesize

        517KB

        MD5

        be1967d55398afbf4563b6f0c31985d9

        SHA1

        d715d2608409cd8f9a2dcebb3cf0c66344113999

        SHA256

        2b0df1e353a80274e83e7e1326a0db2ce0073d58611e8d8b47018729cc6a7e16

        SHA512

        de6f3d5c7a5e0d811ae1652a9698931f79c7066d7eba8bd970871a751faae3bbe69a766cf3ad33364eec4bd7fb4de06962430bbed712504a7df6bc84c400f3d1

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un580426.exe

        Filesize

        517KB

        MD5

        be1967d55398afbf4563b6f0c31985d9

        SHA1

        d715d2608409cd8f9a2dcebb3cf0c66344113999

        SHA256

        2b0df1e353a80274e83e7e1326a0db2ce0073d58611e8d8b47018729cc6a7e16

        SHA512

        de6f3d5c7a5e0d811ae1652a9698931f79c7066d7eba8bd970871a751faae3bbe69a766cf3ad33364eec4bd7fb4de06962430bbed712504a7df6bc84c400f3d1

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8097.exe

        Filesize

        295KB

        MD5

        ba3c4c11cbe3bba85038223da43424f9

        SHA1

        4771246c35f4286e5f3be14d20931f04959ab882

        SHA256

        0838703b9438f7d1712a67d96b3d6664387f87d925f1d126826745e8b49c604f

        SHA512

        25bd1a9f6193d9f74bb58be7d95f36311667342fc7488f898fea444e109c28b3d1d883508c24f83e7f4fb567c46eb06853bb00ad5da12e6ccdf44ec974544f92

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8097.exe

        Filesize

        295KB

        MD5

        ba3c4c11cbe3bba85038223da43424f9

        SHA1

        4771246c35f4286e5f3be14d20931f04959ab882

        SHA256

        0838703b9438f7d1712a67d96b3d6664387f87d925f1d126826745e8b49c604f

        SHA512

        25bd1a9f6193d9f74bb58be7d95f36311667342fc7488f898fea444e109c28b3d1d883508c24f83e7f4fb567c46eb06853bb00ad5da12e6ccdf44ec974544f92

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9436.exe

        Filesize

        353KB

        MD5

        f06316fe91f2f828cca8ac13a055e09c

        SHA1

        13f63d26ddefd1a6fff113bd7018088634e9f014

        SHA256

        041b851de47c3608e1a9266770718ac5c8b4ce235edf9ef627fadcf205445ad8

        SHA512

        fbae5c3ac68f97dd4a586ff2e17130e731966888b91427a308ae57af4ed62b34b748c6ae3d139719677121e9474b542e3fbb8686d618e9a6714069fec9d37755

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9436.exe

        Filesize

        353KB

        MD5

        f06316fe91f2f828cca8ac13a055e09c

        SHA1

        13f63d26ddefd1a6fff113bd7018088634e9f014

        SHA256

        041b851de47c3608e1a9266770718ac5c8b4ce235edf9ef627fadcf205445ad8

        SHA512

        fbae5c3ac68f97dd4a586ff2e17130e731966888b91427a308ae57af4ed62b34b748c6ae3d139719677121e9474b542e3fbb8686d618e9a6714069fec9d37755

      • memory/868-148-0x0000000005040000-0x00000000055E4000-memory.dmp

        Filesize

        5.6MB

      • memory/868-149-0x0000000002320000-0x000000000234D000-memory.dmp

        Filesize

        180KB

      • memory/868-151-0x0000000005030000-0x0000000005040000-memory.dmp

        Filesize

        64KB

      • memory/868-152-0x0000000005030000-0x0000000005040000-memory.dmp

        Filesize

        64KB

      • memory/868-150-0x0000000005030000-0x0000000005040000-memory.dmp

        Filesize

        64KB

      • memory/868-153-0x0000000002800000-0x0000000002812000-memory.dmp

        Filesize

        72KB

      • memory/868-154-0x0000000002800000-0x0000000002812000-memory.dmp

        Filesize

        72KB

      • memory/868-156-0x0000000002800000-0x0000000002812000-memory.dmp

        Filesize

        72KB

      • memory/868-158-0x0000000002800000-0x0000000002812000-memory.dmp

        Filesize

        72KB

      • memory/868-160-0x0000000002800000-0x0000000002812000-memory.dmp

        Filesize

        72KB

      • memory/868-162-0x0000000002800000-0x0000000002812000-memory.dmp

        Filesize

        72KB

      • memory/868-164-0x0000000002800000-0x0000000002812000-memory.dmp

        Filesize

        72KB

      • memory/868-166-0x0000000002800000-0x0000000002812000-memory.dmp

        Filesize

        72KB

      • memory/868-168-0x0000000002800000-0x0000000002812000-memory.dmp

        Filesize

        72KB

      • memory/868-170-0x0000000002800000-0x0000000002812000-memory.dmp

        Filesize

        72KB

      • memory/868-172-0x0000000002800000-0x0000000002812000-memory.dmp

        Filesize

        72KB

      • memory/868-174-0x0000000002800000-0x0000000002812000-memory.dmp

        Filesize

        72KB

      • memory/868-176-0x0000000002800000-0x0000000002812000-memory.dmp

        Filesize

        72KB

      • memory/868-178-0x0000000002800000-0x0000000002812000-memory.dmp

        Filesize

        72KB

      • memory/868-180-0x0000000002800000-0x0000000002812000-memory.dmp

        Filesize

        72KB

      • memory/868-181-0x0000000000400000-0x00000000007FE000-memory.dmp

        Filesize

        4.0MB

      • memory/868-183-0x0000000005030000-0x0000000005040000-memory.dmp

        Filesize

        64KB

      • memory/868-184-0x0000000005030000-0x0000000005040000-memory.dmp

        Filesize

        64KB

      • memory/868-185-0x0000000005030000-0x0000000005040000-memory.dmp

        Filesize

        64KB

      • memory/868-186-0x0000000000400000-0x00000000007FE000-memory.dmp

        Filesize

        4.0MB

      • memory/4320-1123-0x00000000001C0000-0x00000000001F2000-memory.dmp

        Filesize

        200KB

      • memory/4320-1125-0x0000000004E20000-0x0000000004E30000-memory.dmp

        Filesize

        64KB

      • memory/4320-1124-0x0000000004E20000-0x0000000004E30000-memory.dmp

        Filesize

        64KB

      • memory/5040-194-0x0000000002A80000-0x0000000002ABF000-memory.dmp

        Filesize

        252KB

      • memory/5040-228-0x0000000002A80000-0x0000000002ABF000-memory.dmp

        Filesize

        252KB

      • memory/5040-198-0x0000000002A80000-0x0000000002ABF000-memory.dmp

        Filesize

        252KB

      • memory/5040-200-0x0000000002A80000-0x0000000002ABF000-memory.dmp

        Filesize

        252KB

      • memory/5040-202-0x0000000002A80000-0x0000000002ABF000-memory.dmp

        Filesize

        252KB

      • memory/5040-204-0x0000000002A80000-0x0000000002ABF000-memory.dmp

        Filesize

        252KB

      • memory/5040-206-0x0000000002A80000-0x0000000002ABF000-memory.dmp

        Filesize

        252KB

      • memory/5040-208-0x0000000002A80000-0x0000000002ABF000-memory.dmp

        Filesize

        252KB

      • memory/5040-210-0x0000000002A80000-0x0000000002ABF000-memory.dmp

        Filesize

        252KB

      • memory/5040-212-0x0000000002A80000-0x0000000002ABF000-memory.dmp

        Filesize

        252KB

      • memory/5040-214-0x0000000002A80000-0x0000000002ABF000-memory.dmp

        Filesize

        252KB

      • memory/5040-216-0x0000000002A80000-0x0000000002ABF000-memory.dmp

        Filesize

        252KB

      • memory/5040-219-0x0000000002470000-0x00000000024BB000-memory.dmp

        Filesize

        300KB

      • memory/5040-218-0x0000000002A80000-0x0000000002ABF000-memory.dmp

        Filesize

        252KB

      • memory/5040-222-0x0000000002A80000-0x0000000002ABF000-memory.dmp

        Filesize

        252KB

      • memory/5040-221-0x0000000004FA0000-0x0000000004FB0000-memory.dmp

        Filesize

        64KB

      • memory/5040-223-0x0000000004FA0000-0x0000000004FB0000-memory.dmp

        Filesize

        64KB

      • memory/5040-225-0x0000000004FA0000-0x0000000004FB0000-memory.dmp

        Filesize

        64KB

      • memory/5040-226-0x0000000002A80000-0x0000000002ABF000-memory.dmp

        Filesize

        252KB

      • memory/5040-196-0x0000000002A80000-0x0000000002ABF000-memory.dmp

        Filesize

        252KB

      • memory/5040-1101-0x00000000056A0000-0x0000000005CB8000-memory.dmp

        Filesize

        6.1MB

      • memory/5040-1102-0x0000000005D00000-0x0000000005E0A000-memory.dmp

        Filesize

        1.0MB

      • memory/5040-1103-0x0000000005E30000-0x0000000005E42000-memory.dmp

        Filesize

        72KB

      • memory/5040-1104-0x0000000004FA0000-0x0000000004FB0000-memory.dmp

        Filesize

        64KB

      • memory/5040-1105-0x0000000005E50000-0x0000000005E8C000-memory.dmp

        Filesize

        240KB

      • memory/5040-1106-0x0000000006140000-0x00000000061D2000-memory.dmp

        Filesize

        584KB

      • memory/5040-1107-0x00000000061E0000-0x0000000006246000-memory.dmp

        Filesize

        408KB

      • memory/5040-1109-0x0000000004FA0000-0x0000000004FB0000-memory.dmp

        Filesize

        64KB

      • memory/5040-1110-0x0000000004FA0000-0x0000000004FB0000-memory.dmp

        Filesize

        64KB

      • memory/5040-1111-0x0000000004FA0000-0x0000000004FB0000-memory.dmp

        Filesize

        64KB

      • memory/5040-1112-0x0000000004FA0000-0x0000000004FB0000-memory.dmp

        Filesize

        64KB

      • memory/5040-1113-0x0000000007BB0000-0x0000000007C26000-memory.dmp

        Filesize

        472KB

      • memory/5040-192-0x0000000002A80000-0x0000000002ABF000-memory.dmp

        Filesize

        252KB

      • memory/5040-191-0x0000000002A80000-0x0000000002ABF000-memory.dmp

        Filesize

        252KB

      • memory/5040-1114-0x0000000007C40000-0x0000000007C90000-memory.dmp

        Filesize

        320KB

      • memory/5040-1115-0x0000000007DE0000-0x0000000007FA2000-memory.dmp

        Filesize

        1.8MB

      • memory/5040-1116-0x0000000007FB0000-0x00000000084DC000-memory.dmp

        Filesize

        5.2MB