Analysis
-
max time kernel
52s -
max time network
67s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
02/04/2023, 14:01
General
-
Target
dad02fe38f925593d8a5e3d2e4ac138ff0405a0b4d9822a8b2e849c1a9c08e5f.exe
-
Size
537KB
-
MD5
e66ee31a526e68915941cb6d51b8313d
-
SHA1
7bb12f61dc434348a5a6c529fde2e02d2e56eecf
-
SHA256
dad02fe38f925593d8a5e3d2e4ac138ff0405a0b4d9822a8b2e849c1a9c08e5f
-
SHA512
ee9132de777d2d856372388968ccda088e7ab9edefdac3bc59ab5ba0ebf1ca76d38d7c640489e9970ce25a0fbbc32ba9e96645f93be4a782654a5f136189247e
-
SSDEEP
12288:gMrjy90+qd/P7z3zzRGWjELfAkRSw0tUwaprRe1ARmzqDLsjW:zyGH7z3zzoENaprRe1Bz03
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
-
Executes dropped EXE 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 1 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dad02fe38f925593d8a5e3d2e4ac138ff0405a0b4d9822a8b2e849c1a9c08e5f.exe"C:\Users\Admin\AppData\Local\Temp\dad02fe38f925593d8a5e3d2e4ac138ff0405a0b4d9822a8b2e849c1a9c08e5f.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziQv6283.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziQv6283.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr065771.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr065771.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku478877.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku478877.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr573893.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr573893.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD52b1e8e34e4a599595b1782e50b63a353
SHA1a45ac2618842ef9318b151d7d6a7982dc20a1ebf
SHA25655d3852c8108199496a86da98736d0b3dc14f514e9ed590c24dfbf460978aa2f
SHA5129625ba64a124ede3f751693ee4c907e747e7d1433936ca9ab9fa06464070d6d7447a47ecc18f92b6a1a63605883ce5ee09646f88e2d2715f7cfd76d678f4971c
-
Filesize
175KB
MD52b1e8e34e4a599595b1782e50b63a353
SHA1a45ac2618842ef9318b151d7d6a7982dc20a1ebf
SHA25655d3852c8108199496a86da98736d0b3dc14f514e9ed590c24dfbf460978aa2f
SHA5129625ba64a124ede3f751693ee4c907e747e7d1433936ca9ab9fa06464070d6d7447a47ecc18f92b6a1a63605883ce5ee09646f88e2d2715f7cfd76d678f4971c
-
Filesize
395KB
MD59a8fbc9bd25c47697dbead69c5911e53
SHA1c55db5e1f575181167c5bac59b16f9a1ccb52281
SHA2568d93f89c36cbb91b72e8af2f22bdc3e69490c98c28d622b9998edbec13c73b94
SHA51261463d265f8ec1a66194ae44ed99ef9d1031bb79a63a37c413bfea704c375b0f8c35ea933f95043c483b56cbe1e730bfeb3c2fa093ba9acc7a27b774990b42f4
-
Filesize
395KB
MD59a8fbc9bd25c47697dbead69c5911e53
SHA1c55db5e1f575181167c5bac59b16f9a1ccb52281
SHA2568d93f89c36cbb91b72e8af2f22bdc3e69490c98c28d622b9998edbec13c73b94
SHA51261463d265f8ec1a66194ae44ed99ef9d1031bb79a63a37c413bfea704c375b0f8c35ea933f95043c483b56cbe1e730bfeb3c2fa093ba9acc7a27b774990b42f4
-
Filesize
13KB
MD5757c6bced6602de05ee92c180ca2b7ab
SHA169e65c2f44a3cd5f38c7f541e75a1ef8c302b67c
SHA256a76589c3b7bc5645ef4255650879f2ccea2c65d7f69eb11b77b27417d4fa20a9
SHA512858b83c68b61a0180e91d832e5b1082b36ba1e4e12f01c355cd54e6846e5445a3ac4f8856b8dbf2bc03de6ee01c82e661eda1e4949dc14b0714ca36e4e8f5e4b
-
Filesize
13KB
MD5757c6bced6602de05ee92c180ca2b7ab
SHA169e65c2f44a3cd5f38c7f541e75a1ef8c302b67c
SHA256a76589c3b7bc5645ef4255650879f2ccea2c65d7f69eb11b77b27417d4fa20a9
SHA512858b83c68b61a0180e91d832e5b1082b36ba1e4e12f01c355cd54e6846e5445a3ac4f8856b8dbf2bc03de6ee01c82e661eda1e4949dc14b0714ca36e4e8f5e4b
-
Filesize
353KB
MD5df12e4230e7faa8eeb29697fc5ca2ac2
SHA11e30ea37c14a3fd5600ee8a436e9f0e004c5b9df
SHA256a412882dd594587d05b9d5304906367e32d2fb5e129bc403601586724409d33c
SHA512378c26b02d4667c1db36112536f59f40a864a7e617b8f28c85d5bb7333116606b28b28d38eebc982048337371c3ab85a4149564fc8977bdc6d33da1b8e1f0031
-
Filesize
353KB
MD5df12e4230e7faa8eeb29697fc5ca2ac2
SHA11e30ea37c14a3fd5600ee8a436e9f0e004c5b9df
SHA256a412882dd594587d05b9d5304906367e32d2fb5e129bc403601586724409d33c
SHA512378c26b02d4667c1db36112536f59f40a864a7e617b8f28c85d5bb7333116606b28b28d38eebc982048337371c3ab85a4149564fc8977bdc6d33da1b8e1f0031
-
Filesize
280KB
-
Filesize
5.0MB
-
Filesize
272KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
6.0MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
248KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
472KB
-
Filesize
320KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
200KB
-
Filesize
300KB
-
Filesize
64KB