Analysis

  • max time kernel
    66s
  • max time network
    133s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    03-04-2023 22:21

General

  • Target

    75bad185db0babe768a5d9bfe77b978f0b00bbc9d7ff2c04250907aef7326dda.exe

  • Size

    660KB

  • MD5

    7568f4d7e1e254c3df16423fb3333571

  • SHA1

    99b3d6ac329c78247183550c9af4c15be8ff1a2b

  • SHA256

    75bad185db0babe768a5d9bfe77b978f0b00bbc9d7ff2c04250907aef7326dda

  • SHA512

    387cc0cfcb085aea86bb58032c8bee85a9d64af0f4b539874b39aa803aabd3448a3f21438473832da353a3079f29736f7e4f8494b9de72cb39b03d095bd1cdaf

  • SSDEEP

    12288:iMrQy90TmxBo7cmdx4QOvIeVnQK0iBr0uCFn0ft/juO31ET:uyk77cix4ndQniO/F0Bp6T

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

spora

C2

176.113.115.145:4125

Attributes
  • auth_value

    441b39ab37774b2ca9931c31e1bc6071

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\75bad185db0babe768a5d9bfe77b978f0b00bbc9d7ff2c04250907aef7326dda.exe
    "C:\Users\Admin\AppData\Local\Temp\75bad185db0babe768a5d9bfe77b978f0b00bbc9d7ff2c04250907aef7326dda.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2056
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un088060.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un088060.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2440
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1464.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1464.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2676
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8402.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8402.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1764
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si895242.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si895242.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3552

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

3
T1112

Disabling Security Tools

2
T1089

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si895242.exe
    Filesize

    175KB

    MD5

    815f6e513e618b60ed846b412b42d66d

    SHA1

    631d356c06d562be6f68dd674bf85f2355146e03

    SHA256

    d782cfe11dcdec594fbeddff45f6b87daa1db1685bcb43da73f244e3006e12a4

    SHA512

    99543bd4a822254a2cb4891a78e2acd7f411212fd7f8442e96c145cef37e35e611ecf6358404a44898c3bc620d61ac40ad67558e5ccaca474099e882b6b58693

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si895242.exe
    Filesize

    175KB

    MD5

    815f6e513e618b60ed846b412b42d66d

    SHA1

    631d356c06d562be6f68dd674bf85f2355146e03

    SHA256

    d782cfe11dcdec594fbeddff45f6b87daa1db1685bcb43da73f244e3006e12a4

    SHA512

    99543bd4a822254a2cb4891a78e2acd7f411212fd7f8442e96c145cef37e35e611ecf6358404a44898c3bc620d61ac40ad67558e5ccaca474099e882b6b58693

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un088060.exe
    Filesize

    517KB

    MD5

    6fac5eb94b862326e53859d63fe491f3

    SHA1

    0d05a67cc2afff68f467d35ea14423eae445cd98

    SHA256

    bdeeb1516648bf36986b43530cb30d9d0b0f467161bb6e65ac074f297667ed21

    SHA512

    f43ffbbbb9ea7429d931774c9a3ae69ec1be224cdb50011892599dab1a637844d0dc0097ee1fbb029fa9916d2701e3441fe4cc07948d641542f917b5b3f96ea1

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un088060.exe
    Filesize

    517KB

    MD5

    6fac5eb94b862326e53859d63fe491f3

    SHA1

    0d05a67cc2afff68f467d35ea14423eae445cd98

    SHA256

    bdeeb1516648bf36986b43530cb30d9d0b0f467161bb6e65ac074f297667ed21

    SHA512

    f43ffbbbb9ea7429d931774c9a3ae69ec1be224cdb50011892599dab1a637844d0dc0097ee1fbb029fa9916d2701e3441fe4cc07948d641542f917b5b3f96ea1

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1464.exe
    Filesize

    237KB

    MD5

    c3e0a7523fb4124700e918fc2a413012

    SHA1

    61008c5dd028c62f428b62423b8df3154b509101

    SHA256

    f2ef6a766f2a88d4d26f3ad8478ba1b6871b444256a0b88a31528f577bcd99a9

    SHA512

    2a1291b08d1eabef8a50cd2ac886658c5fb7ebbb2307984e7ffb0d7999871a9e8c767c330e757ed14a8cb5913ad8df34abc917f3a9825703f7f2e7debc89e6c8

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1464.exe
    Filesize

    237KB

    MD5

    c3e0a7523fb4124700e918fc2a413012

    SHA1

    61008c5dd028c62f428b62423b8df3154b509101

    SHA256

    f2ef6a766f2a88d4d26f3ad8478ba1b6871b444256a0b88a31528f577bcd99a9

    SHA512

    2a1291b08d1eabef8a50cd2ac886658c5fb7ebbb2307984e7ffb0d7999871a9e8c767c330e757ed14a8cb5913ad8df34abc917f3a9825703f7f2e7debc89e6c8

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8402.exe
    Filesize

    295KB

    MD5

    03c4a4ea3b2a95ca36943eccf8d2cdaf

    SHA1

    75862c329009cab4950599874a3e8d5e59826f83

    SHA256

    2257f7e6de437a450ed1dca9bb2362087975c81e5caffb28cf8da16704b6f9a3

    SHA512

    f980cbc3cd1347983d2d6153ab4a2c04bda8bff37a8d95b6a76e2ed1dc80c858c27f878939eff9d2f8525992a205e41a4374f2a8bca3c9f892bd2179ad060c79

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8402.exe
    Filesize

    295KB

    MD5

    03c4a4ea3b2a95ca36943eccf8d2cdaf

    SHA1

    75862c329009cab4950599874a3e8d5e59826f83

    SHA256

    2257f7e6de437a450ed1dca9bb2362087975c81e5caffb28cf8da16704b6f9a3

    SHA512

    f980cbc3cd1347983d2d6153ab4a2c04bda8bff37a8d95b6a76e2ed1dc80c858c27f878939eff9d2f8525992a205e41a4374f2a8bca3c9f892bd2179ad060c79

  • memory/1764-1093-0x0000000005070000-0x0000000005676000-memory.dmp
    Filesize

    6.0MB

  • memory/1764-221-0x0000000004B60000-0x0000000004B70000-memory.dmp
    Filesize

    64KB

  • memory/1764-1109-0x0000000006750000-0x0000000006C7C000-memory.dmp
    Filesize

    5.2MB

  • memory/1764-1108-0x0000000006580000-0x0000000006742000-memory.dmp
    Filesize

    1.8MB

  • memory/1764-1107-0x0000000006520000-0x0000000006570000-memory.dmp
    Filesize

    320KB

  • memory/1764-198-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/1764-1106-0x0000000006490000-0x0000000006506000-memory.dmp
    Filesize

    472KB

  • memory/1764-1105-0x0000000004B60000-0x0000000004B70000-memory.dmp
    Filesize

    64KB

  • memory/1764-1104-0x0000000005B40000-0x0000000005BA6000-memory.dmp
    Filesize

    408KB

  • memory/1764-1103-0x0000000005AA0000-0x0000000005B32000-memory.dmp
    Filesize

    584KB

  • memory/1764-200-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/1764-1101-0x0000000004B60000-0x0000000004B70000-memory.dmp
    Filesize

    64KB

  • memory/1764-1102-0x0000000004B60000-0x0000000004B70000-memory.dmp
    Filesize

    64KB

  • memory/1764-1100-0x0000000004B60000-0x0000000004B70000-memory.dmp
    Filesize

    64KB

  • memory/1764-1098-0x0000000005910000-0x000000000595B000-memory.dmp
    Filesize

    300KB

  • memory/1764-1097-0x0000000004B60000-0x0000000004B70000-memory.dmp
    Filesize

    64KB

  • memory/1764-1096-0x00000000057C0000-0x00000000057FE000-memory.dmp
    Filesize

    248KB

  • memory/1764-1095-0x00000000057A0000-0x00000000057B2000-memory.dmp
    Filesize

    72KB

  • memory/1764-1094-0x0000000005680000-0x000000000578A000-memory.dmp
    Filesize

    1.0MB

  • memory/1764-208-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/1764-223-0x0000000004B60000-0x0000000004B70000-memory.dmp
    Filesize

    64KB

  • memory/1764-219-0x0000000004B60000-0x0000000004B70000-memory.dmp
    Filesize

    64KB

  • memory/1764-216-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/1764-217-0x0000000000590000-0x00000000005DB000-memory.dmp
    Filesize

    300KB

  • memory/1764-214-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/1764-181-0x00000000024E0000-0x0000000002526000-memory.dmp
    Filesize

    280KB

  • memory/1764-182-0x0000000004A60000-0x0000000004AA4000-memory.dmp
    Filesize

    272KB

  • memory/1764-183-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/1764-184-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/1764-196-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/1764-188-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/1764-190-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/1764-192-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/1764-194-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/1764-186-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/1764-212-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/1764-210-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/1764-204-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/1764-206-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/1764-202-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/2676-171-0x0000000000400000-0x00000000004A9000-memory.dmp
    Filesize

    676KB

  • memory/2676-156-0x0000000000910000-0x0000000000922000-memory.dmp
    Filesize

    72KB

  • memory/2676-146-0x0000000000910000-0x0000000000922000-memory.dmp
    Filesize

    72KB

  • memory/2676-139-0x0000000004CA0000-0x000000000519E000-memory.dmp
    Filesize

    5.0MB

  • memory/2676-140-0x0000000000910000-0x0000000000928000-memory.dmp
    Filesize

    96KB

  • memory/2676-176-0x0000000000400000-0x00000000004A9000-memory.dmp
    Filesize

    676KB

  • memory/2676-174-0x0000000004C90000-0x0000000004CA0000-memory.dmp
    Filesize

    64KB

  • memory/2676-173-0x0000000004C90000-0x0000000004CA0000-memory.dmp
    Filesize

    64KB

  • memory/2676-172-0x0000000004C90000-0x0000000004CA0000-memory.dmp
    Filesize

    64KB

  • memory/2676-138-0x0000000004C90000-0x0000000004CA0000-memory.dmp
    Filesize

    64KB

  • memory/2676-141-0x0000000004C90000-0x0000000004CA0000-memory.dmp
    Filesize

    64KB

  • memory/2676-170-0x0000000000910000-0x0000000000922000-memory.dmp
    Filesize

    72KB

  • memory/2676-168-0x0000000000910000-0x0000000000922000-memory.dmp
    Filesize

    72KB

  • memory/2676-166-0x0000000000910000-0x0000000000922000-memory.dmp
    Filesize

    72KB

  • memory/2676-164-0x0000000000910000-0x0000000000922000-memory.dmp
    Filesize

    72KB

  • memory/2676-162-0x0000000000910000-0x0000000000922000-memory.dmp
    Filesize

    72KB

  • memory/2676-160-0x0000000000910000-0x0000000000922000-memory.dmp
    Filesize

    72KB

  • memory/2676-158-0x0000000000910000-0x0000000000922000-memory.dmp
    Filesize

    72KB

  • memory/2676-154-0x0000000000910000-0x0000000000922000-memory.dmp
    Filesize

    72KB

  • memory/2676-152-0x0000000000910000-0x0000000000922000-memory.dmp
    Filesize

    72KB

  • memory/2676-148-0x0000000000910000-0x0000000000922000-memory.dmp
    Filesize

    72KB

  • memory/2676-150-0x0000000000910000-0x0000000000922000-memory.dmp
    Filesize

    72KB

  • memory/2676-144-0x0000000000910000-0x0000000000922000-memory.dmp
    Filesize

    72KB

  • memory/2676-143-0x0000000000910000-0x0000000000922000-memory.dmp
    Filesize

    72KB

  • memory/2676-142-0x0000000004C90000-0x0000000004CA0000-memory.dmp
    Filesize

    64KB

  • memory/2676-137-0x0000000000860000-0x000000000087A000-memory.dmp
    Filesize

    104KB

  • memory/2676-136-0x00000000001D0000-0x00000000001FD000-memory.dmp
    Filesize

    180KB

  • memory/3552-1115-0x0000000000C10000-0x0000000000C42000-memory.dmp
    Filesize

    200KB

  • memory/3552-1116-0x0000000005790000-0x00000000057A0000-memory.dmp
    Filesize

    64KB

  • memory/3552-1117-0x0000000005650000-0x000000000569B000-memory.dmp
    Filesize

    300KB