Analysis

  • max time kernel
    83s
  • max time network
    113s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-04-2023 22:22

General

  • Target

    6ac8403b2a50486af460bf68075d707f2a0c5be6e4e181d4af7b17411cf1cb69.exe

  • Size

    659KB

  • MD5

    1a481ef2fd43a06ba9b66fedc7caa015

  • SHA1

    23107057f21dfb2e1f808797f18b137aa21b3607

  • SHA256

    6ac8403b2a50486af460bf68075d707f2a0c5be6e4e181d4af7b17411cf1cb69

  • SHA512

    f1800f1e5336ad18aa3de75ae8c018b0d7471f581811a27663c198e608d7414dde5da619253f3f261ccf092d1ffb33d3e84a3b4fc5317837e51cab65bf75b0f2

  • SSDEEP

    12288:rMroy90z0+YKrIKz0gPVnazmIt597rw7VjCleUft/juynzbuCm:zyJUUKgyKmIt5FYVelFBfHC

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

spora

C2

176.113.115.145:4125

Attributes
  • auth_value

    441b39ab37774b2ca9931c31e1bc6071

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 19 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6ac8403b2a50486af460bf68075d707f2a0c5be6e4e181d4af7b17411cf1cb69.exe
    "C:\Users\Admin\AppData\Local\Temp\6ac8403b2a50486af460bf68075d707f2a0c5be6e4e181d4af7b17411cf1cb69.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3584
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un806287.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un806287.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4640
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0960.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0960.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:764
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 1084
          4⤵
          • Program crash
          PID:324
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1380.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1380.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3140
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 1816
          4⤵
          • Program crash
          PID:2348
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si164048.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si164048.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:952
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 764 -ip 764
    1⤵
      PID:208
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3140 -ip 3140
      1⤵
        PID:1136

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Persistence

      Modify Existing Service

      1
      T1031

      Registry Run Keys / Startup Folder

      1
      T1060

      Defense Evasion

      Modify Registry

      3
      T1112

      Disabling Security Tools

      2
      T1089

      Credential Access

      Credentials in Files

      2
      T1081

      Discovery

      Query Registry

      1
      T1012

      Collection

      Data from Local System

      2
      T1005

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si164048.exe
        Filesize

        175KB

        MD5

        0bfa2e7835b376934c1ca6ea595a1299

        SHA1

        d50dc9eee4109248f4d4cdcab2da5acee1952a42

        SHA256

        3c7621809818774a65a4485fd3a59aadcea0c8a3d79f50d428d76ae943909205

        SHA512

        b12c2fd4e4a48bbe7ad0b21ae669b38f23350261b78fa4d00ed6e08f044268071a88aac26c21fb621a55e33b515ed5c849e966c1c3e50a0c9013b34fda5c4442

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si164048.exe
        Filesize

        175KB

        MD5

        0bfa2e7835b376934c1ca6ea595a1299

        SHA1

        d50dc9eee4109248f4d4cdcab2da5acee1952a42

        SHA256

        3c7621809818774a65a4485fd3a59aadcea0c8a3d79f50d428d76ae943909205

        SHA512

        b12c2fd4e4a48bbe7ad0b21ae669b38f23350261b78fa4d00ed6e08f044268071a88aac26c21fb621a55e33b515ed5c849e966c1c3e50a0c9013b34fda5c4442

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un806287.exe
        Filesize

        517KB

        MD5

        4421c0ddacf18c8c9502b305bc43cfac

        SHA1

        4d8e171089cc3a581049f4f795814b5704f002a5

        SHA256

        5988e996757a2a38414d43cd3195656aa7d6a3a703fbc57febabd0c2866acc01

        SHA512

        b9d87890df7e3f81be5a7d36245307171dcc4ca1a0bfe05d8d4fd9b074aa7a25524c2f75b57932530b616001f6224943361628c1e61680308d16330dc2e4b4dc

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un806287.exe
        Filesize

        517KB

        MD5

        4421c0ddacf18c8c9502b305bc43cfac

        SHA1

        4d8e171089cc3a581049f4f795814b5704f002a5

        SHA256

        5988e996757a2a38414d43cd3195656aa7d6a3a703fbc57febabd0c2866acc01

        SHA512

        b9d87890df7e3f81be5a7d36245307171dcc4ca1a0bfe05d8d4fd9b074aa7a25524c2f75b57932530b616001f6224943361628c1e61680308d16330dc2e4b4dc

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0960.exe
        Filesize

        237KB

        MD5

        4c6259e56777c352c62fe5d314a5dafe

        SHA1

        37e1c20a08ca10d84e51d25886a035ef28a8d6d9

        SHA256

        0a46b7a0041298832a685e6b0d7d95ef23ca23f8627c6b0da00a09120f735e68

        SHA512

        28a785a5cf11dcc0ada7e8df3fc12c71cc7f03fcb4b4f6c9b2f0c6bd9ab3d09dea859bc6e12e0af8615bd944d5e17d48e68db9aedc2c277e4311f8e94548f09b

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0960.exe
        Filesize

        237KB

        MD5

        4c6259e56777c352c62fe5d314a5dafe

        SHA1

        37e1c20a08ca10d84e51d25886a035ef28a8d6d9

        SHA256

        0a46b7a0041298832a685e6b0d7d95ef23ca23f8627c6b0da00a09120f735e68

        SHA512

        28a785a5cf11dcc0ada7e8df3fc12c71cc7f03fcb4b4f6c9b2f0c6bd9ab3d09dea859bc6e12e0af8615bd944d5e17d48e68db9aedc2c277e4311f8e94548f09b

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1380.exe
        Filesize

        295KB

        MD5

        c6e4ecf146e38c932c80eed7ad962626

        SHA1

        d210a35aaaf712283f98b5b1931da5be5ed6668f

        SHA256

        1aa172aae359af42c1417591f1cfc95f53ae342186038d9d04ad46a32f77b292

        SHA512

        3588d2388d683e5f13ca79b7994e72494f84aab94ead21f1378efe4db471018f8c46d61ebd69fbb9ced542487df70ba68abe8fb01073e765e23234ff69e5214a

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1380.exe
        Filesize

        295KB

        MD5

        c6e4ecf146e38c932c80eed7ad962626

        SHA1

        d210a35aaaf712283f98b5b1931da5be5ed6668f

        SHA256

        1aa172aae359af42c1417591f1cfc95f53ae342186038d9d04ad46a32f77b292

        SHA512

        3588d2388d683e5f13ca79b7994e72494f84aab94ead21f1378efe4db471018f8c46d61ebd69fbb9ced542487df70ba68abe8fb01073e765e23234ff69e5214a

      • memory/764-148-0x0000000000650000-0x000000000067D000-memory.dmp
        Filesize

        180KB

      • memory/764-149-0x0000000004B70000-0x0000000004B80000-memory.dmp
        Filesize

        64KB

      • memory/764-150-0x0000000004B70000-0x0000000004B80000-memory.dmp
        Filesize

        64KB

      • memory/764-151-0x0000000004B80000-0x0000000005124000-memory.dmp
        Filesize

        5.6MB

      • memory/764-152-0x0000000002460000-0x0000000002472000-memory.dmp
        Filesize

        72KB

      • memory/764-153-0x0000000002460000-0x0000000002472000-memory.dmp
        Filesize

        72KB

      • memory/764-155-0x0000000002460000-0x0000000002472000-memory.dmp
        Filesize

        72KB

      • memory/764-157-0x0000000002460000-0x0000000002472000-memory.dmp
        Filesize

        72KB

      • memory/764-159-0x0000000002460000-0x0000000002472000-memory.dmp
        Filesize

        72KB

      • memory/764-161-0x0000000002460000-0x0000000002472000-memory.dmp
        Filesize

        72KB

      • memory/764-163-0x0000000002460000-0x0000000002472000-memory.dmp
        Filesize

        72KB

      • memory/764-165-0x0000000002460000-0x0000000002472000-memory.dmp
        Filesize

        72KB

      • memory/764-167-0x0000000002460000-0x0000000002472000-memory.dmp
        Filesize

        72KB

      • memory/764-169-0x0000000002460000-0x0000000002472000-memory.dmp
        Filesize

        72KB

      • memory/764-173-0x0000000002460000-0x0000000002472000-memory.dmp
        Filesize

        72KB

      • memory/764-171-0x0000000002460000-0x0000000002472000-memory.dmp
        Filesize

        72KB

      • memory/764-175-0x0000000002460000-0x0000000002472000-memory.dmp
        Filesize

        72KB

      • memory/764-177-0x0000000002460000-0x0000000002472000-memory.dmp
        Filesize

        72KB

      • memory/764-179-0x0000000002460000-0x0000000002472000-memory.dmp
        Filesize

        72KB

      • memory/764-180-0x0000000000400000-0x00000000004A9000-memory.dmp
        Filesize

        676KB

      • memory/764-181-0x0000000004B70000-0x0000000004B80000-memory.dmp
        Filesize

        64KB

      • memory/764-183-0x0000000000400000-0x00000000004A9000-memory.dmp
        Filesize

        676KB

      • memory/952-1119-0x0000000000750000-0x0000000000782000-memory.dmp
        Filesize

        200KB

      • memory/952-1121-0x0000000005380000-0x0000000005390000-memory.dmp
        Filesize

        64KB

      • memory/952-1120-0x0000000005380000-0x0000000005390000-memory.dmp
        Filesize

        64KB

      • memory/3140-195-0x0000000002660000-0x000000000269F000-memory.dmp
        Filesize

        252KB

      • memory/3140-222-0x0000000002660000-0x000000000269F000-memory.dmp
        Filesize

        252KB

      • memory/3140-197-0x0000000002660000-0x000000000269F000-memory.dmp
        Filesize

        252KB

      • memory/3140-199-0x0000000002660000-0x000000000269F000-memory.dmp
        Filesize

        252KB

      • memory/3140-193-0x0000000002660000-0x000000000269F000-memory.dmp
        Filesize

        252KB

      • memory/3140-201-0x0000000002660000-0x000000000269F000-memory.dmp
        Filesize

        252KB

      • memory/3140-203-0x0000000002660000-0x000000000269F000-memory.dmp
        Filesize

        252KB

      • memory/3140-205-0x0000000002660000-0x000000000269F000-memory.dmp
        Filesize

        252KB

      • memory/3140-207-0x0000000002660000-0x000000000269F000-memory.dmp
        Filesize

        252KB

      • memory/3140-209-0x0000000002660000-0x000000000269F000-memory.dmp
        Filesize

        252KB

      • memory/3140-211-0x0000000002010000-0x000000000205B000-memory.dmp
        Filesize

        300KB

      • memory/3140-213-0x00000000026B0000-0x00000000026C0000-memory.dmp
        Filesize

        64KB

      • memory/3140-215-0x00000000026B0000-0x00000000026C0000-memory.dmp
        Filesize

        64KB

      • memory/3140-212-0x0000000002660000-0x000000000269F000-memory.dmp
        Filesize

        252KB

      • memory/3140-216-0x0000000002660000-0x000000000269F000-memory.dmp
        Filesize

        252KB

      • memory/3140-220-0x0000000002660000-0x000000000269F000-memory.dmp
        Filesize

        252KB

      • memory/3140-218-0x0000000002660000-0x000000000269F000-memory.dmp
        Filesize

        252KB

      • memory/3140-191-0x0000000002660000-0x000000000269F000-memory.dmp
        Filesize

        252KB

      • memory/3140-224-0x0000000002660000-0x000000000269F000-memory.dmp
        Filesize

        252KB

      • memory/3140-1097-0x0000000005200000-0x0000000005818000-memory.dmp
        Filesize

        6.1MB

      • memory/3140-1098-0x00000000058A0000-0x00000000059AA000-memory.dmp
        Filesize

        1.0MB

      • memory/3140-1100-0x00000000059E0000-0x00000000059F2000-memory.dmp
        Filesize

        72KB

      • memory/3140-1101-0x00000000026B0000-0x00000000026C0000-memory.dmp
        Filesize

        64KB

      • memory/3140-1102-0x00000000026B0000-0x00000000026C0000-memory.dmp
        Filesize

        64KB

      • memory/3140-1103-0x00000000026B0000-0x00000000026C0000-memory.dmp
        Filesize

        64KB

      • memory/3140-1104-0x00000000026B0000-0x00000000026C0000-memory.dmp
        Filesize

        64KB

      • memory/3140-1105-0x0000000005A00000-0x0000000005A3C000-memory.dmp
        Filesize

        240KB

      • memory/3140-1106-0x0000000005CF0000-0x0000000005D56000-memory.dmp
        Filesize

        408KB

      • memory/3140-1108-0x00000000063A0000-0x0000000006432000-memory.dmp
        Filesize

        584KB

      • memory/3140-1109-0x0000000006490000-0x0000000006506000-memory.dmp
        Filesize

        472KB

      • memory/3140-1110-0x0000000006520000-0x0000000006570000-memory.dmp
        Filesize

        320KB

      • memory/3140-189-0x0000000002660000-0x000000000269F000-memory.dmp
        Filesize

        252KB

      • memory/3140-188-0x0000000002660000-0x000000000269F000-memory.dmp
        Filesize

        252KB

      • memory/3140-1111-0x00000000026B0000-0x00000000026C0000-memory.dmp
        Filesize

        64KB

      • memory/3140-1112-0x0000000007940000-0x0000000007B02000-memory.dmp
        Filesize

        1.8MB

      • memory/3140-1113-0x0000000007B20000-0x000000000804C000-memory.dmp
        Filesize

        5.2MB