Analysis

  • max time kernel
    53s
  • max time network
    74s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    03-04-2023 22:26

General

  • Target

    8bfa84d952ad70b90a3ac352c80949b83dc4af1ab5571ec9774f00ce41f965c5.exe

  • Size

    660KB

  • MD5

    857e34f22dbe32e8f9046bda15a877c0

  • SHA1

    4dfc57646d790022c83bd6bda1d927896d4fd321

  • SHA256

    8bfa84d952ad70b90a3ac352c80949b83dc4af1ab5571ec9774f00ce41f965c5

  • SHA512

    910e09ae93b5279e5d4d7bd4da5d66e70828cf1de8e1f158498bcb2c0a03c78a6605aefa16b0721dbc385ed5026134ca908ba69cec9c5cfa9c1e34e79a5b2b97

  • SSDEEP

    12288:6MrOy90eMaqSuy/rYKQhfCltnN8PnXzlIUlifyoQCFvAft/juH/+ySA:QyEa9uyUMtN4XinrdFIB+/+yD

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

spora

C2

176.113.115.145:4125

Attributes
  • auth_value

    441b39ab37774b2ca9931c31e1bc6071

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 21 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8bfa84d952ad70b90a3ac352c80949b83dc4af1ab5571ec9774f00ce41f965c5.exe
    "C:\Users\Admin\AppData\Local\Temp\8bfa84d952ad70b90a3ac352c80949b83dc4af1ab5571ec9774f00ce41f965c5.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4048
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un147691.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un147691.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4036
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6457.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6457.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2088
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5958.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5958.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1140
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si762094.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si762094.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4496

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

3
T1112

Disabling Security Tools

2
T1089

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si762094.exe
    Filesize

    175KB

    MD5

    a7ffa1429f6f6f1b7fc982eda01341e0

    SHA1

    758ec26f7adcb1ebf527439d4b889f85406e37dd

    SHA256

    7635291dc41b028f951409d86af737b47dfc2422829637a5394b18b61222a14c

    SHA512

    b9d10ec62a57cda6b43a65ffe0c93cf6e7608be213535d8086c5169c7a448dd298986e34961f9279b5aa122d056d22197098a92b82d737bd3d860688bbf6c269

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si762094.exe
    Filesize

    175KB

    MD5

    a7ffa1429f6f6f1b7fc982eda01341e0

    SHA1

    758ec26f7adcb1ebf527439d4b889f85406e37dd

    SHA256

    7635291dc41b028f951409d86af737b47dfc2422829637a5394b18b61222a14c

    SHA512

    b9d10ec62a57cda6b43a65ffe0c93cf6e7608be213535d8086c5169c7a448dd298986e34961f9279b5aa122d056d22197098a92b82d737bd3d860688bbf6c269

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un147691.exe
    Filesize

    517KB

    MD5

    febcd113b20d59157f9b7fba64932fb8

    SHA1

    33fb29fc980360d847e57b5ec86235e8db2e3d7d

    SHA256

    41433b498eae7254bc7971fb58183adaccf0a8cfdf64acc03c24dcff3a10e939

    SHA512

    6a185515b5dc615a1e4e43db6fd11ae6b3aacf2e02797f5b320bddea17fc17df24089adbba8bb5f4d74a8c61d5e36ce82405578c932a00ff6ddb658d43bc03c4

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un147691.exe
    Filesize

    517KB

    MD5

    febcd113b20d59157f9b7fba64932fb8

    SHA1

    33fb29fc980360d847e57b5ec86235e8db2e3d7d

    SHA256

    41433b498eae7254bc7971fb58183adaccf0a8cfdf64acc03c24dcff3a10e939

    SHA512

    6a185515b5dc615a1e4e43db6fd11ae6b3aacf2e02797f5b320bddea17fc17df24089adbba8bb5f4d74a8c61d5e36ce82405578c932a00ff6ddb658d43bc03c4

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6457.exe
    Filesize

    237KB

    MD5

    9fd656b7cb57b6c9cd5a1bb187663b32

    SHA1

    e4b27789dfd2dd54280a5a7768de2b21fdcce357

    SHA256

    b831c7895fbf2d6cbe98435cc75ec6cfa532d2e1dafe0a85db4c7c03a64d0ceb

    SHA512

    c778ceba3578ded7cafab08427cb1bb62d8127062ddb40bcade6ee47e090083875f642440b74613a672db243f4df03ccadd9573e77ef4e2049451f9f95ea782a

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6457.exe
    Filesize

    237KB

    MD5

    9fd656b7cb57b6c9cd5a1bb187663b32

    SHA1

    e4b27789dfd2dd54280a5a7768de2b21fdcce357

    SHA256

    b831c7895fbf2d6cbe98435cc75ec6cfa532d2e1dafe0a85db4c7c03a64d0ceb

    SHA512

    c778ceba3578ded7cafab08427cb1bb62d8127062ddb40bcade6ee47e090083875f642440b74613a672db243f4df03ccadd9573e77ef4e2049451f9f95ea782a

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5958.exe
    Filesize

    295KB

    MD5

    d96b5d103a5c26afa358a46e68fe3996

    SHA1

    e1f00a11b1265faf7684f062ebba858d85d56565

    SHA256

    912d959605b529c35abf94813f5da5cb7c8d28378e251169c37650832afa2fce

    SHA512

    1a433773e9fabb14faaa0a4ac8b5637d1fa17c1fcacc6f4ae9a97a2c76b213b9d56a7b16128eb004f4a1ecdde5b96b2623c4a614831fee55252a8de393ac4fe3

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5958.exe
    Filesize

    295KB

    MD5

    d96b5d103a5c26afa358a46e68fe3996

    SHA1

    e1f00a11b1265faf7684f062ebba858d85d56565

    SHA256

    912d959605b529c35abf94813f5da5cb7c8d28378e251169c37650832afa2fce

    SHA512

    1a433773e9fabb14faaa0a4ac8b5637d1fa17c1fcacc6f4ae9a97a2c76b213b9d56a7b16128eb004f4a1ecdde5b96b2623c4a614831fee55252a8de393ac4fe3

  • memory/1140-1092-0x00000000058E0000-0x00000000058F2000-memory.dmp
    Filesize

    72KB

  • memory/1140-1093-0x0000000004A80000-0x0000000004A90000-memory.dmp
    Filesize

    64KB

  • memory/1140-1106-0x0000000004A80000-0x0000000004A90000-memory.dmp
    Filesize

    64KB

  • memory/1140-1105-0x0000000006650000-0x0000000006B7C000-memory.dmp
    Filesize

    5.2MB

  • memory/1140-1104-0x0000000006480000-0x0000000006642000-memory.dmp
    Filesize

    1.8MB

  • memory/1140-1103-0x00000000063F0000-0x0000000006440000-memory.dmp
    Filesize

    320KB

  • memory/1140-1102-0x0000000006360000-0x00000000063D6000-memory.dmp
    Filesize

    472KB

  • memory/1140-1101-0x00000000062A0000-0x0000000006332000-memory.dmp
    Filesize

    584KB

  • memory/1140-1099-0x0000000004A80000-0x0000000004A90000-memory.dmp
    Filesize

    64KB

  • memory/1140-1100-0x0000000004A80000-0x0000000004A90000-memory.dmp
    Filesize

    64KB

  • memory/1140-1098-0x0000000004A80000-0x0000000004A90000-memory.dmp
    Filesize

    64KB

  • memory/1140-1097-0x0000000005BE0000-0x0000000005C46000-memory.dmp
    Filesize

    408KB

  • memory/1140-1095-0x0000000005A50000-0x0000000005A9B000-memory.dmp
    Filesize

    300KB

  • memory/1140-195-0x0000000004A30000-0x0000000004A6F000-memory.dmp
    Filesize

    252KB

  • memory/1140-1094-0x0000000005900000-0x000000000593E000-memory.dmp
    Filesize

    248KB

  • memory/1140-1091-0x00000000057A0000-0x00000000058AA000-memory.dmp
    Filesize

    1.0MB

  • memory/1140-1090-0x0000000005110000-0x0000000005716000-memory.dmp
    Filesize

    6.0MB

  • memory/1140-217-0x0000000004A30000-0x0000000004A6F000-memory.dmp
    Filesize

    252KB

  • memory/1140-215-0x0000000004A30000-0x0000000004A6F000-memory.dmp
    Filesize

    252KB

  • memory/1140-213-0x0000000004A30000-0x0000000004A6F000-memory.dmp
    Filesize

    252KB

  • memory/1140-211-0x0000000004A30000-0x0000000004A6F000-memory.dmp
    Filesize

    252KB

  • memory/1140-209-0x0000000004A30000-0x0000000004A6F000-memory.dmp
    Filesize

    252KB

  • memory/1140-207-0x0000000004A30000-0x0000000004A6F000-memory.dmp
    Filesize

    252KB

  • memory/1140-178-0x00000000049B0000-0x00000000049F6000-memory.dmp
    Filesize

    280KB

  • memory/1140-193-0x0000000004A80000-0x0000000004A90000-memory.dmp
    Filesize

    64KB

  • memory/1140-180-0x0000000004A30000-0x0000000004A6F000-memory.dmp
    Filesize

    252KB

  • memory/1140-181-0x0000000004A30000-0x0000000004A6F000-memory.dmp
    Filesize

    252KB

  • memory/1140-183-0x0000000004A30000-0x0000000004A6F000-memory.dmp
    Filesize

    252KB

  • memory/1140-185-0x0000000004A30000-0x0000000004A6F000-memory.dmp
    Filesize

    252KB

  • memory/1140-187-0x0000000004A30000-0x0000000004A6F000-memory.dmp
    Filesize

    252KB

  • memory/1140-189-0x0000000004A30000-0x0000000004A6F000-memory.dmp
    Filesize

    252KB

  • memory/1140-191-0x0000000004A30000-0x0000000004A6F000-memory.dmp
    Filesize

    252KB

  • memory/1140-205-0x0000000004A30000-0x0000000004A6F000-memory.dmp
    Filesize

    252KB

  • memory/1140-192-0x00000000005C0000-0x000000000060B000-memory.dmp
    Filesize

    300KB

  • memory/1140-179-0x0000000004A30000-0x0000000004A74000-memory.dmp
    Filesize

    272KB

  • memory/1140-198-0x0000000004A80000-0x0000000004A90000-memory.dmp
    Filesize

    64KB

  • memory/1140-199-0x0000000004A30000-0x0000000004A6F000-memory.dmp
    Filesize

    252KB

  • memory/1140-196-0x0000000004A80000-0x0000000004A90000-memory.dmp
    Filesize

    64KB

  • memory/1140-201-0x0000000004A30000-0x0000000004A6F000-memory.dmp
    Filesize

    252KB

  • memory/1140-203-0x0000000004A30000-0x0000000004A6F000-memory.dmp
    Filesize

    252KB

  • memory/2088-173-0x0000000000400000-0x00000000004A9000-memory.dmp
    Filesize

    676KB

  • memory/2088-147-0x00000000024F0000-0x0000000002502000-memory.dmp
    Filesize

    72KB

  • memory/2088-139-0x00000000024F0000-0x0000000002508000-memory.dmp
    Filesize

    96KB

  • memory/2088-157-0x00000000024F0000-0x0000000002502000-memory.dmp
    Filesize

    72KB

  • memory/2088-171-0x00000000006E0000-0x00000000006F0000-memory.dmp
    Filesize

    64KB

  • memory/2088-170-0x0000000000400000-0x00000000004A9000-memory.dmp
    Filesize

    676KB

  • memory/2088-169-0x00000000006E0000-0x00000000006F0000-memory.dmp
    Filesize

    64KB

  • memory/2088-168-0x00000000006E0000-0x00000000006F0000-memory.dmp
    Filesize

    64KB

  • memory/2088-167-0x00000000024F0000-0x0000000002502000-memory.dmp
    Filesize

    72KB

  • memory/2088-137-0x00000000006E0000-0x00000000006F0000-memory.dmp
    Filesize

    64KB

  • memory/2088-155-0x00000000024F0000-0x0000000002502000-memory.dmp
    Filesize

    72KB

  • memory/2088-165-0x00000000024F0000-0x0000000002502000-memory.dmp
    Filesize

    72KB

  • memory/2088-161-0x00000000024F0000-0x0000000002502000-memory.dmp
    Filesize

    72KB

  • memory/2088-138-0x0000000004A60000-0x0000000004F5E000-memory.dmp
    Filesize

    5.0MB

  • memory/2088-149-0x00000000024F0000-0x0000000002502000-memory.dmp
    Filesize

    72KB

  • memory/2088-140-0x00000000024F0000-0x0000000002502000-memory.dmp
    Filesize

    72KB

  • memory/2088-153-0x00000000024F0000-0x0000000002502000-memory.dmp
    Filesize

    72KB

  • memory/2088-151-0x00000000024F0000-0x0000000002502000-memory.dmp
    Filesize

    72KB

  • memory/2088-163-0x00000000024F0000-0x0000000002502000-memory.dmp
    Filesize

    72KB

  • memory/2088-159-0x00000000024F0000-0x0000000002502000-memory.dmp
    Filesize

    72KB

  • memory/2088-145-0x00000000024F0000-0x0000000002502000-memory.dmp
    Filesize

    72KB

  • memory/2088-143-0x00000000024F0000-0x0000000002502000-memory.dmp
    Filesize

    72KB

  • memory/2088-141-0x00000000024F0000-0x0000000002502000-memory.dmp
    Filesize

    72KB

  • memory/2088-136-0x00000000001D0000-0x00000000001FD000-memory.dmp
    Filesize

    180KB

  • memory/2088-135-0x0000000000990000-0x00000000009AA000-memory.dmp
    Filesize

    104KB

  • memory/4496-1112-0x0000000000140000-0x0000000000172000-memory.dmp
    Filesize

    200KB

  • memory/4496-1113-0x0000000004B80000-0x0000000004BCB000-memory.dmp
    Filesize

    300KB

  • memory/4496-1114-0x0000000004D30000-0x0000000004D40000-memory.dmp
    Filesize

    64KB