Analysis

  • max time kernel
    51s
  • max time network
    73s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    03-04-2023 22:30

General

  • Target

    3a1e621ab5c803c8f9deef974155c7bf75dfa597a034ad853adbc5dfd979dcb0.exe

  • Size

    660KB

  • MD5

    848614867f7c177c87cbbf923a884f5c

  • SHA1

    da60b8c29f0456204f4e8112700954dc5eb5a5bd

  • SHA256

    3a1e621ab5c803c8f9deef974155c7bf75dfa597a034ad853adbc5dfd979dcb0

  • SHA512

    9167c1a95cdd486310688e5aec4622c8b960fca03c0cd16e22e9bd9ad735ce74723565ee4538cec5f64808d3ff3e9a19111fd8eecc5512c0ae4ade5364675e6e

  • SSDEEP

    12288:YMrOy90qeQe6bPhfpdC2OxyqHVd0k1C+X3lBEUCZHHft/juZSo7E1y5:GyaqbPf4OEC+X3ABZnBGHwc

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

spora

C2

176.113.115.145:4125

Attributes
  • auth_value

    441b39ab37774b2ca9931c31e1bc6071

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 21 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3a1e621ab5c803c8f9deef974155c7bf75dfa597a034ad853adbc5dfd979dcb0.exe
    "C:\Users\Admin\AppData\Local\Temp\3a1e621ab5c803c8f9deef974155c7bf75dfa597a034ad853adbc5dfd979dcb0.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4140
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un444940.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un444940.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2512
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9977.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9977.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4960
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7057.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7057.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4876
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si815423.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si815423.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3592

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

3
T1112

Disabling Security Tools

2
T1089

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si815423.exe
    Filesize

    175KB

    MD5

    07d6106504205cf1505756d769f422df

    SHA1

    6b78bf2b7f0834c16c0fcf27f0c019f09c3de2a3

    SHA256

    0a60510e122625e7a49ab37d09282736dea0e136f479c72494b44ac60b812110

    SHA512

    9f7726980362e83030e1face9d4a00768d778c5a774066b46d9680667b9287011a2bfd7b14852dbd70de13e54973c02d9433b66a3352ab672231d4df03fd1eb4

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si815423.exe
    Filesize

    175KB

    MD5

    07d6106504205cf1505756d769f422df

    SHA1

    6b78bf2b7f0834c16c0fcf27f0c019f09c3de2a3

    SHA256

    0a60510e122625e7a49ab37d09282736dea0e136f479c72494b44ac60b812110

    SHA512

    9f7726980362e83030e1face9d4a00768d778c5a774066b46d9680667b9287011a2bfd7b14852dbd70de13e54973c02d9433b66a3352ab672231d4df03fd1eb4

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un444940.exe
    Filesize

    517KB

    MD5

    5a4284cd866f481f6c50f65992005b43

    SHA1

    db12aac997aebe4af446396d9c744947f76ffb93

    SHA256

    06822be72e6326a3dff037b57518c2ad78899a534c84326b431078a71f30d4f3

    SHA512

    f8caf734890d0831a46ab2c3e10810af069cfd6ba91890df30b3143cc8ee8a6c2d64922ac1a3a958c2049c65e2e6c51f1a600b1371e9596db457df5766472570

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un444940.exe
    Filesize

    517KB

    MD5

    5a4284cd866f481f6c50f65992005b43

    SHA1

    db12aac997aebe4af446396d9c744947f76ffb93

    SHA256

    06822be72e6326a3dff037b57518c2ad78899a534c84326b431078a71f30d4f3

    SHA512

    f8caf734890d0831a46ab2c3e10810af069cfd6ba91890df30b3143cc8ee8a6c2d64922ac1a3a958c2049c65e2e6c51f1a600b1371e9596db457df5766472570

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9977.exe
    Filesize

    237KB

    MD5

    f412bf5b3ff2fb7d64a91a1928897907

    SHA1

    b1f4aded0156a49314eec136379d6af60b56057a

    SHA256

    97a5c529de9cb6a299370cc8218ab8d363a314a8f1351eb7576b71d0a32bbbe8

    SHA512

    0a5b009bd03bb7347af9b7b68dc78cc5ec654fcf623e387a8d71dcc0a1883f74f4e89f21c8b69fff6e3c4809149842a5434a8819b731a51b3a9d137aada7a805

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9977.exe
    Filesize

    237KB

    MD5

    f412bf5b3ff2fb7d64a91a1928897907

    SHA1

    b1f4aded0156a49314eec136379d6af60b56057a

    SHA256

    97a5c529de9cb6a299370cc8218ab8d363a314a8f1351eb7576b71d0a32bbbe8

    SHA512

    0a5b009bd03bb7347af9b7b68dc78cc5ec654fcf623e387a8d71dcc0a1883f74f4e89f21c8b69fff6e3c4809149842a5434a8819b731a51b3a9d137aada7a805

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7057.exe
    Filesize

    295KB

    MD5

    37cae12d5a9c6f481d89bf192f144f2c

    SHA1

    0b3796be181f3afb40d3fc5e2c8e4ebbe1e6cdf5

    SHA256

    3de7bcfb323a5d0051dc1abcbba511e68acc332d69f52ab57c5974fd5e06863c

    SHA512

    5c5c4925194d13ab96f82d347c66ec05555a8eb6bff1d0a139534f9eec1a817cc0f437068ee662c25f8480b8bfa537c95458da3198f398a696a791f421bd9ee8

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7057.exe
    Filesize

    295KB

    MD5

    37cae12d5a9c6f481d89bf192f144f2c

    SHA1

    0b3796be181f3afb40d3fc5e2c8e4ebbe1e6cdf5

    SHA256

    3de7bcfb323a5d0051dc1abcbba511e68acc332d69f52ab57c5974fd5e06863c

    SHA512

    5c5c4925194d13ab96f82d347c66ec05555a8eb6bff1d0a139534f9eec1a817cc0f437068ee662c25f8480b8bfa537c95458da3198f398a696a791f421bd9ee8

  • memory/3592-1113-0x00000000050D0000-0x00000000050E0000-memory.dmp
    Filesize

    64KB

  • memory/3592-1112-0x0000000004FB0000-0x0000000004FFB000-memory.dmp
    Filesize

    300KB

  • memory/3592-1111-0x0000000000570000-0x00000000005A2000-memory.dmp
    Filesize

    200KB

  • memory/4876-1088-0x0000000005160000-0x0000000005766000-memory.dmp
    Filesize

    6.0MB

  • memory/4876-1091-0x0000000005900000-0x000000000593E000-memory.dmp
    Filesize

    248KB

  • memory/4876-1104-0x0000000006890000-0x0000000006DBC000-memory.dmp
    Filesize

    5.2MB

  • memory/4876-1103-0x00000000066C0000-0x0000000006882000-memory.dmp
    Filesize

    1.8MB

  • memory/4876-1102-0x0000000004B50000-0x0000000004B60000-memory.dmp
    Filesize

    64KB

  • memory/4876-1101-0x00000000063E0000-0x0000000006430000-memory.dmp
    Filesize

    320KB

  • memory/4876-1100-0x0000000006340000-0x00000000063B6000-memory.dmp
    Filesize

    472KB

  • memory/4876-1099-0x00000000062A0000-0x0000000006332000-memory.dmp
    Filesize

    584KB

  • memory/4876-1098-0x0000000004B50000-0x0000000004B60000-memory.dmp
    Filesize

    64KB

  • memory/4876-1096-0x0000000004B50000-0x0000000004B60000-memory.dmp
    Filesize

    64KB

  • memory/4876-1097-0x0000000004B50000-0x0000000004B60000-memory.dmp
    Filesize

    64KB

  • memory/4876-1095-0x0000000005BE0000-0x0000000005C46000-memory.dmp
    Filesize

    408KB

  • memory/4876-1093-0x0000000005A50000-0x0000000005A9B000-memory.dmp
    Filesize

    300KB

  • memory/4876-1092-0x0000000004B50000-0x0000000004B60000-memory.dmp
    Filesize

    64KB

  • memory/4876-1090-0x00000000058E0000-0x00000000058F2000-memory.dmp
    Filesize

    72KB

  • memory/4876-1089-0x00000000057A0000-0x00000000058AA000-memory.dmp
    Filesize

    1.0MB

  • memory/4876-215-0x0000000004A40000-0x0000000004A7F000-memory.dmp
    Filesize

    252KB

  • memory/4876-213-0x0000000004A40000-0x0000000004A7F000-memory.dmp
    Filesize

    252KB

  • memory/4876-211-0x0000000004A40000-0x0000000004A7F000-memory.dmp
    Filesize

    252KB

  • memory/4876-210-0x0000000004B50000-0x0000000004B60000-memory.dmp
    Filesize

    64KB

  • memory/4876-207-0x0000000004A40000-0x0000000004A7F000-memory.dmp
    Filesize

    252KB

  • memory/4876-208-0x0000000004B50000-0x0000000004B60000-memory.dmp
    Filesize

    64KB

  • memory/4876-176-0x0000000002270000-0x00000000022B6000-memory.dmp
    Filesize

    280KB

  • memory/4876-177-0x0000000004A40000-0x0000000004A84000-memory.dmp
    Filesize

    272KB

  • memory/4876-178-0x0000000004A40000-0x0000000004A7F000-memory.dmp
    Filesize

    252KB

  • memory/4876-179-0x0000000004A40000-0x0000000004A7F000-memory.dmp
    Filesize

    252KB

  • memory/4876-181-0x0000000004A40000-0x0000000004A7F000-memory.dmp
    Filesize

    252KB

  • memory/4876-183-0x0000000004A40000-0x0000000004A7F000-memory.dmp
    Filesize

    252KB

  • memory/4876-185-0x0000000004A40000-0x0000000004A7F000-memory.dmp
    Filesize

    252KB

  • memory/4876-187-0x0000000004A40000-0x0000000004A7F000-memory.dmp
    Filesize

    252KB

  • memory/4876-189-0x0000000004A40000-0x0000000004A7F000-memory.dmp
    Filesize

    252KB

  • memory/4876-191-0x0000000004A40000-0x0000000004A7F000-memory.dmp
    Filesize

    252KB

  • memory/4876-193-0x0000000004A40000-0x0000000004A7F000-memory.dmp
    Filesize

    252KB

  • memory/4876-195-0x0000000004A40000-0x0000000004A7F000-memory.dmp
    Filesize

    252KB

  • memory/4876-197-0x0000000004A40000-0x0000000004A7F000-memory.dmp
    Filesize

    252KB

  • memory/4876-199-0x0000000004A40000-0x0000000004A7F000-memory.dmp
    Filesize

    252KB

  • memory/4876-201-0x0000000004A40000-0x0000000004A7F000-memory.dmp
    Filesize

    252KB

  • memory/4876-204-0x0000000004A40000-0x0000000004A7F000-memory.dmp
    Filesize

    252KB

  • memory/4876-203-0x0000000000590000-0x00000000005DB000-memory.dmp
    Filesize

    300KB

  • memory/4876-205-0x0000000004B50000-0x0000000004B60000-memory.dmp
    Filesize

    64KB

  • memory/4960-159-0x00000000049E0000-0x00000000049F2000-memory.dmp
    Filesize

    72KB

  • memory/4960-131-0x0000000002330000-0x000000000234A000-memory.dmp
    Filesize

    104KB

  • memory/4960-137-0x0000000004A60000-0x0000000004A70000-memory.dmp
    Filesize

    64KB

  • memory/4960-169-0x0000000004A60000-0x0000000004A70000-memory.dmp
    Filesize

    64KB

  • memory/4960-168-0x0000000004A60000-0x0000000004A70000-memory.dmp
    Filesize

    64KB

  • memory/4960-167-0x0000000004A60000-0x0000000004A70000-memory.dmp
    Filesize

    64KB

  • memory/4960-136-0x00000000049E0000-0x00000000049F8000-memory.dmp
    Filesize

    96KB

  • memory/4960-166-0x0000000000400000-0x00000000004A9000-memory.dmp
    Filesize

    676KB

  • memory/4960-165-0x00000000049E0000-0x00000000049F2000-memory.dmp
    Filesize

    72KB

  • memory/4960-139-0x00000000049E0000-0x00000000049F2000-memory.dmp
    Filesize

    72KB

  • memory/4960-163-0x00000000049E0000-0x00000000049F2000-memory.dmp
    Filesize

    72KB

  • memory/4960-161-0x00000000049E0000-0x00000000049F2000-memory.dmp
    Filesize

    72KB

  • memory/4960-171-0x0000000000400000-0x00000000004A9000-memory.dmp
    Filesize

    676KB

  • memory/4960-138-0x00000000049E0000-0x00000000049F2000-memory.dmp
    Filesize

    72KB

  • memory/4960-141-0x00000000049E0000-0x00000000049F2000-memory.dmp
    Filesize

    72KB

  • memory/4960-153-0x00000000049E0000-0x00000000049F2000-memory.dmp
    Filesize

    72KB

  • memory/4960-151-0x00000000049E0000-0x00000000049F2000-memory.dmp
    Filesize

    72KB

  • memory/4960-149-0x00000000049E0000-0x00000000049F2000-memory.dmp
    Filesize

    72KB

  • memory/4960-147-0x00000000049E0000-0x00000000049F2000-memory.dmp
    Filesize

    72KB

  • memory/4960-145-0x00000000049E0000-0x00000000049F2000-memory.dmp
    Filesize

    72KB

  • memory/4960-143-0x00000000049E0000-0x00000000049F2000-memory.dmp
    Filesize

    72KB

  • memory/4960-155-0x00000000049E0000-0x00000000049F2000-memory.dmp
    Filesize

    72KB

  • memory/4960-135-0x0000000004A60000-0x0000000004A70000-memory.dmp
    Filesize

    64KB

  • memory/4960-134-0x0000000004A60000-0x0000000004A70000-memory.dmp
    Filesize

    64KB

  • memory/4960-133-0x0000000000580000-0x00000000005AD000-memory.dmp
    Filesize

    180KB

  • memory/4960-132-0x0000000004A70000-0x0000000004F6E000-memory.dmp
    Filesize

    5.0MB

  • memory/4960-157-0x00000000049E0000-0x00000000049F2000-memory.dmp
    Filesize

    72KB