Analysis

  • max time kernel
    92s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-04-2023 22:35

General

  • Target

    3b9a5b4c3b67e515d610e6f00240eb5d884142af2ac0148936b3f1fe2a290ae0.exe

  • Size

    659KB

  • MD5

    5005c9ed5cdb80d997a3d5bdb18ec16d

  • SHA1

    12814d94b13f8bc060f56eae6907048ba6f181ec

  • SHA256

    3b9a5b4c3b67e515d610e6f00240eb5d884142af2ac0148936b3f1fe2a290ae0

  • SHA512

    c55ed7e1d9f87419359c46db8b43f2ca51a4d788385d9db9e87ca4aa2549fe66fccc84ffb694e9c27e15423cdf005363b3bb6d7044fd24ee72a75d6643b8f48e

  • SSDEEP

    12288:lMruy902YpSmnKPNb6pgHVsOnVPJct59vrwFnyCCaJft/juF0Fk8jU:jyH6SfPZ6ijVP+t5FSnzCcBUp8g

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

spora

C2

176.113.115.145:4125

Attributes
  • auth_value

    441b39ab37774b2ca9931c31e1bc6071

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 18 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3b9a5b4c3b67e515d610e6f00240eb5d884142af2ac0148936b3f1fe2a290ae0.exe
    "C:\Users\Admin\AppData\Local\Temp\3b9a5b4c3b67e515d610e6f00240eb5d884142af2ac0148936b3f1fe2a290ae0.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:5048
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un113167.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un113167.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2764
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1908.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1908.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5104
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 1084
          4⤵
          • Program crash
          PID:2428
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2137.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2137.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2224
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 1336
          4⤵
          • Program crash
          PID:1112
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si100213.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si100213.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4488
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5104 -ip 5104
    1⤵
      PID:3024
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2224 -ip 2224
      1⤵
        PID:1552

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Persistence

      Modify Existing Service

      1
      T1031

      Registry Run Keys / Startup Folder

      1
      T1060

      Defense Evasion

      Modify Registry

      3
      T1112

      Disabling Security Tools

      2
      T1089

      Credential Access

      Credentials in Files

      2
      T1081

      Discovery

      Query Registry

      1
      T1012

      Collection

      Data from Local System

      2
      T1005

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si100213.exe
        Filesize

        175KB

        MD5

        959ac543f3cfccc3c1af5bd59b2e85e1

        SHA1

        d57875ebaa8e54d6dcdb61c2e2bae51a4ff4198d

        SHA256

        bd8c23e92f370416532c186ab7ee3923d9902201f0ecbe158d6b900df1e0f919

        SHA512

        26ea76b112af4eac31d74f72c943dc3e19e7d7f72fa92f00b704f7e1c941c0ace77be00c63d5681ce45db7c52ae565c913cbdc569b78293c954db94dc69cfb84

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si100213.exe
        Filesize

        175KB

        MD5

        959ac543f3cfccc3c1af5bd59b2e85e1

        SHA1

        d57875ebaa8e54d6dcdb61c2e2bae51a4ff4198d

        SHA256

        bd8c23e92f370416532c186ab7ee3923d9902201f0ecbe158d6b900df1e0f919

        SHA512

        26ea76b112af4eac31d74f72c943dc3e19e7d7f72fa92f00b704f7e1c941c0ace77be00c63d5681ce45db7c52ae565c913cbdc569b78293c954db94dc69cfb84

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un113167.exe
        Filesize

        517KB

        MD5

        7cb8ceed3850c873dfbb44e04201b34a

        SHA1

        e3cb0eef4ee56154665b3ba9807191e04679f9ae

        SHA256

        7668c5ac4f5ce03b7c661bcb851ec76332bee5e80d9f0411ae385553f929f849

        SHA512

        7bb569d64e6a0b5d7fb0837c9541055b44d08da62c5c57fdb5295b39272ab3c2fde250394d02ba999b4305a00d50b80c5b025d0fdf7259a1651fbeff14bddfa9

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un113167.exe
        Filesize

        517KB

        MD5

        7cb8ceed3850c873dfbb44e04201b34a

        SHA1

        e3cb0eef4ee56154665b3ba9807191e04679f9ae

        SHA256

        7668c5ac4f5ce03b7c661bcb851ec76332bee5e80d9f0411ae385553f929f849

        SHA512

        7bb569d64e6a0b5d7fb0837c9541055b44d08da62c5c57fdb5295b39272ab3c2fde250394d02ba999b4305a00d50b80c5b025d0fdf7259a1651fbeff14bddfa9

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1908.exe
        Filesize

        237KB

        MD5

        5ae84e349d38ff71a56410b4a7ecb22f

        SHA1

        519d0315f3445232c976ca4c39d55e026f903779

        SHA256

        e794503be96642b3a1d35f90b05d8e2a462dc96a2269c2077937338dabafb2be

        SHA512

        af278522d44703db1b031169e6da93c9dd1edc2dbe56df4e5217054075a1d35aac59ff1c3db4fd03b1ae709f0bfa7771cd1d6f1335e8373f84197b339cdf0137

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1908.exe
        Filesize

        237KB

        MD5

        5ae84e349d38ff71a56410b4a7ecb22f

        SHA1

        519d0315f3445232c976ca4c39d55e026f903779

        SHA256

        e794503be96642b3a1d35f90b05d8e2a462dc96a2269c2077937338dabafb2be

        SHA512

        af278522d44703db1b031169e6da93c9dd1edc2dbe56df4e5217054075a1d35aac59ff1c3db4fd03b1ae709f0bfa7771cd1d6f1335e8373f84197b339cdf0137

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2137.exe
        Filesize

        295KB

        MD5

        84c71ef84a3aba93370192ccec1fecf7

        SHA1

        db1c73013ffa51c418ba2ef67b5433f829f38937

        SHA256

        a7be23b255e9c58fcc9f9df2adea65022e643cd5a51e545d048e80db3746f241

        SHA512

        117712873f78ce0678eaf943830dd9a7f401e88e3c183cd0fa804f334f4dda947a205b1511a64a6a7aed4e37ca3894d27d7772e4b50cdba4e4d6c64ee1d63379

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2137.exe
        Filesize

        295KB

        MD5

        84c71ef84a3aba93370192ccec1fecf7

        SHA1

        db1c73013ffa51c418ba2ef67b5433f829f38937

        SHA256

        a7be23b255e9c58fcc9f9df2adea65022e643cd5a51e545d048e80db3746f241

        SHA512

        117712873f78ce0678eaf943830dd9a7f401e88e3c183cd0fa804f334f4dda947a205b1511a64a6a7aed4e37ca3894d27d7772e4b50cdba4e4d6c64ee1d63379

      • memory/2224-1099-0x00000000052A0000-0x00000000058B8000-memory.dmp
        Filesize

        6.1MB

      • memory/2224-1102-0x0000000005A00000-0x0000000005A3C000-memory.dmp
        Filesize

        240KB

      • memory/2224-1114-0x0000000006770000-0x0000000006C9C000-memory.dmp
        Filesize

        5.2MB

      • memory/2224-1113-0x00000000065A0000-0x0000000006762000-memory.dmp
        Filesize

        1.8MB

      • memory/2224-1112-0x0000000006520000-0x0000000006570000-memory.dmp
        Filesize

        320KB

      • memory/2224-1111-0x00000000064A0000-0x0000000006516000-memory.dmp
        Filesize

        472KB

      • memory/2224-1110-0x0000000005D90000-0x0000000005DF6000-memory.dmp
        Filesize

        408KB

      • memory/2224-1109-0x0000000005CF0000-0x0000000005D82000-memory.dmp
        Filesize

        584KB

      • memory/2224-1108-0x0000000004BE0000-0x0000000004BF0000-memory.dmp
        Filesize

        64KB

      • memory/2224-1107-0x0000000004BE0000-0x0000000004BF0000-memory.dmp
        Filesize

        64KB

      • memory/2224-1106-0x0000000004BE0000-0x0000000004BF0000-memory.dmp
        Filesize

        64KB

      • memory/2224-1105-0x0000000004BE0000-0x0000000004BF0000-memory.dmp
        Filesize

        64KB

      • memory/2224-1103-0x0000000004BE0000-0x0000000004BF0000-memory.dmp
        Filesize

        64KB

      • memory/2224-1101-0x00000000059E0000-0x00000000059F2000-memory.dmp
        Filesize

        72KB

      • memory/2224-1100-0x00000000058C0000-0x00000000059CA000-memory.dmp
        Filesize

        1.0MB

      • memory/2224-294-0x0000000004BE0000-0x0000000004BF0000-memory.dmp
        Filesize

        64KB

      • memory/2224-292-0x0000000004BE0000-0x0000000004BF0000-memory.dmp
        Filesize

        64KB

      • memory/2224-290-0x0000000004BE0000-0x0000000004BF0000-memory.dmp
        Filesize

        64KB

      • memory/2224-288-0x0000000002140000-0x000000000218B000-memory.dmp
        Filesize

        300KB

      • memory/2224-222-0x0000000002710000-0x000000000274F000-memory.dmp
        Filesize

        252KB

      • memory/2224-220-0x0000000002710000-0x000000000274F000-memory.dmp
        Filesize

        252KB

      • memory/2224-189-0x0000000002710000-0x000000000274F000-memory.dmp
        Filesize

        252KB

      • memory/2224-190-0x0000000002710000-0x000000000274F000-memory.dmp
        Filesize

        252KB

      • memory/2224-192-0x0000000002710000-0x000000000274F000-memory.dmp
        Filesize

        252KB

      • memory/2224-194-0x0000000002710000-0x000000000274F000-memory.dmp
        Filesize

        252KB

      • memory/2224-196-0x0000000002710000-0x000000000274F000-memory.dmp
        Filesize

        252KB

      • memory/2224-198-0x0000000002710000-0x000000000274F000-memory.dmp
        Filesize

        252KB

      • memory/2224-200-0x0000000002710000-0x000000000274F000-memory.dmp
        Filesize

        252KB

      • memory/2224-202-0x0000000002710000-0x000000000274F000-memory.dmp
        Filesize

        252KB

      • memory/2224-204-0x0000000002710000-0x000000000274F000-memory.dmp
        Filesize

        252KB

      • memory/2224-206-0x0000000002710000-0x000000000274F000-memory.dmp
        Filesize

        252KB

      • memory/2224-208-0x0000000002710000-0x000000000274F000-memory.dmp
        Filesize

        252KB

      • memory/2224-210-0x0000000002710000-0x000000000274F000-memory.dmp
        Filesize

        252KB

      • memory/2224-212-0x0000000002710000-0x000000000274F000-memory.dmp
        Filesize

        252KB

      • memory/2224-214-0x0000000002710000-0x000000000274F000-memory.dmp
        Filesize

        252KB

      • memory/2224-216-0x0000000002710000-0x000000000274F000-memory.dmp
        Filesize

        252KB

      • memory/2224-218-0x0000000002710000-0x000000000274F000-memory.dmp
        Filesize

        252KB

      • memory/4488-1122-0x0000000000BC0000-0x0000000000BF2000-memory.dmp
        Filesize

        200KB

      • memory/4488-1123-0x00000000054A0000-0x00000000054B0000-memory.dmp
        Filesize

        64KB

      • memory/5104-171-0x00000000025C0000-0x00000000025D2000-memory.dmp
        Filesize

        72KB

      • memory/5104-152-0x00000000025C0000-0x00000000025D2000-memory.dmp
        Filesize

        72KB

      • memory/5104-151-0x0000000004C10000-0x0000000004C20000-memory.dmp
        Filesize

        64KB

      • memory/5104-180-0x0000000000400000-0x00000000004A9000-memory.dmp
        Filesize

        676KB

      • memory/5104-148-0x0000000000720000-0x000000000074D000-memory.dmp
        Filesize

        180KB

      • memory/5104-179-0x00000000025C0000-0x00000000025D2000-memory.dmp
        Filesize

        72KB

      • memory/5104-177-0x00000000025C0000-0x00000000025D2000-memory.dmp
        Filesize

        72KB

      • memory/5104-155-0x00000000025C0000-0x00000000025D2000-memory.dmp
        Filesize

        72KB

      • memory/5104-175-0x00000000025C0000-0x00000000025D2000-memory.dmp
        Filesize

        72KB

      • memory/5104-167-0x00000000025C0000-0x00000000025D2000-memory.dmp
        Filesize

        72KB

      • memory/5104-181-0x0000000004C10000-0x0000000004C20000-memory.dmp
        Filesize

        64KB

      • memory/5104-182-0x0000000004C10000-0x0000000004C20000-memory.dmp
        Filesize

        64KB

      • memory/5104-173-0x00000000025C0000-0x00000000025D2000-memory.dmp
        Filesize

        72KB

      • memory/5104-165-0x00000000025C0000-0x00000000025D2000-memory.dmp
        Filesize

        72KB

      • memory/5104-163-0x00000000025C0000-0x00000000025D2000-memory.dmp
        Filesize

        72KB

      • memory/5104-161-0x00000000025C0000-0x00000000025D2000-memory.dmp
        Filesize

        72KB

      • memory/5104-159-0x00000000025C0000-0x00000000025D2000-memory.dmp
        Filesize

        72KB

      • memory/5104-153-0x00000000025C0000-0x00000000025D2000-memory.dmp
        Filesize

        72KB

      • memory/5104-157-0x00000000025C0000-0x00000000025D2000-memory.dmp
        Filesize

        72KB

      • memory/5104-150-0x0000000004C10000-0x0000000004C20000-memory.dmp
        Filesize

        64KB

      • memory/5104-149-0x0000000004C20000-0x00000000051C4000-memory.dmp
        Filesize

        5.6MB

      • memory/5104-184-0x0000000000400000-0x00000000004A9000-memory.dmp
        Filesize

        676KB

      • memory/5104-169-0x00000000025C0000-0x00000000025D2000-memory.dmp
        Filesize

        72KB