Analysis
-
max time kernel
49s -
max time network
59s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
03/04/2023, 13:44
General
-
Target
e00b6bd7e6a9d46a84d4e314eb3dd5c89d19aff00af015b8038fa23cec52802a.exe
-
Size
522KB
-
MD5
d24021d05a74e90f5cb4848fa57fc207
-
SHA1
f6b1ce344a3a764407909a9805df3701677ea60d
-
SHA256
e00b6bd7e6a9d46a84d4e314eb3dd5c89d19aff00af015b8038fa23cec52802a
-
SHA512
4970f22a5399f768d8d044a5be27cf28574c1af1338317c1ceb9edc689d26e17fb777334b3e26a3387435cc35b86b8fab10724d15994865b082d3a1dd098be78
-
SSDEEP
12288:xMrRy90X+8KaTRC9Lq3tBRRgpWyfbga1OxuSo13KQ:Iyn8KSOqdfRgsmbJaa3l
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
-
Executes dropped EXE 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 1 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e00b6bd7e6a9d46a84d4e314eb3dd5c89d19aff00af015b8038fa23cec52802a.exe"C:\Users\Admin\AppData\Local\Temp\e00b6bd7e6a9d46a84d4e314eb3dd5c89d19aff00af015b8038fa23cec52802a.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zikx4694.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zikx4694.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr229709.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr229709.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku142618.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku142618.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr437753.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr437753.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD5bb6d43fa4ebafe62b98ec4dea4ff49d9
SHA1d8188e664ac977f59d3ec26589e3cf67b1fab23b
SHA2561d1cdf01afc38fc6784a41fe8aa2f308ec44606d2d16c4edd9445813af33fe89
SHA512679a0e394c5751020c38ceaba6a1bd1a33c558b8c9142fc796fa3570baa0ac082d099891451fde50249e165625b9738ead7321dccf2b2da567f3f7e3d4ee4644
-
Filesize
175KB
MD5bb6d43fa4ebafe62b98ec4dea4ff49d9
SHA1d8188e664ac977f59d3ec26589e3cf67b1fab23b
SHA2561d1cdf01afc38fc6784a41fe8aa2f308ec44606d2d16c4edd9445813af33fe89
SHA512679a0e394c5751020c38ceaba6a1bd1a33c558b8c9142fc796fa3570baa0ac082d099891451fde50249e165625b9738ead7321dccf2b2da567f3f7e3d4ee4644
-
Filesize
380KB
MD572d5f4df9a07a2cf5c903be250cd113e
SHA15f4b603f40bd6d72b9419318ff98c5d3b80ffdc5
SHA256555f602c10bd5e14b4842cddd5e6cf0bc621b504509219af6f3e93f00c215608
SHA51283911b382eddbe092640c539ffc8e3bb4d1153f22f24aec6293332f06ad4a05de92b7af2b9e65f293f59d0a744f65a63b9efe33ab2afe2064e4a94230bfb0053
-
Filesize
380KB
MD572d5f4df9a07a2cf5c903be250cd113e
SHA15f4b603f40bd6d72b9419318ff98c5d3b80ffdc5
SHA256555f602c10bd5e14b4842cddd5e6cf0bc621b504509219af6f3e93f00c215608
SHA51283911b382eddbe092640c539ffc8e3bb4d1153f22f24aec6293332f06ad4a05de92b7af2b9e65f293f59d0a744f65a63b9efe33ab2afe2064e4a94230bfb0053
-
Filesize
15KB
MD55fbb0d715e1d689765bebfe8e1190a2d
SHA1597a7aa590594c66b264543e2943161a1449e41c
SHA2563ae4ead9dfd21150c52dea2796d045f76ecb390cd948f6150192c9868e0417fe
SHA512377559c70572fcc8efd0877879ddbf740745d4476db3df918d3994e334e6dff53e579cfc12939241f69d1cd76828a4393ac399e9716966bcba1a71730dd5702b
-
Filesize
15KB
MD55fbb0d715e1d689765bebfe8e1190a2d
SHA1597a7aa590594c66b264543e2943161a1449e41c
SHA2563ae4ead9dfd21150c52dea2796d045f76ecb390cd948f6150192c9868e0417fe
SHA512377559c70572fcc8efd0877879ddbf740745d4476db3df918d3994e334e6dff53e579cfc12939241f69d1cd76828a4393ac399e9716966bcba1a71730dd5702b
-
Filesize
294KB
MD57e1d59ca3a5d866b0cd0151c93fcdfb8
SHA1501b0e0ebf7e35a8f4192d6a01070df96cfc523e
SHA256319c3f4acf181831b40eb383cd786958c760f051cbc7cbe27a09e3393cb70a6b
SHA5125f5703414ce3861d80dcdc9b9549cfb9c0deed03a92849f57aa46b65eeb1a734dfe4d85702468803b1c51777b09e11f8011242f621eaa4d3a8333087a46c7cbc
-
Filesize
294KB
MD57e1d59ca3a5d866b0cd0151c93fcdfb8
SHA1501b0e0ebf7e35a8f4192d6a01070df96cfc523e
SHA256319c3f4acf181831b40eb383cd786958c760f051cbc7cbe27a09e3393cb70a6b
SHA5125f5703414ce3861d80dcdc9b9549cfb9c0deed03a92849f57aa46b65eeb1a734dfe4d85702468803b1c51777b09e11f8011242f621eaa4d3a8333087a46c7cbc
-
Filesize
300KB
-
Filesize
280KB
-
Filesize
5.0MB
-
Filesize
272KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
6.0MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
408KB
-
Filesize
472KB
-
Filesize
320KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
200KB
-
Filesize
300KB
-
Filesize
64KB