Analysis

  • max time kernel
    52s
  • max time network
    71s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    03-04-2023 15:47

General

  • Target

    36eefd2a31f154e255c0c25d1d66178855cecd0d54794d61803904e5de161d45.exe

  • Size

    660KB

  • MD5

    0695e435e43e3b02ab56495b631c3aec

  • SHA1

    d843d413781b86837ffe4100620c7e2d2d904001

  • SHA256

    36eefd2a31f154e255c0c25d1d66178855cecd0d54794d61803904e5de161d45

  • SHA512

    540d61c22c5a7f5b0da5965ee091c3781cc1e4b3664b589d4d822b7fac3889075670d54a58f96207e12863c2604c5d77415548c2efabbb401052f1cd0121baf1

  • SSDEEP

    12288:lMrPy90iwmPnevaDtBIjshfvLZ0kZwVd0PsZrLiRiVaWPkNa22:mypwkneu2jshrHZCd2sZ6RiV5kNr2

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

spora

C2

176.113.115.145:4125

Attributes
  • auth_value

    441b39ab37774b2ca9931c31e1bc6071

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\36eefd2a31f154e255c0c25d1d66178855cecd0d54794d61803904e5de161d45.exe
    "C:\Users\Admin\AppData\Local\Temp\36eefd2a31f154e255c0c25d1d66178855cecd0d54794d61803904e5de161d45.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4148
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un575395.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un575395.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1804
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6534.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6534.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3836
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0027.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0027.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2300
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si405411.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si405411.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4372

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si405411.exe

    Filesize

    175KB

    MD5

    bb6d43fa4ebafe62b98ec4dea4ff49d9

    SHA1

    d8188e664ac977f59d3ec26589e3cf67b1fab23b

    SHA256

    1d1cdf01afc38fc6784a41fe8aa2f308ec44606d2d16c4edd9445813af33fe89

    SHA512

    679a0e394c5751020c38ceaba6a1bd1a33c558b8c9142fc796fa3570baa0ac082d099891451fde50249e165625b9738ead7321dccf2b2da567f3f7e3d4ee4644

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si405411.exe

    Filesize

    175KB

    MD5

    bb6d43fa4ebafe62b98ec4dea4ff49d9

    SHA1

    d8188e664ac977f59d3ec26589e3cf67b1fab23b

    SHA256

    1d1cdf01afc38fc6784a41fe8aa2f308ec44606d2d16c4edd9445813af33fe89

    SHA512

    679a0e394c5751020c38ceaba6a1bd1a33c558b8c9142fc796fa3570baa0ac082d099891451fde50249e165625b9738ead7321dccf2b2da567f3f7e3d4ee4644

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un575395.exe

    Filesize

    518KB

    MD5

    237035c91490cca1b814e50f08b28552

    SHA1

    8a559530cca375f599abf7ba6cc02a22928432ee

    SHA256

    894f34a85fb07dd38fa7e60c7f47ccfe39215c81a3cefac0db8dd42f21a58f48

    SHA512

    d5ee2dc99edfb6df395d39697967e90cf8748c8a0099389bac367e8afac55405f66182076ce6301fa3257ef73a066c9fa454acc563a7a464936a17b7f44f11f9

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un575395.exe

    Filesize

    518KB

    MD5

    237035c91490cca1b814e50f08b28552

    SHA1

    8a559530cca375f599abf7ba6cc02a22928432ee

    SHA256

    894f34a85fb07dd38fa7e60c7f47ccfe39215c81a3cefac0db8dd42f21a58f48

    SHA512

    d5ee2dc99edfb6df395d39697967e90cf8748c8a0099389bac367e8afac55405f66182076ce6301fa3257ef73a066c9fa454acc563a7a464936a17b7f44f11f9

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6534.exe

    Filesize

    236KB

    MD5

    905f651eb46926e4553e9b3e3d6bb009

    SHA1

    c2aac8bdc978e43cd2c428e6cffee038f7eb0f1f

    SHA256

    bcc34128ae232dc45d7c40fe37a4fe95c17cd4e0af20eca2df14a971d91921b8

    SHA512

    348fb40a55e7b0546f8b48088e11ed4450bc9400f5e462bd50639d46c888b11f1dad33713484a48bac01c9b0409cbb70c7e10bf40994e337629e7da7efb526b4

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6534.exe

    Filesize

    236KB

    MD5

    905f651eb46926e4553e9b3e3d6bb009

    SHA1

    c2aac8bdc978e43cd2c428e6cffee038f7eb0f1f

    SHA256

    bcc34128ae232dc45d7c40fe37a4fe95c17cd4e0af20eca2df14a971d91921b8

    SHA512

    348fb40a55e7b0546f8b48088e11ed4450bc9400f5e462bd50639d46c888b11f1dad33713484a48bac01c9b0409cbb70c7e10bf40994e337629e7da7efb526b4

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0027.exe

    Filesize

    295KB

    MD5

    7776568ac84af8ae6dc0948ea0562b28

    SHA1

    be07fba6202499dc798b76d7a0f4359117292da1

    SHA256

    bcf88d01bf330680f06c3780da0407370155cdf7a589d2e4ee13ae90a260bd51

    SHA512

    eb67e81f444f6f9c9760f97dc61a00f4747850165dcc0518c3b993395b9f7c94db7d55a4fc25772e41ab6eb19ed77622b77cf8d7c5d2d2a47cca0988ad69546c

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0027.exe

    Filesize

    295KB

    MD5

    7776568ac84af8ae6dc0948ea0562b28

    SHA1

    be07fba6202499dc798b76d7a0f4359117292da1

    SHA256

    bcf88d01bf330680f06c3780da0407370155cdf7a589d2e4ee13ae90a260bd51

    SHA512

    eb67e81f444f6f9c9760f97dc61a00f4747850165dcc0518c3b993395b9f7c94db7d55a4fc25772e41ab6eb19ed77622b77cf8d7c5d2d2a47cca0988ad69546c

  • memory/2300-1092-0x0000000002200000-0x0000000002210000-memory.dmp

    Filesize

    64KB

  • memory/2300-1093-0x00000000057C0000-0x00000000057FE000-memory.dmp

    Filesize

    248KB

  • memory/2300-1105-0x00000000062F0000-0x0000000006340000-memory.dmp

    Filesize

    320KB

  • memory/2300-1104-0x0000000006260000-0x00000000062D6000-memory.dmp

    Filesize

    472KB

  • memory/2300-1103-0x0000000007780000-0x0000000007CAC000-memory.dmp

    Filesize

    5.2MB

  • memory/2300-1102-0x0000000002200000-0x0000000002210000-memory.dmp

    Filesize

    64KB

  • memory/2300-1101-0x00000000075B0000-0x0000000007772000-memory.dmp

    Filesize

    1.8MB

  • memory/2300-1100-0x0000000002200000-0x0000000002210000-memory.dmp

    Filesize

    64KB

  • memory/2300-1099-0x0000000002200000-0x0000000002210000-memory.dmp

    Filesize

    64KB

  • memory/2300-1098-0x0000000002200000-0x0000000002210000-memory.dmp

    Filesize

    64KB

  • memory/2300-1096-0x0000000005B40000-0x0000000005BA6000-memory.dmp

    Filesize

    408KB

  • memory/2300-1095-0x0000000005AA0000-0x0000000005B32000-memory.dmp

    Filesize

    584KB

  • memory/2300-1094-0x0000000005910000-0x000000000595B000-memory.dmp

    Filesize

    300KB

  • memory/2300-196-0x0000000002540000-0x000000000257F000-memory.dmp

    Filesize

    252KB

  • memory/2300-1091-0x00000000057A0000-0x00000000057B2000-memory.dmp

    Filesize

    72KB

  • memory/2300-1090-0x0000000005660000-0x000000000576A000-memory.dmp

    Filesize

    1.0MB

  • memory/2300-1089-0x0000000004FE0000-0x00000000055E6000-memory.dmp

    Filesize

    6.0MB

  • memory/2300-283-0x0000000002200000-0x0000000002210000-memory.dmp

    Filesize

    64KB

  • memory/2300-285-0x0000000002200000-0x0000000002210000-memory.dmp

    Filesize

    64KB

  • memory/2300-281-0x0000000002200000-0x0000000002210000-memory.dmp

    Filesize

    64KB

  • memory/2300-279-0x00000000005D0000-0x000000000061B000-memory.dmp

    Filesize

    300KB

  • memory/2300-212-0x0000000002540000-0x000000000257F000-memory.dmp

    Filesize

    252KB

  • memory/2300-177-0x0000000002250000-0x0000000002296000-memory.dmp

    Filesize

    280KB

  • memory/2300-178-0x0000000002540000-0x0000000002584000-memory.dmp

    Filesize

    272KB

  • memory/2300-198-0x0000000002540000-0x000000000257F000-memory.dmp

    Filesize

    252KB

  • memory/2300-180-0x0000000002540000-0x000000000257F000-memory.dmp

    Filesize

    252KB

  • memory/2300-182-0x0000000002540000-0x000000000257F000-memory.dmp

    Filesize

    252KB

  • memory/2300-184-0x0000000002540000-0x000000000257F000-memory.dmp

    Filesize

    252KB

  • memory/2300-186-0x0000000002540000-0x000000000257F000-memory.dmp

    Filesize

    252KB

  • memory/2300-188-0x0000000002540000-0x000000000257F000-memory.dmp

    Filesize

    252KB

  • memory/2300-190-0x0000000002540000-0x000000000257F000-memory.dmp

    Filesize

    252KB

  • memory/2300-192-0x0000000002540000-0x000000000257F000-memory.dmp

    Filesize

    252KB

  • memory/2300-210-0x0000000002540000-0x000000000257F000-memory.dmp

    Filesize

    252KB

  • memory/2300-194-0x0000000002540000-0x000000000257F000-memory.dmp

    Filesize

    252KB

  • memory/2300-179-0x0000000002540000-0x000000000257F000-memory.dmp

    Filesize

    252KB

  • memory/2300-200-0x0000000002540000-0x000000000257F000-memory.dmp

    Filesize

    252KB

  • memory/2300-202-0x0000000002540000-0x000000000257F000-memory.dmp

    Filesize

    252KB

  • memory/2300-204-0x0000000002540000-0x000000000257F000-memory.dmp

    Filesize

    252KB

  • memory/2300-206-0x0000000002540000-0x000000000257F000-memory.dmp

    Filesize

    252KB

  • memory/2300-208-0x0000000002540000-0x000000000257F000-memory.dmp

    Filesize

    252KB

  • memory/3836-172-0x0000000000400000-0x00000000004AA000-memory.dmp

    Filesize

    680KB

  • memory/3836-146-0x0000000002290000-0x00000000022A2000-memory.dmp

    Filesize

    72KB

  • memory/3836-139-0x0000000002290000-0x00000000022A2000-memory.dmp

    Filesize

    72KB

  • memory/3836-156-0x0000000002290000-0x00000000022A2000-memory.dmp

    Filesize

    72KB

  • memory/3836-170-0x0000000000400000-0x00000000004AA000-memory.dmp

    Filesize

    680KB

  • memory/3836-169-0x0000000004C10000-0x0000000004C20000-memory.dmp

    Filesize

    64KB

  • memory/3836-168-0x0000000004C10000-0x0000000004C20000-memory.dmp

    Filesize

    64KB

  • memory/3836-167-0x0000000004C10000-0x0000000004C20000-memory.dmp

    Filesize

    64KB

  • memory/3836-166-0x0000000002290000-0x00000000022A2000-memory.dmp

    Filesize

    72KB

  • memory/3836-137-0x0000000004C20000-0x000000000511E000-memory.dmp

    Filesize

    5.0MB

  • memory/3836-154-0x0000000002290000-0x00000000022A2000-memory.dmp

    Filesize

    72KB

  • memory/3836-162-0x0000000002290000-0x00000000022A2000-memory.dmp

    Filesize

    72KB

  • memory/3836-160-0x0000000002290000-0x00000000022A2000-memory.dmp

    Filesize

    72KB

  • memory/3836-138-0x0000000002290000-0x00000000022A8000-memory.dmp

    Filesize

    96KB

  • memory/3836-148-0x0000000002290000-0x00000000022A2000-memory.dmp

    Filesize

    72KB

  • memory/3836-140-0x0000000002290000-0x00000000022A2000-memory.dmp

    Filesize

    72KB

  • memory/3836-152-0x0000000002290000-0x00000000022A2000-memory.dmp

    Filesize

    72KB

  • memory/3836-150-0x0000000002290000-0x00000000022A2000-memory.dmp

    Filesize

    72KB

  • memory/3836-164-0x0000000002290000-0x00000000022A2000-memory.dmp

    Filesize

    72KB

  • memory/3836-158-0x0000000002290000-0x00000000022A2000-memory.dmp

    Filesize

    72KB

  • memory/3836-144-0x0000000002290000-0x00000000022A2000-memory.dmp

    Filesize

    72KB

  • memory/3836-142-0x0000000002290000-0x00000000022A2000-memory.dmp

    Filesize

    72KB

  • memory/3836-136-0x00000000006D0000-0x00000000006EA000-memory.dmp

    Filesize

    104KB

  • memory/3836-135-0x00000000001D0000-0x00000000001FD000-memory.dmp

    Filesize

    180KB

  • memory/4372-1111-0x0000000000D10000-0x0000000000D42000-memory.dmp

    Filesize

    200KB

  • memory/4372-1112-0x0000000005750000-0x000000000579B000-memory.dmp

    Filesize

    300KB

  • memory/4372-1113-0x0000000005630000-0x0000000005640000-memory.dmp

    Filesize

    64KB

  • memory/4372-1114-0x0000000005630000-0x0000000005640000-memory.dmp

    Filesize

    64KB