Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-04-2023 20:58

General

  • Target

    3a4ce9fa246924bc049d37e077d35874ea6806845a0cb512139df90a1bbe0562.exe

  • Size

    535KB

  • MD5

    57fec1386f335f711eb261a273860385

  • SHA1

    edea4c56a72197822e9048a5a8142272f1710854

  • SHA256

    3a4ce9fa246924bc049d37e077d35874ea6806845a0cb512139df90a1bbe0562

  • SHA512

    603baad7f1472b2e3d68f275eaf43470200021a6d609e6c7f35351014156ce876c3aa7b86fc5bf44af42dc67357c1aef236436ce386a66d1d28da3b0ff145f9c

  • SSDEEP

    12288:+Mrcy90EEojf44o9rWfr/xK7C0G0ZeztpytYqJyBN+tG+j:2yDRs/wxfkuw7JJ7j

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 33 IoCs
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\3a4ce9fa246924bc049d37e077d35874ea6806845a0cb512139df90a1bbe0562.exe
    "C:\Users\Admin\AppData\Local\Temp\3a4ce9fa246924bc049d37e077d35874ea6806845a0cb512139df90a1bbe0562.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2452
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziDx0439.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziDx0439.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4628
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it768848.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it768848.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4952
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr640311.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr640311.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:5008
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k netsvcs -p
    1⤵
    • Drops file in System32 directory
    • Checks processor information in registry
    • Enumerates system info in registry
    PID:3196

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

3
T1112

Disabling Security Tools

2
T1089

Discovery

Query Registry

3
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziDx0439.exe
    Filesize

    382KB

    MD5

    a78a9e137312b6b27e69074748ce907b

    SHA1

    5b4483393d74e9effd8728260c21c86633cb619d

    SHA256

    516686a8356cab04d0dd8d8a07bf94f67a4bb68e9652b5c8beb751f2c75fc692

    SHA512

    72ad59a9ecbbd9f8968b8b4b5bf7e9ed1a9748af4b1e865f4f52f59518dd47de965ba0f063bd4dbbd6d6020d88a8b8838bea4d498b2617af3559368aa3ce284b

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziDx0439.exe
    Filesize

    382KB

    MD5

    a78a9e137312b6b27e69074748ce907b

    SHA1

    5b4483393d74e9effd8728260c21c86633cb619d

    SHA256

    516686a8356cab04d0dd8d8a07bf94f67a4bb68e9652b5c8beb751f2c75fc692

    SHA512

    72ad59a9ecbbd9f8968b8b4b5bf7e9ed1a9748af4b1e865f4f52f59518dd47de965ba0f063bd4dbbd6d6020d88a8b8838bea4d498b2617af3559368aa3ce284b

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it768848.exe
    Filesize

    11KB

    MD5

    d8c5787eccdf1a982b642ddde7667899

    SHA1

    a12d727bf992e0aceda76cd1d782dff89cb85fc1

    SHA256

    c684fe61d26739acec9b186b1387f5e4a7b0a384d2716eefc6881d0387784409

    SHA512

    7860d16712baae543e463c2305c99892c444f5755e03d407086d395adfdd2d11ac6567cf136b1e713f950b2b3ba02b9376d4abb4ccebbc845b2685ddeafe302b

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it768848.exe
    Filesize

    11KB

    MD5

    d8c5787eccdf1a982b642ddde7667899

    SHA1

    a12d727bf992e0aceda76cd1d782dff89cb85fc1

    SHA256

    c684fe61d26739acec9b186b1387f5e4a7b0a384d2716eefc6881d0387784409

    SHA512

    7860d16712baae543e463c2305c99892c444f5755e03d407086d395adfdd2d11ac6567cf136b1e713f950b2b3ba02b9376d4abb4ccebbc845b2685ddeafe302b

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr640311.exe
    Filesize

    297KB

    MD5

    ca38bd9870e570150458e09d14353743

    SHA1

    ac9c18247b6d2ec64a6865a4ae65dc6f13d41ed8

    SHA256

    809245a343ef12ee6ebf8cd6548d2013b2f155312e6ee4b560b0aadd0126630e

    SHA512

    f0f38eb34cbd51220aef77c2fac78b0008b8bcb974d6d63d2a00e1026c465995c3313acaff976024795e1290d6e0e9dd107e3bf343afdc8597c3ffde1b7e477f

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr640311.exe
    Filesize

    297KB

    MD5

    ca38bd9870e570150458e09d14353743

    SHA1

    ac9c18247b6d2ec64a6865a4ae65dc6f13d41ed8

    SHA256

    809245a343ef12ee6ebf8cd6548d2013b2f155312e6ee4b560b0aadd0126630e

    SHA512

    f0f38eb34cbd51220aef77c2fac78b0008b8bcb974d6d63d2a00e1026c465995c3313acaff976024795e1290d6e0e9dd107e3bf343afdc8597c3ffde1b7e477f

  • memory/4952-149-0x0000000000B90000-0x0000000000B9A000-memory.dmp
    Filesize

    40KB

  • memory/5008-161-0x00000000006C0000-0x000000000070B000-memory.dmp
    Filesize

    300KB

  • memory/5008-162-0x0000000004AA0000-0x0000000004AB0000-memory.dmp
    Filesize

    64KB

  • memory/5008-163-0x0000000004AB0000-0x0000000005054000-memory.dmp
    Filesize

    5.6MB

  • memory/5008-164-0x0000000004AA0000-0x0000000004AB0000-memory.dmp
    Filesize

    64KB

  • memory/5008-165-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/5008-168-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/5008-166-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/5008-170-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/5008-172-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/5008-174-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/5008-176-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/5008-178-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/5008-180-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/5008-182-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/5008-184-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/5008-186-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/5008-188-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/5008-190-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/5008-192-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/5008-194-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/5008-196-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/5008-198-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/5008-200-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/5008-202-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/5008-204-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/5008-206-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/5008-210-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/5008-212-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/5008-208-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/5008-214-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/5008-216-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/5008-218-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/5008-220-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/5008-222-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/5008-224-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/5008-226-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/5008-228-0x0000000004A60000-0x0000000004A9F000-memory.dmp
    Filesize

    252KB

  • memory/5008-1072-0x0000000005200000-0x0000000005818000-memory.dmp
    Filesize

    6.1MB

  • memory/5008-1073-0x00000000058A0000-0x00000000059AA000-memory.dmp
    Filesize

    1.0MB

  • memory/5008-1074-0x00000000059E0000-0x00000000059F2000-memory.dmp
    Filesize

    72KB

  • memory/5008-1075-0x0000000005A00000-0x0000000005A3C000-memory.dmp
    Filesize

    240KB

  • memory/5008-1076-0x0000000004AA0000-0x0000000004AB0000-memory.dmp
    Filesize

    64KB

  • memory/5008-1077-0x0000000004AA0000-0x0000000004AB0000-memory.dmp
    Filesize

    64KB

  • memory/5008-1078-0x0000000004AA0000-0x0000000004AB0000-memory.dmp
    Filesize

    64KB

  • memory/5008-1079-0x0000000004AA0000-0x0000000004AB0000-memory.dmp
    Filesize

    64KB

  • memory/5008-1081-0x0000000004AA0000-0x0000000004AB0000-memory.dmp
    Filesize

    64KB