Analysis

  • max time kernel
    150s
  • max time network
    100s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    03-05-2023 22:12

General

  • Target

    d828463362d069ce62f8ef4fe35dd13319103fd2c24766788d1091e15301505d.exe

  • Size

    1.4MB

  • MD5

    cd720db9e9f6bd1d661936b2b5187143

  • SHA1

    7f698015698b61e2a31c4b27569903fd501c040c

  • SHA256

    d828463362d069ce62f8ef4fe35dd13319103fd2c24766788d1091e15301505d

  • SHA512

    2f4534271acc77a6639dc858b0f3d3e41df102e98175298d27a42ff6275329f3261e0af58d5806ef6a65073bc638e22b6f90783b59447c70345dd38de211e79e

  • SSDEEP

    24576:TyhXR5iqzOHeAi+miNjsT5SUuIKrPQ5hsic3Gc/dpm8BT:m1riqzui+psT5SUuIKrKhtc38

Malware Config

Extracted

Family

redline

Botnet

mask

C2

217.196.96.56:4138

Attributes
  • auth_value

    31aef25be0febb8e491794ef7f502c50

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 10 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d828463362d069ce62f8ef4fe35dd13319103fd2c24766788d1091e15301505d.exe
    "C:\Users\Admin\AppData\Local\Temp\d828463362d069ce62f8ef4fe35dd13319103fd2c24766788d1091e15301505d.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:372
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0836460.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0836460.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4512
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5912512.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5912512.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4908
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9015438.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9015438.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:68
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v0104675.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v0104675.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:2292
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a6963326.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a6963326.exe
              6⤵
              • Modifies Windows Defender Real-time Protection settings
              • Executes dropped EXE
              • Windows security modification
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4476
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b5477546.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b5477546.exe
              6⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1308
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c3949629.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c3949629.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of FindShellTrayWindow
            PID:4156
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 620
              6⤵
              • Program crash
              PID:1372
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 700
              6⤵
              • Program crash
              PID:4408
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 840
              6⤵
              • Program crash
              PID:4388
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 848
              6⤵
              • Program crash
              PID:3264
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 908
              6⤵
              • Program crash
              PID:5044
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 836
              6⤵
              • Program crash
              PID:4748
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 1120
              6⤵
              • Program crash
              PID:3184
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 1192
              6⤵
              • Program crash
              PID:3392
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 1240
              6⤵
              • Program crash
              PID:3948

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0836460.exe

    Filesize

    1.3MB

    MD5

    ecfb94bcc1d1b3a27148d2b2493822ca

    SHA1

    200ae5328dc3f457af859430ea2493d41c9263d6

    SHA256

    776414d8868271f72ab52924eef3621fe22e627806fc90bf8ae127650214ffd0

    SHA512

    3a15af3c9cb5b83f29fb74d2c86fcbe42b742947801520759d0f80197ddf629d3f71902c3321b6e5efd564ca362a4ce14651d35fad5712643e3994a52e4fd353

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0836460.exe

    Filesize

    1.3MB

    MD5

    ecfb94bcc1d1b3a27148d2b2493822ca

    SHA1

    200ae5328dc3f457af859430ea2493d41c9263d6

    SHA256

    776414d8868271f72ab52924eef3621fe22e627806fc90bf8ae127650214ffd0

    SHA512

    3a15af3c9cb5b83f29fb74d2c86fcbe42b742947801520759d0f80197ddf629d3f71902c3321b6e5efd564ca362a4ce14651d35fad5712643e3994a52e4fd353

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5912512.exe

    Filesize

    845KB

    MD5

    149418b7d4713fa444bf069ecbd79a3a

    SHA1

    45bfb36fcc994a01adfc54c0f5b5d1dc73962095

    SHA256

    b3f8e074c083405bd78305998011cd4d006fd24acd18e4a4ee363a21d5098e47

    SHA512

    60ee4b7176316e760b7cc738fd58371f5e4c784609d88ea26a05d7da2273744d1ac9c706f36987e59516f6c10e7fe0cd2a0217a4aec42b120ee827caac8d9e31

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5912512.exe

    Filesize

    845KB

    MD5

    149418b7d4713fa444bf069ecbd79a3a

    SHA1

    45bfb36fcc994a01adfc54c0f5b5d1dc73962095

    SHA256

    b3f8e074c083405bd78305998011cd4d006fd24acd18e4a4ee363a21d5098e47

    SHA512

    60ee4b7176316e760b7cc738fd58371f5e4c784609d88ea26a05d7da2273744d1ac9c706f36987e59516f6c10e7fe0cd2a0217a4aec42b120ee827caac8d9e31

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9015438.exe

    Filesize

    641KB

    MD5

    a9d58d131b123515f970503b5dd67ba4

    SHA1

    377a34adeb8df9c23009b4db68e4a7b11c7bf625

    SHA256

    4c249596b47d21173de34146f989b8163514068e01c6fc85579bdd2b9fee14f2

    SHA512

    676071eff21ec9c5aa97a68eb99b222d24c96a22de478b77aa267b8767dbeae5304118c924895c292b497c635b43e9a4ec9d91801990c90461994d3f8558a3be

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9015438.exe

    Filesize

    641KB

    MD5

    a9d58d131b123515f970503b5dd67ba4

    SHA1

    377a34adeb8df9c23009b4db68e4a7b11c7bf625

    SHA256

    4c249596b47d21173de34146f989b8163514068e01c6fc85579bdd2b9fee14f2

    SHA512

    676071eff21ec9c5aa97a68eb99b222d24c96a22de478b77aa267b8767dbeae5304118c924895c292b497c635b43e9a4ec9d91801990c90461994d3f8558a3be

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c3949629.exe

    Filesize

    268KB

    MD5

    1c5f6d6cecf56c665270b12957176f04

    SHA1

    8f9a134be57bc254d4a916261762a482af902632

    SHA256

    0ee59b47167c6255a62aeaba9c1c3a5b9d0a2dc6134125dc3bd91996c10eb4e9

    SHA512

    b94098d935ecf9736122fb1eaa77be4b865dc462c6cf6fbd4a0d4cc2d885c83e61a36c6f1c127b06efc800e40629afd8386735514ff21ce62ca74b56000a7090

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c3949629.exe

    Filesize

    268KB

    MD5

    1c5f6d6cecf56c665270b12957176f04

    SHA1

    8f9a134be57bc254d4a916261762a482af902632

    SHA256

    0ee59b47167c6255a62aeaba9c1c3a5b9d0a2dc6134125dc3bd91996c10eb4e9

    SHA512

    b94098d935ecf9736122fb1eaa77be4b865dc462c6cf6fbd4a0d4cc2d885c83e61a36c6f1c127b06efc800e40629afd8386735514ff21ce62ca74b56000a7090

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v0104675.exe

    Filesize

    383KB

    MD5

    a9858da4d8d68f9148cb2fdf88c968b0

    SHA1

    dd95e412a2d1ae826aa4376f3179a4c284a6e96a

    SHA256

    86bd0d4490ff6bd10ff0639f1d9d4d98a1a910d5dcb7d75db31d4d9c0f9efefb

    SHA512

    1409e1ca0e0bb3388846d4b17fece4c43ff78f0cd970d25583f7d9f4992d95f85824df3dffdbd865a6fc2ca413e33865a9ad4523429acb9d05f94beb64b5baea

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v0104675.exe

    Filesize

    383KB

    MD5

    a9858da4d8d68f9148cb2fdf88c968b0

    SHA1

    dd95e412a2d1ae826aa4376f3179a4c284a6e96a

    SHA256

    86bd0d4490ff6bd10ff0639f1d9d4d98a1a910d5dcb7d75db31d4d9c0f9efefb

    SHA512

    1409e1ca0e0bb3388846d4b17fece4c43ff78f0cd970d25583f7d9f4992d95f85824df3dffdbd865a6fc2ca413e33865a9ad4523429acb9d05f94beb64b5baea

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a6963326.exe

    Filesize

    289KB

    MD5

    4cd759f1f1666573ef5a6756d5268424

    SHA1

    a979ffdccaf067ac3f43865c9900608a1aefaeb0

    SHA256

    7f677e587f427a224054bed62ce3313e9c48cfa7a17bb630b4a685a64ae08f49

    SHA512

    30a87da5cd8a481ae724e69011bffbca7843d8f1d5b302e7338228da5cc38ed72886a766eb1239dd74d096f153d2582c3e97c2c7ad47ffb2a71eaa9bd665f97f

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a6963326.exe

    Filesize

    289KB

    MD5

    4cd759f1f1666573ef5a6756d5268424

    SHA1

    a979ffdccaf067ac3f43865c9900608a1aefaeb0

    SHA256

    7f677e587f427a224054bed62ce3313e9c48cfa7a17bb630b4a685a64ae08f49

    SHA512

    30a87da5cd8a481ae724e69011bffbca7843d8f1d5b302e7338228da5cc38ed72886a766eb1239dd74d096f153d2582c3e97c2c7ad47ffb2a71eaa9bd665f97f

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b5477546.exe

    Filesize

    168KB

    MD5

    7a74df915b5430800ba197dafd4212e1

    SHA1

    68836a1e973bcee635351e9a5f697b27639efcb6

    SHA256

    2a65571a76a6acb055bbcae4911cf3c5bcaad3186930c92e4b9941ccacac4618

    SHA512

    3ead8c640f51aed743423c71747f060c1033e31c349b78cdc6ecfd196837e69c932a074881ec422c4ed8e4454dc686c199c580c6c1159ed0660e43f5a5fd2b1e

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b5477546.exe

    Filesize

    168KB

    MD5

    7a74df915b5430800ba197dafd4212e1

    SHA1

    68836a1e973bcee635351e9a5f697b27639efcb6

    SHA256

    2a65571a76a6acb055bbcae4911cf3c5bcaad3186930c92e4b9941ccacac4618

    SHA512

    3ead8c640f51aed743423c71747f060c1033e31c349b78cdc6ecfd196837e69c932a074881ec422c4ed8e4454dc686c199c580c6c1159ed0660e43f5a5fd2b1e

  • memory/1308-204-0x0000000005D20000-0x0000000005DB2000-memory.dmp

    Filesize

    584KB

  • memory/1308-201-0x0000000005740000-0x0000000005750000-memory.dmp

    Filesize

    64KB

  • memory/1308-208-0x0000000009000000-0x000000000952C000-memory.dmp

    Filesize

    5.2MB

  • memory/1308-207-0x0000000007280000-0x0000000007442000-memory.dmp

    Filesize

    1.8MB

  • memory/1308-206-0x00000000066F0000-0x0000000006740000-memory.dmp

    Filesize

    320KB

  • memory/1308-205-0x0000000005DC0000-0x0000000005E26000-memory.dmp

    Filesize

    408KB

  • memory/1308-195-0x0000000000E30000-0x0000000000E60000-memory.dmp

    Filesize

    192KB

  • memory/1308-203-0x0000000005C00000-0x0000000005C76000-memory.dmp

    Filesize

    472KB

  • memory/1308-202-0x0000000005A70000-0x0000000005ABB000-memory.dmp

    Filesize

    300KB

  • memory/1308-209-0x0000000005740000-0x0000000005750000-memory.dmp

    Filesize

    64KB

  • memory/1308-200-0x00000000058E0000-0x000000000591E000-memory.dmp

    Filesize

    248KB

  • memory/1308-199-0x0000000005880000-0x0000000005892000-memory.dmp

    Filesize

    72KB

  • memory/1308-198-0x0000000005960000-0x0000000005A6A000-memory.dmp

    Filesize

    1.0MB

  • memory/1308-197-0x0000000005E60000-0x0000000006466000-memory.dmp

    Filesize

    6.0MB

  • memory/1308-196-0x00000000030B0000-0x00000000030B6000-memory.dmp

    Filesize

    24KB

  • memory/4156-215-0x00000000006D0000-0x0000000000705000-memory.dmp

    Filesize

    212KB

  • memory/4156-216-0x0000000000400000-0x00000000006C4000-memory.dmp

    Filesize

    2.8MB

  • memory/4476-157-0x0000000002150000-0x0000000002168000-memory.dmp

    Filesize

    96KB

  • memory/4476-188-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/4476-189-0x0000000002140000-0x0000000002150000-memory.dmp

    Filesize

    64KB

  • memory/4476-191-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/4476-187-0x0000000002140000-0x0000000002150000-memory.dmp

    Filesize

    64KB

  • memory/4476-186-0x0000000002140000-0x0000000002150000-memory.dmp

    Filesize

    64KB

  • memory/4476-185-0x0000000002150000-0x0000000002162000-memory.dmp

    Filesize

    72KB

  • memory/4476-183-0x0000000002150000-0x0000000002162000-memory.dmp

    Filesize

    72KB

  • memory/4476-181-0x0000000002150000-0x0000000002162000-memory.dmp

    Filesize

    72KB

  • memory/4476-179-0x0000000002150000-0x0000000002162000-memory.dmp

    Filesize

    72KB

  • memory/4476-177-0x0000000002150000-0x0000000002162000-memory.dmp

    Filesize

    72KB

  • memory/4476-175-0x0000000002150000-0x0000000002162000-memory.dmp

    Filesize

    72KB

  • memory/4476-173-0x0000000002150000-0x0000000002162000-memory.dmp

    Filesize

    72KB

  • memory/4476-171-0x0000000002150000-0x0000000002162000-memory.dmp

    Filesize

    72KB

  • memory/4476-169-0x0000000002150000-0x0000000002162000-memory.dmp

    Filesize

    72KB

  • memory/4476-167-0x0000000002150000-0x0000000002162000-memory.dmp

    Filesize

    72KB

  • memory/4476-165-0x0000000002150000-0x0000000002162000-memory.dmp

    Filesize

    72KB

  • memory/4476-163-0x0000000002150000-0x0000000002162000-memory.dmp

    Filesize

    72KB

  • memory/4476-161-0x0000000002150000-0x0000000002162000-memory.dmp

    Filesize

    72KB

  • memory/4476-159-0x0000000002150000-0x0000000002162000-memory.dmp

    Filesize

    72KB

  • memory/4476-158-0x0000000002150000-0x0000000002162000-memory.dmp

    Filesize

    72KB

  • memory/4476-156-0x0000000004A90000-0x0000000004F8E000-memory.dmp

    Filesize

    5.0MB

  • memory/4476-155-0x0000000002140000-0x0000000002150000-memory.dmp

    Filesize

    64KB

  • memory/4476-154-0x00000000020F0000-0x000000000210A000-memory.dmp

    Filesize

    104KB

  • memory/4476-153-0x00000000001D0000-0x00000000001FD000-memory.dmp

    Filesize

    180KB