Analysis

  • max time kernel
    152s
  • max time network
    190s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/05/2023, 18:23 UTC

General

  • Target

    4c704574790a3f618497a05ca7e00d3e0acce9f02b921055e81714cf7aee4fbd.exe

  • Size

    554KB

  • MD5

    806b93727802ab6e59d30eb60c0d6915

  • SHA1

    ff5bc6534f66fa88c87dc53c9dd386cf2c6dd6cb

  • SHA256

    4c704574790a3f618497a05ca7e00d3e0acce9f02b921055e81714cf7aee4fbd

  • SHA512

    660e62294c1edd855c0e291e3f1839ceb5f9d9244583cae44207a0aeafd348bd8f43bad584612b1e2d0a2b02c42db5d9ae85e63176857319f0e81e68c8298679

  • SSDEEP

    12288:eMrny90EIVI2PmM7t5XnM3OQm+WLnmGPBXq2iQYWKcaR:NyTIVI2eit5khOPIeaR

Malware Config

Extracted

Family

redline

Botnet

darm

C2

217.196.96.56:4138

Attributes
  • auth_value

    d88ac8ccc04ab9979b04b46313db1648

Signatures

  • Detects Redline Stealer samples 2 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4c704574790a3f618497a05ca7e00d3e0acce9f02b921055e81714cf7aee4fbd.exe
    "C:\Users\Admin\AppData\Local\Temp\4c704574790a3f618497a05ca7e00d3e0acce9f02b921055e81714cf7aee4fbd.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3456
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0047531.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0047531.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4700
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g1362961.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g1362961.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3776

Network

  • flag-us
    DNS
    8.3.197.209.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.3.197.209.in-addr.arpa
    IN PTR
    Response
    8.3.197.209.in-addr.arpa
    IN PTR
    vip0x008map2sslhwcdnnet
  • flag-us
    DNS
    86.8.109.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    86.8.109.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    254.178.238.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    254.178.238.8.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    26.165.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    26.165.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    56.126.166.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    56.126.166.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    2.36.159.162.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    2.36.159.162.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    56.96.196.217.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    56.96.196.217.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    33.18.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    33.18.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    134.121.24.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    134.121.24.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    6.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.0.3.0.1.3.0.6.2.ip6.arpa
    Remote address:
    8.8.8.8:53
    Request
    6.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.0.3.0.1.3.0.6.2.ip6.arpa
    IN PTR
    Response
  • flag-us
    DNS
    32.146.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    32.146.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    154.239.44.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    154.239.44.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    191.94.239.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    191.94.239.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    113.238.32.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    113.238.32.23.in-addr.arpa
    IN PTR
    Response
    113.238.32.23.in-addr.arpa
    IN PTR
    a23-32-238-113deploystaticakamaitechnologiescom
  • flag-us
    DNS
    113.238.32.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    113.238.32.23.in-addr.arpa
    IN PTR
    Response
    113.238.32.23.in-addr.arpa
    IN PTR
    a23-32-238-113deploystaticakamaitechnologiescom
  • 209.197.3.8:80
    208 B
    4
  • 52.242.97.97:443
    260 B
    5
  • 93.184.220.29:80
    322 B
    7
  • 84.53.175.11:80
    322 B
    7
  • 173.223.113.164:443
    322 B
    7
  • 173.223.113.131:80
    322 B
    7
  • 204.79.197.203:80
    322 B
    7
  • 217.196.96.56:4138
    g1362961.exe
    11.4kB
    6.8kB
    35
    25
  • 8.8.8.8:53
    8.3.197.209.in-addr.arpa
    dns
    70 B
    111 B
    1
    1

    DNS Request

    8.3.197.209.in-addr.arpa

  • 8.8.8.8:53
    86.8.109.52.in-addr.arpa
    dns
    70 B
    144 B
    1
    1

    DNS Request

    86.8.109.52.in-addr.arpa

  • 8.8.8.8:53
    254.178.238.8.in-addr.arpa
    dns
    72 B
    126 B
    1
    1

    DNS Request

    254.178.238.8.in-addr.arpa

  • 8.8.8.8:53
    26.165.165.52.in-addr.arpa
    dns
    72 B
    146 B
    1
    1

    DNS Request

    26.165.165.52.in-addr.arpa

  • 8.8.8.8:53
    56.126.166.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    56.126.166.20.in-addr.arpa

  • 8.8.8.8:53
    2.36.159.162.in-addr.arpa
    dns
    71 B
    133 B
    1
    1

    DNS Request

    2.36.159.162.in-addr.arpa

  • 8.8.8.8:53
    56.96.196.217.in-addr.arpa
    dns
    72 B
    132 B
    1
    1

    DNS Request

    56.96.196.217.in-addr.arpa

  • 8.8.8.8:53
    33.18.126.40.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    33.18.126.40.in-addr.arpa

  • 8.8.8.8:53
    134.121.24.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    134.121.24.20.in-addr.arpa

  • 8.8.8.8:53
    6.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.0.3.0.1.3.0.6.2.ip6.arpa
    dns
    118 B
    204 B
    1
    1

    DNS Request

    6.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.0.3.0.1.3.0.6.2.ip6.arpa

  • 8.8.8.8:53
    32.146.190.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    32.146.190.20.in-addr.arpa

  • 8.8.8.8:53
    154.239.44.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    154.239.44.20.in-addr.arpa

  • 8.8.8.8:53
    191.94.239.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    191.94.239.20.in-addr.arpa

  • 8.8.8.8:53
    113.238.32.23.in-addr.arpa
    dns
    144 B
    274 B
    2
    2

    DNS Request

    113.238.32.23.in-addr.arpa

    DNS Request

    113.238.32.23.in-addr.arpa

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0047531.exe

    Filesize

    382KB

    MD5

    566fd352dab97049f5b38fc2dd4bfc2c

    SHA1

    65bf7e2116615ae7185369eb48d1e195a006fce2

    SHA256

    180160a4ef9108cb6d03ba8497f35ac3b0281ec5e5b58198366ce0dd7914faaa

    SHA512

    8dc46785d3b6c7045ac883d65d79fd919f20dc78ab68c9f9e8d6cfea31c7babdb920bb394372d52f9f9413487797e44e2d42d245ebcb99dfdb667bc2061b50af

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0047531.exe

    Filesize

    382KB

    MD5

    566fd352dab97049f5b38fc2dd4bfc2c

    SHA1

    65bf7e2116615ae7185369eb48d1e195a006fce2

    SHA256

    180160a4ef9108cb6d03ba8497f35ac3b0281ec5e5b58198366ce0dd7914faaa

    SHA512

    8dc46785d3b6c7045ac883d65d79fd919f20dc78ab68c9f9e8d6cfea31c7babdb920bb394372d52f9f9413487797e44e2d42d245ebcb99dfdb667bc2061b50af

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g1362961.exe

    Filesize

    169KB

    MD5

    875fe879a6710f2d234c364ed16f91f6

    SHA1

    e046da6a3e0e5b1ee619aa529be24d131bf001cf

    SHA256

    fd6d75036030d9db26a2a97d25aa9799de99254bfece746fcfff515535ec2ac3

    SHA512

    e5b23d50b1c9504c1548c44e60d9c023aba4e13fbd4c1837936d1407cd3016cb0106131f41d447ca8e8ae81ea9ee05b8d28a598556d43659ba07d0cfc1fbb0fe

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g1362961.exe

    Filesize

    169KB

    MD5

    875fe879a6710f2d234c364ed16f91f6

    SHA1

    e046da6a3e0e5b1ee619aa529be24d131bf001cf

    SHA256

    fd6d75036030d9db26a2a97d25aa9799de99254bfece746fcfff515535ec2ac3

    SHA512

    e5b23d50b1c9504c1548c44e60d9c023aba4e13fbd4c1837936d1407cd3016cb0106131f41d447ca8e8ae81ea9ee05b8d28a598556d43659ba07d0cfc1fbb0fe

  • memory/3776-147-0x0000000000DD0000-0x0000000000E00000-memory.dmp

    Filesize

    192KB

  • memory/3776-148-0x000000000B290000-0x000000000B8A8000-memory.dmp

    Filesize

    6.1MB

  • memory/3776-149-0x000000000AEC0000-0x000000000AFCA000-memory.dmp

    Filesize

    1.0MB

  • memory/3776-150-0x000000000ADD0000-0x000000000ADE2000-memory.dmp

    Filesize

    72KB

  • memory/3776-151-0x00000000058E0000-0x00000000058F0000-memory.dmp

    Filesize

    64KB

  • memory/3776-152-0x000000000AE30000-0x000000000AE6C000-memory.dmp

    Filesize

    240KB

  • memory/3776-153-0x00000000058E0000-0x00000000058F0000-memory.dmp

    Filesize

    64KB

  • memory/3776-154-0x0000000002E60000-0x0000000002ED6000-memory.dmp

    Filesize

    472KB

  • memory/3776-155-0x0000000002CF0000-0x0000000002D82000-memory.dmp

    Filesize

    584KB

  • memory/3776-156-0x000000000BE60000-0x000000000C404000-memory.dmp

    Filesize

    5.6MB

  • memory/3776-157-0x000000000B160000-0x000000000B1C6000-memory.dmp

    Filesize

    408KB

  • memory/3776-158-0x000000000B1D0000-0x000000000B220000-memory.dmp

    Filesize

    320KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.