Analysis

  • max time kernel
    169s
  • max time network
    205s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    06/05/2023, 21:20

General

  • Target

    9a23b608d40c2409be16f02653f782b9bce18fc6e204efea3072c3bd60915715.exe

  • Size

    1.5MB

  • MD5

    3765e5a027328866312a6f27f6d02875

  • SHA1

    88a999cfb8317430a887fc87ee4e243218583a30

  • SHA256

    9a23b608d40c2409be16f02653f782b9bce18fc6e204efea3072c3bd60915715

  • SHA512

    1b54958032e7ae9553118a2b264d0990871cda2c483871a69007299d345258b7bcba2f96142b433bbf621c5756ebbbdd12634e5276e048a8e961012864b3b309

  • SSDEEP

    24576:eyBiX7WB+CjluuY6ckhEUHvEqCyzTGeACrbjUJMb9wPpyJm46fo3qLvZ:tBiXSBkuZl9cqC8TGPCrXUJOSM+/Lv

Malware Config

Extracted

Family

redline

Botnet

maza

C2

185.161.248.73:4164

Attributes
  • auth_value

    474d54c1c2f5291290c53f8378acd684

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 13 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9a23b608d40c2409be16f02653f782b9bce18fc6e204efea3072c3bd60915715.exe
    "C:\Users\Admin\AppData\Local\Temp\9a23b608d40c2409be16f02653f782b9bce18fc6e204efea3072c3bd60915715.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1804
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i56702579.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i56702579.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2004
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i25280411.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i25280411.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1288
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i30717911.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i30717911.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:1476
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i93229882.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i93229882.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:800
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a78290018.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a78290018.exe
              6⤵
              • Modifies Windows Defender Real-time Protection settings
              • Executes dropped EXE
              • Loads dropped DLL
              • Windows security modification
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:852
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b61977632.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b61977632.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1380

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i56702579.exe

    Filesize

    1.3MB

    MD5

    30298022fce160f9aa3bde2158a3e14f

    SHA1

    d250cc51a27b7d245a385e8e626e0ce683421189

    SHA256

    d09f8cd1a6fe7401ebf21ff2b05dc96b22da338064676a90cf30120dc856e6f8

    SHA512

    afbf22b47dba6a2808946cc199638dd29ddb8dc7c61f583d6a97895148d9578dd3f8cb8210dcc1af75a74826062cce523da7ade2304201b016f756f87ac3f0d0

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i56702579.exe

    Filesize

    1.3MB

    MD5

    30298022fce160f9aa3bde2158a3e14f

    SHA1

    d250cc51a27b7d245a385e8e626e0ce683421189

    SHA256

    d09f8cd1a6fe7401ebf21ff2b05dc96b22da338064676a90cf30120dc856e6f8

    SHA512

    afbf22b47dba6a2808946cc199638dd29ddb8dc7c61f583d6a97895148d9578dd3f8cb8210dcc1af75a74826062cce523da7ade2304201b016f756f87ac3f0d0

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i25280411.exe

    Filesize

    1.1MB

    MD5

    23051fa1442198fc1439c01c2996268b

    SHA1

    6f5a4964abc467de857b038c547f21eb4abd72c4

    SHA256

    156620d0e3d8855e7e46fe73cf4de9a2745bdb1e5580c622097476419fcbdbee

    SHA512

    308e0439e64bb1bb403dff46083b865c9b09b2ab84bf6e1f7864661b6508ddbefa7c7e6f7bc47a3c90c0f9fe6e53e1133627a86f0b1954cc73ed401826f3d055

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i25280411.exe

    Filesize

    1.1MB

    MD5

    23051fa1442198fc1439c01c2996268b

    SHA1

    6f5a4964abc467de857b038c547f21eb4abd72c4

    SHA256

    156620d0e3d8855e7e46fe73cf4de9a2745bdb1e5580c622097476419fcbdbee

    SHA512

    308e0439e64bb1bb403dff46083b865c9b09b2ab84bf6e1f7864661b6508ddbefa7c7e6f7bc47a3c90c0f9fe6e53e1133627a86f0b1954cc73ed401826f3d055

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i30717911.exe

    Filesize

    687KB

    MD5

    ef610db83309b6856b6fa13c93f025d5

    SHA1

    e50d683d04995e285adb39ab15a624079ce28519

    SHA256

    83955076601ab552eb35947426c54f07525fdade6b8fffdcf445d62f806d9aa0

    SHA512

    bba8cd3b9a25dd036c5a7779d8cee24e4fe7ff1018e828c20630c1dc308ec82dd109621231a370fd72ef1f210fd3d7bd4a4ed69cf5fd95a82460fecf46df36f8

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i30717911.exe

    Filesize

    687KB

    MD5

    ef610db83309b6856b6fa13c93f025d5

    SHA1

    e50d683d04995e285adb39ab15a624079ce28519

    SHA256

    83955076601ab552eb35947426c54f07525fdade6b8fffdcf445d62f806d9aa0

    SHA512

    bba8cd3b9a25dd036c5a7779d8cee24e4fe7ff1018e828c20630c1dc308ec82dd109621231a370fd72ef1f210fd3d7bd4a4ed69cf5fd95a82460fecf46df36f8

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i93229882.exe

    Filesize

    403KB

    MD5

    ba4a109c9ca0c90cc02c37365c9b50e7

    SHA1

    8054a1e96b263dc143fffa7e3c1d4a248570562a

    SHA256

    cdf3d91f15538616f555f1e819b2d510cd1f1441873ef8e4209e2f9fc6cf0fbd

    SHA512

    f0318055879bf7bdc4f2ce34ce8945dbc651151a08d109c86e7c54c346bf55146535e07e193949aacc635d014625a56a033dfc3cfc1ab52e4bcdf2984563ab6f

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i93229882.exe

    Filesize

    403KB

    MD5

    ba4a109c9ca0c90cc02c37365c9b50e7

    SHA1

    8054a1e96b263dc143fffa7e3c1d4a248570562a

    SHA256

    cdf3d91f15538616f555f1e819b2d510cd1f1441873ef8e4209e2f9fc6cf0fbd

    SHA512

    f0318055879bf7bdc4f2ce34ce8945dbc651151a08d109c86e7c54c346bf55146535e07e193949aacc635d014625a56a033dfc3cfc1ab52e4bcdf2984563ab6f

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a78290018.exe

    Filesize

    344KB

    MD5

    c6ecdc777352e773b4a38cd14640a45e

    SHA1

    597fe0d9bff57fe4e5cef42dd719dbda875c8c8b

    SHA256

    06b6488995d9076755841d1fa7f3d29aaa81224bce2658dc8d969719b24c351d

    SHA512

    43a9ee085f66115fd068f6363ee97961d0cf50dd672e17086053071e09e02abb4911c287f7da5f1b14a69264404c46add11e95aa1e1ba709a6a55803c8aa582d

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a78290018.exe

    Filesize

    344KB

    MD5

    c6ecdc777352e773b4a38cd14640a45e

    SHA1

    597fe0d9bff57fe4e5cef42dd719dbda875c8c8b

    SHA256

    06b6488995d9076755841d1fa7f3d29aaa81224bce2658dc8d969719b24c351d

    SHA512

    43a9ee085f66115fd068f6363ee97961d0cf50dd672e17086053071e09e02abb4911c287f7da5f1b14a69264404c46add11e95aa1e1ba709a6a55803c8aa582d

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a78290018.exe

    Filesize

    344KB

    MD5

    c6ecdc777352e773b4a38cd14640a45e

    SHA1

    597fe0d9bff57fe4e5cef42dd719dbda875c8c8b

    SHA256

    06b6488995d9076755841d1fa7f3d29aaa81224bce2658dc8d969719b24c351d

    SHA512

    43a9ee085f66115fd068f6363ee97961d0cf50dd672e17086053071e09e02abb4911c287f7da5f1b14a69264404c46add11e95aa1e1ba709a6a55803c8aa582d

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b61977632.exe

    Filesize

    168KB

    MD5

    ce515251a3f19ff94fe20b0ef710911f

    SHA1

    20012695f964b9b8c63b5a264946fc99f52bed1a

    SHA256

    021f3d7f05c11b77f30e1704cdb4cfa8e521e165e6e31bee524028e5703d4c8d

    SHA512

    2f48ca036e3fdc3830a37eab9831e1d2626dd435999f91aeea8a78400fefcf1bfa660de5d8b083ef47060b4c43b883947463addf742bdc20ea5634d5c0957cbc

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b61977632.exe

    Filesize

    168KB

    MD5

    ce515251a3f19ff94fe20b0ef710911f

    SHA1

    20012695f964b9b8c63b5a264946fc99f52bed1a

    SHA256

    021f3d7f05c11b77f30e1704cdb4cfa8e521e165e6e31bee524028e5703d4c8d

    SHA512

    2f48ca036e3fdc3830a37eab9831e1d2626dd435999f91aeea8a78400fefcf1bfa660de5d8b083ef47060b4c43b883947463addf742bdc20ea5634d5c0957cbc

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\i56702579.exe

    Filesize

    1.3MB

    MD5

    30298022fce160f9aa3bde2158a3e14f

    SHA1

    d250cc51a27b7d245a385e8e626e0ce683421189

    SHA256

    d09f8cd1a6fe7401ebf21ff2b05dc96b22da338064676a90cf30120dc856e6f8

    SHA512

    afbf22b47dba6a2808946cc199638dd29ddb8dc7c61f583d6a97895148d9578dd3f8cb8210dcc1af75a74826062cce523da7ade2304201b016f756f87ac3f0d0

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\i56702579.exe

    Filesize

    1.3MB

    MD5

    30298022fce160f9aa3bde2158a3e14f

    SHA1

    d250cc51a27b7d245a385e8e626e0ce683421189

    SHA256

    d09f8cd1a6fe7401ebf21ff2b05dc96b22da338064676a90cf30120dc856e6f8

    SHA512

    afbf22b47dba6a2808946cc199638dd29ddb8dc7c61f583d6a97895148d9578dd3f8cb8210dcc1af75a74826062cce523da7ade2304201b016f756f87ac3f0d0

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\i25280411.exe

    Filesize

    1.1MB

    MD5

    23051fa1442198fc1439c01c2996268b

    SHA1

    6f5a4964abc467de857b038c547f21eb4abd72c4

    SHA256

    156620d0e3d8855e7e46fe73cf4de9a2745bdb1e5580c622097476419fcbdbee

    SHA512

    308e0439e64bb1bb403dff46083b865c9b09b2ab84bf6e1f7864661b6508ddbefa7c7e6f7bc47a3c90c0f9fe6e53e1133627a86f0b1954cc73ed401826f3d055

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\i25280411.exe

    Filesize

    1.1MB

    MD5

    23051fa1442198fc1439c01c2996268b

    SHA1

    6f5a4964abc467de857b038c547f21eb4abd72c4

    SHA256

    156620d0e3d8855e7e46fe73cf4de9a2745bdb1e5580c622097476419fcbdbee

    SHA512

    308e0439e64bb1bb403dff46083b865c9b09b2ab84bf6e1f7864661b6508ddbefa7c7e6f7bc47a3c90c0f9fe6e53e1133627a86f0b1954cc73ed401826f3d055

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\i30717911.exe

    Filesize

    687KB

    MD5

    ef610db83309b6856b6fa13c93f025d5

    SHA1

    e50d683d04995e285adb39ab15a624079ce28519

    SHA256

    83955076601ab552eb35947426c54f07525fdade6b8fffdcf445d62f806d9aa0

    SHA512

    bba8cd3b9a25dd036c5a7779d8cee24e4fe7ff1018e828c20630c1dc308ec82dd109621231a370fd72ef1f210fd3d7bd4a4ed69cf5fd95a82460fecf46df36f8

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\i30717911.exe

    Filesize

    687KB

    MD5

    ef610db83309b6856b6fa13c93f025d5

    SHA1

    e50d683d04995e285adb39ab15a624079ce28519

    SHA256

    83955076601ab552eb35947426c54f07525fdade6b8fffdcf445d62f806d9aa0

    SHA512

    bba8cd3b9a25dd036c5a7779d8cee24e4fe7ff1018e828c20630c1dc308ec82dd109621231a370fd72ef1f210fd3d7bd4a4ed69cf5fd95a82460fecf46df36f8

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\i93229882.exe

    Filesize

    403KB

    MD5

    ba4a109c9ca0c90cc02c37365c9b50e7

    SHA1

    8054a1e96b263dc143fffa7e3c1d4a248570562a

    SHA256

    cdf3d91f15538616f555f1e819b2d510cd1f1441873ef8e4209e2f9fc6cf0fbd

    SHA512

    f0318055879bf7bdc4f2ce34ce8945dbc651151a08d109c86e7c54c346bf55146535e07e193949aacc635d014625a56a033dfc3cfc1ab52e4bcdf2984563ab6f

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\i93229882.exe

    Filesize

    403KB

    MD5

    ba4a109c9ca0c90cc02c37365c9b50e7

    SHA1

    8054a1e96b263dc143fffa7e3c1d4a248570562a

    SHA256

    cdf3d91f15538616f555f1e819b2d510cd1f1441873ef8e4209e2f9fc6cf0fbd

    SHA512

    f0318055879bf7bdc4f2ce34ce8945dbc651151a08d109c86e7c54c346bf55146535e07e193949aacc635d014625a56a033dfc3cfc1ab52e4bcdf2984563ab6f

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\a78290018.exe

    Filesize

    344KB

    MD5

    c6ecdc777352e773b4a38cd14640a45e

    SHA1

    597fe0d9bff57fe4e5cef42dd719dbda875c8c8b

    SHA256

    06b6488995d9076755841d1fa7f3d29aaa81224bce2658dc8d969719b24c351d

    SHA512

    43a9ee085f66115fd068f6363ee97961d0cf50dd672e17086053071e09e02abb4911c287f7da5f1b14a69264404c46add11e95aa1e1ba709a6a55803c8aa582d

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\a78290018.exe

    Filesize

    344KB

    MD5

    c6ecdc777352e773b4a38cd14640a45e

    SHA1

    597fe0d9bff57fe4e5cef42dd719dbda875c8c8b

    SHA256

    06b6488995d9076755841d1fa7f3d29aaa81224bce2658dc8d969719b24c351d

    SHA512

    43a9ee085f66115fd068f6363ee97961d0cf50dd672e17086053071e09e02abb4911c287f7da5f1b14a69264404c46add11e95aa1e1ba709a6a55803c8aa582d

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\a78290018.exe

    Filesize

    344KB

    MD5

    c6ecdc777352e773b4a38cd14640a45e

    SHA1

    597fe0d9bff57fe4e5cef42dd719dbda875c8c8b

    SHA256

    06b6488995d9076755841d1fa7f3d29aaa81224bce2658dc8d969719b24c351d

    SHA512

    43a9ee085f66115fd068f6363ee97961d0cf50dd672e17086053071e09e02abb4911c287f7da5f1b14a69264404c46add11e95aa1e1ba709a6a55803c8aa582d

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\b61977632.exe

    Filesize

    168KB

    MD5

    ce515251a3f19ff94fe20b0ef710911f

    SHA1

    20012695f964b9b8c63b5a264946fc99f52bed1a

    SHA256

    021f3d7f05c11b77f30e1704cdb4cfa8e521e165e6e31bee524028e5703d4c8d

    SHA512

    2f48ca036e3fdc3830a37eab9831e1d2626dd435999f91aeea8a78400fefcf1bfa660de5d8b083ef47060b4c43b883947463addf742bdc20ea5634d5c0957cbc

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\b61977632.exe

    Filesize

    168KB

    MD5

    ce515251a3f19ff94fe20b0ef710911f

    SHA1

    20012695f964b9b8c63b5a264946fc99f52bed1a

    SHA256

    021f3d7f05c11b77f30e1704cdb4cfa8e521e165e6e31bee524028e5703d4c8d

    SHA512

    2f48ca036e3fdc3830a37eab9831e1d2626dd435999f91aeea8a78400fefcf1bfa660de5d8b083ef47060b4c43b883947463addf742bdc20ea5634d5c0957cbc

  • memory/852-112-0x0000000000B30000-0x0000000000B42000-memory.dmp

    Filesize

    72KB

  • memory/852-138-0x0000000000B30000-0x0000000000B42000-memory.dmp

    Filesize

    72KB

  • memory/852-116-0x0000000000B30000-0x0000000000B42000-memory.dmp

    Filesize

    72KB

  • memory/852-118-0x0000000000B30000-0x0000000000B42000-memory.dmp

    Filesize

    72KB

  • memory/852-120-0x0000000000B30000-0x0000000000B42000-memory.dmp

    Filesize

    72KB

  • memory/852-122-0x0000000000B30000-0x0000000000B42000-memory.dmp

    Filesize

    72KB

  • memory/852-124-0x0000000000B30000-0x0000000000B42000-memory.dmp

    Filesize

    72KB

  • memory/852-126-0x0000000000B30000-0x0000000000B42000-memory.dmp

    Filesize

    72KB

  • memory/852-128-0x0000000000B30000-0x0000000000B42000-memory.dmp

    Filesize

    72KB

  • memory/852-130-0x0000000000B30000-0x0000000000B42000-memory.dmp

    Filesize

    72KB

  • memory/852-132-0x0000000000B30000-0x0000000000B42000-memory.dmp

    Filesize

    72KB

  • memory/852-134-0x0000000000B30000-0x0000000000B42000-memory.dmp

    Filesize

    72KB

  • memory/852-136-0x0000000000B30000-0x0000000000B42000-memory.dmp

    Filesize

    72KB

  • memory/852-114-0x0000000000B30000-0x0000000000B42000-memory.dmp

    Filesize

    72KB

  • memory/852-139-0x0000000005380000-0x00000000053C0000-memory.dmp

    Filesize

    256KB

  • memory/852-140-0x0000000005380000-0x00000000053C0000-memory.dmp

    Filesize

    256KB

  • memory/852-141-0x0000000000400000-0x0000000000A67000-memory.dmp

    Filesize

    6.4MB

  • memory/852-143-0x0000000005380000-0x00000000053C0000-memory.dmp

    Filesize

    256KB

  • memory/852-146-0x0000000000400000-0x0000000000A67000-memory.dmp

    Filesize

    6.4MB

  • memory/852-111-0x0000000000B30000-0x0000000000B42000-memory.dmp

    Filesize

    72KB

  • memory/852-110-0x0000000000B30000-0x0000000000B48000-memory.dmp

    Filesize

    96KB

  • memory/852-109-0x0000000000AB0000-0x0000000000ACA000-memory.dmp

    Filesize

    104KB

  • memory/852-108-0x0000000000280000-0x00000000002AD000-memory.dmp

    Filesize

    180KB

  • memory/1380-153-0x00000000001B0000-0x00000000001DE000-memory.dmp

    Filesize

    184KB

  • memory/1380-154-0x0000000000290000-0x0000000000296000-memory.dmp

    Filesize

    24KB

  • memory/1380-155-0x0000000004CA0000-0x0000000004CE0000-memory.dmp

    Filesize

    256KB

  • memory/1380-156-0x0000000004CA0000-0x0000000004CE0000-memory.dmp

    Filesize

    256KB