Analysis

  • max time kernel
    47s
  • max time network
    31s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    14-05-2023 18:36

General

  • Target

    e04e5d101d0d716311b6b71e2958c3493199b14d787f0da6b22a84b78f71e93a.exe

  • Size

    1.1MB

  • MD5

    55db6060e2088a273573383c4789c3c5

  • SHA1

    a2633cd98d48996a740b8b0a05a5b60ff873bdb9

  • SHA256

    e04e5d101d0d716311b6b71e2958c3493199b14d787f0da6b22a84b78f71e93a

  • SHA512

    231feab5e830835dd939df2b547e2b1fca43cb36dab6615e48db1b4cb60515b3568ff328c87c22330a2bef692b9a68b52561573953b39d3cbd03ac49be058d93

  • SSDEEP

    24576:GyMrGI96ZsJoC0xIwucHRYcWLTxRk6j6IxVapeqBAkxybUHNlD2Sq+:VM10Zsiiwu+SxqDwSxWKNlDm

Malware Config

Extracted

Family

redline

Botnet

luka

C2

185.161.248.75:4132

Attributes
  • auth_value

    44560bcd37d6bf076da309730fdb519a

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 13 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e04e5d101d0d716311b6b71e2958c3493199b14d787f0da6b22a84b78f71e93a.exe
    "C:\Users\Admin\AppData\Local\Temp\e04e5d101d0d716311b6b71e2958c3493199b14d787f0da6b22a84b78f71e93a.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1204
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9508213.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9508213.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1688
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5390702.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5390702.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:676
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5301643.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5301643.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:832
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7919426.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7919426.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1732
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 640
            5⤵
            • Loads dropped DLL
            • Program crash
            PID:1720

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

3
T1112

Disabling Security Tools

2
T1089

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9508213.exe
    Filesize

    702KB

    MD5

    a2b4010c2ea5808ea21639d4a0588765

    SHA1

    602d9a30ff933f1320aa3d99cf2a4153d03cc667

    SHA256

    c68f9a03c7870b7d05c55c270d0910883e979f0e9c46e20d6efd9315c15d1650

    SHA512

    ad898339409a18b9409b26eee5a9a4248f2c2f2b44c7e95339e8ea468fc2c5ceb5426dc81754051065806b06bbd9aba12ad9eb27561aeddd23617b303cc0cba1

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9508213.exe
    Filesize

    702KB

    MD5

    a2b4010c2ea5808ea21639d4a0588765

    SHA1

    602d9a30ff933f1320aa3d99cf2a4153d03cc667

    SHA256

    c68f9a03c7870b7d05c55c270d0910883e979f0e9c46e20d6efd9315c15d1650

    SHA512

    ad898339409a18b9409b26eee5a9a4248f2c2f2b44c7e95339e8ea468fc2c5ceb5426dc81754051065806b06bbd9aba12ad9eb27561aeddd23617b303cc0cba1

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5390702.exe
    Filesize

    306KB

    MD5

    5f186e0064818e254b6b6af01a8409fb

    SHA1

    eb430b9303aecc5be13398a78bd30e4576c576d1

    SHA256

    504ccaaf5de1b2783a3e760e89420daaf3c48034745365cacf0d5411cf75c828

    SHA512

    4bd658f21370fc7c23b274f597dfa24fec7c5947b4720f63b9d9e919da8e45463d37471f6fa02f7964be351fe1c33f514b186a3d78afed81df01fdc904bc7327

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5390702.exe
    Filesize

    306KB

    MD5

    5f186e0064818e254b6b6af01a8409fb

    SHA1

    eb430b9303aecc5be13398a78bd30e4576c576d1

    SHA256

    504ccaaf5de1b2783a3e760e89420daaf3c48034745365cacf0d5411cf75c828

    SHA512

    4bd658f21370fc7c23b274f597dfa24fec7c5947b4720f63b9d9e919da8e45463d37471f6fa02f7964be351fe1c33f514b186a3d78afed81df01fdc904bc7327

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5301643.exe
    Filesize

    185KB

    MD5

    be5ace7590ee1bc95350c858c33ebe90

    SHA1

    7bb57cacde52a8bf5c784b08c0168fb892d9c6a0

    SHA256

    bcecb81d1349ffe25fdc5fe729b192255ebec85fbfcf66a357bff3d0de97f4e3

    SHA512

    ce1ddc512052f466650e77a62c8d2fad5410253135dc9654e692734e5e17fc0b48c7b50a7ae274744b2b94e5bd60946ec49ce4d47b23fa8309e9d49e13407e7f

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5301643.exe
    Filesize

    185KB

    MD5

    be5ace7590ee1bc95350c858c33ebe90

    SHA1

    7bb57cacde52a8bf5c784b08c0168fb892d9c6a0

    SHA256

    bcecb81d1349ffe25fdc5fe729b192255ebec85fbfcf66a357bff3d0de97f4e3

    SHA512

    ce1ddc512052f466650e77a62c8d2fad5410253135dc9654e692734e5e17fc0b48c7b50a7ae274744b2b94e5bd60946ec49ce4d47b23fa8309e9d49e13407e7f

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7919426.exe
    Filesize

    145KB

    MD5

    db621cf7bb350333ef33e0bbae6fe8da

    SHA1

    3218770056c5e5349ca466d333fecbdc46e3a5ac

    SHA256

    6ff1af4614045aeb630c456fdd4f0ea02c9052bdd4ec99079c3bee165699f89b

    SHA512

    3a4eda2c72f38dd2d59da86aa78a3c3afcacfbc2fadaf21302771b4054c585115c2b281bfd1d92dd258165ab236bcf667aa8417d522ffe760db1f8f47a3377fa

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7919426.exe
    Filesize

    145KB

    MD5

    db621cf7bb350333ef33e0bbae6fe8da

    SHA1

    3218770056c5e5349ca466d333fecbdc46e3a5ac

    SHA256

    6ff1af4614045aeb630c456fdd4f0ea02c9052bdd4ec99079c3bee165699f89b

    SHA512

    3a4eda2c72f38dd2d59da86aa78a3c3afcacfbc2fadaf21302771b4054c585115c2b281bfd1d92dd258165ab236bcf667aa8417d522ffe760db1f8f47a3377fa

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\z9508213.exe
    Filesize

    702KB

    MD5

    a2b4010c2ea5808ea21639d4a0588765

    SHA1

    602d9a30ff933f1320aa3d99cf2a4153d03cc667

    SHA256

    c68f9a03c7870b7d05c55c270d0910883e979f0e9c46e20d6efd9315c15d1650

    SHA512

    ad898339409a18b9409b26eee5a9a4248f2c2f2b44c7e95339e8ea468fc2c5ceb5426dc81754051065806b06bbd9aba12ad9eb27561aeddd23617b303cc0cba1

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\z9508213.exe
    Filesize

    702KB

    MD5

    a2b4010c2ea5808ea21639d4a0588765

    SHA1

    602d9a30ff933f1320aa3d99cf2a4153d03cc667

    SHA256

    c68f9a03c7870b7d05c55c270d0910883e979f0e9c46e20d6efd9315c15d1650

    SHA512

    ad898339409a18b9409b26eee5a9a4248f2c2f2b44c7e95339e8ea468fc2c5ceb5426dc81754051065806b06bbd9aba12ad9eb27561aeddd23617b303cc0cba1

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\z5390702.exe
    Filesize

    306KB

    MD5

    5f186e0064818e254b6b6af01a8409fb

    SHA1

    eb430b9303aecc5be13398a78bd30e4576c576d1

    SHA256

    504ccaaf5de1b2783a3e760e89420daaf3c48034745365cacf0d5411cf75c828

    SHA512

    4bd658f21370fc7c23b274f597dfa24fec7c5947b4720f63b9d9e919da8e45463d37471f6fa02f7964be351fe1c33f514b186a3d78afed81df01fdc904bc7327

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\z5390702.exe
    Filesize

    306KB

    MD5

    5f186e0064818e254b6b6af01a8409fb

    SHA1

    eb430b9303aecc5be13398a78bd30e4576c576d1

    SHA256

    504ccaaf5de1b2783a3e760e89420daaf3c48034745365cacf0d5411cf75c828

    SHA512

    4bd658f21370fc7c23b274f597dfa24fec7c5947b4720f63b9d9e919da8e45463d37471f6fa02f7964be351fe1c33f514b186a3d78afed81df01fdc904bc7327

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\o5301643.exe
    Filesize

    185KB

    MD5

    be5ace7590ee1bc95350c858c33ebe90

    SHA1

    7bb57cacde52a8bf5c784b08c0168fb892d9c6a0

    SHA256

    bcecb81d1349ffe25fdc5fe729b192255ebec85fbfcf66a357bff3d0de97f4e3

    SHA512

    ce1ddc512052f466650e77a62c8d2fad5410253135dc9654e692734e5e17fc0b48c7b50a7ae274744b2b94e5bd60946ec49ce4d47b23fa8309e9d49e13407e7f

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\o5301643.exe
    Filesize

    185KB

    MD5

    be5ace7590ee1bc95350c858c33ebe90

    SHA1

    7bb57cacde52a8bf5c784b08c0168fb892d9c6a0

    SHA256

    bcecb81d1349ffe25fdc5fe729b192255ebec85fbfcf66a357bff3d0de97f4e3

    SHA512

    ce1ddc512052f466650e77a62c8d2fad5410253135dc9654e692734e5e17fc0b48c7b50a7ae274744b2b94e5bd60946ec49ce4d47b23fa8309e9d49e13407e7f

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\p7919426.exe
    Filesize

    145KB

    MD5

    db621cf7bb350333ef33e0bbae6fe8da

    SHA1

    3218770056c5e5349ca466d333fecbdc46e3a5ac

    SHA256

    6ff1af4614045aeb630c456fdd4f0ea02c9052bdd4ec99079c3bee165699f89b

    SHA512

    3a4eda2c72f38dd2d59da86aa78a3c3afcacfbc2fadaf21302771b4054c585115c2b281bfd1d92dd258165ab236bcf667aa8417d522ffe760db1f8f47a3377fa

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\p7919426.exe
    Filesize

    145KB

    MD5

    db621cf7bb350333ef33e0bbae6fe8da

    SHA1

    3218770056c5e5349ca466d333fecbdc46e3a5ac

    SHA256

    6ff1af4614045aeb630c456fdd4f0ea02c9052bdd4ec99079c3bee165699f89b

    SHA512

    3a4eda2c72f38dd2d59da86aa78a3c3afcacfbc2fadaf21302771b4054c585115c2b281bfd1d92dd258165ab236bcf667aa8417d522ffe760db1f8f47a3377fa

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\p7919426.exe
    Filesize

    145KB

    MD5

    db621cf7bb350333ef33e0bbae6fe8da

    SHA1

    3218770056c5e5349ca466d333fecbdc46e3a5ac

    SHA256

    6ff1af4614045aeb630c456fdd4f0ea02c9052bdd4ec99079c3bee165699f89b

    SHA512

    3a4eda2c72f38dd2d59da86aa78a3c3afcacfbc2fadaf21302771b4054c585115c2b281bfd1d92dd258165ab236bcf667aa8417d522ffe760db1f8f47a3377fa

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\p7919426.exe
    Filesize

    145KB

    MD5

    db621cf7bb350333ef33e0bbae6fe8da

    SHA1

    3218770056c5e5349ca466d333fecbdc46e3a5ac

    SHA256

    6ff1af4614045aeb630c456fdd4f0ea02c9052bdd4ec99079c3bee165699f89b

    SHA512

    3a4eda2c72f38dd2d59da86aa78a3c3afcacfbc2fadaf21302771b4054c585115c2b281bfd1d92dd258165ab236bcf667aa8417d522ffe760db1f8f47a3377fa

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\p7919426.exe
    Filesize

    145KB

    MD5

    db621cf7bb350333ef33e0bbae6fe8da

    SHA1

    3218770056c5e5349ca466d333fecbdc46e3a5ac

    SHA256

    6ff1af4614045aeb630c456fdd4f0ea02c9052bdd4ec99079c3bee165699f89b

    SHA512

    3a4eda2c72f38dd2d59da86aa78a3c3afcacfbc2fadaf21302771b4054c585115c2b281bfd1d92dd258165ab236bcf667aa8417d522ffe760db1f8f47a3377fa

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\p7919426.exe
    Filesize

    145KB

    MD5

    db621cf7bb350333ef33e0bbae6fe8da

    SHA1

    3218770056c5e5349ca466d333fecbdc46e3a5ac

    SHA256

    6ff1af4614045aeb630c456fdd4f0ea02c9052bdd4ec99079c3bee165699f89b

    SHA512

    3a4eda2c72f38dd2d59da86aa78a3c3afcacfbc2fadaf21302771b4054c585115c2b281bfd1d92dd258165ab236bcf667aa8417d522ffe760db1f8f47a3377fa

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\p7919426.exe
    Filesize

    145KB

    MD5

    db621cf7bb350333ef33e0bbae6fe8da

    SHA1

    3218770056c5e5349ca466d333fecbdc46e3a5ac

    SHA256

    6ff1af4614045aeb630c456fdd4f0ea02c9052bdd4ec99079c3bee165699f89b

    SHA512

    3a4eda2c72f38dd2d59da86aa78a3c3afcacfbc2fadaf21302771b4054c585115c2b281bfd1d92dd258165ab236bcf667aa8417d522ffe760db1f8f47a3377fa

  • memory/832-95-0x0000000000AB0000-0x0000000000AC6000-memory.dmp
    Filesize

    88KB

  • memory/832-115-0x0000000000AB0000-0x0000000000AC6000-memory.dmp
    Filesize

    88KB

  • memory/832-101-0x0000000000AB0000-0x0000000000AC6000-memory.dmp
    Filesize

    88KB

  • memory/832-103-0x0000000000AB0000-0x0000000000AC6000-memory.dmp
    Filesize

    88KB

  • memory/832-105-0x0000000000AB0000-0x0000000000AC6000-memory.dmp
    Filesize

    88KB

  • memory/832-107-0x0000000000AB0000-0x0000000000AC6000-memory.dmp
    Filesize

    88KB

  • memory/832-109-0x0000000000AB0000-0x0000000000AC6000-memory.dmp
    Filesize

    88KB

  • memory/832-111-0x0000000000AB0000-0x0000000000AC6000-memory.dmp
    Filesize

    88KB

  • memory/832-113-0x0000000000AB0000-0x0000000000AC6000-memory.dmp
    Filesize

    88KB

  • memory/832-99-0x0000000000AB0000-0x0000000000AC6000-memory.dmp
    Filesize

    88KB

  • memory/832-97-0x0000000000AB0000-0x0000000000AC6000-memory.dmp
    Filesize

    88KB

  • memory/832-93-0x0000000000AB0000-0x0000000000AC6000-memory.dmp
    Filesize

    88KB

  • memory/832-91-0x0000000000AB0000-0x0000000000AC6000-memory.dmp
    Filesize

    88KB

  • memory/832-89-0x0000000000AB0000-0x0000000000AC6000-memory.dmp
    Filesize

    88KB

  • memory/832-84-0x00000000003E0000-0x00000000003FE000-memory.dmp
    Filesize

    120KB

  • memory/832-88-0x0000000000AB0000-0x0000000000AC6000-memory.dmp
    Filesize

    88KB

  • memory/832-87-0x0000000000AB0000-0x0000000000ACC000-memory.dmp
    Filesize

    112KB

  • memory/832-86-0x0000000004A20000-0x0000000004A60000-memory.dmp
    Filesize

    256KB

  • memory/832-85-0x0000000004A20000-0x0000000004A60000-memory.dmp
    Filesize

    256KB

  • memory/1732-122-0x0000000000330000-0x000000000035A000-memory.dmp
    Filesize

    168KB