Analysis

  • max time kernel
    136s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/05/2023, 02:03

General

  • Target

    1bdfb86c567fb1e945a6e892e10adf1637c8bc0e92cd45367a11de24e3070d0c.exe

  • Size

    1.0MB

  • MD5

    7e3c5dd8469fae45642704ac8eb6f0a4

  • SHA1

    eb56c1978ebe0f8db5d0e707305c6890daa76a55

  • SHA256

    1bdfb86c567fb1e945a6e892e10adf1637c8bc0e92cd45367a11de24e3070d0c

  • SHA512

    11614d1ef414c0a4b57f08ad7790c85640f231055f99d4f6e4410e664468cc9dd4c2a17da4ec958cb3225312e9f72075dd9684c0edc2915cd1f85bcc1e582b6e

  • SSDEEP

    12288:pMruy90s9EhlTW+GTd5WnEInm7fT3mkcQFNEh9WLp2X/GdpjfGuECLo8ubkmW0yN:ryxW0d2m7rmkBpoPGdpLBo868ua/vd

Malware Config

Extracted

Family

redline

Botnet

luna

C2

77.91.68.253:4138

Attributes
  • auth_value

    16dec8addb01db1c11c59667022ef7a2

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Executes dropped EXE 8 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1bdfb86c567fb1e945a6e892e10adf1637c8bc0e92cd45367a11de24e3070d0c.exe
    "C:\Users\Admin\AppData\Local\Temp\1bdfb86c567fb1e945a6e892e10adf1637c8bc0e92cd45367a11de24e3070d0c.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4784
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8289880.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8289880.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1696
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8625650.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8625650.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2660
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o7753466.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o7753466.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5068
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p0097015.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p0097015.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1792
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5797614.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5797614.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1476
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s3508505.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s3508505.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:944
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s3508505.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s3508505.exe
        3⤵
        • Executes dropped EXE
        PID:908
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s3508505.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s3508505.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of UnmapMainImage
        PID:632
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 12
          4⤵
          • Program crash
          PID:2228
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 632 -ip 632
    1⤵
      PID:2496

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s3508505.exe

      Filesize

      962KB

      MD5

      42d775ab396ef990629170e7749168e6

      SHA1

      9c2634622a69730e1bdcf986825f03dca9231b9f

      SHA256

      2892e80b57ee7feac2b7b8d602f2c040cc28f72388a802d7e7be08f70872bae8

      SHA512

      ca7888533ca648d16169870afddb5d9cfd264459064fd888d02961cb491f537c604d363f922a8c861552d1708d172cabf55f186dacc45651554e8f346006153b

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s3508505.exe

      Filesize

      962KB

      MD5

      42d775ab396ef990629170e7749168e6

      SHA1

      9c2634622a69730e1bdcf986825f03dca9231b9f

      SHA256

      2892e80b57ee7feac2b7b8d602f2c040cc28f72388a802d7e7be08f70872bae8

      SHA512

      ca7888533ca648d16169870afddb5d9cfd264459064fd888d02961cb491f537c604d363f922a8c861552d1708d172cabf55f186dacc45651554e8f346006153b

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s3508505.exe

      Filesize

      962KB

      MD5

      42d775ab396ef990629170e7749168e6

      SHA1

      9c2634622a69730e1bdcf986825f03dca9231b9f

      SHA256

      2892e80b57ee7feac2b7b8d602f2c040cc28f72388a802d7e7be08f70872bae8

      SHA512

      ca7888533ca648d16169870afddb5d9cfd264459064fd888d02961cb491f537c604d363f922a8c861552d1708d172cabf55f186dacc45651554e8f346006153b

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s3508505.exe

      Filesize

      962KB

      MD5

      42d775ab396ef990629170e7749168e6

      SHA1

      9c2634622a69730e1bdcf986825f03dca9231b9f

      SHA256

      2892e80b57ee7feac2b7b8d602f2c040cc28f72388a802d7e7be08f70872bae8

      SHA512

      ca7888533ca648d16169870afddb5d9cfd264459064fd888d02961cb491f537c604d363f922a8c861552d1708d172cabf55f186dacc45651554e8f346006153b

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8289880.exe

      Filesize

      585KB

      MD5

      c1a18d21d5221e75bf1dec8e11a47979

      SHA1

      e469a558f359d80af923fad18bc59733b80b4fe7

      SHA256

      4bf1d3f7b175cef489fb5392a05488f30686ea97e4d8f92a441965f77c3dde51

      SHA512

      9c3123d6808b9e1dbeb21462c2bf2f36b7e225b55ff2da76c3e451f3bf9b2a191d17c07bab59050b2e1f5ec44129eb3f68733ee887c753b28f3bedf430a83214

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8289880.exe

      Filesize

      585KB

      MD5

      c1a18d21d5221e75bf1dec8e11a47979

      SHA1

      e469a558f359d80af923fad18bc59733b80b4fe7

      SHA256

      4bf1d3f7b175cef489fb5392a05488f30686ea97e4d8f92a441965f77c3dde51

      SHA512

      9c3123d6808b9e1dbeb21462c2bf2f36b7e225b55ff2da76c3e451f3bf9b2a191d17c07bab59050b2e1f5ec44129eb3f68733ee887c753b28f3bedf430a83214

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5797614.exe

      Filesize

      284KB

      MD5

      eb1e767f5b888a021c6ef53fb937c319

      SHA1

      e6c8e4ca5fa3b3eea6f134050df65da151884a20

      SHA256

      40bc68d5b54c3ff4c5170ebdf7f0ce54b42b7a11fe1649be0e01a389d440164e

      SHA512

      d32e0e409e445f985df77385e5e26547b2a1f427a66fd65d41499bfe3264570eacecaddbd5a2c0f905533abeea728008eafbdfae01e9d3e4bced28a3b5f01984

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5797614.exe

      Filesize

      284KB

      MD5

      eb1e767f5b888a021c6ef53fb937c319

      SHA1

      e6c8e4ca5fa3b3eea6f134050df65da151884a20

      SHA256

      40bc68d5b54c3ff4c5170ebdf7f0ce54b42b7a11fe1649be0e01a389d440164e

      SHA512

      d32e0e409e445f985df77385e5e26547b2a1f427a66fd65d41499bfe3264570eacecaddbd5a2c0f905533abeea728008eafbdfae01e9d3e4bced28a3b5f01984

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8625650.exe

      Filesize

      305KB

      MD5

      d2bf50a7c5f54b4f1bb88d215d06aaa5

      SHA1

      586f77a3332f74f07a3f6d2cb16af0b818c0097c

      SHA256

      7edc350f15870a73d1726503132cdfa4fd4daab2f41704ff0e2394ba0ebab7ff

      SHA512

      52627e8e0b73aa21d76fe61c364b33e69817c4640fe3242111122dca3cc32ea9bd4dc1e32926bd99aa5b8d6d87764a5d3dc7a1fc7bed57159dbf0ebc9d03af65

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8625650.exe

      Filesize

      305KB

      MD5

      d2bf50a7c5f54b4f1bb88d215d06aaa5

      SHA1

      586f77a3332f74f07a3f6d2cb16af0b818c0097c

      SHA256

      7edc350f15870a73d1726503132cdfa4fd4daab2f41704ff0e2394ba0ebab7ff

      SHA512

      52627e8e0b73aa21d76fe61c364b33e69817c4640fe3242111122dca3cc32ea9bd4dc1e32926bd99aa5b8d6d87764a5d3dc7a1fc7bed57159dbf0ebc9d03af65

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o7753466.exe

      Filesize

      184KB

      MD5

      f624d1cff774d3852b8424f3bc87bcf8

      SHA1

      94bf8654b869c2dd2c7cd645f81ace1209d1a7e5

      SHA256

      0680f3af2daf22fc83c265759ae453f501fd3b56af9d83225ed53c0d67b63a6e

      SHA512

      7cf7641872502ba5152790c8ed7524dd030d997296cef9758488870a38bb5cf214afbc4551038073f42470b1002aaec35ea02ddd51144c84a328daadbbfd2cb1

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o7753466.exe

      Filesize

      184KB

      MD5

      f624d1cff774d3852b8424f3bc87bcf8

      SHA1

      94bf8654b869c2dd2c7cd645f81ace1209d1a7e5

      SHA256

      0680f3af2daf22fc83c265759ae453f501fd3b56af9d83225ed53c0d67b63a6e

      SHA512

      7cf7641872502ba5152790c8ed7524dd030d997296cef9758488870a38bb5cf214afbc4551038073f42470b1002aaec35ea02ddd51144c84a328daadbbfd2cb1

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p0097015.exe

      Filesize

      145KB

      MD5

      6999eeb76dd31fdd9fd0f631eb315f0a

      SHA1

      4660a3bd6a62fc70eb8e6fbe2cebe43ae2213347

      SHA256

      b292b25e8116dedf8e94a635524731fcab7c141f378795382d5dffecfc8400a8

      SHA512

      d43f0029bdd59d4c8b2259f515b2e3fdac673ac470b292e670385f095dc6105dbe15c146297dd4c0265c12d2f8b06d26fd6024a3fee04d78e7bfb112e8816fac

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p0097015.exe

      Filesize

      145KB

      MD5

      6999eeb76dd31fdd9fd0f631eb315f0a

      SHA1

      4660a3bd6a62fc70eb8e6fbe2cebe43ae2213347

      SHA256

      b292b25e8116dedf8e94a635524731fcab7c141f378795382d5dffecfc8400a8

      SHA512

      d43f0029bdd59d4c8b2259f515b2e3fdac673ac470b292e670385f095dc6105dbe15c146297dd4c0265c12d2f8b06d26fd6024a3fee04d78e7bfb112e8816fac

    • memory/944-1129-0x0000000000BE0000-0x0000000000CD8000-memory.dmp

      Filesize

      992KB

    • memory/944-1130-0x0000000007B20000-0x0000000007B30000-memory.dmp

      Filesize

      64KB

    • memory/1476-243-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/1476-1122-0x0000000004A30000-0x0000000004A40000-memory.dmp

      Filesize

      64KB

    • memory/1476-328-0x0000000004A30000-0x0000000004A40000-memory.dmp

      Filesize

      64KB

    • memory/1476-245-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/1476-330-0x0000000004A30000-0x0000000004A40000-memory.dmp

      Filesize

      64KB

    • memory/1476-241-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/1476-239-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/1476-237-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/1476-235-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/1476-233-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/1476-231-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/1476-229-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/1476-1121-0x0000000004A30000-0x0000000004A40000-memory.dmp

      Filesize

      64KB

    • memory/1476-326-0x0000000004A30000-0x0000000004A40000-memory.dmp

      Filesize

      64KB

    • memory/1476-227-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/1476-225-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/1476-223-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/1476-221-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/1476-219-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/1476-217-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/1476-215-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/1476-213-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/1476-1124-0x0000000004A30000-0x0000000004A40000-memory.dmp

      Filesize

      64KB

    • memory/1476-210-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/1476-211-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/1476-1123-0x0000000004A30000-0x0000000004A40000-memory.dmp

      Filesize

      64KB

    • memory/1792-201-0x00000000068A0000-0x0000000006A62000-memory.dmp

      Filesize

      1.8MB

    • memory/1792-205-0x0000000004FF0000-0x0000000005000000-memory.dmp

      Filesize

      64KB

    • memory/1792-204-0x0000000006840000-0x0000000006890000-memory.dmp

      Filesize

      320KB

    • memory/1792-203-0x0000000006A70000-0x0000000006AE6000-memory.dmp

      Filesize

      472KB

    • memory/1792-202-0x0000000006FA0000-0x00000000074CC000-memory.dmp

      Filesize

      5.2MB

    • memory/1792-200-0x00000000054B0000-0x0000000005516000-memory.dmp

      Filesize

      408KB

    • memory/1792-199-0x0000000005B70000-0x0000000005C02000-memory.dmp

      Filesize

      584KB

    • memory/1792-198-0x0000000004FF0000-0x0000000005000000-memory.dmp

      Filesize

      64KB

    • memory/1792-197-0x0000000005080000-0x00000000050BC000-memory.dmp

      Filesize

      240KB

    • memory/1792-196-0x0000000005020000-0x0000000005032000-memory.dmp

      Filesize

      72KB

    • memory/1792-195-0x00000000050D0000-0x00000000051DA000-memory.dmp

      Filesize

      1.0MB

    • memory/1792-194-0x0000000005550000-0x0000000005B68000-memory.dmp

      Filesize

      6.1MB

    • memory/1792-193-0x0000000000630000-0x000000000065A000-memory.dmp

      Filesize

      168KB

    • memory/5068-188-0x0000000004A20000-0x0000000004A30000-memory.dmp

      Filesize

      64KB

    • memory/5068-187-0x0000000004A20000-0x0000000004A30000-memory.dmp

      Filesize

      64KB

    • memory/5068-186-0x0000000004A20000-0x0000000004A30000-memory.dmp

      Filesize

      64KB

    • memory/5068-182-0x0000000004960000-0x0000000004977000-memory.dmp

      Filesize

      92KB

    • memory/5068-185-0x0000000004A20000-0x0000000004A30000-memory.dmp

      Filesize

      64KB

    • memory/5068-184-0x0000000004A20000-0x0000000004A30000-memory.dmp

      Filesize

      64KB

    • memory/5068-183-0x0000000004A20000-0x0000000004A30000-memory.dmp

      Filesize

      64KB

    • memory/5068-180-0x0000000004960000-0x0000000004977000-memory.dmp

      Filesize

      92KB

    • memory/5068-178-0x0000000004960000-0x0000000004977000-memory.dmp

      Filesize

      92KB

    • memory/5068-176-0x0000000004960000-0x0000000004977000-memory.dmp

      Filesize

      92KB

    • memory/5068-174-0x0000000004960000-0x0000000004977000-memory.dmp

      Filesize

      92KB

    • memory/5068-172-0x0000000004960000-0x0000000004977000-memory.dmp

      Filesize

      92KB

    • memory/5068-170-0x0000000004960000-0x0000000004977000-memory.dmp

      Filesize

      92KB

    • memory/5068-168-0x0000000004960000-0x0000000004977000-memory.dmp

      Filesize

      92KB

    • memory/5068-166-0x0000000004960000-0x0000000004977000-memory.dmp

      Filesize

      92KB

    • memory/5068-164-0x0000000004960000-0x0000000004977000-memory.dmp

      Filesize

      92KB

    • memory/5068-162-0x0000000004960000-0x0000000004977000-memory.dmp

      Filesize

      92KB

    • memory/5068-156-0x0000000004960000-0x0000000004977000-memory.dmp

      Filesize

      92KB

    • memory/5068-158-0x0000000004960000-0x0000000004977000-memory.dmp

      Filesize

      92KB

    • memory/5068-160-0x0000000004960000-0x0000000004977000-memory.dmp

      Filesize

      92KB

    • memory/5068-155-0x0000000004960000-0x0000000004977000-memory.dmp

      Filesize

      92KB

    • memory/5068-154-0x0000000004A30000-0x0000000004FD4000-memory.dmp

      Filesize

      5.6MB