Analysis

  • max time kernel
    100s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/05/2023, 23:01

General

  • Target

    12ce14cfa643f47aba44b9fe2105cbb3a6605b7d1a64fe021b482bbf1abb49c6.exe

  • Size

    1.0MB

  • MD5

    87ead40b28cfae2fc3ba500bb492186a

  • SHA1

    225d1fc818233ec0e2dddc9ed907643eb0c3fbc2

  • SHA256

    12ce14cfa643f47aba44b9fe2105cbb3a6605b7d1a64fe021b482bbf1abb49c6

  • SHA512

    e4e25d7e7f95ef22790b177d738a02d7f68fcc0b2960b8398858d6868c23b051b1e7a4649d7ad9fba17001c017e0334efa205c3ab624d85bc77b170fa9086d59

  • SSDEEP

    24576:Wy/JZEL1P+aLh6qmfGhU9cGbBtk0ghTFQLYDJHozBEsuZT8s:lBmL9zd6qmfyU9co33ghTMM2zBYT8

Malware Config

Extracted

Family

redline

Botnet

diza

C2

185.161.248.37:4138

Attributes
  • auth_value

    0d09b419c8bc967f91c68be4a17e92ee

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 18 IoCs
  • Executes dropped EXE 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\12ce14cfa643f47aba44b9fe2105cbb3a6605b7d1a64fe021b482bbf1abb49c6.exe
    "C:\Users\Admin\AppData\Local\Temp\12ce14cfa643f47aba44b9fe2105cbb3a6605b7d1a64fe021b482bbf1abb49c6.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1596
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8424491.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8424491.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:696
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0633339.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0633339.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3056
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0080621.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0080621.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3132
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1506566.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1506566.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4784
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m2534222.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m2534222.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3660
        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m2534222.exe
          C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m2534222.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of UnmapMainImage
          PID:4864
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 12
            5⤵
            • Program crash
            PID:728
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n7664606.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n7664606.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4256
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4864 -ip 4864
    1⤵
      PID:3168

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n7664606.exe

      Filesize

      285KB

      MD5

      6633bbd533da8e3cfe1722d44c74e7ca

      SHA1

      4fecb99eebf4db0b84c2566b277fa449aa933043

      SHA256

      e75fc60733432c3a361942e87779520c4b2a6f239fd2e5f85cfd9fb3db5a4c41

      SHA512

      531a56af50c0c1df986968f29d210eec045d6ba854385db04fda829b9ff718f51bb53f6c618499dd2a8fd21b7f65d3381398366ee328e39eebcf723ab88143d5

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n7664606.exe

      Filesize

      285KB

      MD5

      6633bbd533da8e3cfe1722d44c74e7ca

      SHA1

      4fecb99eebf4db0b84c2566b277fa449aa933043

      SHA256

      e75fc60733432c3a361942e87779520c4b2a6f239fd2e5f85cfd9fb3db5a4c41

      SHA512

      531a56af50c0c1df986968f29d210eec045d6ba854385db04fda829b9ff718f51bb53f6c618499dd2a8fd21b7f65d3381398366ee328e39eebcf723ab88143d5

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8424491.exe

      Filesize

      750KB

      MD5

      ce27976034751f060abab13a264ed209

      SHA1

      b56414a5cdc07fc95d8bfc4834125c17fba4d0a0

      SHA256

      252dd9823672779e4175cb82bb47d6494596b2030a30a9d8c4c1aaa68edb1729

      SHA512

      eab6d3bf7e2393204414f7525222b6365a713038c6f97e742b0c892c3de6750ba6bd1d510f66fba0834c733d16ce42c73483a397b196f85c4314528d8c1f91cc

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8424491.exe

      Filesize

      750KB

      MD5

      ce27976034751f060abab13a264ed209

      SHA1

      b56414a5cdc07fc95d8bfc4834125c17fba4d0a0

      SHA256

      252dd9823672779e4175cb82bb47d6494596b2030a30a9d8c4c1aaa68edb1729

      SHA512

      eab6d3bf7e2393204414f7525222b6365a713038c6f97e742b0c892c3de6750ba6bd1d510f66fba0834c733d16ce42c73483a397b196f85c4314528d8c1f91cc

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m2534222.exe

      Filesize

      965KB

      MD5

      779526adf273365f69ff2f89cbe41efd

      SHA1

      e08582dd33baf8b8e55b5a02a803a73d23148308

      SHA256

      5bf88782c5c7be4ba5b30df7005f5aab3a09643ff2a168c8415c8ae4052a9a19

      SHA512

      cf044caf276d2c1ae054fca67865f8f159ac5eb082fa56c7c9850e8f2382b555540801464e15f7422bf22ad1193dbf85ae415beb4f8686890bc9ea1f5c161677

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m2534222.exe

      Filesize

      965KB

      MD5

      779526adf273365f69ff2f89cbe41efd

      SHA1

      e08582dd33baf8b8e55b5a02a803a73d23148308

      SHA256

      5bf88782c5c7be4ba5b30df7005f5aab3a09643ff2a168c8415c8ae4052a9a19

      SHA512

      cf044caf276d2c1ae054fca67865f8f159ac5eb082fa56c7c9850e8f2382b555540801464e15f7422bf22ad1193dbf85ae415beb4f8686890bc9ea1f5c161677

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m2534222.exe

      Filesize

      965KB

      MD5

      779526adf273365f69ff2f89cbe41efd

      SHA1

      e08582dd33baf8b8e55b5a02a803a73d23148308

      SHA256

      5bf88782c5c7be4ba5b30df7005f5aab3a09643ff2a168c8415c8ae4052a9a19

      SHA512

      cf044caf276d2c1ae054fca67865f8f159ac5eb082fa56c7c9850e8f2382b555540801464e15f7422bf22ad1193dbf85ae415beb4f8686890bc9ea1f5c161677

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0633339.exe

      Filesize

      305KB

      MD5

      6e350202f926394d3a2e3de7ab425272

      SHA1

      73c64755da7dcc6fb7f1f3b3da6c7897695262a0

      SHA256

      8209ffb25912c5c268901b03bbe109d669921958044edca639ea6bdc242d0b75

      SHA512

      315488ecce96c9f19d261e6f97d4281253e5379774e1ed95d13a1a1cce3f3299ce1b0618782ed7b1fc4fff891c06f650fde360e7436d7dedd8867c068de3b3f8

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0633339.exe

      Filesize

      305KB

      MD5

      6e350202f926394d3a2e3de7ab425272

      SHA1

      73c64755da7dcc6fb7f1f3b3da6c7897695262a0

      SHA256

      8209ffb25912c5c268901b03bbe109d669921958044edca639ea6bdc242d0b75

      SHA512

      315488ecce96c9f19d261e6f97d4281253e5379774e1ed95d13a1a1cce3f3299ce1b0618782ed7b1fc4fff891c06f650fde360e7436d7dedd8867c068de3b3f8

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0080621.exe

      Filesize

      186KB

      MD5

      b708bf161180a5ee4e1a7faa26a962a9

      SHA1

      02d68430bf41e56f0f16264e920c04d67cd2943b

      SHA256

      62c7203c4004a4bda736895cf1e2a4490a0ff848c5959438c164816d6a5ea77d

      SHA512

      51bd304bc2fa29638bc498944bc1e7b24aa38813c82fe2dbc738eec630020b64b0e675d4048f08bca008efcd8e35155da9f8b911d466b8b8ee214ac84f588643

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0080621.exe

      Filesize

      186KB

      MD5

      b708bf161180a5ee4e1a7faa26a962a9

      SHA1

      02d68430bf41e56f0f16264e920c04d67cd2943b

      SHA256

      62c7203c4004a4bda736895cf1e2a4490a0ff848c5959438c164816d6a5ea77d

      SHA512

      51bd304bc2fa29638bc498944bc1e7b24aa38813c82fe2dbc738eec630020b64b0e675d4048f08bca008efcd8e35155da9f8b911d466b8b8ee214ac84f588643

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1506566.exe

      Filesize

      145KB

      MD5

      7380b406c903e9d3dea85f9dfb22bc65

      SHA1

      3151f1a47e1196ea45809b149cf23bdd576d15d7

      SHA256

      172e4e6eeb53dffc04415e4b271bca466f9c70e40004b8492ee776e5e20fa6f1

      SHA512

      60f55af075b050d1261e956e8efc646343a2cdf4aa400ac4bf1b158ec1f18f98061d0225ba4dab3926a7935b9619c215ddbb7aa4c621188d5996ddd594c60d2c

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1506566.exe

      Filesize

      145KB

      MD5

      7380b406c903e9d3dea85f9dfb22bc65

      SHA1

      3151f1a47e1196ea45809b149cf23bdd576d15d7

      SHA256

      172e4e6eeb53dffc04415e4b271bca466f9c70e40004b8492ee776e5e20fa6f1

      SHA512

      60f55af075b050d1261e956e8efc646343a2cdf4aa400ac4bf1b158ec1f18f98061d0225ba4dab3926a7935b9619c215ddbb7aa4c621188d5996ddd594c60d2c

    • memory/3132-175-0x0000000004970000-0x0000000004986000-memory.dmp

      Filesize

      88KB

    • memory/3132-185-0x0000000004B60000-0x0000000004B70000-memory.dmp

      Filesize

      64KB

    • memory/3132-169-0x0000000004970000-0x0000000004986000-memory.dmp

      Filesize

      88KB

    • memory/3132-171-0x0000000004970000-0x0000000004986000-memory.dmp

      Filesize

      88KB

    • memory/3132-173-0x0000000004970000-0x0000000004986000-memory.dmp

      Filesize

      88KB

    • memory/3132-165-0x0000000004970000-0x0000000004986000-memory.dmp

      Filesize

      88KB

    • memory/3132-179-0x0000000004970000-0x0000000004986000-memory.dmp

      Filesize

      88KB

    • memory/3132-177-0x0000000004970000-0x0000000004986000-memory.dmp

      Filesize

      88KB

    • memory/3132-181-0x0000000004970000-0x0000000004986000-memory.dmp

      Filesize

      88KB

    • memory/3132-183-0x0000000004970000-0x0000000004986000-memory.dmp

      Filesize

      88KB

    • memory/3132-184-0x0000000004B60000-0x0000000004B70000-memory.dmp

      Filesize

      64KB

    • memory/3132-167-0x0000000004970000-0x0000000004986000-memory.dmp

      Filesize

      88KB

    • memory/3132-186-0x0000000004B60000-0x0000000004B70000-memory.dmp

      Filesize

      64KB

    • memory/3132-188-0x0000000004B60000-0x0000000004B70000-memory.dmp

      Filesize

      64KB

    • memory/3132-189-0x0000000004B60000-0x0000000004B70000-memory.dmp

      Filesize

      64KB

    • memory/3132-163-0x0000000004970000-0x0000000004986000-memory.dmp

      Filesize

      88KB

    • memory/3132-161-0x0000000004970000-0x0000000004986000-memory.dmp

      Filesize

      88KB

    • memory/3132-156-0x0000000004970000-0x0000000004986000-memory.dmp

      Filesize

      88KB

    • memory/3132-159-0x0000000004970000-0x0000000004986000-memory.dmp

      Filesize

      88KB

    • memory/3132-157-0x0000000004970000-0x0000000004986000-memory.dmp

      Filesize

      88KB

    • memory/3132-155-0x0000000004B70000-0x0000000005114000-memory.dmp

      Filesize

      5.6MB

    • memory/3132-154-0x0000000004B60000-0x0000000004B70000-memory.dmp

      Filesize

      64KB

    • memory/3660-210-0x0000000000AD0000-0x0000000000BC8000-memory.dmp

      Filesize

      992KB

    • memory/3660-211-0x00000000079A0000-0x00000000079B0000-memory.dmp

      Filesize

      64KB

    • memory/4256-221-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/4256-242-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/4256-1132-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

      Filesize

      64KB

    • memory/4256-1131-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

      Filesize

      64KB

    • memory/4256-1129-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

      Filesize

      64KB

    • memory/4256-254-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/4256-252-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/4256-250-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/4256-248-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/4256-246-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/4256-244-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/4256-240-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/4256-238-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/4256-236-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/4256-218-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

      Filesize

      64KB

    • memory/4256-220-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

      Filesize

      64KB

    • memory/4256-219-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

      Filesize

      64KB

    • memory/4256-234-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/4256-224-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/4256-222-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/4256-226-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/4256-228-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/4256-230-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/4256-232-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/4784-197-0x0000000005540000-0x000000000557C000-memory.dmp

      Filesize

      240KB

    • memory/4784-203-0x0000000006E80000-0x0000000007042000-memory.dmp

      Filesize

      1.8MB

    • memory/4784-195-0x00000000055B0000-0x00000000056BA000-memory.dmp

      Filesize

      1.0MB

    • memory/4784-196-0x00000000054E0000-0x00000000054F2000-memory.dmp

      Filesize

      72KB

    • memory/4784-201-0x0000000006C30000-0x0000000006CA6000-memory.dmp

      Filesize

      472KB

    • memory/4784-202-0x0000000006BB0000-0x0000000006C00000-memory.dmp

      Filesize

      320KB

    • memory/4784-199-0x0000000006050000-0x00000000060E2000-memory.dmp

      Filesize

      584KB

    • memory/4784-193-0x0000000000B10000-0x0000000000B3A000-memory.dmp

      Filesize

      168KB

    • memory/4784-194-0x0000000005A30000-0x0000000006048000-memory.dmp

      Filesize

      6.1MB

    • memory/4784-200-0x0000000005990000-0x00000000059F6000-memory.dmp

      Filesize

      408KB

    • memory/4784-205-0x0000000005590000-0x00000000055A0000-memory.dmp

      Filesize

      64KB

    • memory/4784-204-0x0000000007580000-0x0000000007AAC000-memory.dmp

      Filesize

      5.2MB

    • memory/4784-198-0x0000000005590000-0x00000000055A0000-memory.dmp

      Filesize

      64KB

    • memory/4864-212-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB