Analysis

  • max time kernel
    125s
  • max time network
    147s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    26/05/2023, 03:35

General

  • Target

    5fb55afd4a05d87b8afbcc71d324ef4db17d71d5e65a7f1f006304bca093ad96.exe

  • Size

    769KB

  • MD5

    417ab0ee644b68208b4b090708707a22

  • SHA1

    900f92fcb9a6b40d508294916503853847e60c55

  • SHA256

    5fb55afd4a05d87b8afbcc71d324ef4db17d71d5e65a7f1f006304bca093ad96

  • SHA512

    107d8b5188de3a1afc7f0debe3b721ff653dffa44849b3dade187b758b6df7eff761a5354718c671a6cef80fb84a482dccd192c50ece306c38127900e9071021

  • SSDEEP

    12288:UMrTy90nYfDHr+ay+9dIhk29cv0Mv+9fFrSfAek9stWSkBcznMMtIW+/E2:nyIuv+sYxU0Mm9fFrysWdkWzMM1+V

Malware Config

Extracted

Family

redline

Botnet

mina

C2

83.97.73.122:19062

Attributes
  • auth_value

    3d04bf4b8ba2a11c4dcf9df0e388fa05

Extracted

Family

redline

Botnet

greg

C2

83.97.73.122:19062

Attributes
  • auth_value

    4c966a90781c6b4ab7f512d018696362

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5fb55afd4a05d87b8afbcc71d324ef4db17d71d5e65a7f1f006304bca093ad96.exe
    "C:\Users\Admin\AppData\Local\Temp\5fb55afd4a05d87b8afbcc71d324ef4db17d71d5e65a7f1f006304bca093ad96.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:352
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7538405.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7538405.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1424
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6667354.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6667354.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4144
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4179011.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4179011.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2352
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
            "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2252
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7327693.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7327693.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4452
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c1544913.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c1544913.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4800
        • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
          "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4424
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metado.exe /TR "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:2784
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metado.exe" /P "Admin:N"&&CACLS "metado.exe" /P "Admin:R" /E&&echo Y|CACLS "..\a9e2a16078" /P "Admin:N"&&CACLS "..\a9e2a16078" /P "Admin:R" /E&&Exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2792
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              6⤵
                PID:1860
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metado.exe" /P "Admin:N"
                6⤵
                  PID:4728
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "metado.exe" /P "Admin:R" /E
                  6⤵
                    PID:4872
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    6⤵
                      PID:4916
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\a9e2a16078" /P "Admin:N"
                      6⤵
                        PID:4844
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\a9e2a16078" /P "Admin:R" /E
                        6⤵
                          PID:3380
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                        5⤵
                        • Loads dropped DLL
                        PID:1844
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d1919606.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d1919606.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:3672
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                    "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4436
              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                1⤵
                • Executes dropped EXE
                PID:68
              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                1⤵
                • Executes dropped EXE
                PID:2356

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

                Filesize

                226B

                MD5

                957779c42144282d8cd83192b8fbc7cf

                SHA1

                de83d08d2cca06b9ff3d1ef239d6b60b705d25fe

                SHA256

                0d7ca7ba65e2b465e4878e324ceab8f8981f5ec06dcf5bc32559a4467a9c7d51

                SHA512

                f1549c61b4f2906d13b2aabb74772c2bc826cd42373d7bb6c48cbb125d5aa2ec17617e6b5e67e8aae3bb5790cc831cdba48a45008ed01df4fba8be448cce39fd

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d1919606.exe

                Filesize

                322KB

                MD5

                acf4b8c8fa6cc3930a312a307469e6ed

                SHA1

                b047ee60fe06c3070a6e3d6b0a0dee57dc60bd80

                SHA256

                83dfc7a8af5ed7ad11c6aaafbfb98d9fb771d7d89813c4de8f85d2262768217a

                SHA512

                9cb6ae8c4d228d9887c893b4a67cd85620468542a43b617fa62d196a98d16e308927ff255b8417b6d956c877b5e29490591488bdf578754253db4cef5975eed1

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d1919606.exe

                Filesize

                322KB

                MD5

                acf4b8c8fa6cc3930a312a307469e6ed

                SHA1

                b047ee60fe06c3070a6e3d6b0a0dee57dc60bd80

                SHA256

                83dfc7a8af5ed7ad11c6aaafbfb98d9fb771d7d89813c4de8f85d2262768217a

                SHA512

                9cb6ae8c4d228d9887c893b4a67cd85620468542a43b617fa62d196a98d16e308927ff255b8417b6d956c877b5e29490591488bdf578754253db4cef5975eed1

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7538405.exe

                Filesize

                449KB

                MD5

                4b542eaf21e8d8e2666aa561ed3fa444

                SHA1

                06c04ad63d6ce8fb6f937e91d3696e05b24b852b

                SHA256

                8bceaf730e6c346751f84323b3f85cf7064389cc8cc5a805ee204cd60086fa18

                SHA512

                16c0002da1b99be14d0dac14f5c9c795c69929e1bfa32e3fda6aa4141bb6a8e1a8a1af0d847119843adabcefdd34fe1bc6e9e25b094f49a09147ad3c5ddcd328

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7538405.exe

                Filesize

                449KB

                MD5

                4b542eaf21e8d8e2666aa561ed3fa444

                SHA1

                06c04ad63d6ce8fb6f937e91d3696e05b24b852b

                SHA256

                8bceaf730e6c346751f84323b3f85cf7064389cc8cc5a805ee204cd60086fa18

                SHA512

                16c0002da1b99be14d0dac14f5c9c795c69929e1bfa32e3fda6aa4141bb6a8e1a8a1af0d847119843adabcefdd34fe1bc6e9e25b094f49a09147ad3c5ddcd328

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c1544913.exe

                Filesize

                205KB

                MD5

                bc4eff09d9ac26cfb2047469dd9830e6

                SHA1

                cc8f782aac2229965e5390007561132321aa8f57

                SHA256

                3c12a366304d0026fdb771df24645e06dd9105f1803c24c01eeda3058bec7d78

                SHA512

                8fdf41a67ce31666d47bf0aac64881bbe980e2e91b0d4b2c87db2d08b61945a7d9229ae25768c8925a5393be177a062deafb7ba2511092fce7a1c68e0a3ca089

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c1544913.exe

                Filesize

                205KB

                MD5

                bc4eff09d9ac26cfb2047469dd9830e6

                SHA1

                cc8f782aac2229965e5390007561132321aa8f57

                SHA256

                3c12a366304d0026fdb771df24645e06dd9105f1803c24c01eeda3058bec7d78

                SHA512

                8fdf41a67ce31666d47bf0aac64881bbe980e2e91b0d4b2c87db2d08b61945a7d9229ae25768c8925a5393be177a062deafb7ba2511092fce7a1c68e0a3ca089

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6667354.exe

                Filesize

                277KB

                MD5

                22f48470fa57e9129bec15d25d6f585f

                SHA1

                57c5beafb4daa9bdffb2d9f4f3f9272e65db6ec5

                SHA256

                cabf94719e01d0c94a5392c30fa04430cae7e925f601f6cab178757924b10453

                SHA512

                cadbb9459f8031419d8779aaf6f7b4e71440a7b410c456a5fd70a2cedd9aa8e8df81f52e6cd036ea8b9409f7dfda2dafa7a2925a968345758bcbaa6349caed63

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6667354.exe

                Filesize

                277KB

                MD5

                22f48470fa57e9129bec15d25d6f585f

                SHA1

                57c5beafb4daa9bdffb2d9f4f3f9272e65db6ec5

                SHA256

                cabf94719e01d0c94a5392c30fa04430cae7e925f601f6cab178757924b10453

                SHA512

                cadbb9459f8031419d8779aaf6f7b4e71440a7b410c456a5fd70a2cedd9aa8e8df81f52e6cd036ea8b9409f7dfda2dafa7a2925a968345758bcbaa6349caed63

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4179011.exe

                Filesize

                188KB

                MD5

                78901e2ff6f54851c4e7b5817414973b

                SHA1

                4b25a9fb550389fcd6fbcec580bd8b7db7452f5e

                SHA256

                ef9c728a20036f276148ad05c3c833fa909f2886ce56a0023940f3481dd35ff2

                SHA512

                c996a457cc318142f40e33b312343faebb60e0d9b5ff76bdf2eda932f967cd5c25fa50f1016d216ec59ffee5e95c397fee703bee9d11c9ed8533cfa82306f8e3

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4179011.exe

                Filesize

                188KB

                MD5

                78901e2ff6f54851c4e7b5817414973b

                SHA1

                4b25a9fb550389fcd6fbcec580bd8b7db7452f5e

                SHA256

                ef9c728a20036f276148ad05c3c833fa909f2886ce56a0023940f3481dd35ff2

                SHA512

                c996a457cc318142f40e33b312343faebb60e0d9b5ff76bdf2eda932f967cd5c25fa50f1016d216ec59ffee5e95c397fee703bee9d11c9ed8533cfa82306f8e3

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7327693.exe

                Filesize

                145KB

                MD5

                7e959a53b97f5bb744d304ec3ed43a41

                SHA1

                97c1d28ed0ee208d7e78c0f25bbbe2d5d7a8523a

                SHA256

                4d9703ebe94545cfa521b7756df891a67c8b06bca5c4b0a0e2942a037e8115f6

                SHA512

                43170f7a6ef069e138968ca7415ac8d5b75292500874a2d264f451d82be0a5b2a139766281216140d137354de6f76b959cafd3892cb7af44060de4ce9f7cebd2

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7327693.exe

                Filesize

                145KB

                MD5

                7e959a53b97f5bb744d304ec3ed43a41

                SHA1

                97c1d28ed0ee208d7e78c0f25bbbe2d5d7a8523a

                SHA256

                4d9703ebe94545cfa521b7756df891a67c8b06bca5c4b0a0e2942a037e8115f6

                SHA512

                43170f7a6ef069e138968ca7415ac8d5b75292500874a2d264f451d82be0a5b2a139766281216140d137354de6f76b959cafd3892cb7af44060de4ce9f7cebd2

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                205KB

                MD5

                bc4eff09d9ac26cfb2047469dd9830e6

                SHA1

                cc8f782aac2229965e5390007561132321aa8f57

                SHA256

                3c12a366304d0026fdb771df24645e06dd9105f1803c24c01eeda3058bec7d78

                SHA512

                8fdf41a67ce31666d47bf0aac64881bbe980e2e91b0d4b2c87db2d08b61945a7d9229ae25768c8925a5393be177a062deafb7ba2511092fce7a1c68e0a3ca089

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                205KB

                MD5

                bc4eff09d9ac26cfb2047469dd9830e6

                SHA1

                cc8f782aac2229965e5390007561132321aa8f57

                SHA256

                3c12a366304d0026fdb771df24645e06dd9105f1803c24c01eeda3058bec7d78

                SHA512

                8fdf41a67ce31666d47bf0aac64881bbe980e2e91b0d4b2c87db2d08b61945a7d9229ae25768c8925a5393be177a062deafb7ba2511092fce7a1c68e0a3ca089

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                205KB

                MD5

                bc4eff09d9ac26cfb2047469dd9830e6

                SHA1

                cc8f782aac2229965e5390007561132321aa8f57

                SHA256

                3c12a366304d0026fdb771df24645e06dd9105f1803c24c01eeda3058bec7d78

                SHA512

                8fdf41a67ce31666d47bf0aac64881bbe980e2e91b0d4b2c87db2d08b61945a7d9229ae25768c8925a5393be177a062deafb7ba2511092fce7a1c68e0a3ca089

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                205KB

                MD5

                bc4eff09d9ac26cfb2047469dd9830e6

                SHA1

                cc8f782aac2229965e5390007561132321aa8f57

                SHA256

                3c12a366304d0026fdb771df24645e06dd9105f1803c24c01eeda3058bec7d78

                SHA512

                8fdf41a67ce31666d47bf0aac64881bbe980e2e91b0d4b2c87db2d08b61945a7d9229ae25768c8925a5393be177a062deafb7ba2511092fce7a1c68e0a3ca089

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                205KB

                MD5

                bc4eff09d9ac26cfb2047469dd9830e6

                SHA1

                cc8f782aac2229965e5390007561132321aa8f57

                SHA256

                3c12a366304d0026fdb771df24645e06dd9105f1803c24c01eeda3058bec7d78

                SHA512

                8fdf41a67ce31666d47bf0aac64881bbe980e2e91b0d4b2c87db2d08b61945a7d9229ae25768c8925a5393be177a062deafb7ba2511092fce7a1c68e0a3ca089

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                547bae937be965d63f61d89e8eafb4a1

                SHA1

                85466c95625bcbb7f68aa89a367149d35f80e1fa

                SHA256

                015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5

                SHA512

                1869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                547bae937be965d63f61d89e8eafb4a1

                SHA1

                85466c95625bcbb7f68aa89a367149d35f80e1fa

                SHA256

                015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5

                SHA512

                1869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                162B

                MD5

                1b7c22a214949975556626d7217e9a39

                SHA1

                d01c97e2944166ed23e47e4a62ff471ab8fa031f

                SHA256

                340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                SHA512

                ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

              • \Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                547bae937be965d63f61d89e8eafb4a1

                SHA1

                85466c95625bcbb7f68aa89a367149d35f80e1fa

                SHA256

                015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5

                SHA512

                1869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f

              • memory/2252-139-0x00000000003D0000-0x00000000003DA000-memory.dmp

                Filesize

                40KB

              • memory/4436-202-0x0000000000700000-0x000000000072A000-memory.dmp

                Filesize

                168KB

              • memory/4436-211-0x0000000008DA0000-0x0000000008DEB000-memory.dmp

                Filesize

                300KB

              • memory/4436-216-0x0000000008C00000-0x0000000008C10000-memory.dmp

                Filesize

                64KB

              • memory/4452-151-0x0000000005BE0000-0x00000000061E6000-memory.dmp

                Filesize

                6.0MB

              • memory/4452-186-0x0000000005750000-0x0000000005760000-memory.dmp

                Filesize

                64KB

              • memory/4452-174-0x0000000006E30000-0x0000000006E80000-memory.dmp

                Filesize

                320KB

              • memory/4452-171-0x00000000070D0000-0x0000000007146000-memory.dmp

                Filesize

                472KB

              • memory/4452-169-0x0000000007600000-0x0000000007B2C000-memory.dmp

                Filesize

                5.2MB

              • memory/4452-168-0x0000000006F00000-0x00000000070C2000-memory.dmp

                Filesize

                1.8MB

              • memory/4452-167-0x00000000065F0000-0x0000000006682000-memory.dmp

                Filesize

                584KB

              • memory/4452-166-0x0000000005A30000-0x0000000005A96000-memory.dmp

                Filesize

                408KB

              • memory/4452-165-0x00000000066F0000-0x0000000006BEE000-memory.dmp

                Filesize

                5.0MB

              • memory/4452-156-0x0000000005880000-0x00000000058CB000-memory.dmp

                Filesize

                300KB

              • memory/4452-155-0x0000000005700000-0x000000000573E000-memory.dmp

                Filesize

                248KB

              • memory/4452-154-0x0000000005750000-0x0000000005760000-memory.dmp

                Filesize

                64KB

              • memory/4452-153-0x00000000056A0000-0x00000000056B2000-memory.dmp

                Filesize

                72KB

              • memory/4452-152-0x0000000005770000-0x000000000587A000-memory.dmp

                Filesize

                1.0MB

              • memory/4452-150-0x0000000000D10000-0x0000000000D3A000-memory.dmp

                Filesize

                168KB