Analysis

  • max time kernel
    138s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-06-2023 01:44

General

  • Target

    55cdc97fd6c5d628dc2e3c0531713cb98b204c94ed1a68ae5323de8cb3bd14b7.exe

  • Size

    751KB

  • MD5

    fea94ff0f46639c084a7e060f4a19ffd

  • SHA1

    7e782714e15b6ed91a008ca81eedb3696a687e2b

  • SHA256

    55cdc97fd6c5d628dc2e3c0531713cb98b204c94ed1a68ae5323de8cb3bd14b7

  • SHA512

    6cb22dd2fe12ada91eb021bc0570fdc2c2181537ecbd2278fbbe8b79d0862f06b28cbdf4c920a21361c39760ef3f0d943939f38e52e13470eb66cb3044a790e9

  • SSDEEP

    12288:QMrTy90mfH62QceZaw44EydOul2Dc/jgWgn5iULid/twDjU54F34:TyjF7w3dOul26Hgn5XL6/twDwyF34

Malware Config

Extracted

Family

redline

Botnet

diza

C2

83.97.73.127:19045

Attributes
  • auth_value

    0d09b419c8bc967f91c68be4a17e92ee

Extracted

Family

redline

Botnet

rocker

C2

83.97.73.127:19045

Attributes
  • auth_value

    b4693c25843b5a1c7d63376e73e32dae

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\55cdc97fd6c5d628dc2e3c0531713cb98b204c94ed1a68ae5323de8cb3bd14b7.exe
    "C:\Users\Admin\AppData\Local\Temp\55cdc97fd6c5d628dc2e3c0531713cb98b204c94ed1a68ae5323de8cb3bd14b7.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4104
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1703514.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1703514.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2420
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3085108.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3085108.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1536
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f8887600.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f8887600.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2216
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g3877900.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g3877900.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2728
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
            "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4824
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7912393.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7912393.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2012
        • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
          "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2928
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metado.exe /TR "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:3784
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metado.exe" /P "Admin:N"&&CACLS "metado.exe" /P "Admin:R" /E&&echo Y|CACLS "..\a9e2a16078" /P "Admin:N"&&CACLS "..\a9e2a16078" /P "Admin:R" /E&&Exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4852
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              6⤵
                PID:3960
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metado.exe" /P "Admin:N"
                6⤵
                  PID:560
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "metado.exe" /P "Admin:R" /E
                  6⤵
                    PID:1516
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    6⤵
                      PID:3936
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\a9e2a16078" /P "Admin:N"
                      6⤵
                        PID:4672
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\a9e2a16078" /P "Admin:R" /E
                        6⤵
                          PID:3792
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                        5⤵
                        • Loads dropped DLL
                        PID:4440
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i9664518.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i9664518.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:1144
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                    "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1072
              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                1⤵
                • Executes dropped EXE
                PID:5052
              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                1⤵
                • Executes dropped EXE
                PID:1428

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

                Filesize

                226B

                MD5

                916851e072fbabc4796d8916c5131092

                SHA1

                d48a602229a690c512d5fdaf4c8d77547a88e7a2

                SHA256

                7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

                SHA512

                07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i9664518.exe

                Filesize

                323KB

                MD5

                93457be7529e5e6cdfcd01dedafcc223

                SHA1

                e179c6ed1532b28a89ce2477b5a6ccde80835318

                SHA256

                7c923a1f6fb08957af889b4d9823b319a0904306535e984077028cbe5fd7edf9

                SHA512

                c20cec5c3713bd5fc7f393ec07f6c1401b5093710b9746b792c6dcbd3a8c06a00dc4e4d8a41b286f25c35d39063dfd9ec8c596365c27ae70d29021271c2340a9

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i9664518.exe

                Filesize

                323KB

                MD5

                93457be7529e5e6cdfcd01dedafcc223

                SHA1

                e179c6ed1532b28a89ce2477b5a6ccde80835318

                SHA256

                7c923a1f6fb08957af889b4d9823b319a0904306535e984077028cbe5fd7edf9

                SHA512

                c20cec5c3713bd5fc7f393ec07f6c1401b5093710b9746b792c6dcbd3a8c06a00dc4e4d8a41b286f25c35d39063dfd9ec8c596365c27ae70d29021271c2340a9

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1703514.exe

                Filesize

                451KB

                MD5

                c20a45e7a71aece3e7f490daf6cb5035

                SHA1

                2d7f10ecd6e842c8e3dbd9772663245823bcd105

                SHA256

                a14867d384ae0e7eb6e5d173e2c25a199be06060685d54cbbb5700aa0ea00dbe

                SHA512

                007272ac8a259b039412c6834cb78fb56f9995971689ce6a278a398806c8b4f333b58cb579ce32ae6a84defb8ad0f0b5f31ff5400e76e4d37e30f20c43ca4f15

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1703514.exe

                Filesize

                451KB

                MD5

                c20a45e7a71aece3e7f490daf6cb5035

                SHA1

                2d7f10ecd6e842c8e3dbd9772663245823bcd105

                SHA256

                a14867d384ae0e7eb6e5d173e2c25a199be06060685d54cbbb5700aa0ea00dbe

                SHA512

                007272ac8a259b039412c6834cb78fb56f9995971689ce6a278a398806c8b4f333b58cb579ce32ae6a84defb8ad0f0b5f31ff5400e76e4d37e30f20c43ca4f15

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7912393.exe

                Filesize

                213KB

                MD5

                10f4e6eb118c000e665088ade4eda2d1

                SHA1

                4cbae0697e701b7da28d73aacdacc4bd04e2c840

                SHA256

                bf29a24cf074095dcdef466fb77c561a17bb52e7916cee30703453f7e79826f7

                SHA512

                ede845b4924342cdae32f18698622900748478d303330bca9427ae137b1156733fdd1eb9d4bd09da52cf0cc036a1363905f159696490abea20f471519e3e9d3a

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7912393.exe

                Filesize

                213KB

                MD5

                10f4e6eb118c000e665088ade4eda2d1

                SHA1

                4cbae0697e701b7da28d73aacdacc4bd04e2c840

                SHA256

                bf29a24cf074095dcdef466fb77c561a17bb52e7916cee30703453f7e79826f7

                SHA512

                ede845b4924342cdae32f18698622900748478d303330bca9427ae137b1156733fdd1eb9d4bd09da52cf0cc036a1363905f159696490abea20f471519e3e9d3a

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3085108.exe

                Filesize

                279KB

                MD5

                3d880af867978ca5f76703636581b40e

                SHA1

                ccf4262e6f9152279d763ae99701945c79a7d906

                SHA256

                691b20d458c4f908485b1ec8f13f906f9ff9b74efeb5fc303f9667eed69af46a

                SHA512

                66dfb7e9a28ab924ebaf2f533adc64a3a44dde7d3b575c02fc68b6b9b688b6e4f21424912c4f214c84f089eca73aa43c276454a7a119464a6eb5189358ccfede

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3085108.exe

                Filesize

                279KB

                MD5

                3d880af867978ca5f76703636581b40e

                SHA1

                ccf4262e6f9152279d763ae99701945c79a7d906

                SHA256

                691b20d458c4f908485b1ec8f13f906f9ff9b74efeb5fc303f9667eed69af46a

                SHA512

                66dfb7e9a28ab924ebaf2f533adc64a3a44dde7d3b575c02fc68b6b9b688b6e4f21424912c4f214c84f089eca73aa43c276454a7a119464a6eb5189358ccfede

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f8887600.exe

                Filesize

                168KB

                MD5

                643f08724ed3fef630f63711b5557364

                SHA1

                97f4d3669727ad346cd35e09cbd0e1164c9e3cb1

                SHA256

                f9b0b6afa9a3944105442a2239ee724df6828099c5770a7077dc6f57cddcc81a

                SHA512

                1db65cc5b4f8ba187f4f31f1823e7dd3b2c07088c71b0b15306c5c83a762f36a350ce6ef7dd2b8e96b7c8dd7d2a049862acc918265fa41c5fe12ae2fcbd21248

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f8887600.exe

                Filesize

                168KB

                MD5

                643f08724ed3fef630f63711b5557364

                SHA1

                97f4d3669727ad346cd35e09cbd0e1164c9e3cb1

                SHA256

                f9b0b6afa9a3944105442a2239ee724df6828099c5770a7077dc6f57cddcc81a

                SHA512

                1db65cc5b4f8ba187f4f31f1823e7dd3b2c07088c71b0b15306c5c83a762f36a350ce6ef7dd2b8e96b7c8dd7d2a049862acc918265fa41c5fe12ae2fcbd21248

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g3877900.exe

                Filesize

                166KB

                MD5

                a0a51651825718eb60d4af41c4a2bf99

                SHA1

                ff9af8f16e4ff58d8abfa669b8c7ab833110324d

                SHA256

                e29eae1312048978ec0817604489ee6de9651c700af74d07630f6098e51aec05

                SHA512

                30fecd1820946c437c31e7695149cc39ad4d5a2259d74e8ba5e2613dd3dfd832e97a57863a93c7c76d66b2a7ea5ccc48ffeca8038fe1c7b74a0e200cfe32a1f2

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g3877900.exe

                Filesize

                166KB

                MD5

                a0a51651825718eb60d4af41c4a2bf99

                SHA1

                ff9af8f16e4ff58d8abfa669b8c7ab833110324d

                SHA256

                e29eae1312048978ec0817604489ee6de9651c700af74d07630f6098e51aec05

                SHA512

                30fecd1820946c437c31e7695149cc39ad4d5a2259d74e8ba5e2613dd3dfd832e97a57863a93c7c76d66b2a7ea5ccc48ffeca8038fe1c7b74a0e200cfe32a1f2

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                213KB

                MD5

                10f4e6eb118c000e665088ade4eda2d1

                SHA1

                4cbae0697e701b7da28d73aacdacc4bd04e2c840

                SHA256

                bf29a24cf074095dcdef466fb77c561a17bb52e7916cee30703453f7e79826f7

                SHA512

                ede845b4924342cdae32f18698622900748478d303330bca9427ae137b1156733fdd1eb9d4bd09da52cf0cc036a1363905f159696490abea20f471519e3e9d3a

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                213KB

                MD5

                10f4e6eb118c000e665088ade4eda2d1

                SHA1

                4cbae0697e701b7da28d73aacdacc4bd04e2c840

                SHA256

                bf29a24cf074095dcdef466fb77c561a17bb52e7916cee30703453f7e79826f7

                SHA512

                ede845b4924342cdae32f18698622900748478d303330bca9427ae137b1156733fdd1eb9d4bd09da52cf0cc036a1363905f159696490abea20f471519e3e9d3a

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                213KB

                MD5

                10f4e6eb118c000e665088ade4eda2d1

                SHA1

                4cbae0697e701b7da28d73aacdacc4bd04e2c840

                SHA256

                bf29a24cf074095dcdef466fb77c561a17bb52e7916cee30703453f7e79826f7

                SHA512

                ede845b4924342cdae32f18698622900748478d303330bca9427ae137b1156733fdd1eb9d4bd09da52cf0cc036a1363905f159696490abea20f471519e3e9d3a

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                213KB

                MD5

                10f4e6eb118c000e665088ade4eda2d1

                SHA1

                4cbae0697e701b7da28d73aacdacc4bd04e2c840

                SHA256

                bf29a24cf074095dcdef466fb77c561a17bb52e7916cee30703453f7e79826f7

                SHA512

                ede845b4924342cdae32f18698622900748478d303330bca9427ae137b1156733fdd1eb9d4bd09da52cf0cc036a1363905f159696490abea20f471519e3e9d3a

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                213KB

                MD5

                10f4e6eb118c000e665088ade4eda2d1

                SHA1

                4cbae0697e701b7da28d73aacdacc4bd04e2c840

                SHA256

                bf29a24cf074095dcdef466fb77c561a17bb52e7916cee30703453f7e79826f7

                SHA512

                ede845b4924342cdae32f18698622900748478d303330bca9427ae137b1156733fdd1eb9d4bd09da52cf0cc036a1363905f159696490abea20f471519e3e9d3a

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                547bae937be965d63f61d89e8eafb4a1

                SHA1

                85466c95625bcbb7f68aa89a367149d35f80e1fa

                SHA256

                015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5

                SHA512

                1869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                547bae937be965d63f61d89e8eafb4a1

                SHA1

                85466c95625bcbb7f68aa89a367149d35f80e1fa

                SHA256

                015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5

                SHA512

                1869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                547bae937be965d63f61d89e8eafb4a1

                SHA1

                85466c95625bcbb7f68aa89a367149d35f80e1fa

                SHA256

                015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5

                SHA512

                1869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                162B

                MD5

                1b7c22a214949975556626d7217e9a39

                SHA1

                d01c97e2944166ed23e47e4a62ff471ab8fa031f

                SHA256

                340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                SHA512

                ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

              • memory/1072-193-0x00000000001D0000-0x00000000001FE000-memory.dmp

                Filesize

                184KB

              • memory/1072-198-0x0000000004840000-0x0000000004850000-memory.dmp

                Filesize

                64KB

              • memory/2216-157-0x0000000005730000-0x0000000005742000-memory.dmp

                Filesize

                72KB

              • memory/2216-162-0x0000000006E60000-0x0000000007404000-memory.dmp

                Filesize

                5.6MB

              • memory/2216-167-0x0000000006B80000-0x0000000006BD0000-memory.dmp

                Filesize

                320KB

              • memory/2216-166-0x0000000005770000-0x0000000005780000-memory.dmp

                Filesize

                64KB

              • memory/2216-165-0x0000000009030000-0x000000000955C000-memory.dmp

                Filesize

                5.2MB

              • memory/2216-164-0x0000000006C80000-0x0000000006E42000-memory.dmp

                Filesize

                1.8MB

              • memory/2216-163-0x00000000063C0000-0x0000000006426000-memory.dmp

                Filesize

                408KB

              • memory/2216-154-0x0000000000CB0000-0x0000000000CDE000-memory.dmp

                Filesize

                184KB

              • memory/2216-161-0x0000000005BD0000-0x0000000005C62000-memory.dmp

                Filesize

                584KB

              • memory/2216-160-0x0000000005AB0000-0x0000000005B26000-memory.dmp

                Filesize

                472KB

              • memory/2216-159-0x0000000005770000-0x0000000005780000-memory.dmp

                Filesize

                64KB

              • memory/2216-158-0x00000000057C0000-0x00000000057FC000-memory.dmp

                Filesize

                240KB

              • memory/2216-156-0x0000000005890000-0x000000000599A000-memory.dmp

                Filesize

                1.0MB

              • memory/2216-155-0x0000000005DA0000-0x00000000063B8000-memory.dmp

                Filesize

                6.1MB

              • memory/4824-172-0x0000000000400000-0x000000000040A000-memory.dmp

                Filesize

                40KB