Analysis
-
max time kernel
34s -
max time network
36s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
26-07-2021 14:03
Static task
static1
Behavioral task
behavioral1
Sample
57b7bb4faf2eabffda8fd57de9642234.exe
Resource
win7v20210408
General
-
Target
57b7bb4faf2eabffda8fd57de9642234.exe
-
Size
689KB
-
MD5
57b7bb4faf2eabffda8fd57de9642234
-
SHA1
a9ab94f2d27ee8fb44893b83059d53ae063a6093
-
SHA256
1b8e0d6bf6bbc7bd304c72d27f68e40383a3107cdd286cdae3ad77cfb2877438
-
SHA512
45b0114f87daf889aa1932e5bc34ffe5d48cacfabe24572f215970c43fb5b8a09f6667820fecf2f609bd3d88cf1c628db3d639cb27742e39200e8ce2acbbbed2
Malware Config
Extracted
redline
MIX 26.07
185.215.113.17:18597
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/620-69-0x0000000000390000-0x00000000003AB000-memory.dmp family_redline behavioral1/memory/620-73-0x00000000007D0000-0x00000000007EA000-memory.dmp family_redline -
suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
apineshpp.exepid process 620 apineshpp.exe -
Loads dropped DLL 2 IoCs
Processes:
57b7bb4faf2eabffda8fd57de9642234.exepid process 792 57b7bb4faf2eabffda8fd57de9642234.exe 792 57b7bb4faf2eabffda8fd57de9642234.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
57b7bb4faf2eabffda8fd57de9642234.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 57b7bb4faf2eabffda8fd57de9642234.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 57b7bb4faf2eabffda8fd57de9642234.exe -
Processes:
apineshpp.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 apineshpp.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e apineshpp.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e apineshpp.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
apineshpp.exepid process 620 apineshpp.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
apineshpp.exedescription pid process Token: SeDebugPrivilege 620 apineshpp.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
57b7bb4faf2eabffda8fd57de9642234.exedescription pid process target process PID 792 wrote to memory of 620 792 57b7bb4faf2eabffda8fd57de9642234.exe apineshpp.exe PID 792 wrote to memory of 620 792 57b7bb4faf2eabffda8fd57de9642234.exe apineshpp.exe PID 792 wrote to memory of 620 792 57b7bb4faf2eabffda8fd57de9642234.exe apineshpp.exe PID 792 wrote to memory of 620 792 57b7bb4faf2eabffda8fd57de9642234.exe apineshpp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\57b7bb4faf2eabffda8fd57de9642234.exe"C:\Users\Admin\AppData\Local\Temp\57b7bb4faf2eabffda8fd57de9642234.exe"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\dahgarq\apineshpp.exeapineshpp.exe2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\dahgarq\apineshpp.exeMD5
2828e87a24cde9ffa4d318a0a98fab8b
SHA1b8e22b39aebeb2724ce7f8d2edcfcdbe07bbf908
SHA256b30c723982534b09ac7736e33151c7093403b96e8cbc0c9aa58bd7cfcb6a7e32
SHA512d8cd026bbb4f218f8d3d44a139cf36e8052120980a7bae2e9ffbd0a24697de658d19889c9335f0aae812a0af75c993c7e2456e7a3efd8fb0cd77e392f2e3ecf1
-
\Users\Admin\AppData\Roaming\dahgarq\apineshpp.exeMD5
2828e87a24cde9ffa4d318a0a98fab8b
SHA1b8e22b39aebeb2724ce7f8d2edcfcdbe07bbf908
SHA256b30c723982534b09ac7736e33151c7093403b96e8cbc0c9aa58bd7cfcb6a7e32
SHA512d8cd026bbb4f218f8d3d44a139cf36e8052120980a7bae2e9ffbd0a24697de658d19889c9335f0aae812a0af75c993c7e2456e7a3efd8fb0cd77e392f2e3ecf1
-
\Users\Admin\AppData\Roaming\dahgarq\apineshpp.exeMD5
2828e87a24cde9ffa4d318a0a98fab8b
SHA1b8e22b39aebeb2724ce7f8d2edcfcdbe07bbf908
SHA256b30c723982534b09ac7736e33151c7093403b96e8cbc0c9aa58bd7cfcb6a7e32
SHA512d8cd026bbb4f218f8d3d44a139cf36e8052120980a7bae2e9ffbd0a24697de658d19889c9335f0aae812a0af75c993c7e2456e7a3efd8fb0cd77e392f2e3ecf1
-
memory/620-68-0x0000000000400000-0x000000000047D000-memory.dmpFilesize
500KB
-
memory/620-65-0x0000000000000000-mapping.dmp
-
memory/620-67-0x0000000000230000-0x000000000025F000-memory.dmpFilesize
188KB
-
memory/620-69-0x0000000000390000-0x00000000003AB000-memory.dmpFilesize
108KB
-
memory/620-71-0x0000000004A72000-0x0000000004A73000-memory.dmpFilesize
4KB
-
memory/620-70-0x0000000004A71000-0x0000000004A72000-memory.dmpFilesize
4KB
-
memory/620-72-0x0000000004A73000-0x0000000004A74000-memory.dmpFilesize
4KB
-
memory/620-73-0x00000000007D0000-0x00000000007EA000-memory.dmpFilesize
104KB
-
memory/620-74-0x0000000004A74000-0x0000000004A76000-memory.dmpFilesize
8KB
-
memory/792-60-0x0000000075041000-0x0000000075043000-memory.dmpFilesize
8KB
-
memory/792-61-0x00000000004E0000-0x00000000005AC000-memory.dmpFilesize
816KB
-
memory/792-62-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB