Analysis
-
max time kernel
20s -
max time network
45s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27-07-2021 15:41
Static task
static1
Behavioral task
behavioral1
Sample
fab18787863297968fe1c105420d8465.exe
Resource
win7v20210410
General
-
Target
fab18787863297968fe1c105420d8465.exe
-
Size
692KB
-
MD5
fab18787863297968fe1c105420d8465
-
SHA1
f1069e7432ba125ee7c4eb67064b817134095ab9
-
SHA256
04a7438ab8d6f9429c0ae2856093431cbcc974f753862d726caa0d4bc8eef916
-
SHA512
b4c9b8a0e151807064b0fc9da9f35a50e78d8e47a94d96870f1c2a6c85e1077cc30ad827256f4a89df4901b3bab805dd0998795a0282010f101550d2323436bf
Malware Config
Extracted
redline
MIX 27.07
185.215.113.17:18597
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/332-67-0x0000000000500000-0x000000000051B000-memory.dmp family_redline behavioral1/memory/332-70-0x00000000020E0000-0x00000000020FA000-memory.dmp family_redline -
suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
apineshpp.exepid process 332 apineshpp.exe -
Loads dropped DLL 2 IoCs
Processes:
fab18787863297968fe1c105420d8465.exepid process 2028 fab18787863297968fe1c105420d8465.exe 2028 fab18787863297968fe1c105420d8465.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
fab18787863297968fe1c105420d8465.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 fab18787863297968fe1c105420d8465.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString fab18787863297968fe1c105420d8465.exe -
Processes:
apineshpp.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 apineshpp.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e apineshpp.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e apineshpp.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
apineshpp.exepid process 332 apineshpp.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
apineshpp.exedescription pid process Token: SeDebugPrivilege 332 apineshpp.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
fab18787863297968fe1c105420d8465.exedescription pid process target process PID 2028 wrote to memory of 332 2028 fab18787863297968fe1c105420d8465.exe apineshpp.exe PID 2028 wrote to memory of 332 2028 fab18787863297968fe1c105420d8465.exe apineshpp.exe PID 2028 wrote to memory of 332 2028 fab18787863297968fe1c105420d8465.exe apineshpp.exe PID 2028 wrote to memory of 332 2028 fab18787863297968fe1c105420d8465.exe apineshpp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fab18787863297968fe1c105420d8465.exe"C:\Users\Admin\AppData\Local\Temp\fab18787863297968fe1c105420d8465.exe"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\dahgarq\apineshpp.exeapineshpp.exe2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\dahgarq\apineshpp.exeMD5
cc904eb37f5b7045892d29350c8022ce
SHA191a718ea5544056e870ff49e7759d1b3b5818cea
SHA2568e41b7dbc4efb96ccd077635859088866c629a1f131364bb64de2bf72b852723
SHA51216e64de75fd6bb4d908a1208f17fb47fc94c86b6ac3f207cb3a52af9486f65a50237dfc3984851997fc9d752cf5715fb541d8821bff74ed0f3113c8b5276bf72
-
\Users\Admin\AppData\Roaming\dahgarq\apineshpp.exeMD5
cc904eb37f5b7045892d29350c8022ce
SHA191a718ea5544056e870ff49e7759d1b3b5818cea
SHA2568e41b7dbc4efb96ccd077635859088866c629a1f131364bb64de2bf72b852723
SHA51216e64de75fd6bb4d908a1208f17fb47fc94c86b6ac3f207cb3a52af9486f65a50237dfc3984851997fc9d752cf5715fb541d8821bff74ed0f3113c8b5276bf72
-
\Users\Admin\AppData\Roaming\dahgarq\apineshpp.exeMD5
cc904eb37f5b7045892d29350c8022ce
SHA191a718ea5544056e870ff49e7759d1b3b5818cea
SHA2568e41b7dbc4efb96ccd077635859088866c629a1f131364bb64de2bf72b852723
SHA51216e64de75fd6bb4d908a1208f17fb47fc94c86b6ac3f207cb3a52af9486f65a50237dfc3984851997fc9d752cf5715fb541d8821bff74ed0f3113c8b5276bf72
-
memory/332-68-0x00000000002D0000-0x00000000002FF000-memory.dmpFilesize
188KB
-
memory/332-65-0x0000000000000000-mapping.dmp
-
memory/332-67-0x0000000000500000-0x000000000051B000-memory.dmpFilesize
108KB
-
memory/332-72-0x0000000004942000-0x0000000004943000-memory.dmpFilesize
4KB
-
memory/332-73-0x0000000004943000-0x0000000004944000-memory.dmpFilesize
4KB
-
memory/332-71-0x0000000004941000-0x0000000004942000-memory.dmpFilesize
4KB
-
memory/332-70-0x00000000020E0000-0x00000000020FA000-memory.dmpFilesize
104KB
-
memory/332-69-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/332-74-0x0000000004944000-0x0000000004946000-memory.dmpFilesize
8KB
-
memory/2028-60-0x00000000765F1000-0x00000000765F3000-memory.dmpFilesize
8KB
-
memory/2028-61-0x0000000001CA0000-0x0000000001D6C000-memory.dmpFilesize
816KB
-
memory/2028-62-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB