Analysis
-
max time kernel
29s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
27-07-2021 15:32
Static task
static1
Behavioral task
behavioral1
Sample
26808e9fe7def427eea65c3f4b1c7838.exe
Resource
win7v20210408
General
-
Target
26808e9fe7def427eea65c3f4b1c7838.exe
-
Size
692KB
-
MD5
26808e9fe7def427eea65c3f4b1c7838
-
SHA1
36b67b700b9c6c84851ee50211e8a3f714ff8412
-
SHA256
b0c5d41fc112355182211c211ca210868a68c18f199bb7e4cf115650531d19a8
-
SHA512
c383fa5ba083dc5ec711c2c082f17c68404e695c412521deb2093b88342ab39f7ccd4a1c10b10483272287c0d57aeb862312e94d320064459a842d59dbd1ea1b
Malware Config
Extracted
redline
MIX 27.07
185.215.113.17:18597
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2700-121-0x00000000021C0000-0x00000000021DB000-memory.dmp family_redline behavioral2/memory/2700-123-0x00000000025D0000-0x00000000025EA000-memory.dmp family_redline -
suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
apineshpp.exepid process 2700 apineshpp.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
26808e9fe7def427eea65c3f4b1c7838.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 26808e9fe7def427eea65c3f4b1c7838.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 26808e9fe7def427eea65c3f4b1c7838.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
apineshpp.exepid process 2700 apineshpp.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
apineshpp.exedescription pid process Token: SeDebugPrivilege 2700 apineshpp.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
26808e9fe7def427eea65c3f4b1c7838.exedescription pid process target process PID 3128 wrote to memory of 2700 3128 26808e9fe7def427eea65c3f4b1c7838.exe apineshpp.exe PID 3128 wrote to memory of 2700 3128 26808e9fe7def427eea65c3f4b1c7838.exe apineshpp.exe PID 3128 wrote to memory of 2700 3128 26808e9fe7def427eea65c3f4b1c7838.exe apineshpp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\26808e9fe7def427eea65c3f4b1c7838.exe"C:\Users\Admin\AppData\Local\Temp\26808e9fe7def427eea65c3f4b1c7838.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\dahgarq\apineshpp.exeapineshpp.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\dahgarq\apineshpp.exeMD5
cc904eb37f5b7045892d29350c8022ce
SHA191a718ea5544056e870ff49e7759d1b3b5818cea
SHA2568e41b7dbc4efb96ccd077635859088866c629a1f131364bb64de2bf72b852723
SHA51216e64de75fd6bb4d908a1208f17fb47fc94c86b6ac3f207cb3a52af9486f65a50237dfc3984851997fc9d752cf5715fb541d8821bff74ed0f3113c8b5276bf72
-
C:\Users\Admin\AppData\Roaming\dahgarq\apineshpp.exeMD5
cc904eb37f5b7045892d29350c8022ce
SHA191a718ea5544056e870ff49e7759d1b3b5818cea
SHA2568e41b7dbc4efb96ccd077635859088866c629a1f131364bb64de2bf72b852723
SHA51216e64de75fd6bb4d908a1208f17fb47fc94c86b6ac3f207cb3a52af9486f65a50237dfc3984851997fc9d752cf5715fb541d8821bff74ed0f3113c8b5276bf72
-
memory/2700-126-0x0000000004D63000-0x0000000004D64000-memory.dmpFilesize
4KB
-
memory/2700-138-0x0000000007420000-0x0000000007421000-memory.dmpFilesize
4KB
-
memory/2700-127-0x0000000005270000-0x0000000005271000-memory.dmpFilesize
4KB
-
memory/2700-120-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2700-119-0x0000000002070000-0x000000000209F000-memory.dmpFilesize
188KB
-
memory/2700-121-0x00000000021C0000-0x00000000021DB000-memory.dmpFilesize
108KB
-
memory/2700-122-0x0000000004D70000-0x0000000004D71000-memory.dmpFilesize
4KB
-
memory/2700-123-0x00000000025D0000-0x00000000025EA000-memory.dmpFilesize
104KB
-
memory/2700-125-0x0000000004D62000-0x0000000004D63000-memory.dmpFilesize
4KB
-
memory/2700-128-0x0000000004BA0000-0x0000000004BA1000-memory.dmpFilesize
4KB
-
memory/2700-137-0x0000000007240000-0x0000000007241000-memory.dmpFilesize
4KB
-
memory/2700-116-0x0000000000000000-mapping.dmp
-
memory/2700-124-0x0000000004D60000-0x0000000004D61000-memory.dmpFilesize
4KB
-
memory/2700-129-0x0000000004BC0000-0x0000000004BC1000-memory.dmpFilesize
4KB
-
memory/2700-130-0x0000000004C20000-0x0000000004C21000-memory.dmpFilesize
4KB
-
memory/2700-131-0x0000000004D64000-0x0000000004D66000-memory.dmpFilesize
8KB
-
memory/2700-132-0x00000000058D0000-0x00000000058D1000-memory.dmpFilesize
4KB
-
memory/2700-133-0x00000000065B0000-0x00000000065B1000-memory.dmpFilesize
4KB
-
memory/2700-134-0x0000000006780000-0x0000000006781000-memory.dmpFilesize
4KB
-
memory/2700-135-0x0000000006DB0000-0x0000000006DB1000-memory.dmpFilesize
4KB
-
memory/2700-136-0x0000000007150000-0x0000000007151000-memory.dmpFilesize
4KB
-
memory/3128-115-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB
-
memory/3128-114-0x0000000002210000-0x00000000022DC000-memory.dmpFilesize
816KB