Analysis
-
max time kernel
26s -
max time network
54s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27-07-2021 15:38
Static task
static1
Behavioral task
behavioral1
Sample
c5f656e37e0f79c1d657fac79c0dc6f9.exe
Resource
win7v20210410
General
-
Target
c5f656e37e0f79c1d657fac79c0dc6f9.exe
-
Size
689KB
-
MD5
c5f656e37e0f79c1d657fac79c0dc6f9
-
SHA1
9f8ea43cff55f791bc07b54831db69ff8e538536
-
SHA256
4a366034ebd2de1c9b6a13b215a82d56b31c0ed5f6162edc55b11084b69d1e46
-
SHA512
7a4269a1bcebb4f2858c66599ac609bc8a22972e72a8fe073b0f4262c07ff273ed7833cdedd901444187367dae550d753c2c607fcc3effbf7a8cec9b9cadb578
Malware Config
Extracted
redline
MIX 27.07
185.215.113.17:18597
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/512-68-0x00000000020E0000-0x00000000020FB000-memory.dmp family_redline behavioral1/memory/512-69-0x0000000002120000-0x000000000213A000-memory.dmp family_redline -
suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
apineshpp.exepid process 512 apineshpp.exe -
Loads dropped DLL 2 IoCs
Processes:
c5f656e37e0f79c1d657fac79c0dc6f9.exepid process 1852 c5f656e37e0f79c1d657fac79c0dc6f9.exe 1852 c5f656e37e0f79c1d657fac79c0dc6f9.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
c5f656e37e0f79c1d657fac79c0dc6f9.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 c5f656e37e0f79c1d657fac79c0dc6f9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString c5f656e37e0f79c1d657fac79c0dc6f9.exe -
Processes:
apineshpp.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e apineshpp.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e apineshpp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 apineshpp.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
apineshpp.exepid process 512 apineshpp.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
apineshpp.exedescription pid process Token: SeDebugPrivilege 512 apineshpp.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
c5f656e37e0f79c1d657fac79c0dc6f9.exedescription pid process target process PID 1852 wrote to memory of 512 1852 c5f656e37e0f79c1d657fac79c0dc6f9.exe apineshpp.exe PID 1852 wrote to memory of 512 1852 c5f656e37e0f79c1d657fac79c0dc6f9.exe apineshpp.exe PID 1852 wrote to memory of 512 1852 c5f656e37e0f79c1d657fac79c0dc6f9.exe apineshpp.exe PID 1852 wrote to memory of 512 1852 c5f656e37e0f79c1d657fac79c0dc6f9.exe apineshpp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5f656e37e0f79c1d657fac79c0dc6f9.exe"C:\Users\Admin\AppData\Local\Temp\c5f656e37e0f79c1d657fac79c0dc6f9.exe"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\dahgarq\apineshpp.exeapineshpp.exe2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\dahgarq\apineshpp.exeMD5
cc904eb37f5b7045892d29350c8022ce
SHA191a718ea5544056e870ff49e7759d1b3b5818cea
SHA2568e41b7dbc4efb96ccd077635859088866c629a1f131364bb64de2bf72b852723
SHA51216e64de75fd6bb4d908a1208f17fb47fc94c86b6ac3f207cb3a52af9486f65a50237dfc3984851997fc9d752cf5715fb541d8821bff74ed0f3113c8b5276bf72
-
\Users\Admin\AppData\Roaming\dahgarq\apineshpp.exeMD5
cc904eb37f5b7045892d29350c8022ce
SHA191a718ea5544056e870ff49e7759d1b3b5818cea
SHA2568e41b7dbc4efb96ccd077635859088866c629a1f131364bb64de2bf72b852723
SHA51216e64de75fd6bb4d908a1208f17fb47fc94c86b6ac3f207cb3a52af9486f65a50237dfc3984851997fc9d752cf5715fb541d8821bff74ed0f3113c8b5276bf72
-
\Users\Admin\AppData\Roaming\dahgarq\apineshpp.exeMD5
cc904eb37f5b7045892d29350c8022ce
SHA191a718ea5544056e870ff49e7759d1b3b5818cea
SHA2568e41b7dbc4efb96ccd077635859088866c629a1f131364bb64de2bf72b852723
SHA51216e64de75fd6bb4d908a1208f17fb47fc94c86b6ac3f207cb3a52af9486f65a50237dfc3984851997fc9d752cf5715fb541d8821bff74ed0f3113c8b5276bf72
-
memory/512-66-0x00000000003D0000-0x00000000003FF000-memory.dmpFilesize
188KB
-
memory/512-64-0x0000000000000000-mapping.dmp
-
memory/512-67-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/512-68-0x00000000020E0000-0x00000000020FB000-memory.dmpFilesize
108KB
-
memory/512-69-0x0000000002120000-0x000000000213A000-memory.dmpFilesize
104KB
-
memory/512-72-0x0000000002183000-0x0000000002184000-memory.dmpFilesize
4KB
-
memory/512-71-0x0000000002182000-0x0000000002183000-memory.dmpFilesize
4KB
-
memory/512-73-0x0000000002184000-0x0000000002186000-memory.dmpFilesize
8KB
-
memory/512-70-0x0000000002181000-0x0000000002182000-memory.dmpFilesize
4KB
-
memory/1852-59-0x0000000074F31000-0x0000000074F33000-memory.dmpFilesize
8KB
-
memory/1852-60-0x00000000004E0000-0x00000000005AC000-memory.dmpFilesize
816KB
-
memory/1852-61-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB