Analysis
-
max time kernel
30s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
27-07-2021 15:38
Static task
static1
Behavioral task
behavioral1
Sample
c5f656e37e0f79c1d657fac79c0dc6f9.exe
Resource
win7v20210410
General
-
Target
c5f656e37e0f79c1d657fac79c0dc6f9.exe
-
Size
689KB
-
MD5
c5f656e37e0f79c1d657fac79c0dc6f9
-
SHA1
9f8ea43cff55f791bc07b54831db69ff8e538536
-
SHA256
4a366034ebd2de1c9b6a13b215a82d56b31c0ed5f6162edc55b11084b69d1e46
-
SHA512
7a4269a1bcebb4f2858c66599ac609bc8a22972e72a8fe073b0f4262c07ff273ed7833cdedd901444187367dae550d753c2c607fcc3effbf7a8cec9b9cadb578
Malware Config
Extracted
redline
MIX 27.07
185.215.113.17:18597
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/196-119-0x0000000002140000-0x000000000215B000-memory.dmp family_redline behavioral2/memory/196-121-0x0000000004EC0000-0x0000000004EDA000-memory.dmp family_redline -
suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
apineshpp.exepid process 196 apineshpp.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
c5f656e37e0f79c1d657fac79c0dc6f9.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 c5f656e37e0f79c1d657fac79c0dc6f9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString c5f656e37e0f79c1d657fac79c0dc6f9.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
apineshpp.exepid process 196 apineshpp.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
apineshpp.exedescription pid process Token: SeDebugPrivilege 196 apineshpp.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
c5f656e37e0f79c1d657fac79c0dc6f9.exedescription pid process target process PID 808 wrote to memory of 196 808 c5f656e37e0f79c1d657fac79c0dc6f9.exe apineshpp.exe PID 808 wrote to memory of 196 808 c5f656e37e0f79c1d657fac79c0dc6f9.exe apineshpp.exe PID 808 wrote to memory of 196 808 c5f656e37e0f79c1d657fac79c0dc6f9.exe apineshpp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5f656e37e0f79c1d657fac79c0dc6f9.exe"C:\Users\Admin\AppData\Local\Temp\c5f656e37e0f79c1d657fac79c0dc6f9.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\dahgarq\apineshpp.exeapineshpp.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\dahgarq\apineshpp.exeMD5
cc904eb37f5b7045892d29350c8022ce
SHA191a718ea5544056e870ff49e7759d1b3b5818cea
SHA2568e41b7dbc4efb96ccd077635859088866c629a1f131364bb64de2bf72b852723
SHA51216e64de75fd6bb4d908a1208f17fb47fc94c86b6ac3f207cb3a52af9486f65a50237dfc3984851997fc9d752cf5715fb541d8821bff74ed0f3113c8b5276bf72
-
C:\Users\Admin\AppData\Roaming\dahgarq\apineshpp.exeMD5
cc904eb37f5b7045892d29350c8022ce
SHA191a718ea5544056e870ff49e7759d1b3b5818cea
SHA2568e41b7dbc4efb96ccd077635859088866c629a1f131364bb64de2bf72b852723
SHA51216e64de75fd6bb4d908a1208f17fb47fc94c86b6ac3f207cb3a52af9486f65a50237dfc3984851997fc9d752cf5715fb541d8821bff74ed0f3113c8b5276bf72
-
memory/196-127-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/196-138-0x0000000007110000-0x0000000007111000-memory.dmpFilesize
4KB
-
memory/196-128-0x00000000024C0000-0x00000000024C1000-memory.dmpFilesize
4KB
-
memory/196-119-0x0000000002140000-0x000000000215B000-memory.dmpFilesize
108KB
-
memory/196-120-0x00000000049C0000-0x00000000049C1000-memory.dmpFilesize
4KB
-
memory/196-121-0x0000000004EC0000-0x0000000004EDA000-memory.dmpFilesize
104KB
-
memory/196-122-0x0000000004EE0000-0x0000000004EE1000-memory.dmpFilesize
4KB
-
memory/196-123-0x0000000005580000-0x0000000005581000-memory.dmpFilesize
4KB
-
memory/196-124-0x00000000055A0000-0x00000000055A1000-memory.dmpFilesize
4KB
-
memory/196-126-0x0000000001F50000-0x0000000001F7F000-memory.dmpFilesize
188KB
-
memory/196-137-0x0000000007140000-0x0000000007141000-memory.dmpFilesize
4KB
-
memory/196-116-0x0000000000000000-mapping.dmp
-
memory/196-125-0x0000000005600000-0x0000000005601000-memory.dmpFilesize
4KB
-
memory/196-129-0x00000000024C2000-0x00000000024C3000-memory.dmpFilesize
4KB
-
memory/196-130-0x00000000024C3000-0x00000000024C4000-memory.dmpFilesize
4KB
-
memory/196-131-0x00000000024C4000-0x00000000024C6000-memory.dmpFilesize
8KB
-
memory/196-132-0x0000000005790000-0x0000000005791000-memory.dmpFilesize
4KB
-
memory/196-133-0x0000000006470000-0x0000000006471000-memory.dmpFilesize
4KB
-
memory/196-134-0x0000000006640000-0x0000000006641000-memory.dmpFilesize
4KB
-
memory/196-135-0x0000000006C90000-0x0000000006C91000-memory.dmpFilesize
4KB
-
memory/196-136-0x0000000006FF0000-0x0000000006FF1000-memory.dmpFilesize
4KB
-
memory/808-115-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB
-
memory/808-114-0x0000000002280000-0x000000000234C000-memory.dmpFilesize
816KB