Analysis
-
max time kernel
24s -
max time network
123s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
27-07-2021 16:17
Static task
static1
Behavioral task
behavioral1
Sample
111f54264510164719eeb43b56d385d9.exe
Resource
win7v20210408
General
-
Target
111f54264510164719eeb43b56d385d9.exe
-
Size
689KB
-
MD5
111f54264510164719eeb43b56d385d9
-
SHA1
47f300489c9198cfdaf5dbc6fea4050610566f8e
-
SHA256
fc4cc2a7d217e04b0b3406cf3b62b7f16dcee104cf5a05497092d2d93d858509
-
SHA512
e7e3e03197bc07b00be86906dd0e59e7e167f9eff6c955c1db236e04cc3659315b1a97fc191e2f70d541c8d4ea08ff4a84c83e0117419d848357e46e906c3b1d
Malware Config
Extracted
redline
MIX 27.07
185.215.113.17:18597
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3432-121-0x00000000021E0000-0x00000000021FB000-memory.dmp family_redline behavioral2/memory/3432-123-0x00000000022F0000-0x000000000230A000-memory.dmp family_redline -
suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
apineshpp.exepid process 3432 apineshpp.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
111f54264510164719eeb43b56d385d9.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 111f54264510164719eeb43b56d385d9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 111f54264510164719eeb43b56d385d9.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
apineshpp.exepid process 3432 apineshpp.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
apineshpp.exedescription pid process Token: SeDebugPrivilege 3432 apineshpp.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
111f54264510164719eeb43b56d385d9.exedescription pid process target process PID 3492 wrote to memory of 3432 3492 111f54264510164719eeb43b56d385d9.exe apineshpp.exe PID 3492 wrote to memory of 3432 3492 111f54264510164719eeb43b56d385d9.exe apineshpp.exe PID 3492 wrote to memory of 3432 3492 111f54264510164719eeb43b56d385d9.exe apineshpp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\111f54264510164719eeb43b56d385d9.exe"C:\Users\Admin\AppData\Local\Temp\111f54264510164719eeb43b56d385d9.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\dahgarq\apineshpp.exeapineshpp.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\dahgarq\apineshpp.exeMD5
cc904eb37f5b7045892d29350c8022ce
SHA191a718ea5544056e870ff49e7759d1b3b5818cea
SHA2568e41b7dbc4efb96ccd077635859088866c629a1f131364bb64de2bf72b852723
SHA51216e64de75fd6bb4d908a1208f17fb47fc94c86b6ac3f207cb3a52af9486f65a50237dfc3984851997fc9d752cf5715fb541d8821bff74ed0f3113c8b5276bf72
-
C:\Users\Admin\AppData\Roaming\dahgarq\apineshpp.exeMD5
cc904eb37f5b7045892d29350c8022ce
SHA191a718ea5544056e870ff49e7759d1b3b5818cea
SHA2568e41b7dbc4efb96ccd077635859088866c629a1f131364bb64de2bf72b852723
SHA51216e64de75fd6bb4d908a1208f17fb47fc94c86b6ac3f207cb3a52af9486f65a50237dfc3984851997fc9d752cf5715fb541d8821bff74ed0f3113c8b5276bf72
-
memory/3432-125-0x0000000004D30000-0x0000000004D31000-memory.dmpFilesize
4KB
-
memory/3432-138-0x0000000007500000-0x0000000007501000-memory.dmpFilesize
4KB
-
memory/3432-127-0x0000000004D33000-0x0000000004D34000-memory.dmpFilesize
4KB
-
memory/3432-120-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3432-119-0x0000000001F60000-0x0000000001F8F000-memory.dmpFilesize
188KB
-
memory/3432-121-0x00000000021E0000-0x00000000021FB000-memory.dmpFilesize
108KB
-
memory/3432-122-0x0000000004D40000-0x0000000004D41000-memory.dmpFilesize
4KB
-
memory/3432-123-0x00000000022F0000-0x000000000230A000-memory.dmpFilesize
104KB
-
memory/3432-124-0x0000000005850000-0x0000000005851000-memory.dmpFilesize
4KB
-
memory/3432-128-0x0000000002750000-0x0000000002751000-memory.dmpFilesize
4KB
-
memory/3432-137-0x0000000007300000-0x0000000007301000-memory.dmpFilesize
4KB
-
memory/3432-116-0x0000000000000000-mapping.dmp
-
memory/3432-126-0x0000000004D32000-0x0000000004D33000-memory.dmpFilesize
4KB
-
memory/3432-129-0x0000000002770000-0x0000000002771000-memory.dmpFilesize
4KB
-
memory/3432-130-0x0000000004C30000-0x0000000004C31000-memory.dmpFilesize
4KB
-
memory/3432-131-0x0000000004D34000-0x0000000004D36000-memory.dmpFilesize
8KB
-
memory/3432-132-0x00000000052C0000-0x00000000052C1000-memory.dmpFilesize
4KB
-
memory/3432-133-0x00000000065B0000-0x00000000065B1000-memory.dmpFilesize
4KB
-
memory/3432-134-0x0000000006780000-0x0000000006781000-memory.dmpFilesize
4KB
-
memory/3432-135-0x0000000006DE0000-0x0000000006DE1000-memory.dmpFilesize
4KB
-
memory/3432-136-0x0000000007280000-0x0000000007281000-memory.dmpFilesize
4KB
-
memory/3492-115-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB
-
memory/3492-114-0x0000000002110000-0x00000000021DC000-memory.dmpFilesize
816KB