Analysis
-
max time kernel
118s -
max time network
126s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
19-10-2021 13:35
Static task
static1
Behavioral task
behavioral1
Sample
e770761477d224bb737862944b9a933f.exe
Resource
win7-en-20210920
General
-
Target
e770761477d224bb737862944b9a933f.exe
-
Size
658KB
-
MD5
e770761477d224bb737862944b9a933f
-
SHA1
f2fe97e649e235430bb3f1862dad6da7d0377ca7
-
SHA256
881df3054f29b28ef9fb5342b18591a295aefb3d7c2fe1d0f6272b10819e1f8b
-
SHA512
5b151c18fb4edd9d8ea269ba60440267d19c997c3711db93459758c9fbc4cfe48735545a6c333c22b0a2daca4c9b0ac4ed64725cdc0057e6a186ac7b042509a3
Malware Config
Extracted
redline
mix19.10
185.215.113.15:57055
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/424-124-0x0000000004AD0000-0x0000000004AEF000-memory.dmp family_redline behavioral2/memory/424-126-0x0000000007940000-0x000000000795D000-memory.dmp family_redline -
suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger
suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
mopnns.exepid process 424 mopnns.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
e770761477d224bb737862944b9a933f.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 e770761477d224bb737862944b9a933f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString e770761477d224bb737862944b9a933f.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
mopnns.exepid process 424 mopnns.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
mopnns.exedescription pid process Token: SeDebugPrivilege 424 mopnns.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
e770761477d224bb737862944b9a933f.exedescription pid process target process PID 2632 wrote to memory of 424 2632 e770761477d224bb737862944b9a933f.exe mopnns.exe PID 2632 wrote to memory of 424 2632 e770761477d224bb737862944b9a933f.exe mopnns.exe PID 2632 wrote to memory of 424 2632 e770761477d224bb737862944b9a933f.exe mopnns.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e770761477d224bb737862944b9a933f.exe"C:\Users\Admin\AppData\Local\Temp\e770761477d224bb737862944b9a933f.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Roaming\wowsfree\mopnns.exemopnns.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:424
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\wowsfree\mopnns.exeMD5
f75dbcb091e82f8f4a4ed66fdb0578d1
SHA1f7e666941c03decf5fda3fcb302c24e837c1e816
SHA25690c625663d0140d183420da24b3cd35d32671434e3773eb1c6061a3a4f61e702
SHA512ee1f8e1942d7ee645ebd6d4acab0afe088dd34becca2a363ba966a7e1b820b55886e6a80143a80d3226f57dd859c919c79d8a2d8a270bec4bd657341af628683
-
C:\Users\Admin\AppData\Roaming\wowsfree\mopnns.exeMD5
f75dbcb091e82f8f4a4ed66fdb0578d1
SHA1f7e666941c03decf5fda3fcb302c24e837c1e816
SHA25690c625663d0140d183420da24b3cd35d32671434e3773eb1c6061a3a4f61e702
SHA512ee1f8e1942d7ee645ebd6d4acab0afe088dd34becca2a363ba966a7e1b820b55886e6a80143a80d3226f57dd859c919c79d8a2d8a270bec4bd657341af628683
-
memory/424-128-0x0000000004BA2000-0x0000000004BA3000-memory.dmpFilesize
4KB
-
memory/424-121-0x0000000002FF7000-0x000000000301A000-memory.dmpFilesize
140KB
-
memory/424-129-0x0000000004BA3000-0x0000000004BA4000-memory.dmpFilesize
4KB
-
memory/424-141-0x0000000009770000-0x0000000009771000-memory.dmpFilesize
4KB
-
memory/424-130-0x0000000007960000-0x0000000007961000-memory.dmpFilesize
4KB
-
memory/424-122-0x0000000004990000-0x00000000049C0000-memory.dmpFilesize
192KB
-
memory/424-123-0x0000000000400000-0x0000000002DB7000-memory.dmpFilesize
41.7MB
-
memory/424-131-0x0000000007FF0000-0x0000000007FF1000-memory.dmpFilesize
4KB
-
memory/424-125-0x0000000007440000-0x0000000007441000-memory.dmpFilesize
4KB
-
memory/424-126-0x0000000007940000-0x000000000795D000-memory.dmpFilesize
116KB
-
memory/424-140-0x00000000095B0000-0x00000000095B1000-memory.dmpFilesize
4KB
-
memory/424-127-0x0000000004BA0000-0x0000000004BA1000-memory.dmpFilesize
4KB
-
memory/424-139-0x00000000093A0000-0x00000000093A1000-memory.dmpFilesize
4KB
-
memory/424-118-0x0000000000000000-mapping.dmp
-
memory/424-124-0x0000000004AD0000-0x0000000004AEF000-memory.dmpFilesize
124KB
-
memory/424-132-0x0000000008020000-0x0000000008021000-memory.dmpFilesize
4KB
-
memory/424-133-0x0000000004BA4000-0x0000000004BA6000-memory.dmpFilesize
8KB
-
memory/424-134-0x0000000008130000-0x0000000008131000-memory.dmpFilesize
4KB
-
memory/424-135-0x00000000081B0000-0x00000000081B1000-memory.dmpFilesize
4KB
-
memory/424-136-0x0000000008DD0000-0x0000000008DD1000-memory.dmpFilesize
4KB
-
memory/424-137-0x0000000008FA0000-0x0000000008FA1000-memory.dmpFilesize
4KB
-
memory/424-138-0x0000000009320000-0x0000000009321000-memory.dmpFilesize
4KB
-
memory/2632-117-0x0000000000400000-0x0000000002F6C000-memory.dmpFilesize
43.4MB
-
memory/2632-115-0x00000000030DE000-0x000000000314A000-memory.dmpFilesize
432KB
-
memory/2632-116-0x0000000004CB0000-0x0000000004D7F000-memory.dmpFilesize
828KB