redline | 3f3a020f63daef5ffa7c2eb9014452dfa913cc6ff977e5747e6f0c854d849358

General

Target

Fri05a277b9a3d2.exe
Size

383KB
MD5

8958066e38eb4b70f922db2c23457c18
SHA1

27aff4aed5d4c782e9170ba124a3a1f90d979e6a
SHA256

3f3a020f63daef5ffa7c2eb9014452dfa913cc6ff977e5747e6f0c854d849358
SHA512

c2b73802a4b3350290d40bf2aa3942d92239eea4f69ab13fcce84090093e13d7950e3c32d565880a9ec74b8898cb82bb63e04a53505d9ef5f3aea812f8a68236

Score

10^/10

redline media21 infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

media21

C2

91.121.67.60:23325

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral7/memory/1212-121-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral7/memory/1212-122-0x0000000000418532-mapping.dmp	family_redline

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Drops file in System32 directory 4 IoCs

Processes:

OfficeC2RClient.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	OfficeC2RClient.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db	OfficeC2RClient.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db-wal	OfficeC2RClient.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db-shm	OfficeC2RClient.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Fri05a277b9a3d2.exe

description pid process target process

PID 2800 set thread context of 1212 2800 Fri05a277b9a3d2.exe Fri05a277b9a3d2.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2520 1212 WerFault.exe Fri05a277b9a3d2.exe

description	pid	process	target process
PID 2800 set thread context of 1212	2800	Fri05a277b9a3d2.exe	Fri05a277b9a3d2.exe

pid	pid_target	process	target process
2520	1212	WerFault.exe	Fri05a277b9a3d2.exe

Modifies data under HKEY_USERS 30 IoCs

Processes:

OfficeC2RClient.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property	OfficeC2RClient.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}\DeviceId = "0018C00372A10EBC"	OfficeC2RClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}\ApplicationFlags = "1"	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeC2RClient.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,17110988,7153487,39965824,17962391,17962392,3702920,3462423,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData	OfficeC2RClient.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun	OfficeC2RClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2"	OfficeC2RClient.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe\ULSMonitor	OfficeC2RClient.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,941 10,1329 15,941 15,941 6,1329 100,1329 6"	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry\Volatile	OfficeC2RClient.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry\Volatile\MsaDevice = "t=GwAWAbuEBAAUTtlZ6S5DAUSlRrmXzKeUMjH15hsOZgAAEGaGXkKdgxrsMb+s2i+UzTbgAINLOXzAvQgfsj1JvjSp73K1oGTf6lyViy3le5tBR2yOwm0wXH4vz6qUubl0fOhxpernY8vIOv3oR35kwUnlxft+aj5mlZhWKQa4Vwl06SSO53qB7GG7X+MW7ffaj0LmUV4OUrqh7o6LtZ2V98CsxBg44nofV4ez3OnwPlWcJUC4v6a2ZDfCw/NeE+aOYj9c9On161/bDCwP7F3PzjF7zdEC47b7Kv6gnsZiURqkUdF1oXsG1qtLckozd3ZbwDn22haZS/SQgcOTZC0TBApBMfLVrgy58AarC7c6oTBO3VV5GwE=&p="	OfficeC2RClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1"	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe\ULSMonitor	OfficeC2RClient.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property\0018C00372A10EBC = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000635dc147c9921f41a7655578079672e00000000002000000000010660000000100002000000037731f7af1515dc05bf41accde461a604c510ad192a5559e56ae9dbadf17d969000000000e8000000002000020000000e7b29d003a2888641e39aa370553188d4446d123e3a05c2f377d5508458a4090800000005b51a901af512fa75d91b32480804eeb6af0271a116e7a559b9c6e7e965050c983d18f8808f24777012038f7420e6cf5413533e5ab122972a9d2d81a89e3fe3117911e5a470a888c0f0550020821c70c3d5c034e7e84ad639722f83400b5c46e0f05e2ff3ea600173b5c84602a28135239935b430091dd3961da0370d4bbfd2b400000008c6697b763e95bc9737fd3edc3d4efb89f239fbd9ecf9d5eb2c8c4286f0d8aff24ff9e692dba91f690bed9863b6592ad59f38ef7afbeab2816d458db93457fa6	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeC2RClient.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000635dc147c9921f41a7655578079672e0000000000200000000001066000000010000200000004e683347243b293fb62d60866b62257efd5701d8ea8ee76236bcc28647a10d92000000000e8000000002000020000000545f99cd667563eaf737193f3178364bf1e4fe43c2d9232d1e657368d2f9c090f0030000dbecc7f6807165501ef275a0da279c686565653f58194be6aeb05e94fe1fdfc5c8856360b807ec5e59a5f5bcc8b8beeb8c1329fecbbd8c1bbca10d4235eb41071378881baf7299b752885e16c20059911a0d745791a3c8c12c886cee096a3f97d9453b7b2b9abf216c25a309b09fa4b9919c53dad770366c0418086d6a691ef8620cfe5644ee2d6d1e8e1662f3c16f50b89a841cb7a5f80de2e9ca6059137f248228a9fa4ad34c73ee6a57d4572b4b1f1cb5d375ef7056def2a408da66a77a37b30c14fab581fb7f98d81404a2213cbcd6fe09aae7c8387bf10f07208ba9b4dc8b72c324cf05d8ab794069292ab6c5bb739f4965d1907f23215980e565ba4a6d9f52ecd5e077b420b9ff326aa5609bb6223545930d423438899235eb229dfd38f6a5740615811c8df04f6c7c3aed0272e7cda308e33f0dbccf58402e905a04af61dc492c19c0018531dd159ccac378ed66d426a5bc002321fbfa2e1e4cb48b745864fe8c5617d88faeca1cece60ffe350cbf537d9bf7720bd628f72923b23b7803dd9c4432d29480125e2e21af058df04f7e495cc31d1d6557798f72d6d4b4e697b3e20cc26f7986380ccbb6d290d697a9fa064c6059a0c63821e42dc0bfa5a5fbfa125e5b7f499ee2d7f48caf917da7acb6b6e22eb9cb4a5f044416805924e0966e74247db147a972e8e1071ce1acaf327a584f61d166663d93bb9c5220936149bc73d8860a0c79cb3bfbe7e063cad24b81ddfa2eecf21afd5ff541c91af4260778d460d7c9797de93e2f425d110d32cd01820098f4cde924b81b60755cf7542e0a304c308cd3555c84f07f908a3a468d55f966b34929950020340e317d235dc3a35670d29bfd0022afe0a18ec5d6e5ad814481e296add1b67e9f7046e2ef1405cc76db3059780463a2c134ac52998fe24b7d6d6f7d7c3b849d0dc6191507cf970b6bfabd86095c6b9b37d05e1d34eab1b8483fc7a6f51e5f3f198639cf86f0504e77240a03fcd786025fc9e3477bef8905bc7cf18a46b58b775392c3c2f62786166cb5fe491798828ec4933a1313428fd981eee300dc55f46727daf09f0a9a62bd6a3d47b0513de6a974ba3d3a282c9022f2fced87604eec57c9cc06ff8a5bb962c24fd41fadf4f89095b5e2c49fcba57ff4a93baeb82e802079492eb95bdd6e98e015df5f9d403e741f988f0463f3cb1a306d4fdc9a44802e671bfc50d71786e015fb150455c2a0fee21895727e1b60eb106e0a5a59ed87a6ba401494251ddead42660e40fa381c0ce2357215bcfe7fcbc704c0b6f8caf947e8fe6b5e879432e549679b80619bc1d26f71c5c49bef2616a572efe4313dc3e23c00e2aa370360e800f939d07be855fab29d89d7431d2d184564db5684413ffc51d4e27dcad87c2704735329f83493df94671116275440000000ad11e72e878c92c85397a5a7d6814a4bc7b807f0c00fab8939d54ec0e4c6c174261f6408931f979c758855e66e2a6bfaa621f2777de72dba5f75cd259beae61d	OfficeC2RClient.exe

Modifies registry class 44 IoCs

Processes:

FileSyncConfig.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	FileSyncConfig.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_CLASSES\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DEFAULTICON	FileSyncConfig.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_CLASSES\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\INSTANCE\INITPROPERTYBAG	FileSyncConfig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\CLSID = "{0E5AAE11-A475-4c5b-AB00-C66DE400274E}"	FileSyncConfig.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag	FileSyncConfig.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_CLASSES\WOW6432NODE\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SHELLFOLDER	FileSyncConfig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32\ = "%systemroot%\\system32\\shell32.dll"	FileSyncConfig.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIcon	FileSyncConfig.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SortOrderIndex = "66"	FileSyncConfig.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\Attributes = "17"	FileSyncConfig.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder	FileSyncConfig.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder\FolderValueFlags = "40"	FileSyncConfig.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_CLASSES\WOW6432NODE\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\INPROCSERVER32	FileSyncConfig.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}	FileSyncConfig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ = "OneDrive"	FileSyncConfig.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag	FileSyncConfig.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}	FileSyncConfig.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder	FileSyncConfig.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	FileSyncConfig.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_CLASSES\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\INPROCSERVER32	FileSyncConfig.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32	FileSyncConfig.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	FileSyncConfig.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\System.IsPinnedToNameSpaceTree = "1"	FileSyncConfig.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SortOrderIndex = "66"	FileSyncConfig.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_CLASSES\WOW6432NODE\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DEFAULTICON	FileSyncConfig.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_CLASSES\WOW6432NODE\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\INSTANCE\INITPROPERTYBAG	FileSyncConfig.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}	FileSyncConfig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\TargetKnownFolder = "{a52bba46-e9e1-435f-b3d9-28daa648c0f6}"	FileSyncConfig.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\Attributes = "17"	FileSyncConfig.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder\FolderValueFlags = "40"	FileSyncConfig.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_CLASSES\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SHELLFOLDER	FileSyncConfig.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\System.IsPinnedToNameSpaceTree = "1"	FileSyncConfig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32\ = "%systemroot%\\SysWow64\\shell32.dll"	FileSyncConfig.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder\Attributes = "4034920525"	FileSyncConfig.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}	FileSyncConfig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ = "OneDrive"	FileSyncConfig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe,0"	FileSyncConfig.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder\Attributes = "4034920525"	FileSyncConfig.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32	FileSyncConfig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\CLSID = "{0E5AAE11-A475-4c5b-AB00-C66DE400274E}"	FileSyncConfig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\TargetKnownFolder = "{a52bba46-e9e1-435f-b3d9-28daa648c0f6}"	FileSyncConfig.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	FileSyncConfig.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIcon	FileSyncConfig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe,0"	FileSyncConfig.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OfficeC2RClient.exe

pid process

1848 OfficeC2RClient.exe

pid	process
1848	OfficeC2RClient.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Fri05a277b9a3d2.exe

description	pid	process	target process
PID 2800 wrote to memory of 1212	2800	Fri05a277b9a3d2.exe	Fri05a277b9a3d2.exe
PID 2800 wrote to memory of 1212	2800	Fri05a277b9a3d2.exe	Fri05a277b9a3d2.exe
PID 2800 wrote to memory of 1212	2800	Fri05a277b9a3d2.exe	Fri05a277b9a3d2.exe
PID 2800 wrote to memory of 1212	2800	Fri05a277b9a3d2.exe	Fri05a277b9a3d2.exe
PID 2800 wrote to memory of 1212	2800	Fri05a277b9a3d2.exe	Fri05a277b9a3d2.exe
PID 2800 wrote to memory of 1212	2800	Fri05a277b9a3d2.exe	Fri05a277b9a3d2.exe
PID 2800 wrote to memory of 1212	2800	Fri05a277b9a3d2.exe	Fri05a277b9a3d2.exe
PID 2800 wrote to memory of 1212	2800	Fri05a277b9a3d2.exe	Fri05a277b9a3d2.exe

C:\Users\Admin\AppData\Local\Temp\Fri05a277b9a3d2.exe
"C:\Users\Admin\AppData\Local\Temp\Fri05a277b9a3d2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2800

C:\Users\Admin\AppData\Local\Temp\Fri05a277b9a3d2.exe
C:\Users\Admin\AppData\Local\Temp\Fri05a277b9a3d2.exe
2⤵
PID:1212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 24
3⤵
- Program crash
PID:2520

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.196.0921.0007\FileSyncConfig.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.196.0921.0007\FileSyncConfig.exe"
1⤵
- Modifies registry class
PID:512

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylevel=False
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1848

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1212-121-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1212-122-0x0000000000418532-mapping.dmp

Download
memory/2800-115-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2800-117-0x0000000004D60000-0x0000000004D61000-memory.dmp

Filesize
4KB

Download
memory/2800-118-0x0000000004D00000-0x0000000004D01000-memory.dmp

Filesize
4KB

Download
memory/2800-119-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

Filesize
4KB

Download
memory/2800-120-0x00000000054B0000-0x00000000054B1000-memory.dmp

Filesize
4KB

Download
memory/2800-123-0x00000000059B0000-0x00000000059B1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads