Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
15-04-2022 13:23
Static task
static1
Behavioral task
behavioral1
Sample
fb368927d9051a0ed52610ad43849d1b0cdf2acee3bb1bf88c63e3fce54a4f0f.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
fb368927d9051a0ed52610ad43849d1b0cdf2acee3bb1bf88c63e3fce54a4f0f.exe
Resource
win10v2004-20220414-en
General
-
Target
fb368927d9051a0ed52610ad43849d1b0cdf2acee3bb1bf88c63e3fce54a4f0f.exe
-
Size
692KB
-
MD5
837547af8d2a1f60f8bbe09066f0ffa2
-
SHA1
727421a8ea79d0c0562870c33d055224c7c9a4bc
-
SHA256
fb368927d9051a0ed52610ad43849d1b0cdf2acee3bb1bf88c63e3fce54a4f0f
-
SHA512
579fe72723076eb6605660258caf1b8b2a2cf4f05c50f15c0a6a1d8226c13eb847ade0230e5bb1ba21c820e6b2ae0662b33725e65f7b43e0fb2f98c4e41d6961
Malware Config
Extracted
redline
04062022
62.204.41.166:27688
-
auth_value
48182fe753fa2aff7472da064aa2a5d9
Extracted
arkei
Default
http://62.204.41.69/p8jG9WvgbE.php
Extracted
azorult
http://195.245.112.115/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Meta Stealer Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
resource yara_rule behavioral2/memory/2000-140-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral2/memory/2000-141-0x0000000000400000-0x0000000000424000-memory.dmp family_redline -
suricata: ET MALWARE Base64 Encoded Stealer Config from Server - %APPDATA% M4
suricata: ET MALWARE Base64 Encoded Stealer Config from Server - %APPDATA% M4
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M15
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M15
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
pid Process 912 dcaqbmme.exe 3332 kaxfcfdds.exe 3452 kaxfds.exe -
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation fb368927d9051a0ed52610ad43849d1b0cdf2acee3bb1bf88c63e3fce54a4f0f.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation regasm.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation fb368927d9051a0ed52610ad43849d1b0cdf2acee3bb1bf88c63e3fce54a4f0f.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation kaxfds.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation kaxfcfdds.exe -
Loads dropped DLL 2 IoCs
pid Process 4192 fb368927d9051a0ed52610ad43849d1b0cdf2acee3bb1bf88c63e3fce54a4f0f.exe 4192 fb368927d9051a0ed52610ad43849d1b0cdf2acee3bb1bf88c63e3fce54a4f0f.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Qreqp = "\"C:\\Users\\Admin\\AppData\\Roaming\\Yrretwohx\\Qreqp.exe\"" kaxfcfdds.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 912 set thread context of 2000 912 dcaqbmme.exe 78 PID 3136 set thread context of 4192 3136 fb368927d9051a0ed52610ad43849d1b0cdf2acee3bb1bf88c63e3fce54a4f0f.exe 79 PID 3452 set thread context of 1868 3452 kaxfds.exe 86 PID 3332 set thread context of 1136 3332 kaxfcfdds.exe 89 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 fb368927d9051a0ed52610ad43849d1b0cdf2acee3bb1bf88c63e3fce54a4f0f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString fb368927d9051a0ed52610ad43849d1b0cdf2acee3bb1bf88c63e3fce54a4f0f.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 4836 timeout.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 2000 regasm.exe 3452 kaxfds.exe 3452 kaxfds.exe 240 powershell.exe 240 powershell.exe 3332 kaxfcfdds.exe 3332 kaxfcfdds.exe 1136 aspnet_compiler.exe 1136 aspnet_compiler.exe 1136 aspnet_compiler.exe 1136 aspnet_compiler.exe 1136 aspnet_compiler.exe 1136 aspnet_compiler.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 912 dcaqbmme.exe 3136 fb368927d9051a0ed52610ad43849d1b0cdf2acee3bb1bf88c63e3fce54a4f0f.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2000 regasm.exe Token: SeDebugPrivilege 3332 kaxfcfdds.exe Token: SeDebugPrivilege 3452 kaxfds.exe Token: SeDebugPrivilege 240 powershell.exe Token: SeDebugPrivilege 1136 aspnet_compiler.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3136 fb368927d9051a0ed52610ad43849d1b0cdf2acee3bb1bf88c63e3fce54a4f0f.exe 912 dcaqbmme.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 3136 wrote to memory of 912 3136 fb368927d9051a0ed52610ad43849d1b0cdf2acee3bb1bf88c63e3fce54a4f0f.exe 77 PID 3136 wrote to memory of 912 3136 fb368927d9051a0ed52610ad43849d1b0cdf2acee3bb1bf88c63e3fce54a4f0f.exe 77 PID 3136 wrote to memory of 912 3136 fb368927d9051a0ed52610ad43849d1b0cdf2acee3bb1bf88c63e3fce54a4f0f.exe 77 PID 912 wrote to memory of 2000 912 dcaqbmme.exe 78 PID 912 wrote to memory of 2000 912 dcaqbmme.exe 78 PID 912 wrote to memory of 2000 912 dcaqbmme.exe 78 PID 912 wrote to memory of 2000 912 dcaqbmme.exe 78 PID 3136 wrote to memory of 4192 3136 fb368927d9051a0ed52610ad43849d1b0cdf2acee3bb1bf88c63e3fce54a4f0f.exe 79 PID 3136 wrote to memory of 4192 3136 fb368927d9051a0ed52610ad43849d1b0cdf2acee3bb1bf88c63e3fce54a4f0f.exe 79 PID 3136 wrote to memory of 4192 3136 fb368927d9051a0ed52610ad43849d1b0cdf2acee3bb1bf88c63e3fce54a4f0f.exe 79 PID 3136 wrote to memory of 4192 3136 fb368927d9051a0ed52610ad43849d1b0cdf2acee3bb1bf88c63e3fce54a4f0f.exe 79 PID 2000 wrote to memory of 3332 2000 regasm.exe 81 PID 2000 wrote to memory of 3332 2000 regasm.exe 81 PID 2000 wrote to memory of 3452 2000 regasm.exe 82 PID 2000 wrote to memory of 3452 2000 regasm.exe 82 PID 2000 wrote to memory of 3452 2000 regasm.exe 82 PID 4192 wrote to memory of 2852 4192 fb368927d9051a0ed52610ad43849d1b0cdf2acee3bb1bf88c63e3fce54a4f0f.exe 83 PID 4192 wrote to memory of 2852 4192 fb368927d9051a0ed52610ad43849d1b0cdf2acee3bb1bf88c63e3fce54a4f0f.exe 83 PID 4192 wrote to memory of 2852 4192 fb368927d9051a0ed52610ad43849d1b0cdf2acee3bb1bf88c63e3fce54a4f0f.exe 83 PID 2852 wrote to memory of 4836 2852 cmd.exe 85 PID 2852 wrote to memory of 4836 2852 cmd.exe 85 PID 2852 wrote to memory of 4836 2852 cmd.exe 85 PID 3452 wrote to memory of 1868 3452 kaxfds.exe 86 PID 3452 wrote to memory of 1868 3452 kaxfds.exe 86 PID 3452 wrote to memory of 1868 3452 kaxfds.exe 86 PID 3452 wrote to memory of 1868 3452 kaxfds.exe 86 PID 3452 wrote to memory of 1868 3452 kaxfds.exe 86 PID 3452 wrote to memory of 1868 3452 kaxfds.exe 86 PID 3452 wrote to memory of 1868 3452 kaxfds.exe 86 PID 3452 wrote to memory of 1868 3452 kaxfds.exe 86 PID 3452 wrote to memory of 1868 3452 kaxfds.exe 86 PID 3332 wrote to memory of 240 3332 kaxfcfdds.exe 87 PID 3332 wrote to memory of 240 3332 kaxfcfdds.exe 87 PID 3332 wrote to memory of 1136 3332 kaxfcfdds.exe 89 PID 3332 wrote to memory of 1136 3332 kaxfcfdds.exe 89 PID 3332 wrote to memory of 1136 3332 kaxfcfdds.exe 89 PID 3332 wrote to memory of 1136 3332 kaxfcfdds.exe 89 PID 3332 wrote to memory of 1136 3332 kaxfcfdds.exe 89 PID 3332 wrote to memory of 1136 3332 kaxfcfdds.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb368927d9051a0ed52610ad43849d1b0cdf2acee3bb1bf88c63e3fce54a4f0f.exe"C:\Users\Admin\AppData\Local\Temp\fb368927d9051a0ed52610ad43849d1b0cdf2acee3bb1bf88c63e3fce54a4f0f.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\dcaqbmme.exe"C:\Users\Admin\AppData\Local\Temp\dcaqbmme.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\kaxfcfdds.exe"C:\Users\Admin\AppData\Local\Temp\kaxfcfdds.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAJwAsACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABZAHIAcgBlAHQAdwBvAGgAeABcAFEAcgBlAHEAcAAuAGUAeABlACcA5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:240
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1136
-
-
-
C:\Users\Admin\AppData\Local\Temp\kaxfds.exe"C:\Users\Admin\AppData\Local\Temp\kaxfds.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe5⤵PID:1868
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\fb368927d9051a0ed52610ad43849d1b0cdf2acee3bb1bf88c63e3fce54a4f0f.exe"C:\Users\Admin\AppData\Local\Temp\fb368927d9051a0ed52610ad43849d1b0cdf2acee3bb1bf88c63e3fce54a4f0f.exe"2⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\fb368927d9051a0ed52610ad43849d1b0cdf2acee3bb1bf88c63e3fce54a4f0f.exe" & exit3⤵
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\timeout.exetimeout /t 54⤵
- Delays execution with timeout.exe
PID:4836
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
133KB
MD58f73c08a9660691143661bf7332c3c27
SHA137fa65dd737c50fda710fdbde89e51374d0c204a
SHA2563fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
SHA5120042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89
-
Filesize
1.2MB
MD5bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
Filesize
324KB
MD52652215d4d7a57fc45691bb1d53fb6ce
SHA115838b55aa4b2dc05ca09b2b958056fcb17776bd
SHA256326923ce18fd7a9c8210697d8ffab62481db036588c12f05a21798fcf67bd9a6
SHA512f4694966c4beb4e9cca674b85311de400f7c9ebf7eb9e0e271074281447513d562757bb477a7884b02ba9cdc8caf9b3952afcc0e66b9a36c6c167aa5e731ca59
-
Filesize
324KB
MD52652215d4d7a57fc45691bb1d53fb6ce
SHA115838b55aa4b2dc05ca09b2b958056fcb17776bd
SHA256326923ce18fd7a9c8210697d8ffab62481db036588c12f05a21798fcf67bd9a6
SHA512f4694966c4beb4e9cca674b85311de400f7c9ebf7eb9e0e271074281447513d562757bb477a7884b02ba9cdc8caf9b3952afcc0e66b9a36c6c167aa5e731ca59
-
Filesize
295KB
MD551a6e667c3c59d0e4a2fb644a284ead4
SHA1f2f6646aa2a70ae1520728c376d6048e5a8bf7ef
SHA25640e3f0d6fc66f3881a716191aa965e1b4bceceb357d98f63254e4cb6db00c7c5
SHA51236d2c78ba57322d26a22059daa92f5255ffcb9fd3695a1300898f3fd42ff4ed2cdd51f014410de372e5dbad86f2227f6002084282f93b6b1248e3da420c76b37
-
Filesize
295KB
MD551a6e667c3c59d0e4a2fb644a284ead4
SHA1f2f6646aa2a70ae1520728c376d6048e5a8bf7ef
SHA25640e3f0d6fc66f3881a716191aa965e1b4bceceb357d98f63254e4cb6db00c7c5
SHA51236d2c78ba57322d26a22059daa92f5255ffcb9fd3695a1300898f3fd42ff4ed2cdd51f014410de372e5dbad86f2227f6002084282f93b6b1248e3da420c76b37
-
Filesize
295KB
MD5263950977bac605cb152d88be7b3115f
SHA1c690bae8657278742c2ddf1144b1ecbbaaab7916
SHA256479a6f9b920dc41930fbfb0dbe7bc6fb34724da607bbbe8775b7be7e3897c688
SHA512aea4d8df7678330cbd033c5e302cd02c44699cad1e11bc12d01f47bcfc52bb49876dba7a5247dc36713f5bfd9fbe9e1548417a54391b6013e261e8e997e8a464
-
Filesize
295KB
MD5263950977bac605cb152d88be7b3115f
SHA1c690bae8657278742c2ddf1144b1ecbbaaab7916
SHA256479a6f9b920dc41930fbfb0dbe7bc6fb34724da607bbbe8775b7be7e3897c688
SHA512aea4d8df7678330cbd033c5e302cd02c44699cad1e11bc12d01f47bcfc52bb49876dba7a5247dc36713f5bfd9fbe9e1548417a54391b6013e261e8e997e8a464