Analysis

  • max time kernel
    129s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    15-04-2022 13:23

General

  • Target

    0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe

  • Size

    392KB

  • MD5

    5fea51478a01f10a78d428751e973aba

  • SHA1

    cb7f1e3acc3636a6f890edb8c44d0abe2674ec1c

  • SHA256

    0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b

  • SHA512

    47ea5c07b4d9d2bd5f9045906da94961f9d7d64e55c992435bdae2d21334daed98f096892da46f2bd18637f48ecac6bc80d6531c5a1cacceb7f3a46182e103c6

Malware Config

Extracted

Family

arkei

Botnet

Default

C2

http://62.204.41.69/p8jG9WvgbE.php

Extracted

Family

redline

Botnet

04062022

C2

62.204.41.166:27688

Attributes
  • auth_value

    48182fe753fa2aff7472da064aa2a5d9

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Meta Stealer Stealer

    Meta Stealer steals passwords stored in browsers, written in C++.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 5 IoCs
  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe
    "C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4356
    • C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe
      "C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2300
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
        3⤵
          PID:756
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
          3⤵
          • Checks computer location settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1176
          • C:\Users\Admin\AppData\Local\Temp\kaxfcfdds.exe
            "C:\Users\Admin\AppData\Local\Temp\kaxfcfdds.exe"
            4⤵
            • Executes dropped EXE
            • Checks computer location settings
            • Adds Run key to start application
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4260
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAJwAsACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABZAHIAcgBlAHQAdwBvAGgAeABcAFEAcgBlAHEAcAAuAGUAeABlACcA
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1372
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
              5⤵
                PID:3784
            • C:\Users\Admin\AppData\Local\Temp\kaxfds.exe
              "C:\Users\Admin\AppData\Local\Temp\kaxfds.exe"
              4⤵
              • Executes dropped EXE
              • Checks computer location settings
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:3596
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                5⤵
                  PID:4516
          • C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe
            "C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe"
            2⤵
            • Checks computer location settings
            • Loads dropped DLL
            • Checks processor information in registry
            • Suspicious use of WriteProcessMemory
            PID:2980
            • C:\Users\Admin\AppData\Roaming\azne.exe
              "C:\Users\Admin\AppData\Roaming\azne.exe"
              3⤵
              • Executes dropped EXE
              • Checks computer location settings
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2624
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                4⤵
                  PID:772
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                  4⤵
                    PID:1200
                • C:\Users\Admin\AppData\Roaming\pm.exe
                  "C:\Users\Admin\AppData\Roaming\pm.exe"
                  3⤵
                  • Executes dropped EXE
                  • Checks computer location settings
                  • Adds Run key to start application
                  • Suspicious use of SetThreadContext
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:3224
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAJwAsACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABZAHIAcgBlAHQAdwBvAGgAeABcAFEAcgBlAHEAcAAuAGUAeABlACcA
                    4⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4304
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
                    4⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5028
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe" & exit
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1320
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout /t 5
                    4⤵
                    • Delays execution with timeout.exe
                    PID:1272

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\ProgramData\mozglue.dll

              Filesize

              133KB

              MD5

              8f73c08a9660691143661bf7332c3c27

              SHA1

              37fa65dd737c50fda710fdbde89e51374d0c204a

              SHA256

              3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

              SHA512

              0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

            • C:\ProgramData\nss3.dll

              Filesize

              1.2MB

              MD5

              bfac4e3c5908856ba17d41edcd455a51

              SHA1

              8eec7e888767aa9e4cca8ff246eb2aacb9170428

              SHA256

              e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

              SHA512

              2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              944B

              MD5

              bd5940f08d0be56e65e5f2aaf47c538e

              SHA1

              d7e31b87866e5e383ab5499da64aba50f03e8443

              SHA256

              2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

              SHA512

              c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

            • C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe

              Filesize

              172KB

              MD5

              e124d6fab64aa638922bc7861998fa8c

              SHA1

              3420d895a8ef834eaf85c800fb83b1eca0a7816e

              SHA256

              de8f8f5217cc3fca88d5261c8ad2c3115750ccf4f7bf3e7904760af2014959e3

              SHA512

              b456215751eeda2f5b633cd52b5b5d820d1dc96d9ec4f4f35fa4fa1c5859dd925c949f0f6270af80a12ede9f9ac45f4a979aea7f8d4da459ed05cd1b7bdd5ed7

            • C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe

              Filesize

              172KB

              MD5

              e124d6fab64aa638922bc7861998fa8c

              SHA1

              3420d895a8ef834eaf85c800fb83b1eca0a7816e

              SHA256

              de8f8f5217cc3fca88d5261c8ad2c3115750ccf4f7bf3e7904760af2014959e3

              SHA512

              b456215751eeda2f5b633cd52b5b5d820d1dc96d9ec4f4f35fa4fa1c5859dd925c949f0f6270af80a12ede9f9ac45f4a979aea7f8d4da459ed05cd1b7bdd5ed7

            • C:\Users\Admin\AppData\Local\Temp\kaxfcfdds.exe

              Filesize

              295KB

              MD5

              51a6e667c3c59d0e4a2fb644a284ead4

              SHA1

              f2f6646aa2a70ae1520728c376d6048e5a8bf7ef

              SHA256

              40e3f0d6fc66f3881a716191aa965e1b4bceceb357d98f63254e4cb6db00c7c5

              SHA512

              36d2c78ba57322d26a22059daa92f5255ffcb9fd3695a1300898f3fd42ff4ed2cdd51f014410de372e5dbad86f2227f6002084282f93b6b1248e3da420c76b37

            • C:\Users\Admin\AppData\Local\Temp\kaxfcfdds.exe

              Filesize

              295KB

              MD5

              51a6e667c3c59d0e4a2fb644a284ead4

              SHA1

              f2f6646aa2a70ae1520728c376d6048e5a8bf7ef

              SHA256

              40e3f0d6fc66f3881a716191aa965e1b4bceceb357d98f63254e4cb6db00c7c5

              SHA512

              36d2c78ba57322d26a22059daa92f5255ffcb9fd3695a1300898f3fd42ff4ed2cdd51f014410de372e5dbad86f2227f6002084282f93b6b1248e3da420c76b37

            • C:\Users\Admin\AppData\Local\Temp\kaxfds.exe

              Filesize

              295KB

              MD5

              263950977bac605cb152d88be7b3115f

              SHA1

              c690bae8657278742c2ddf1144b1ecbbaaab7916

              SHA256

              479a6f9b920dc41930fbfb0dbe7bc6fb34724da607bbbe8775b7be7e3897c688

              SHA512

              aea4d8df7678330cbd033c5e302cd02c44699cad1e11bc12d01f47bcfc52bb49876dba7a5247dc36713f5bfd9fbe9e1548417a54391b6013e261e8e997e8a464

            • C:\Users\Admin\AppData\Local\Temp\kaxfds.exe

              Filesize

              295KB

              MD5

              263950977bac605cb152d88be7b3115f

              SHA1

              c690bae8657278742c2ddf1144b1ecbbaaab7916

              SHA256

              479a6f9b920dc41930fbfb0dbe7bc6fb34724da607bbbe8775b7be7e3897c688

              SHA512

              aea4d8df7678330cbd033c5e302cd02c44699cad1e11bc12d01f47bcfc52bb49876dba7a5247dc36713f5bfd9fbe9e1548417a54391b6013e261e8e997e8a464

            • C:\Users\Admin\AppData\Roaming\azne.exe

              Filesize

              295KB

              MD5

              263950977bac605cb152d88be7b3115f

              SHA1

              c690bae8657278742c2ddf1144b1ecbbaaab7916

              SHA256

              479a6f9b920dc41930fbfb0dbe7bc6fb34724da607bbbe8775b7be7e3897c688

              SHA512

              aea4d8df7678330cbd033c5e302cd02c44699cad1e11bc12d01f47bcfc52bb49876dba7a5247dc36713f5bfd9fbe9e1548417a54391b6013e261e8e997e8a464

            • C:\Users\Admin\AppData\Roaming\azne.exe

              Filesize

              295KB

              MD5

              263950977bac605cb152d88be7b3115f

              SHA1

              c690bae8657278742c2ddf1144b1ecbbaaab7916

              SHA256

              479a6f9b920dc41930fbfb0dbe7bc6fb34724da607bbbe8775b7be7e3897c688

              SHA512

              aea4d8df7678330cbd033c5e302cd02c44699cad1e11bc12d01f47bcfc52bb49876dba7a5247dc36713f5bfd9fbe9e1548417a54391b6013e261e8e997e8a464

            • C:\Users\Admin\AppData\Roaming\pm.exe

              Filesize

              295KB

              MD5

              51a6e667c3c59d0e4a2fb644a284ead4

              SHA1

              f2f6646aa2a70ae1520728c376d6048e5a8bf7ef

              SHA256

              40e3f0d6fc66f3881a716191aa965e1b4bceceb357d98f63254e4cb6db00c7c5

              SHA512

              36d2c78ba57322d26a22059daa92f5255ffcb9fd3695a1300898f3fd42ff4ed2cdd51f014410de372e5dbad86f2227f6002084282f93b6b1248e3da420c76b37

            • C:\Users\Admin\AppData\Roaming\pm.exe

              Filesize

              295KB

              MD5

              51a6e667c3c59d0e4a2fb644a284ead4

              SHA1

              f2f6646aa2a70ae1520728c376d6048e5a8bf7ef

              SHA256

              40e3f0d6fc66f3881a716191aa965e1b4bceceb357d98f63254e4cb6db00c7c5

              SHA512

              36d2c78ba57322d26a22059daa92f5255ffcb9fd3695a1300898f3fd42ff4ed2cdd51f014410de372e5dbad86f2227f6002084282f93b6b1248e3da420c76b37

            • memory/1176-142-0x0000000000400000-0x0000000000420000-memory.dmp

              Filesize

              128KB

            • memory/1176-187-0x0000000006410000-0x0000000006460000-memory.dmp

              Filesize

              320KB

            • memory/1176-143-0x00000000055B0000-0x0000000005BC8000-memory.dmp

              Filesize

              6.1MB

            • memory/1176-147-0x0000000005040000-0x000000000507C000-memory.dmp

              Filesize

              240KB

            • memory/1176-189-0x0000000007300000-0x000000000782C000-memory.dmp

              Filesize

              5.2MB

            • memory/1176-144-0x0000000004FE0000-0x0000000004FF2000-memory.dmp

              Filesize

              72KB

            • memory/1176-188-0x0000000006C00000-0x0000000006DC2000-memory.dmp

              Filesize

              1.8MB

            • memory/1176-145-0x0000000000400000-0x0000000000424000-memory.dmp

              Filesize

              144KB

            • memory/1176-146-0x0000000005110000-0x000000000521A000-memory.dmp

              Filesize

              1.0MB

            • memory/1176-186-0x0000000006120000-0x000000000613E000-memory.dmp

              Filesize

              120KB

            • memory/1176-185-0x0000000006010000-0x0000000006086000-memory.dmp

              Filesize

              472KB

            • memory/1176-184-0x0000000005370000-0x00000000053D6000-memory.dmp

              Filesize

              408KB

            • memory/1200-195-0x0000000000400000-0x0000000000420000-memory.dmp

              Filesize

              128KB

            • memory/1200-202-0x0000000000400000-0x0000000000420000-memory.dmp

              Filesize

              128KB

            • memory/1200-192-0x0000000000400000-0x0000000000420000-memory.dmp

              Filesize

              128KB

            • memory/1372-220-0x000001D32A6B0000-0x000001D32A6B2000-memory.dmp

              Filesize

              8KB

            • memory/1372-219-0x00007FFE09260000-0x00007FFE09D21000-memory.dmp

              Filesize

              10.8MB

            • memory/1372-223-0x000001D32A6B6000-0x000001D32A6B8000-memory.dmp

              Filesize

              8KB

            • memory/1372-221-0x000001D32A6B3000-0x000001D32A6B5000-memory.dmp

              Filesize

              8KB

            • memory/2624-172-0x00000000005A0000-0x00000000005F0000-memory.dmp

              Filesize

              320KB

            • memory/2624-181-0x0000000004F10000-0x0000000004F1A000-memory.dmp

              Filesize

              40KB

            • memory/2624-179-0x0000000004E70000-0x0000000004F02000-memory.dmp

              Filesize

              584KB

            • memory/2624-176-0x0000000005420000-0x00000000059C4000-memory.dmp

              Filesize

              5.6MB

            • memory/2980-141-0x0000000000400000-0x000000000043C000-memory.dmp

              Filesize

              240KB

            • memory/2980-148-0x0000000060900000-0x0000000060992000-memory.dmp

              Filesize

              584KB

            • memory/3224-183-0x000000001B700000-0x000000001B702000-memory.dmp

              Filesize

              8KB

            • memory/3224-201-0x000000001B706000-0x000000001B708000-memory.dmp

              Filesize

              8KB

            • memory/3224-200-0x000000001B702000-0x000000001B704000-memory.dmp

              Filesize

              8KB

            • memory/3224-178-0x0000000000A80000-0x0000000000AD0000-memory.dmp

              Filesize

              320KB

            • memory/3224-182-0x00007FFE09260000-0x00007FFE09D21000-memory.dmp

              Filesize

              10.8MB

            • memory/3784-233-0x000002B819310000-0x000002B819312000-memory.dmp

              Filesize

              8KB

            • memory/3784-227-0x00007FFE09260000-0x00007FFE09D21000-memory.dmp

              Filesize

              10.8MB

            • memory/4260-207-0x000000001C330000-0x000000001C332000-memory.dmp

              Filesize

              8KB

            • memory/4260-203-0x00007FFE09260000-0x00007FFE09D21000-memory.dmp

              Filesize

              10.8MB

            • memory/4260-217-0x000000001C332000-0x000000001C334000-memory.dmp

              Filesize

              8KB

            • memory/4260-218-0x000000001C336000-0x000000001C338000-memory.dmp

              Filesize

              8KB

            • memory/4304-206-0x000002CCC41F3000-0x000002CCC41F5000-memory.dmp

              Filesize

              8KB

            • memory/4304-199-0x000002CCC4100000-0x000002CCC4122000-memory.dmp

              Filesize

              136KB

            • memory/4304-205-0x000002CCC41F0000-0x000002CCC41F2000-memory.dmp

              Filesize

              8KB

            • memory/4304-204-0x00007FFE09260000-0x00007FFE09D21000-memory.dmp

              Filesize

              10.8MB

            • memory/4304-208-0x000002CCC41F6000-0x000002CCC41F8000-memory.dmp

              Filesize

              8KB

            • memory/4356-138-0x00000000034B0000-0x00000000034B7000-memory.dmp

              Filesize

              28KB

            • memory/4516-232-0x0000000000400000-0x0000000000420000-memory.dmp

              Filesize

              128KB

            • memory/5028-212-0x0000000140000000-0x000000014007A000-memory.dmp

              Filesize

              488KB

            • memory/5028-215-0x000002CDDEEB0000-0x000002CDDEEB2000-memory.dmp

              Filesize

              8KB

            • memory/5028-214-0x00007FFE09260000-0x00007FFE09D21000-memory.dmp

              Filesize

              10.8MB

            • memory/5028-234-0x000002CDDEEB2000-0x000002CDDEEB4000-memory.dmp

              Filesize

              8KB