Analysis Overview
SHA256
0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b
Threat Level: Known bad
The file 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe was found to be: Known bad.
Malicious Activity Summary
RedLine
Arkei
RedLine Payload
Executes dropped EXE
Loads dropped DLL
Checks computer location settings
Suspicious use of SetThreadContext
Enumerates physical storage devices
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-04-20 13:28
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2022-04-20 13:28
Reported
2022-04-20 13:34
Platform
win7-20220414-en
Max time kernel
173s
Max time network
198s
Command Line
Signatures
Arkei
RedLine
RedLine Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1756 set thread context of 1356 | N/A | C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe | C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe |
| PID 1424 set thread context of 1268 | N/A | C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe |
Enumerates physical storage devices
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe
"C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe"
C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe
"C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe"
C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe
"C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
Network
| Country | Destination | Domain | Proto |
| US | 93.184.220.29:80 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| US | 93.184.220.29:80 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp |
Files
memory/1756-56-0x0000000075B61000-0x0000000075B63000-memory.dmp
\Users\Admin\AppData\Local\Temp\Fvdfggf.exe
| MD5 | e124d6fab64aa638922bc7861998fa8c |
| SHA1 | 3420d895a8ef834eaf85c800fb83b1eca0a7816e |
| SHA256 | de8f8f5217cc3fca88d5261c8ad2c3115750ccf4f7bf3e7904760af2014959e3 |
| SHA512 | b456215751eeda2f5b633cd52b5b5d820d1dc96d9ec4f4f35fa4fa1c5859dd925c949f0f6270af80a12ede9f9ac45f4a979aea7f8d4da459ed05cd1b7bdd5ed7 |
\Users\Admin\AppData\Local\Temp\Fvdfggf.exe
| MD5 | e124d6fab64aa638922bc7861998fa8c |
| SHA1 | 3420d895a8ef834eaf85c800fb83b1eca0a7816e |
| SHA256 | de8f8f5217cc3fca88d5261c8ad2c3115750ccf4f7bf3e7904760af2014959e3 |
| SHA512 | b456215751eeda2f5b633cd52b5b5d820d1dc96d9ec4f4f35fa4fa1c5859dd925c949f0f6270af80a12ede9f9ac45f4a979aea7f8d4da459ed05cd1b7bdd5ed7 |
memory/1424-59-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe
| MD5 | e124d6fab64aa638922bc7861998fa8c |
| SHA1 | 3420d895a8ef834eaf85c800fb83b1eca0a7816e |
| SHA256 | de8f8f5217cc3fca88d5261c8ad2c3115750ccf4f7bf3e7904760af2014959e3 |
| SHA512 | b456215751eeda2f5b633cd52b5b5d820d1dc96d9ec4f4f35fa4fa1c5859dd925c949f0f6270af80a12ede9f9ac45f4a979aea7f8d4da459ed05cd1b7bdd5ed7 |
memory/1356-62-0x0000000000408430-mapping.dmp
memory/1756-65-0x0000000000560000-0x0000000000567000-memory.dmp
memory/1356-66-0x0000000000400000-0x000000000043C000-memory.dmp
memory/1268-67-0x000000000041BC2E-mapping.dmp
memory/1268-69-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1268-70-0x0000000000400000-0x0000000000424000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2022-04-20 13:28
Reported
2022-04-20 13:34
Platform
win10v2004-20220414-en
Max time kernel
167s
Max time network
185s
Command Line
Signatures
Arkei
RedLine
RedLine Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2800 set thread context of 1776 | N/A | C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe |
| PID 4184 set thread context of 1764 | N/A | C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe | C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe |
Enumerates physical storage devices
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe
"C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe"
C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe
"C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe
"C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe"
Network
| Country | Destination | Domain | Proto |
| JP | 40.74.98.195:443 | tcp | |
| US | 209.197.3.8:80 | tcp | |
| US | 209.197.3.8:80 | tcp | |
| US | 209.197.3.8:80 | tcp | |
| US | 93.184.220.29:80 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp |
Files
memory/2800-132-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe
| MD5 | e124d6fab64aa638922bc7861998fa8c |
| SHA1 | 3420d895a8ef834eaf85c800fb83b1eca0a7816e |
| SHA256 | de8f8f5217cc3fca88d5261c8ad2c3115750ccf4f7bf3e7904760af2014959e3 |
| SHA512 | b456215751eeda2f5b633cd52b5b5d820d1dc96d9ec4f4f35fa4fa1c5859dd925c949f0f6270af80a12ede9f9ac45f4a979aea7f8d4da459ed05cd1b7bdd5ed7 |
C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe
| MD5 | e124d6fab64aa638922bc7861998fa8c |
| SHA1 | 3420d895a8ef834eaf85c800fb83b1eca0a7816e |
| SHA256 | de8f8f5217cc3fca88d5261c8ad2c3115750ccf4f7bf3e7904760af2014959e3 |
| SHA512 | b456215751eeda2f5b633cd52b5b5d820d1dc96d9ec4f4f35fa4fa1c5859dd925c949f0f6270af80a12ede9f9ac45f4a979aea7f8d4da459ed05cd1b7bdd5ed7 |
memory/1776-137-0x0000000000000000-mapping.dmp
memory/2800-138-0x0000000000500000-0x0000000000507000-memory.dmp
memory/1764-139-0x0000000000000000-mapping.dmp
memory/1776-140-0x0000000000400000-0x0000000000424000-memory.dmp
memory/1764-141-0x0000000000400000-0x000000000043C000-memory.dmp
memory/1776-142-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1776-143-0x0000000005AD0000-0x00000000060E8000-memory.dmp
memory/1776-144-0x0000000005570000-0x0000000005582000-memory.dmp
memory/1776-145-0x00000000056A0000-0x00000000057AA000-memory.dmp
memory/1776-146-0x00000000055D0000-0x000000000560C000-memory.dmp