Analysis Overview
SHA256
0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b
Threat Level: Known bad
The file 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe was found to be: Known bad.
Malicious Activity Summary
RedLine Payload
Arkei
RedLine
Executes dropped EXE
Loads dropped DLL
Checks computer location settings
Suspicious use of SetThreadContext
Enumerates physical storage devices
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-05-07 19:47
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2022-05-07 19:47
Reported
2022-05-07 19:55
Platform
win7-20220414-en
Max time kernel
150s
Max time network
160s
Command Line
Signatures
Arkei
RedLine
RedLine Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1468 set thread context of 1548 | N/A | C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe | C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe |
| PID 1744 set thread context of 1188 | N/A | C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe |
Enumerates physical storage devices
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe
"C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe"
C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe
"C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe"
C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe
"C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
Network
| Country | Destination | Domain | Proto |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp |
Files
memory/1468-56-0x00000000752D1000-0x00000000752D3000-memory.dmp
\Users\Admin\AppData\Local\Temp\Fvdfggf.exe
| MD5 | e124d6fab64aa638922bc7861998fa8c |
| SHA1 | 3420d895a8ef834eaf85c800fb83b1eca0a7816e |
| SHA256 | de8f8f5217cc3fca88d5261c8ad2c3115750ccf4f7bf3e7904760af2014959e3 |
| SHA512 | b456215751eeda2f5b633cd52b5b5d820d1dc96d9ec4f4f35fa4fa1c5859dd925c949f0f6270af80a12ede9f9ac45f4a979aea7f8d4da459ed05cd1b7bdd5ed7 |
\Users\Admin\AppData\Local\Temp\Fvdfggf.exe
| MD5 | e124d6fab64aa638922bc7861998fa8c |
| SHA1 | 3420d895a8ef834eaf85c800fb83b1eca0a7816e |
| SHA256 | de8f8f5217cc3fca88d5261c8ad2c3115750ccf4f7bf3e7904760af2014959e3 |
| SHA512 | b456215751eeda2f5b633cd52b5b5d820d1dc96d9ec4f4f35fa4fa1c5859dd925c949f0f6270af80a12ede9f9ac45f4a979aea7f8d4da459ed05cd1b7bdd5ed7 |
memory/1744-59-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe
| MD5 | e124d6fab64aa638922bc7861998fa8c |
| SHA1 | 3420d895a8ef834eaf85c800fb83b1eca0a7816e |
| SHA256 | de8f8f5217cc3fca88d5261c8ad2c3115750ccf4f7bf3e7904760af2014959e3 |
| SHA512 | b456215751eeda2f5b633cd52b5b5d820d1dc96d9ec4f4f35fa4fa1c5859dd925c949f0f6270af80a12ede9f9ac45f4a979aea7f8d4da459ed05cd1b7bdd5ed7 |
memory/1548-62-0x0000000000408430-mapping.dmp
memory/1468-65-0x0000000000600000-0x0000000000607000-memory.dmp
memory/1188-66-0x000000000041BC2E-mapping.dmp
memory/1188-68-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1188-69-0x0000000000400000-0x0000000000424000-memory.dmp
memory/1548-70-0x0000000000400000-0x000000000043C000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2022-05-07 19:47
Reported
2022-05-07 19:55
Platform
win10v2004-20220414-en
Max time kernel
152s
Max time network
158s
Command Line
Signatures
Arkei
RedLine
RedLine Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 3364 set thread context of 1196 | N/A | C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe | C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe |
| PID 1632 set thread context of 1812 | N/A | C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe |
Enumerates physical storage devices
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe
"C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe"
C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe
"C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe"
C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe
"C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
Network
| Country | Destination | Domain | Proto |
| NL | 20.190.160.71:443 | tcp | |
| NL | 20.190.160.71:443 | tcp | |
| US | 93.184.220.29:80 | tcp | |
| NL | 20.190.160.129:443 | tcp | |
| NL | 20.190.160.129:443 | tcp | |
| JP | 40.74.98.195:443 | tcp | |
| US | 209.197.3.8:80 | tcp | |
| US | 209.197.3.8:80 | tcp | |
| US | 209.197.3.8:80 | tcp | |
| NL | 20.190.160.4:443 | tcp | |
| NL | 20.190.160.4:443 | tcp | |
| NL | 20.190.160.67:443 | tcp | |
| NL | 20.190.160.67:443 | tcp | |
| NL | 20.190.160.6:443 | tcp | |
| NL | 20.190.160.6:443 | tcp | |
| NL | 20.190.160.73:443 | tcp | |
| NL | 20.190.160.73:443 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe
| MD5 | e124d6fab64aa638922bc7861998fa8c |
| SHA1 | 3420d895a8ef834eaf85c800fb83b1eca0a7816e |
| SHA256 | de8f8f5217cc3fca88d5261c8ad2c3115750ccf4f7bf3e7904760af2014959e3 |
| SHA512 | b456215751eeda2f5b633cd52b5b5d820d1dc96d9ec4f4f35fa4fa1c5859dd925c949f0f6270af80a12ede9f9ac45f4a979aea7f8d4da459ed05cd1b7bdd5ed7 |
memory/1632-132-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe
| MD5 | e124d6fab64aa638922bc7861998fa8c |
| SHA1 | 3420d895a8ef834eaf85c800fb83b1eca0a7816e |
| SHA256 | de8f8f5217cc3fca88d5261c8ad2c3115750ccf4f7bf3e7904760af2014959e3 |
| SHA512 | b456215751eeda2f5b633cd52b5b5d820d1dc96d9ec4f4f35fa4fa1c5859dd925c949f0f6270af80a12ede9f9ac45f4a979aea7f8d4da459ed05cd1b7bdd5ed7 |
memory/1632-137-0x00000000006D0000-0x00000000006D7000-memory.dmp
memory/1196-138-0x0000000000000000-mapping.dmp
memory/1812-139-0x0000000000000000-mapping.dmp
memory/1196-140-0x0000000000400000-0x000000000043C000-memory.dmp
memory/1812-141-0x0000000000400000-0x0000000000424000-memory.dmp
memory/1812-142-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1812-143-0x0000000005970000-0x0000000005F88000-memory.dmp
memory/1812-144-0x0000000005410000-0x0000000005422000-memory.dmp
memory/1812-145-0x0000000005540000-0x000000000564A000-memory.dmp
memory/1812-146-0x0000000005470000-0x00000000054AC000-memory.dmp