Analysis Overview
SHA256
0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b
Threat Level: Known bad
The file 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe was found to be: Known bad.
Malicious Activity Summary
RedLine
RedLine Payload
Arkei
Executes dropped EXE
Loads dropped DLL
Checks computer location settings
Suspicious use of SetThreadContext
Enumerates physical storage devices
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-05-09 19:50
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2022-05-09 19:50
Reported
2022-05-09 19:59
Platform
win7-20220414-en
Max time kernel
157s
Max time network
178s
Command Line
Signatures
Arkei
RedLine
RedLine Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 892 set thread context of 1980 | N/A | C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe | C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe |
| PID 940 set thread context of 1740 | N/A | C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe |
Enumerates physical storage devices
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe
"C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe"
C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe
"C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe"
C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe
"C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
Network
| Country | Destination | Domain | Proto |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp |
Files
memory/892-56-0x0000000075271000-0x0000000075273000-memory.dmp
\Users\Admin\AppData\Local\Temp\Fvdfggf.exe
| MD5 | e124d6fab64aa638922bc7861998fa8c |
| SHA1 | 3420d895a8ef834eaf85c800fb83b1eca0a7816e |
| SHA256 | de8f8f5217cc3fca88d5261c8ad2c3115750ccf4f7bf3e7904760af2014959e3 |
| SHA512 | b456215751eeda2f5b633cd52b5b5d820d1dc96d9ec4f4f35fa4fa1c5859dd925c949f0f6270af80a12ede9f9ac45f4a979aea7f8d4da459ed05cd1b7bdd5ed7 |
\Users\Admin\AppData\Local\Temp\Fvdfggf.exe
| MD5 | e124d6fab64aa638922bc7861998fa8c |
| SHA1 | 3420d895a8ef834eaf85c800fb83b1eca0a7816e |
| SHA256 | de8f8f5217cc3fca88d5261c8ad2c3115750ccf4f7bf3e7904760af2014959e3 |
| SHA512 | b456215751eeda2f5b633cd52b5b5d820d1dc96d9ec4f4f35fa4fa1c5859dd925c949f0f6270af80a12ede9f9ac45f4a979aea7f8d4da459ed05cd1b7bdd5ed7 |
memory/940-59-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe
| MD5 | e124d6fab64aa638922bc7861998fa8c |
| SHA1 | 3420d895a8ef834eaf85c800fb83b1eca0a7816e |
| SHA256 | de8f8f5217cc3fca88d5261c8ad2c3115750ccf4f7bf3e7904760af2014959e3 |
| SHA512 | b456215751eeda2f5b633cd52b5b5d820d1dc96d9ec4f4f35fa4fa1c5859dd925c949f0f6270af80a12ede9f9ac45f4a979aea7f8d4da459ed05cd1b7bdd5ed7 |
memory/1980-62-0x0000000000408430-mapping.dmp
memory/892-65-0x0000000000890000-0x0000000000897000-memory.dmp
memory/1740-66-0x000000000041BC2E-mapping.dmp
memory/1740-68-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1740-69-0x0000000000400000-0x0000000000424000-memory.dmp
memory/1980-70-0x0000000000400000-0x000000000043C000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2022-05-09 19:50
Reported
2022-05-09 19:59
Platform
win10v2004-20220414-en
Max time kernel
164s
Max time network
171s
Command Line
Signatures
Arkei
RedLine
RedLine Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 4756 set thread context of 1428 | N/A | C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe |
| PID 4428 set thread context of 2220 | N/A | C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe | C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe |
Enumerates physical storage devices
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe
"C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe"
C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe
"C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe
"C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe"
Network
| Country | Destination | Domain | Proto |
| BE | 8.238.110.126:80 | tcp | |
| BE | 8.238.110.126:80 | tcp | |
| BE | 8.238.110.126:80 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp | |
| RU | 62.204.41.166:27688 | tcp |
Files
memory/4756-132-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe
| MD5 | e124d6fab64aa638922bc7861998fa8c |
| SHA1 | 3420d895a8ef834eaf85c800fb83b1eca0a7816e |
| SHA256 | de8f8f5217cc3fca88d5261c8ad2c3115750ccf4f7bf3e7904760af2014959e3 |
| SHA512 | b456215751eeda2f5b633cd52b5b5d820d1dc96d9ec4f4f35fa4fa1c5859dd925c949f0f6270af80a12ede9f9ac45f4a979aea7f8d4da459ed05cd1b7bdd5ed7 |
C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe
| MD5 | e124d6fab64aa638922bc7861998fa8c |
| SHA1 | 3420d895a8ef834eaf85c800fb83b1eca0a7816e |
| SHA256 | de8f8f5217cc3fca88d5261c8ad2c3115750ccf4f7bf3e7904760af2014959e3 |
| SHA512 | b456215751eeda2f5b633cd52b5b5d820d1dc96d9ec4f4f35fa4fa1c5859dd925c949f0f6270af80a12ede9f9ac45f4a979aea7f8d4da459ed05cd1b7bdd5ed7 |
memory/1428-137-0x0000000000000000-mapping.dmp
memory/4756-138-0x00000000006D0000-0x00000000006D7000-memory.dmp
memory/1428-139-0x0000000000400000-0x0000000000420000-memory.dmp
memory/2220-140-0x0000000000000000-mapping.dmp
memory/1428-141-0x0000000005680000-0x0000000005C98000-memory.dmp
memory/1428-142-0x0000000005120000-0x0000000005132000-memory.dmp
memory/1428-143-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2220-144-0x0000000000400000-0x000000000043C000-memory.dmp
memory/1428-145-0x0000000005250000-0x000000000535A000-memory.dmp
memory/1428-146-0x0000000005180000-0x00000000051BC000-memory.dmp