Analysis
-
max time kernel
125s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
24-05-2022 07:55
Static task
static1
Behavioral task
behavioral1
Sample
74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b.exe
Resource
win7-20220414-en
General
-
Target
74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b.exe
-
Size
336KB
-
MD5
53f54f7688b7becf3f68ca1ac3cb3565
-
SHA1
b99a8ee9253186f3a19e750e4b9a7cecedb30136
-
SHA256
74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b
-
SHA512
a94b97891ae3e7c202746e13912737e9047ba0f5e344ad22c6eba54e15178935db2b3e9b94eb2759294de171588a6cd42ade38dc1bdb98fd16ddafccec6591ad
Malware Config
Extracted
amadey
3.10
185.215.113.35/d2VxjasuwS_old/index.php
Extracted
redline
9
185.62.58.140:41022
-
auth_value
185c92a51d0022998b6da3a38f6a9117
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1444-95-0x00000000005D0000-0x0000000000604000-memory.dmp family_redline behavioral1/memory/1444-96-0x0000000000660000-0x0000000000694000-memory.dmp family_redline -
suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE Amadey CnC Check-In
-
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
Processes:
orxds.exeorxds.exeorxds.exeorxds.exepid process 1888 orxds.exe 1680 orxds.exe 1444 orxds.exe 1764 orxds.exe -
Loads dropped DLL 3 IoCs
Processes:
74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b.exeorxds.exepid process 2036 74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b.exe 2036 74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b.exe 1888 orxds.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
orxds.exedescription pid process target process PID 1888 set thread context of 1444 1888 orxds.exe orxds.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
orxds.exepid process 1444 orxds.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
orxds.exedescription pid process Token: SeDebugPrivilege 1444 orxds.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b.exeorxds.execmd.exetaskeng.exedescription pid process target process PID 2036 wrote to memory of 1888 2036 74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b.exe orxds.exe PID 2036 wrote to memory of 1888 2036 74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b.exe orxds.exe PID 2036 wrote to memory of 1888 2036 74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b.exe orxds.exe PID 2036 wrote to memory of 1888 2036 74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b.exe orxds.exe PID 1888 wrote to memory of 952 1888 orxds.exe cmd.exe PID 1888 wrote to memory of 952 1888 orxds.exe cmd.exe PID 1888 wrote to memory of 952 1888 orxds.exe cmd.exe PID 1888 wrote to memory of 952 1888 orxds.exe cmd.exe PID 1888 wrote to memory of 1452 1888 orxds.exe schtasks.exe PID 1888 wrote to memory of 1452 1888 orxds.exe schtasks.exe PID 1888 wrote to memory of 1452 1888 orxds.exe schtasks.exe PID 1888 wrote to memory of 1452 1888 orxds.exe schtasks.exe PID 952 wrote to memory of 1368 952 cmd.exe reg.exe PID 952 wrote to memory of 1368 952 cmd.exe reg.exe PID 952 wrote to memory of 1368 952 cmd.exe reg.exe PID 952 wrote to memory of 1368 952 cmd.exe reg.exe PID 1652 wrote to memory of 1680 1652 taskeng.exe orxds.exe PID 1652 wrote to memory of 1680 1652 taskeng.exe orxds.exe PID 1652 wrote to memory of 1680 1652 taskeng.exe orxds.exe PID 1652 wrote to memory of 1680 1652 taskeng.exe orxds.exe PID 1888 wrote to memory of 1444 1888 orxds.exe orxds.exe PID 1888 wrote to memory of 1444 1888 orxds.exe orxds.exe PID 1888 wrote to memory of 1444 1888 orxds.exe orxds.exe PID 1888 wrote to memory of 1444 1888 orxds.exe orxds.exe PID 1888 wrote to memory of 1444 1888 orxds.exe orxds.exe PID 1888 wrote to memory of 1444 1888 orxds.exe orxds.exe PID 1888 wrote to memory of 1444 1888 orxds.exe orxds.exe PID 1888 wrote to memory of 1444 1888 orxds.exe orxds.exe PID 1888 wrote to memory of 1444 1888 orxds.exe orxds.exe PID 1888 wrote to memory of 1444 1888 orxds.exe orxds.exe PID 1888 wrote to memory of 1444 1888 orxds.exe orxds.exe PID 1888 wrote to memory of 1444 1888 orxds.exe orxds.exe PID 1652 wrote to memory of 1764 1652 taskeng.exe orxds.exe PID 1652 wrote to memory of 1764 1652 taskeng.exe orxds.exe PID 1652 wrote to memory of 1764 1652 taskeng.exe orxds.exe PID 1652 wrote to memory of 1764 1652 taskeng.exe orxds.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b.exe"C:\Users\Admin\AppData\Local\Temp\74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exe"C:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\d273120da5\3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\d273120da5\4⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN orxds.exe /TR "C:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exe"C:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskeng.exetaskeng.exe {A21CC350-CC19-49EA-932F-441708B4CC6E} S-1-5-21-790309383-526510583-3802439154-1000:TVHJCWMH\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exeC:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exeC:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exeFilesize
336KB
MD553f54f7688b7becf3f68ca1ac3cb3565
SHA1b99a8ee9253186f3a19e750e4b9a7cecedb30136
SHA25674e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b
SHA512a94b97891ae3e7c202746e13912737e9047ba0f5e344ad22c6eba54e15178935db2b3e9b94eb2759294de171588a6cd42ade38dc1bdb98fd16ddafccec6591ad
-
C:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exeFilesize
336KB
MD553f54f7688b7becf3f68ca1ac3cb3565
SHA1b99a8ee9253186f3a19e750e4b9a7cecedb30136
SHA25674e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b
SHA512a94b97891ae3e7c202746e13912737e9047ba0f5e344ad22c6eba54e15178935db2b3e9b94eb2759294de171588a6cd42ade38dc1bdb98fd16ddafccec6591ad
-
C:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exeFilesize
336KB
MD553f54f7688b7becf3f68ca1ac3cb3565
SHA1b99a8ee9253186f3a19e750e4b9a7cecedb30136
SHA25674e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b
SHA512a94b97891ae3e7c202746e13912737e9047ba0f5e344ad22c6eba54e15178935db2b3e9b94eb2759294de171588a6cd42ade38dc1bdb98fd16ddafccec6591ad
-
C:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exeFilesize
336KB
MD553f54f7688b7becf3f68ca1ac3cb3565
SHA1b99a8ee9253186f3a19e750e4b9a7cecedb30136
SHA25674e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b
SHA512a94b97891ae3e7c202746e13912737e9047ba0f5e344ad22c6eba54e15178935db2b3e9b94eb2759294de171588a6cd42ade38dc1bdb98fd16ddafccec6591ad
-
C:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exeFilesize
336KB
MD553f54f7688b7becf3f68ca1ac3cb3565
SHA1b99a8ee9253186f3a19e750e4b9a7cecedb30136
SHA25674e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b
SHA512a94b97891ae3e7c202746e13912737e9047ba0f5e344ad22c6eba54e15178935db2b3e9b94eb2759294de171588a6cd42ade38dc1bdb98fd16ddafccec6591ad
-
\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exeFilesize
336KB
MD553f54f7688b7becf3f68ca1ac3cb3565
SHA1b99a8ee9253186f3a19e750e4b9a7cecedb30136
SHA25674e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b
SHA512a94b97891ae3e7c202746e13912737e9047ba0f5e344ad22c6eba54e15178935db2b3e9b94eb2759294de171588a6cd42ade38dc1bdb98fd16ddafccec6591ad
-
\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exeFilesize
336KB
MD553f54f7688b7becf3f68ca1ac3cb3565
SHA1b99a8ee9253186f3a19e750e4b9a7cecedb30136
SHA25674e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b
SHA512a94b97891ae3e7c202746e13912737e9047ba0f5e344ad22c6eba54e15178935db2b3e9b94eb2759294de171588a6cd42ade38dc1bdb98fd16ddafccec6591ad
-
\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exeFilesize
336KB
MD553f54f7688b7becf3f68ca1ac3cb3565
SHA1b99a8ee9253186f3a19e750e4b9a7cecedb30136
SHA25674e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b
SHA512a94b97891ae3e7c202746e13912737e9047ba0f5e344ad22c6eba54e15178935db2b3e9b94eb2759294de171588a6cd42ade38dc1bdb98fd16ddafccec6591ad
-
memory/952-64-0x0000000000000000-mapping.dmp
-
memory/1368-66-0x0000000000000000-mapping.dmp
-
memory/1444-73-0x0000000000400000-0x00000000004A5000-memory.dmpFilesize
660KB
-
memory/1444-92-0x0000000000908000-0x0000000000934000-memory.dmpFilesize
176KB
-
memory/1444-96-0x0000000000660000-0x0000000000694000-memory.dmpFilesize
208KB
-
memory/1444-95-0x00000000005D0000-0x0000000000604000-memory.dmpFilesize
208KB
-
memory/1444-94-0x0000000000400000-0x00000000004A5000-memory.dmpFilesize
660KB
-
memory/1444-93-0x0000000000220000-0x0000000000259000-memory.dmpFilesize
228KB
-
memory/1444-88-0x0000000000400000-0x00000000004A5000-memory.dmpFilesize
660KB
-
memory/1444-72-0x0000000000400000-0x00000000004A5000-memory.dmpFilesize
660KB
-
memory/1444-86-0x0000000000400000-0x00000000004A5000-memory.dmpFilesize
660KB
-
memory/1444-75-0x0000000000400000-0x00000000004A5000-memory.dmpFilesize
660KB
-
memory/1444-77-0x0000000000400000-0x00000000004A5000-memory.dmpFilesize
660KB
-
memory/1444-82-0x0000000000400000-0x00000000004A5000-memory.dmpFilesize
660KB
-
memory/1444-83-0x0000000000409BC0-mapping.dmp
-
memory/1444-87-0x0000000000908000-0x0000000000934000-memory.dmpFilesize
176KB
-
memory/1452-65-0x0000000000000000-mapping.dmp
-
memory/1680-69-0x0000000000000000-mapping.dmp
-
memory/1680-90-0x0000000002CEE000-0x0000000002D0C000-memory.dmpFilesize
120KB
-
memory/1680-91-0x0000000000400000-0x0000000002B70000-memory.dmpFilesize
39.4MB
-
memory/1764-102-0x0000000000400000-0x0000000002B70000-memory.dmpFilesize
39.4MB
-
memory/1764-101-0x0000000002CEE000-0x0000000002D0C000-memory.dmpFilesize
120KB
-
memory/1764-98-0x0000000000000000-mapping.dmp
-
memory/1888-60-0x0000000000000000-mapping.dmp
-
memory/1888-63-0x0000000002BFF000-0x0000000002C1D000-memory.dmpFilesize
120KB
-
memory/1888-67-0x0000000000400000-0x0000000002B70000-memory.dmpFilesize
39.4MB
-
memory/2036-56-0x0000000000220000-0x0000000000258000-memory.dmpFilesize
224KB
-
memory/2036-55-0x0000000002C4E000-0x0000000002C6C000-memory.dmpFilesize
120KB
-
memory/2036-57-0x0000000000400000-0x0000000002B70000-memory.dmpFilesize
39.4MB
-
memory/2036-54-0x0000000075C01000-0x0000000075C03000-memory.dmpFilesize
8KB