Analysis
-
max time kernel
47s -
max time network
173s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
05-07-2022 22:18
Static task
static1
Behavioral task
behavioral1
Sample
809f720b347e0aa5f58c3a117129a76a19be445d5983892df7089c0e869c07c1.exe
Resource
win7-20220414-en
General
-
Target
809f720b347e0aa5f58c3a117129a76a19be445d5983892df7089c0e869c07c1.exe
-
Size
5.3MB
-
MD5
b76babadb0dc8806052579b97e45f0ff
-
SHA1
2f7b7e70ac41d942c82976e13abc528788af2ae1
-
SHA256
809f720b347e0aa5f58c3a117129a76a19be445d5983892df7089c0e869c07c1
-
SHA512
98604efeec79122f41c836be03f87166fcc0ea820613e8ea7b8d3bf40093d5dfc67015656532ad193b75f35a83eeff26810e81204eb2b09a1cf0f5749ae9560a
Malware Config
Extracted
redline
SUBZERO
185.215.113.217:19618
-
auth_value
019ff2a82025cde517e4466362191205
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2484-249-0x0000000002560000-0x0000000002596000-memory.dmp family_redline behavioral2/memory/2484-256-0x0000000002710000-0x0000000002744000-memory.dmp family_redline -
Executes dropped EXE 2 IoCs
Processes:
mnkcix.exemnkcix.exepid process 1180 mnkcix.exe 2484 mnkcix.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
mnkcix.exedescription pid process target process PID 1180 set thread context of 2484 1180 mnkcix.exe mnkcix.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
mnkcix.exedescription pid process Token: SeDebugPrivilege 2484 mnkcix.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
809f720b347e0aa5f58c3a117129a76a19be445d5983892df7089c0e869c07c1.exemnkcix.exedescription pid process target process PID 3056 wrote to memory of 1180 3056 809f720b347e0aa5f58c3a117129a76a19be445d5983892df7089c0e869c07c1.exe mnkcix.exe PID 3056 wrote to memory of 1180 3056 809f720b347e0aa5f58c3a117129a76a19be445d5983892df7089c0e869c07c1.exe mnkcix.exe PID 3056 wrote to memory of 1180 3056 809f720b347e0aa5f58c3a117129a76a19be445d5983892df7089c0e869c07c1.exe mnkcix.exe PID 1180 wrote to memory of 2484 1180 mnkcix.exe mnkcix.exe PID 1180 wrote to memory of 2484 1180 mnkcix.exe mnkcix.exe PID 1180 wrote to memory of 2484 1180 mnkcix.exe mnkcix.exe PID 1180 wrote to memory of 2484 1180 mnkcix.exe mnkcix.exe PID 1180 wrote to memory of 2484 1180 mnkcix.exe mnkcix.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\809f720b347e0aa5f58c3a117129a76a19be445d5983892df7089c0e869c07c1.exe"C:\Users\Admin\AppData\Local\Temp\809f720b347e0aa5f58c3a117129a76a19be445d5983892df7089c0e869c07c1.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\cwf\CixMediaLektor\safe_media\LEQ\03421_kldvb\mnkcix.exe"C:\ProgramData\cwf\CixMediaLektor\safe_media\LEQ\03421_kldvb\mnkcix.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\cwf\CixMediaLektor\safe_media\LEQ\03421_kldvb\mnkcix.exe"C:\ProgramData\cwf\CixMediaLektor\safe_media\LEQ\03421_kldvb\mnkcix.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\cwf\CixMediaLektor\safe_media\LEQ\03421_kldvb\mnkcix.exeFilesize
1.9MB
MD595bd190834a2adf7f48e0ef1375aacc8
SHA1adc883c4793cb3ab09335e380cf99e23a3da55af
SHA2569e831a9512a6c11bd27850a9f472b426089822cbd9d693b15c65ee6a1a4b76bc
SHA512bf96679c4709388f9c37fd93d0991d91efa4b79dc8b6b7640020052e6441a16fd01e2b11f994cb7e804846865866aed9646d682980af7ed4081cc7d9349545e7
-
C:\ProgramData\cwf\CixMediaLektor\safe_media\LEQ\03421_kldvb\mnkcix.exeFilesize
1.9MB
MD595bd190834a2adf7f48e0ef1375aacc8
SHA1adc883c4793cb3ab09335e380cf99e23a3da55af
SHA2569e831a9512a6c11bd27850a9f472b426089822cbd9d693b15c65ee6a1a4b76bc
SHA512bf96679c4709388f9c37fd93d0991d91efa4b79dc8b6b7640020052e6441a16fd01e2b11f994cb7e804846865866aed9646d682980af7ed4081cc7d9349545e7
-
C:\ProgramData\cwf\CixMediaLektor\safe_media\LEQ\03421_kldvb\mnkcix.exeFilesize
1.9MB
MD595bd190834a2adf7f48e0ef1375aacc8
SHA1adc883c4793cb3ab09335e380cf99e23a3da55af
SHA2569e831a9512a6c11bd27850a9f472b426089822cbd9d693b15c65ee6a1a4b76bc
SHA512bf96679c4709388f9c37fd93d0991d91efa4b79dc8b6b7640020052e6441a16fd01e2b11f994cb7e804846865866aed9646d682980af7ed4081cc7d9349545e7
-
memory/1180-178-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/1180-179-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/1180-180-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/1180-181-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/1180-176-0x0000000000000000-mapping.dmp
-
memory/2484-285-0x0000000005A60000-0x0000000005AF2000-memory.dmpFilesize
584KB
-
memory/2484-208-0x000000000040CD2F-mapping.dmp
-
memory/2484-275-0x00000000056B0000-0x00000000057BA000-memory.dmpFilesize
1.0MB
-
memory/2484-274-0x0000000005690000-0x00000000056A2000-memory.dmpFilesize
72KB
-
memory/2484-273-0x0000000005080000-0x0000000005686000-memory.dmpFilesize
6.0MB
-
memory/2484-256-0x0000000002710000-0x0000000002744000-memory.dmpFilesize
208KB
-
memory/2484-254-0x0000000004B80000-0x000000000507E000-memory.dmpFilesize
5.0MB
-
memory/2484-249-0x0000000002560000-0x0000000002596000-memory.dmpFilesize
216KB
-
memory/2484-244-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/2484-278-0x00000000057F0000-0x000000000582E000-memory.dmpFilesize
248KB
-
memory/2484-280-0x0000000005840000-0x000000000588B000-memory.dmpFilesize
300KB
-
memory/2484-284-0x00000000059E0000-0x0000000005A56000-memory.dmpFilesize
472KB
-
memory/2484-288-0x0000000005C40000-0x0000000005C5E000-memory.dmpFilesize
120KB
-
memory/2484-290-0x0000000005DC0000-0x0000000005E26000-memory.dmpFilesize
408KB
-
memory/2484-299-0x0000000007200000-0x00000000073C2000-memory.dmpFilesize
1.8MB
-
memory/2484-300-0x00000000073E0000-0x000000000790C000-memory.dmpFilesize
5.2MB
-
memory/2484-307-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/3056-137-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-170-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-143-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-144-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-145-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-146-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-148-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-149-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-150-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-147-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-151-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-152-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-153-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-154-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-156-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-157-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-155-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-158-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-159-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-160-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-162-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-161-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-164-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-163-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-166-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-165-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-167-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-168-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-169-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-142-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-171-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-172-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-173-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-174-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-175-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-141-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-138-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-140-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-139-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-116-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-136-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-135-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-134-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-133-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-132-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-131-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-130-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-129-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-128-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-125-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-127-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-126-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-124-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-123-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-122-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-121-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-120-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-119-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-118-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-117-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB