Analysis
-
max time kernel
97s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
07-08-2022 23:34
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://141.98.6.236/1337/ZvfejoxpnTORRENTOLD-1.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
http://141.98.6.236/1337/ZvfejoxpnTORRENTOLD-1.exe
Resource
win10v2004-20220721-en
General
-
Target
http://141.98.6.236/1337/ZvfejoxpnTORRENTOLD-1.exe
Malware Config
Extracted
redline
TORRENTOLD
amrican-sport-live-stream.cc:4581
-
auth_value
74e1b58bf920611f04c0e3919954fe05
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1840-63-0x0000000000400000-0x0000000000444000-memory.dmp family_redline behavioral1/memory/1840-64-0x0000000000400000-0x0000000000444000-memory.dmp family_redline behavioral1/memory/1840-65-0x0000000000400000-0x0000000000444000-memory.dmp family_redline behavioral1/memory/1840-66-0x000000000043E76E-mapping.dmp family_redline behavioral1/memory/1840-68-0x0000000000400000-0x0000000000444000-memory.dmp family_redline behavioral1/memory/1840-70-0x0000000000400000-0x0000000000444000-memory.dmp family_redline -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
ZvfejoxpnTORRENTOLD-1.exepid process 1260 ZvfejoxpnTORRENTOLD-1.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
ZvfejoxpnTORRENTOLD-1.exedescription pid process target process PID 1260 set thread context of 1840 1260 ZvfejoxpnTORRENTOLD-1.exe RegAsm.exe -
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 10f5060cc7aad801 iexplore.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005fbcd10b409412459e4a784628514125000000000200000000001066000000010000200000007296ee1cfb4992aab1667de15d7e893b0be55ae96f6fcaee5e07beb5baaf7660000000000e800000000200002000000047bbd880ea1bf3d56b951feb0278e857fcf16c84bfaf67906271ee2565f1a2ad200000004d7ad44bb56ffa102cf56b5221feb134ec5ff167a83220b149a986d4347e4447400000003190ea457e696fed3b9d6aeaa660b47711636d59568f071413b19eb0ce96676493e12993e9232265565b241593bb5a3cda280a9b3f4c82750bebc9af7b40b8dd iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4469DCB1-16BA-11ED-A294-E6961454B536} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 001edb1ec7aad801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005fbcd10b409412459e4a78462851412500000000020000000000106600000001000020000000b2bf1fd88618e436807d190066b8e47d248fffc7c614bb4880ef6eea343292a2000000000e80000000020000200000000ae15c9ba96c87a6a4601e3ada07e2943bfe797ade99e1c76532949af2fbdaed90000000fc10c69337744ce34e9a3264bd1a30293a948f4c927eaae14e840d7f1352dbeaca83009be93993258f2213d3359376b1d4e873eb4d8feb4bd6fd9913b9138456608a5ffd8d50ed901fe1b144bf3f62e3e87bca654dd3a7bb29fa46a4d7089f4e224d3f182290da55df239b818911ff12815c86e684950cedf888740e288743ff9eff8586fe660d1e96b5e2986d39f45540000000b9826c6f22ffa6fb1a5621479f79b79548937d226f873b9a8c198aacd42f0b3b3ee05ef05163db2e7f83b3f3a889cf29bd587806c77cb61a74252bfd3181f3b1 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "366687454" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
ZvfejoxpnTORRENTOLD-1.exeRegAsm.exepid process 1260 ZvfejoxpnTORRENTOLD-1.exe 1260 ZvfejoxpnTORRENTOLD-1.exe 1260 ZvfejoxpnTORRENTOLD-1.exe 1840 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ZvfejoxpnTORRENTOLD-1.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 1260 ZvfejoxpnTORRENTOLD-1.exe Token: SeDebugPrivilege 1840 RegAsm.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exepid process 1800 iexplore.exe 1800 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1800 iexplore.exe 1800 iexplore.exe 1776 IEXPLORE.EXE 1776 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
iexplore.exeZvfejoxpnTORRENTOLD-1.exedescription pid process target process PID 1800 wrote to memory of 1776 1800 iexplore.exe IEXPLORE.EXE PID 1800 wrote to memory of 1776 1800 iexplore.exe IEXPLORE.EXE PID 1800 wrote to memory of 1776 1800 iexplore.exe IEXPLORE.EXE PID 1800 wrote to memory of 1776 1800 iexplore.exe IEXPLORE.EXE PID 1800 wrote to memory of 1260 1800 iexplore.exe ZvfejoxpnTORRENTOLD-1.exe PID 1800 wrote to memory of 1260 1800 iexplore.exe ZvfejoxpnTORRENTOLD-1.exe PID 1800 wrote to memory of 1260 1800 iexplore.exe ZvfejoxpnTORRENTOLD-1.exe PID 1800 wrote to memory of 1260 1800 iexplore.exe ZvfejoxpnTORRENTOLD-1.exe PID 1260 wrote to memory of 1840 1260 ZvfejoxpnTORRENTOLD-1.exe RegAsm.exe PID 1260 wrote to memory of 1840 1260 ZvfejoxpnTORRENTOLD-1.exe RegAsm.exe PID 1260 wrote to memory of 1840 1260 ZvfejoxpnTORRENTOLD-1.exe RegAsm.exe PID 1260 wrote to memory of 1840 1260 ZvfejoxpnTORRENTOLD-1.exe RegAsm.exe PID 1260 wrote to memory of 1840 1260 ZvfejoxpnTORRENTOLD-1.exe RegAsm.exe PID 1260 wrote to memory of 1840 1260 ZvfejoxpnTORRENTOLD-1.exe RegAsm.exe PID 1260 wrote to memory of 1840 1260 ZvfejoxpnTORRENTOLD-1.exe RegAsm.exe PID 1260 wrote to memory of 1840 1260 ZvfejoxpnTORRENTOLD-1.exe RegAsm.exe PID 1260 wrote to memory of 1840 1260 ZvfejoxpnTORRENTOLD-1.exe RegAsm.exe PID 1260 wrote to memory of 1840 1260 ZvfejoxpnTORRENTOLD-1.exe RegAsm.exe PID 1260 wrote to memory of 1840 1260 ZvfejoxpnTORRENTOLD-1.exe RegAsm.exe PID 1260 wrote to memory of 1840 1260 ZvfejoxpnTORRENTOLD-1.exe RegAsm.exe
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://141.98.6.236/1337/ZvfejoxpnTORRENTOLD-1.exe1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1800 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JF7FDU3Y\ZvfejoxpnTORRENTOLD-1.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JF7FDU3Y\ZvfejoxpnTORRENTOLD-1.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JF7FDU3Y\ZvfejoxpnTORRENTOLD-1.exeFilesize
784KB
MD543089a1a50b1981a4dba7959e31e62f1
SHA1c8db527eba66719e365672a17bd1eddc2085de9a
SHA2564fb57da6d703e8bebfdd51b7f579fb36127eee300880eeb5ca2be3f00cce154e
SHA5122777758eff7684d51ca8bc060f0652c14ef6999375061262acb5a741a2c927cfefe46bbbe733530777bd1d08893cce8e7f0631e157ff2069f6c75c5f3624b0fa
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JF7FDU3Y\ZvfejoxpnTORRENTOLD-1.exe.6l80n1o.partialFilesize
784KB
MD543089a1a50b1981a4dba7959e31e62f1
SHA1c8db527eba66719e365672a17bd1eddc2085de9a
SHA2564fb57da6d703e8bebfdd51b7f579fb36127eee300880eeb5ca2be3f00cce154e
SHA5122777758eff7684d51ca8bc060f0652c14ef6999375061262acb5a741a2c927cfefe46bbbe733530777bd1d08893cce8e7f0631e157ff2069f6c75c5f3624b0fa
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\WB8IGSS8.txtFilesize
599B
MD59c3d607b045691c061928a03e57a2214
SHA1d7126a1a736c303d6ece322ac824ae729169d843
SHA256ff4eec3a46bf45f826c5a86fb1f37bad7017019ef907a6f8b27e570dbdc1f79c
SHA512c0e9bf002b0095128f90d01ac1b1a7982f001635c4e98168e2dace7b2a80d88f81b3c8d614c369afb8fd032e0c30d9b0bfb343d8ec8287a55159d36094c2059c
-
memory/1260-55-0x0000000000000000-mapping.dmp
-
memory/1260-57-0x00000000013B0000-0x000000000147A000-memory.dmpFilesize
808KB
-
memory/1260-58-0x00000000003B0000-0x0000000000420000-memory.dmpFilesize
448KB
-
memory/1260-59-0x0000000000B70000-0x0000000000C02000-memory.dmpFilesize
584KB
-
memory/1840-63-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/1840-61-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/1840-64-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/1840-65-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/1840-66-0x000000000043E76E-mapping.dmp
-
memory/1840-68-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/1840-70-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/1840-71-0x0000000076291000-0x0000000076293000-memory.dmpFilesize
8KB
-
memory/1840-72-0x00000000003F0000-0x00000000003F6000-memory.dmpFilesize
24KB
-
memory/1840-60-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB