redline | 5ec3a8d538cf38f9be9ba8419dee05bf711b70baf155ae6d6728ab15444fd24c

General

Target

file.exe
Size

1.7MB
MD5

0869629e5fc4b5b7088fee6b06038d17
SHA1

ddfc132d410fc3c38e3fda093ca3cf76fe1a843f
SHA256

5ec3a8d538cf38f9be9ba8419dee05bf711b70baf155ae6d6728ab15444fd24c
SHA512

20733334a1ecd38c23d21360035b88e4ec4aa84b498ebf159afb321dd2426c24afe2a7085f6b5e95ac8aa8030d7f92dabf6219288c2eac23048f97e59be57138
SSDEEP

24576:LnAUWkcdUd7MyD0LeFwIXyua+cBLYkxChx4Q:UUWkcdUd7fD0iFx3pc3xChxd

Score

10^/10

redline logsdiller cloud (sup: @mr_golds)discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (Sup: @mr_golds)

C2

51.89.201.21:7161

Attributes

auth_value
56c6f7b9024c076f0a96931453da7e56

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1372-61-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral1/memory/1372-62-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral1/memory/1372-63-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral1/memory/1372-64-0x0000000000422176-mapping.dmp	family_redline
behavioral1/memory/1372-66-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral1/memory/1372-68-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline

Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

setup.exe

pid process

1836 setup.exe
Loads dropped DLL 2 IoCs

Processes:

file.exe

pid process

1372 file.exe
1844
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
1836	setup.exe

pid	process
1372	file.exe
1844

Suspicious use of SetThreadContext 2 IoCs

Processes:

file.exesetup.exe

description	pid	process	target process
PID 1912 set thread context of 1372	1912	file.exe	file.exe
PID 1836 set thread context of 1584	1836	setup.exe	RegSvcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 46 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\bestrealprizes.life\ = "16"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30aed79f56d3d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{98C60471-3F49-11ED-8B55-6651945CA213} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\bestrealprizes.life	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\bestrealprizes.life\Total = "16"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf0000000002000000000010660000000100002000000084273b1de3060883c50425d5b43283b87fe9d34ac1168e8a9f972f71ff8cce46000000000e8000000002000020000000bcfed265851f712b70e7aea497d218f434d917c351007ad2d6b3f68035b647e520000000ad6f3f7903be4d77d481c1f8310195c6a9905e0f5e0b37430ded5b6372d5cb61400000002ca98903d7b3069071ad58a38c49c0a7e0937438a7edda32299c460763a6c6f58a90459336c8b9af87a39814337d654bfc4175316d8a0449567cee19374e068f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "16"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\bestrealprizes.life\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\bestrealprizes.life\Total = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371147060"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\bestrealprizes.life\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf00000000020000000000106600000001000020000000c30256ead7ddc4d6660de133cba578cf943e827a173148d3b3c0ece49b56532a000000000e8000000002000020000000e575bfcfe3b69306269f54da17bf548784693bfd3f999c4a7a2c3db83690f3de90000000051ebef46003a0b104ff34f09b80434fabf6394534732abcc0702eb5db1146c65f5a01def92a837bb7ca96d06bd5ca2e812d13f223a43071e7287a456ec8cabed4604fb31a9dd719735d12af45a613eafd426252e1f12152bcfcf872e8ada47b515a81eae1b8b5f8ff6e5c4464f11f2e40b0b80839e9ed12ed0ada728b062d51bde4b9ca28043118075e82d861d1a5a04000000007d278c2394ef96469993059abb5b6fff9a3095ec524a64284fcb014396c7704f7a48c8e2d9953ec489d9055bcb85cfe38b8c78b2cbc1e3b5287bae2513cb752	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

file.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	file.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	file.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

file.exe

pid process

1372 file.exe
1372 file.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

file.exefile.exe

description pid process

Token: SeDebugPrivilege 1912 file.exe
Token: SeDebugPrivilege 1372 file.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

912 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

912 iexplore.exe
912 iexplore.exe
1816 IEXPLORE.EXE
1816 IEXPLORE.EXE
1816 IEXPLORE.EXE
1816 IEXPLORE.EXE

pid	process
1372	file.exe
1372	file.exe

description	pid	process
Token: SeDebugPrivilege	1912	file.exe
Token: SeDebugPrivilege	1372	file.exe

pid	process
912	iexplore.exe

pid	process
912	iexplore.exe
912	iexplore.exe
1816	IEXPLORE.EXE
1816	IEXPLORE.EXE
1816	IEXPLORE.EXE
1816	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

file.exefile.exeiexplore.exesetup.exe

description	pid	process	target process
PID 1912 wrote to memory of 1372	1912	file.exe	file.exe
PID 1912 wrote to memory of 1372	1912	file.exe	file.exe
PID 1912 wrote to memory of 1372	1912	file.exe	file.exe
PID 1912 wrote to memory of 1372	1912	file.exe	file.exe
PID 1912 wrote to memory of 1372	1912	file.exe	file.exe
PID 1912 wrote to memory of 1372	1912	file.exe	file.exe
PID 1912 wrote to memory of 1372	1912	file.exe	file.exe
PID 1912 wrote to memory of 1372	1912	file.exe	file.exe
PID 1912 wrote to memory of 1372	1912	file.exe	file.exe
PID 1372 wrote to memory of 912	1372	file.exe	iexplore.exe
PID 1372 wrote to memory of 912	1372	file.exe	iexplore.exe
PID 1372 wrote to memory of 912	1372	file.exe	iexplore.exe
PID 1372 wrote to memory of 912	1372	file.exe	iexplore.exe
PID 912 wrote to memory of 1816	912	iexplore.exe	IEXPLORE.EXE
PID 912 wrote to memory of 1816	912	iexplore.exe	IEXPLORE.EXE
PID 912 wrote to memory of 1816	912	iexplore.exe	IEXPLORE.EXE
PID 912 wrote to memory of 1816	912	iexplore.exe	IEXPLORE.EXE
PID 1372 wrote to memory of 1836	1372	file.exe	setup.exe
PID 1372 wrote to memory of 1836	1372	file.exe	setup.exe
PID 1372 wrote to memory of 1836	1372	file.exe	setup.exe
PID 1372 wrote to memory of 1836	1372	file.exe	setup.exe
PID 1836 wrote to memory of 1584	1836	setup.exe	RegSvcs.exe
PID 1836 wrote to memory of 1584	1836	setup.exe	RegSvcs.exe
PID 1836 wrote to memory of 1584	1836	setup.exe	RegSvcs.exe
PID 1836 wrote to memory of 1584	1836	setup.exe	RegSvcs.exe
PID 1836 wrote to memory of 1584	1836	setup.exe	RegSvcs.exe
PID 1836 wrote to memory of 1584	1836	setup.exe	RegSvcs.exe
PID 1836 wrote to memory of 1584	1836	setup.exe	RegSvcs.exe
PID 1836 wrote to memory of 1584	1836	setup.exe	RegSvcs.exe
PID 1836 wrote to memory of 1584	1836	setup.exe	RegSvcs.exe
PID 1836 wrote to memory of 1584	1836	setup.exe	RegSvcs.exe
PID 1836 wrote to memory of 1584	1836	setup.exe	RegSvcs.exe
PID 1836 wrote to memory of 1584	1836	setup.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1912

C:\Users\Admin\AppData\Local\Temp\file.exe
C:\Users\Admin\AppData\Local\Temp\file.exe
2⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1372

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://bestrealprizes.life/?u=lq1pd08&o=hdck0gl
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:912

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:912 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1816

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1836

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
4⤵
PID:1584

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Install Root Certificate

1

T1130

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
60KB

MD5
d15aaa7c9be910a9898260767e2490e1

SHA1
2090c53f8d9fc3fbdbafd3a1e4dc25520eb74388

SHA256
f8ebaaf487cba0c81a17c8cd680bdd2dd8e90d2114ecc54844cffc0cc647848e

SHA512
7e1c1a683914b961b5cc2fe5e4ae288b60bab43bfaa21ce4972772aa0589615c19f57e672e1d93e50a7ed7b76fbd2f1b421089dcaed277120b93f8e91b18af94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
f4bf53053d293f9031c93d0abdd14689

SHA1
79402166e98b8dd67c8bd4ef4d784766a25c7fdb

SHA256
fd92f766c3d5837c1847787732c04445bd992a22ae08b6575fe44406b5b073bf

SHA512
2716bfb02296e24e31af043cd998e1844e75055f097379f16606d2d13ec9081f9c127ad1246b54c01768cf0676c87205d0c066195420b843e8af2ed6a9e14a01

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
Filesize
345KB

MD5
074f4690e37f519e136a17d673fb023c

SHA1
6ae97f82fafb429df5c4af4e1f708fa72570cedb

SHA256
b642e29066bc94c378a3de14ba7263ab2190aa4b7c140a667014e388b1fa1da8

SHA512
b3f268cc367d21d5454c906c23a6830677631c0dc1deb6b1ee3d39fba9e9fec7f9b557f0714a75a0bfff1e72416db15bca7d6757f2089024d4ad55d47a3bc9b7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\DVQXPJVE.txt
Filesize
608B

MD5
8568cd8544dd1058e7269cdaa1e9e085

SHA1
47a56cbc9f4779caba6249145bfdef6f81445e38

SHA256
d1e44ed879612787483382a8d677a1f3b8d189866b6aba9a92199d93a8e89a2a

SHA512
3516f70c28e25d7295e30b9748c91dc9803e0d938f80e74367f5b3c5c8d87febca14dbf0f011a4cff04b68599dc4413196ac2f64b3aa0c4ea9652a91d49a6fc8

Download Submit
\Users\Admin\AppData\Local\Temp\setup.exe
Filesize
345KB

MD5
074f4690e37f519e136a17d673fb023c

SHA1
6ae97f82fafb429df5c4af4e1f708fa72570cedb

SHA256
b642e29066bc94c378a3de14ba7263ab2190aa4b7c140a667014e388b1fa1da8

SHA512
b3f268cc367d21d5454c906c23a6830677631c0dc1deb6b1ee3d39fba9e9fec7f9b557f0714a75a0bfff1e72416db15bca7d6757f2089024d4ad55d47a3bc9b7

Download Submit
\Users\Admin\AppData\Local\Temp\setup.exe
Filesize
345KB

MD5
074f4690e37f519e136a17d673fb023c

SHA1
6ae97f82fafb429df5c4af4e1f708fa72570cedb

SHA256
b642e29066bc94c378a3de14ba7263ab2190aa4b7c140a667014e388b1fa1da8

SHA512
b3f268cc367d21d5454c906c23a6830677631c0dc1deb6b1ee3d39fba9e9fec7f9b557f0714a75a0bfff1e72416db15bca7d6757f2089024d4ad55d47a3bc9b7

Download Submit
memory/1372-62-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1372-59-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1372-63-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1372-64-0x0000000000422176-mapping.dmp

Download
memory/1372-66-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1372-68-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1372-61-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1372-58-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1584-74-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/1584-77-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/1584-85-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/1584-86-0x0000000140003FEC-mapping.dmp

Download
memory/1584-84-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/1584-83-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/1584-82-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/1584-80-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/1584-79-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/1584-89-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/1584-75-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/1584-88-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/1836-71-0x0000000000000000-mapping.dmp

Download
memory/1912-54-0x0000000000CE0000-0x0000000000EA2000-memory.dmp

Filesize
1.8MB

Download
memory/1912-57-0x0000000004D90000-0x0000000004E22000-memory.dmp

Filesize
584KB

Download
memory/1912-56-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download
memory/1912-55-0x00000000009A0000-0x0000000000A4E000-memory.dmp

Filesize
696KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads