Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
28-09-2022 15:06
Static task
static1
General
-
Target
f89fc833d8f2ef44781ff75039c4a0736bf740515dba9380f44adcc3ecf6298a.exe
-
Size
294KB
-
MD5
d4f9728a799fac59998aaf687defbdf8
-
SHA1
e4cad651d7755e38adc4f3edf17cdc94f27f34ce
-
SHA256
f89fc833d8f2ef44781ff75039c4a0736bf740515dba9380f44adcc3ecf6298a
-
SHA512
9b0957fdea42779dc5cd7c40bba37d5b71e54924ef4c51d2ba996734455a8c4187bf3f4beb9b146aa8c74947fa513cfc0b96b2460ee424c6c3dffdc94baba76d
-
SSDEEP
6144:jTbZSKRK/gKopgI7o44y8701jkigavwVfIx:jwF/kph34y/TRx
Malware Config
Extracted
danabot
-
embedded_hash
6618C163D57D6441FCCA65D86C4D380D
-
type
loader
Extracted
redline
insmix
jamesmillion2.xyz:9420
-
auth_value
f388a05524f756108c9e4b0f4c4bafb6
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
BE8D.exe3380.exepid process 5084 BE8D.exe 3608 3380.exe -
Deletes itself 1 IoCs
Processes:
pid process 2896 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
f89fc833d8f2ef44781ff75039c4a0736bf740515dba9380f44adcc3ecf6298a.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f89fc833d8f2ef44781ff75039c4a0736bf740515dba9380f44adcc3ecf6298a.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f89fc833d8f2ef44781ff75039c4a0736bf740515dba9380f44adcc3ecf6298a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f89fc833d8f2ef44781ff75039c4a0736bf740515dba9380f44adcc3ecf6298a.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f89fc833d8f2ef44781ff75039c4a0736bf740515dba9380f44adcc3ecf6298a.exepid process 2060 f89fc833d8f2ef44781ff75039c4a0736bf740515dba9380f44adcc3ecf6298a.exe 2060 f89fc833d8f2ef44781ff75039c4a0736bf740515dba9380f44adcc3ecf6298a.exe 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2896 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
f89fc833d8f2ef44781ff75039c4a0736bf740515dba9380f44adcc3ecf6298a.exepid process 2060 f89fc833d8f2ef44781ff75039c4a0736bf740515dba9380f44adcc3ecf6298a.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
3380.exedescription pid process Token: SeShutdownPrivilege 2896 Token: SeCreatePagefilePrivilege 2896 Token: SeDebugPrivilege 3608 3380.exe Token: SeShutdownPrivilege 2896 Token: SeCreatePagefilePrivilege 2896 -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
BE8D.exedescription pid process target process PID 2896 wrote to memory of 5084 2896 BE8D.exe PID 2896 wrote to memory of 5084 2896 BE8D.exe PID 2896 wrote to memory of 5084 2896 BE8D.exe PID 5084 wrote to memory of 3724 5084 BE8D.exe appidtel.exe PID 5084 wrote to memory of 3724 5084 BE8D.exe appidtel.exe PID 5084 wrote to memory of 3724 5084 BE8D.exe appidtel.exe PID 2896 wrote to memory of 3608 2896 3380.exe PID 2896 wrote to memory of 3608 2896 3380.exe PID 2896 wrote to memory of 3608 2896 3380.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f89fc833d8f2ef44781ff75039c4a0736bf740515dba9380f44adcc3ecf6298a.exe"C:\Users\Admin\AppData\Local\Temp\f89fc833d8f2ef44781ff75039c4a0736bf740515dba9380f44adcc3ecf6298a.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\BE8D.exeC:\Users\Admin\AppData\Local\Temp\BE8D.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\appidtel.exeC:\Windows\system32\appidtel.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\3380.exeC:\Users\Admin\AppData\Local\Temp\3380.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\3380.exeFilesize
304KB
MD515f1517f0ceaaf9b6c78cf7625510c07
SHA18aabce20aff43476586a1b69b0b761a7f39d1e7e
SHA256d0d47dec11c63b6fa1a2dcac89e5a7352220e371b728781de041bf42fa8965fb
SHA512931a79a6e0d38c9b59b03a68d31e3c8fdb2b51e5eeed1df45790eba38f516f767ed67d9edd10bef16d169dc253c81ba6afb5d52738761cc2fa84f601f86b3516
-
C:\Users\Admin\AppData\Local\Temp\3380.exeFilesize
304KB
MD515f1517f0ceaaf9b6c78cf7625510c07
SHA18aabce20aff43476586a1b69b0b761a7f39d1e7e
SHA256d0d47dec11c63b6fa1a2dcac89e5a7352220e371b728781de041bf42fa8965fb
SHA512931a79a6e0d38c9b59b03a68d31e3c8fdb2b51e5eeed1df45790eba38f516f767ed67d9edd10bef16d169dc253c81ba6afb5d52738761cc2fa84f601f86b3516
-
C:\Users\Admin\AppData\Local\Temp\BE8D.exeFilesize
1.4MB
MD5f729ffe22a3a3be0937f6dbc7106ea22
SHA192d6928b2ecbe16a2b7bdd8bb2530043876ea793
SHA256ea3514cfe20008aff0108a175014f47e12be8bb739220ba139f62936aa10320a
SHA51276aa1ceb667e318b09cd5c3e8d6adf1c38254a8534f4d460bea16d76d1192f6debcd0567a812eb00113390fbe6dfc1ef24c335a01d4642e46483bb2ed5a8a883
-
C:\Users\Admin\AppData\Local\Temp\BE8D.exeFilesize
1.4MB
MD5f729ffe22a3a3be0937f6dbc7106ea22
SHA192d6928b2ecbe16a2b7bdd8bb2530043876ea793
SHA256ea3514cfe20008aff0108a175014f47e12be8bb739220ba139f62936aa10320a
SHA51276aa1ceb667e318b09cd5c3e8d6adf1c38254a8534f4d460bea16d76d1192f6debcd0567a812eb00113390fbe6dfc1ef24c335a01d4642e46483bb2ed5a8a883
-
memory/2060-150-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-125-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-152-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-124-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-154-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-127-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-128-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-130-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-129-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-131-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-132-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-133-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-134-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-135-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-136-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-137-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-138-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-140-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-141-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/2060-142-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-139-0x0000000000450000-0x00000000004FE000-memory.dmpFilesize
696KB
-
memory/2060-143-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-144-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-145-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-146-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-147-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-148-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-149-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-119-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-151-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-123-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-120-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-122-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-155-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/2060-153-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-121-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3608-207-0x0000000000000000-mapping.dmp
-
memory/3608-319-0x00000000008F6000-0x0000000000920000-memory.dmpFilesize
168KB
-
memory/3608-257-0x0000000004E40000-0x000000000533E000-memory.dmpFilesize
5.0MB
-
memory/3608-276-0x0000000004D70000-0x0000000004DAE000-memory.dmpFilesize
248KB
-
memory/3608-313-0x00000000008F6000-0x0000000000920000-memory.dmpFilesize
168KB
-
memory/3608-312-0x0000000007000000-0x000000000701E000-memory.dmpFilesize
120KB
-
memory/3608-306-0x0000000006930000-0x0000000006E5C000-memory.dmpFilesize
5.2MB
-
memory/3608-305-0x0000000006760000-0x0000000006922000-memory.dmpFilesize
1.8MB
-
memory/3608-304-0x0000000006470000-0x00000000064E6000-memory.dmpFilesize
472KB
-
memory/3608-303-0x0000000006400000-0x0000000006450000-memory.dmpFilesize
320KB
-
memory/3608-252-0x0000000002530000-0x0000000002560000-memory.dmpFilesize
192KB
-
memory/3608-320-0x0000000000400000-0x00000000005A5000-memory.dmpFilesize
1.6MB
-
memory/3608-293-0x0000000005CB0000-0x0000000005D42000-memory.dmpFilesize
584KB
-
memory/3608-295-0x0000000005D50000-0x0000000005DB6000-memory.dmpFilesize
408KB
-
memory/3608-314-0x0000000000710000-0x0000000000747000-memory.dmpFilesize
220KB
-
memory/3608-273-0x0000000005950000-0x0000000005A5A000-memory.dmpFilesize
1.0MB
-
memory/3608-272-0x0000000004D20000-0x0000000004D32000-memory.dmpFilesize
72KB
-
memory/3608-271-0x0000000005340000-0x0000000005946000-memory.dmpFilesize
6.0MB
-
memory/3608-261-0x0000000000400000-0x00000000005A5000-memory.dmpFilesize
1.6MB
-
memory/3608-259-0x00000000026D0000-0x00000000026FE000-memory.dmpFilesize
184KB
-
memory/3608-284-0x0000000004DE0000-0x0000000004E2B000-memory.dmpFilesize
300KB
-
memory/3608-233-0x00000000008F6000-0x0000000000920000-memory.dmpFilesize
168KB
-
memory/3608-234-0x0000000000710000-0x0000000000747000-memory.dmpFilesize
220KB
-
memory/3724-194-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3724-193-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3724-192-0x0000000000000000-mapping.dmp
-
memory/5084-169-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/5084-186-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/5084-187-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/5084-188-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/5084-190-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/5084-189-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/5084-176-0x00000000007E0000-0x000000000092A000-memory.dmpFilesize
1.3MB
-
memory/5084-191-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/5084-204-0x00000000007E0000-0x000000000092A000-memory.dmpFilesize
1.3MB
-
memory/5084-205-0x0000000002430000-0x000000000270B000-memory.dmpFilesize
2.9MB
-
memory/5084-206-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/5084-185-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/5084-184-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/5084-183-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/5084-182-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/5084-181-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/5084-180-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/5084-178-0x0000000002430000-0x000000000270B000-memory.dmpFilesize
2.9MB
-
memory/5084-179-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/5084-177-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/5084-173-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/5084-175-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/5084-174-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/5084-172-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/5084-171-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/5084-170-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/5084-168-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/5084-167-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/5084-164-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/5084-163-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/5084-162-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/5084-161-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/5084-160-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/5084-159-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/5084-158-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/5084-156-0x0000000000000000-mapping.dmp