Analysis
-
max time kernel
156s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20-10-2022 17:38
Static task
static1
Behavioral task
behavioral1
Sample
64ab4ef26c1ba7198236df31bef06dbab47ca17f0abd81823a39d244327ba1ab.exe
Resource
win10v2004-20220812-en
General
-
Target
64ab4ef26c1ba7198236df31bef06dbab47ca17f0abd81823a39d244327ba1ab.exe
-
Size
368KB
-
MD5
d896bb5d82c5b8f7f32cf4bbbd8d58d3
-
SHA1
edd21146086ebd68b4974d75eefe46b81eb91db3
-
SHA256
64ab4ef26c1ba7198236df31bef06dbab47ca17f0abd81823a39d244327ba1ab
-
SHA512
8ddea7f4293ee802c5efee47c5a9168be2c90e21a175546e514c80e769219a5e6e7cc0416468d56c45340986d84b97c264671774e20aec857a4fdc862e66fab8
-
SSDEEP
1536:rrae78zjORCDGwfdCSog01313gs5gcXqr:BahKyd2n31Z5pqr
Malware Config
Extracted
redline
Nigh
80.66.87.20:80
-
auth_value
dab8506635d1dc134af4ebaedf4404eb
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/3556-152-0x0000000000400000-0x0000000000428000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
SETUP_~1.EXENuktvijioppmpfdjkrcwhoprojections_s.exeSETUP_~1.EXESETUP_~1.EXEpid process 4592 SETUP_~1.EXE 4844 Nuktvijioppmpfdjkrcwhoprojections_s.exe 3896 SETUP_~1.EXE 3556 SETUP_~1.EXE -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SETUP_~1.EXENuktvijioppmpfdjkrcwhoprojections_s.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation SETUP_~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Nuktvijioppmpfdjkrcwhoprojections_s.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
64ab4ef26c1ba7198236df31bef06dbab47ca17f0abd81823a39d244327ba1ab.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce 64ab4ef26c1ba7198236df31bef06dbab47ca17f0abd81823a39d244327ba1ab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 64ab4ef26c1ba7198236df31bef06dbab47ca17f0abd81823a39d244327ba1ab.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SETUP_~1.EXEdescription pid process target process PID 4592 set thread context of 3556 4592 SETUP_~1.EXE SETUP_~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exeSETUP_~1.EXEpowershell.exepid process 432 powershell.exe 432 powershell.exe 4592 SETUP_~1.EXE 4592 SETUP_~1.EXE 4124 powershell.exe 4124 powershell.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
SETUP_~1.EXEpowershell.exeNuktvijioppmpfdjkrcwhoprojections_s.exepowershell.exeSETUP_~1.EXEdescription pid process Token: SeDebugPrivilege 4592 SETUP_~1.EXE Token: SeDebugPrivilege 432 powershell.exe Token: SeDebugPrivilege 4844 Nuktvijioppmpfdjkrcwhoprojections_s.exe Token: SeDebugPrivilege 4124 powershell.exe Token: SeDebugPrivilege 3556 SETUP_~1.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
64ab4ef26c1ba7198236df31bef06dbab47ca17f0abd81823a39d244327ba1ab.exeSETUP_~1.EXENuktvijioppmpfdjkrcwhoprojections_s.exedescription pid process target process PID 5032 wrote to memory of 4592 5032 64ab4ef26c1ba7198236df31bef06dbab47ca17f0abd81823a39d244327ba1ab.exe SETUP_~1.EXE PID 5032 wrote to memory of 4592 5032 64ab4ef26c1ba7198236df31bef06dbab47ca17f0abd81823a39d244327ba1ab.exe SETUP_~1.EXE PID 5032 wrote to memory of 4592 5032 64ab4ef26c1ba7198236df31bef06dbab47ca17f0abd81823a39d244327ba1ab.exe SETUP_~1.EXE PID 4592 wrote to memory of 432 4592 SETUP_~1.EXE powershell.exe PID 4592 wrote to memory of 432 4592 SETUP_~1.EXE powershell.exe PID 4592 wrote to memory of 432 4592 SETUP_~1.EXE powershell.exe PID 4592 wrote to memory of 4844 4592 SETUP_~1.EXE Nuktvijioppmpfdjkrcwhoprojections_s.exe PID 4592 wrote to memory of 4844 4592 SETUP_~1.EXE Nuktvijioppmpfdjkrcwhoprojections_s.exe PID 4592 wrote to memory of 3896 4592 SETUP_~1.EXE SETUP_~1.EXE PID 4592 wrote to memory of 3896 4592 SETUP_~1.EXE SETUP_~1.EXE PID 4592 wrote to memory of 3896 4592 SETUP_~1.EXE SETUP_~1.EXE PID 4592 wrote to memory of 3556 4592 SETUP_~1.EXE SETUP_~1.EXE PID 4592 wrote to memory of 3556 4592 SETUP_~1.EXE SETUP_~1.EXE PID 4592 wrote to memory of 3556 4592 SETUP_~1.EXE SETUP_~1.EXE PID 4592 wrote to memory of 3556 4592 SETUP_~1.EXE SETUP_~1.EXE PID 4592 wrote to memory of 3556 4592 SETUP_~1.EXE SETUP_~1.EXE PID 4592 wrote to memory of 3556 4592 SETUP_~1.EXE SETUP_~1.EXE PID 4592 wrote to memory of 3556 4592 SETUP_~1.EXE SETUP_~1.EXE PID 4592 wrote to memory of 3556 4592 SETUP_~1.EXE SETUP_~1.EXE PID 4844 wrote to memory of 4124 4844 Nuktvijioppmpfdjkrcwhoprojections_s.exe powershell.exe PID 4844 wrote to memory of 4124 4844 Nuktvijioppmpfdjkrcwhoprojections_s.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\64ab4ef26c1ba7198236df31bef06dbab47ca17f0abd81823a39d244327ba1ab.exe"C:\Users\Admin\AppData\Local\Temp\64ab4ef26c1ba7198236df31bef06dbab47ca17f0abd81823a39d244327ba1ab.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA1AA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Nuktvijioppmpfdjkrcwhoprojections_s.exe"C:\Users\Admin\AppData\Local\Temp\Nuktvijioppmpfdjkrcwhoprojections_s.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA1AA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SETUP_~1.EXE.logFilesize
1KB
MD5e87e48b105757e1c7563d1c719059733
SHA128a3f2b2e0672da2b531f4757d2b20b53032dafc
SHA2560aaf22dc84cc3fcfe53de7ccfed8e662247dfb7f1a9967032c88790d0c663461
SHA512bf19c5743143aee914a453c41189c722c9b90a5b8bf299cecf3e1f97656d32cd209ecb74da8aebc89bb41c27d189f73aaaabbc64fe383410c95dc76ad4218968
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD506ad34f9739c5159b4d92d702545bd49
SHA19152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA256474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
SHA512c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD516d5029a79300bde0f33b6701c0b27a4
SHA1b36d75aea081ae935305b8bc8c6e1bed9577a7eb
SHA2569a12673ad3e21088111ba698646b30411818b35f3bf2bf716d7250c63de0fab7
SHA51213d15804ac03227133abc4177f5baa832077b3e168e80d68d1d0d4a7e55816f5512b21d9c36313b208f904db6c78f8ee47b15f2f860ddbbd120fbb46fc17242c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEFilesize
214.6MB
MD5baf3b26e5290c2b658e0993ac4bacaf5
SHA1296f6dc637defc0ee638793aac6ed9a09b8f0515
SHA2569214a72501ec76cbc19ee9cace68f48afb864164652be3124a7ab05b9a37d655
SHA5124d7f8623a2af090134d1d3815d53a2980d83f84312458191234a462fdfd69f73fbdf83d8887518a6b6b804b9fb52cff3701a2b99cee9bf9c1bb15e565137d58f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEFilesize
214.6MB
MD5baf3b26e5290c2b658e0993ac4bacaf5
SHA1296f6dc637defc0ee638793aac6ed9a09b8f0515
SHA2569214a72501ec76cbc19ee9cace68f48afb864164652be3124a7ab05b9a37d655
SHA5124d7f8623a2af090134d1d3815d53a2980d83f84312458191234a462fdfd69f73fbdf83d8887518a6b6b804b9fb52cff3701a2b99cee9bf9c1bb15e565137d58f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEFilesize
214.6MB
MD5baf3b26e5290c2b658e0993ac4bacaf5
SHA1296f6dc637defc0ee638793aac6ed9a09b8f0515
SHA2569214a72501ec76cbc19ee9cace68f48afb864164652be3124a7ab05b9a37d655
SHA5124d7f8623a2af090134d1d3815d53a2980d83f84312458191234a462fdfd69f73fbdf83d8887518a6b6b804b9fb52cff3701a2b99cee9bf9c1bb15e565137d58f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEFilesize
214.6MB
MD5baf3b26e5290c2b658e0993ac4bacaf5
SHA1296f6dc637defc0ee638793aac6ed9a09b8f0515
SHA2569214a72501ec76cbc19ee9cace68f48afb864164652be3124a7ab05b9a37d655
SHA5124d7f8623a2af090134d1d3815d53a2980d83f84312458191234a462fdfd69f73fbdf83d8887518a6b6b804b9fb52cff3701a2b99cee9bf9c1bb15e565137d58f
-
C:\Users\Admin\AppData\Local\Temp\Nuktvijioppmpfdjkrcwhoprojections_s.exeFilesize
5KB
MD51478b815565de4723822479760dd551a
SHA14ec2ed62384a8d15dc56073cd0791cf711355404
SHA25632698160fed7ce9defc0775cbcf932d14ce9c11ee4ce63232b852e0f32e87a1f
SHA512116040b609402ef26a53c9e6eb5866e584f0e35c47db110f97f38cebfd1a4287ed7069f3459f6bb3ef40637cea65d99410703c46dcc228313772c20c0bd5f315
-
C:\Users\Admin\AppData\Local\Temp\Nuktvijioppmpfdjkrcwhoprojections_s.exeFilesize
5KB
MD51478b815565de4723822479760dd551a
SHA14ec2ed62384a8d15dc56073cd0791cf711355404
SHA25632698160fed7ce9defc0775cbcf932d14ce9c11ee4ce63232b852e0f32e87a1f
SHA512116040b609402ef26a53c9e6eb5866e584f0e35c47db110f97f38cebfd1a4287ed7069f3459f6bb3ef40637cea65d99410703c46dcc228313772c20c0bd5f315
-
memory/432-138-0x0000000002A60000-0x0000000002A96000-memory.dmpFilesize
216KB
-
memory/432-141-0x0000000005190000-0x00000000051F6000-memory.dmpFilesize
408KB
-
memory/432-142-0x0000000004DE0000-0x0000000004DFE000-memory.dmpFilesize
120KB
-
memory/432-143-0x0000000007870000-0x0000000007EEA000-memory.dmpFilesize
6.5MB
-
memory/432-144-0x0000000006540000-0x000000000655A000-memory.dmpFilesize
104KB
-
memory/432-140-0x0000000005120000-0x0000000005186000-memory.dmpFilesize
408KB
-
memory/432-139-0x0000000005300000-0x0000000005928000-memory.dmpFilesize
6.2MB
-
memory/432-137-0x0000000000000000-mapping.dmp
-
memory/3556-160-0x0000000005780000-0x00000000057BC000-memory.dmpFilesize
240KB
-
memory/3556-151-0x0000000000000000-mapping.dmp
-
memory/3556-152-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3556-157-0x0000000005D60000-0x0000000006378000-memory.dmpFilesize
6.1MB
-
memory/3556-159-0x00000000033A0000-0x00000000033B2000-memory.dmpFilesize
72KB
-
memory/3556-158-0x0000000005850000-0x000000000595A000-memory.dmpFilesize
1.0MB
-
memory/3896-149-0x0000000000000000-mapping.dmp
-
memory/4124-166-0x00007FF87D520000-0x00007FF87DFE1000-memory.dmpFilesize
10.8MB
-
memory/4124-165-0x00007FF87D520000-0x00007FF87DFE1000-memory.dmpFilesize
10.8MB
-
memory/4124-161-0x0000000000000000-mapping.dmp
-
memory/4592-135-0x0000000000C30000-0x0000000000C38000-memory.dmpFilesize
32KB
-
memory/4592-136-0x00000000061A0000-0x00000000061C2000-memory.dmpFilesize
136KB
-
memory/4592-132-0x0000000000000000-mapping.dmp
-
memory/4844-148-0x0000000000570000-0x0000000000576000-memory.dmpFilesize
24KB
-
memory/4844-162-0x00007FF87D520000-0x00007FF87DFE1000-memory.dmpFilesize
10.8MB
-
memory/4844-156-0x000000001C7A0000-0x000000001C7C2000-memory.dmpFilesize
136KB
-
memory/4844-155-0x00007FF87D520000-0x00007FF87DFE1000-memory.dmpFilesize
10.8MB
-
memory/4844-145-0x0000000000000000-mapping.dmp