redline | fddc8f5a6d7dd5a4bab21291d07cf528e940bf138d53c70eadaf97152282b734

General

Target

file.exe
Size

724KB
MD5

06469b7e7904c634cdab3d3fe18a9ad3
SHA1

bbeb65a0bd4bbf7a87e0303aee2d9a3dd7c69ef7
SHA256

fddc8f5a6d7dd5a4bab21291d07cf528e940bf138d53c70eadaf97152282b734
SHA512

3bcd23caa950b8fb06b9543de154a43263e125487bb3e033ad19f8ab66392cb5c6426b6b7f06080342ec0448a5578c1567d60366d976c3f0624627f3a087671e
SSDEEP

12288:qQBRuwkLNx0mf0ZjwQsn7uFURmtEif3w74COR0oq7yGOVVuyUq0SWo0MLoimPMFP:qQBRtkLNx0I0Z9EivwECORR8Bo0MLQEp

Score

10^/10

redline logsdiller cloud (tg: @logsdillabot)infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

51.89.201.21:7161

Attributes

auth_value
3a050df92d0cf082b2cdaf87863616be

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1472-56-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral1/memory/1472-61-0x000000000042218E-mapping.dmp	family_redline
behavioral1/memory/1116-63-0x0000000000140000-0x00000000001F8000-memory.dmp	family_redline
behavioral1/memory/1472-64-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral1/memory/1472-62-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline

Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

setu2p.exe

pid process

768 setu2p.exe
Loads dropped DLL 1 IoCs

Processes:

RegSvcs.exe

pid process

1472 RegSvcs.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
768	setu2p.exe

pid	process
1472	RegSvcs.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

file.exesetu2p.exe

description	pid	process	target process
PID 1116 set thread context of 1472	1116	file.exe	RegSvcs.exe
PID 768 set thread context of 1040	768	setu2p.exe	RegSvcs.exe

Modifies Internet Explorer settings 1 TTPs 46 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\bestrealprizes.life\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "16"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\bestrealprizes.life\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\bestrealprizes.life	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A04A1501-5494-11ED-9F1A-42A98B637845} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 603abe6aa1e8d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\bestrealprizes.life\ = "16"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf000000000200000000001066000000010000200000003028c6797c2f891768c0314b7e7164781a506fa1a30aa3c7de6aa6e7e876d1b9000000000e80000000020000200000008e155d99b5365fdda9594e2529d585710ddb1b7c8ef5a72922c2cd426aa1d2a720000000a7a8a78d60069e264880786bc1ff97ad6892f0ab543ff6d79975ed0c19fac99b400000008acdabbcc29de89f9ad1c26c38edbf5d8066e3811c2565a84249c9dd988ee6114b3c3be3a567a0805ce0fb6a7639e74cf25d3af431d25c0b93e590e03c8f3490	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\bestrealprizes.life\Total = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "373488259"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\bestrealprizes.life\Total = "16"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf00000000020000000000106600000001000020000000e340ed922f2b5119f9ba1c4703c24d5c023f8b91e4d4f0f171e1ff098a99b188000000000e800000000200002000000050ef7253ccd543c95f89150574253781406d467e201b73b9e6f40469c19e8ee890000000321f081f4c4386a9aafda6256281481f5cd033b76bd6076355db3feb702d32ec8628785354751b3b216af7cccedf9ca7fb11f511a240c4e0c2e306e62e91d558d3da9480389fc4103659c61a12867dd22ea9ae884bb24c1b56486e6038d9c12f8fa991f4c2357e040fdf2e7b52850b2f4a91ad65055464f77d9672360d9507c873552b824822599992595cc1966e881d40000000d7108ede3e9eb0758ccb9a8e17afd8dc80b0e890b2c923effb7568cf6864ae101ca23c314e9286d064a4ee328354b8a60cf23fb7cd26087430b654abccc17990	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

1472 RegSvcs.exe
1472 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 1472 RegSvcs.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

932 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

932 iexplore.exe
932 iexplore.exe
1748 IEXPLORE.EXE
1748 IEXPLORE.EXE
1748 IEXPLORE.EXE
1748 IEXPLORE.EXE

pid	process
1472	RegSvcs.exe
1472	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1472	RegSvcs.exe

pid	process
932	iexplore.exe

pid	process
932	iexplore.exe
932	iexplore.exe
1748	IEXPLORE.EXE
1748	IEXPLORE.EXE
1748	IEXPLORE.EXE
1748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

file.exeRegSvcs.exeiexplore.exesetu2p.exe

description	pid	process	target process
PID 1116 wrote to memory of 1472	1116	file.exe	RegSvcs.exe
PID 1116 wrote to memory of 1472	1116	file.exe	RegSvcs.exe
PID 1116 wrote to memory of 1472	1116	file.exe	RegSvcs.exe
PID 1116 wrote to memory of 1472	1116	file.exe	RegSvcs.exe
PID 1116 wrote to memory of 1472	1116	file.exe	RegSvcs.exe
PID 1116 wrote to memory of 1472	1116	file.exe	RegSvcs.exe
PID 1116 wrote to memory of 1472	1116	file.exe	RegSvcs.exe
PID 1116 wrote to memory of 1472	1116	file.exe	RegSvcs.exe
PID 1116 wrote to memory of 1472	1116	file.exe	RegSvcs.exe
PID 1472 wrote to memory of 932	1472	RegSvcs.exe	iexplore.exe
PID 1472 wrote to memory of 932	1472	RegSvcs.exe	iexplore.exe
PID 1472 wrote to memory of 932	1472	RegSvcs.exe	iexplore.exe
PID 1472 wrote to memory of 932	1472	RegSvcs.exe	iexplore.exe
PID 932 wrote to memory of 1748	932	iexplore.exe	IEXPLORE.EXE
PID 932 wrote to memory of 1748	932	iexplore.exe	IEXPLORE.EXE
PID 932 wrote to memory of 1748	932	iexplore.exe	IEXPLORE.EXE
PID 932 wrote to memory of 1748	932	iexplore.exe	IEXPLORE.EXE
PID 1472 wrote to memory of 768	1472	RegSvcs.exe	setu2p.exe
PID 1472 wrote to memory of 768	1472	RegSvcs.exe	setu2p.exe
PID 1472 wrote to memory of 768	1472	RegSvcs.exe	setu2p.exe
PID 1472 wrote to memory of 768	1472	RegSvcs.exe	setu2p.exe
PID 768 wrote to memory of 1040	768	setu2p.exe	RegSvcs.exe
PID 768 wrote to memory of 1040	768	setu2p.exe	RegSvcs.exe
PID 768 wrote to memory of 1040	768	setu2p.exe	RegSvcs.exe
PID 768 wrote to memory of 1040	768	setu2p.exe	RegSvcs.exe
PID 768 wrote to memory of 1040	768	setu2p.exe	RegSvcs.exe
PID 768 wrote to memory of 1040	768	setu2p.exe	RegSvcs.exe
PID 768 wrote to memory of 1040	768	setu2p.exe	RegSvcs.exe
PID 768 wrote to memory of 1040	768	setu2p.exe	RegSvcs.exe
PID 768 wrote to memory of 1040	768	setu2p.exe	RegSvcs.exe
PID 768 wrote to memory of 1040	768	setu2p.exe	RegSvcs.exe
PID 768 wrote to memory of 1040	768	setu2p.exe	RegSvcs.exe
PID 768 wrote to memory of 1040	768	setu2p.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1116

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1472

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://bestrealprizes.life/?u=lq1pd08&o=hdck0gl
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:932

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:932 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1748

C:\Users\Admin\AppData\Local\Temp\setu2p.exe
"C:\Users\Admin\AppData\Local\Temp\setu2p.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:768

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
4⤵
PID:1040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
60KB

MD5
d15aaa7c9be910a9898260767e2490e1

SHA1
2090c53f8d9fc3fbdbafd3a1e4dc25520eb74388

SHA256
f8ebaaf487cba0c81a17c8cd680bdd2dd8e90d2114ecc54844cffc0cc647848e

SHA512
7e1c1a683914b961b5cc2fe5e4ae288b60bab43bfaa21ce4972772aa0589615c19f57e672e1d93e50a7ed7b76fbd2f1b421089dcaed277120b93f8e91b18af94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
e61d902729e889069cf5ea6dbe231b9c

SHA1
f8f0f164839f1ca2c20094dbe328e5906b038860

SHA256
db74a0f0550c7524435c7d8d9df4ba4fccfc9e2456dc82fb6a28117173f834d6

SHA512
73489ee2d3e5a534a7685458679cf622b8c6d6a30c194ef37d774f113fa1c190b2a4b9d7559b7acf81fb57b24d1c2a279a17c39e9a0c0cd7da44efc7efdf74f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
894a366bcce56733eeba3f3272036955

SHA1
db00b73a802de37bb6d9c9e785ffc73af7841391

SHA256
300a0ec0e4fe450a39e4cd376626bf3fa0cccd67302da59abb317bb5fdea4177

SHA512
fb0c6dc2bcd90d760586065f6291eb47fd4ed7740ceb6e326ac070fa6a062e4e40978d002938e5b988cd0ab7aef00f08aef5349b78c99c790da6f58ee77518cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
f8ef649f23d91afae4297c2f64b6932e

SHA1
0dc4c00ec55c796e298aabb42218f32aa6be1074

SHA256
9b63cad6afb61ced5c9b9b25cd296443c4017b528b05d9c961b98bf65e323ae8

SHA512
9e5a409a1bd0adcfab15f8da9b451f93813bc0d57b6404ec5542226471bbc26a2143dc299fa6800b34ab05372625d9d07aec033b8a0d1c2a853d7b84181aa0dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\setu2p.exe
Filesize
344KB

MD5
95230f05deb43f0adc402b128e331a9f

SHA1
2f732066b25f6c38b6d34d8cd5230cb0105aac9b

SHA256
feab1a440d731ecca4c1c09f3a6d5c0207816eb77967fa0396fbcf16d059fdfb

SHA512
9fb99707ecb76268c6319b6f791fbb98b03e6fb86e26187c484df9c4cb2a255a7688aa5878b27c8c7ac2f31ddb44c36db2093002e0f01532862fb6753ebf662f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\P8NYOF0B.txt
Filesize
608B

MD5
287d2aca4bbad71da084abdfe857d9dc

SHA1
1ba1eea8438dfe1afec664354e9a194ec72496a8

SHA256
4b479cd7f56e04263f66dcf7b7bb81b679150cc99c6530f7adc6cc1d63d648a3

SHA512
787d5287fafb5556ddd16c8ee6c30c750e1a4f9a29f5814e8ac814e89436814aadb5d7540548310ce010b6f4b71bd6b92f5061acd22d6c4cd3a0f9940c8b2f20

Download Submit
\Users\Admin\AppData\Local\Temp\setu2p.exe
Filesize
344KB

MD5
95230f05deb43f0adc402b128e331a9f

SHA1
2f732066b25f6c38b6d34d8cd5230cb0105aac9b

SHA256
feab1a440d731ecca4c1c09f3a6d5c0207816eb77967fa0396fbcf16d059fdfb

SHA512
9fb99707ecb76268c6319b6f791fbb98b03e6fb86e26187c484df9c4cb2a255a7688aa5878b27c8c7ac2f31ddb44c36db2093002e0f01532862fb6753ebf662f

Download Submit
memory/768-67-0x0000000000000000-mapping.dmp

Download
memory/1040-75-0x0000000140000000-0x0000000140022000-memory.dmp

Filesize
136KB

Download
memory/1040-78-0x0000000140000000-0x0000000140022000-memory.dmp

Filesize
136KB

Download
memory/1040-70-0x0000000140000000-0x0000000140022000-memory.dmp

Filesize
136KB

Download
memory/1040-72-0x0000000140000000-0x0000000140022000-memory.dmp

Filesize
136KB

Download
memory/1040-74-0x0000000140000000-0x0000000140022000-memory.dmp

Filesize
136KB

Download
memory/1040-69-0x0000000140000000-0x0000000140022000-memory.dmp

Filesize
136KB

Download
memory/1040-77-0x0000000140000000-0x0000000140022000-memory.dmp

Filesize
136KB

Download
memory/1040-88-0x000007FEFB801000-0x000007FEFB803000-memory.dmp

Filesize
8KB

Download
memory/1040-79-0x0000000140000000-0x0000000140022000-memory.dmp

Filesize
136KB

Download
memory/1040-80-0x0000000140000000-0x0000000140022000-memory.dmp

Filesize
136KB

Download
memory/1040-81-0x0000000140003E0C-mapping.dmp

Download
memory/1040-83-0x0000000140000000-0x0000000140022000-memory.dmp

Filesize
136KB

Download
memory/1040-84-0x0000000140000000-0x0000000140022000-memory.dmp

Filesize
136KB

Download
memory/1116-63-0x0000000000140000-0x00000000001F8000-memory.dmp

Filesize
736KB

Download
memory/1472-54-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1472-64-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1472-62-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1472-65-0x0000000074D61000-0x0000000074D63000-memory.dmp

Filesize
8KB

Download
memory/1472-61-0x000000000042218E-mapping.dmp

Download
memory/1472-56-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads