Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-11-2022 00:32

General

  • Target

    file.exe

  • Size

    251KB

  • MD5

    9200f1ce034123708f20d0ec5e3fe24c

  • SHA1

    2f155571b16a04df0586ccdad0aa9d0f88cabc63

  • SHA256

    4d75f10d3bc192a274ec9a8b1109dbe14c8af8e00e5f060a7f85100a6d1ac4cb

  • SHA512

    3ef49149de93d9f19ee4b238ab42890dd71ed90ec2cd401ae68f0c72f586991288b236ccd2ebb6c835ae648e2745e33643006c967abf5afe38b72e9c7ca3f820

  • SSDEEP

    6144:t+V0uXaO4xLJF81mJy9Il9C9lnLuUUtqFXg:t+V0uXaO4xlF81riCHLuU9e

Malware Config

Extracted

Family

redline

Botnet

boy

C2

77.73.134.241:4691

Attributes
  • auth_value

    a91fa8cc2cfaefc42a23c03faef44bd3

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detect Amadey credential stealer module 4 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1524
    • C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
      "C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3088
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe" /F
        3⤵
        • Creates scheduled task(s)
        PID:3684
      • C:\Users\Admin\AppData\Local\Temp\1000003001\mana.exe
        "C:\Users\Admin\AppData\Local\Temp\1000003001\mana.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4560
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll, Main
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • outlook_win_path
        PID:4784
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 1136
      2⤵
      • Program crash
      PID:4948
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1524 -ip 1524
    1⤵
      PID:4932
    • C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
      C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
      1⤵
      • Executes dropped EXE
      PID:2248
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 416
        2⤵
        • Program crash
        PID:4084
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2248 -ip 2248
      1⤵
        PID:432
      • C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
        C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
        1⤵
        • Executes dropped EXE
        PID:3856
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 220
          2⤵
          • Program crash
          PID:4984
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3856 -ip 3856
        1⤵
          PID:2348

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Execution

        Scheduled Task

        1
        T1053

        Persistence

        Registry Run Keys / Startup Folder

        1
        T1060

        Scheduled Task

        1
        T1053

        Privilege Escalation

        Scheduled Task

        1
        T1053

        Defense Evasion

        Modify Registry

        1
        T1112

        Credential Access

        Credentials in Files

        3
        T1081

        Discovery

        Query Registry

        2
        T1012

        System Information Discovery

        2
        T1082

        Collection

        Data from Local System

        3
        T1005

        Email Collection

        1
        T1114

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\1000003001\mana.exe
          Filesize

          137KB

          MD5

          e63d74cec6926b2d04e474b889d08af4

          SHA1

          a64a888ccfb4e82ade71f1a00a7ae681d29c7bcb

          SHA256

          a9ffffff38aca59d7d2f041fbdb253ca612c7ba2d597782b2e6a59a914f49b33

          SHA512

          fd59c0a1c613611002e52a309ee4baad626df8fbbd8c0c230bcb8e6fed4a3059296ab11b88a1d25a0f54c65f730a027f876629298120f7b4c251bf6d2aaed148

        • C:\Users\Admin\AppData\Local\Temp\1000003001\mana.exe
          Filesize

          137KB

          MD5

          e63d74cec6926b2d04e474b889d08af4

          SHA1

          a64a888ccfb4e82ade71f1a00a7ae681d29c7bcb

          SHA256

          a9ffffff38aca59d7d2f041fbdb253ca612c7ba2d597782b2e6a59a914f49b33

          SHA512

          fd59c0a1c613611002e52a309ee4baad626df8fbbd8c0c230bcb8e6fed4a3059296ab11b88a1d25a0f54c65f730a027f876629298120f7b4c251bf6d2aaed148

        • C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
          Filesize

          251KB

          MD5

          9200f1ce034123708f20d0ec5e3fe24c

          SHA1

          2f155571b16a04df0586ccdad0aa9d0f88cabc63

          SHA256

          4d75f10d3bc192a274ec9a8b1109dbe14c8af8e00e5f060a7f85100a6d1ac4cb

          SHA512

          3ef49149de93d9f19ee4b238ab42890dd71ed90ec2cd401ae68f0c72f586991288b236ccd2ebb6c835ae648e2745e33643006c967abf5afe38b72e9c7ca3f820

        • C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
          Filesize

          251KB

          MD5

          9200f1ce034123708f20d0ec5e3fe24c

          SHA1

          2f155571b16a04df0586ccdad0aa9d0f88cabc63

          SHA256

          4d75f10d3bc192a274ec9a8b1109dbe14c8af8e00e5f060a7f85100a6d1ac4cb

          SHA512

          3ef49149de93d9f19ee4b238ab42890dd71ed90ec2cd401ae68f0c72f586991288b236ccd2ebb6c835ae648e2745e33643006c967abf5afe38b72e9c7ca3f820

        • C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
          Filesize

          251KB

          MD5

          9200f1ce034123708f20d0ec5e3fe24c

          SHA1

          2f155571b16a04df0586ccdad0aa9d0f88cabc63

          SHA256

          4d75f10d3bc192a274ec9a8b1109dbe14c8af8e00e5f060a7f85100a6d1ac4cb

          SHA512

          3ef49149de93d9f19ee4b238ab42890dd71ed90ec2cd401ae68f0c72f586991288b236ccd2ebb6c835ae648e2745e33643006c967abf5afe38b72e9c7ca3f820

        • C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
          Filesize

          251KB

          MD5

          9200f1ce034123708f20d0ec5e3fe24c

          SHA1

          2f155571b16a04df0586ccdad0aa9d0f88cabc63

          SHA256

          4d75f10d3bc192a274ec9a8b1109dbe14c8af8e00e5f060a7f85100a6d1ac4cb

          SHA512

          3ef49149de93d9f19ee4b238ab42890dd71ed90ec2cd401ae68f0c72f586991288b236ccd2ebb6c835ae648e2745e33643006c967abf5afe38b72e9c7ca3f820

        • C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll
          Filesize

          126KB

          MD5

          b8d80046e28849a320a3dcd868b73d7c

          SHA1

          f15bc4a4c5189e7aa845213469c6def5afd68186

          SHA256

          d23147a448d24f81d81d4bb226f3fc968386792c0987dda75917104b5ecd9d5a

          SHA512

          b7f6d59ee55d2b579c2185560d2e660c1952f9214f3db3096b1358af3559fd985859aa3389be333c826f35b85cd63c6f65a03e65a7ad57c7834bb09abd1d853e

        • C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll
          Filesize

          126KB

          MD5

          b8d80046e28849a320a3dcd868b73d7c

          SHA1

          f15bc4a4c5189e7aa845213469c6def5afd68186

          SHA256

          d23147a448d24f81d81d4bb226f3fc968386792c0987dda75917104b5ecd9d5a

          SHA512

          b7f6d59ee55d2b579c2185560d2e660c1952f9214f3db3096b1358af3559fd985859aa3389be333c826f35b85cd63c6f65a03e65a7ad57c7834bb09abd1d853e

        • C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll
          Filesize

          126KB

          MD5

          b8d80046e28849a320a3dcd868b73d7c

          SHA1

          f15bc4a4c5189e7aa845213469c6def5afd68186

          SHA256

          d23147a448d24f81d81d4bb226f3fc968386792c0987dda75917104b5ecd9d5a

          SHA512

          b7f6d59ee55d2b579c2185560d2e660c1952f9214f3db3096b1358af3559fd985859aa3389be333c826f35b85cd63c6f65a03e65a7ad57c7834bb09abd1d853e

        • memory/1524-136-0x0000000000730000-0x000000000076E000-memory.dmp
          Filesize

          248KB

        • memory/1524-137-0x0000000000400000-0x000000000059A000-memory.dmp
          Filesize

          1.6MB

        • memory/1524-135-0x00000000007B9000-0x00000000007D8000-memory.dmp
          Filesize

          124KB

        • memory/2248-164-0x0000000000400000-0x000000000059A000-memory.dmp
          Filesize

          1.6MB

        • memory/2248-163-0x000000000083C000-0x000000000085B000-memory.dmp
          Filesize

          124KB

        • memory/3088-140-0x0000000000400000-0x000000000059A000-memory.dmp
          Filesize

          1.6MB

        • memory/3088-139-0x00000000005D8000-0x00000000005F7000-memory.dmp
          Filesize

          124KB

        • memory/3088-156-0x0000000000400000-0x000000000059A000-memory.dmp
          Filesize

          1.6MB

        • memory/3088-132-0x0000000000000000-mapping.dmp
        • memory/3684-138-0x0000000000000000-mapping.dmp
        • memory/3856-167-0x0000000000400000-0x000000000059A000-memory.dmp
          Filesize

          1.6MB

        • memory/3856-166-0x000000000080C000-0x000000000082B000-memory.dmp
          Filesize

          124KB

        • memory/4560-141-0x0000000000000000-mapping.dmp
        • memory/4560-148-0x0000000005930000-0x000000000596C000-memory.dmp
          Filesize

          240KB

        • memory/4560-155-0x0000000007970000-0x0000000007E9C000-memory.dmp
          Filesize

          5.2MB

        • memory/4560-153-0x00000000069A0000-0x00000000069F0000-memory.dmp
          Filesize

          320KB

        • memory/4560-144-0x0000000000F20000-0x0000000000F48000-memory.dmp
          Filesize

          160KB

        • memory/4560-152-0x0000000006920000-0x0000000006996000-memory.dmp
          Filesize

          472KB

        • memory/4560-151-0x0000000005D40000-0x0000000005DA6000-memory.dmp
          Filesize

          408KB

        • memory/4560-150-0x00000000069F0000-0x0000000006F94000-memory.dmp
          Filesize

          5.6MB

        • memory/4560-145-0x0000000005E20000-0x0000000006438000-memory.dmp
          Filesize

          6.1MB

        • memory/4560-149-0x0000000005CA0000-0x0000000005D32000-memory.dmp
          Filesize

          584KB

        • memory/4560-154-0x0000000007270000-0x0000000007432000-memory.dmp
          Filesize

          1.8MB

        • memory/4560-147-0x00000000058D0000-0x00000000058E2000-memory.dmp
          Filesize

          72KB

        • memory/4560-146-0x00000000059A0000-0x0000000005AAA000-memory.dmp
          Filesize

          1.0MB

        • memory/4784-161-0x00000000006E0000-0x0000000000704000-memory.dmp
          Filesize

          144KB

        • memory/4784-157-0x0000000000000000-mapping.dmp