Analysis

  • max time kernel
    115s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    12-11-2022 00:32

General

  • Target

    file.exe

  • Size

    251KB

  • MD5

    9200f1ce034123708f20d0ec5e3fe24c

  • SHA1

    2f155571b16a04df0586ccdad0aa9d0f88cabc63

  • SHA256

    4d75f10d3bc192a274ec9a8b1109dbe14c8af8e00e5f060a7f85100a6d1ac4cb

  • SHA512

    3ef49149de93d9f19ee4b238ab42890dd71ed90ec2cd401ae68f0c72f586991288b236ccd2ebb6c835ae648e2745e33643006c967abf5afe38b72e9c7ca3f820

  • SSDEEP

    6144:t+V0uXaO4xLJF81mJy9Il9C9lnLuUUtqFXg:t+V0uXaO4xlF81riCHLuU9e

Malware Config

Extracted

Family

redline

Botnet

boy

C2

77.73.134.241:4691

Attributes
  • auth_value

    a91fa8cc2cfaefc42a23c03faef44bd3

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detect Amadey credential stealer module 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 4 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1204
    • C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
      "C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1088
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe" /F
        3⤵
        • Creates scheduled task(s)
        PID:580
      • C:\Users\Admin\AppData\Local\Temp\1000003001\mana.exe
        "C:\Users\Admin\AppData\Local\Temp\1000003001\mana.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2020
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll, Main
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • outlook_win_path
        PID:436
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {D1CE7A3D-81D5-4106-A422-9F8620A80205} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1668
    • C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
      C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
      2⤵
      • Executes dropped EXE
      PID:912
    • C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
      C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
      2⤵
      • Executes dropped EXE
      PID:1340

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\1000003001\mana.exe
    Filesize

    137KB

    MD5

    e63d74cec6926b2d04e474b889d08af4

    SHA1

    a64a888ccfb4e82ade71f1a00a7ae681d29c7bcb

    SHA256

    a9ffffff38aca59d7d2f041fbdb253ca612c7ba2d597782b2e6a59a914f49b33

    SHA512

    fd59c0a1c613611002e52a309ee4baad626df8fbbd8c0c230bcb8e6fed4a3059296ab11b88a1d25a0f54c65f730a027f876629298120f7b4c251bf6d2aaed148

  • C:\Users\Admin\AppData\Local\Temp\1000003001\mana.exe
    Filesize

    137KB

    MD5

    e63d74cec6926b2d04e474b889d08af4

    SHA1

    a64a888ccfb4e82ade71f1a00a7ae681d29c7bcb

    SHA256

    a9ffffff38aca59d7d2f041fbdb253ca612c7ba2d597782b2e6a59a914f49b33

    SHA512

    fd59c0a1c613611002e52a309ee4baad626df8fbbd8c0c230bcb8e6fed4a3059296ab11b88a1d25a0f54c65f730a027f876629298120f7b4c251bf6d2aaed148

  • C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
    Filesize

    251KB

    MD5

    9200f1ce034123708f20d0ec5e3fe24c

    SHA1

    2f155571b16a04df0586ccdad0aa9d0f88cabc63

    SHA256

    4d75f10d3bc192a274ec9a8b1109dbe14c8af8e00e5f060a7f85100a6d1ac4cb

    SHA512

    3ef49149de93d9f19ee4b238ab42890dd71ed90ec2cd401ae68f0c72f586991288b236ccd2ebb6c835ae648e2745e33643006c967abf5afe38b72e9c7ca3f820

  • C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
    Filesize

    251KB

    MD5

    9200f1ce034123708f20d0ec5e3fe24c

    SHA1

    2f155571b16a04df0586ccdad0aa9d0f88cabc63

    SHA256

    4d75f10d3bc192a274ec9a8b1109dbe14c8af8e00e5f060a7f85100a6d1ac4cb

    SHA512

    3ef49149de93d9f19ee4b238ab42890dd71ed90ec2cd401ae68f0c72f586991288b236ccd2ebb6c835ae648e2745e33643006c967abf5afe38b72e9c7ca3f820

  • C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
    Filesize

    251KB

    MD5

    9200f1ce034123708f20d0ec5e3fe24c

    SHA1

    2f155571b16a04df0586ccdad0aa9d0f88cabc63

    SHA256

    4d75f10d3bc192a274ec9a8b1109dbe14c8af8e00e5f060a7f85100a6d1ac4cb

    SHA512

    3ef49149de93d9f19ee4b238ab42890dd71ed90ec2cd401ae68f0c72f586991288b236ccd2ebb6c835ae648e2745e33643006c967abf5afe38b72e9c7ca3f820

  • C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
    Filesize

    251KB

    MD5

    9200f1ce034123708f20d0ec5e3fe24c

    SHA1

    2f155571b16a04df0586ccdad0aa9d0f88cabc63

    SHA256

    4d75f10d3bc192a274ec9a8b1109dbe14c8af8e00e5f060a7f85100a6d1ac4cb

    SHA512

    3ef49149de93d9f19ee4b238ab42890dd71ed90ec2cd401ae68f0c72f586991288b236ccd2ebb6c835ae648e2745e33643006c967abf5afe38b72e9c7ca3f820

  • C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll
    Filesize

    126KB

    MD5

    b8d80046e28849a320a3dcd868b73d7c

    SHA1

    f15bc4a4c5189e7aa845213469c6def5afd68186

    SHA256

    d23147a448d24f81d81d4bb226f3fc968386792c0987dda75917104b5ecd9d5a

    SHA512

    b7f6d59ee55d2b579c2185560d2e660c1952f9214f3db3096b1358af3559fd985859aa3389be333c826f35b85cd63c6f65a03e65a7ad57c7834bb09abd1d853e

  • \Users\Admin\AppData\Local\Temp\1000003001\mana.exe
    Filesize

    137KB

    MD5

    e63d74cec6926b2d04e474b889d08af4

    SHA1

    a64a888ccfb4e82ade71f1a00a7ae681d29c7bcb

    SHA256

    a9ffffff38aca59d7d2f041fbdb253ca612c7ba2d597782b2e6a59a914f49b33

    SHA512

    fd59c0a1c613611002e52a309ee4baad626df8fbbd8c0c230bcb8e6fed4a3059296ab11b88a1d25a0f54c65f730a027f876629298120f7b4c251bf6d2aaed148

  • \Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
    Filesize

    251KB

    MD5

    9200f1ce034123708f20d0ec5e3fe24c

    SHA1

    2f155571b16a04df0586ccdad0aa9d0f88cabc63

    SHA256

    4d75f10d3bc192a274ec9a8b1109dbe14c8af8e00e5f060a7f85100a6d1ac4cb

    SHA512

    3ef49149de93d9f19ee4b238ab42890dd71ed90ec2cd401ae68f0c72f586991288b236ccd2ebb6c835ae648e2745e33643006c967abf5afe38b72e9c7ca3f820

  • \Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
    Filesize

    251KB

    MD5

    9200f1ce034123708f20d0ec5e3fe24c

    SHA1

    2f155571b16a04df0586ccdad0aa9d0f88cabc63

    SHA256

    4d75f10d3bc192a274ec9a8b1109dbe14c8af8e00e5f060a7f85100a6d1ac4cb

    SHA512

    3ef49149de93d9f19ee4b238ab42890dd71ed90ec2cd401ae68f0c72f586991288b236ccd2ebb6c835ae648e2745e33643006c967abf5afe38b72e9c7ca3f820

  • \Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll
    Filesize

    126KB

    MD5

    b8d80046e28849a320a3dcd868b73d7c

    SHA1

    f15bc4a4c5189e7aa845213469c6def5afd68186

    SHA256

    d23147a448d24f81d81d4bb226f3fc968386792c0987dda75917104b5ecd9d5a

    SHA512

    b7f6d59ee55d2b579c2185560d2e660c1952f9214f3db3096b1358af3559fd985859aa3389be333c826f35b85cd63c6f65a03e65a7ad57c7834bb09abd1d853e

  • \Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll
    Filesize

    126KB

    MD5

    b8d80046e28849a320a3dcd868b73d7c

    SHA1

    f15bc4a4c5189e7aa845213469c6def5afd68186

    SHA256

    d23147a448d24f81d81d4bb226f3fc968386792c0987dda75917104b5ecd9d5a

    SHA512

    b7f6d59ee55d2b579c2185560d2e660c1952f9214f3db3096b1358af3559fd985859aa3389be333c826f35b85cd63c6f65a03e65a7ad57c7834bb09abd1d853e

  • \Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll
    Filesize

    126KB

    MD5

    b8d80046e28849a320a3dcd868b73d7c

    SHA1

    f15bc4a4c5189e7aa845213469c6def5afd68186

    SHA256

    d23147a448d24f81d81d4bb226f3fc968386792c0987dda75917104b5ecd9d5a

    SHA512

    b7f6d59ee55d2b579c2185560d2e660c1952f9214f3db3096b1358af3559fd985859aa3389be333c826f35b85cd63c6f65a03e65a7ad57c7834bb09abd1d853e

  • \Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll
    Filesize

    126KB

    MD5

    b8d80046e28849a320a3dcd868b73d7c

    SHA1

    f15bc4a4c5189e7aa845213469c6def5afd68186

    SHA256

    d23147a448d24f81d81d4bb226f3fc968386792c0987dda75917104b5ecd9d5a

    SHA512

    b7f6d59ee55d2b579c2185560d2e660c1952f9214f3db3096b1358af3559fd985859aa3389be333c826f35b85cd63c6f65a03e65a7ad57c7834bb09abd1d853e

  • memory/436-81-0x00000000004E0000-0x0000000000504000-memory.dmp
    Filesize

    144KB

  • memory/436-74-0x0000000000000000-mapping.dmp
  • memory/580-63-0x0000000000000000-mapping.dmp
  • memory/912-82-0x0000000000000000-mapping.dmp
  • memory/912-86-0x0000000000400000-0x000000000059A000-memory.dmp
    Filesize

    1.6MB

  • memory/912-85-0x00000000002CB000-0x00000000002EA000-memory.dmp
    Filesize

    124KB

  • memory/1088-65-0x000000000030B000-0x000000000032A000-memory.dmp
    Filesize

    124KB

  • memory/1088-73-0x0000000000400000-0x000000000059A000-memory.dmp
    Filesize

    1.6MB

  • memory/1088-66-0x0000000000400000-0x000000000059A000-memory.dmp
    Filesize

    1.6MB

  • memory/1088-57-0x0000000000000000-mapping.dmp
  • memory/1204-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmp
    Filesize

    8KB

  • memory/1204-61-0x0000000000400000-0x000000000059A000-memory.dmp
    Filesize

    1.6MB

  • memory/1204-60-0x0000000000220000-0x000000000025E000-memory.dmp
    Filesize

    248KB

  • memory/1204-59-0x000000000075B000-0x000000000077A000-memory.dmp
    Filesize

    124KB

  • memory/1340-87-0x0000000000000000-mapping.dmp
  • memory/1340-91-0x0000000000400000-0x000000000059A000-memory.dmp
    Filesize

    1.6MB

  • memory/1340-90-0x000000000073B000-0x000000000075A000-memory.dmp
    Filesize

    124KB

  • memory/2020-68-0x0000000000000000-mapping.dmp
  • memory/2020-71-0x0000000000040000-0x0000000000068000-memory.dmp
    Filesize

    160KB