Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-en
  • resource tags

    arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
  • submitted
    12-11-2022 05:15

General

  • Target

    276cdfc90d876dcaa0b8803e2f3dbfffe17204fe7bbbf10c5fbe5e98fd456d79.exe

  • Size

    252KB

  • MD5

    d78228d99c0fe720a2e73a47c79c978b

  • SHA1

    16e51d35e90ae2bad685c4dd06d0b6461d7d532e

  • SHA256

    276cdfc90d876dcaa0b8803e2f3dbfffe17204fe7bbbf10c5fbe5e98fd456d79

  • SHA512

    67bf2e542ef37fa3f1e65c0da09b6b55b22da17e49352c39d8bec5adf7b182c89d3a96f4e9d13085136053b7a190d1cbc838e05e9efc93d092f31fe0382e998e

  • SSDEEP

    3072:6SLXqSrdSNJEdrLtJhWneR5da4QL0sBZPS4PghZKRVPB6SCBfSs7L5/Lq+BTxVnO:6AqGSN8LtJhW6da1BZP1RSdxx/zBTzn

Malware Config

Extracted

Family

redline

Botnet

boy

C2

77.73.134.241:4691

Attributes
  • auth_value

    a91fa8cc2cfaefc42a23c03faef44bd3

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detect Amadey credential stealer module 2 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\276cdfc90d876dcaa0b8803e2f3dbfffe17204fe7bbbf10c5fbe5e98fd456d79.exe
    "C:\Users\Admin\AppData\Local\Temp\276cdfc90d876dcaa0b8803e2f3dbfffe17204fe7bbbf10c5fbe5e98fd456d79.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2764
    • C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
      "C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4072
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe" /F
        3⤵
        • Creates scheduled task(s)
        PID:4608
      • C:\Users\Admin\AppData\Local\Temp\1000073001\mana.exe
        "C:\Users\Admin\AppData\Local\Temp\1000073001\mana.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4520
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\80b59841e5c623\cred64.dll, Main
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • outlook_win_path
        PID:1948
  • C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
    C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
    1⤵
    • Executes dropped EXE
    PID:1460
  • C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
    C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
    1⤵
    • Executes dropped EXE
    PID:4988

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\1000073001\mana.exe
    Filesize

    137KB

    MD5

    e63d74cec6926b2d04e474b889d08af4

    SHA1

    a64a888ccfb4e82ade71f1a00a7ae681d29c7bcb

    SHA256

    a9ffffff38aca59d7d2f041fbdb253ca612c7ba2d597782b2e6a59a914f49b33

    SHA512

    fd59c0a1c613611002e52a309ee4baad626df8fbbd8c0c230bcb8e6fed4a3059296ab11b88a1d25a0f54c65f730a027f876629298120f7b4c251bf6d2aaed148

  • C:\Users\Admin\AppData\Local\Temp\1000073001\mana.exe
    Filesize

    137KB

    MD5

    e63d74cec6926b2d04e474b889d08af4

    SHA1

    a64a888ccfb4e82ade71f1a00a7ae681d29c7bcb

    SHA256

    a9ffffff38aca59d7d2f041fbdb253ca612c7ba2d597782b2e6a59a914f49b33

    SHA512

    fd59c0a1c613611002e52a309ee4baad626df8fbbd8c0c230bcb8e6fed4a3059296ab11b88a1d25a0f54c65f730a027f876629298120f7b4c251bf6d2aaed148

  • C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
    Filesize

    252KB

    MD5

    d78228d99c0fe720a2e73a47c79c978b

    SHA1

    16e51d35e90ae2bad685c4dd06d0b6461d7d532e

    SHA256

    276cdfc90d876dcaa0b8803e2f3dbfffe17204fe7bbbf10c5fbe5e98fd456d79

    SHA512

    67bf2e542ef37fa3f1e65c0da09b6b55b22da17e49352c39d8bec5adf7b182c89d3a96f4e9d13085136053b7a190d1cbc838e05e9efc93d092f31fe0382e998e

  • C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
    Filesize

    252KB

    MD5

    d78228d99c0fe720a2e73a47c79c978b

    SHA1

    16e51d35e90ae2bad685c4dd06d0b6461d7d532e

    SHA256

    276cdfc90d876dcaa0b8803e2f3dbfffe17204fe7bbbf10c5fbe5e98fd456d79

    SHA512

    67bf2e542ef37fa3f1e65c0da09b6b55b22da17e49352c39d8bec5adf7b182c89d3a96f4e9d13085136053b7a190d1cbc838e05e9efc93d092f31fe0382e998e

  • C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
    Filesize

    252KB

    MD5

    d78228d99c0fe720a2e73a47c79c978b

    SHA1

    16e51d35e90ae2bad685c4dd06d0b6461d7d532e

    SHA256

    276cdfc90d876dcaa0b8803e2f3dbfffe17204fe7bbbf10c5fbe5e98fd456d79

    SHA512

    67bf2e542ef37fa3f1e65c0da09b6b55b22da17e49352c39d8bec5adf7b182c89d3a96f4e9d13085136053b7a190d1cbc838e05e9efc93d092f31fe0382e998e

  • C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
    Filesize

    252KB

    MD5

    d78228d99c0fe720a2e73a47c79c978b

    SHA1

    16e51d35e90ae2bad685c4dd06d0b6461d7d532e

    SHA256

    276cdfc90d876dcaa0b8803e2f3dbfffe17204fe7bbbf10c5fbe5e98fd456d79

    SHA512

    67bf2e542ef37fa3f1e65c0da09b6b55b22da17e49352c39d8bec5adf7b182c89d3a96f4e9d13085136053b7a190d1cbc838e05e9efc93d092f31fe0382e998e

  • C:\Users\Admin\AppData\Roaming\80b59841e5c623\cred64.dll
    Filesize

    126KB

    MD5

    522adad0782501491314a78c7f32006b

    SHA1

    e487edceeef3a41e2a8eea1e684bcbc3b39adb97

    SHA256

    351fd9b73fa0cbbdfbce0793ca41544f5191650d79317a34024f3c09f73ac9ba

    SHA512

    5f8a103deea3ed5f8641d1f4c91a4f891a8208b679cadbfac4a068afbad0d2f777cd29ace4bdfec590e722435473e4f8465fb80d5cda792dc0236646580101a7

  • \Users\Admin\AppData\Roaming\80b59841e5c623\cred64.dll
    Filesize

    126KB

    MD5

    522adad0782501491314a78c7f32006b

    SHA1

    e487edceeef3a41e2a8eea1e684bcbc3b39adb97

    SHA256

    351fd9b73fa0cbbdfbce0793ca41544f5191650d79317a34024f3c09f73ac9ba

    SHA512

    5f8a103deea3ed5f8641d1f4c91a4f891a8208b679cadbfac4a068afbad0d2f777cd29ace4bdfec590e722435473e4f8465fb80d5cda792dc0236646580101a7

  • memory/1460-461-0x0000000000400000-0x000000000059A000-memory.dmp
    Filesize

    1.6MB

  • memory/1460-460-0x00000000007CC000-0x00000000007EB000-memory.dmp
    Filesize

    124KB

  • memory/1948-347-0x0000000000000000-mapping.dmp
  • memory/2764-173-0x0000000000856000-0x0000000000875000-memory.dmp
    Filesize

    124KB

  • memory/2764-138-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-133-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-134-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-135-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-137-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-140-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-142-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-141-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-143-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-144-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-139-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-145-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-146-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-147-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-121-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-149-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-152-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-151-0x00000000022E0000-0x000000000231E000-memory.dmp
    Filesize

    248KB

  • memory/2764-150-0x0000000000856000-0x0000000000875000-memory.dmp
    Filesize

    124KB

  • memory/2764-153-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-122-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-136-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-154-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-155-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-156-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-157-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-158-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-159-0x0000000000400000-0x000000000059A000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-162-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-161-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-123-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-163-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-166-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-165-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-164-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-168-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-169-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-167-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-120-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-126-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-177-0x0000000000400000-0x000000000059A000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-125-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-124-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-160-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-132-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-148-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-128-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-130-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-129-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-127-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/2764-175-0x00000000022E0000-0x000000000231E000-memory.dmp
    Filesize

    248KB

  • memory/2764-131-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/4072-233-0x00000000006B0000-0x00000000007FA000-memory.dmp
    Filesize

    1.3MB

  • memory/4072-176-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/4072-235-0x0000000000400000-0x000000000059A000-memory.dmp
    Filesize

    1.6MB

  • memory/4072-183-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/4072-172-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/4072-187-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/4072-170-0x0000000000000000-mapping.dmp
  • memory/4072-192-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/4072-188-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/4072-186-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/4072-335-0x0000000000400000-0x000000000059A000-memory.dmp
    Filesize

    1.6MB

  • memory/4072-178-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/4072-191-0x00000000007F6000-0x0000000000815000-memory.dmp
    Filesize

    124KB

  • memory/4072-184-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/4072-190-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/4072-180-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/4072-179-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/4072-185-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/4072-174-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/4072-189-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/4072-181-0x0000000077660000-0x00000000777EE000-memory.dmp
    Filesize

    1.6MB

  • memory/4072-334-0x00000000006B0000-0x00000000007FA000-memory.dmp
    Filesize

    1.3MB

  • memory/4520-337-0x0000000006810000-0x0000000006860000-memory.dmp
    Filesize

    320KB

  • memory/4520-316-0x00000000051B0000-0x00000000051EE000-memory.dmp
    Filesize

    248KB

  • memory/4520-323-0x0000000006210000-0x000000000670E000-memory.dmp
    Filesize

    5.0MB

  • memory/4520-322-0x00000000054F0000-0x0000000005582000-memory.dmp
    Filesize

    584KB

  • memory/4520-336-0x0000000006790000-0x0000000006806000-memory.dmp
    Filesize

    472KB

  • memory/4520-318-0x0000000005320000-0x000000000536B000-memory.dmp
    Filesize

    300KB

  • memory/4520-338-0x0000000006B30000-0x0000000006CF2000-memory.dmp
    Filesize

    1.8MB

  • memory/4520-339-0x0000000007230000-0x000000000775C000-memory.dmp
    Filesize

    5.2MB

  • memory/4520-311-0x0000000005700000-0x0000000005D06000-memory.dmp
    Filesize

    6.0MB

  • memory/4520-326-0x0000000005590000-0x00000000055F6000-memory.dmp
    Filesize

    408KB

  • memory/4520-290-0x0000000000900000-0x0000000000928000-memory.dmp
    Filesize

    160KB

  • memory/4520-314-0x0000000005140000-0x0000000005152000-memory.dmp
    Filesize

    72KB

  • memory/4520-254-0x0000000000000000-mapping.dmp
  • memory/4520-312-0x0000000005210000-0x000000000531A000-memory.dmp
    Filesize

    1.0MB

  • memory/4608-224-0x0000000000000000-mapping.dmp
  • memory/4988-500-0x000000000089C000-0x00000000008BB000-memory.dmp
    Filesize

    124KB

  • memory/4988-501-0x0000000000400000-0x000000000059A000-memory.dmp
    Filesize

    1.6MB