Analysis
-
max time kernel
97s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
14-11-2022 06:55
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://193.56.146.244/solo/mana.exe
Resource
win7-20220812-en
General
Malware Config
Extracted
redline
boy
77.73.134.241:4691
-
auth_value
a91fa8cc2cfaefc42a23c03faef44bd3
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3XPFXPM5\mana.exe.jn9ym97.partial family_redline C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3XPFXPM5\mana.exe family_redline behavioral1/memory/752-57-0x0000000000B70000-0x0000000000B98000-memory.dmp family_redline -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
mana.exepid process 752 mana.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = c0be6a81fef7d801 iexplore.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6018c393fef7d801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004c486e8274cede4092788bef879cd6fb0000000002000000000010660000000100002000000006c8e7082b10588a42d91437431515896851141f249ffafe2172da2c993c9c67000000000e80000000020000200000004aab2568f0e0b285dabdaa1afcf577b32b7bbe1d1854060d68a7d3da8397c65720000000221ed9b3821d5c93ca7f8da6099ce8f1424af7e0fef7b383b34c70702f7e37cc4000000065ce286f64794489cd4915c33469fa42a4c758cd31e5f4c64bc7cc70181dd6d2eed0b8635053d78c88158c3b2f34068f9627b036f503d3edf78f9085e643d02e iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004c486e8274cede4092788bef879cd6fb0000000002000000000010660000000100002000000079b931e8640bb610edb5380b1f59265084398bb6c26673ed1472dfdd159bfe49000000000e8000000002000020000000f604aa82633cd2ed7e70607203855bcf9418351faf9c4b89fa5de9426be83bb990000000b729c5bb49212ce8c10b3a55a86287ab057a5b8d16255608e1a75ee6f77d5258292c17caf8b23925e9c215e556642ccd980de7abd36e4fac0a7b7ebf5580fd762aa98d8f0d5240a12d7998056af804a8cf3ffc56f897b564ed5942ccd9e5d5edcd8613242170c821e5fbbd73d013a0f53b27e7e627185fb10f622828b40aa37d69c9227c0aba2fa112a18902eca9911d400000002cceb171b9409699c631006670437cb9a1cccb8cf9e2ab9f632412723697eaa523c66be66ed9c7edb8a0ecb788c4581274a6310d0d4c7adffcd9c5d3f29a5cd3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B9CEA831-63F1-11ED-AE30-7E4CDA66D2DC} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375177513" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
mana.exepid process 752 mana.exe 752 mana.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
mana.exedescription pid process Token: SeDebugPrivilege 752 mana.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exepid process 1092 iexplore.exe 1092 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1092 iexplore.exe 1092 iexplore.exe 1944 IEXPLORE.EXE 1944 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
iexplore.exedescription pid process target process PID 1092 wrote to memory of 1944 1092 iexplore.exe IEXPLORE.EXE PID 1092 wrote to memory of 1944 1092 iexplore.exe IEXPLORE.EXE PID 1092 wrote to memory of 1944 1092 iexplore.exe IEXPLORE.EXE PID 1092 wrote to memory of 1944 1092 iexplore.exe IEXPLORE.EXE PID 1092 wrote to memory of 752 1092 iexplore.exe mana.exe PID 1092 wrote to memory of 752 1092 iexplore.exe mana.exe PID 1092 wrote to memory of 752 1092 iexplore.exe mana.exe PID 1092 wrote to memory of 752 1092 iexplore.exe mana.exe
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://193.56.146.244/solo/mana.exe1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1092 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3XPFXPM5\mana.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3XPFXPM5\mana.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3XPFXPM5\mana.exeFilesize
137KB
MD5e63d74cec6926b2d04e474b889d08af4
SHA1a64a888ccfb4e82ade71f1a00a7ae681d29c7bcb
SHA256a9ffffff38aca59d7d2f041fbdb253ca612c7ba2d597782b2e6a59a914f49b33
SHA512fd59c0a1c613611002e52a309ee4baad626df8fbbd8c0c230bcb8e6fed4a3059296ab11b88a1d25a0f54c65f730a027f876629298120f7b4c251bf6d2aaed148
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3XPFXPM5\mana.exe.jn9ym97.partialFilesize
137KB
MD5e63d74cec6926b2d04e474b889d08af4
SHA1a64a888ccfb4e82ade71f1a00a7ae681d29c7bcb
SHA256a9ffffff38aca59d7d2f041fbdb253ca612c7ba2d597782b2e6a59a914f49b33
SHA512fd59c0a1c613611002e52a309ee4baad626df8fbbd8c0c230bcb8e6fed4a3059296ab11b88a1d25a0f54c65f730a027f876629298120f7b4c251bf6d2aaed148
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\UHK7FAMR.txtFilesize
608B
MD5b521faaea64a7cc5376ec34450e7b101
SHA190400085484dbaa89709d811a72f30e4efecb25d
SHA256216068b4cfd7e8ee292a69eb81481f77b5540f229a31ea836279a69adfcb58e6
SHA512cd209e52a5e534ae3175fc5748a0ca3ca796ffad3156fb1e5b96e8a6823b4233ee652b2b99ad7f41e2b817227609535e633fbb672f1efb6400de54d6b3b001e6
-
memory/752-55-0x0000000000000000-mapping.dmp
-
memory/752-57-0x0000000000B70000-0x0000000000B98000-memory.dmpFilesize
160KB
-
memory/752-58-0x0000000074C91000-0x0000000074C93000-memory.dmpFilesize
8KB