Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
14-11-2022 06:55
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://193.56.146.244/solo/mana.exe
Resource
win7-20220812-en
General
Malware Config
Extracted
redline
boy
77.73.134.241:4691
-
auth_value
a91fa8cc2cfaefc42a23c03faef44bd3
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G3YCTSQY\mana.exe.6wox173.partial family_redline C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G3YCTSQY\mana.exe family_redline behavioral2/memory/1188-135-0x0000000000590000-0x00000000005B8000-memory.dmp family_redline -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
mana.exepid process 1188 mana.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = e8baa059b9aed801 iexplore.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30996478" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B9F8B4D1-63F1-11ED-B696-520B3B914C01} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2541847676" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\RepId iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0e6398ffef7d801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90f94c8ffef7d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{205A0705-2552-49F1-9E44-893C6CD60FCA}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ff70dc89c955b249b6f33d1d2b4fa9b400000000020000000000106600000001000020000000a1cb520207a9adfc98037f9707851ff3b76d6ddf1f503eddcf74983ac06cae50000000000e8000000002000020000000d20e9ea84582ea1dbc62470b33047b55c98b4a165b19416f13cf0c920bb3ca192000000063266eae9bce38d7bcb030b0afb210445570e459106d1799ee38fe8e1e7cdbbf4000000097fdcb86d9ea1c7ee50696e99566b4dc39960df29bbad505d270e41eac06fda1c045aa582f7f0bdfc2019bd991d3c63706f3a468a6a5e22d0ee7b3d10080c2e2 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2541847676" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30996478" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375177513" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ff70dc89c955b249b6f33d1d2b4fa9b40000000002000000000010660000000100002000000094871d825b7c2be3a1e0244299fb0a28ae7d9cbca5f5ce4ad4f14edf97668c12000000000e80000000020000200000003eddcbf7fd9465b5dd648606de21b033745b280cb03bf1551552c55d428618d320000000806bf143fe2040e8ba3699b7e8352207d9349a1ee1e8a7b491f7845a710c8a4a400000007135638f28a540697b033115843fdb7aadd48f2b0c7239ae35ffebc4872c6ea60b96249e4b06c9f4f5b46ba53fc050a24e030075e1ede7d8cc603aafe58aade3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
mana.exepid process 1188 mana.exe 1188 mana.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
mana.exedescription pid process Token: SeDebugPrivilege 1188 mana.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exepid process 1436 iexplore.exe 1436 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1436 iexplore.exe 1436 iexplore.exe 2124 IEXPLORE.EXE 2124 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
iexplore.exedescription pid process target process PID 1436 wrote to memory of 2124 1436 iexplore.exe IEXPLORE.EXE PID 1436 wrote to memory of 2124 1436 iexplore.exe IEXPLORE.EXE PID 1436 wrote to memory of 2124 1436 iexplore.exe IEXPLORE.EXE PID 1436 wrote to memory of 1188 1436 iexplore.exe mana.exe PID 1436 wrote to memory of 1188 1436 iexplore.exe mana.exe PID 1436 wrote to memory of 1188 1436 iexplore.exe mana.exe
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://193.56.146.244/solo/mana.exe1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1436 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G3YCTSQY\mana.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G3YCTSQY\mana.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G3YCTSQY\mana.exeFilesize
137KB
MD5e63d74cec6926b2d04e474b889d08af4
SHA1a64a888ccfb4e82ade71f1a00a7ae681d29c7bcb
SHA256a9ffffff38aca59d7d2f041fbdb253ca612c7ba2d597782b2e6a59a914f49b33
SHA512fd59c0a1c613611002e52a309ee4baad626df8fbbd8c0c230bcb8e6fed4a3059296ab11b88a1d25a0f54c65f730a027f876629298120f7b4c251bf6d2aaed148
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G3YCTSQY\mana.exe.6wox173.partialFilesize
137KB
MD5e63d74cec6926b2d04e474b889d08af4
SHA1a64a888ccfb4e82ade71f1a00a7ae681d29c7bcb
SHA256a9ffffff38aca59d7d2f041fbdb253ca612c7ba2d597782b2e6a59a914f49b33
SHA512fd59c0a1c613611002e52a309ee4baad626df8fbbd8c0c230bcb8e6fed4a3059296ab11b88a1d25a0f54c65f730a027f876629298120f7b4c251bf6d2aaed148
-
memory/1188-138-0x0000000004F40000-0x0000000004F52000-memory.dmpFilesize
72KB
-
memory/1188-135-0x0000000000590000-0x00000000005B8000-memory.dmpFilesize
160KB
-
memory/1188-136-0x0000000005490000-0x0000000005AA8000-memory.dmpFilesize
6.1MB
-
memory/1188-137-0x0000000005010000-0x000000000511A000-memory.dmpFilesize
1.0MB
-
memory/1188-133-0x0000000000000000-mapping.dmp
-
memory/1188-139-0x0000000004FA0000-0x0000000004FDC000-memory.dmpFilesize
240KB
-
memory/1188-140-0x00000000052B0000-0x0000000005316000-memory.dmpFilesize
408KB
-
memory/1188-141-0x0000000006370000-0x0000000006914000-memory.dmpFilesize
5.6MB
-
memory/1188-142-0x0000000005EA0000-0x0000000005F32000-memory.dmpFilesize
584KB
-
memory/1188-143-0x0000000005FC0000-0x0000000006036000-memory.dmpFilesize
472KB
-
memory/1188-144-0x0000000006040000-0x0000000006090000-memory.dmpFilesize
320KB
-
memory/1188-145-0x0000000006AF0000-0x0000000006CB2000-memory.dmpFilesize
1.8MB
-
memory/1188-146-0x00000000071F0000-0x000000000771C000-memory.dmpFilesize
5.2MB