Analysis
-
max time kernel
135s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
04-12-2022 17:38
Static task
static1
Behavioral task
behavioral1
Sample
a5e0a8d94d854de7b2c94d4b196449ecfae16dfde2d917ed1cc9cb7726069a40.exe
Resource
win10-20220812-en
General
-
Target
a5e0a8d94d854de7b2c94d4b196449ecfae16dfde2d917ed1cc9cb7726069a40.exe
-
Size
380KB
-
MD5
91176af73e5f4c5c01e6c8ce88a481a0
-
SHA1
e5349d540c50972802e1825c1c3dd68002f7e8b8
-
SHA256
a5e0a8d94d854de7b2c94d4b196449ecfae16dfde2d917ed1cc9cb7726069a40
-
SHA512
7c5ddfb8d279eadfbc594d916a359269cc43dd4b17b11e0a4f9562b33adb09416aab7de6a0341c3dff1bc380f2f3e06bfa390e531322b3a6a6e2edaf871bcf70
-
SSDEEP
6144:XBPegtXz3z9PCY8Xv1LFMirYsy91ymlgl0KOqG1PF:XBPTpz9PCYi1LyimyWglHBG
Malware Config
Extracted
amadey
3.50
31.41.244.167/v7eWcjs/index.php
Extracted
redline
NewDef2023
185.106.92.214:2510
-
auth_value
048f34b18865578890538db10b2e9edf
Signatures
-
Detect Amadey credential stealer module 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dll amadey_cred_module \Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dll amadey_cred_module \Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dll amadey_cred_module -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/4188-296-0x0000000002790000-0x00000000027CE000-memory.dmp family_redline behavioral1/memory/4188-303-0x0000000004B80000-0x0000000004BBC000-memory.dmp family_redline -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 10 1320 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
gntuud.exeanon.exepid process 5068 gntuud.exe 4188 anon.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exepid process 1320 rundll32.exe 1320 rundll32.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
gntuud.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\anon.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000006001\\anon.exe" gntuud.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
anon.exerundll32.exepid process 4188 anon.exe 4188 anon.exe 1320 rundll32.exe 1320 rundll32.exe 1320 rundll32.exe 1320 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
anon.exedescription pid process Token: SeDebugPrivilege 4188 anon.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
a5e0a8d94d854de7b2c94d4b196449ecfae16dfde2d917ed1cc9cb7726069a40.exegntuud.exedescription pid process target process PID 3688 wrote to memory of 5068 3688 a5e0a8d94d854de7b2c94d4b196449ecfae16dfde2d917ed1cc9cb7726069a40.exe gntuud.exe PID 3688 wrote to memory of 5068 3688 a5e0a8d94d854de7b2c94d4b196449ecfae16dfde2d917ed1cc9cb7726069a40.exe gntuud.exe PID 3688 wrote to memory of 5068 3688 a5e0a8d94d854de7b2c94d4b196449ecfae16dfde2d917ed1cc9cb7726069a40.exe gntuud.exe PID 5068 wrote to memory of 1080 5068 gntuud.exe schtasks.exe PID 5068 wrote to memory of 1080 5068 gntuud.exe schtasks.exe PID 5068 wrote to memory of 1080 5068 gntuud.exe schtasks.exe PID 5068 wrote to memory of 4188 5068 gntuud.exe anon.exe PID 5068 wrote to memory of 4188 5068 gntuud.exe anon.exe PID 5068 wrote to memory of 4188 5068 gntuud.exe anon.exe PID 5068 wrote to memory of 1320 5068 gntuud.exe rundll32.exe PID 5068 wrote to memory of 1320 5068 gntuud.exe rundll32.exe PID 5068 wrote to memory of 1320 5068 gntuud.exe rundll32.exe -
outlook_win_path 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5e0a8d94d854de7b2c94d4b196449ecfae16dfde2d917ed1cc9cb7726069a40.exe"C:\Users\Admin\AppData\Local\Temp\a5e0a8d94d854de7b2c94d4b196449ecfae16dfde2d917ed1cc9cb7726069a40.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe"C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1000006001\anon.exe"C:\Users\Admin\AppData\Local\Temp\1000006001\anon.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1000006001\anon.exeFilesize
452KB
MD519c1d32660807e878d801d3022d14dfb
SHA10ee53ad1a2a1b111985e6b1d91e7e072ff98d567
SHA25654f68753efa15d3aab3710e29006be6f5e341edce07c38eaa41abdb4bfa3c0e9
SHA512fd3e003b6fb1f6932dd2f9a7951bbcd9eca7901581882804c17070ebb39da3be3fc79c218cb79428a96ac2951b163d4ccea1aed8e44f78cc68b0c3f8df540b91
-
C:\Users\Admin\AppData\Local\Temp\1000006001\anon.exeFilesize
452KB
MD519c1d32660807e878d801d3022d14dfb
SHA10ee53ad1a2a1b111985e6b1d91e7e072ff98d567
SHA25654f68753efa15d3aab3710e29006be6f5e341edce07c38eaa41abdb4bfa3c0e9
SHA512fd3e003b6fb1f6932dd2f9a7951bbcd9eca7901581882804c17070ebb39da3be3fc79c218cb79428a96ac2951b163d4ccea1aed8e44f78cc68b0c3f8df540b91
-
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exeFilesize
380KB
MD591176af73e5f4c5c01e6c8ce88a481a0
SHA1e5349d540c50972802e1825c1c3dd68002f7e8b8
SHA256a5e0a8d94d854de7b2c94d4b196449ecfae16dfde2d917ed1cc9cb7726069a40
SHA5127c5ddfb8d279eadfbc594d916a359269cc43dd4b17b11e0a4f9562b33adb09416aab7de6a0341c3dff1bc380f2f3e06bfa390e531322b3a6a6e2edaf871bcf70
-
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exeFilesize
380KB
MD591176af73e5f4c5c01e6c8ce88a481a0
SHA1e5349d540c50972802e1825c1c3dd68002f7e8b8
SHA256a5e0a8d94d854de7b2c94d4b196449ecfae16dfde2d917ed1cc9cb7726069a40
SHA5127c5ddfb8d279eadfbc594d916a359269cc43dd4b17b11e0a4f9562b33adb09416aab7de6a0341c3dff1bc380f2f3e06bfa390e531322b3a6a6e2edaf871bcf70
-
C:\Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dllFilesize
126KB
MD5aebf8cd9ea982decded5ee6f3777c6d7
SHA1406e723158cd5697503d1d04839d3bc7a5051603
SHA256104af593683398f0980f2c86e6513b8c1b7dededc1f924d4693ad92410d51a62
SHA512f28fbb9b155348a6aca1105abf6f88640bb68374c07e023a7c9e06577006002d09b53b7629923c2486d7e9811f7254a296d19e566940077431e5089b06a13981
-
\Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dllFilesize
126KB
MD5aebf8cd9ea982decded5ee6f3777c6d7
SHA1406e723158cd5697503d1d04839d3bc7a5051603
SHA256104af593683398f0980f2c86e6513b8c1b7dededc1f924d4693ad92410d51a62
SHA512f28fbb9b155348a6aca1105abf6f88640bb68374c07e023a7c9e06577006002d09b53b7629923c2486d7e9811f7254a296d19e566940077431e5089b06a13981
-
\Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dllFilesize
126KB
MD5aebf8cd9ea982decded5ee6f3777c6d7
SHA1406e723158cd5697503d1d04839d3bc7a5051603
SHA256104af593683398f0980f2c86e6513b8c1b7dededc1f924d4693ad92410d51a62
SHA512f28fbb9b155348a6aca1105abf6f88640bb68374c07e023a7c9e06577006002d09b53b7629923c2486d7e9811f7254a296d19e566940077431e5089b06a13981
-
memory/1080-218-0x0000000000000000-mapping.dmp
-
memory/1320-355-0x0000000000000000-mapping.dmp
-
memory/3688-142-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-150-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-127-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-128-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-129-0x00000000005D1000-0x00000000005F0000-memory.dmpFilesize
124KB
-
memory/3688-130-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-131-0x0000000000470000-0x00000000005BA000-memory.dmpFilesize
1.3MB
-
memory/3688-132-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-133-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-134-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-135-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-136-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-137-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-138-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-139-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-140-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-141-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-116-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-117-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-144-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-145-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-146-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-147-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-148-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-149-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-124-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-151-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-152-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-153-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-154-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-155-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/3688-156-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-157-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-158-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-159-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-160-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-161-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-162-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-163-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-164-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-125-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-118-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-119-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-169-0x00000000005D1000-0x00000000005F0000-memory.dmpFilesize
124KB
-
memory/3688-120-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-170-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/3688-126-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-143-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-121-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-122-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3688-123-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4188-279-0x0000000000530000-0x000000000067A000-memory.dmpFilesize
1.3MB
-
memory/4188-324-0x0000000005330000-0x0000000005342000-memory.dmpFilesize
72KB
-
memory/4188-354-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/4188-344-0x0000000006610000-0x0000000006B3C000-memory.dmpFilesize
5.2MB
-
memory/4188-343-0x0000000006430000-0x00000000065F2000-memory.dmpFilesize
1.8MB
-
memory/4188-335-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/4188-330-0x0000000005AF0000-0x0000000005B3B000-memory.dmpFilesize
300KB
-
memory/4188-328-0x0000000005350000-0x000000000538E000-memory.dmpFilesize
248KB
-
memory/4188-326-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/4188-325-0x0000000000530000-0x000000000067A000-memory.dmpFilesize
1.3MB
-
memory/4188-322-0x00000000051F0000-0x00000000052FA000-memory.dmpFilesize
1.0MB
-
memory/4188-321-0x00000000053E0000-0x00000000059E6000-memory.dmpFilesize
6.0MB
-
memory/4188-305-0x0000000005110000-0x00000000051A2000-memory.dmpFilesize
584KB
-
memory/4188-303-0x0000000004B80000-0x0000000004BBC000-memory.dmpFilesize
240KB
-
memory/4188-301-0x0000000004C10000-0x000000000510E000-memory.dmpFilesize
5.0MB
-
memory/4188-296-0x0000000002790000-0x00000000027CE000-memory.dmpFilesize
248KB
-
memory/4188-247-0x0000000000000000-mapping.dmp
-
memory/4188-280-0x00000000004C0000-0x00000000004FE000-memory.dmpFilesize
248KB
-
memory/4188-281-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/5068-184-0x0000000000691000-0x00000000006B0000-memory.dmpFilesize
124KB
-
memory/5068-182-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5068-174-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5068-282-0x0000000000691000-0x00000000006B0000-memory.dmpFilesize
124KB
-
memory/5068-283-0x00000000001C0000-0x00000000001FE000-memory.dmpFilesize
248KB
-
memory/5068-284-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/5068-225-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/5068-175-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5068-189-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5068-188-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5068-187-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5068-186-0x00000000001C0000-0x00000000001FE000-memory.dmpFilesize
248KB
-
memory/5068-177-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5068-171-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5068-185-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5068-183-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5068-173-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5068-181-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5068-180-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5068-178-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5068-179-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5068-168-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5068-167-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5068-165-0x0000000000000000-mapping.dmp
-
memory/5068-172-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB