Analysis
-
max time kernel
95s -
max time network
148s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
06-12-2022 14:12
Static task
static1
Behavioral task
behavioral1
Sample
41fe913164b78e8bf6208c80c5e8985c518b33f12f711d6166e949b3fdec86d0.exe
Resource
win10-20220812-en
General
-
Target
41fe913164b78e8bf6208c80c5e8985c518b33f12f711d6166e949b3fdec86d0.exe
-
Size
416KB
-
MD5
1664c91034dd52ec6b75cfd1d3a2e090
-
SHA1
a59f8e13e0ce8d155120aeb8db8d6f3a152190f5
-
SHA256
41fe913164b78e8bf6208c80c5e8985c518b33f12f711d6166e949b3fdec86d0
-
SHA512
6cf6fcaaa3af51ee0cb05d4850614de58a99bcb0667f47b08e917a653e1c446049c253ad495abf2fcb106c50772a8b6fc588a64d5178ebd397c1e8b88bb0e218
-
SSDEEP
6144:lQAp6LXifpQAc1O50G6LPB1/iN3tRzbf5yigb7PMk:lQA8bgpNcq0vPriRf5yz
Malware Config
Extracted
amadey
3.50
77.73.133.72/hfk3vK9/index.php
Extracted
redline
@2023@
193.106.191.138:32796
-
auth_value
ca057e5baadfd0774a34a6a949cd5e69
Signatures
-
Detect Amadey credential stealer module 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\f49dfc5e4e2508\cred64.dll amadey_cred_module \Users\Admin\AppData\Roaming\f49dfc5e4e2508\cred64.dll amadey_cred_module -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3208-336-0x0000000002580000-0x00000000025C6000-memory.dmp family_redline behavioral1/memory/3208-343-0x0000000002600000-0x0000000002644000-memory.dmp family_redline -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 10 4956 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
Processes:
gntuud.exesoftx64.exegntuud.exegntuud.exepid process 4000 gntuud.exe 3208 softx64.exe 3352 gntuud.exe 1960 gntuud.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4956 rundll32.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
gntuud.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\Run\softx64.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000015001\\softx64.exe" gntuud.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
rundll32.exesoftx64.exepid process 4956 rundll32.exe 4956 rundll32.exe 4956 rundll32.exe 4956 rundll32.exe 3208 softx64.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
softx64.exedescription pid process Token: SeDebugPrivilege 3208 softx64.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
41fe913164b78e8bf6208c80c5e8985c518b33f12f711d6166e949b3fdec86d0.exegntuud.exedescription pid process target process PID 2504 wrote to memory of 4000 2504 41fe913164b78e8bf6208c80c5e8985c518b33f12f711d6166e949b3fdec86d0.exe gntuud.exe PID 2504 wrote to memory of 4000 2504 41fe913164b78e8bf6208c80c5e8985c518b33f12f711d6166e949b3fdec86d0.exe gntuud.exe PID 2504 wrote to memory of 4000 2504 41fe913164b78e8bf6208c80c5e8985c518b33f12f711d6166e949b3fdec86d0.exe gntuud.exe PID 4000 wrote to memory of 4540 4000 gntuud.exe schtasks.exe PID 4000 wrote to memory of 4540 4000 gntuud.exe schtasks.exe PID 4000 wrote to memory of 4540 4000 gntuud.exe schtasks.exe PID 4000 wrote to memory of 3208 4000 gntuud.exe softx64.exe PID 4000 wrote to memory of 3208 4000 gntuud.exe softx64.exe PID 4000 wrote to memory of 3208 4000 gntuud.exe softx64.exe PID 4000 wrote to memory of 4956 4000 gntuud.exe rundll32.exe PID 4000 wrote to memory of 4956 4000 gntuud.exe rundll32.exe PID 4000 wrote to memory of 4956 4000 gntuud.exe rundll32.exe -
outlook_win_path 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\41fe913164b78e8bf6208c80c5e8985c518b33f12f711d6166e949b3fdec86d0.exe"C:\Users\Admin\AppData\Local\Temp\41fe913164b78e8bf6208c80c5e8985c518b33f12f711d6166e949b3fdec86d0.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exe"C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1000015001\softx64.exe"C:\Users\Admin\AppData\Local\Temp\1000015001\softx64.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\f49dfc5e4e2508\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_win_path
-
C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exeC:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exeC:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1000015001\softx64.exeFilesize
478KB
MD560fd334487b4f70b474411ea4fd16c99
SHA13a98b0fa0c5057d8ec18d183f0149cc53269fc0f
SHA256f4b7637b4996c285c806b8404144275944b7b9a90d880f1467c2a9f8231d0d99
SHA5121d42434a9f7ef8c048917b45372532367e7d6c78a375ae105b67533e0116fc8ce2ffbe1c95d274e54f5d020d3537b408d2ee8ddc3e27c22aca20cca2ab374962
-
C:\Users\Admin\AppData\Local\Temp\1000015001\softx64.exeFilesize
478KB
MD560fd334487b4f70b474411ea4fd16c99
SHA13a98b0fa0c5057d8ec18d183f0149cc53269fc0f
SHA256f4b7637b4996c285c806b8404144275944b7b9a90d880f1467c2a9f8231d0d99
SHA5121d42434a9f7ef8c048917b45372532367e7d6c78a375ae105b67533e0116fc8ce2ffbe1c95d274e54f5d020d3537b408d2ee8ddc3e27c22aca20cca2ab374962
-
C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exeFilesize
416KB
MD51664c91034dd52ec6b75cfd1d3a2e090
SHA1a59f8e13e0ce8d155120aeb8db8d6f3a152190f5
SHA25641fe913164b78e8bf6208c80c5e8985c518b33f12f711d6166e949b3fdec86d0
SHA5126cf6fcaaa3af51ee0cb05d4850614de58a99bcb0667f47b08e917a653e1c446049c253ad495abf2fcb106c50772a8b6fc588a64d5178ebd397c1e8b88bb0e218
-
C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exeFilesize
416KB
MD51664c91034dd52ec6b75cfd1d3a2e090
SHA1a59f8e13e0ce8d155120aeb8db8d6f3a152190f5
SHA25641fe913164b78e8bf6208c80c5e8985c518b33f12f711d6166e949b3fdec86d0
SHA5126cf6fcaaa3af51ee0cb05d4850614de58a99bcb0667f47b08e917a653e1c446049c253ad495abf2fcb106c50772a8b6fc588a64d5178ebd397c1e8b88bb0e218
-
C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exeFilesize
416KB
MD51664c91034dd52ec6b75cfd1d3a2e090
SHA1a59f8e13e0ce8d155120aeb8db8d6f3a152190f5
SHA25641fe913164b78e8bf6208c80c5e8985c518b33f12f711d6166e949b3fdec86d0
SHA5126cf6fcaaa3af51ee0cb05d4850614de58a99bcb0667f47b08e917a653e1c446049c253ad495abf2fcb106c50772a8b6fc588a64d5178ebd397c1e8b88bb0e218
-
C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exeFilesize
416KB
MD51664c91034dd52ec6b75cfd1d3a2e090
SHA1a59f8e13e0ce8d155120aeb8db8d6f3a152190f5
SHA25641fe913164b78e8bf6208c80c5e8985c518b33f12f711d6166e949b3fdec86d0
SHA5126cf6fcaaa3af51ee0cb05d4850614de58a99bcb0667f47b08e917a653e1c446049c253ad495abf2fcb106c50772a8b6fc588a64d5178ebd397c1e8b88bb0e218
-
C:\Users\Admin\AppData\Roaming\f49dfc5e4e2508\cred64.dllFilesize
126KB
MD5349b2b47fef50fa6a1fc19d0ee4b2db8
SHA1077f4328b3f060a9f010b1a63d9e127d24ddafd4
SHA2565cd41f164de6f783b7da82b5f6dbd49413eccd87cc7470f2004d58ca081fb0e0
SHA51283fd58be4c0051ed05b7a03443d256d52f09206d2f433bd302c9e9e3780b9d472e823aed1db01b5052dc8fdc63a4352beac9e399858a8252c057f11cf2bd1773
-
\Users\Admin\AppData\Roaming\f49dfc5e4e2508\cred64.dllFilesize
126KB
MD5349b2b47fef50fa6a1fc19d0ee4b2db8
SHA1077f4328b3f060a9f010b1a63d9e127d24ddafd4
SHA2565cd41f164de6f783b7da82b5f6dbd49413eccd87cc7470f2004d58ca081fb0e0
SHA51283fd58be4c0051ed05b7a03443d256d52f09206d2f433bd302c9e9e3780b9d472e823aed1db01b5052dc8fdc63a4352beac9e399858a8252c057f11cf2bd1773
-
memory/1960-517-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/1960-516-0x0000000000654000-0x0000000000673000-memory.dmpFilesize
124KB
-
memory/2504-180-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/2504-135-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-130-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-120-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-133-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-132-0x00000000006A1000-0x00000000006C0000-memory.dmpFilesize
124KB
-
memory/2504-134-0x00000000001C0000-0x00000000001FE000-memory.dmpFilesize
248KB
-
memory/2504-121-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-136-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-137-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-138-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-139-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-140-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-141-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-142-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-143-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-144-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-145-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-146-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-147-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-148-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-149-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-150-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-151-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-152-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-153-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-154-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-155-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-156-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/2504-122-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-158-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-159-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-160-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-161-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-162-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-163-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-164-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-165-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-166-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-167-0x00000000006A1000-0x00000000006C0000-memory.dmpFilesize
124KB
-
memory/2504-168-0x00000000001C0000-0x00000000001FE000-memory.dmpFilesize
248KB
-
memory/2504-169-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-170-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-178-0x00000000006A1000-0x00000000006C0000-memory.dmpFilesize
124KB
-
memory/2504-128-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-123-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-124-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-125-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-131-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-129-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-157-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-126-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2504-127-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/3208-378-0x0000000007FD0000-0x000000000801B000-memory.dmpFilesize
300KB
-
memory/3208-364-0x0000000005E90000-0x0000000005F9A000-memory.dmpFilesize
1.0MB
-
memory/3208-343-0x0000000002600000-0x0000000002644000-memory.dmpFilesize
272KB
-
memory/3208-488-0x0000000000400000-0x000000000047C000-memory.dmpFilesize
496KB
-
memory/3208-475-0x0000000007AA0000-0x0000000007FCC000-memory.dmpFilesize
5.2MB
-
memory/3208-295-0x0000000000480000-0x00000000005CA000-memory.dmpFilesize
1.3MB
-
memory/3208-460-0x00000000056B0000-0x0000000005742000-memory.dmpFilesize
584KB
-
memory/3208-253-0x0000000000000000-mapping.dmp
-
memory/3208-415-0x00000000081A0000-0x0000000008206000-memory.dmpFilesize
408KB
-
memory/3208-376-0x0000000008050000-0x000000000808E000-memory.dmpFilesize
248KB
-
memory/3208-373-0x0000000007630000-0x0000000007642000-memory.dmpFilesize
72KB
-
memory/3208-336-0x0000000002580000-0x00000000025C6000-memory.dmpFilesize
280KB
-
memory/3208-363-0x0000000005800000-0x0000000005E06000-memory.dmpFilesize
6.0MB
-
memory/3208-351-0x0000000000480000-0x00000000005CA000-memory.dmpFilesize
1.3MB
-
memory/3208-350-0x0000000000480000-0x000000000052E000-memory.dmpFilesize
696KB
-
memory/3208-294-0x0000000000480000-0x000000000052E000-memory.dmpFilesize
696KB
-
memory/3208-474-0x00000000078D0000-0x0000000007A92000-memory.dmpFilesize
1.8MB
-
memory/3208-341-0x0000000004D30000-0x000000000522E000-memory.dmpFilesize
5.0MB
-
memory/3208-296-0x0000000000400000-0x000000000047C000-memory.dmpFilesize
496KB
-
memory/3352-331-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/3352-330-0x00000000007C4000-0x00000000007E3000-memory.dmpFilesize
124KB
-
memory/4000-193-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4000-188-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4000-293-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/4000-173-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4000-270-0x0000000000470000-0x000000000051E000-memory.dmpFilesize
696KB
-
memory/4000-181-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4000-179-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4000-217-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/4000-184-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4000-194-0x0000000000470000-0x000000000051E000-memory.dmpFilesize
696KB
-
memory/4000-195-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4000-192-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4000-177-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4000-174-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4000-185-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4000-191-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4000-171-0x0000000000000000-mapping.dmp
-
memory/4000-190-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4000-189-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4000-176-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4000-187-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4000-175-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4000-186-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4540-225-0x0000000000000000-mapping.dmp
-
memory/4956-382-0x0000000000000000-mapping.dmp