Analysis
-
max time kernel
55s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
09-02-2023 13:58
Static task
static1
Behavioral task
behavioral1
Sample
aa8b2be4fc7f54a1f4d5b98c50339db3e72438919305251c29b5a379f10d9315.exe
Resource
win10-20220812-en
General
-
Target
aa8b2be4fc7f54a1f4d5b98c50339db3e72438919305251c29b5a379f10d9315.exe
-
Size
514KB
-
MD5
ab996d5b02f6f125f5cfe2b15a810a34
-
SHA1
62be350e5491b392ecca94e31e84aca345d0edd9
-
SHA256
aa8b2be4fc7f54a1f4d5b98c50339db3e72438919305251c29b5a379f10d9315
-
SHA512
5d0c49c2597798c92d6b0160bf8bcc26e3534dd6f9f9246e25191069a35a1306eb992f106f908ec7cd6e74c6a65b1e693b7673281ad02537317c9234da26fe25
-
SSDEEP
12288:lMrFy90Ew/NnQrIs3MWmhk8ddtqMA9Q7vjzDLfkxC:8y0nY3MJhk8d7TASnzT
Malware Config
Extracted
redline
romka
193.233.20.11:4131
-
auth_value
fcbb3247051f5290e8ac5b1a841af67b
Extracted
redline
crypt
176.113.115.17:4132
-
auth_value
407e05c9b3a74d99a20f90b091547bd6
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2144-221-0x0000000002390000-0x00000000023D6000-memory.dmp family_redline behavioral1/memory/2144-227-0x0000000005060000-0x00000000050A4000-memory.dmp family_redline -
Executes dropped EXE 2 IoCs
Processes:
blof.execloloa.exepid process 2144 blof.exe 4736 cloloa.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
aa8b2be4fc7f54a1f4d5b98c50339db3e72438919305251c29b5a379f10d9315.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce aa8b2be4fc7f54a1f4d5b98c50339db3e72438919305251c29b5a379f10d9315.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" aa8b2be4fc7f54a1f4d5b98c50339db3e72438919305251c29b5a379f10d9315.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
cloloa.exedescription pid process target process PID 4736 set thread context of 4976 4736 cloloa.exe AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
blof.exeAppLaunch.exepid process 2144 blof.exe 2144 blof.exe 4976 AppLaunch.exe 4976 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
blof.exeAppLaunch.exedescription pid process Token: SeDebugPrivilege 2144 blof.exe Token: SeDebugPrivilege 4976 AppLaunch.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
aa8b2be4fc7f54a1f4d5b98c50339db3e72438919305251c29b5a379f10d9315.execloloa.exedescription pid process target process PID 2716 wrote to memory of 2144 2716 aa8b2be4fc7f54a1f4d5b98c50339db3e72438919305251c29b5a379f10d9315.exe blof.exe PID 2716 wrote to memory of 2144 2716 aa8b2be4fc7f54a1f4d5b98c50339db3e72438919305251c29b5a379f10d9315.exe blof.exe PID 2716 wrote to memory of 2144 2716 aa8b2be4fc7f54a1f4d5b98c50339db3e72438919305251c29b5a379f10d9315.exe blof.exe PID 2716 wrote to memory of 4736 2716 aa8b2be4fc7f54a1f4d5b98c50339db3e72438919305251c29b5a379f10d9315.exe cloloa.exe PID 2716 wrote to memory of 4736 2716 aa8b2be4fc7f54a1f4d5b98c50339db3e72438919305251c29b5a379f10d9315.exe cloloa.exe PID 2716 wrote to memory of 4736 2716 aa8b2be4fc7f54a1f4d5b98c50339db3e72438919305251c29b5a379f10d9315.exe cloloa.exe PID 4736 wrote to memory of 4976 4736 cloloa.exe AppLaunch.exe PID 4736 wrote to memory of 4976 4736 cloloa.exe AppLaunch.exe PID 4736 wrote to memory of 4976 4736 cloloa.exe AppLaunch.exe PID 4736 wrote to memory of 4976 4736 cloloa.exe AppLaunch.exe PID 4736 wrote to memory of 4976 4736 cloloa.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa8b2be4fc7f54a1f4d5b98c50339db3e72438919305251c29b5a379f10d9315.exe"C:\Users\Admin\AppData\Local\Temp\aa8b2be4fc7f54a1f4d5b98c50339db3e72438919305251c29b5a379f10d9315.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\blof.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\blof.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cloloa.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cloloa.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\blof.exeFilesize
294KB
MD5b8932f9e6cefce7bc5f5670090f4fc8e
SHA1e16c0bb2a4e98679b1f4471ec00b68aa696b79e2
SHA2561995bff914d60f0009dda3a9a421040158d76e0f07f63327a6e77d7ee290414f
SHA5125c00465afdbffed29b6aac11be4ad3a644114e8aff8fb1723b611b92eaf2c744f2315daccef253c3cae6b0228c01b7bd81aae6c8c6375b3b826492687aee66cc
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\blof.exeFilesize
294KB
MD5b8932f9e6cefce7bc5f5670090f4fc8e
SHA1e16c0bb2a4e98679b1f4471ec00b68aa696b79e2
SHA2561995bff914d60f0009dda3a9a421040158d76e0f07f63327a6e77d7ee290414f
SHA5125c00465afdbffed29b6aac11be4ad3a644114e8aff8fb1723b611b92eaf2c744f2315daccef253c3cae6b0228c01b7bd81aae6c8c6375b3b826492687aee66cc
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cloloa.exeFilesize
283KB
MD5457dcca2cfa8e1592521e4bc580d2097
SHA1de855fa7934126fd1cde834b752999ebe79e367f
SHA25654ce28a037eea87448e65bc25f8d3a38ddd4b4679516cc59899b77150aa46fcc
SHA512d15709dd44e184612a86e7201c78887771e7cc062e8b4daf83c5bbf1d6dd74320e8c5058cde295d412d8e5b135f8686f8ed56aa9aa2a439b022319e6723bb752
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cloloa.exeFilesize
283KB
MD5457dcca2cfa8e1592521e4bc580d2097
SHA1de855fa7934126fd1cde834b752999ebe79e367f
SHA25654ce28a037eea87448e65bc25f8d3a38ddd4b4679516cc59899b77150aa46fcc
SHA512d15709dd44e184612a86e7201c78887771e7cc062e8b4daf83c5bbf1d6dd74320e8c5058cde295d412d8e5b135f8686f8ed56aa9aa2a439b022319e6723bb752
-
memory/2144-214-0x0000000000400000-0x0000000000579000-memory.dmpFilesize
1.5MB
-
memory/2144-162-0x0000000000000000-mapping.dmp
-
memory/2144-272-0x0000000000400000-0x0000000000579000-memory.dmpFilesize
1.5MB
-
memory/2144-271-0x0000000000891000-0x00000000008BF000-memory.dmpFilesize
184KB
-
memory/2144-164-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2144-266-0x0000000006E00000-0x0000000006E50000-memory.dmpFilesize
320KB
-
memory/2144-265-0x0000000006D80000-0x0000000006DF6000-memory.dmpFilesize
472KB
-
memory/2144-263-0x0000000000891000-0x00000000008BF000-memory.dmpFilesize
184KB
-
memory/2144-264-0x0000000000680000-0x00000000007CA000-memory.dmpFilesize
1.3MB
-
memory/2144-260-0x00000000064E0000-0x0000000006A0C000-memory.dmpFilesize
5.2MB
-
memory/2144-259-0x0000000006310000-0x00000000064D2000-memory.dmpFilesize
1.8MB
-
memory/2144-166-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2144-258-0x0000000006220000-0x00000000062B2000-memory.dmpFilesize
584KB
-
memory/2144-250-0x0000000005B60000-0x0000000005BC6000-memory.dmpFilesize
408KB
-
memory/2144-245-0x00000000059D0000-0x0000000005A1B000-memory.dmpFilesize
300KB
-
memory/2144-243-0x0000000005880000-0x00000000058BE000-memory.dmpFilesize
248KB
-
memory/2144-241-0x0000000005860000-0x0000000005872000-memory.dmpFilesize
72KB
-
memory/2144-239-0x0000000005720000-0x000000000582A000-memory.dmpFilesize
1.0MB
-
memory/2144-238-0x00000000050A0000-0x00000000056A6000-memory.dmpFilesize
6.0MB
-
memory/2144-227-0x0000000005060000-0x00000000050A4000-memory.dmpFilesize
272KB
-
memory/2144-225-0x0000000004B60000-0x000000000505E000-memory.dmpFilesize
5.0MB
-
memory/2144-221-0x0000000002390000-0x00000000023D6000-memory.dmpFilesize
280KB
-
memory/2144-212-0x0000000000680000-0x00000000007CA000-memory.dmpFilesize
1.3MB
-
memory/2144-165-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2144-211-0x0000000000891000-0x00000000008BF000-memory.dmpFilesize
184KB
-
memory/2144-182-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2144-181-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2144-180-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2144-179-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2144-178-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2144-177-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2144-176-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2144-175-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2144-174-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2144-173-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2144-172-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2144-170-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2144-169-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2144-168-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2144-167-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-142-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-116-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-160-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-120-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-124-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-143-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-132-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-159-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-158-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-157-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-155-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-156-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-154-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-153-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-119-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-151-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-152-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-150-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-149-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-148-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-147-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-146-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-145-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-144-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-121-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-161-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-141-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-140-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-139-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-138-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-137-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-136-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-135-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-134-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-133-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-131-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-130-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-126-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-129-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-128-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-127-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-125-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-123-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-122-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-117-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2716-118-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/4736-273-0x0000000000000000-mapping.dmp
-
memory/4976-319-0x000000000079B592-mapping.dmp
-
memory/4976-371-0x0000000000780000-0x00000000007B2000-memory.dmpFilesize
200KB
-
memory/4976-387-0x0000000008E50000-0x0000000008E9B000-memory.dmpFilesize
300KB