Analysis
-
max time kernel
125s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
12-02-2023 03:49
Static task
static1
Behavioral task
behavioral1
Sample
11e3a29344e93641be53aeba47ab00596070590691bbce9e799e649999b62d83.exe
Resource
win10v2004-20220812-en
General
-
Target
11e3a29344e93641be53aeba47ab00596070590691bbce9e799e649999b62d83.exe
-
Size
724KB
-
MD5
00a3c62c98d6f8daeb9872b0a0292a51
-
SHA1
620707da9604a7ffd5cf18f2f2dd7a15fffe6e87
-
SHA256
11e3a29344e93641be53aeba47ab00596070590691bbce9e799e649999b62d83
-
SHA512
19336fc9d31aa1fd939728d35913b1ac4326eca6a267039bb8ab04dd1b9b06a4847ef9ba3e1da9606a0e8e76e9d6b97af9b1ddd8933fbe0823610caa935f2baa
-
SSDEEP
12288:MMrXy90sJ+UV0oCCote31RD2WegyeJRwq7p5N9deY0KS2IhWi:DyTV0CbXRtT0nyi
Malware Config
Extracted
redline
dunm
193.233.20.12:4132
-
auth_value
352959e3707029296ec94306d74e2334
Extracted
amadey
3.66
62.204.41.4/Gol478Ns/index.php
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" fvH11.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" fvH11.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" fvH11.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection fvH11.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" fvH11.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" fvH11.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation bMf79Hy.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation mnolyk.exe -
Executes dropped EXE 8 IoCs
pid Process 1912 gay78Wa.exe 4768 gsG94lf.exe 2628 aKR78id.exe 4688 bMf79Hy.exe 4084 mnolyk.exe 912 dnP1639.exe 3912 fvH11.exe 560 mnolyk.exe -
Loads dropped DLL 1 IoCs
pid Process 4140 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" fvH11.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 11e3a29344e93641be53aeba47ab00596070590691bbce9e799e649999b62d83.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce gay78Wa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" gay78Wa.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce gsG94lf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" gsG94lf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 11e3a29344e93641be53aeba47ab00596070590691bbce9e799e649999b62d83.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 4964 912 WerFault.exe 84 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4928 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2628 aKR78id.exe 2628 aKR78id.exe 912 dnP1639.exe 912 dnP1639.exe 3912 fvH11.exe 3912 fvH11.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2628 aKR78id.exe Token: SeDebugPrivilege 912 dnP1639.exe Token: SeDebugPrivilege 3912 fvH11.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 4716 wrote to memory of 1912 4716 11e3a29344e93641be53aeba47ab00596070590691bbce9e799e649999b62d83.exe 79 PID 4716 wrote to memory of 1912 4716 11e3a29344e93641be53aeba47ab00596070590691bbce9e799e649999b62d83.exe 79 PID 4716 wrote to memory of 1912 4716 11e3a29344e93641be53aeba47ab00596070590691bbce9e799e649999b62d83.exe 79 PID 1912 wrote to memory of 4768 1912 gay78Wa.exe 80 PID 1912 wrote to memory of 4768 1912 gay78Wa.exe 80 PID 1912 wrote to memory of 4768 1912 gay78Wa.exe 80 PID 4768 wrote to memory of 2628 4768 gsG94lf.exe 81 PID 4768 wrote to memory of 2628 4768 gsG94lf.exe 81 PID 4768 wrote to memory of 2628 4768 gsG94lf.exe 81 PID 4768 wrote to memory of 4688 4768 gsG94lf.exe 82 PID 4768 wrote to memory of 4688 4768 gsG94lf.exe 82 PID 4768 wrote to memory of 4688 4768 gsG94lf.exe 82 PID 4688 wrote to memory of 4084 4688 bMf79Hy.exe 83 PID 4688 wrote to memory of 4084 4688 bMf79Hy.exe 83 PID 4688 wrote to memory of 4084 4688 bMf79Hy.exe 83 PID 1912 wrote to memory of 912 1912 gay78Wa.exe 84 PID 1912 wrote to memory of 912 1912 gay78Wa.exe 84 PID 1912 wrote to memory of 912 1912 gay78Wa.exe 84 PID 4084 wrote to memory of 4928 4084 mnolyk.exe 85 PID 4084 wrote to memory of 4928 4084 mnolyk.exe 85 PID 4084 wrote to memory of 4928 4084 mnolyk.exe 85 PID 4084 wrote to memory of 636 4084 mnolyk.exe 87 PID 4084 wrote to memory of 636 4084 mnolyk.exe 87 PID 4084 wrote to memory of 636 4084 mnolyk.exe 87 PID 636 wrote to memory of 884 636 cmd.exe 89 PID 636 wrote to memory of 884 636 cmd.exe 89 PID 636 wrote to memory of 884 636 cmd.exe 89 PID 636 wrote to memory of 1184 636 cmd.exe 90 PID 636 wrote to memory of 1184 636 cmd.exe 90 PID 636 wrote to memory of 1184 636 cmd.exe 90 PID 636 wrote to memory of 3396 636 cmd.exe 92 PID 636 wrote to memory of 3396 636 cmd.exe 92 PID 636 wrote to memory of 3396 636 cmd.exe 92 PID 636 wrote to memory of 1076 636 cmd.exe 93 PID 636 wrote to memory of 1076 636 cmd.exe 93 PID 636 wrote to memory of 1076 636 cmd.exe 93 PID 636 wrote to memory of 2004 636 cmd.exe 94 PID 636 wrote to memory of 2004 636 cmd.exe 94 PID 636 wrote to memory of 2004 636 cmd.exe 94 PID 636 wrote to memory of 1744 636 cmd.exe 95 PID 636 wrote to memory of 1744 636 cmd.exe 95 PID 636 wrote to memory of 1744 636 cmd.exe 95 PID 4084 wrote to memory of 4140 4084 mnolyk.exe 99 PID 4084 wrote to memory of 4140 4084 mnolyk.exe 99 PID 4084 wrote to memory of 4140 4084 mnolyk.exe 99 PID 4716 wrote to memory of 3912 4716 11e3a29344e93641be53aeba47ab00596070590691bbce9e799e649999b62d83.exe 100 PID 4716 wrote to memory of 3912 4716 11e3a29344e93641be53aeba47ab00596070590691bbce9e799e649999b62d83.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\11e3a29344e93641be53aeba47ab00596070590691bbce9e799e649999b62d83.exe"C:\Users\Admin\AppData\Local\Temp\11e3a29344e93641be53aeba47ab00596070590691bbce9e799e649999b62d83.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gay78Wa.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gay78Wa.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gsG94lf.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gsG94lf.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\aKR78id.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\aKR78id.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2628
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bMf79Hy.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bMf79Hy.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe"C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F6⤵
- Creates scheduled task(s)
PID:4928
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\4b9a106e76" /P "Admin:N"&&CACLS "..\4b9a106e76" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:884
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:N"7⤵PID:1184
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:R" /E7⤵PID:3396
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:1076
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\4b9a106e76" /P "Admin:N"7⤵PID:2004
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\4b9a106e76" /P "Admin:R" /E7⤵PID:1744
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main6⤵
- Loads dropped DLL
PID:4140
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dnP1639.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dnP1639.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:912 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 912 -s 13524⤵
- Program crash
PID:4964
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fvH11.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fvH11.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3912
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 912 -ip 9121⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe1⤵
- Executes dropped EXE
PID:560
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
236KB
MD58bb923c4d81284daef7896e5682df6c6
SHA167e34a96b77e44b666c5479f540995bdeacf5de2
SHA2569b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21
SHA5122daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7
-
Filesize
236KB
MD58bb923c4d81284daef7896e5682df6c6
SHA167e34a96b77e44b666c5479f540995bdeacf5de2
SHA2569b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21
SHA5122daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7
-
Filesize
236KB
MD58bb923c4d81284daef7896e5682df6c6
SHA167e34a96b77e44b666c5479f540995bdeacf5de2
SHA2569b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21
SHA5122daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
620KB
MD5d537d3a1c858e6261a2e7c50297c88e6
SHA1a732a21cc9f92939513bef07562df6d5cccae2d6
SHA256c4b16a38be05a2e5b8c3f7a17aa206c2b49b5c9ba04ed57ae390406331d09be2
SHA512dc52ebd4dad10890102cdd5c8063dcb3c6c665cf4062bc6bcd8392a56feab211228063c19f78e39ce8dce3229593b3f67a2ce00d9adec875231218588e1424da
-
Filesize
620KB
MD5d537d3a1c858e6261a2e7c50297c88e6
SHA1a732a21cc9f92939513bef07562df6d5cccae2d6
SHA256c4b16a38be05a2e5b8c3f7a17aa206c2b49b5c9ba04ed57ae390406331d09be2
SHA512dc52ebd4dad10890102cdd5c8063dcb3c6c665cf4062bc6bcd8392a56feab211228063c19f78e39ce8dce3229593b3f67a2ce00d9adec875231218588e1424da
-
Filesize
296KB
MD5d9e71b0156f68d4cda84e1cedfbaca3a
SHA137ed58dce2e3c595dcebfc2756261820ca56dfda
SHA256c5c4d980034190d276fc28b7cc65974748abdbdc99ff4319a76bb44554ad1fef
SHA5128ab927f50f4241e1abb0d94088e278dfc0dcfe93003de36cdc893bc23b7472a98ba3259fa4d89544645fc568ed05deb57c6791883c1ceed6094b4640127db65f
-
Filesize
296KB
MD5d9e71b0156f68d4cda84e1cedfbaca3a
SHA137ed58dce2e3c595dcebfc2756261820ca56dfda
SHA256c5c4d980034190d276fc28b7cc65974748abdbdc99ff4319a76bb44554ad1fef
SHA5128ab927f50f4241e1abb0d94088e278dfc0dcfe93003de36cdc893bc23b7472a98ba3259fa4d89544645fc568ed05deb57c6791883c1ceed6094b4640127db65f
-
Filesize
286KB
MD54ff1bdbb4f429e1392cf629caac19060
SHA1ef4039f4e421b209cd88c20168976adcd23ef929
SHA256319f247624e463398b2ae2f592328339a77bb37184d64e4bbed777eede8f7ddd
SHA5129a7622761919298eaa8d7f1ffdd13bdc1b27d20c8023c69cd0e41d09fb06001187d6690505317a58c788f78c6f3750149d22c546decb3d3e1c0e5f4322c8b4ad
-
Filesize
286KB
MD54ff1bdbb4f429e1392cf629caac19060
SHA1ef4039f4e421b209cd88c20168976adcd23ef929
SHA256319f247624e463398b2ae2f592328339a77bb37184d64e4bbed777eede8f7ddd
SHA5129a7622761919298eaa8d7f1ffdd13bdc1b27d20c8023c69cd0e41d09fb06001187d6690505317a58c788f78c6f3750149d22c546decb3d3e1c0e5f4322c8b4ad
-
Filesize
175KB
MD569f79e05d0c83aee310d9adfe5aa7f2b
SHA1485c490180380051a14316564fbda07723be11b1
SHA256c41dc7f6cc752595337cd7f209f923b43b061b201c6ab4dc02151afb90cd66e2
SHA512f1789a74aeb83867c37ddeadcd06cddfc1454a94fcc122b35d67b0309b46742b9a6611e4c3e583baa90a3fd456e45c75ae5f1a206f6e4500c1f3f8ddf5e47b42
-
Filesize
175KB
MD569f79e05d0c83aee310d9adfe5aa7f2b
SHA1485c490180380051a14316564fbda07723be11b1
SHA256c41dc7f6cc752595337cd7f209f923b43b061b201c6ab4dc02151afb90cd66e2
SHA512f1789a74aeb83867c37ddeadcd06cddfc1454a94fcc122b35d67b0309b46742b9a6611e4c3e583baa90a3fd456e45c75ae5f1a206f6e4500c1f3f8ddf5e47b42
-
Filesize
236KB
MD58bb923c4d81284daef7896e5682df6c6
SHA167e34a96b77e44b666c5479f540995bdeacf5de2
SHA2569b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21
SHA5122daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7
-
Filesize
236KB
MD58bb923c4d81284daef7896e5682df6c6
SHA167e34a96b77e44b666c5479f540995bdeacf5de2
SHA2569b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21
SHA5122daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7
-
Filesize
89KB
MD5c79b74d8fec5e7e2ba2f1789fd582a15
SHA178a1e5d99dbaccc5e07b125e1dfb280112cb3128
SHA256b5bd049d32f0faeea6ce65a0f0d326de5bc4427a7c1ad24bfb0ea050c1dec7d3
SHA5120debfc54904fd538cfb1fc648d18f90a991337200b3decf74b28ac2f341843fb3bab4f45bc92cfec333b18dfff9cc136854462e79054a39926a7bd8ee2e057ba
-
Filesize
89KB
MD5c79b74d8fec5e7e2ba2f1789fd582a15
SHA178a1e5d99dbaccc5e07b125e1dfb280112cb3128
SHA256b5bd049d32f0faeea6ce65a0f0d326de5bc4427a7c1ad24bfb0ea050c1dec7d3
SHA5120debfc54904fd538cfb1fc648d18f90a991337200b3decf74b28ac2f341843fb3bab4f45bc92cfec333b18dfff9cc136854462e79054a39926a7bd8ee2e057ba