Analysis
-
max time kernel
171s -
max time network
186s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
12/02/2023, 17:13
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20221111-en
General
-
Target
file.exe
-
Size
719KB
-
MD5
1450f4dcb89c51964eb3a4516761deed
-
SHA1
a6362d6280670c8574645696f410be0bdfa801ce
-
SHA256
ce3fd7f8b043d72232aa9666df38c3021b6fc8aebb92d51b9ef46e8c18f8074d
-
SHA512
96658b3f0f2edc06481dfa37350db658fa39f3a6ab3f7192eacfcc440b8786633dabc6e7b9b9b4fd6cfaf0b439e2da13fc34f6510e35f8885e0d6ed6cded8c88
-
SSDEEP
12288:dMrFy9031ioWiwzVbcDGxqpceJhVSso9Pj9VRR8tvW86TDR6MnNfLfK:MyMBWjzVbcGxqDhVo9Pj9Vr8tu8sDRH8
Malware Config
Extracted
redline
dunm
193.233.20.12:4132
-
auth_value
352959e3707029296ec94306d74e2334
Extracted
amadey
3.66
62.204.41.4/Gol478Ns/index.php
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" fCl52.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" fCl52.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection fCl52.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" fCl52.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" fCl52.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" fCl52.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation bbA14FY.exe Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation mnolyk.exe -
Executes dropped EXE 9 IoCs
pid Process 4676 gED16sa.exe 1704 glI29pT.exe 432 aBc38uw.exe 4484 bbA14FY.exe 2192 mnolyk.exe 208 dbF8408.exe 1492 mnolyk.exe 3472 fCl52.exe 4700 mnolyk.exe -
Loads dropped DLL 1 IoCs
pid Process 4796 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" fCl52.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce file.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" file.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce gED16sa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" gED16sa.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce glI29pT.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" glI29pT.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1804 208 WerFault.exe 85 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2196 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 432 aBc38uw.exe 432 aBc38uw.exe 208 dbF8408.exe 208 dbF8408.exe 3472 fCl52.exe 3472 fCl52.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 432 aBc38uw.exe Token: SeDebugPrivilege 208 dbF8408.exe Token: SeDebugPrivilege 3472 fCl52.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 2808 wrote to memory of 4676 2808 file.exe 80 PID 2808 wrote to memory of 4676 2808 file.exe 80 PID 2808 wrote to memory of 4676 2808 file.exe 80 PID 4676 wrote to memory of 1704 4676 gED16sa.exe 81 PID 4676 wrote to memory of 1704 4676 gED16sa.exe 81 PID 4676 wrote to memory of 1704 4676 gED16sa.exe 81 PID 1704 wrote to memory of 432 1704 glI29pT.exe 82 PID 1704 wrote to memory of 432 1704 glI29pT.exe 82 PID 1704 wrote to memory of 432 1704 glI29pT.exe 82 PID 1704 wrote to memory of 4484 1704 glI29pT.exe 83 PID 1704 wrote to memory of 4484 1704 glI29pT.exe 83 PID 1704 wrote to memory of 4484 1704 glI29pT.exe 83 PID 4484 wrote to memory of 2192 4484 bbA14FY.exe 84 PID 4484 wrote to memory of 2192 4484 bbA14FY.exe 84 PID 4484 wrote to memory of 2192 4484 bbA14FY.exe 84 PID 4676 wrote to memory of 208 4676 gED16sa.exe 85 PID 4676 wrote to memory of 208 4676 gED16sa.exe 85 PID 4676 wrote to memory of 208 4676 gED16sa.exe 85 PID 2192 wrote to memory of 2196 2192 mnolyk.exe 86 PID 2192 wrote to memory of 2196 2192 mnolyk.exe 86 PID 2192 wrote to memory of 2196 2192 mnolyk.exe 86 PID 2192 wrote to memory of 2000 2192 mnolyk.exe 88 PID 2192 wrote to memory of 2000 2192 mnolyk.exe 88 PID 2192 wrote to memory of 2000 2192 mnolyk.exe 88 PID 2000 wrote to memory of 2276 2000 cmd.exe 90 PID 2000 wrote to memory of 2276 2000 cmd.exe 90 PID 2000 wrote to memory of 2276 2000 cmd.exe 90 PID 2000 wrote to memory of 1720 2000 cmd.exe 91 PID 2000 wrote to memory of 1720 2000 cmd.exe 91 PID 2000 wrote to memory of 1720 2000 cmd.exe 91 PID 2000 wrote to memory of 1700 2000 cmd.exe 92 PID 2000 wrote to memory of 1700 2000 cmd.exe 92 PID 2000 wrote to memory of 1700 2000 cmd.exe 92 PID 2000 wrote to memory of 720 2000 cmd.exe 93 PID 2000 wrote to memory of 720 2000 cmd.exe 93 PID 2000 wrote to memory of 720 2000 cmd.exe 93 PID 2000 wrote to memory of 3900 2000 cmd.exe 94 PID 2000 wrote to memory of 3900 2000 cmd.exe 94 PID 2000 wrote to memory of 3900 2000 cmd.exe 94 PID 2000 wrote to memory of 1180 2000 cmd.exe 95 PID 2000 wrote to memory of 1180 2000 cmd.exe 95 PID 2000 wrote to memory of 1180 2000 cmd.exe 95 PID 2808 wrote to memory of 3472 2808 file.exe 106 PID 2808 wrote to memory of 3472 2808 file.exe 106 PID 2192 wrote to memory of 4796 2192 mnolyk.exe 107 PID 2192 wrote to memory of 4796 2192 mnolyk.exe 107 PID 2192 wrote to memory of 4796 2192 mnolyk.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gED16sa.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gED16sa.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\glI29pT.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\glI29pT.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\aBc38uw.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\aBc38uw.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:432
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bbA14FY.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bbA14FY.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe"C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F6⤵
- Creates scheduled task(s)
PID:2196
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\4b9a106e76" /P "Admin:N"&&CACLS "..\4b9a106e76" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:2276
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:N"7⤵PID:1720
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:R" /E7⤵PID:1700
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:720
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\4b9a106e76" /P "Admin:N"7⤵PID:3900
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\4b9a106e76" /P "Admin:R" /E7⤵PID:1180
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main6⤵
- Loads dropped DLL
PID:4796
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dbF8408.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dbF8408.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:208 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 13524⤵
- Program crash
PID:1804
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fCl52.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fCl52.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3472
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 208 -ip 2081⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe1⤵
- Executes dropped EXE
PID:1492
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe1⤵
- Executes dropped EXE
PID:4700
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
236KB
MD58bb923c4d81284daef7896e5682df6c6
SHA167e34a96b77e44b666c5479f540995bdeacf5de2
SHA2569b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21
SHA5122daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7
-
Filesize
236KB
MD58bb923c4d81284daef7896e5682df6c6
SHA167e34a96b77e44b666c5479f540995bdeacf5de2
SHA2569b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21
SHA5122daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7
-
Filesize
236KB
MD58bb923c4d81284daef7896e5682df6c6
SHA167e34a96b77e44b666c5479f540995bdeacf5de2
SHA2569b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21
SHA5122daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7
-
Filesize
236KB
MD58bb923c4d81284daef7896e5682df6c6
SHA167e34a96b77e44b666c5479f540995bdeacf5de2
SHA2569b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21
SHA5122daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
615KB
MD5bd957a870696c2fade76b039e1a1862e
SHA18b4295196392588e0128549766efbc0b20ba7f7a
SHA256e468ebae17c4505962ad246f50c7a72c533cbcb1932889c7cf7e26a804d8a19e
SHA5120f356a3d1aa65ab1cf2c8fd513c6e3da73e1e565e99d7f4caee920c7f1b7f144842cb0399b4b16093807378477f51b24f452175abb3112ebb8002e9b9595bd5d
-
Filesize
615KB
MD5bd957a870696c2fade76b039e1a1862e
SHA18b4295196392588e0128549766efbc0b20ba7f7a
SHA256e468ebae17c4505962ad246f50c7a72c533cbcb1932889c7cf7e26a804d8a19e
SHA5120f356a3d1aa65ab1cf2c8fd513c6e3da73e1e565e99d7f4caee920c7f1b7f144842cb0399b4b16093807378477f51b24f452175abb3112ebb8002e9b9595bd5d
-
Filesize
287KB
MD55679820c359decb6148df7d1f99dbf24
SHA1afc2c0c251e62bdcfa1b53ae4f228ba8d734ee9f
SHA2566187b858630a3b80420ea4e8643056877eb2c528f9f366e4b41d4d31443e5938
SHA51271d465a2e6accb08a50dc8545792df0c0dd2ea67c06be3462448ce4d76166c12214a8e8b99d994a7303d8b9b7c6f8974b01aa5af206f3f2eed4e59b503731aa9
-
Filesize
287KB
MD55679820c359decb6148df7d1f99dbf24
SHA1afc2c0c251e62bdcfa1b53ae4f228ba8d734ee9f
SHA2566187b858630a3b80420ea4e8643056877eb2c528f9f366e4b41d4d31443e5938
SHA51271d465a2e6accb08a50dc8545792df0c0dd2ea67c06be3462448ce4d76166c12214a8e8b99d994a7303d8b9b7c6f8974b01aa5af206f3f2eed4e59b503731aa9
-
Filesize
286KB
MD53c8c88f71ff35c321c0c96da90cf2913
SHA13b96bdc1ff2a487bb62021e10f12152442681c18
SHA25699e703f9e297548078f4835ce68d99bf047136ba990b076988fe35cb7299637f
SHA512adec913f786a2be6a6de6542b6d49f955fc5d5ea8214ab9395f57417374635a0fb96f2e542293a332e479a1b4ab0d61af1e93a79ce9a803de5ad655ea50794c3
-
Filesize
286KB
MD53c8c88f71ff35c321c0c96da90cf2913
SHA13b96bdc1ff2a487bb62021e10f12152442681c18
SHA25699e703f9e297548078f4835ce68d99bf047136ba990b076988fe35cb7299637f
SHA512adec913f786a2be6a6de6542b6d49f955fc5d5ea8214ab9395f57417374635a0fb96f2e542293a332e479a1b4ab0d61af1e93a79ce9a803de5ad655ea50794c3
-
Filesize
175KB
MD569f79e05d0c83aee310d9adfe5aa7f2b
SHA1485c490180380051a14316564fbda07723be11b1
SHA256c41dc7f6cc752595337cd7f209f923b43b061b201c6ab4dc02151afb90cd66e2
SHA512f1789a74aeb83867c37ddeadcd06cddfc1454a94fcc122b35d67b0309b46742b9a6611e4c3e583baa90a3fd456e45c75ae5f1a206f6e4500c1f3f8ddf5e47b42
-
Filesize
175KB
MD569f79e05d0c83aee310d9adfe5aa7f2b
SHA1485c490180380051a14316564fbda07723be11b1
SHA256c41dc7f6cc752595337cd7f209f923b43b061b201c6ab4dc02151afb90cd66e2
SHA512f1789a74aeb83867c37ddeadcd06cddfc1454a94fcc122b35d67b0309b46742b9a6611e4c3e583baa90a3fd456e45c75ae5f1a206f6e4500c1f3f8ddf5e47b42
-
Filesize
236KB
MD58bb923c4d81284daef7896e5682df6c6
SHA167e34a96b77e44b666c5479f540995bdeacf5de2
SHA2569b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21
SHA5122daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7
-
Filesize
236KB
MD58bb923c4d81284daef7896e5682df6c6
SHA167e34a96b77e44b666c5479f540995bdeacf5de2
SHA2569b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21
SHA5122daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7
-
Filesize
89KB
MD5c79b74d8fec5e7e2ba2f1789fd582a15
SHA178a1e5d99dbaccc5e07b125e1dfb280112cb3128
SHA256b5bd049d32f0faeea6ce65a0f0d326de5bc4427a7c1ad24bfb0ea050c1dec7d3
SHA5120debfc54904fd538cfb1fc648d18f90a991337200b3decf74b28ac2f341843fb3bab4f45bc92cfec333b18dfff9cc136854462e79054a39926a7bd8ee2e057ba
-
Filesize
89KB
MD5c79b74d8fec5e7e2ba2f1789fd582a15
SHA178a1e5d99dbaccc5e07b125e1dfb280112cb3128
SHA256b5bd049d32f0faeea6ce65a0f0d326de5bc4427a7c1ad24bfb0ea050c1dec7d3
SHA5120debfc54904fd538cfb1fc648d18f90a991337200b3decf74b28ac2f341843fb3bab4f45bc92cfec333b18dfff9cc136854462e79054a39926a7bd8ee2e057ba