Analysis
-
max time kernel
147s -
max time network
146s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
13/02/2023, 11:54
Static task
static1
General
-
Target
79cfd2ac20a30d13ee5fa93ff215753faf944aac5df4b50c874e7046c4179d3d.exe
-
Size
728KB
-
MD5
c69255d6bd840aa81e410b528b148785
-
SHA1
93c0bcf09e13d85c13f4a8dca7485573de97f4c6
-
SHA256
79cfd2ac20a30d13ee5fa93ff215753faf944aac5df4b50c874e7046c4179d3d
-
SHA512
39329740e00fe54b27f3a7c6f741312a3c63bebaf76937b2785738d754b7a7e0567265dbb2c314716f5b483efe2c8b4f5c33b1aed18ea310b4ca85e03196b30a
-
SSDEEP
12288:sMrUy906d+T7c9EkzoOWuGvs+u88nmqIPy2xcz3aShrroNdRmIsm2VzalN:Qy5+SZW7vtu88nmqIq2xe3aSlUNzsmaE
Malware Config
Extracted
redline
fusa
193.233.20.12:4132
-
auth_value
a08b2f01bd2af756e38c5dd60e87e697
Extracted
amadey
3.66
62.204.41.5/Bu58Ngs/index.php
Extracted
redline
romik
193.233.20.12:4132
-
auth_value
8fb78d2889ba0ca42678b59b884e88ff
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" rzo10qP.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" rzo10qP.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" rzo10qP.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" rzo10qP.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" rzo10qP.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral1/memory/1428-592-0x0000000002200000-0x0000000002246000-memory.dmp family_redline behavioral1/memory/1428-604-0x0000000002490000-0x00000000024D4000-memory.dmp family_redline -
Executes dropped EXE 9 IoCs
pid Process 2068 shF35Yi.exe 2972 sGG17Lp.exe 4232 kiw35DP.exe 3712 mcP97.exe 1092 mnolyk.exe 1428 nTE24YY.exe 4688 rzo10qP.exe 1400 mnolyk.exe 792 mnolyk.exe -
Loads dropped DLL 1 IoCs
pid Process 476 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" rzo10qP.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce shF35Yi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" shF35Yi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce sGG17Lp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" sGG17Lp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 79cfd2ac20a30d13ee5fa93ff215753faf944aac5df4b50c874e7046c4179d3d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 79cfd2ac20a30d13ee5fa93ff215753faf944aac5df4b50c874e7046c4179d3d.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2516 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4232 kiw35DP.exe 4232 kiw35DP.exe 1428 nTE24YY.exe 1428 nTE24YY.exe 4688 rzo10qP.exe 4688 rzo10qP.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4232 kiw35DP.exe Token: SeDebugPrivilege 1428 nTE24YY.exe Token: SeDebugPrivilege 4688 rzo10qP.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 2740 wrote to memory of 2068 2740 79cfd2ac20a30d13ee5fa93ff215753faf944aac5df4b50c874e7046c4179d3d.exe 66 PID 2740 wrote to memory of 2068 2740 79cfd2ac20a30d13ee5fa93ff215753faf944aac5df4b50c874e7046c4179d3d.exe 66 PID 2740 wrote to memory of 2068 2740 79cfd2ac20a30d13ee5fa93ff215753faf944aac5df4b50c874e7046c4179d3d.exe 66 PID 2068 wrote to memory of 2972 2068 shF35Yi.exe 67 PID 2068 wrote to memory of 2972 2068 shF35Yi.exe 67 PID 2068 wrote to memory of 2972 2068 shF35Yi.exe 67 PID 2972 wrote to memory of 4232 2972 sGG17Lp.exe 68 PID 2972 wrote to memory of 4232 2972 sGG17Lp.exe 68 PID 2972 wrote to memory of 4232 2972 sGG17Lp.exe 68 PID 2972 wrote to memory of 3712 2972 sGG17Lp.exe 70 PID 2972 wrote to memory of 3712 2972 sGG17Lp.exe 70 PID 2972 wrote to memory of 3712 2972 sGG17Lp.exe 70 PID 3712 wrote to memory of 1092 3712 mcP97.exe 71 PID 3712 wrote to memory of 1092 3712 mcP97.exe 71 PID 3712 wrote to memory of 1092 3712 mcP97.exe 71 PID 2068 wrote to memory of 1428 2068 shF35Yi.exe 72 PID 2068 wrote to memory of 1428 2068 shF35Yi.exe 72 PID 2068 wrote to memory of 1428 2068 shF35Yi.exe 72 PID 1092 wrote to memory of 2516 1092 mnolyk.exe 73 PID 1092 wrote to memory of 2516 1092 mnolyk.exe 73 PID 1092 wrote to memory of 2516 1092 mnolyk.exe 73 PID 1092 wrote to memory of 2680 1092 mnolyk.exe 74 PID 1092 wrote to memory of 2680 1092 mnolyk.exe 74 PID 1092 wrote to memory of 2680 1092 mnolyk.exe 74 PID 2680 wrote to memory of 3484 2680 cmd.exe 77 PID 2680 wrote to memory of 3484 2680 cmd.exe 77 PID 2680 wrote to memory of 3484 2680 cmd.exe 77 PID 2680 wrote to memory of 2244 2680 cmd.exe 78 PID 2680 wrote to memory of 2244 2680 cmd.exe 78 PID 2680 wrote to memory of 2244 2680 cmd.exe 78 PID 2680 wrote to memory of 4124 2680 cmd.exe 79 PID 2680 wrote to memory of 4124 2680 cmd.exe 79 PID 2680 wrote to memory of 4124 2680 cmd.exe 79 PID 2680 wrote to memory of 4824 2680 cmd.exe 80 PID 2680 wrote to memory of 4824 2680 cmd.exe 80 PID 2680 wrote to memory of 4824 2680 cmd.exe 80 PID 2680 wrote to memory of 3932 2680 cmd.exe 81 PID 2680 wrote to memory of 3932 2680 cmd.exe 81 PID 2680 wrote to memory of 3932 2680 cmd.exe 81 PID 2680 wrote to memory of 3004 2680 cmd.exe 82 PID 2680 wrote to memory of 3004 2680 cmd.exe 82 PID 2680 wrote to memory of 3004 2680 cmd.exe 82 PID 2740 wrote to memory of 4688 2740 79cfd2ac20a30d13ee5fa93ff215753faf944aac5df4b50c874e7046c4179d3d.exe 83 PID 2740 wrote to memory of 4688 2740 79cfd2ac20a30d13ee5fa93ff215753faf944aac5df4b50c874e7046c4179d3d.exe 83 PID 1092 wrote to memory of 476 1092 mnolyk.exe 84 PID 1092 wrote to memory of 476 1092 mnolyk.exe 84 PID 1092 wrote to memory of 476 1092 mnolyk.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\79cfd2ac20a30d13ee5fa93ff215753faf944aac5df4b50c874e7046c4179d3d.exe"C:\Users\Admin\AppData\Local\Temp\79cfd2ac20a30d13ee5fa93ff215753faf944aac5df4b50c874e7046c4179d3d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\shF35Yi.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\shF35Yi.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sGG17Lp.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sGG17Lp.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kiw35DP.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kiw35DP.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4232
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mcP97.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mcP97.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe"C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe" /F6⤵
- Creates scheduled task(s)
PID:2516
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5eb6b96734" /P "Admin:N"&&CACLS "..\5eb6b96734" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:3484
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:N"7⤵PID:2244
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:R" /E7⤵PID:4124
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:4824
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\5eb6b96734" /P "Admin:N"7⤵PID:3932
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\5eb6b96734" /P "Admin:R" /E7⤵PID:3004
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
PID:476
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nTE24YY.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nTE24YY.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1428
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rzo10qP.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rzo10qP.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4688
-
-
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe1⤵
- Executes dropped EXE
PID:1400
-
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe1⤵
- Executes dropped EXE
PID:792
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
236KB
MD5fde8915d251fada3a37530421eb29dcf
SHA144386a8947ddfab993409945dae05a772a13e047
SHA2566cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116
SHA512ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd
-
Filesize
236KB
MD5fde8915d251fada3a37530421eb29dcf
SHA144386a8947ddfab993409945dae05a772a13e047
SHA2566cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116
SHA512ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd
-
Filesize
236KB
MD5fde8915d251fada3a37530421eb29dcf
SHA144386a8947ddfab993409945dae05a772a13e047
SHA2566cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116
SHA512ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd
-
Filesize
236KB
MD5fde8915d251fada3a37530421eb29dcf
SHA144386a8947ddfab993409945dae05a772a13e047
SHA2566cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116
SHA512ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
624KB
MD5a57422f4e6e8e31f38296adf54282457
SHA1a0cf558a76cf883ffcf63314ed7d5724f38d85b0
SHA256a8fc472526092df52a67dbe68a882915848cc6467813e2cb15d7dc4252bbab7e
SHA512f5b2e33d31bb13091f6b2c610409d59056904600f8959d6c5604c4739df7a0587f78d36269900233e98353c8ee069a34521172a136045c5a790adb6f7b5bd4b5
-
Filesize
624KB
MD5a57422f4e6e8e31f38296adf54282457
SHA1a0cf558a76cf883ffcf63314ed7d5724f38d85b0
SHA256a8fc472526092df52a67dbe68a882915848cc6467813e2cb15d7dc4252bbab7e
SHA512f5b2e33d31bb13091f6b2c610409d59056904600f8959d6c5604c4739df7a0587f78d36269900233e98353c8ee069a34521172a136045c5a790adb6f7b5bd4b5
-
Filesize
306KB
MD544aee1861e5f2d4f001fcc570dfb4468
SHA1a8341f8adabde95dc3465b23601052a7e1bd60e8
SHA256c0acee57b9df5bd9f0cdc471c05d5797c8df24f11b6ac21959781f3fe234a287
SHA51297a08b33f3ed6ceea8e12cd011bcda6c3316da2e0192e2d7db6464ae1843725e795f1559e05b48cbde32d008b4943c10f5c0957e5cd4dd10a4310ec10bb3fa1c
-
Filesize
306KB
MD544aee1861e5f2d4f001fcc570dfb4468
SHA1a8341f8adabde95dc3465b23601052a7e1bd60e8
SHA256c0acee57b9df5bd9f0cdc471c05d5797c8df24f11b6ac21959781f3fe234a287
SHA51297a08b33f3ed6ceea8e12cd011bcda6c3316da2e0192e2d7db6464ae1843725e795f1559e05b48cbde32d008b4943c10f5c0957e5cd4dd10a4310ec10bb3fa1c
-
Filesize
286KB
MD56c7692553b3525540c8859e6963835e6
SHA19143687d84c6fdb0e04fcda0b71f6a85479112f9
SHA2568e90bdaeea32e1df8f80e88fc5bc6228fdfeda90079b4209310e1b41aea26cb8
SHA512eb83957fe0afe375f086454f2fbaf69c7e8fc995309555cd3bb9cc6c694ea65a44c1340ed6c9f436e8a092835b43f4488329e6cd807c8aede693b6810bc45b95
-
Filesize
286KB
MD56c7692553b3525540c8859e6963835e6
SHA19143687d84c6fdb0e04fcda0b71f6a85479112f9
SHA2568e90bdaeea32e1df8f80e88fc5bc6228fdfeda90079b4209310e1b41aea26cb8
SHA512eb83957fe0afe375f086454f2fbaf69c7e8fc995309555cd3bb9cc6c694ea65a44c1340ed6c9f436e8a092835b43f4488329e6cd807c8aede693b6810bc45b95
-
Filesize
175KB
MD5da6f3bef8abc85bd09f50783059964e3
SHA1a0f25f60ec1896c4c920ea397f40e6ce29724322
SHA256e6d9ee8ab0ea2ade6e5a9481d8f0f921427ec6919b1b48c6067570fde270736b
SHA5124d2e1472b114c98c74900b8305aabbc49ba28edffdc2376206cf02e26593df4e444933b3aa19f0c6cd0ae3ac3133d656433574aaf25a57748758e5dd25edfbec
-
Filesize
175KB
MD5da6f3bef8abc85bd09f50783059964e3
SHA1a0f25f60ec1896c4c920ea397f40e6ce29724322
SHA256e6d9ee8ab0ea2ade6e5a9481d8f0f921427ec6919b1b48c6067570fde270736b
SHA5124d2e1472b114c98c74900b8305aabbc49ba28edffdc2376206cf02e26593df4e444933b3aa19f0c6cd0ae3ac3133d656433574aaf25a57748758e5dd25edfbec
-
Filesize
236KB
MD5fde8915d251fada3a37530421eb29dcf
SHA144386a8947ddfab993409945dae05a772a13e047
SHA2566cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116
SHA512ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd
-
Filesize
236KB
MD5fde8915d251fada3a37530421eb29dcf
SHA144386a8947ddfab993409945dae05a772a13e047
SHA2566cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116
SHA512ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd
-
Filesize
89KB
MD59221a421a3e777eb7d4ce55e474bcc4a
SHA1c96d7bd7ccbf9352d50527bff472595b3dc5298e
SHA25610ee53988bcfbb4bb9c8928ea96c4268bd64b9dfd1f28c6233185e695434d2f8
SHA51263ac172cb19c7c020676937cb35e853710d08e99e06e8cdcb410c37e0c9056af409a50fdec0c90a3c532edcf5e0f128fa1e2181063e1208d4fc4643b1b5736f3
-
Filesize
89KB
MD59221a421a3e777eb7d4ce55e474bcc4a
SHA1c96d7bd7ccbf9352d50527bff472595b3dc5298e
SHA25610ee53988bcfbb4bb9c8928ea96c4268bd64b9dfd1f28c6233185e695434d2f8
SHA51263ac172cb19c7c020676937cb35e853710d08e99e06e8cdcb410c37e0c9056af409a50fdec0c90a3c532edcf5e0f128fa1e2181063e1208d4fc4643b1b5736f3