Analysis
-
max time kernel
28s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
04-05-2023 17:06
Static task
static1
Behavioral task
behavioral1
Sample
FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe
Resource
win7-20230220-en
General
-
Target
FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe
-
Size
2.4MB
-
MD5
b39a7bc324162d5bbe0ebb53c5f72a74
-
SHA1
1c3cb0cba6b2aca973aed18953bf394c96aadddd
-
SHA256
fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060
-
SHA512
72a8de9c826aff66f11ca849652d291a5cccf317830d8b6dc063c446a6982e2efc416a933a6a071448d26102aa1d2e5f4bad264c46abdb57d00e132ab87aaef9
-
SSDEEP
24576:W3Sui5m+5yX+RNFlnRgyuMnb9310oUUS/qnwpJDQgbf2Ma9yzncNsJPsHah+uAAw:cQNFRLgXD2NkznzAviKVCvbRN/sp
Malware Config
Extracted
redline
new1
hfiepqnsyosb.top:81
fhgerbugjreqnhfegrb.top:81
-
auth_value
3a3079db884153e24cc7bde3453aec7a
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 1 IoCs
Processes:
Mpqxrnojqbnwqpnomnew2.exepid process 432 Mpqxrnojqbnwqpnomnew2.exe -
Loads dropped DLL 1 IoCs
Processes:
FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exepid process 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeipconfig.exepid process 1492 ipconfig.exe 1668 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exeMpqxrnojqbnwqpnomnew2.exepid process 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe 432 Mpqxrnojqbnwqpnomnew2.exe 432 Mpqxrnojqbnwqpnomnew2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exeMpqxrnojqbnwqpnomnew2.exedescription pid process Token: SeDebugPrivilege 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe Token: SeDebugPrivilege 432 Mpqxrnojqbnwqpnomnew2.exe -
Suspicious use of WriteProcessMemory 60 IoCs
Processes:
FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.execmd.execmd.exedescription pid process target process PID 1328 wrote to memory of 1228 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe cmd.exe PID 1328 wrote to memory of 1228 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe cmd.exe PID 1328 wrote to memory of 1228 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe cmd.exe PID 1328 wrote to memory of 1228 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe cmd.exe PID 1228 wrote to memory of 1492 1228 cmd.exe ipconfig.exe PID 1228 wrote to memory of 1492 1228 cmd.exe ipconfig.exe PID 1228 wrote to memory of 1492 1228 cmd.exe ipconfig.exe PID 1228 wrote to memory of 1492 1228 cmd.exe ipconfig.exe PID 1328 wrote to memory of 432 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe Mpqxrnojqbnwqpnomnew2.exe PID 1328 wrote to memory of 432 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe Mpqxrnojqbnwqpnomnew2.exe PID 1328 wrote to memory of 432 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe Mpqxrnojqbnwqpnomnew2.exe PID 1328 wrote to memory of 432 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe Mpqxrnojqbnwqpnomnew2.exe PID 1328 wrote to memory of 644 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe cmd.exe PID 1328 wrote to memory of 644 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe cmd.exe PID 1328 wrote to memory of 644 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe cmd.exe PID 1328 wrote to memory of 644 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe cmd.exe PID 644 wrote to memory of 1668 644 cmd.exe ipconfig.exe PID 644 wrote to memory of 1668 644 cmd.exe ipconfig.exe PID 644 wrote to memory of 1668 644 cmd.exe ipconfig.exe PID 644 wrote to memory of 1668 644 cmd.exe ipconfig.exe PID 1328 wrote to memory of 1764 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 1764 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 1764 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 1764 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 612 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 612 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 612 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 612 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 1720 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 1720 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 1720 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 1720 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 1784 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 1784 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 1784 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 1784 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 828 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 828 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 828 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 828 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 292 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 292 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 292 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 292 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 1628 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 1628 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 1628 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 1628 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 1016 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 1016 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 1016 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 1016 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 1868 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 1868 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 1868 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 1868 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 1092 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 1092 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 1092 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1328 wrote to memory of 1092 1328 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe"C:\Users\Admin\AppData\Local\Temp\FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /release2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /release3⤵
- Gathers network information
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /renew2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /renew3⤵
- Gathers network information
-
C:\Users\Admin\AppData\Local\Temp\Mpqxrnojqbnwqpnomnew2.exe"C:\Users\Admin\AppData\Local\Temp\Mpqxrnojqbnwqpnomnew2.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exeC:\Users\Admin\AppData\Local\Temp\FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exeC:\Users\Admin\AppData\Local\Temp\FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exeC:\Users\Admin\AppData\Local\Temp\FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exeC:\Users\Admin\AppData\Local\Temp\FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exeC:\Users\Admin\AppData\Local\Temp\FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exeC:\Users\Admin\AppData\Local\Temp\FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exeC:\Users\Admin\AppData\Local\Temp\FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exeC:\Users\Admin\AppData\Local\Temp\FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exeC:\Users\Admin\AppData\Local\Temp\FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exeC:\Users\Admin\AppData\Local\Temp\FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Mpqxrnojqbnwqpnomnew2.exeFilesize
254KB
MD5f0ea5f95775ebf4f1dd466643cd1ada0
SHA1bca03393f7949ad007d4131b2abdc877ae3706e3
SHA25628c76e66d29a449750c2331ed783af24a77f09cfbe392153a72e752ff5f4b3f8
SHA5124a9df69c98e83f47263482ebce3e8b9df9b2a9bb70cf13728fbaace45b302902db443e40ba9be2e9dd69ad5c3576e2fc0e52e23ed91023b57bbeff56f0f2f4f9
-
C:\Users\Admin\AppData\Local\Temp\Mpqxrnojqbnwqpnomnew2.exeFilesize
254KB
MD5f0ea5f95775ebf4f1dd466643cd1ada0
SHA1bca03393f7949ad007d4131b2abdc877ae3706e3
SHA25628c76e66d29a449750c2331ed783af24a77f09cfbe392153a72e752ff5f4b3f8
SHA5124a9df69c98e83f47263482ebce3e8b9df9b2a9bb70cf13728fbaace45b302902db443e40ba9be2e9dd69ad5c3576e2fc0e52e23ed91023b57bbeff56f0f2f4f9
-
\Users\Admin\AppData\Local\Temp\Mpqxrnojqbnwqpnomnew2.exeFilesize
254KB
MD5f0ea5f95775ebf4f1dd466643cd1ada0
SHA1bca03393f7949ad007d4131b2abdc877ae3706e3
SHA25628c76e66d29a449750c2331ed783af24a77f09cfbe392153a72e752ff5f4b3f8
SHA5124a9df69c98e83f47263482ebce3e8b9df9b2a9bb70cf13728fbaace45b302902db443e40ba9be2e9dd69ad5c3576e2fc0e52e23ed91023b57bbeff56f0f2f4f9
-
memory/432-65-0x0000000000330000-0x0000000000376000-memory.dmpFilesize
280KB
-
memory/432-66-0x0000000004540000-0x0000000004580000-memory.dmpFilesize
256KB
-
memory/1328-54-0x00000000001C0000-0x000000000042E000-memory.dmpFilesize
2.4MB
-
memory/1328-55-0x00000000049C0000-0x0000000004B16000-memory.dmpFilesize
1.3MB
-
memory/1328-56-0x0000000004F50000-0x0000000004FE2000-memory.dmpFilesize
584KB
-
memory/1328-61-0x0000000004790000-0x00000000047D0000-memory.dmpFilesize
256KB