Analysis
-
max time kernel
138s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
04-05-2023 17:06
Static task
static1
Behavioral task
behavioral1
Sample
FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe
Resource
win7-20230220-en
General
-
Target
FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe
-
Size
2.4MB
-
MD5
b39a7bc324162d5bbe0ebb53c5f72a74
-
SHA1
1c3cb0cba6b2aca973aed18953bf394c96aadddd
-
SHA256
fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060
-
SHA512
72a8de9c826aff66f11ca849652d291a5cccf317830d8b6dc063c446a6982e2efc416a933a6a071448d26102aa1d2e5f4bad264c46abdb57d00e132ab87aaef9
-
SSDEEP
24576:W3Sui5m+5yX+RNFlnRgyuMnb9310oUUS/qnwpJDQgbf2Ma9yzncNsJPsHah+uAAw:cQNFRLgXD2NkznzAviKVCvbRN/sp
Malware Config
Extracted
redline
new1
hfiepqnsyosb.top:81
fhgerbugjreqnhfegrb.top:81
-
auth_value
3a3079db884153e24cc7bde3453aec7a
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe -
Executes dropped EXE 1 IoCs
Processes:
Mpqxrnojqbnwqpnomnew2.exepid process 2276 Mpqxrnojqbnwqpnomnew2.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exedescription pid process target process PID 1920 set thread context of 4068 1920 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeipconfig.exepid process 3844 ipconfig.exe 1892 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exeMpqxrnojqbnwqpnomnew2.exeFCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exepid process 1920 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe 2276 Mpqxrnojqbnwqpnomnew2.exe 4068 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe 2276 Mpqxrnojqbnwqpnomnew2.exe 4068 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exeMpqxrnojqbnwqpnomnew2.exeFCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exedescription pid process Token: SeDebugPrivilege 1920 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe Token: SeDebugPrivilege 2276 Mpqxrnojqbnwqpnomnew2.exe Token: SeDebugPrivilege 4068 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.execmd.execmd.exedescription pid process target process PID 1920 wrote to memory of 116 1920 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe cmd.exe PID 1920 wrote to memory of 116 1920 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe cmd.exe PID 1920 wrote to memory of 116 1920 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe cmd.exe PID 116 wrote to memory of 3844 116 cmd.exe ipconfig.exe PID 116 wrote to memory of 3844 116 cmd.exe ipconfig.exe PID 116 wrote to memory of 3844 116 cmd.exe ipconfig.exe PID 1920 wrote to memory of 2276 1920 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe Mpqxrnojqbnwqpnomnew2.exe PID 1920 wrote to memory of 2276 1920 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe Mpqxrnojqbnwqpnomnew2.exe PID 1920 wrote to memory of 2276 1920 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe Mpqxrnojqbnwqpnomnew2.exe PID 1920 wrote to memory of 404 1920 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe cmd.exe PID 1920 wrote to memory of 404 1920 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe cmd.exe PID 1920 wrote to memory of 404 1920 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe cmd.exe PID 404 wrote to memory of 1892 404 cmd.exe ipconfig.exe PID 404 wrote to memory of 1892 404 cmd.exe ipconfig.exe PID 404 wrote to memory of 1892 404 cmd.exe ipconfig.exe PID 1920 wrote to memory of 4068 1920 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1920 wrote to memory of 4068 1920 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1920 wrote to memory of 4068 1920 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1920 wrote to memory of 4068 1920 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1920 wrote to memory of 4068 1920 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1920 wrote to memory of 4068 1920 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1920 wrote to memory of 4068 1920 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1920 wrote to memory of 4068 1920 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe"C:\Users\Admin\AppData\Local\Temp\FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /release2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /release3⤵
- Gathers network information
-
C:\Users\Admin\AppData\Local\Temp\Mpqxrnojqbnwqpnomnew2.exe"C:\Users\Admin\AppData\Local\Temp\Mpqxrnojqbnwqpnomnew2.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /renew2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /renew3⤵
- Gathers network information
-
C:\Users\Admin\AppData\Local\Temp\FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exeC:\Users\Admin\AppData\Local\Temp\FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe.logFilesize
1KB
MD57e88081fcf716d85992bb3af3d9b6454
SHA12153780fbc71061b0102a7a7b665349e1013e250
SHA2565ffb4a3ea94a6a53c4f88e2191c6fec5fd8a7336e367aa113fe8c12631e0c4d2
SHA512ec606e14367ae221c04f213a61a6f797034495121198e4788e3afa4aa8db67bf59c5c5210a56afae5557158e8923b013b371b84c7d64303618c5b4c57a2224f7
-
C:\Users\Admin\AppData\Local\Temp\Mpqxrnojqbnwqpnomnew2.exeFilesize
254KB
MD5f0ea5f95775ebf4f1dd466643cd1ada0
SHA1bca03393f7949ad007d4131b2abdc877ae3706e3
SHA25628c76e66d29a449750c2331ed783af24a77f09cfbe392153a72e752ff5f4b3f8
SHA5124a9df69c98e83f47263482ebce3e8b9df9b2a9bb70cf13728fbaace45b302902db443e40ba9be2e9dd69ad5c3576e2fc0e52e23ed91023b57bbeff56f0f2f4f9
-
C:\Users\Admin\AppData\Local\Temp\Mpqxrnojqbnwqpnomnew2.exeFilesize
254KB
MD5f0ea5f95775ebf4f1dd466643cd1ada0
SHA1bca03393f7949ad007d4131b2abdc877ae3706e3
SHA25628c76e66d29a449750c2331ed783af24a77f09cfbe392153a72e752ff5f4b3f8
SHA5124a9df69c98e83f47263482ebce3e8b9df9b2a9bb70cf13728fbaace45b302902db443e40ba9be2e9dd69ad5c3576e2fc0e52e23ed91023b57bbeff56f0f2f4f9
-
C:\Users\Admin\AppData\Local\Temp\Mpqxrnojqbnwqpnomnew2.exeFilesize
254KB
MD5f0ea5f95775ebf4f1dd466643cd1ada0
SHA1bca03393f7949ad007d4131b2abdc877ae3706e3
SHA25628c76e66d29a449750c2331ed783af24a77f09cfbe392153a72e752ff5f4b3f8
SHA5124a9df69c98e83f47263482ebce3e8b9df9b2a9bb70cf13728fbaace45b302902db443e40ba9be2e9dd69ad5c3576e2fc0e52e23ed91023b57bbeff56f0f2f4f9
-
memory/1920-133-0x0000000000010000-0x000000000027E000-memory.dmpFilesize
2.4MB
-
memory/1920-134-0x0000000004F60000-0x0000000004F82000-memory.dmpFilesize
136KB
-
memory/1920-135-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/2276-153-0x0000000005580000-0x000000000568A000-memory.dmpFilesize
1.0MB
-
memory/2276-156-0x00000000054B0000-0x00000000054C0000-memory.dmpFilesize
64KB
-
memory/2276-159-0x0000000007170000-0x0000000007714000-memory.dmpFilesize
5.6MB
-
memory/2276-148-0x00000000059C0000-0x0000000005FD8000-memory.dmpFilesize
6.1MB
-
memory/2276-147-0x0000000000BF0000-0x0000000000C36000-memory.dmpFilesize
280KB
-
memory/2276-154-0x00000000054C0000-0x00000000054FC000-memory.dmpFilesize
240KB
-
memory/2276-157-0x0000000005800000-0x0000000005866000-memory.dmpFilesize
408KB
-
memory/2276-149-0x0000000005450000-0x0000000005462000-memory.dmpFilesize
72KB
-
memory/4068-155-0x0000000005080000-0x0000000005090000-memory.dmpFilesize
64KB
-
memory/4068-150-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/4068-158-0x0000000006690000-0x0000000006722000-memory.dmpFilesize
584KB
-
memory/4068-160-0x00000000067B0000-0x0000000006826000-memory.dmpFilesize
472KB
-
memory/4068-161-0x0000000006770000-0x000000000678E000-memory.dmpFilesize
120KB
-
memory/4068-162-0x0000000006AB0000-0x0000000006C72000-memory.dmpFilesize
1.8MB
-
memory/4068-163-0x00000000077C0000-0x0000000007CEC000-memory.dmpFilesize
5.2MB