Analysis
-
max time kernel
234s -
max time network
336s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
05-05-2023 20:37
Static task
static1
Behavioral task
behavioral1
Sample
FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe
Resource
win7-20230220-en
General
-
Target
FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe
-
Size
2.4MB
-
MD5
b39a7bc324162d5bbe0ebb53c5f72a74
-
SHA1
1c3cb0cba6b2aca973aed18953bf394c96aadddd
-
SHA256
fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060
-
SHA512
72a8de9c826aff66f11ca849652d291a5cccf317830d8b6dc063c446a6982e2efc416a933a6a071448d26102aa1d2e5f4bad264c46abdb57d00e132ab87aaef9
-
SSDEEP
24576:W3Sui5m+5yX+RNFlnRgyuMnb9310oUUS/qnwpJDQgbf2Ma9yzncNsJPsHah+uAAw:cQNFRLgXD2NkznzAviKVCvbRN/sp
Malware Config
Extracted
redline
new1
hfiepqnsyosb.top:81
fhgerbugjreqnhfegrb.top:81
-
auth_value
3a3079db884153e24cc7bde3453aec7a
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 1 IoCs
Processes:
Mpqxrnojqbnwqpnomnew2.exepid process 1016 Mpqxrnojqbnwqpnomnew2.exe -
Loads dropped DLL 1 IoCs
Processes:
FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exepid process 1856 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exedescription pid process target process PID 1856 set thread context of 1020 1856 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeipconfig.exepid process 1860 ipconfig.exe 1716 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exeMpqxrnojqbnwqpnomnew2.exeFCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exepid process 1856 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe 1016 Mpqxrnojqbnwqpnomnew2.exe 1020 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe 1016 Mpqxrnojqbnwqpnomnew2.exe 1020 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exeMpqxrnojqbnwqpnomnew2.exeFCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exedescription pid process Token: SeDebugPrivilege 1856 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe Token: SeDebugPrivilege 1016 Mpqxrnojqbnwqpnomnew2.exe Token: SeDebugPrivilege 1020 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.execmd.execmd.exedescription pid process target process PID 1856 wrote to memory of 1520 1856 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe cmd.exe PID 1856 wrote to memory of 1520 1856 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe cmd.exe PID 1856 wrote to memory of 1520 1856 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe cmd.exe PID 1856 wrote to memory of 1520 1856 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe cmd.exe PID 1520 wrote to memory of 1860 1520 cmd.exe ipconfig.exe PID 1520 wrote to memory of 1860 1520 cmd.exe ipconfig.exe PID 1520 wrote to memory of 1860 1520 cmd.exe ipconfig.exe PID 1520 wrote to memory of 1860 1520 cmd.exe ipconfig.exe PID 1856 wrote to memory of 1016 1856 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe Mpqxrnojqbnwqpnomnew2.exe PID 1856 wrote to memory of 1016 1856 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe Mpqxrnojqbnwqpnomnew2.exe PID 1856 wrote to memory of 1016 1856 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe Mpqxrnojqbnwqpnomnew2.exe PID 1856 wrote to memory of 1016 1856 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe Mpqxrnojqbnwqpnomnew2.exe PID 1856 wrote to memory of 1580 1856 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe cmd.exe PID 1856 wrote to memory of 1580 1856 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe cmd.exe PID 1856 wrote to memory of 1580 1856 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe cmd.exe PID 1856 wrote to memory of 1580 1856 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe cmd.exe PID 1580 wrote to memory of 1716 1580 cmd.exe ipconfig.exe PID 1580 wrote to memory of 1716 1580 cmd.exe ipconfig.exe PID 1580 wrote to memory of 1716 1580 cmd.exe ipconfig.exe PID 1580 wrote to memory of 1716 1580 cmd.exe ipconfig.exe PID 1856 wrote to memory of 1020 1856 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1856 wrote to memory of 1020 1856 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1856 wrote to memory of 1020 1856 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1856 wrote to memory of 1020 1856 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1856 wrote to memory of 1020 1856 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1856 wrote to memory of 1020 1856 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1856 wrote to memory of 1020 1856 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1856 wrote to memory of 1020 1856 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe PID 1856 wrote to memory of 1020 1856 FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe"C:\Users\Admin\AppData\Local\Temp\FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /release2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /release3⤵
- Gathers network information
-
C:\Users\Admin\AppData\Local\Temp\Mpqxrnojqbnwqpnomnew2.exe"C:\Users\Admin\AppData\Local\Temp\Mpqxrnojqbnwqpnomnew2.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /renew2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /renew3⤵
- Gathers network information
-
C:\Users\Admin\AppData\Local\Temp\FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exeC:\Users\Admin\AppData\Local\Temp\FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Mpqxrnojqbnwqpnomnew2.exeFilesize
254KB
MD5f0ea5f95775ebf4f1dd466643cd1ada0
SHA1bca03393f7949ad007d4131b2abdc877ae3706e3
SHA25628c76e66d29a449750c2331ed783af24a77f09cfbe392153a72e752ff5f4b3f8
SHA5124a9df69c98e83f47263482ebce3e8b9df9b2a9bb70cf13728fbaace45b302902db443e40ba9be2e9dd69ad5c3576e2fc0e52e23ed91023b57bbeff56f0f2f4f9
-
C:\Users\Admin\AppData\Local\Temp\Mpqxrnojqbnwqpnomnew2.exeFilesize
254KB
MD5f0ea5f95775ebf4f1dd466643cd1ada0
SHA1bca03393f7949ad007d4131b2abdc877ae3706e3
SHA25628c76e66d29a449750c2331ed783af24a77f09cfbe392153a72e752ff5f4b3f8
SHA5124a9df69c98e83f47263482ebce3e8b9df9b2a9bb70cf13728fbaace45b302902db443e40ba9be2e9dd69ad5c3576e2fc0e52e23ed91023b57bbeff56f0f2f4f9
-
\Users\Admin\AppData\Local\Temp\Mpqxrnojqbnwqpnomnew2.exeFilesize
254KB
MD5f0ea5f95775ebf4f1dd466643cd1ada0
SHA1bca03393f7949ad007d4131b2abdc877ae3706e3
SHA25628c76e66d29a449750c2331ed783af24a77f09cfbe392153a72e752ff5f4b3f8
SHA5124a9df69c98e83f47263482ebce3e8b9df9b2a9bb70cf13728fbaace45b302902db443e40ba9be2e9dd69ad5c3576e2fc0e52e23ed91023b57bbeff56f0f2f4f9
-
memory/1016-78-0x0000000004A60000-0x0000000004AA0000-memory.dmpFilesize
256KB
-
memory/1016-65-0x0000000000090000-0x00000000000D6000-memory.dmpFilesize
280KB
-
memory/1020-67-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/1020-70-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1020-77-0x0000000004F50000-0x0000000004F90000-memory.dmpFilesize
256KB
-
memory/1020-76-0x0000000004F50000-0x0000000004F90000-memory.dmpFilesize
256KB
-
memory/1020-66-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/1020-68-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/1020-69-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/1020-73-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/1020-71-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/1020-75-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/1856-57-0x0000000004F60000-0x0000000004FF2000-memory.dmpFilesize
584KB
-
memory/1856-54-0x0000000000AB0000-0x0000000000D1E000-memory.dmpFilesize
2.4MB
-
memory/1856-56-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/1856-55-0x0000000004A20000-0x0000000004B76000-memory.dmpFilesize
1.3MB