Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
06-05-2023 03:03
Static task
static1
Behavioral task
behavioral1
Sample
fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe
Resource
win7-20230220-en
General
-
Target
fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe
-
Size
2.4MB
-
MD5
b39a7bc324162d5bbe0ebb53c5f72a74
-
SHA1
1c3cb0cba6b2aca973aed18953bf394c96aadddd
-
SHA256
fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060
-
SHA512
72a8de9c826aff66f11ca849652d291a5cccf317830d8b6dc063c446a6982e2efc416a933a6a071448d26102aa1d2e5f4bad264c46abdb57d00e132ab87aaef9
-
SSDEEP
24576:W3Sui5m+5yX+RNFlnRgyuMnb9310oUUS/qnwpJDQgbf2Ma9yzncNsJPsHah+uAAw:cQNFRLgXD2NkznzAviKVCvbRN/sp
Malware Config
Extracted
redline
new1
hfiepqnsyosb.top:81
fhgerbugjreqnhfegrb.top:81
-
auth_value
3a3079db884153e24cc7bde3453aec7a
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 1 IoCs
Processes:
Mpqxrnojqbnwqpnomnew2.exepid process 1488 Mpqxrnojqbnwqpnomnew2.exe -
Loads dropped DLL 1 IoCs
Processes:
fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exepid process 1048 fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exedescription pid process target process PID 1048 set thread context of 1812 1048 fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeipconfig.exepid process 1312 ipconfig.exe 564 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exefcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exeMpqxrnojqbnwqpnomnew2.exepid process 1048 fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe 1812 fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe 1488 Mpqxrnojqbnwqpnomnew2.exe 1812 fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe 1488 Mpqxrnojqbnwqpnomnew2.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exeMpqxrnojqbnwqpnomnew2.exefcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exedescription pid process Token: SeDebugPrivilege 1048 fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe Token: SeDebugPrivilege 1488 Mpqxrnojqbnwqpnomnew2.exe Token: SeDebugPrivilege 1812 fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.execmd.execmd.exedescription pid process target process PID 1048 wrote to memory of 1168 1048 fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe cmd.exe PID 1048 wrote to memory of 1168 1048 fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe cmd.exe PID 1048 wrote to memory of 1168 1048 fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe cmd.exe PID 1048 wrote to memory of 1168 1048 fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe cmd.exe PID 1168 wrote to memory of 1312 1168 cmd.exe ipconfig.exe PID 1168 wrote to memory of 1312 1168 cmd.exe ipconfig.exe PID 1168 wrote to memory of 1312 1168 cmd.exe ipconfig.exe PID 1168 wrote to memory of 1312 1168 cmd.exe ipconfig.exe PID 1048 wrote to memory of 1488 1048 fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe Mpqxrnojqbnwqpnomnew2.exe PID 1048 wrote to memory of 1488 1048 fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe Mpqxrnojqbnwqpnomnew2.exe PID 1048 wrote to memory of 1488 1048 fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe Mpqxrnojqbnwqpnomnew2.exe PID 1048 wrote to memory of 1488 1048 fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe Mpqxrnojqbnwqpnomnew2.exe PID 1048 wrote to memory of 1432 1048 fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe cmd.exe PID 1048 wrote to memory of 1432 1048 fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe cmd.exe PID 1048 wrote to memory of 1432 1048 fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe cmd.exe PID 1048 wrote to memory of 1432 1048 fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe cmd.exe PID 1432 wrote to memory of 564 1432 cmd.exe ipconfig.exe PID 1432 wrote to memory of 564 1432 cmd.exe ipconfig.exe PID 1432 wrote to memory of 564 1432 cmd.exe ipconfig.exe PID 1432 wrote to memory of 564 1432 cmd.exe ipconfig.exe PID 1048 wrote to memory of 1812 1048 fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe PID 1048 wrote to memory of 1812 1048 fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe PID 1048 wrote to memory of 1812 1048 fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe PID 1048 wrote to memory of 1812 1048 fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe PID 1048 wrote to memory of 1812 1048 fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe PID 1048 wrote to memory of 1812 1048 fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe PID 1048 wrote to memory of 1812 1048 fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe PID 1048 wrote to memory of 1812 1048 fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe PID 1048 wrote to memory of 1812 1048 fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe"C:\Users\Admin\AppData\Local\Temp\fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /release2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /release3⤵
- Gathers network information
-
C:\Users\Admin\AppData\Local\Temp\Mpqxrnojqbnwqpnomnew2.exe"C:\Users\Admin\AppData\Local\Temp\Mpqxrnojqbnwqpnomnew2.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /renew2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /renew3⤵
- Gathers network information
-
C:\Users\Admin\AppData\Local\Temp\fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exeC:\Users\Admin\AppData\Local\Temp\fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Mpqxrnojqbnwqpnomnew2.exeFilesize
254KB
MD5f0ea5f95775ebf4f1dd466643cd1ada0
SHA1bca03393f7949ad007d4131b2abdc877ae3706e3
SHA25628c76e66d29a449750c2331ed783af24a77f09cfbe392153a72e752ff5f4b3f8
SHA5124a9df69c98e83f47263482ebce3e8b9df9b2a9bb70cf13728fbaace45b302902db443e40ba9be2e9dd69ad5c3576e2fc0e52e23ed91023b57bbeff56f0f2f4f9
-
C:\Users\Admin\AppData\Local\Temp\Mpqxrnojqbnwqpnomnew2.exeFilesize
254KB
MD5f0ea5f95775ebf4f1dd466643cd1ada0
SHA1bca03393f7949ad007d4131b2abdc877ae3706e3
SHA25628c76e66d29a449750c2331ed783af24a77f09cfbe392153a72e752ff5f4b3f8
SHA5124a9df69c98e83f47263482ebce3e8b9df9b2a9bb70cf13728fbaace45b302902db443e40ba9be2e9dd69ad5c3576e2fc0e52e23ed91023b57bbeff56f0f2f4f9
-
\Users\Admin\AppData\Local\Temp\Mpqxrnojqbnwqpnomnew2.exeFilesize
254KB
MD5f0ea5f95775ebf4f1dd466643cd1ada0
SHA1bca03393f7949ad007d4131b2abdc877ae3706e3
SHA25628c76e66d29a449750c2331ed783af24a77f09cfbe392153a72e752ff5f4b3f8
SHA5124a9df69c98e83f47263482ebce3e8b9df9b2a9bb70cf13728fbaace45b302902db443e40ba9be2e9dd69ad5c3576e2fc0e52e23ed91023b57bbeff56f0f2f4f9
-
memory/1048-55-0x0000000004BF0000-0x0000000004D46000-memory.dmpFilesize
1.3MB
-
memory/1048-56-0x0000000004D40000-0x0000000004D80000-memory.dmpFilesize
256KB
-
memory/1048-57-0x0000000000C50000-0x0000000000CE2000-memory.dmpFilesize
584KB
-
memory/1048-54-0x00000000012B0000-0x000000000151E000-memory.dmpFilesize
2.4MB
-
memory/1488-76-0x0000000004650000-0x0000000004690000-memory.dmpFilesize
256KB
-
memory/1488-65-0x0000000000090000-0x00000000000D6000-memory.dmpFilesize
280KB
-
memory/1812-66-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/1812-69-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/1812-68-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/1812-70-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1812-71-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/1812-73-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/1812-75-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/1812-67-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/1812-77-0x00000000004A0000-0x00000000004E0000-memory.dmpFilesize
256KB