Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
29-08-2023 03:30
Static task
static1
Behavioral task
behavioral1
Sample
c7ed6b51413f33726ae67244d3b5e375e5a8314fceffb1aebe2dfd240f7574a7.exe
Resource
win10v2004-20230703-en
General
-
Target
c7ed6b51413f33726ae67244d3b5e375e5a8314fceffb1aebe2dfd240f7574a7.exe
-
Size
1.4MB
-
MD5
56a2d6b2c73760f28c3abd8d659232b9
-
SHA1
07729e401f6dd138d53f9fbbc1e3cc451a3300d1
-
SHA256
c7ed6b51413f33726ae67244d3b5e375e5a8314fceffb1aebe2dfd240f7574a7
-
SHA512
9703a3c15524ea234bd93e424512dfd40edb875ab2ba0e8180ef84ba00b55564b95c2c53c133970cab662eb9b01e461a05c53d61a29f8258190c3f7b2506cb6a
-
SSDEEP
24576:NymseWxPTLkvpYHm4K4mdZcmNsy5eY20YL06amSGtg4uUE2G5x9csG:omMxPG4m4K4mdrsOqL0TktYUEJP9cs
Malware Config
Extracted
amadey
3.87
77.91.68.18/nice/index.php
Extracted
redline
stas
77.91.124.82:19071
-
auth_value
db6d96c4eade05afc28c31d9ad73a73c
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 10 IoCs
pid Process 2332 y5067651.exe 336 y8684360.exe 2028 y1145706.exe 5048 l5377434.exe 2092 saves.exe 456 m9543672.exe 4036 n5373383.exe 2156 saves.exe 4316 saves.exe 1988 saves.exe -
Loads dropped DLL 1 IoCs
pid Process 1444 rundll32.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" y8684360.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" y1145706.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c7ed6b51413f33726ae67244d3b5e375e5a8314fceffb1aebe2dfd240f7574a7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y5067651.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4992 schtasks.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 2700 wrote to memory of 2332 2700 c7ed6b51413f33726ae67244d3b5e375e5a8314fceffb1aebe2dfd240f7574a7.exe 81 PID 2700 wrote to memory of 2332 2700 c7ed6b51413f33726ae67244d3b5e375e5a8314fceffb1aebe2dfd240f7574a7.exe 81 PID 2700 wrote to memory of 2332 2700 c7ed6b51413f33726ae67244d3b5e375e5a8314fceffb1aebe2dfd240f7574a7.exe 81 PID 2332 wrote to memory of 336 2332 y5067651.exe 82 PID 2332 wrote to memory of 336 2332 y5067651.exe 82 PID 2332 wrote to memory of 336 2332 y5067651.exe 82 PID 336 wrote to memory of 2028 336 y8684360.exe 83 PID 336 wrote to memory of 2028 336 y8684360.exe 83 PID 336 wrote to memory of 2028 336 y8684360.exe 83 PID 2028 wrote to memory of 5048 2028 y1145706.exe 84 PID 2028 wrote to memory of 5048 2028 y1145706.exe 84 PID 2028 wrote to memory of 5048 2028 y1145706.exe 84 PID 5048 wrote to memory of 2092 5048 l5377434.exe 86 PID 5048 wrote to memory of 2092 5048 l5377434.exe 86 PID 5048 wrote to memory of 2092 5048 l5377434.exe 86 PID 2028 wrote to memory of 456 2028 y1145706.exe 87 PID 2028 wrote to memory of 456 2028 y1145706.exe 87 PID 2028 wrote to memory of 456 2028 y1145706.exe 87 PID 2092 wrote to memory of 4992 2092 saves.exe 88 PID 2092 wrote to memory of 4992 2092 saves.exe 88 PID 2092 wrote to memory of 4992 2092 saves.exe 88 PID 2092 wrote to memory of 4700 2092 saves.exe 90 PID 2092 wrote to memory of 4700 2092 saves.exe 90 PID 2092 wrote to memory of 4700 2092 saves.exe 90 PID 4700 wrote to memory of 4156 4700 cmd.exe 92 PID 4700 wrote to memory of 4156 4700 cmd.exe 92 PID 4700 wrote to memory of 4156 4700 cmd.exe 92 PID 4700 wrote to memory of 2200 4700 cmd.exe 93 PID 4700 wrote to memory of 2200 4700 cmd.exe 93 PID 4700 wrote to memory of 2200 4700 cmd.exe 93 PID 4700 wrote to memory of 5068 4700 cmd.exe 94 PID 4700 wrote to memory of 5068 4700 cmd.exe 94 PID 4700 wrote to memory of 5068 4700 cmd.exe 94 PID 4700 wrote to memory of 1364 4700 cmd.exe 95 PID 4700 wrote to memory of 1364 4700 cmd.exe 95 PID 4700 wrote to memory of 1364 4700 cmd.exe 95 PID 4700 wrote to memory of 3800 4700 cmd.exe 96 PID 4700 wrote to memory of 3800 4700 cmd.exe 96 PID 4700 wrote to memory of 3800 4700 cmd.exe 96 PID 4700 wrote to memory of 4464 4700 cmd.exe 97 PID 4700 wrote to memory of 4464 4700 cmd.exe 97 PID 4700 wrote to memory of 4464 4700 cmd.exe 97 PID 336 wrote to memory of 4036 336 y8684360.exe 98 PID 336 wrote to memory of 4036 336 y8684360.exe 98 PID 336 wrote to memory of 4036 336 y8684360.exe 98 PID 2092 wrote to memory of 1444 2092 saves.exe 108 PID 2092 wrote to memory of 1444 2092 saves.exe 108 PID 2092 wrote to memory of 1444 2092 saves.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7ed6b51413f33726ae67244d3b5e375e5a8314fceffb1aebe2dfd240f7574a7.exe"C:\Users\Admin\AppData\Local\Temp\c7ed6b51413f33726ae67244d3b5e375e5a8314fceffb1aebe2dfd240f7574a7.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5067651.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5067651.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8684360.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8684360.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y1145706.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y1145706.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\l5377434.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\l5377434.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F7⤵
- Creates scheduled task(s)
PID:4992
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit7⤵
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵PID:4156
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:N"8⤵PID:2200
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:R" /E8⤵PID:5068
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵PID:1364
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:N"8⤵PID:3800
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:R" /E8⤵PID:4464
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main7⤵
- Loads dropped DLL
PID:1444
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\m9543672.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\m9543672.exe5⤵
- Executes dropped EXE
PID:456
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n5373383.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n5373383.exe4⤵
- Executes dropped EXE
PID:4036
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:2156
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:4316
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:1988
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5fabb0c7df1afe823f61c7e300b2ee713
SHA1a1187aab3faa13a1b99b5b23cd4664ffab96839f
SHA2564c0960dca35532bb3eeb46503ab25c7e5ce8c8f99128a5f524a0780b7630eb51
SHA5121df36a017a87a2c6eaffb4a3f50132d85db7e0e36132088b2770b3163af641d31ea447c835e087e2761f9019e5ef40ce54c0e057887cc5cd108194d15a0876a4
-
Filesize
1.3MB
MD5fabb0c7df1afe823f61c7e300b2ee713
SHA1a1187aab3faa13a1b99b5b23cd4664ffab96839f
SHA2564c0960dca35532bb3eeb46503ab25c7e5ce8c8f99128a5f524a0780b7630eb51
SHA5121df36a017a87a2c6eaffb4a3f50132d85db7e0e36132088b2770b3163af641d31ea447c835e087e2761f9019e5ef40ce54c0e057887cc5cd108194d15a0876a4
-
Filesize
475KB
MD56c0d9e8d5d3f35dd05d410c4b3fa2540
SHA185046b56ce047878f02351ee8b5fdd8475c80da6
SHA256430d6559c9b0f695ff60aeec7c61a1ff5198fa9ea08b0a86f3e925f2cf4d3c10
SHA512da1a4b2b6453491d51c46d1fd9029640d5520397904ab446fe4b5b4c50b7640be34c00f8f2c3258839c0b2c24b2a348aba0c8302f8aa0716d9bbf9db644f6d4c
-
Filesize
475KB
MD56c0d9e8d5d3f35dd05d410c4b3fa2540
SHA185046b56ce047878f02351ee8b5fdd8475c80da6
SHA256430d6559c9b0f695ff60aeec7c61a1ff5198fa9ea08b0a86f3e925f2cf4d3c10
SHA512da1a4b2b6453491d51c46d1fd9029640d5520397904ab446fe4b5b4c50b7640be34c00f8f2c3258839c0b2c24b2a348aba0c8302f8aa0716d9bbf9db644f6d4c
-
Filesize
175KB
MD539decbeadc8a13b3a5cdddc68205c905
SHA16619db4d6f25b8a0d7b43afdf6bc8081158cb6bc
SHA2561ce9d1e367d3fcaa04220c9faf04e2840b0861e63897405973def46130a4d44e
SHA51298065855d4471c1a552096f9b32f14af201999b521ebcdfe141c5829d526372aa02d809ef493e7772b56a02f70f94e433d733f83d90ccf581caf8f4e0a862406
-
Filesize
175KB
MD539decbeadc8a13b3a5cdddc68205c905
SHA16619db4d6f25b8a0d7b43afdf6bc8081158cb6bc
SHA2561ce9d1e367d3fcaa04220c9faf04e2840b0861e63897405973def46130a4d44e
SHA51298065855d4471c1a552096f9b32f14af201999b521ebcdfe141c5829d526372aa02d809ef493e7772b56a02f70f94e433d733f83d90ccf581caf8f4e0a862406
-
Filesize
319KB
MD52b7d35cf6ea7cb5676ff67f1fdbef122
SHA107a31f160a3627d78409f33314ba550859b1ca2d
SHA256dd048683d9ec86836d79566d7f612f9ff506977b59fd179f481e47c84f3f564b
SHA512db6aa01a44cdb521b4ea84c5b1e7f2709ed3f1d7184ca52809b26f229f9712d55a566154b6ae5d432e0654ec250eabb0a0993f229ded4db18605e3df2c422a3b
-
Filesize
319KB
MD52b7d35cf6ea7cb5676ff67f1fdbef122
SHA107a31f160a3627d78409f33314ba550859b1ca2d
SHA256dd048683d9ec86836d79566d7f612f9ff506977b59fd179f481e47c84f3f564b
SHA512db6aa01a44cdb521b4ea84c5b1e7f2709ed3f1d7184ca52809b26f229f9712d55a566154b6ae5d432e0654ec250eabb0a0993f229ded4db18605e3df2c422a3b
-
Filesize
324KB
MD5a85e81449f4ea7794dd065bf95d2dc05
SHA122886df09f0f11b142c3a12c8b399643acfb8e3d
SHA256ff1caab62e32a245629051af14da30218ab749484f1dc3f4a0a421debdb02892
SHA512ffe5c6ef75e2ffbf554d71efe48b99ecd2eeb9cf78941ee64f02e6e7ab0b8a5dc130c3ce69211b1114b414b3f06bbaef77a95534a24ff9fa6beb04e59ffe2987
-
Filesize
324KB
MD5a85e81449f4ea7794dd065bf95d2dc05
SHA122886df09f0f11b142c3a12c8b399643acfb8e3d
SHA256ff1caab62e32a245629051af14da30218ab749484f1dc3f4a0a421debdb02892
SHA512ffe5c6ef75e2ffbf554d71efe48b99ecd2eeb9cf78941ee64f02e6e7ab0b8a5dc130c3ce69211b1114b414b3f06bbaef77a95534a24ff9fa6beb04e59ffe2987
-
Filesize
141KB
MD50c64102c2e5ee673ae3d11df7b2c4a3c
SHA18c01756e76b98c338a55e0d7d828659201d4ae4f
SHA2567e383e5ae3fa33f88f43d50272f1583b347f43344d76715cc5b3430ccc7cc078
SHA51228c3555d134501a0991456241296893a4abfa48d053a3ec3cfafabc53190b4c4df20db26e69d489eae03851344f48844425cd0a19404ec3a794f10417241a21f
-
Filesize
141KB
MD50c64102c2e5ee673ae3d11df7b2c4a3c
SHA18c01756e76b98c338a55e0d7d828659201d4ae4f
SHA2567e383e5ae3fa33f88f43d50272f1583b347f43344d76715cc5b3430ccc7cc078
SHA51228c3555d134501a0991456241296893a4abfa48d053a3ec3cfafabc53190b4c4df20db26e69d489eae03851344f48844425cd0a19404ec3a794f10417241a21f
-
Filesize
324KB
MD5a85e81449f4ea7794dd065bf95d2dc05
SHA122886df09f0f11b142c3a12c8b399643acfb8e3d
SHA256ff1caab62e32a245629051af14da30218ab749484f1dc3f4a0a421debdb02892
SHA512ffe5c6ef75e2ffbf554d71efe48b99ecd2eeb9cf78941ee64f02e6e7ab0b8a5dc130c3ce69211b1114b414b3f06bbaef77a95534a24ff9fa6beb04e59ffe2987
-
Filesize
324KB
MD5a85e81449f4ea7794dd065bf95d2dc05
SHA122886df09f0f11b142c3a12c8b399643acfb8e3d
SHA256ff1caab62e32a245629051af14da30218ab749484f1dc3f4a0a421debdb02892
SHA512ffe5c6ef75e2ffbf554d71efe48b99ecd2eeb9cf78941ee64f02e6e7ab0b8a5dc130c3ce69211b1114b414b3f06bbaef77a95534a24ff9fa6beb04e59ffe2987
-
Filesize
324KB
MD5a85e81449f4ea7794dd065bf95d2dc05
SHA122886df09f0f11b142c3a12c8b399643acfb8e3d
SHA256ff1caab62e32a245629051af14da30218ab749484f1dc3f4a0a421debdb02892
SHA512ffe5c6ef75e2ffbf554d71efe48b99ecd2eeb9cf78941ee64f02e6e7ab0b8a5dc130c3ce69211b1114b414b3f06bbaef77a95534a24ff9fa6beb04e59ffe2987
-
Filesize
324KB
MD5a85e81449f4ea7794dd065bf95d2dc05
SHA122886df09f0f11b142c3a12c8b399643acfb8e3d
SHA256ff1caab62e32a245629051af14da30218ab749484f1dc3f4a0a421debdb02892
SHA512ffe5c6ef75e2ffbf554d71efe48b99ecd2eeb9cf78941ee64f02e6e7ab0b8a5dc130c3ce69211b1114b414b3f06bbaef77a95534a24ff9fa6beb04e59ffe2987
-
Filesize
324KB
MD5a85e81449f4ea7794dd065bf95d2dc05
SHA122886df09f0f11b142c3a12c8b399643acfb8e3d
SHA256ff1caab62e32a245629051af14da30218ab749484f1dc3f4a0a421debdb02892
SHA512ffe5c6ef75e2ffbf554d71efe48b99ecd2eeb9cf78941ee64f02e6e7ab0b8a5dc130c3ce69211b1114b414b3f06bbaef77a95534a24ff9fa6beb04e59ffe2987
-
Filesize
324KB
MD5a85e81449f4ea7794dd065bf95d2dc05
SHA122886df09f0f11b142c3a12c8b399643acfb8e3d
SHA256ff1caab62e32a245629051af14da30218ab749484f1dc3f4a0a421debdb02892
SHA512ffe5c6ef75e2ffbf554d71efe48b99ecd2eeb9cf78941ee64f02e6e7ab0b8a5dc130c3ce69211b1114b414b3f06bbaef77a95534a24ff9fa6beb04e59ffe2987
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
273B
MD5374bfdcfcf19f4edfe949022092848d2
SHA1df5ee40497e98efcfba30012452d433373d287d4
SHA256224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f
SHA512bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7