Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
06-09-2023 19:26
Static task
static1
Behavioral task
behavioral1
Sample
y7782521_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
y7782521_JC.exe
Resource
win10v2004-20230831-en
General
-
Target
y7782521_JC.exe
-
Size
1.4MB
-
MD5
42b532b5ca8bb5321359800ea00f92af
-
SHA1
adffe2bf482903e1ae18eafb716bcf7b5f9743d0
-
SHA256
ebd3b3f33062508d1089a2a741b5afdaed0686c68887c71a827b24c69ac2d270
-
SHA512
2901e89b57952b4e5d026d1dde5e9844eb63d77a110b3cb38a569c018285b18f0f9c5bb4c62236ffd2237fec3508a71cfad087c17b195639ab7471e6a9f77e6c
-
SSDEEP
24576:ryCDbyrPmVcEgG7DaKoEBvzs8Xn3FtdP7FtCe3p1PJnoPtvEzSLRqkKU8XQRek:eCD6mHgG3aKoEBJ35PxtCex8yeRsh
Malware Config
Extracted
amadey
3.87
77.91.68.18/nice/index.php
-
install_dir
b40d11255d
-
install_file
saves.exe
-
strings_key
fa622dfc42544927a6471829ee1fa9fe
Extracted
redline
gena
77.91.124.82:19071
-
auth_value
93c20961cb6b06b2d5781c212db6201e
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
l7913480.exesaves.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000\Control Panel\International\Geo\Nation l7913480.exe Key value queried \REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000\Control Panel\International\Geo\Nation saves.exe -
Executes dropped EXE 8 IoCs
Processes:
y3553050.exey3356582.exel7913480.exesaves.exem2612426.exen5689015.exesaves.exesaves.exepid process 4380 y3553050.exe 3116 y3356582.exe 2536 l7913480.exe 4176 saves.exe 4060 m2612426.exe 2468 n5689015.exe 3952 saves.exe 3416 saves.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3148 rundll32.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
y7782521_JC.exey3553050.exey3356582.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" y7782521_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y3553050.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" y3356582.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 45 IoCs
Processes:
y7782521_JC.exey3553050.exey3356582.exel7913480.exesaves.execmd.exedescription pid process target process PID 4536 wrote to memory of 4380 4536 y7782521_JC.exe y3553050.exe PID 4536 wrote to memory of 4380 4536 y7782521_JC.exe y3553050.exe PID 4536 wrote to memory of 4380 4536 y7782521_JC.exe y3553050.exe PID 4380 wrote to memory of 3116 4380 y3553050.exe y3356582.exe PID 4380 wrote to memory of 3116 4380 y3553050.exe y3356582.exe PID 4380 wrote to memory of 3116 4380 y3553050.exe y3356582.exe PID 3116 wrote to memory of 2536 3116 y3356582.exe l7913480.exe PID 3116 wrote to memory of 2536 3116 y3356582.exe l7913480.exe PID 3116 wrote to memory of 2536 3116 y3356582.exe l7913480.exe PID 2536 wrote to memory of 4176 2536 l7913480.exe saves.exe PID 2536 wrote to memory of 4176 2536 l7913480.exe saves.exe PID 2536 wrote to memory of 4176 2536 l7913480.exe saves.exe PID 3116 wrote to memory of 4060 3116 y3356582.exe m2612426.exe PID 3116 wrote to memory of 4060 3116 y3356582.exe m2612426.exe PID 3116 wrote to memory of 4060 3116 y3356582.exe m2612426.exe PID 4176 wrote to memory of 5012 4176 saves.exe schtasks.exe PID 4176 wrote to memory of 5012 4176 saves.exe schtasks.exe PID 4176 wrote to memory of 5012 4176 saves.exe schtasks.exe PID 4176 wrote to memory of 1320 4176 saves.exe cmd.exe PID 4176 wrote to memory of 1320 4176 saves.exe cmd.exe PID 4176 wrote to memory of 1320 4176 saves.exe cmd.exe PID 1320 wrote to memory of 3440 1320 cmd.exe cmd.exe PID 1320 wrote to memory of 3440 1320 cmd.exe cmd.exe PID 1320 wrote to memory of 3440 1320 cmd.exe cmd.exe PID 1320 wrote to memory of 4016 1320 cmd.exe cacls.exe PID 1320 wrote to memory of 4016 1320 cmd.exe cacls.exe PID 1320 wrote to memory of 4016 1320 cmd.exe cacls.exe PID 1320 wrote to memory of 5024 1320 cmd.exe cacls.exe PID 1320 wrote to memory of 5024 1320 cmd.exe cacls.exe PID 1320 wrote to memory of 5024 1320 cmd.exe cacls.exe PID 1320 wrote to memory of 4008 1320 cmd.exe cmd.exe PID 1320 wrote to memory of 4008 1320 cmd.exe cmd.exe PID 1320 wrote to memory of 4008 1320 cmd.exe cmd.exe PID 1320 wrote to memory of 2208 1320 cmd.exe cacls.exe PID 1320 wrote to memory of 2208 1320 cmd.exe cacls.exe PID 1320 wrote to memory of 2208 1320 cmd.exe cacls.exe PID 1320 wrote to memory of 5080 1320 cmd.exe cacls.exe PID 1320 wrote to memory of 5080 1320 cmd.exe cacls.exe PID 1320 wrote to memory of 5080 1320 cmd.exe cacls.exe PID 4380 wrote to memory of 2468 4380 y3553050.exe n5689015.exe PID 4380 wrote to memory of 2468 4380 y3553050.exe n5689015.exe PID 4380 wrote to memory of 2468 4380 y3553050.exe n5689015.exe PID 4176 wrote to memory of 3148 4176 saves.exe rundll32.exe PID 4176 wrote to memory of 3148 4176 saves.exe rundll32.exe PID 4176 wrote to memory of 3148 4176 saves.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\y7782521_JC.exe"C:\Users\Admin\AppData\Local\Temp\y7782521_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3553050.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3553050.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3356582.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3356582.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7913480.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7913480.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F6⤵
- Creates scheduled task(s)
PID:5012 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:3440
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:N"7⤵PID:4016
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:R" /E7⤵PID:5024
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:4008
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:N"7⤵PID:2208
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:R" /E7⤵PID:5080
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m2612426.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m2612426.exe4⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n5689015.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n5689015.exe3⤵
- Executes dropped EXE
PID:2468
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:3952
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:3416
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
475KB
MD5335b60f68cec9ff16ed72eaaee6e5f38
SHA142aa49fd41887caa28bfb727ef1bc0bc0fea2098
SHA2564e378e09a769f803e4765d4918b11e756e658cecc422d330d73409b21dcedb30
SHA512049c6271eeb5541efa0a6bfd51780e5e90cae7308a7364a66ad153d2d24a903957bf31564a31ae76d7d2632805607ed342681bd7e8caaea4a96bc8e496ad8154
-
Filesize
475KB
MD5335b60f68cec9ff16ed72eaaee6e5f38
SHA142aa49fd41887caa28bfb727ef1bc0bc0fea2098
SHA2564e378e09a769f803e4765d4918b11e756e658cecc422d330d73409b21dcedb30
SHA512049c6271eeb5541efa0a6bfd51780e5e90cae7308a7364a66ad153d2d24a903957bf31564a31ae76d7d2632805607ed342681bd7e8caaea4a96bc8e496ad8154
-
Filesize
175KB
MD55e4f505d24096da9b7c33b1dd98776a3
SHA127a9feb5d6ce7ff6967292b065dcb96af63f0e29
SHA2569d21e040c835833b905f544b2a4367daca346129f4b5e28377500be7e5fc77aa
SHA5121f939a096e1ff8ad9d70c15db226279e8c26b1e8eb1c71dfecea9988de565f13003dc30e020ef43538c3e8f86bc9b56d022c6a87cc8bfd7a38742774ad4a1230
-
Filesize
175KB
MD55e4f505d24096da9b7c33b1dd98776a3
SHA127a9feb5d6ce7ff6967292b065dcb96af63f0e29
SHA2569d21e040c835833b905f544b2a4367daca346129f4b5e28377500be7e5fc77aa
SHA5121f939a096e1ff8ad9d70c15db226279e8c26b1e8eb1c71dfecea9988de565f13003dc30e020ef43538c3e8f86bc9b56d022c6a87cc8bfd7a38742774ad4a1230
-
Filesize
320KB
MD5d169eb6c70eaebfe9eb25a1160c7e49d
SHA19b599fb27b51faf0fb96e7f26ec0e23a783fe9b3
SHA2564da5b47336eb25e9a0018f4b29cb6c2172699d8fb21f07446c8a2dc43ab6a095
SHA512aabc0cc2c53d88795a184d347ff62d3cfcfd5d709f4e91d7dcfebbf4e77d1960f61917e43b7772124752a339b60638d00877774047805382b7fd82edbd44ccdc
-
Filesize
320KB
MD5d169eb6c70eaebfe9eb25a1160c7e49d
SHA19b599fb27b51faf0fb96e7f26ec0e23a783fe9b3
SHA2564da5b47336eb25e9a0018f4b29cb6c2172699d8fb21f07446c8a2dc43ab6a095
SHA512aabc0cc2c53d88795a184d347ff62d3cfcfd5d709f4e91d7dcfebbf4e77d1960f61917e43b7772124752a339b60638d00877774047805382b7fd82edbd44ccdc
-
Filesize
335KB
MD553c47a6e238635674dec3fabaa166889
SHA1836279ae43f7837a11bc35a04f794267084ae91c
SHA2566c27d65f740d9297a306ec814b19ca2bbe6157f935d8e252f3ab09c416b2da07
SHA51245da8c27be7d9c593f90f25231e5c397d77c4335aedc387aa9ab38af3ba9890db3149b53c5ce2318935e4347381ae1f4e17808d0e07ae2eb02ef94e596238dc0
-
Filesize
335KB
MD553c47a6e238635674dec3fabaa166889
SHA1836279ae43f7837a11bc35a04f794267084ae91c
SHA2566c27d65f740d9297a306ec814b19ca2bbe6157f935d8e252f3ab09c416b2da07
SHA51245da8c27be7d9c593f90f25231e5c397d77c4335aedc387aa9ab38af3ba9890db3149b53c5ce2318935e4347381ae1f4e17808d0e07ae2eb02ef94e596238dc0
-
Filesize
141KB
MD5aaa89c7a9479a4d5926274ac1f652bbe
SHA107f55526ed043eccf531b76ce9fed5149ca990c7
SHA256eb0510ea5bb96dde222a89f954910be79fd30d854f24702d50a14d563ca7285c
SHA512d17715dbfd3077214669dad72b3b6a59dd404f255fdc7a43d6096093c85f399ed1df0cf21ede57e0835e662562d1c1c5e13b942670f82bfa8e7296c67f7605fd
-
Filesize
141KB
MD5aaa89c7a9479a4d5926274ac1f652bbe
SHA107f55526ed043eccf531b76ce9fed5149ca990c7
SHA256eb0510ea5bb96dde222a89f954910be79fd30d854f24702d50a14d563ca7285c
SHA512d17715dbfd3077214669dad72b3b6a59dd404f255fdc7a43d6096093c85f399ed1df0cf21ede57e0835e662562d1c1c5e13b942670f82bfa8e7296c67f7605fd
-
Filesize
335KB
MD553c47a6e238635674dec3fabaa166889
SHA1836279ae43f7837a11bc35a04f794267084ae91c
SHA2566c27d65f740d9297a306ec814b19ca2bbe6157f935d8e252f3ab09c416b2da07
SHA51245da8c27be7d9c593f90f25231e5c397d77c4335aedc387aa9ab38af3ba9890db3149b53c5ce2318935e4347381ae1f4e17808d0e07ae2eb02ef94e596238dc0
-
Filesize
335KB
MD553c47a6e238635674dec3fabaa166889
SHA1836279ae43f7837a11bc35a04f794267084ae91c
SHA2566c27d65f740d9297a306ec814b19ca2bbe6157f935d8e252f3ab09c416b2da07
SHA51245da8c27be7d9c593f90f25231e5c397d77c4335aedc387aa9ab38af3ba9890db3149b53c5ce2318935e4347381ae1f4e17808d0e07ae2eb02ef94e596238dc0
-
Filesize
335KB
MD553c47a6e238635674dec3fabaa166889
SHA1836279ae43f7837a11bc35a04f794267084ae91c
SHA2566c27d65f740d9297a306ec814b19ca2bbe6157f935d8e252f3ab09c416b2da07
SHA51245da8c27be7d9c593f90f25231e5c397d77c4335aedc387aa9ab38af3ba9890db3149b53c5ce2318935e4347381ae1f4e17808d0e07ae2eb02ef94e596238dc0
-
Filesize
335KB
MD553c47a6e238635674dec3fabaa166889
SHA1836279ae43f7837a11bc35a04f794267084ae91c
SHA2566c27d65f740d9297a306ec814b19ca2bbe6157f935d8e252f3ab09c416b2da07
SHA51245da8c27be7d9c593f90f25231e5c397d77c4335aedc387aa9ab38af3ba9890db3149b53c5ce2318935e4347381ae1f4e17808d0e07ae2eb02ef94e596238dc0
-
Filesize
335KB
MD553c47a6e238635674dec3fabaa166889
SHA1836279ae43f7837a11bc35a04f794267084ae91c
SHA2566c27d65f740d9297a306ec814b19ca2bbe6157f935d8e252f3ab09c416b2da07
SHA51245da8c27be7d9c593f90f25231e5c397d77c4335aedc387aa9ab38af3ba9890db3149b53c5ce2318935e4347381ae1f4e17808d0e07ae2eb02ef94e596238dc0
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
273B
MD5374bfdcfcf19f4edfe949022092848d2
SHA1df5ee40497e98efcfba30012452d433373d287d4
SHA256224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f
SHA512bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7