Overview
overview
10Static
static
3016b8fab11...90.exe
windows10-2004-x64
10046f35763e...68.exe
windows10-2004-x64
1014e25178ee...de.exe
windows10-2004-x64
1058609bf38b...1d.exe
windows10-2004-x64
105e46be5a16...b4.exe
windows10-2004-x64
1064220efa05...b0.exe
windows10-2004-x64
107252b3ba90...cd.exe
windows10-2004-x64
10761baf17cd...b8.exe
windows10-2004-x64
1079b34442d1...59.exe
windows10-2004-x64
107bca30b01b...44.exe
windows10-2004-x64
77f2d656f1a...24.exe
windows10-2004-x64
1092903f5aac...33.exe
windows10-2004-x64
10a6fd8428c6...ff.exe
windows10-2004-x64
10a9a24c6b40...79.exe
windows10-2004-x64
10c957c1f7d6...20.exe
windows10-2004-x64
10d30a3fe09c...90.exe
windows10-2004-x64
10d4c8c5a1d2...4e.exe
windows10-2004-x64
10e2ca05276c...37.exe
windows10-2004-x64
10e79c48869d...9a.exe
windows10-2004-x64
10fff53a878c...d6.exe
windows10-2004-x64
10Analysis
-
max time kernel
145s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 07:44
Static task
static1
Behavioral task
behavioral1
Sample
016b8fab114770bc330d8c49bc8909920899011e9018ceeaa5233b1b572c4190.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
046f35763e317ea5c0e4e5bc1725bc6e4fbd85ebf7a2820a18b9033c87584f68.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
14e25178ee8b8712bc968c820fb869e90a44dec170ecd8a6483ae8f108b1f2de.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral4
Sample
58609bf38be4777dd43032b4b64e68420854d83e377491d6356127f6c112181d.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
5e46be5a1605d21562eda70cd21e2675e650c3789e8dde9dfb908ec546adc9b4.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral6
Sample
64220efa0582fe1aec27096123429aeb58dc263d43340ad6613555ad427544b0.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
7252b3ba9094d91a1e12f9c9944f24ccf25c9a4c75e7f7e3380ca37b8e6bfbcd.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral8
Sample
761baf17cd7e790b03075c76f9e902cd11700ce8b920d2741b04a70371069ab8.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
79b34442d1c8507ff7bb7f184e63b7b674da3847ab0d3d8203b60c93467fa859.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral10
Sample
7bca30b01b52faa483cb9bba6adca25589109b55d6cd6c01bb4219ef6d8f4444.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
7f2d656f1a4331d02ffea567b5177c3a772a6a6e9c022b13e9042bd0dccbf324.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral12
Sample
92903f5aac10e31279ef8ae844a86a677e02e1799ba17380867ee77d55b31433.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
a6fd8428c609450c9b2629eda53c7749e0bb145c64d6bcfc5071adec21c467ff.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral14
Sample
a9a24c6b40b53ea0f85263a4222bf4792c43b7f26287058d9cd536b2ceb5a779.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
c957c1f7d6e812384412b37342974d2234a9d5e5aaa2e53f0e6e41977b4af020.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral16
Sample
d30a3fe09c9a256105cd948f3eb2049778fcc4c34bdd05779bd39a344805a590.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
d4c8c5a1d2ba6f3920e2785153bc3ad1843efb3696b1cfd86ebffe60bc121e4e.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
e2ca05276c37a88d337993eae49ec4ac99bf1c9f9e56112366021c7a649bf337.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
e79c48869da7300155b8f28e75c456d3c8b56a174d85529c97d8307a157a099a.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral20
Sample
fff53a878cc4bf75cd2f5a6ea052244eda18185761d3173fcd0c10469adce0d6.exe
Resource
win10v2004-20240426-en
General
-
Target
14e25178ee8b8712bc968c820fb869e90a44dec170ecd8a6483ae8f108b1f2de.exe
-
Size
1.0MB
-
MD5
1e122a6f0ed6181bda7d4bf1eb33f793
-
SHA1
6b1eb80241e7e528ca1e807c72313668ae8975a5
-
SHA256
14e25178ee8b8712bc968c820fb869e90a44dec170ecd8a6483ae8f108b1f2de
-
SHA512
b4bd70d297c2912540da9ec529070d31b9ef73b846a225fa4705402ba7fb75fc08c573512a8f7e0ed37476643b08455de7f68818b5677452a76f251c412cd082
-
SSDEEP
24576:hyKI2pjfsvcRzmYqFpts/vsBBpjW08KzPAf1pq:UK1f8c/OXovsjpK085f1
Malware Config
Extracted
redline
horda
194.49.94.152:19053
Extracted
risepro
194.49.94.152
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral3/memory/4680-14-0x0000000000400000-0x000000000043C000-memory.dmp family_redline -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk 3pE92xl.exe -
Executes dropped EXE 3 IoCs
pid Process 2816 Rp6qu35.exe 4904 2Jv9134.exe 1100 3pE92xl.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 14e25178ee8b8712bc968c820fb869e90a44dec170ecd8a6483ae8f108b1f2de.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" Rp6qu35.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe" 3pE92xl.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4904 set thread context of 4680 4904 2Jv9134.exe 103 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 4280 4904 WerFault.exe 83 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 216 schtasks.exe 3648 schtasks.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 872 wrote to memory of 2816 872 14e25178ee8b8712bc968c820fb869e90a44dec170ecd8a6483ae8f108b1f2de.exe 82 PID 872 wrote to memory of 2816 872 14e25178ee8b8712bc968c820fb869e90a44dec170ecd8a6483ae8f108b1f2de.exe 82 PID 872 wrote to memory of 2816 872 14e25178ee8b8712bc968c820fb869e90a44dec170ecd8a6483ae8f108b1f2de.exe 82 PID 2816 wrote to memory of 4904 2816 Rp6qu35.exe 83 PID 2816 wrote to memory of 4904 2816 Rp6qu35.exe 83 PID 2816 wrote to memory of 4904 2816 Rp6qu35.exe 83 PID 4904 wrote to memory of 1240 4904 2Jv9134.exe 98 PID 4904 wrote to memory of 1240 4904 2Jv9134.exe 98 PID 4904 wrote to memory of 1240 4904 2Jv9134.exe 98 PID 4904 wrote to memory of 2932 4904 2Jv9134.exe 99 PID 4904 wrote to memory of 2932 4904 2Jv9134.exe 99 PID 4904 wrote to memory of 2932 4904 2Jv9134.exe 99 PID 4904 wrote to memory of 1680 4904 2Jv9134.exe 100 PID 4904 wrote to memory of 1680 4904 2Jv9134.exe 100 PID 4904 wrote to memory of 1680 4904 2Jv9134.exe 100 PID 4904 wrote to memory of 1408 4904 2Jv9134.exe 101 PID 4904 wrote to memory of 1408 4904 2Jv9134.exe 101 PID 4904 wrote to memory of 1408 4904 2Jv9134.exe 101 PID 4904 wrote to memory of 1448 4904 2Jv9134.exe 102 PID 4904 wrote to memory of 1448 4904 2Jv9134.exe 102 PID 4904 wrote to memory of 1448 4904 2Jv9134.exe 102 PID 4904 wrote to memory of 4680 4904 2Jv9134.exe 103 PID 4904 wrote to memory of 4680 4904 2Jv9134.exe 103 PID 4904 wrote to memory of 4680 4904 2Jv9134.exe 103 PID 4904 wrote to memory of 4680 4904 2Jv9134.exe 103 PID 4904 wrote to memory of 4680 4904 2Jv9134.exe 103 PID 4904 wrote to memory of 4680 4904 2Jv9134.exe 103 PID 4904 wrote to memory of 4680 4904 2Jv9134.exe 103 PID 4904 wrote to memory of 4680 4904 2Jv9134.exe 103 PID 2816 wrote to memory of 1100 2816 Rp6qu35.exe 107 PID 2816 wrote to memory of 1100 2816 Rp6qu35.exe 107 PID 2816 wrote to memory of 1100 2816 Rp6qu35.exe 107 PID 1100 wrote to memory of 216 1100 3pE92xl.exe 108 PID 1100 wrote to memory of 216 1100 3pE92xl.exe 108 PID 1100 wrote to memory of 216 1100 3pE92xl.exe 108 PID 1100 wrote to memory of 3648 1100 3pE92xl.exe 110 PID 1100 wrote to memory of 3648 1100 3pE92xl.exe 110 PID 1100 wrote to memory of 3648 1100 3pE92xl.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\14e25178ee8b8712bc968c820fb869e90a44dec170ecd8a6483ae8f108b1f2de.exe"C:\Users\Admin\AppData\Local\Temp\14e25178ee8b8712bc968c820fb869e90a44dec170ecd8a6483ae8f108b1f2de.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rp6qu35.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rp6qu35.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Jv9134.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Jv9134.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵PID:1240
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵PID:2932
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵PID:1680
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵PID:1408
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵PID:1448
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵PID:4680
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 6364⤵
- Program crash
PID:4280
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3pE92xl.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3pE92xl.exe3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST4⤵
- Creates scheduled task(s)
PID:216
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST4⤵
- Creates scheduled task(s)
PID:3648
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4904 -ip 49041⤵PID:4404
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
946KB
MD56ed94b05647d7b713063fc8eef0aa7ca
SHA10699a92d19c598c3e274bb152c5a31e5f815fbc7
SHA256587dff0ac038d2d69f8307f8ad030872d00dbc7d4fbb7053e044a9f1e94b7e4f
SHA512a530437ab63a8898f0377477a29e416c8dc0133068e82acd21c54cce8ae80eab327e1e33f02d8af3f4b459cfdf3b0ac1e1904fc4935483eaf8741017277db7bd
-
Filesize
1.1MB
MD5a996f1f8ca16ac9d38982563918c429a
SHA1fcc91279b440715b06a6245c202f9c43d4fabb77
SHA256ffa310b561393b4d2921bfab23ff37e83ee8f28da0a6cd693528d9c5d28d9242
SHA512b197c9063c05389425b1444af012a58330c8ace1190a8420d759477b45ccf59e0ec0a6ac0fad14dc38d8366d5af1fee0f9e6c6f7a816377ccdfcd016ed4f763a
-
Filesize
1.3MB
MD534c2b74ff04eaa70dbadc8e9916029b0
SHA176bfc5ef4e15e8d700e6f04791dac4fa8775cee8
SHA256484b7657b8c88fba0357da676c330bbf82e3aace1889a14722c03a645bee77b5
SHA512ade66e6f4f46167a3c903de8aee3a773ef2a23a6097cbf2f0880f5257b3003c0c7c7a2090dca688eb834a771678c12b11423d94462822547aecf249cb0afd37e