Analysis
- max time kernel
146s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
24/07/2024, 14:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4F26B9B399E238579178958FC76C17AB1A605A33CB6BD6D47AAC073596A2DEE6.exe
Resource
win7-20240708-en
windows7-x64
13 signatures
150 seconds
General
- Target 4F26B9B399E238579178958FC76C17AB1A605A33CB6BD6D47AAC073596A2DEE6.exe
- Size 384KB
- Sample240724-rgpf8ashrf
- SHA256 3492109e6402567ad87451c72a554d3f112b5f59f3fb97e84082a767c2c76108
- MD5 2ff5a03dff94e3d9cb079b4da0e57cf5
- SHA1 d6483a3b778de602ba2c5657ca8efa2a0b75e3de
- SHA512 34cd550664d44cb43d49ca060fe02f59cf19e0555adfe0f188b4f0877e6408b09ec5087ed606e0c7e7b39ec1d10f8305268337048b73bf36e9d67b6d64960f41
- SSDEEP 6144:++pLw3TFfhAvLp2z62Dpl+X9Z+nD0nYwL6Q9HL6QGI7:BpLITFaKtuX9QnDmjj9rjGI
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
redline
Botnet
-
03252020
C2
-
62.204.41.166:27688
Attributes
-
auth_value
615a24be0b062774496a554724a2fe2b
Extracted
Family
-
arkei
Botnet
-
Default
C2
-
62.204.41.69/p8jG9WvgbE.php
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 2 IoCs
resource yara_rule behavioral2/memory/948-32-0x0000000000400000-0x0000000000424000-memory.dmp family_redline behavioral2/memory/948-34-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
resource yara_rule behavioral2/files/0x00090000000233db-3.dat aspack_v212_v242 - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation 4F26B9B399E238579178958FC76C17AB1A605A33CB6BD6D47AAC073596A2DEE6.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation ZOfyQM.exe - Executes dropped EXE 2 IoCs
pid Process 3176 ZOfyQM.exe 4032 vaqvame.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4032 set thread context of 948 4032 vaqvame.exe 91 PID 2340 set thread context of 2352 2340 4F26B9B399E238579178958FC76C17AB1A605A33CB6BD6D47AAC073596A2DEE6.exe 93 - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe ZOfyQM.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe ZOfyQM.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe ZOfyQM.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe ZOfyQM.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe ZOfyQM.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe ZOfyQM.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe ZOfyQM.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe ZOfyQM.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe ZOfyQM.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe ZOfyQM.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe ZOfyQM.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe ZOfyQM.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe ZOfyQM.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe ZOfyQM.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe ZOfyQM.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE ZOfyQM.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE ZOfyQM.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe ZOfyQM.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\chrome_pwa_launcher.exe ZOfyQM.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe ZOfyQM.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe ZOfyQM.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe ZOfyQM.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe ZOfyQM.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe ZOfyQM.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe ZOfyQM.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe ZOfyQM.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe ZOfyQM.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe ZOfyQM.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe ZOfyQM.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe ZOfyQM.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe ZOfyQM.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe ZOfyQM.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe ZOfyQM.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE ZOfyQM.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe ZOfyQM.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe ZOfyQM.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe ZOfyQM.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe ZOfyQM.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe ZOfyQM.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe ZOfyQM.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe ZOfyQM.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe ZOfyQM.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe ZOfyQM.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe ZOfyQM.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe ZOfyQM.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe ZOfyQM.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe ZOfyQM.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE ZOfyQM.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe ZOfyQM.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE ZOfyQM.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE ZOfyQM.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe ZOfyQM.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe ZOfyQM.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe ZOfyQM.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe ZOfyQM.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Time.exe ZOfyQM.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe ZOfyQM.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe ZOfyQM.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe ZOfyQM.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe ZOfyQM.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe ZOfyQM.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe ZOfyQM.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe ZOfyQM.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe ZOfyQM.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vaqvame.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regasm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F26B9B399E238579178958FC76C17AB1A605A33CB6BD6D47AAC073596A2DEE6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZOfyQM.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 4032 vaqvame.exe 4032 vaqvame.exe 4032 vaqvame.exe 4032 vaqvame.exe 2340 4F26B9B399E238579178958FC76C17AB1A605A33CB6BD6D47AAC073596A2DEE6.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2340 4F26B9B399E238579178958FC76C17AB1A605A33CB6BD6D47AAC073596A2DEE6.exe 4032 vaqvame.exe - Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 2340 wrote to memory of 3176 2340 4F26B9B399E238579178958FC76C17AB1A605A33CB6BD6D47AAC073596A2DEE6.exe 84 PID 2340 wrote to memory of 3176 2340 4F26B9B399E238579178958FC76C17AB1A605A33CB6BD6D47AAC073596A2DEE6.exe 84 PID 2340 wrote to memory of 3176 2340 4F26B9B399E238579178958FC76C17AB1A605A33CB6BD6D47AAC073596A2DEE6.exe 84 PID 2340 wrote to memory of 4032 2340 4F26B9B399E238579178958FC76C17AB1A605A33CB6BD6D47AAC073596A2DEE6.exe 85 PID 2340 wrote to memory of 4032 2340 4F26B9B399E238579178958FC76C17AB1A605A33CB6BD6D47AAC073596A2DEE6.exe 85 PID 2340 wrote to memory of 4032 2340 4F26B9B399E238579178958FC76C17AB1A605A33CB6BD6D47AAC073596A2DEE6.exe 85 PID 3176 wrote to memory of 1300 3176 ZOfyQM.exe 86 PID 3176 wrote to memory of 1300 3176 ZOfyQM.exe 86 PID 3176 wrote to memory of 1300 3176 ZOfyQM.exe 86 PID 4032 wrote to memory of 1744 4032 vaqvame.exe 88 PID 4032 wrote to memory of 1744 4032 vaqvame.exe 88 PID 4032 wrote to memory of 1744 4032 vaqvame.exe 88 PID 4032 wrote to memory of 1744 4032 vaqvame.exe 88 PID 4032 wrote to memory of 4616 4032 vaqvame.exe 89 PID 4032 wrote to memory of 4616 4032 vaqvame.exe 89 PID 4032 wrote to memory of 4616 4032 vaqvame.exe 89 PID 4032 wrote to memory of 4616 4032 vaqvame.exe 89 PID 4032 wrote to memory of 4932 4032 vaqvame.exe 90 PID 4032 wrote to memory of 4932 4032 vaqvame.exe 90 PID 4032 wrote to memory of 4932 4032 vaqvame.exe 90 PID 4032 wrote to memory of 4932 4032 vaqvame.exe 90 PID 4032 wrote to memory of 948 4032 vaqvame.exe 91 PID 4032 wrote to memory of 948 4032 vaqvame.exe 91 PID 4032 wrote to memory of 948 4032 vaqvame.exe 91 PID 4032 wrote to memory of 948 4032 vaqvame.exe 91 PID 2340 wrote to memory of 2352 2340 4F26B9B399E238579178958FC76C17AB1A605A33CB6BD6D47AAC073596A2DEE6.exe 93 PID 2340 wrote to memory of 2352 2340 4F26B9B399E238579178958FC76C17AB1A605A33CB6BD6D47AAC073596A2DEE6.exe 93 PID 2340 wrote to memory of 2352 2340 4F26B9B399E238579178958FC76C17AB1A605A33CB6BD6D47AAC073596A2DEE6.exe 93 PID 2340 wrote to memory of 2352 2340 4F26B9B399E238579178958FC76C17AB1A605A33CB6BD6D47AAC073596A2DEE6.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\4F26B9B399E238579178958FC76C17AB1A605A33CB6BD6D47AAC073596A2DEE6.exe"C:\Users\Admin\AppData\Local\Temp\4F26B9B399E238579178958FC76C17AB1A605A33CB6BD6D47AAC073596A2DEE6.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\ZOfyQM.exeC:\Users\Admin\AppData\Local\Temp\ZOfyQM.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2d707542.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:1300
-
-
-
C:\Users\Admin\AppData\Roaming\vaqvame.exe"C:\Users\Admin\AppData\Roaming\vaqvame.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"3⤵PID:1744
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"3⤵PID:4616
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"3⤵PID:4932
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"3⤵
- System Location Discovery: System Language Discovery
PID:948
-
-
-
C:\Users\Admin\AppData\Local\Temp\4F26B9B399E238579178958FC76C17AB1A605A33CB6BD6D47AAC073596A2DEE6.exe"C:\Users\Admin\AppData\Local\Temp\4F26B9B399E238579178958FC76C17AB1A605A33CB6BD6D47AAC073596A2DEE6.exe"2⤵PID:2352
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\2d707542.bat
- Size 187B
- SHA256 cfcf6fca8444449dc7ff14f3729c16830e5f5d5233249d0cec4155821d57645a
- MD5 542e10f98948047488312dac825473f2
- SHA1 fa71e154130f8c07903712b72c6633a64db23859
- SHA512 eb2d48e4bbbf418ef0585744c48b7598d6baf5f9c2dd48a46cd898eb4fc9ed00d7e134b0de462b9bbfd14dd844e0d0ce372260ab47edcbe0ebae6d3822d38c5a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\ZOfyQM.exe
- Size 15KB
- SHA256 4485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794
- MD5 f7d21de5c4e81341eccd280c11ddcc9a
- SHA1 d4e9ef10d7685d491583c6fa93ae5d9105d815bd
- SHA512 e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3
- SSDEEP 384:IXZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:gQGPL4vzZq2o9W7GsxBbPr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\vaqvame.exe
- Size 160KB
- SHA256 64855433a38b11ffa6ea3f7e4603df462c0256cb110543ecb258e1d4b8129fa1
- MD5 5a635cd2e969d56f271469e4dec47827
- SHA1 fe577c3351a4782955d17cbb7d63205420198a67
- SHA512 b5e5d5bce3c744cf6172427c2ca7ed4f6dc2e4ba426062b0fd0479be5c52fb46d47beedeb32ad6fcb86e4547332f645b7d2ad6b7835da1c1af002deb41e81c38
- SSDEEP 3072:YoHwdFyL6X9oZ4+nv28GZKeIbw8nWIh3Gl0RQJbiyeVrO1:j+X9Z+nD0nYwL6Q97
- MD5 SHA1 SHA512 SSDEEP