Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-11-2024 16:03

General

  • Target

    npp.8.4.1.Installer.x64.exe

  • Size

    700.0MB

  • MD5

    9a2c573e882d31251e1bcd07ba90585f

  • SHA1

    d46878f2ad28df08972371a617bce73ae623523c

  • SHA256

    d7cd49477ad1b8c676dc3507372ca774a69af98280db45a1c9ad0c5f0a4c309e

  • SHA512

    40ac3d1cca6bb8eb7ccfb0d1ae0467423b0355ee5cded84b1095a284f08cecbd70325b808df933d47a7af60081470ad71ee1021e724759227379052302ff3894

  • SSDEEP

    98304:h9eCUTzzphq1G/jxZIo0YYUOJimJJQYts5JcyTcvg6BtufkCJ:PefTzVhqpP9JvgpTcvf7ufz

Malware Config

Extracted

Family

redline

Botnet

Notepad_2

C2

194.36.177.124:39456

Attributes
  • auth_value

    37464cc4dd294b9925a8c1092e1c72a9

Signatures

  • Detect PureCrypter injector 1 IoCs
  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

  • Purecrypter family
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\npp.8.4.1.Installer.x64.exe
    "C:\Users\Admin\AppData\Local\Temp\npp.8.4.1.Installer.x64.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4804
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DRIVER~1.EXE
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DRIVER~1.EXE
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2848
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c timeout 10
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2828
        • C:\Windows\SysWOW64\timeout.exe
          timeout 10
          4⤵
          • System Location Discovery: System Language Discovery
          • Delays execution with timeout.exe
          PID:3240
      • C:\Users\Admin\AppData\Local\Temp\Mppzqonpp.8.4.1.installer.x64.exe
        "C:\Users\Admin\AppData\Local\Temp\Mppzqonpp.8.4.1.installer.x64.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:3968
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3160

Network

  • flag-us
    DNS
    232.168.11.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    232.168.11.51.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    133.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    241.150.49.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.150.49.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    200.163.202.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.163.202.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    98.117.19.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    98.117.19.2.in-addr.arpa
    IN PTR
    Response
    98.117.19.2.in-addr.arpa
    IN PTR
    a2-19-117-98deploystaticakamaitechnologiescom
  • flag-us
    DNS
    0.204.248.87.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    0.204.248.87.in-addr.arpa
    IN PTR
    Response
    0.204.248.87.in-addr.arpa
    IN PTR
    https-87-248-204-0lhrllnwnet
  • flag-us
    DNS
    77.190.18.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    77.190.18.2.in-addr.arpa
    IN PTR
    Response
    77.190.18.2.in-addr.arpa
    IN PTR
    a2-18-190-77deploystaticakamaitechnologiescom
  • flag-us
    DNS
    13.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.227.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    93.65.42.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    93.65.42.20.in-addr.arpa
    IN PTR
    Response
  • 194.36.177.124:39456
    InstallUtil.exe
    260 B
    5
  • 194.36.177.124:39456
    InstallUtil.exe
    260 B
    5
  • 194.36.177.124:39456
    InstallUtil.exe
    260 B
    5
  • 194.36.177.124:39456
    InstallUtil.exe
    260 B
    5
  • 194.36.177.124:39456
    InstallUtil.exe
    208 B
    4
  • 8.8.8.8:53
    232.168.11.51.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    232.168.11.51.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
    128 B
    1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    133.32.126.40.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    133.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    241.150.49.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    241.150.49.20.in-addr.arpa

  • 8.8.8.8:53
    18.31.95.13.in-addr.arpa
    dns
    70 B
    144 B
    1
    1

    DNS Request

    18.31.95.13.in-addr.arpa

  • 8.8.8.8:53
    200.163.202.172.in-addr.arpa
    dns
    74 B
    160 B
    1
    1

    DNS Request

    200.163.202.172.in-addr.arpa

  • 8.8.8.8:53
    98.117.19.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    98.117.19.2.in-addr.arpa

  • 8.8.8.8:53
    0.204.248.87.in-addr.arpa
    dns
    71 B
    116 B
    1
    1

    DNS Request

    0.204.248.87.in-addr.arpa

  • 8.8.8.8:53
    77.190.18.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    77.190.18.2.in-addr.arpa

  • 8.8.8.8:53
    13.227.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    13.227.111.52.in-addr.arpa

  • 8.8.8.8:53
    93.65.42.20.in-addr.arpa
    dns
    70 B
    156 B
    1
    1

    DNS Request

    93.65.42.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Mppzqonpp.8.4.1.installer.x64.exe

    Filesize

    4.3MB

    MD5

    542c0f910db312aa76c75d5cdbf76844

    SHA1

    18f608b6220c392ddde0194352b3faf7a10608d1

    SHA256

    6d80dcfdb5a979eb11de1ebbf5733a101fbe4cd8f7c1ac10f651e71fadf52e4a

    SHA512

    087f415c20d485cc322be24ae43f730ae7edfa6f64fe78828727a8cf47a0207d18a9b45769f9f3228cd5012c7d34244ccc7edb3e93ba0cc263c4370153fe4a0d

  • C:\Users\Admin\AppData\Local\Temp\nss2548.tmp\InstallOptions.dll

    Filesize

    15KB

    MD5

    ece25721125d55aa26cdfe019c871476

    SHA1

    b87685ae482553823bf95e73e790de48dc0c11ba

    SHA256

    c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf

    SHA512

    4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480

  • C:\Users\Admin\AppData\Local\Temp\nss2548.tmp\LangDLL.dll

    Filesize

    5KB

    MD5

    68b287f4067ba013e34a1339afdb1ea8

    SHA1

    45ad585b3cc8e5a6af7b68f5d8269c97992130b3

    SHA256

    18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026

    SHA512

    06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb

  • C:\Users\Admin\AppData\Local\Temp\nss2548.tmp\System.dll

    Filesize

    12KB

    MD5

    cff85c549d536f651d4fb8387f1976f2

    SHA1

    d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

    SHA256

    8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

    SHA512

    531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

  • C:\Users\Admin\AppData\Local\Temp\nss2548.tmp\ioSpecial.ini

    Filesize

    1KB

    MD5

    933ebba1892092abff0e1344feb65dc5

    SHA1

    272a37935cfac1ae456d43aff277adcb22265203

    SHA256

    3d10a171a930e6782a588723514dd55c937eea7326a2f55f6519e93b352788d4

    SHA512

    5b3ab09e1f03b61050ff82be58b204683d7ef6663db7e27e5c0c13ce07c63bfef8a8426082ea419d89161c8eb204535f26cf9874332a86818b79aa66dbcae89e

  • C:\Users\Admin\AppData\Local\Temp\nss2548.tmp\nsDialogs.dll

    Filesize

    9KB

    MD5

    6c3f8c94d0727894d706940a8a980543

    SHA1

    0d1bcad901be377f38d579aafc0c41c0ef8dcefd

    SHA256

    56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

    SHA512

    2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355

  • memory/2848-13-0x0000000008470000-0x00000000084D6000-memory.dmp

    Filesize

    408KB

  • memory/2848-12-0x00000000053D0000-0x000000000541C000-memory.dmp

    Filesize

    304KB

  • memory/2848-35-0x0000000074D80000-0x0000000075530000-memory.dmp

    Filesize

    7.7MB

  • memory/2848-14-0x0000000009200000-0x0000000009292000-memory.dmp

    Filesize

    584KB

  • memory/2848-15-0x0000000009850000-0x0000000009DF4000-memory.dmp

    Filesize

    5.6MB

  • memory/2848-11-0x0000000005F70000-0x00000000063FA000-memory.dmp

    Filesize

    4.5MB

  • memory/2848-5-0x0000000074D8E000-0x0000000074D8F000-memory.dmp

    Filesize

    4KB

  • memory/2848-10-0x0000000074D80000-0x0000000075530000-memory.dmp

    Filesize

    7.7MB

  • memory/2848-9-0x0000000074D8E000-0x0000000074D8F000-memory.dmp

    Filesize

    4KB

  • memory/2848-8-0x0000000074D80000-0x0000000075530000-memory.dmp

    Filesize

    7.7MB

  • memory/2848-7-0x0000000005AE0000-0x0000000005F68000-memory.dmp

    Filesize

    4.5MB

  • memory/2848-6-0x0000000000C70000-0x000000000111E000-memory.dmp

    Filesize

    4.7MB

  • memory/3160-26-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/3160-41-0x00000000054B0000-0x00000000054EC000-memory.dmp

    Filesize

    240KB

  • memory/3160-42-0x00000000054F0000-0x000000000553C000-memory.dmp

    Filesize

    304KB

  • memory/3160-39-0x0000000005450000-0x0000000005462000-memory.dmp

    Filesize

    72KB

  • memory/3160-40-0x0000000005580000-0x000000000568A000-memory.dmp

    Filesize

    1.0MB

  • memory/3160-38-0x00000000059E0000-0x0000000005FF8000-memory.dmp

    Filesize

    6.1MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.