Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
06-11-2024 16:03
Static task
static1
Behavioral task
behavioral1
Sample
DATA PROTECTION/combase.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
DATA PROTECTION/combase.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
DATA PROTECTION/freebl3.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
DATA PROTECTION/freebl3.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
npp.8.4.1.Installer.x64.exe
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
npp.8.4.1.Installer.x64.exe
Resource
win10v2004-20241007-en
General
-
Target
npp.8.4.1.Installer.x64.exe
-
Size
700.0MB
-
MD5
9a2c573e882d31251e1bcd07ba90585f
-
SHA1
d46878f2ad28df08972371a617bce73ae623523c
-
SHA256
d7cd49477ad1b8c676dc3507372ca774a69af98280db45a1c9ad0c5f0a4c309e
-
SHA512
40ac3d1cca6bb8eb7ccfb0d1ae0467423b0355ee5cded84b1095a284f08cecbd70325b808df933d47a7af60081470ad71ee1021e724759227379052302ff3894
-
SSDEEP
98304:h9eCUTzzphq1G/jxZIo0YYUOJimJJQYts5JcyTcvg6BtufkCJ:PefTzVhqpP9JvgpTcvf7ufz
Malware Config
Extracted
redline
Notepad_2
194.36.177.124:39456
-
auth_value
37464cc4dd294b9925a8c1092e1c72a9
Signatures
-
Detect PureCrypter injector 1 IoCs
resource yara_rule behavioral6/memory/2848-11-0x0000000005F70000-0x00000000063FA000-memory.dmp family_purecrypter -
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Purecrypter family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral6/memory/3160-26-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Redline family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation DRIVER~1.EXE -
Executes dropped EXE 2 IoCs
pid Process 2848 DRIVER~1.EXE 3968 Mppzqonpp.8.4.1.installer.x64.exe -
Loads dropped DLL 5 IoCs
pid Process 3968 Mppzqonpp.8.4.1.installer.x64.exe 3968 Mppzqonpp.8.4.1.installer.x64.exe 3968 Mppzqonpp.8.4.1.installer.x64.exe 3968 Mppzqonpp.8.4.1.installer.x64.exe 3968 Mppzqonpp.8.4.1.installer.x64.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" npp.8.4.1.Installer.x64.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2848 set thread context of 3160 2848 DRIVER~1.EXE 98 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mppzqonpp.8.4.1.installer.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InstallUtil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DRIVER~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 3240 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2848 DRIVER~1.EXE 2848 DRIVER~1.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2848 DRIVER~1.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 4804 wrote to memory of 2848 4804 npp.8.4.1.Installer.x64.exe 89 PID 4804 wrote to memory of 2848 4804 npp.8.4.1.Installer.x64.exe 89 PID 4804 wrote to memory of 2848 4804 npp.8.4.1.Installer.x64.exe 89 PID 2848 wrote to memory of 2828 2848 DRIVER~1.EXE 93 PID 2848 wrote to memory of 2828 2848 DRIVER~1.EXE 93 PID 2848 wrote to memory of 2828 2848 DRIVER~1.EXE 93 PID 2828 wrote to memory of 3240 2828 cmd.exe 95 PID 2828 wrote to memory of 3240 2828 cmd.exe 95 PID 2828 wrote to memory of 3240 2828 cmd.exe 95 PID 2848 wrote to memory of 3968 2848 DRIVER~1.EXE 97 PID 2848 wrote to memory of 3968 2848 DRIVER~1.EXE 97 PID 2848 wrote to memory of 3968 2848 DRIVER~1.EXE 97 PID 2848 wrote to memory of 3160 2848 DRIVER~1.EXE 98 PID 2848 wrote to memory of 3160 2848 DRIVER~1.EXE 98 PID 2848 wrote to memory of 3160 2848 DRIVER~1.EXE 98 PID 2848 wrote to memory of 3160 2848 DRIVER~1.EXE 98 PID 2848 wrote to memory of 3160 2848 DRIVER~1.EXE 98 PID 2848 wrote to memory of 3160 2848 DRIVER~1.EXE 98 PID 2848 wrote to memory of 3160 2848 DRIVER~1.EXE 98 PID 2848 wrote to memory of 3160 2848 DRIVER~1.EXE 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\npp.8.4.1.Installer.x64.exe"C:\Users\Admin\AppData\Local\Temp\npp.8.4.1.Installer.x64.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DRIVER~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DRIVER~1.EXE2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 103⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\timeout.exetimeout 104⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3240
-
-
-
C:\Users\Admin\AppData\Local\Temp\Mppzqonpp.8.4.1.installer.x64.exe"C:\Users\Admin\AppData\Local\Temp\Mppzqonpp.8.4.1.installer.x64.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3968
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
- System Location Discovery: System Language Discovery
PID:3160
-
-
Network
-
Remote address:8.8.8.8:53Request232.168.11.51.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request133.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request241.150.49.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request18.31.95.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request200.163.202.172.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request98.117.19.2.in-addr.arpaIN PTRResponse98.117.19.2.in-addr.arpaIN PTRa2-19-117-98deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request0.204.248.87.in-addr.arpaIN PTRResponse0.204.248.87.in-addr.arpaIN PTRhttps-87-248-204-0lhrllnwnet
-
Remote address:8.8.8.8:53Request77.190.18.2.in-addr.arpaIN PTRResponse77.190.18.2.in-addr.arpaIN PTRa2-18-190-77deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request13.227.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request93.65.42.20.in-addr.arpaIN PTRResponse
-
260 B 5
-
260 B 5
-
260 B 5
-
260 B 5
-
208 B 4
-
72 B 158 B 1 1
DNS Request
232.168.11.51.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
133.32.126.40.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
241.150.49.20.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
18.31.95.13.in-addr.arpa
-
74 B 160 B 1 1
DNS Request
200.163.202.172.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
98.117.19.2.in-addr.arpa
-
71 B 116 B 1 1
DNS Request
0.204.248.87.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
77.190.18.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
13.227.111.52.in-addr.arpa
-
70 B 156 B 1 1
DNS Request
93.65.42.20.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.3MB
MD5542c0f910db312aa76c75d5cdbf76844
SHA118f608b6220c392ddde0194352b3faf7a10608d1
SHA2566d80dcfdb5a979eb11de1ebbf5733a101fbe4cd8f7c1ac10f651e71fadf52e4a
SHA512087f415c20d485cc322be24ae43f730ae7edfa6f64fe78828727a8cf47a0207d18a9b45769f9f3228cd5012c7d34244ccc7edb3e93ba0cc263c4370153fe4a0d
-
Filesize
15KB
MD5ece25721125d55aa26cdfe019c871476
SHA1b87685ae482553823bf95e73e790de48dc0c11ba
SHA256c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf
SHA5124e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480
-
Filesize
5KB
MD568b287f4067ba013e34a1339afdb1ea8
SHA145ad585b3cc8e5a6af7b68f5d8269c97992130b3
SHA25618e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
SHA51206c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
-
Filesize
12KB
MD5cff85c549d536f651d4fb8387f1976f2
SHA1d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA2568dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
SHA512531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
-
Filesize
1KB
MD5933ebba1892092abff0e1344feb65dc5
SHA1272a37935cfac1ae456d43aff277adcb22265203
SHA2563d10a171a930e6782a588723514dd55c937eea7326a2f55f6519e93b352788d4
SHA5125b3ab09e1f03b61050ff82be58b204683d7ef6663db7e27e5c0c13ce07c63bfef8a8426082ea419d89161c8eb204535f26cf9874332a86818b79aa66dbcae89e
-
Filesize
9KB
MD56c3f8c94d0727894d706940a8a980543
SHA10d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA25656b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
SHA5122094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355