Analysis Overview
SHA256
cfa85c9aec50350d95b8b5daa95b54d00c5c6636b1697fab614781432e43109c
Threat Level: Known bad
The file cfa85c9aec50350d95b8b5daa95b54d00c5c6636b1697fab614781432e43109cN was found to be: Known bad.
Malicious Activity Summary
Redline family
RedLine
RedLine payload
Executes dropped EXE
Checks computer location settings
Adds Run key to start application
System Location Discovery: System Language Discovery
Unsigned PE
Enumerates physical storage devices
Program crash
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-10 01:13
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-10 01:13
Reported
2024-11-10 01:15
Platform
win10v2004-20241007-en
Max time kernel
110s
Max time network
118s
Command Line
Signatures
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Redline family
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m33178016.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m33178016.exe | N/A |
| N/A | N/A | C:\Windows\Temp\1.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n93965724.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\cfa85c9aec50350d95b8b5daa95b54d00c5c6636b1697fab614781432e43109cN.exe | N/A |
Enumerates physical storage devices
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m33178016.exe |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\cfa85c9aec50350d95b8b5daa95b54d00c5c6636b1697fab614781432e43109cN.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m33178016.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Temp\1.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n93965724.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m33178016.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\cfa85c9aec50350d95b8b5daa95b54d00c5c6636b1697fab614781432e43109cN.exe
"C:\Users\Admin\AppData\Local\Temp\cfa85c9aec50350d95b8b5daa95b54d00c5c6636b1697fab614781432e43109cN.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m33178016.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m33178016.exe
C:\Windows\Temp\1.exe
"C:\Windows\Temp\1.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4192 -ip 4192
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 1384
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n93965724.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n93965724.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 97.17.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 64.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| RU | 185.161.248.73:4164 | tcp | |
| RU | 185.161.248.73:4164 | tcp | |
| US | 8.8.8.8:53 | 133.211.185.52.in-addr.arpa | udp |
| RU | 185.161.248.73:4164 | tcp | |
| US | 8.8.8.8:53 | 56.163.245.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| RU | 185.161.248.73:4164 | tcp | |
| US | 8.8.8.8:53 | 98.117.19.2.in-addr.arpa | udp |
| RU | 185.161.248.73:4164 | tcp | |
| RU | 185.161.248.73:4164 | tcp | |
| RU | 185.161.248.73:4164 | tcp | |
| RU | 185.161.248.73:4164 | tcp | |
| US | 8.8.8.8:53 | 48.229.111.52.in-addr.arpa | udp |
| RU | 185.161.248.73:4164 | tcp | |
| RU | 185.161.248.73:4164 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m33178016.exe
| MD5 | 2c96d4d854acee0503cfc5f4759cebf5 |
| SHA1 | 933991c7d06b62e0a716dc9a23ab0c94b09b3f59 |
| SHA256 | 1beca08441d61c6c1afdc8d983d2bfc4f5fe913df3f3457d93d997b70ff0b489 |
| SHA512 | 69199469727c4fc471d6b72856d2686e628015bc75e68064eabea07b99cf3e3fbe2ca86ee4b31066d1773a69654321c37688453977de3aac74e3b5b7ce1cfb7d |
memory/4192-8-0x00000000009D0000-0x0000000000AD0000-memory.dmp
memory/4192-9-0x0000000000970000-0x00000000009CB000-memory.dmp
memory/4192-10-0x0000000000400000-0x000000000045E000-memory.dmp
memory/4192-11-0x0000000000400000-0x0000000000835000-memory.dmp
memory/4192-12-0x00000000028B0000-0x0000000002918000-memory.dmp
memory/4192-13-0x0000000005010000-0x00000000055B4000-memory.dmp
memory/4192-14-0x00000000055C0000-0x0000000005626000-memory.dmp
memory/4192-74-0x00000000055C0000-0x0000000005620000-memory.dmp
memory/4192-78-0x00000000055C0000-0x0000000005620000-memory.dmp
memory/4192-76-0x00000000055C0000-0x0000000005620000-memory.dmp
memory/4192-72-0x00000000055C0000-0x0000000005620000-memory.dmp
memory/4192-70-0x00000000055C0000-0x0000000005620000-memory.dmp
memory/4192-68-0x00000000055C0000-0x0000000005620000-memory.dmp
memory/4192-66-0x00000000055C0000-0x0000000005620000-memory.dmp
memory/4192-64-0x00000000055C0000-0x0000000005620000-memory.dmp
memory/4192-62-0x00000000055C0000-0x0000000005620000-memory.dmp
memory/4192-60-0x00000000055C0000-0x0000000005620000-memory.dmp
memory/4192-56-0x00000000055C0000-0x0000000005620000-memory.dmp
memory/4192-54-0x00000000055C0000-0x0000000005620000-memory.dmp
memory/4192-52-0x00000000055C0000-0x0000000005620000-memory.dmp
memory/4192-50-0x00000000055C0000-0x0000000005620000-memory.dmp
memory/4192-48-0x00000000055C0000-0x0000000005620000-memory.dmp
memory/4192-46-0x00000000055C0000-0x0000000005620000-memory.dmp
memory/4192-44-0x00000000055C0000-0x0000000005620000-memory.dmp
memory/4192-42-0x00000000055C0000-0x0000000005620000-memory.dmp
memory/4192-38-0x00000000055C0000-0x0000000005620000-memory.dmp
memory/4192-36-0x00000000055C0000-0x0000000005620000-memory.dmp
memory/4192-34-0x00000000055C0000-0x0000000005620000-memory.dmp
memory/4192-32-0x00000000055C0000-0x0000000005620000-memory.dmp
memory/4192-30-0x00000000055C0000-0x0000000005620000-memory.dmp
memory/4192-28-0x00000000055C0000-0x0000000005620000-memory.dmp
memory/4192-26-0x00000000055C0000-0x0000000005620000-memory.dmp
memory/4192-22-0x00000000055C0000-0x0000000005620000-memory.dmp
memory/4192-20-0x00000000055C0000-0x0000000005620000-memory.dmp
memory/4192-18-0x00000000055C0000-0x0000000005620000-memory.dmp
memory/4192-16-0x00000000055C0000-0x0000000005620000-memory.dmp
memory/4192-15-0x00000000055C0000-0x0000000005620000-memory.dmp
memory/4192-58-0x00000000055C0000-0x0000000005620000-memory.dmp
memory/4192-40-0x00000000055C0000-0x0000000005620000-memory.dmp
memory/4192-24-0x00000000055C0000-0x0000000005620000-memory.dmp
memory/4192-2162-0x0000000004ED0000-0x0000000004F02000-memory.dmp
memory/4192-2161-0x00000000009D0000-0x0000000000AD0000-memory.dmp
C:\Windows\Temp\1.exe
| MD5 | f16fb63d4e551d3808e8f01f2671b57e |
| SHA1 | 781153ad6235a1152da112de1fb39a6f2d063575 |
| SHA256 | 8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581 |
| SHA512 | fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf |
memory/4484-2176-0x0000000000470000-0x000000000049E000-memory.dmp
memory/4484-2175-0x0000000073D5E000-0x0000000073D5F000-memory.dmp
memory/4484-2177-0x0000000002700000-0x0000000002706000-memory.dmp
memory/4484-2178-0x00000000053C0000-0x00000000059D8000-memory.dmp
memory/4484-2179-0x0000000004EC0000-0x0000000004FCA000-memory.dmp
memory/4192-2181-0x0000000000970000-0x00000000009CB000-memory.dmp
memory/4484-2180-0x0000000004DF0000-0x0000000004E02000-memory.dmp
memory/4484-2182-0x0000000004E50000-0x0000000004E8C000-memory.dmp
memory/4484-2184-0x0000000004FD0000-0x000000000501C000-memory.dmp
memory/4484-2183-0x0000000073D50000-0x0000000074500000-memory.dmp
memory/4192-2186-0x0000000000400000-0x000000000045E000-memory.dmp
memory/4192-2187-0x0000000000400000-0x0000000000835000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n93965724.exe
| MD5 | 34bc8de328c8b062661ae32d31054fa6 |
| SHA1 | bdd92bb5496d9d8b118149b07be52e2582a3cbbb |
| SHA256 | 58c3bee46bd1a23ab699328fbb5aa682d883063c7327486e82e0b1b1a3285ef7 |
| SHA512 | f799bd0f2b4dd32cb9874fdce5c562f3eee141f29e2948ef21eb0f67f5e2ae84c3a4d98e4b49d0deca1acdd0cea27ea18b08c08f7d05b02d09efcb9f3f9b67e8 |
memory/5320-2191-0x0000000000180000-0x00000000001B0000-memory.dmp
memory/5320-2192-0x0000000002340000-0x0000000002346000-memory.dmp
memory/4484-2193-0x0000000073D5E000-0x0000000073D5F000-memory.dmp
memory/4484-2194-0x0000000073D50000-0x0000000074500000-memory.dmp