Analysis Overview
SHA256
22c1a63a7205d1da40b89afd71679c06d8d0ba66649afe47278e84a1380f8f88
Threat Level: Known bad
The file 22c1a63a7205d1da40b89afd71679c06d8d0ba66649afe47278e84a1380f8f88 was found to be: Known bad.
Malicious Activity Summary
RedLine
RedLine payload
Redline family
Executes dropped EXE
Adds Run key to start application
Unsigned PE
System Location Discovery: System Language Discovery
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-12 20:26
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-12 20:26
Reported
2024-11-12 20:29
Platform
win10v2004-20241007-en
Max time kernel
140s
Max time network
150s
Command Line
Signatures
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Redline family
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vJM12.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vSB30.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dHj16.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\22c1a63a7205d1da40b89afd71679c06d8d0ba66649afe47278e84a1380f8f88.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vJM12.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vSB30.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vSB30.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dHj16.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\22c1a63a7205d1da40b89afd71679c06d8d0ba66649afe47278e84a1380f8f88.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vJM12.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dHj16.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\22c1a63a7205d1da40b89afd71679c06d8d0ba66649afe47278e84a1380f8f88.exe
"C:\Users\Admin\AppData\Local\Temp\22c1a63a7205d1da40b89afd71679c06d8d0ba66649afe47278e84a1380f8f88.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vJM12.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vJM12.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vSB30.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vSB30.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dHj16.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dHj16.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 71.209.201.84.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| RU | 193.233.20.12:4132 | tcp | |
| US | 8.8.8.8:53 | 133.211.185.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.163.202.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| RU | 193.233.20.12:4132 | tcp | |
| US | 8.8.8.8:53 | 74.209.201.84.in-addr.arpa | udp |
| RU | 193.233.20.12:4132 | tcp | |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| RU | 193.233.20.12:4132 | tcp | |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| RU | 193.233.20.12:4132 | tcp | |
| RU | 193.233.20.12:4132 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vJM12.exe
| MD5 | 926b103575301f2845bf10a52573df4c |
| SHA1 | d287cada71637511c7f1909c38fbd5012122b382 |
| SHA256 | 63ea3f7582ce3938814f0f8d32d107bec23a59e02d3b3094f2ab11ce74858099 |
| SHA512 | a93cb342fdc158e6dad2f67eb6f20c024c5389d20b7b57d45ca2c158cebc634fd366fd964aff15b97a25cb74871872933f75469f26c2bfa2f0e8346a832ff03c |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vSB30.exe
| MD5 | 8b2cef09e4a0a9e6096c7164e9bedf5d |
| SHA1 | f40e1016b15afaab49c109a80545b28ad0620eb2 |
| SHA256 | e8e9f3539ac23af78b2aafefc85d6bfd2f3410584d6debda08fff846f1b85da4 |
| SHA512 | fc7382860bad8d7a0635e60b8629e5a3ccc70e7465aca5c234d7b0262629fd386a28d05467cf2ae2a7f61d6b26904910c2e37f1cc60774a557ddea367129acef |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dHj16.exe
| MD5 | 45f8bfc8d5eb5084fd616df3f7e055af |
| SHA1 | bed0d63374a425e922b18f243c699239ba0f6bfb |
| SHA256 | e36e5a2972ffa26a5453108e0385fbe371045fafb60ca0fafd0a7fe1e557a0c9 |
| SHA512 | 0e4ae78d96fe6e89929806a7716770563cab588ce1f724abffd046b6671f8f46e78007a8d6b74c0c034f6ddaebc646359810075e2e6fdf3fa66c8e343cbba1e4 |
memory/3000-24-0x0000000000400000-0x000000000044E000-memory.dmp
memory/3000-23-0x0000000000670000-0x00000000006BB000-memory.dmp
memory/3000-22-0x0000000000740000-0x0000000000840000-memory.dmp
memory/3000-25-0x0000000002260000-0x00000000022A6000-memory.dmp
memory/3000-26-0x0000000004CE0000-0x0000000005284000-memory.dmp
memory/3000-27-0x0000000004B50000-0x0000000004B94000-memory.dmp
memory/3000-29-0x0000000004B50000-0x0000000004B8E000-memory.dmp
memory/3000-67-0x0000000004B50000-0x0000000004B8E000-memory.dmp
memory/3000-91-0x0000000004B50000-0x0000000004B8E000-memory.dmp
memory/3000-89-0x0000000004B50000-0x0000000004B8E000-memory.dmp
memory/3000-88-0x0000000004B50000-0x0000000004B8E000-memory.dmp
memory/3000-85-0x0000000004B50000-0x0000000004B8E000-memory.dmp
memory/3000-83-0x0000000004B50000-0x0000000004B8E000-memory.dmp
memory/3000-81-0x0000000004B50000-0x0000000004B8E000-memory.dmp
memory/3000-79-0x0000000004B50000-0x0000000004B8E000-memory.dmp
memory/3000-77-0x0000000004B50000-0x0000000004B8E000-memory.dmp
memory/3000-75-0x0000000004B50000-0x0000000004B8E000-memory.dmp
memory/3000-73-0x0000000004B50000-0x0000000004B8E000-memory.dmp
memory/3000-71-0x0000000004B50000-0x0000000004B8E000-memory.dmp
memory/3000-69-0x0000000004B50000-0x0000000004B8E000-memory.dmp
memory/3000-65-0x0000000004B50000-0x0000000004B8E000-memory.dmp
memory/3000-63-0x0000000004B50000-0x0000000004B8E000-memory.dmp
memory/3000-62-0x0000000004B50000-0x0000000004B8E000-memory.dmp
memory/3000-59-0x0000000004B50000-0x0000000004B8E000-memory.dmp
memory/3000-57-0x0000000004B50000-0x0000000004B8E000-memory.dmp
memory/3000-55-0x0000000004B50000-0x0000000004B8E000-memory.dmp
memory/3000-51-0x0000000004B50000-0x0000000004B8E000-memory.dmp
memory/3000-49-0x0000000004B50000-0x0000000004B8E000-memory.dmp
memory/3000-47-0x0000000004B50000-0x0000000004B8E000-memory.dmp
memory/3000-45-0x0000000004B50000-0x0000000004B8E000-memory.dmp
memory/3000-43-0x0000000004B50000-0x0000000004B8E000-memory.dmp
memory/3000-41-0x0000000004B50000-0x0000000004B8E000-memory.dmp
memory/3000-39-0x0000000004B50000-0x0000000004B8E000-memory.dmp
memory/3000-37-0x0000000004B50000-0x0000000004B8E000-memory.dmp
memory/3000-35-0x0000000004B50000-0x0000000004B8E000-memory.dmp
memory/3000-31-0x0000000004B50000-0x0000000004B8E000-memory.dmp
memory/3000-53-0x0000000004B50000-0x0000000004B8E000-memory.dmp
memory/3000-33-0x0000000004B50000-0x0000000004B8E000-memory.dmp
memory/3000-28-0x0000000004B50000-0x0000000004B8E000-memory.dmp
memory/3000-934-0x0000000005290000-0x00000000058A8000-memory.dmp
memory/3000-935-0x00000000058B0000-0x00000000059BA000-memory.dmp
memory/3000-936-0x0000000004CA0000-0x0000000004CB2000-memory.dmp
memory/3000-937-0x00000000059C0000-0x00000000059FC000-memory.dmp
memory/3000-938-0x0000000005B00000-0x0000000005B4C000-memory.dmp
memory/3000-940-0x0000000000740000-0x0000000000840000-memory.dmp
memory/3000-941-0x0000000000400000-0x000000000044E000-memory.dmp