Analysis
-
max time kernel
119s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13-12-2024 07:07
Static task
static1
Behavioral task
behavioral1
Sample
dd1e3f38ae7711d270748012af613950.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dd1e3f38ae7711d270748012af613950.exe
Resource
win10v2004-20241007-en
General
-
Target
dd1e3f38ae7711d270748012af613950.exe
-
Size
301KB
-
MD5
dd1e3f38ae7711d270748012af613950
-
SHA1
b3b90eec3507f523aa63802cc16e5248c8ef0ea8
-
SHA256
2997292293c332e73b11fa28126b6fbefea75a6bb02001eb017de46797d4e4ec
-
SHA512
0eff0cba972b6622fb59683fe4d15d1b6c1ef106166189f60dcd7b4c76b6ceb82fd5c71433dc61394f03eff03575f2be27dec6ac8ab064491710263879b11bca
-
SSDEEP
6144:Y2J31coxDzgqSAy3/wLZRYa2dWSS8ySQIaTgHJ0tYRV4OeJiqbQ5rF4:71coxDzgxAKILIa2d1S8ySQIaTpjKrF4
Malware Config
Extracted
redline
eewx
185.81.68.147:1912
Signatures
-
Amadey family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
resource yara_rule behavioral1/files/0x0005000000019427-50.dat family_redline behavioral1/memory/2856-73-0x0000000000FA0000-0x0000000000FF2000-memory.dmp family_redline behavioral1/memory/2688-243-0x0000000000F50000-0x0000000000FA2000-memory.dmp family_redline -
Redline family
-
Blocklisted process makes network request 8 IoCs
flow pid Process 16 900 rundll32.exe 17 900 rundll32.exe 20 2488 rundll32.exe 21 2488 rundll32.exe 26 3060 rundll32.exe 27 3060 rundll32.exe 29 832 rundll32.exe 30 832 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 8 IoCs
pid Process 1148 B377.tmp.ctx.exe 2856 B5D8.tmp.ssg.exe 2748 B377.tmp.ctx.exe 2988 BABA.tmp.gfx.exe 2696 Gxtuum.exe 1652 update.exe 3064 update.exe 2688 ssg.exe -
Loads dropped DLL 54 IoCs
pid Process 1152 Explorer.EXE 1148 B377.tmp.ctx.exe 2748 B377.tmp.ctx.exe 2748 B377.tmp.ctx.exe 2748 B377.tmp.ctx.exe 2748 B377.tmp.ctx.exe 2748 B377.tmp.ctx.exe 2748 B377.tmp.ctx.exe 2748 B377.tmp.ctx.exe 2748 B377.tmp.ctx.exe 2748 B377.tmp.ctx.exe 2748 B377.tmp.ctx.exe 2748 B377.tmp.ctx.exe 2748 B377.tmp.ctx.exe 2748 B377.tmp.ctx.exe 2748 B377.tmp.ctx.exe 2748 B377.tmp.ctx.exe 2748 B377.tmp.ctx.exe 2748 B377.tmp.ctx.exe 2748 B377.tmp.ctx.exe 2748 B377.tmp.ctx.exe 2748 B377.tmp.ctx.exe 2748 B377.tmp.ctx.exe 2748 B377.tmp.ctx.exe 2988 BABA.tmp.gfx.exe 1548 rundll32.exe 1548 rundll32.exe 1548 rundll32.exe 1548 rundll32.exe 900 rundll32.exe 900 rundll32.exe 900 rundll32.exe 900 rundll32.exe 2696 Gxtuum.exe 2696 Gxtuum.exe 2696 Gxtuum.exe 2696 Gxtuum.exe 2512 rundll32.exe 2512 rundll32.exe 2512 rundll32.exe 2512 rundll32.exe 2488 rundll32.exe 2488 rundll32.exe 2488 rundll32.exe 2488 rundll32.exe 2696 Gxtuum.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe 832 rundll32.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\AppData\\Roaming\\63C53BED1A393712659782\\63C53BED1A393712659782.exe" dd1e3f38ae7711d270748012af613950.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\AppData\\Roaming\\63C53BED1A393712659782\\63C53BED1A393712659782.exe" update.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\AppData\\Roaming\\63C53BED1A393712659782\\63C53BED1A393712659782.exe" update.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\Gxtuum.job BABA.tmp.gfx.exe -
pid Process 2308 powershell.exe 2340 powershell.exe -
Detects Pyinstaller 1 IoCs
resource yara_rule behavioral1/files/0x0008000000016d0e-13.dat pyinstaller -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gxtuum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ssg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5D8.tmp.ssg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BABA.tmp.gfx.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 928 netsh.exe 2740 netsh.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 1792 dd1e3f38ae7711d270748012af613950.exe 1152 Explorer.EXE 2856 B5D8.tmp.ssg.exe 2856 B5D8.tmp.ssg.exe 2856 B5D8.tmp.ssg.exe 900 rundll32.exe 900 rundll32.exe 900 rundll32.exe 900 rundll32.exe 900 rundll32.exe 900 rundll32.exe 2308 powershell.exe 2488 rundll32.exe 2488 rundll32.exe 2488 rundll32.exe 2488 rundll32.exe 2488 rundll32.exe 2488 rundll32.exe 2340 powershell.exe 2688 ssg.exe 2688 ssg.exe 2688 ssg.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1792 dd1e3f38ae7711d270748012af613950.exe Token: SeSecurityPrivilege 1792 dd1e3f38ae7711d270748012af613950.exe Token: SeTakeOwnershipPrivilege 1792 dd1e3f38ae7711d270748012af613950.exe Token: SeLoadDriverPrivilege 1792 dd1e3f38ae7711d270748012af613950.exe Token: SeSystemProfilePrivilege 1792 dd1e3f38ae7711d270748012af613950.exe Token: SeSystemtimePrivilege 1792 dd1e3f38ae7711d270748012af613950.exe Token: SeProfSingleProcessPrivilege 1792 dd1e3f38ae7711d270748012af613950.exe Token: SeIncBasePriorityPrivilege 1792 dd1e3f38ae7711d270748012af613950.exe Token: SeCreatePagefilePrivilege 1792 dd1e3f38ae7711d270748012af613950.exe Token: SeBackupPrivilege 1792 dd1e3f38ae7711d270748012af613950.exe Token: SeRestorePrivilege 1792 dd1e3f38ae7711d270748012af613950.exe Token: SeShutdownPrivilege 1792 dd1e3f38ae7711d270748012af613950.exe Token: SeDebugPrivilege 1792 dd1e3f38ae7711d270748012af613950.exe Token: SeSystemEnvironmentPrivilege 1792 dd1e3f38ae7711d270748012af613950.exe Token: SeRemoteShutdownPrivilege 1792 dd1e3f38ae7711d270748012af613950.exe Token: SeUndockPrivilege 1792 dd1e3f38ae7711d270748012af613950.exe Token: SeManageVolumePrivilege 1792 dd1e3f38ae7711d270748012af613950.exe Token: 33 1792 dd1e3f38ae7711d270748012af613950.exe Token: 34 1792 dd1e3f38ae7711d270748012af613950.exe Token: 35 1792 dd1e3f38ae7711d270748012af613950.exe Token: SeDebugPrivilege 1792 dd1e3f38ae7711d270748012af613950.exe Token: SeDebugPrivilege 2856 B5D8.tmp.ssg.exe Token: SeDebugPrivilege 2308 powershell.exe Token: SeIncreaseQuotaPrivilege 1652 update.exe Token: SeSecurityPrivilege 1652 update.exe Token: SeTakeOwnershipPrivilege 1652 update.exe Token: SeLoadDriverPrivilege 1652 update.exe Token: SeSystemProfilePrivilege 1652 update.exe Token: SeSystemtimePrivilege 1652 update.exe Token: SeProfSingleProcessPrivilege 1652 update.exe Token: SeIncBasePriorityPrivilege 1652 update.exe Token: SeCreatePagefilePrivilege 1652 update.exe Token: SeBackupPrivilege 1652 update.exe Token: SeRestorePrivilege 1652 update.exe Token: SeShutdownPrivilege 1652 update.exe Token: SeDebugPrivilege 1652 update.exe Token: SeSystemEnvironmentPrivilege 1652 update.exe Token: SeRemoteShutdownPrivilege 1652 update.exe Token: SeUndockPrivilege 1652 update.exe Token: SeManageVolumePrivilege 1652 update.exe Token: 33 1652 update.exe Token: 34 1652 update.exe Token: 35 1652 update.exe Token: SeIncreaseQuotaPrivilege 3064 update.exe Token: SeSecurityPrivilege 3064 update.exe Token: SeTakeOwnershipPrivilege 3064 update.exe Token: SeLoadDriverPrivilege 3064 update.exe Token: SeSystemProfilePrivilege 3064 update.exe Token: SeSystemtimePrivilege 3064 update.exe Token: SeProfSingleProcessPrivilege 3064 update.exe Token: SeIncBasePriorityPrivilege 3064 update.exe Token: SeCreatePagefilePrivilege 3064 update.exe Token: SeBackupPrivilege 3064 update.exe Token: SeRestorePrivilege 3064 update.exe Token: SeShutdownPrivilege 3064 update.exe Token: SeDebugPrivilege 3064 update.exe Token: SeSystemEnvironmentPrivilege 3064 update.exe Token: SeRemoteShutdownPrivilege 3064 update.exe Token: SeUndockPrivilege 3064 update.exe Token: SeManageVolumePrivilege 3064 update.exe Token: 33 3064 update.exe Token: 34 3064 update.exe Token: 35 3064 update.exe Token: SeDebugPrivilege 2340 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2988 BABA.tmp.gfx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1792 wrote to memory of 1152 1792 dd1e3f38ae7711d270748012af613950.exe 20 PID 1152 wrote to memory of 1148 1152 Explorer.EXE 30 PID 1152 wrote to memory of 1148 1152 Explorer.EXE 30 PID 1152 wrote to memory of 1148 1152 Explorer.EXE 30 PID 1152 wrote to memory of 2856 1152 Explorer.EXE 31 PID 1152 wrote to memory of 2856 1152 Explorer.EXE 31 PID 1152 wrote to memory of 2856 1152 Explorer.EXE 31 PID 1152 wrote to memory of 2856 1152 Explorer.EXE 31 PID 1148 wrote to memory of 2748 1148 B377.tmp.ctx.exe 32 PID 1148 wrote to memory of 2748 1148 B377.tmp.ctx.exe 32 PID 1148 wrote to memory of 2748 1148 B377.tmp.ctx.exe 32 PID 1152 wrote to memory of 2988 1152 Explorer.EXE 33 PID 1152 wrote to memory of 2988 1152 Explorer.EXE 33 PID 1152 wrote to memory of 2988 1152 Explorer.EXE 33 PID 1152 wrote to memory of 2988 1152 Explorer.EXE 33 PID 2988 wrote to memory of 2696 2988 BABA.tmp.gfx.exe 34 PID 2988 wrote to memory of 2696 2988 BABA.tmp.gfx.exe 34 PID 2988 wrote to memory of 2696 2988 BABA.tmp.gfx.exe 34 PID 2988 wrote to memory of 2696 2988 BABA.tmp.gfx.exe 34 PID 2696 wrote to memory of 1548 2696 Gxtuum.exe 38 PID 2696 wrote to memory of 1548 2696 Gxtuum.exe 38 PID 2696 wrote to memory of 1548 2696 Gxtuum.exe 38 PID 2696 wrote to memory of 1548 2696 Gxtuum.exe 38 PID 2696 wrote to memory of 1548 2696 Gxtuum.exe 38 PID 2696 wrote to memory of 1548 2696 Gxtuum.exe 38 PID 2696 wrote to memory of 1548 2696 Gxtuum.exe 38 PID 1548 wrote to memory of 900 1548 rundll32.exe 39 PID 1548 wrote to memory of 900 1548 rundll32.exe 39 PID 1548 wrote to memory of 900 1548 rundll32.exe 39 PID 1548 wrote to memory of 900 1548 rundll32.exe 39 PID 900 wrote to memory of 928 900 rundll32.exe 40 PID 900 wrote to memory of 928 900 rundll32.exe 40 PID 900 wrote to memory of 928 900 rundll32.exe 40 PID 900 wrote to memory of 2308 900 rundll32.exe 42 PID 900 wrote to memory of 2308 900 rundll32.exe 42 PID 900 wrote to memory of 2308 900 rundll32.exe 42 PID 2696 wrote to memory of 1652 2696 Gxtuum.exe 44 PID 2696 wrote to memory of 1652 2696 Gxtuum.exe 44 PID 2696 wrote to memory of 1652 2696 Gxtuum.exe 44 PID 2696 wrote to memory of 1652 2696 Gxtuum.exe 44 PID 2696 wrote to memory of 3064 2696 Gxtuum.exe 45 PID 2696 wrote to memory of 3064 2696 Gxtuum.exe 45 PID 2696 wrote to memory of 3064 2696 Gxtuum.exe 45 PID 2696 wrote to memory of 3064 2696 Gxtuum.exe 45 PID 2696 wrote to memory of 2512 2696 Gxtuum.exe 46 PID 2696 wrote to memory of 2512 2696 Gxtuum.exe 46 PID 2696 wrote to memory of 2512 2696 Gxtuum.exe 46 PID 2696 wrote to memory of 2512 2696 Gxtuum.exe 46 PID 2696 wrote to memory of 2512 2696 Gxtuum.exe 46 PID 2696 wrote to memory of 2512 2696 Gxtuum.exe 46 PID 2696 wrote to memory of 2512 2696 Gxtuum.exe 46 PID 2512 wrote to memory of 2488 2512 rundll32.exe 47 PID 2512 wrote to memory of 2488 2512 rundll32.exe 47 PID 2512 wrote to memory of 2488 2512 rundll32.exe 47 PID 2512 wrote to memory of 2488 2512 rundll32.exe 47 PID 2488 wrote to memory of 2740 2488 rundll32.exe 48 PID 2488 wrote to memory of 2740 2488 rundll32.exe 48 PID 2488 wrote to memory of 2740 2488 rundll32.exe 48 PID 2488 wrote to memory of 2340 2488 rundll32.exe 50 PID 2488 wrote to memory of 2340 2488 rundll32.exe 50 PID 2488 wrote to memory of 2340 2488 rundll32.exe 50 PID 2696 wrote to memory of 2688 2696 Gxtuum.exe 52 PID 2696 wrote to memory of 2688 2696 Gxtuum.exe 52 PID 2696 wrote to memory of 2688 2696 Gxtuum.exe 52
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\dd1e3f38ae7711d270748012af613950.exe"C:\Users\Admin\AppData\Local\Temp\dd1e3f38ae7711d270748012af613950.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1792
-
-
C:\Users\Admin\AppData\Local\Temp\B377.tmp.ctx.exe"C:\Users\Admin\AppData\Local\Temp\B377.tmp.ctx.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\B377.tmp.ctx.exe"C:\Users\Admin\AppData\Local\Temp\B377.tmp.ctx.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748
-
-
-
C:\Users\Admin\AppData\Local\Temp\B5D8.tmp.ssg.exe"C:\Users\Admin\AppData\Local\Temp\B5D8.tmp.ssg.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2856
-
-
C:\Users\Admin\AppData\Local\Temp\BABA.tmp.gfx.exe"C:\Users\Admin\AppData\Local\Temp\BABA.tmp.gfx.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\ee29ea508b\Gxtuum.exe"C:\Users\Admin\AppData\Local\Temp\ee29ea508b\Gxtuum.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\43266f2abbf198\cred64.dll, Main4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\43266f2abbf198\cred64.dll, Main5⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Windows\system32\netsh.exenetsh wlan show profiles6⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:928
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\872745919274_Desktop.zip' -CompressionLevel Optimal6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2308
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10000820101\update.exe"C:\Users\Admin\AppData\Local\Temp\10000820101\update.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1652
-
-
C:\Users\Admin\AppData\Local\Temp\10000830101\update.exe"C:\Users\Admin\AppData\Local\Temp\10000830101\update.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:3064
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\43266f2abbf198\cred64.dll, Main4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\43266f2abbf198\cred64.dll, Main5⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\system32\netsh.exenetsh wlan show profiles6⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:2740
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\872745919274_Desktop.zip' -CompressionLevel Optimal6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2340
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10000840101\ssg.exe"C:\Users\Admin\AppData\Local\Temp\10000840101\ssg.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2688
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\43266f2abbf198\clip64.dll, Main4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3060
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\43266f2abbf198\clip64.dll, Main4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:832
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD5da82513d453db6c45a5b4f37f6cd2e86
SHA14f6b5140e44185351c8a4ea575fd956f53f813ed
SHA2565e6dfb0b55d63e75e27079d49e375f3b4f4b928cfbb9ca9c1efadaaff01ccbba
SHA512eced3087b56e49ac67f0702eca9d436e388e6f3a922dc57053f969d5504dd00161f3386301299ccb708f4663841d80da4fcd95d372b9a9c5ec9f1c49554c9abf
-
Filesize
300KB
MD57b6730ca4da283a35c41b831b9567f15
SHA192ef2fd33f713d72207209ec65f0de6eef395af5
SHA25694d7d12ae53ce97f38d8890383c2317ce03d45bd6ecaf0e0b9165c7066cd300c
SHA512ae2d10f9895e5f2af10b4fa87cdb7c930a531e910b55cd752b15dac77a432cc28eca6e5b32b95eeb21e238aaf2eb57e29474660cae93e734d0b6543c1d462ace
-
Filesize
19KB
MD5b56d69079d2001c1b2af272774b53a64
SHA167ede1c5a71412b11847f79f5a684eabaf00de01
SHA256f3a41d882544202b2e1bdf3d955458be11fc7f76ba12668388a681870636f143
SHA5127eb8fe111dd2e1f7e308b622461eb311c2b9fc4ef44c76e1def6c524eb7281d5522af12211f1f91f651f2b678592d2997fe4cd15724f700deaff314a1737b3a8
-
Filesize
19KB
MD55af784f599437629deea9fe4e8eb4799
SHA13c891b920fd2703edd6881117ea035ced5a619f6
SHA2567e5bd3ee263d09c7998e0d5ffa684906ddc56da61536331c89c74b039df00c7c
SHA5124df58513cf52511c0d2037cdc674115d8ed5a0ed4360eb6383cc6a798a7037f3f7f2d587797223ed7797ccd476f1c503b3c16e095843f43e6b87d55ad4822d70
-
Filesize
19KB
MD5e1ca15cf0597c6743b3876af23a96960
SHA1301231f7250431bd122b12ed34a8d4e8bb379457
SHA256990e46d8f7c9574a558ebdfcb8739fbccba59d0d3a2193c9c8e66807387a276d
SHA5127c9dacd882a0650bf2f553e9bc5647e6320a66021ac4c1adc802070fd53de4c6672a7bacfd397c51009a23b6762e85c8017895e9347a94d489d42c50fa0a1c42
-
Filesize
19KB
MD58d6599d7c4897dcd0217070cca074574
SHA125eacaaa4c6f89945e97388796a8c85ba6fb01fb
SHA256a011260fafaaaefd7e7326d8d5290c6a76d55e5af4e43ffa4de5fea9b08fa928
SHA512e8e2e7c5bff41ccaa0f77c3cfee48dac43c11e75688f03b719cc1d716db047597a7a2ce25b561171ef259957bdcd9dd4345a0e0125db2b36f31698ba178e2248
-
Filesize
22KB
MD5642b29701907e98e2aa7d36eba7d78b8
SHA116f46b0e057816f3592f9c0a6671111ea2f35114
SHA2565d72feac789562d445d745a55a99536fa9302b0c27b8f493f025ba69ba31941c
SHA5121beab2b368cc595beb39b2f5a2f52d334bc42bf674b8039d334c6d399c966aff0b15876105f0a4a54fa08e021cb44907ed47d31a0af9e789eb4102b82025cf57
-
Filesize
19KB
MD5f0c73f7454a5ce6fb8e3d795fdb0235d
SHA1acdd6c5a359421d268b28ddf19d3bcb71f36c010
SHA2562a59dd891533a028fae7a81e690e4c28c9074c2f327393fab17329affe53fd7b
SHA512bd6cf4e37c3e7a1a3b36f42858af1b476f69caa4ba1fd836a7e32220e5eff7ccc811c903019560844af988a7c77cc41dc6216c0c949d8e04516a537da5821a3e
-
Filesize
19KB
MD57d4d4593b478b4357446c106b64e61f8
SHA18a4969c9e59d7a7485c8cc5723c037b20dea5c9d
SHA2560a6e2224cde90a0d41926e8863f9956848ffbf19848e8855bd08953112afc801
SHA5127bc9c473705ec98ba0c1da31c295937d97710cedefc660f6a5cb0512bae36ad23bebb2f6f14df7ce7f90ec3f817b02f577317fdd514560aab22cb0434d8e4e0b
-
Filesize
19KB
MD57bc1b8712e266db746914db48b27ef9c
SHA1c76eb162c23865b3f1bd7978f7979d6ba09ccb60
SHA256f82d05aea21bcf6337ef45fbdad6d647d17c043a67b44c7234f149f861a012b9
SHA512db6983f5f9c18908266dbf01ef95ebae49f88edc04a0515699ef12201ac9a50f09939b8784c75ae513105ada5b155e5330bd42d70f8c8c48fe6005513aefad2a
-
Filesize
19KB
MD5b071e761cea670d89d7ae80e016ce7e6
SHA1c675be753dbef1624100f16674c2221a20cf07dd
SHA25663fb84a49308b857804ae1481d2d53b00a88bbd806d257d196de2bd5c385701e
SHA512f2ecbdaba3516d92bd29dcce618185f1755451d95c7dbbe23f8215318f6f300a9964c93ec3ed65c5535d87be82b668e1d3025a7e325af71a05f14e15d530d35f
-
Filesize
19KB
MD51dccf27f2967601ce6666c8611317f03
SHA1d8246df2ed9ec4a8a719fd4b1db4fd8a71ef679b
SHA2566a83ab9a413afd74d77a090f52784b0128527bee9cb0a4224c59d5c75fc18387
SHA51270b96d69d609211f8b9e05fa510ea7d574ae8da3a6498f5c982aee71635b8a749162247055b7ba21a884bfa06c1415b68912c463f0f1b6ffb9049f3532386877
-
Filesize
19KB
MD5569a7ac3f6824a04282ff708c629a6d2
SHA1fc0d78de1075dfd4c1024a72074d09576d4d4181
SHA25684c579a8263a87991ca1d3aee2845e1c262fb4b849606358062093d08afdc7a2
SHA512e9cbff82e32540f9230cead9063acb1aceb7ccc9f3338c0b7ad10b0ac70ff5b47c15944d0dce33ea8405554aa9b75de30b26ae2ca55db159d45b6e64bc02a180
-
Filesize
21KB
MD51d75e7b9f68c23a195d408cf02248119
SHA162179fc9a949d238bb221d7c2f71ba7c1680184c
SHA25667ebe168b7019627d68064043680674f9782fda7e30258748b29412c2b3d4c6b
SHA512c2ee84a9aeac34f7b51426d12f87bb35d8c3238bb26a6e14f412ea485e5bd3b8fb5b1231323d4b089cf69d8180a38ddd7fd593cc52cbdf250125ad02d66eea9d
-
Filesize
19KB
MD5623283471b12f1bdb83e25dbafaf9c16
SHA1ecbba66f4dca89a3faa3e242e30aefac8de02153
SHA2569ca500775fee9ff69b960d65040b8dc415a2efde2982a9251ee6a3e8de625bc7
SHA51254b69ffa2c263be4ddadca62fa2867fea6148949d64c2634745db3dcbc1ba0ecf7167f02fa53efd69eaaee81d617d914f370f26ca16ee5850853f70c69e9a61f
-
Filesize
19KB
MD561f70f2d1e3f22e976053df5f3d8ecb7
SHA17d224b7f404cde960e6b7a1c449b41050c8e9c58
SHA2562695761b010d22fdfda2b5e73cf0ac7328ccc62b4b28101d5c10155dd9a48020
SHA5121ddc568590e9954db198f102be99eabb4133b49e9f3b464f2fc7f31cc77d06d5a7132152f4b331332c42f241562ee6c7bf1c2d68e546db3f59ab47eaf83a22cf
-
Filesize
19KB
MD5d6ad0f2652460f428c0e8fc40b6f6115
SHA11a5152871abc5cf3d4868a218de665105563775e
SHA2564ef09fa6510eeebb4855b6f197b20a7a27b56368c63cc8a3d1014fa4231ab93a
SHA512ceafeee932919bc002b111d6d67b7c249c85d30da35dfbcebd1f37db51e506ac161e4ee047ff8f7bf0d08da6a7f8b97e802224920bd058f8e790e6fa0ee48b22
-
Filesize
19KB
MD5eab486e4719b916cad05d64cd4e72e43
SHA1876c256fb2aeb0b25a63c9ee87d79b7a3c157ead
SHA25605fe96faa8429992520451f4317fbceba1b17716fa2caf44ddc92ede88ce509d
SHA512c50c3e656cc28a2f4f6377ba24d126bdc248a3125dca490994f8cace0a4903e23346ae937bb5b0a333f7d39ece42665ae44fde2fd5600873489f3982151a0f5d
-
Filesize
19KB
MD533a0fe1943c5a325f93679d6e9237fee
SHA1737d2537d602308fc022dbc0c29aa607bcdec702
SHA2565af7aa065ffdbf98d139246e198601bfde025d11a6c878201f4b99876d6c7eac
SHA512cab7fcaa305a9ace1f1cc7077b97526bebc0921adf23273e74cd42d7fe99401d4f7ede8ecb9847b6734a13760b9ebe4dbd2465a3db3139ed232dbef68fb62c54
-
Filesize
21KB
MD5633dca52da4ebaa6f4bf268822c6dc88
SHA11ebfc0f881ce338d2f66fcc3f9c1cbb94cdc067e
SHA256424fd5d3d3297a8ab1227007ef8ded5a4f194f24bd573a5211be71937aa55d22
SHA512ed058525ee7b4cc7e12561c7d674c26759a4301322ff0b3239f3183911ce14993614e3199d8017b9bfde25c8cb9ac0990d318bb19f3992624b39ec0f084a8df1
-
Filesize
20KB
MD543bf2037bfd3fb60e1fedac634c6f86e
SHA1959eebe41d905ad3afa4254a52628ec13613cf70
SHA256735703c0597da278af8a6359fc051b9e657627f50ad5b486185c2ef328ad571b
SHA5127042846c009efea45ca5fafdc08016eca471a8c54486ba03f212abba47467f8744e9546c8f33214620f97dbcc994e3002788ad0db65b86d8a3e4ff0d8a9d0d05
-
Filesize
19KB
MD5d51bc845c4efbfdbd68e8ccffdad7375
SHA1c82e580ec68c48e613c63a4c2f9974bb59182cf6
SHA25689d9f54e6c9ae1cb8f914da1a2993a20de588c18f1aaf4d66efb20c3a282c866
SHA5122e353cf58ad218c3e068a345d1da6743f488789ef7c6b96492d48571dc64df8a71ad2db2e5976cfd04cf4b55455e99c70c7f32bd2c0f4a8bed1d29c2dafc17b0
-
Filesize
28KB
MD5487f72d0cf7dc1d85fa18788a1b46813
SHA10aabff6d4ee9a2a56d40ee61e4591d4ba7d14c0d
SHA256560baf1b87b692c284ccbb82f2458a688757231b315b6875482e08c8f5333b3d
SHA512b7f4e32f98bfdcf799331253faebb1fb08ec24f638d8526f02a6d9371c8490b27d03db3412128ced6d2bbb11604247f3f22c8380b1bf2a11fb3bb92f18980185
-
Filesize
20KB
MD554a8fca040976f2aac779a344b275c80
SHA1ea1f01d6dcdf688eb0f21a8cb8a38f03bc777883
SHA2567e90e7acc69aca4591ce421c302c7f6cdf8e44f3b4390f66ec43dff456ffea29
SHA512cb20bed4972e56f74de1b7bc50dc1e27f2422dbb302aecb749018b9f88e3e4a67c9fc69bbbb8c4b21d49a530cc8266172e7d237650512aafb293cdfe06d02228
-
Filesize
23KB
MD521b509d048418922b92985696710afca
SHA1c499dd098aab8c7e05b8b0fd55f994472d527203
SHA256fe7336d2fb3b13a00b5b4ce055a84f0957daefdace94f21b88e692e54b678ac3
SHA512c517b02d4e94cf8360d98fd093bca25e8ae303c1b4500cf4cf01f78a7d7ef5f581b99a0371f438c6805a0b3040a0e06994ba7b541213819bd07ec8c6251cb9bb
-
Filesize
25KB
MD5120a5dc2682cd2a838e0fc0efd45506e
SHA18710be5d5e9c878669ff8b25b67fb2deb32cd77a
SHA256c14f0d929a761a4505628c4eb5754d81b88aa1fdad2154a2f2b0215b983b6d89
SHA5124330edf9b84c541e5ed3bb672548f35efa75c6b257c3215fc29ba6e152294820347517ec9bd6bde38411efa9074324a276cf0d7d905ed5dd88e906d78780760c
-
Filesize
25KB
MD5f22faca49e4d5d80ec26ed31e7ecd0e0
SHA1473bcbfb78e6a63afd720b5cbe5c55d9495a3d88
SHA2561eb30ea95dae91054a33a12b1c73601518d28e3746db552d7ce120da589d4cf4
SHA512c8090758435f02e3659d303211d78102c71754ba12b0a7e25083fd3529b3894dc3ab200b02a2899418cc6ed3b8f483d36e6c2bf86ce2a34e5fd9ad0483b73040
-
Filesize
821KB
MD5f4981249047e4b7709801a388e2965af
SHA142847b581e714a407a0b73e5dab019b104ec9af2
SHA256b191e669b1c715026d0732cbf8415f1ff5cfba5ed9d818444719d03e72d14233
SHA512e8ef3fb3c9d5ef8ae9065838b124ba4920a3a1ba2d4174269cad05c1f318bc9ff80b1c6a6c0f3493e998f0587ef59be0305bc92e009e67b82836755470bc1b13
-
Filesize
4.0MB
MD5d2a8a5e7380d5f4716016777818a32c5
SHA1fb12f31d1d0758fe3e056875461186056121ed0c
SHA25659ab345c565304f638effa7c0236f26041fd06e35041a75988e13995cd28ace9
SHA512ad1269d1367f587809e3fbe44af703c464a88fa3b2ae0bf2ad6544b8ed938e4265aab7e308d999e6c8297c0c85c608e3160796325286db3188a3edf040a02ab7
-
Filesize
1021KB
MD54e326feeb3ebf1e3eb21eeb224345727
SHA1f156a272dbc6695cc170b6091ef8cd41db7ba040
SHA2563c60056371f82e4744185b6f2fa0c69042b1e78804685944132974dd13f3b6d9
SHA512be9420a85c82eeee685e18913a7ff152fcead72a90ddcc2bcc8ab53a4a1743ae98f49354023c0a32b3a1d919bda64b5d455f6c3a49d4842bbba4aa37c1d05d67
-
Filesize
431KB
MD54962575a2378d5c72e7a836ea766e2ad
SHA1549964178b12017622d3cbdda6dbfdef0904e7e2
SHA256eff5fad47b9c739b09e760813b2bcbb0788eb35598f72e64ff95c794e72e6676
SHA512911a59f7a6785dd09a57dcd6d977b8abd5e160bd613786e871a1e92377c9e6f3b85fe3037431754bbdb1212e153776efca5fadac1de6b2ad474253da176e8e53
-
Filesize
124KB
MD5c2f3fbbbe6d5f48a71b6b168b1485866
SHA11cd56cfc2dc07880b65bd8a1f5b7147633f5d553
SHA256c7ed512058bc924045144daa16701da10f244ac12a5ea2de901e59dce6470839
SHA512e211f18c2850987529336e0d20aa894533c1f6a8ae6745e320fd394a9481d3a956c719ac29627afd783e36e5429c0325b98e60aee2a830e75323c276c72f845a
-
Filesize
1.2MB
MD5c6aabb27450f1a9939a417e86bf53217
SHA1b8ef3bb7575139fd6997379415d7119e452b5fc4
SHA256b91a3743c7399aee454491862e015ef6fc668a25d1aa2816e065a86a03f6be35
SHA512e5fe205cb0f419e0a320488d6fa4a70e5ed58f25b570b41412ebd4f32bbe504ff75acb20bfea22513102630cf653a41e5090051f20af2ed3aadb53ce16a05944
-
Filesize
301KB
MD5dd1e3f38ae7711d270748012af613950
SHA1b3b90eec3507f523aa63802cc16e5248c8ef0ea8
SHA2562997292293c332e73b11fa28126b6fbefea75a6bb02001eb017de46797d4e4ec
SHA5120eff0cba972b6622fb59683fe4d15d1b6c1ef106166189f60dcd7b4c76b6ceb82fd5c71433dc61394f03eff03575f2be27dec6ac8ab064491710263879b11bca
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Q8WLU0GLD5NMNU519LLJ.temp
Filesize7KB
MD5d0cb7a75cfef4afd943e72fcc0238ddd
SHA1cb56076c81d9e02798378a5945a20271410f8f29
SHA2569806ecdaef03980f554d62ddd652d97baa6c4291622744470343ee3cdbf5a562
SHA512af0b5526c965ba4447276292441a4d2b08a22621f3571c1a9de3793e6e32465fea82000ac91971b63e7f434799baf789d8407e402bc0cd8963a7ae3370d8b2dd
-
Filesize
5.6MB
MD5ae2a4249c8389603933df4f806546c96
SHA1a71ad1c875e0282b84451095e01d9c1709129643
SHA256cbe157a18df07d512f3e4939d048f6419163892bf0cc5d5694eaadc7809d2477
SHA5121c40ef124087b8ff3b66ddbcdbef1cd7ffcd112d137dbf0a5ff3b636642cae35b8d4f12eb38506da86ab81984edd6552dc395f072fed37d120daf064ba468cd2
-
Filesize
87KB
MD50e675d4a7a5b7ccd69013386793f68eb
SHA16e5821ddd8fea6681bda4448816f39984a33596b
SHA256bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1
SHA512cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66
-
Filesize
120KB
MD5f1e33a8f6f91c2ed93dc5049dd50d7b8
SHA123c583dc98aa3f6b8b108db5d90e65d3dd72e9b4
SHA2569459d246df7a3c638776305cf3683946ba8db26a7de90df8b60e1be0b27e53c4
SHA512229896da389d78cbdf2168753ed7fcc72d8e0e62c6607a3766d6d47842c0abd519ac4f5d46607b15e7ba785280f9d27b482954e931645337a152b8a54467c6a5
-
Filesize
20KB
MD522bfe210b767a667b0f3ed692a536e4e
SHA188e0ff9c141d8484b5e34eaaa5e4be0b414b8adf
SHA256f1a2499cc238e52d69c63a43d1e61847cf852173fe95c155056cfbd2cb76abc3
SHA512cbea3c690049a73b1a713a2183ff15d13b09982f8dd128546fd3db264af4252ccd390021dee54435f06827450da4bd388bd6ff11b084c0b43d50b181c928fd25
-
Filesize
23KB
MD5da5e087677c8ebbc0062eac758dfed49
SHA1ca69d48efa07090acb7ae7c1608f61e8d26d3985
SHA25608a43a53a66d8acb2e107e6fc71213cedd180363055a2dc5081fe5a837940dce
SHA5126262e9a0808d8f64e5f2dfad5242cd307e2f5eaa78f0a768f325e65c98db056c312d79f0b3e63c74e364af913a832c1d90f4604fe26cc5fb05f3a5a661b12573
-
Filesize
21KB
MD52fd0da47811b8ed4a0abdf9030419381
SHA146e3f21a9bd31013a804ba45dc90cc22331a60d1
SHA256de81c4d37833380a1c71a5401de3ab4fe1f8856fc40d46d0165719a81d7f3924
SHA5122e6f900628809bfd908590fe1ea38e0e36960235f9a6bbccb73bbb95c71bfd10f75e1df5e8cf93a682e4ada962b06c278afc9123ab5a4117f77d1686ff683d6f
-
Filesize
32KB
MD54424baf6ed5340df85482fa82b857b03
SHA1181b641bf21c810a486f855864cd4b8967c24c44
SHA2568c1f7f64579d01fedfde07e0906b1f8e607c34d5e6424c87abe431a2322eba79
SHA5128adb94893ada555de2e82f006ab4d571fad8a1b16ac19ca4d2efc1065677f25d2de5c981473fabd0398f6328c1be1ebd4d36668ea67f8a5d25060f1980ee7e33