Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
23-10-2021 16:37
Static task
static1
Behavioral task
behavioral1
Sample
Cheat.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
Cheat.exe
Resource
win10-en-20211014
General
-
Target
Cheat.exe
-
Size
1.5MB
-
MD5
f567e7f230994425ae32af49c31fa4b3
-
SHA1
1a446323d5092737c1151635ba65e25a18cdda58
-
SHA256
4a3be4ff2f613bd0389b3c65b0db723f190e83120a4a97abb2063e5c9d2b897a
-
SHA512
86a313994c94e9d8b28470713679336d35e8812c951f18c41e42a4e6fd1cc11bae4d131dd96dd4746e076c4bff33b5e2e7cf0669d76b168eaf6a6021cfd95ef7
Malware Config
Extracted
redline
cheat
194.61.0.151:56384
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/996-71-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/996-72-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/996-73-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/996-74-0x000000000041932E-mapping.dmp family_redline behavioral1/memory/996-76-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
82889309..exe82889309..exe82889309..exepid process 672 82889309..exe 1092 82889309..exe 996 82889309..exe -
Loads dropped DLL 3 IoCs
Processes:
Cheat.exe82889309..exepid process 588 Cheat.exe 672 82889309..exe 672 82889309..exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
Cheat.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts Cheat.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
Cheat.exe82889309..exedescription pid process target process PID 524 set thread context of 588 524 Cheat.exe Cheat.exe PID 672 set thread context of 996 672 82889309..exe 82889309..exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
Cheat.exe82889309..exe82889309..exepid process 588 Cheat.exe 588 Cheat.exe 588 Cheat.exe 588 Cheat.exe 672 82889309..exe 672 82889309..exe 996 82889309..exe 996 82889309..exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Cheat.exe82889309..exedescription pid process Token: SeDebugPrivilege 588 Cheat.exe Token: SeCreateTokenPrivilege 588 Cheat.exe Token: SeDebugPrivilege 996 82889309..exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
Cheat.exeCheat.exe82889309..exedescription pid process target process PID 524 wrote to memory of 588 524 Cheat.exe Cheat.exe PID 524 wrote to memory of 588 524 Cheat.exe Cheat.exe PID 524 wrote to memory of 588 524 Cheat.exe Cheat.exe PID 524 wrote to memory of 588 524 Cheat.exe Cheat.exe PID 524 wrote to memory of 588 524 Cheat.exe Cheat.exe PID 524 wrote to memory of 588 524 Cheat.exe Cheat.exe PID 588 wrote to memory of 672 588 Cheat.exe 82889309..exe PID 588 wrote to memory of 672 588 Cheat.exe 82889309..exe PID 588 wrote to memory of 672 588 Cheat.exe 82889309..exe PID 588 wrote to memory of 672 588 Cheat.exe 82889309..exe PID 672 wrote to memory of 1092 672 82889309..exe 82889309..exe PID 672 wrote to memory of 1092 672 82889309..exe 82889309..exe PID 672 wrote to memory of 1092 672 82889309..exe 82889309..exe PID 672 wrote to memory of 1092 672 82889309..exe 82889309..exe PID 672 wrote to memory of 996 672 82889309..exe 82889309..exe PID 672 wrote to memory of 996 672 82889309..exe 82889309..exe PID 672 wrote to memory of 996 672 82889309..exe 82889309..exe PID 672 wrote to memory of 996 672 82889309..exe 82889309..exe PID 672 wrote to memory of 996 672 82889309..exe 82889309..exe PID 672 wrote to memory of 996 672 82889309..exe 82889309..exe PID 672 wrote to memory of 996 672 82889309..exe 82889309..exe PID 672 wrote to memory of 996 672 82889309..exe 82889309..exe PID 672 wrote to memory of 996 672 82889309..exe 82889309..exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cheat.exe"C:\Users\Admin\AppData\Local\Temp\Cheat.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Cheat.exe"C:\Users\Admin\AppData\Local\Temp\Cheat.exe"2⤵
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\82889309..exe"C:\Users\Admin\AppData\Local\Temp\82889309..exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\82889309..exe"C:\Users\Admin\AppData\Local\Temp\82889309..exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\82889309..exe"C:\Users\Admin\AppData\Local\Temp\82889309..exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\82889309..exeMD5
7bdaabc4abf3566af83d62ecda4955f8
SHA1fec34028c8ba8900d4932d9709253ed4991f2086
SHA25603c45bc25768284960e7404502a6fd6247180d739fff5dee42ee16654800545c
SHA512ea81ab03927397eb66c655c8b848b0a9ee47973dddc0f3fc24e263bb25717d2edefbe12973fbe50e4e63af41ea4fe589402fb788f3b968e0ace97e3af3aa76a4
-
C:\Users\Admin\AppData\Local\Temp\82889309..exeMD5
7bdaabc4abf3566af83d62ecda4955f8
SHA1fec34028c8ba8900d4932d9709253ed4991f2086
SHA25603c45bc25768284960e7404502a6fd6247180d739fff5dee42ee16654800545c
SHA512ea81ab03927397eb66c655c8b848b0a9ee47973dddc0f3fc24e263bb25717d2edefbe12973fbe50e4e63af41ea4fe589402fb788f3b968e0ace97e3af3aa76a4
-
C:\Users\Admin\AppData\Local\Temp\82889309..exeMD5
7bdaabc4abf3566af83d62ecda4955f8
SHA1fec34028c8ba8900d4932d9709253ed4991f2086
SHA25603c45bc25768284960e7404502a6fd6247180d739fff5dee42ee16654800545c
SHA512ea81ab03927397eb66c655c8b848b0a9ee47973dddc0f3fc24e263bb25717d2edefbe12973fbe50e4e63af41ea4fe589402fb788f3b968e0ace97e3af3aa76a4
-
C:\Users\Admin\AppData\Local\Temp\82889309..exeMD5
7bdaabc4abf3566af83d62ecda4955f8
SHA1fec34028c8ba8900d4932d9709253ed4991f2086
SHA25603c45bc25768284960e7404502a6fd6247180d739fff5dee42ee16654800545c
SHA512ea81ab03927397eb66c655c8b848b0a9ee47973dddc0f3fc24e263bb25717d2edefbe12973fbe50e4e63af41ea4fe589402fb788f3b968e0ace97e3af3aa76a4
-
\Users\Admin\AppData\Local\Temp\82889309..exeMD5
7bdaabc4abf3566af83d62ecda4955f8
SHA1fec34028c8ba8900d4932d9709253ed4991f2086
SHA25603c45bc25768284960e7404502a6fd6247180d739fff5dee42ee16654800545c
SHA512ea81ab03927397eb66c655c8b848b0a9ee47973dddc0f3fc24e263bb25717d2edefbe12973fbe50e4e63af41ea4fe589402fb788f3b968e0ace97e3af3aa76a4
-
\Users\Admin\AppData\Local\Temp\82889309..exeMD5
7bdaabc4abf3566af83d62ecda4955f8
SHA1fec34028c8ba8900d4932d9709253ed4991f2086
SHA25603c45bc25768284960e7404502a6fd6247180d739fff5dee42ee16654800545c
SHA512ea81ab03927397eb66c655c8b848b0a9ee47973dddc0f3fc24e263bb25717d2edefbe12973fbe50e4e63af41ea4fe589402fb788f3b968e0ace97e3af3aa76a4
-
\Users\Admin\AppData\Local\Temp\82889309..exeMD5
7bdaabc4abf3566af83d62ecda4955f8
SHA1fec34028c8ba8900d4932d9709253ed4991f2086
SHA25603c45bc25768284960e7404502a6fd6247180d739fff5dee42ee16654800545c
SHA512ea81ab03927397eb66c655c8b848b0a9ee47973dddc0f3fc24e263bb25717d2edefbe12973fbe50e4e63af41ea4fe589402fb788f3b968e0ace97e3af3aa76a4
-
memory/588-54-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/588-56-0x0000000000425EC5-mapping.dmp
-
memory/588-57-0x0000000075951000-0x0000000075953000-memory.dmpFilesize
8KB
-
memory/588-58-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/588-55-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/672-65-0x0000000000230000-0x0000000000233000-memory.dmpFilesize
12KB
-
memory/672-63-0x0000000001120000-0x0000000001121000-memory.dmpFilesize
4KB
-
memory/672-60-0x0000000000000000-mapping.dmp
-
memory/996-69-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/996-70-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/996-71-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/996-72-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/996-73-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/996-74-0x000000000041932E-mapping.dmp
-
memory/996-76-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/996-78-0x00000000049C0000-0x00000000049C1000-memory.dmpFilesize
4KB