Overview

overview

10

Static

static

URLScan

urlscan

1

http://141.98.6.236/...

windows7-x64

8

http://141.98.6.236/...

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220721-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-08-2022 00:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    http://141.98.6.236/1337New/ZvfejoxpnTORRENTOLD-1.exe

Score
10/10
redlinetorrentolddiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

TORRENTOLD

C2

amrican-sport-live-stream.cc:4581

Attributes
  • auth_value

    74e1b58bf920611f04c0e3919954fe05

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
    adwarespyware
  • Modifies registry class 56 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://141.98.6.236/1337New/ZvfejoxpnTORRENTOLD-1.exe
    1⤵
    • Modifies Internet Explorer Phishing Filter
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1940
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1940 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:4304
  • C:\Users\Admin\Desktop\ZvfejoxpnTORRENTOLD-1.exe
    "C:\Users\Admin\Desktop\ZvfejoxpnTORRENTOLD-1.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      2⤵
        PID:3844
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3620

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Modify Registry

    2
    T1112

    Credential Access

    Credentials in Files

    2
    T1081

    Discovery

    Query Registry

    1
    T1012

    Lateral Movement

    Collection

    Data from Local System

    2
    T1005

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\Desktop\ZvfejoxpnTORRENTOLD-1.exe
      Filesize

      784KB

      MD5

      43089a1a50b1981a4dba7959e31e62f1

      SHA1

      c8db527eba66719e365672a17bd1eddc2085de9a

      SHA256

      4fb57da6d703e8bebfdd51b7f579fb36127eee300880eeb5ca2be3f00cce154e

      SHA512

      2777758eff7684d51ca8bc060f0652c14ef6999375061262acb5a741a2c927cfefe46bbbe733530777bd1d08893cce8e7f0631e157ff2069f6c75c5f3624b0fa

      Download Submit
    • C:\Users\Admin\Desktop\ZvfejoxpnTORRENTOLD-1.exe.ymgs5od.partial
      Filesize

      784KB

      MD5

      43089a1a50b1981a4dba7959e31e62f1

      SHA1

      c8db527eba66719e365672a17bd1eddc2085de9a

      SHA256

      4fb57da6d703e8bebfdd51b7f579fb36127eee300880eeb5ca2be3f00cce154e

      SHA512

      2777758eff7684d51ca8bc060f0652c14ef6999375061262acb5a741a2c927cfefe46bbbe733530777bd1d08893cce8e7f0631e157ff2069f6c75c5f3624b0fa

      Download Submit
    • memory/1712-132-0x0000000000B60000-0x0000000000C2A000-memory.dmp
      Filesize

      808KB

      Download
    • memory/1712-133-0x00000000057B0000-0x00000000057D2000-memory.dmp
      Filesize

      136KB

      Download
    • memory/1712-134-0x000000002D800000-0x000000002D866000-memory.dmp
      Filesize

      408KB

      Download
    • memory/1712-135-0x000000002DCB0000-0x000000002DD42000-memory.dmp
      Filesize

      584KB

      Download
    • memory/1712-136-0x000000002E300000-0x000000002E8A4000-memory.dmp
      Filesize

      5.6MB

      Download
    • memory/3620-138-0x0000000000000000-mapping.dmp
      Download
    • memory/3620-139-0x0000000000400000-0x0000000000444000-memory.dmp
      Filesize

      272KB

      Download
    • memory/3620-140-0x000000000AE40000-0x000000000B458000-memory.dmp
      Filesize

      6.1MB

      Download
    • memory/3620-141-0x000000000A8C0000-0x000000000A8D2000-memory.dmp
      Filesize

      72KB

      Download
    • memory/3620-142-0x000000000A9F0000-0x000000000AAFA000-memory.dmp
      Filesize

      1.0MB

      Download
    • memory/3620-143-0x000000000A920000-0x000000000A95C000-memory.dmp
      Filesize

      240KB

      Download
    • memory/3620-144-0x000000000B510000-0x000000000B586000-memory.dmp
      Filesize

      472KB

      Download
    • memory/3620-145-0x000000000B710000-0x000000000B72E000-memory.dmp
      Filesize

      120KB

      Download
    • memory/3620-146-0x000000000C500000-0x000000000C6C2000-memory.dmp
      Filesize

      1.8MB

      Download
    • memory/3620-147-0x000000000CC00000-0x000000000D12C000-memory.dmp
      Filesize

      5.2MB

      Download
    • memory/3620-148-0x00000000064E0000-0x0000000006530000-memory.dmp
      Filesize

      320KB

      Download
    • memory/3844-137-0x0000000000000000-mapping.dmp
      Download