Resubmissions
04-01-2023 00:10
230104-af5ndadc88 10Analysis
-
max time kernel
125s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04-01-2023 00:10
Behavioral task
behavioral1
Sample
Micetopia/rungame.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
Micetopia/rungame.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
Micetopia/rungame.exe
-
Size
752.5MB
-
MD5
5a0474481175e6c7b09bc00b6850bd0d
-
SHA1
6f8b6c6d94ff99ee259656d17d02107721677a56
-
SHA256
d9c3952bdeb57e5a7378bb0c97cbf99584e27259c85119e4f2d838746cae2d19
-
SHA512
9cd140be34ea4ee0eca2ee998e664f53d5e2eab890bd8a7bcea7e9a5134bd666475ad595c7d52eb2e2f72623c5901bc6ec6b26e22955dad7dda52518dceef8bf
-
SSDEEP
6144:IT6GN8vB8kFDIozpRaV9iktC0KRDyAeP9EBOLrRCOSs9Tdl5ofgfwLoshP+Q3KEv:I4Pa0OH9rWyBw+Tk1qU17Nfn80r+Ga6
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
1086881322_99
C2
themocca.xyz:3306
themocca.xyz:28786
Attributes
-
auth_value
c7b4b3ad5c912786e8dea8b34a307b0d
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4152 set thread context of 4112 4152 rungame.exe 80 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 55 IoCs
pid Process 4112 AppLaunch.exe 4112 AppLaunch.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4112 AppLaunch.exe Token: SeDebugPrivilege 4100 taskmgr.exe Token: SeSystemProfilePrivilege 4100 taskmgr.exe Token: SeCreateGlobalPrivilege 4100 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4152 wrote to memory of 4112 4152 rungame.exe 80 PID 4152 wrote to memory of 4112 4152 rungame.exe 80 PID 4152 wrote to memory of 4112 4152 rungame.exe 80 PID 4152 wrote to memory of 4112 4152 rungame.exe 80 PID 4152 wrote to memory of 4112 4152 rungame.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\Micetopia\rungame.exe"C:\Users\Admin\AppData\Local\Temp\Micetopia\rungame.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4112
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4100
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1004