Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/01/2023, 21:43

General

  • Target

    file.exe

  • Size

    898KB

  • MD5

    efbdd6926c4cb453abc717966d17247b

  • SHA1

    4d5527e2b261b908905c857776cf625b12b3959c

  • SHA256

    d56f262888e77a5de910970fdc1fa46fef7fc527da135926e994affa293ebde6

  • SHA512

    d64ebc2141a1924c50589d349914471192a0be23ed436e98ea5a9c6c5c813e6b41b18979ebc6b0ca360042396fc31d656677d283b7b0a6a7bd6ff9e5f536f68b

  • SSDEEP

    6144:2ahOEYGnXi1o+ragfy6QRTsU3S7OZb9a:2icGXko+ragfAoUC7OZ8

Malware Config

Extracted

Family

purecrypter

C2

https://buffetdetalhes.com/wp-admin/images/css/marina/bo/Vqhpwhiml.dll

Extracted

Family

redline

Botnet

1

C2

45.142.214.214:20301

Attributes
  • auth_value

    9c39d577e04da4bd3bab7c12203f5f07

Signatures

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1676
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1904
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2496
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
        3⤵
        • Executes dropped EXE
        PID:3572
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
        3⤵
        • Executes dropped EXE
        PID:4380

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ifmedianov.exe.log

          Filesize

          1KB

          MD5

          2e49a0dc2cc777cf418322c4466c896e

          SHA1

          d1c48311da63a8124b58ca948b0d64409e927d2d

          SHA256

          b6e3216891c905bc01dfa776fb8f50aadd5b51b997551eb32ad5e21a53574041

          SHA512

          b03923994a5b5b0c8ea0905a19a820eda810ded3687e965ee280641eb6b9dd8bf36ce3984bb04712199fcaffc28cacbbadcc872e12b2bda7f491091aa656156a

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe

          Filesize

          362.5MB

          MD5

          b0c7de14111c40f664432150255e9f86

          SHA1

          c54bdb6dc8821d820aad092dfd591fd9ec8ecf49

          SHA256

          09a3c1c2d0563b828eee982d12fd5d63bc1307baf0fb0f86bf7806708b656115

          SHA512

          fc32992df5ae257fcf56572bba9170e85b8aa2783990435228515edde5d1a695109f70df6e8de4807f4b7a48c8cb48b4a6884e5523fe70d93ddda9c09c1dabaf

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe

          Filesize

          362.5MB

          MD5

          b0c7de14111c40f664432150255e9f86

          SHA1

          c54bdb6dc8821d820aad092dfd591fd9ec8ecf49

          SHA256

          09a3c1c2d0563b828eee982d12fd5d63bc1307baf0fb0f86bf7806708b656115

          SHA512

          fc32992df5ae257fcf56572bba9170e85b8aa2783990435228515edde5d1a695109f70df6e8de4807f4b7a48c8cb48b4a6884e5523fe70d93ddda9c09c1dabaf

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe

          Filesize

          235.4MB

          MD5

          f0d621207b3805f4101ee9eae0f02a1c

          SHA1

          f9eb653326a93e608e42800cc874a897f5a95ffa

          SHA256

          613f6ccc32fa32590acf90815597439cded663f951a87891d54d4078b7e37f18

          SHA512

          b2910373c9fb6c36064bd4461eeb1ab557223c1dd572d8c712a4576074422c9e871e98941cfe100d40eae57e38c3e43a37ffd4a6a11021eabe9485d8ee3c57a1

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe

          Filesize

          232.7MB

          MD5

          04a4105ad93a2ea565e46da45793ac6a

          SHA1

          913926a0c985c7777bbd0e751e9fe3ed2208a0b4

          SHA256

          49e99ba25608615607d01de6651bc72d5daaf875150aa053b006e83383f4993e

          SHA512

          3cc837718882849f8f0a568f37917cde7a78b3d443cc47c7c52bcbacd012fd3b919cfca7b89eb3f425ae4936c852870f01618ba1baa1edd9717df83fb9683282

        • memory/1904-138-0x00000000057B0000-0x00000000057BA000-memory.dmp

          Filesize

          40KB

        • memory/1904-137-0x00000000055F0000-0x0000000005682000-memory.dmp

          Filesize

          584KB

        • memory/1904-139-0x0000000006C80000-0x0000000006CD0000-memory.dmp

          Filesize

          320KB

        • memory/1904-140-0x0000000006EF0000-0x0000000006FA2000-memory.dmp

          Filesize

          712KB

        • memory/1904-141-0x00000000072E0000-0x0000000007302000-memory.dmp

          Filesize

          136KB

        • memory/1904-136-0x0000000005C60000-0x0000000006204000-memory.dmp

          Filesize

          5.6MB

        • memory/1904-135-0x0000000000C30000-0x0000000000C54000-memory.dmp

          Filesize

          144KB

        • memory/2496-144-0x0000000005350000-0x0000000005978000-memory.dmp

          Filesize

          6.2MB

        • memory/2496-146-0x0000000005A60000-0x0000000005AC6000-memory.dmp

          Filesize

          408KB

        • memory/2496-147-0x00000000060C0000-0x00000000060DE000-memory.dmp

          Filesize

          120KB

        • memory/2496-148-0x0000000007700000-0x0000000007D7A000-memory.dmp

          Filesize

          6.5MB

        • memory/2496-149-0x00000000065C0000-0x00000000065DA000-memory.dmp

          Filesize

          104KB

        • memory/2496-145-0x00000000059F0000-0x0000000005A56000-memory.dmp

          Filesize

          408KB

        • memory/2496-143-0x0000000002AF0000-0x0000000002B26000-memory.dmp

          Filesize

          216KB

        • memory/4380-153-0x0000000000400000-0x0000000000432000-memory.dmp

          Filesize

          200KB