Analysis
-
max time kernel
43s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27-01-2023 03:49
Static task
static1
Behavioral task
behavioral1
Sample
deflated-rufus_Installer.exe
Resource
win7-20220812-en
General
-
Target
deflated-rufus_Installer.exe
-
Size
2.6MB
-
MD5
9814a046255e18128a7605b718efca93
-
SHA1
5d83e5f3931720fce6ccb43186391f3114124679
-
SHA256
047528fe2e0b207d93b51f21109eea05ece9bec290c8ddf22a09301bf262735a
-
SHA512
bf2f9346bc2296542ae6818df770ad922034e40eb35928c513189edb81df52a7f6b8f53b0b645785902c8ed30f2f578a5361d8bb6ebb8883d5d5f794d3bb20f0
-
SSDEEP
49152:3mJQWFAlO5SRY8mYzbNKrFtbrR4S2EypQ2QbQQ69cE:2HAOTYvYbDypQ2QbOF
Malware Config
Extracted
redline
new
194.87.71.146:49144
-
auth_value
4c1607b6fe3d7ff96ea7cf54c0ad912c
Signatures
-
Detect PureCrypter injector 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2036-56-0x0000000004D10000-0x0000000004F8A000-memory.dmp family_purecrypter -
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
deflated-rufus_Installer.exedescription pid process target process PID 2036 set thread context of 1332 2036 deflated-rufus_Installer.exe deflated-rufus_Installer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exedeflated-rufus_Installer.exepid process 2016 powershell.exe 1332 deflated-rufus_Installer.exe 1332 deflated-rufus_Installer.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
deflated-rufus_Installer.exepowershell.exedeflated-rufus_Installer.exedescription pid process Token: SeDebugPrivilege 2036 deflated-rufus_Installer.exe Token: SeDebugPrivilege 2016 powershell.exe Token: SeDebugPrivilege 1332 deflated-rufus_Installer.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
deflated-rufus_Installer.exedescription pid process target process PID 2036 wrote to memory of 2016 2036 deflated-rufus_Installer.exe powershell.exe PID 2036 wrote to memory of 2016 2036 deflated-rufus_Installer.exe powershell.exe PID 2036 wrote to memory of 2016 2036 deflated-rufus_Installer.exe powershell.exe PID 2036 wrote to memory of 2016 2036 deflated-rufus_Installer.exe powershell.exe PID 2036 wrote to memory of 1332 2036 deflated-rufus_Installer.exe deflated-rufus_Installer.exe PID 2036 wrote to memory of 1332 2036 deflated-rufus_Installer.exe deflated-rufus_Installer.exe PID 2036 wrote to memory of 1332 2036 deflated-rufus_Installer.exe deflated-rufus_Installer.exe PID 2036 wrote to memory of 1332 2036 deflated-rufus_Installer.exe deflated-rufus_Installer.exe PID 2036 wrote to memory of 1332 2036 deflated-rufus_Installer.exe deflated-rufus_Installer.exe PID 2036 wrote to memory of 1332 2036 deflated-rufus_Installer.exe deflated-rufus_Installer.exe PID 2036 wrote to memory of 1332 2036 deflated-rufus_Installer.exe deflated-rufus_Installer.exe PID 2036 wrote to memory of 1332 2036 deflated-rufus_Installer.exe deflated-rufus_Installer.exe PID 2036 wrote to memory of 1332 2036 deflated-rufus_Installer.exe deflated-rufus_Installer.exe PID 2036 wrote to memory of 1332 2036 deflated-rufus_Installer.exe deflated-rufus_Installer.exe PID 2036 wrote to memory of 1332 2036 deflated-rufus_Installer.exe deflated-rufus_Installer.exe PID 2036 wrote to memory of 1332 2036 deflated-rufus_Installer.exe deflated-rufus_Installer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\deflated-rufus_Installer.exe"C:\Users\Admin\AppData\Local\Temp\deflated-rufus_Installer.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\deflated-rufus_Installer.exeC:\Users\Admin\AppData\Local\Temp\deflated-rufus_Installer.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1332-69-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/1332-66-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/1332-74-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/1332-72-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/1332-63-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/1332-70-0x000000000041B592-mapping.dmp
-
memory/1332-68-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/1332-64-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2016-59-0x000000006F700000-0x000000006FCAB000-memory.dmpFilesize
5.7MB
-
memory/2016-61-0x000000006F700000-0x000000006FCAB000-memory.dmpFilesize
5.7MB
-
memory/2016-60-0x000000006F700000-0x000000006FCAB000-memory.dmpFilesize
5.7MB
-
memory/2016-57-0x0000000000000000-mapping.dmp
-
memory/2036-62-0x0000000005170000-0x00000000051BC000-memory.dmpFilesize
304KB
-
memory/2036-55-0x00000000762D1000-0x00000000762D3000-memory.dmpFilesize
8KB
-
memory/2036-54-0x0000000000EA0000-0x0000000001138000-memory.dmpFilesize
2.6MB
-
memory/2036-56-0x0000000004D10000-0x0000000004F8A000-memory.dmpFilesize
2.5MB