Analysis
-
max time kernel
29s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
23-02-2023 23:24
Static task
static1
Behavioral task
behavioral1
Sample
Discord Logger V4.exe
Resource
win7-20230220-en
General
-
Target
Discord Logger V4.exe
-
Size
191KB
-
MD5
f1a5d668b65f4db0c423ed6e9239e217
-
SHA1
17d986b65eef4389f0c311730a06ff062499adf1
-
SHA256
1f9843ff169fa572bc715c398ccb74e6d04232ae9a2f23d964d839bea5a94cae
-
SHA512
ea3f14a32718e4002cde81c5a32384d6ccfc6206571425fd0ac47dcddb5dfc7a9d7a836dcba6360e06f7a2faa88ab4efe3b6d7dab24c66abd1579b9065eaac0c
-
SSDEEP
3072:7OvZrP9bo8BdUayvjKRTtTO2NMmBM155t3S9CuVkXGsG4Ii+qJAmx8:7OBrFbo8BdE1sMnvSEkkvG4kquh
Malware Config
Extracted
redline
cheat
83.150.217.106:26463
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/928-56-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/928-62-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/928-63-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/928-56-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/928-62-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/928-63-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Discord Logger V4.exedescription pid process target process PID 1236 set thread context of 928 1236 Discord Logger V4.exe AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 928 AppLaunch.exe 928 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 928 AppLaunch.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Discord Logger V4.exedescription pid process target process PID 1236 wrote to memory of 928 1236 Discord Logger V4.exe AppLaunch.exe PID 1236 wrote to memory of 928 1236 Discord Logger V4.exe AppLaunch.exe PID 1236 wrote to memory of 928 1236 Discord Logger V4.exe AppLaunch.exe PID 1236 wrote to memory of 928 1236 Discord Logger V4.exe AppLaunch.exe PID 1236 wrote to memory of 928 1236 Discord Logger V4.exe AppLaunch.exe PID 1236 wrote to memory of 928 1236 Discord Logger V4.exe AppLaunch.exe PID 1236 wrote to memory of 928 1236 Discord Logger V4.exe AppLaunch.exe PID 1236 wrote to memory of 928 1236 Discord Logger V4.exe AppLaunch.exe PID 1236 wrote to memory of 928 1236 Discord Logger V4.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Discord Logger V4.exe"C:\Users\Admin\AppData\Local\Temp\Discord Logger V4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp48CF.tmpFilesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
C:\Users\Admin\AppData\Local\Temp\tmp48F4.tmpFilesize
92KB
MD5c08f436bbec13c2834bd05a243688e46
SHA16db5b9acbb470d08557f74946f066317824d783a
SHA256031c03c49af6d02675e0cdb3400135d1fd476384300bc0daf1262b8a9303450c
SHA5121a9f7a09841bd93b3c159125c696b08eb6fb7c9d5de92aba1763c078c3d817786185659cc563a3e3e6b5e4cd722905251e037e669bd2e5cdd87a686ac3dfc519
-
memory/928-55-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/928-56-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/928-60-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/928-62-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/928-63-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/928-64-0x0000000000A10000-0x0000000000A50000-memory.dmpFilesize
256KB
-
memory/928-152-0x0000000000A10000-0x0000000000A50000-memory.dmpFilesize
256KB