Overview

overview

10

Static

static

1

URLScan

urlscan

1

https://www.mediafir...

windows10-2004-x64

10

Analysis

  • max time kernel
    17s
  • max time network
    85s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/03/2023, 03:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://www.mediafire.com/file/fu7vj52h3yb7o8p/AtmosphereCheats.zip/file
  • Sample230328-d8ffqsaf5x
Score
10/10
redlineinfostealer

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 43 IoCs
    adwarespyware
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.mediafire.com/file/fu7vj52h3yb7o8p/AtmosphereCheats.zip/file
    1⤵
    • Modifies Internet Explorer Phishing Filter
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:368
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:368 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2584
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4976
    • C:\Program Files\7-Zip\7zG.exe
      "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\AtmosphereCheats\" -spe -an -ai#7zMap25726:94:7zEvent26471
      1⤵
        PID:3532
      • C:\Users\Admin\Downloads\AtmosphereCheats\AtmosphereLauncher.exe
        "C:\Users\Admin\Downloads\AtmosphereCheats\AtmosphereLauncher.exe"
        1⤵
          PID:508
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
            "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe"
            2⤵
              PID:4584

          Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                www.mediafire[1].xml
                • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\Q69XFBXR\www.mediafire[1].xml
                • Size 1KB
                • SHA256 c9bf3606ea2c63d019dfa5cb7af37d7e77c14107a07122eb1dadd71f4d543c00
                • MD5 SHA1 SHA512
                Submit Download

                www.mediafire[1].xml
                • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\Q69XFBXR\www.mediafire[1].xml
                • Size 244B
                • SHA256 80f8da0885f17f54d83eff419589f390bfa091647c931966c53a4fcddb98db26
                • MD5 SHA1 SHA512
                Submit Download

                imagestore.dat
                • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\phzg4yt\imagestore.dat
                • Size 11KB
                • SHA256 ad77a2761fd2a08bc5de32eec4779c086c32ec5dcba15851cb5b5546bedc2875
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                favicon[1].ico
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U4IULL1L\favicon[1].ico
                • Size 10KB
                • SHA256 cdc78cc8b2994712a041a2a4cb02f488afbab00981771bdd3a8036c2dddf540f
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                ~DF4B630F042AB4EC57.TMP
                • Path C:\Users\Admin\AppData\Local\Temp\~DF4B630F042AB4EC57.TMP
                • Size 16KB
                • SHA256 d9698e425edf2357132305a35190f33b05b545ae77b3746cc136f16148cb4849
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                AtmosphereCheats.zip.23iksuy.partial
                • Path C:\Users\Admin\Downloads\AtmosphereCheats.zip.23iksuy.partial
                • Size 14.3MB
                • SHA256 462ba6a1b67a37b36f9c5767c5a49a6bd60163aaf513545db32c8da769896ac4
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                AtmosphereLauncher.exe
                • Path C:\Users\Admin\Downloads\AtmosphereCheats\AtmosphereLauncher.exe
                • Size 182.9MB
                • SHA256 839ea7813231f897f16019c2c472f0b8a996f5fa83cbb7c1fb6f3dc71c1d1228
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                AtmosphereLauncher.exe
                • Path C:\Users\Admin\Downloads\AtmosphereCheats\AtmosphereLauncher.exe
                • Size 183.6MB
                • SHA256 bffe98993614d6c33d0b0ec77f2cfd2ae016335e5bded1f35488016660ff7202
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                memory/508-320-0x0000000000E30000-0x000000000166C000-memory.dmp
                Download

                memory/508-322-0x0000000003660000-0x0000000003661000-memory.dmp
                Download

                memory/508-321-0x00000000038A0000-0x00000000038B0000-memory.dmp
                Download