Analysis
-
max time kernel
130s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 05:26
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20230220-en
General
-
Target
tmp.exe
-
Size
1.3MB
-
MD5
7b36da4da4db96852a59a1a428554a55
-
SHA1
9b5d0528b3f85f54f5aae5305a9f602e0a4ae834
-
SHA256
dce05561ae5582a0a5e716dcd273ed4b9359eb5a2fb556d103c63dc75f03622e
-
SHA512
828634d3b27f246ed0988a397cead98c0bd6e9023525e0069cb8e57581d53e7066bc92998c6f8d76c4713b79de8f35ffb28323b5dfec0e0f6fa304217738d5cf
-
SSDEEP
24576:R+DS4BrH+eG0G+dqeUh80qIMt6RvXWpBtnZ6Nk3:R+DS4BqeI+drIzRPmBtZyk
Malware Config
Extracted
redline
HEXO-SOFTWARE
amrican-sport-live-stream.cc:4581
-
auth_value
fea440ffae02b6f56d7b00fe8105ccb8
Signatures
-
Detect PureCrypter injector 33 IoCs
Processes:
resource yara_rule behavioral2/memory/4208-134-0x0000000004AD0000-0x0000000004D46000-memory.dmp family_purecrypter behavioral2/memory/4208-135-0x0000000004AD0000-0x0000000004D46000-memory.dmp family_purecrypter behavioral2/memory/4208-137-0x0000000004AD0000-0x0000000004D46000-memory.dmp family_purecrypter behavioral2/memory/4208-139-0x0000000004AD0000-0x0000000004D46000-memory.dmp family_purecrypter behavioral2/memory/4208-141-0x0000000004AD0000-0x0000000004D46000-memory.dmp family_purecrypter behavioral2/memory/4208-143-0x0000000004AD0000-0x0000000004D46000-memory.dmp family_purecrypter behavioral2/memory/4208-145-0x0000000004AD0000-0x0000000004D46000-memory.dmp family_purecrypter behavioral2/memory/4208-148-0x0000000004AD0000-0x0000000004D46000-memory.dmp family_purecrypter behavioral2/memory/4208-150-0x0000000004AD0000-0x0000000004D46000-memory.dmp family_purecrypter behavioral2/memory/4208-152-0x0000000004AD0000-0x0000000004D46000-memory.dmp family_purecrypter behavioral2/memory/4208-154-0x0000000004AD0000-0x0000000004D46000-memory.dmp family_purecrypter behavioral2/memory/4208-156-0x0000000004AD0000-0x0000000004D46000-memory.dmp family_purecrypter behavioral2/memory/4208-158-0x0000000004AD0000-0x0000000004D46000-memory.dmp family_purecrypter behavioral2/memory/4208-160-0x0000000004AD0000-0x0000000004D46000-memory.dmp family_purecrypter behavioral2/memory/4208-162-0x0000000004AD0000-0x0000000004D46000-memory.dmp family_purecrypter behavioral2/memory/4208-164-0x0000000004AD0000-0x0000000004D46000-memory.dmp family_purecrypter behavioral2/memory/4208-166-0x0000000004AD0000-0x0000000004D46000-memory.dmp family_purecrypter behavioral2/memory/4208-168-0x0000000004AD0000-0x0000000004D46000-memory.dmp family_purecrypter behavioral2/memory/4208-170-0x0000000004AD0000-0x0000000004D46000-memory.dmp family_purecrypter behavioral2/memory/4208-172-0x0000000004AD0000-0x0000000004D46000-memory.dmp family_purecrypter behavioral2/memory/4208-174-0x0000000004AD0000-0x0000000004D46000-memory.dmp family_purecrypter behavioral2/memory/4208-176-0x0000000004AD0000-0x0000000004D46000-memory.dmp family_purecrypter behavioral2/memory/4208-178-0x0000000004AD0000-0x0000000004D46000-memory.dmp family_purecrypter behavioral2/memory/4208-180-0x0000000004AD0000-0x0000000004D46000-memory.dmp family_purecrypter behavioral2/memory/4208-182-0x0000000004AD0000-0x0000000004D46000-memory.dmp family_purecrypter behavioral2/memory/4208-184-0x0000000004AD0000-0x0000000004D46000-memory.dmp family_purecrypter behavioral2/memory/4208-186-0x0000000004AD0000-0x0000000004D46000-memory.dmp family_purecrypter behavioral2/memory/4208-188-0x0000000004AD0000-0x0000000004D46000-memory.dmp family_purecrypter behavioral2/memory/4208-190-0x0000000004AD0000-0x0000000004D46000-memory.dmp family_purecrypter behavioral2/memory/4208-192-0x0000000004AD0000-0x0000000004D46000-memory.dmp family_purecrypter behavioral2/memory/4208-194-0x0000000004AD0000-0x0000000004D46000-memory.dmp family_purecrypter behavioral2/memory/4208-196-0x0000000004AD0000-0x0000000004D46000-memory.dmp family_purecrypter behavioral2/memory/4208-198-0x0000000004AD0000-0x0000000004D46000-memory.dmp family_purecrypter -
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
tmp.exedescription pid process target process PID 4208 set thread context of 4164 4208 tmp.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
InstallUtil.exepid process 4164 InstallUtil.exe 4164 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
tmp.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 4208 tmp.exe Token: SeDebugPrivilege 4164 InstallUtil.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
tmp.exedescription pid process target process PID 4208 wrote to memory of 4164 4208 tmp.exe InstallUtil.exe PID 4208 wrote to memory of 4164 4208 tmp.exe InstallUtil.exe PID 4208 wrote to memory of 4164 4208 tmp.exe InstallUtil.exe PID 4208 wrote to memory of 4164 4208 tmp.exe InstallUtil.exe PID 4208 wrote to memory of 4164 4208 tmp.exe InstallUtil.exe PID 4208 wrote to memory of 4164 4208 tmp.exe InstallUtil.exe PID 4208 wrote to memory of 4164 4208 tmp.exe InstallUtil.exe PID 4208 wrote to memory of 4164 4208 tmp.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4164-10264-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/4164-10265-0x0000000004FB0000-0x0000000004FC0000-memory.dmpFilesize
64KB
-
memory/4164-10266-0x000000000ACE0000-0x000000000B2F8000-memory.dmpFilesize
6.1MB
-
memory/4164-10267-0x000000000A820000-0x000000000A92A000-memory.dmpFilesize
1.0MB
-
memory/4164-10268-0x000000000A750000-0x000000000A762000-memory.dmpFilesize
72KB
-
memory/4164-10274-0x0000000004FB0000-0x0000000004FC0000-memory.dmpFilesize
64KB
-
memory/4164-10273-0x000000000C420000-0x000000000C470000-memory.dmpFilesize
320KB
-
memory/4164-10272-0x000000000C3A0000-0x000000000C416000-memory.dmpFilesize
472KB
-
memory/4164-10271-0x000000000C730000-0x000000000CC5C000-memory.dmpFilesize
5.2MB
-
memory/4164-10270-0x000000000C030000-0x000000000C1F2000-memory.dmpFilesize
1.8MB
-
memory/4164-10269-0x000000000A7B0000-0x000000000A7EC000-memory.dmpFilesize
240KB
-
memory/4208-168-0x0000000004AD0000-0x0000000004D46000-memory.dmpFilesize
2.5MB
-
memory/4208-180-0x0000000004AD0000-0x0000000004D46000-memory.dmpFilesize
2.5MB
-
memory/4208-145-0x0000000004AD0000-0x0000000004D46000-memory.dmpFilesize
2.5MB
-
memory/4208-148-0x0000000004AD0000-0x0000000004D46000-memory.dmpFilesize
2.5MB
-
memory/4208-150-0x0000000004AD0000-0x0000000004D46000-memory.dmpFilesize
2.5MB
-
memory/4208-152-0x0000000004AD0000-0x0000000004D46000-memory.dmpFilesize
2.5MB
-
memory/4208-154-0x0000000004AD0000-0x0000000004D46000-memory.dmpFilesize
2.5MB
-
memory/4208-156-0x0000000004AD0000-0x0000000004D46000-memory.dmpFilesize
2.5MB
-
memory/4208-158-0x0000000004AD0000-0x0000000004D46000-memory.dmpFilesize
2.5MB
-
memory/4208-160-0x0000000004AD0000-0x0000000004D46000-memory.dmpFilesize
2.5MB
-
memory/4208-162-0x0000000004AD0000-0x0000000004D46000-memory.dmpFilesize
2.5MB
-
memory/4208-164-0x0000000004AD0000-0x0000000004D46000-memory.dmpFilesize
2.5MB
-
memory/4208-166-0x0000000004AD0000-0x0000000004D46000-memory.dmpFilesize
2.5MB
-
memory/4208-143-0x0000000004AD0000-0x0000000004D46000-memory.dmpFilesize
2.5MB
-
memory/4208-170-0x0000000004AD0000-0x0000000004D46000-memory.dmpFilesize
2.5MB
-
memory/4208-172-0x0000000004AD0000-0x0000000004D46000-memory.dmpFilesize
2.5MB
-
memory/4208-174-0x0000000004AD0000-0x0000000004D46000-memory.dmpFilesize
2.5MB
-
memory/4208-176-0x0000000004AD0000-0x0000000004D46000-memory.dmpFilesize
2.5MB
-
memory/4208-178-0x0000000004AD0000-0x0000000004D46000-memory.dmpFilesize
2.5MB
-
memory/4208-146-0x0000000004AC0000-0x0000000004AD0000-memory.dmpFilesize
64KB
-
memory/4208-182-0x0000000004AD0000-0x0000000004D46000-memory.dmpFilesize
2.5MB
-
memory/4208-184-0x0000000004AD0000-0x0000000004D46000-memory.dmpFilesize
2.5MB
-
memory/4208-186-0x0000000004AD0000-0x0000000004D46000-memory.dmpFilesize
2.5MB
-
memory/4208-188-0x0000000004AD0000-0x0000000004D46000-memory.dmpFilesize
2.5MB
-
memory/4208-190-0x0000000004AD0000-0x0000000004D46000-memory.dmpFilesize
2.5MB
-
memory/4208-192-0x0000000004AD0000-0x0000000004D46000-memory.dmpFilesize
2.5MB
-
memory/4208-194-0x0000000004AD0000-0x0000000004D46000-memory.dmpFilesize
2.5MB
-
memory/4208-196-0x0000000004AD0000-0x0000000004D46000-memory.dmpFilesize
2.5MB
-
memory/4208-198-0x0000000004AD0000-0x0000000004D46000-memory.dmpFilesize
2.5MB
-
memory/4208-141-0x0000000004AD0000-0x0000000004D46000-memory.dmpFilesize
2.5MB
-
memory/4208-139-0x0000000004AD0000-0x0000000004D46000-memory.dmpFilesize
2.5MB
-
memory/4208-137-0x0000000004AD0000-0x0000000004D46000-memory.dmpFilesize
2.5MB
-
memory/4208-135-0x0000000004AD0000-0x0000000004D46000-memory.dmpFilesize
2.5MB
-
memory/4208-134-0x0000000004AD0000-0x0000000004D46000-memory.dmpFilesize
2.5MB
-
memory/4208-133-0x00000000000D0000-0x0000000000218000-memory.dmpFilesize
1.3MB
-
memory/4208-786-0x0000000004AC0000-0x0000000004AD0000-memory.dmpFilesize
64KB
-
memory/4208-10258-0x00000000008B0000-0x00000000008D2000-memory.dmpFilesize
136KB
-
memory/4208-10259-0x00000000359B0000-0x0000000035A16000-memory.dmpFilesize
408KB
-
memory/4208-10260-0x0000000035C20000-0x0000000035CB2000-memory.dmpFilesize
584KB
-
memory/4208-10261-0x0000000036270000-0x0000000036814000-memory.dmpFilesize
5.6MB