Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
07-05-2023 04:39
Static task
static1
Behavioral task
behavioral1
Sample
94137cbe1455e824d25c59e3c5a0daf2b9274b055cf6e20800efa7713d10c1ac.ps1
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
94137cbe1455e824d25c59e3c5a0daf2b9274b055cf6e20800efa7713d10c1ac.ps1
Resource
win10v2004-20230220-en
General
-
Target
94137cbe1455e824d25c59e3c5a0daf2b9274b055cf6e20800efa7713d10c1ac.ps1
-
Size
801KB
-
MD5
7660ddcbb1eeb5db743604a0487f144c
-
SHA1
2a8ddaa0c0da3fb447ea70abedd27f5c7709bb77
-
SHA256
94137cbe1455e824d25c59e3c5a0daf2b9274b055cf6e20800efa7713d10c1ac
-
SHA512
6ed5131ef7cc08eabead72bcc983d59b41032db698db8ae421a8c0abc8e180550f4ce5ef156d6d64606cdb3bd375408c68a8dc37cb5206c42785a80abd7f4ff6
-
SSDEEP
12288:OZmTk3LmZmTk3Lv2RDsUU1Vq2RDsUU1VW2RDsUU1V2:OZmTAKZmTAr25gq25gW25g2
Malware Config
Extracted
revengerat
NyanCatRevenge
b2b.ddns.com.br:5222
d9261ef3301b4b86a95
Signatures
-
Detects Redline Stealer samples 2 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
Processes:
resource yara_rule behavioral1/memory/1284-58-0x000000001B1D0000-0x000000001B4B2000-memory.dmp redline_stealer behavioral1/memory/1284-61-0x0000000002470000-0x00000000024F0000-memory.dmp redline_stealer -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 1284 set thread context of 588 1284 powershell.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1284 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1284 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
powershell.exedescription pid process target process PID 1284 wrote to memory of 588 1284 powershell.exe RegSvcs.exe PID 1284 wrote to memory of 588 1284 powershell.exe RegSvcs.exe PID 1284 wrote to memory of 588 1284 powershell.exe RegSvcs.exe PID 1284 wrote to memory of 588 1284 powershell.exe RegSvcs.exe PID 1284 wrote to memory of 588 1284 powershell.exe RegSvcs.exe PID 1284 wrote to memory of 588 1284 powershell.exe RegSvcs.exe PID 1284 wrote to memory of 588 1284 powershell.exe RegSvcs.exe PID 1284 wrote to memory of 588 1284 powershell.exe RegSvcs.exe PID 1284 wrote to memory of 588 1284 powershell.exe RegSvcs.exe PID 1284 wrote to memory of 588 1284 powershell.exe RegSvcs.exe PID 1284 wrote to memory of 588 1284 powershell.exe RegSvcs.exe PID 1284 wrote to memory of 588 1284 powershell.exe RegSvcs.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\94137cbe1455e824d25c59e3c5a0daf2b9274b055cf6e20800efa7713d10c1ac.ps11⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/588-76-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/588-87-0x0000000004B30000-0x0000000004B70000-memory.dmpFilesize
256KB
-
memory/588-86-0x0000000004B30000-0x0000000004B70000-memory.dmpFilesize
256KB
-
memory/588-85-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/588-83-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/588-81-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/588-80-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/588-79-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/588-78-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/588-77-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1284-63-0x000000001B690000-0x000000001B6B0000-memory.dmpFilesize
128KB
-
memory/1284-67-0x000000001B690000-0x000000001B6A8000-memory.dmpFilesize
96KB
-
memory/1284-65-0x000000001B690000-0x000000001B6A8000-memory.dmpFilesize
96KB
-
memory/1284-69-0x000000001B690000-0x000000001B6A8000-memory.dmpFilesize
96KB
-
memory/1284-71-0x000000001B690000-0x000000001B6A8000-memory.dmpFilesize
96KB
-
memory/1284-75-0x000000001B690000-0x000000001B6A8000-memory.dmpFilesize
96KB
-
memory/1284-73-0x000000001B690000-0x000000001B6A8000-memory.dmpFilesize
96KB
-
memory/1284-64-0x000000001B690000-0x000000001B6A8000-memory.dmpFilesize
96KB
-
memory/1284-58-0x000000001B1D0000-0x000000001B4B2000-memory.dmpFilesize
2.9MB
-
memory/1284-62-0x0000000002470000-0x00000000024F0000-memory.dmpFilesize
512KB
-
memory/1284-61-0x0000000002470000-0x00000000024F0000-memory.dmpFilesize
512KB
-
memory/1284-60-0x0000000002470000-0x00000000024F0000-memory.dmpFilesize
512KB
-
memory/1284-59-0x0000000002660000-0x0000000002668000-memory.dmpFilesize
32KB