Resubmissions

06-07-2023 06:59

230706-hr9qgahc95 10

Analysis

  • max time kernel
    14s
  • max time network
    21s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    06-07-2023 06:59

General

  • Target

    Comet Executor/Comet.exe

  • Size

    350.0MB

  • MD5

    b7fe913c365f483fc79be7d81c7445c2

  • SHA1

    23cfb242c4610f3de72521f78c8af219dac57451

  • SHA256

    72d28771d21b24cadbd362ca08e16653d13080c3551e6b1dec4f32132d7a1bee

  • SHA512

    ff7cea53e441fd56f1b36672b5338c725477b5960fb279d141f7f4c04f5750ad88c645d94b942c4f9cf007f52850b708205ec1c732aeea05a9cf1a4e070a5fb1

  • SSDEEP

    24576:rcfBkcC1amUUoLK4N8vnxQtQHEZe0EVzkLzgjcV4CKo0/fOA2tdvU/:rcfKcF9dN86/bE2AcV4Cf0OtxU

Malware Config

Extracted

Family

redline

Botnet

@dxrkl0rd

C2

91.103.252.8:29975

Attributes
  • auth_value

    9750c50e8073b21d538cfb6d993427dc

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Comet Executor\Comet.exe
    "C:\Users\Admin\AppData\Local\Temp\Comet Executor\Comet.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4520
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:232

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/232-207-0x0000000000400000-0x0000000000426000-memory.dmp
    Filesize

    152KB

  • memory/232-219-0x0000000007080000-0x00000000075AC000-memory.dmp
    Filesize

    5.2MB

  • memory/232-218-0x0000000006980000-0x0000000006B42000-memory.dmp
    Filesize

    1.8MB

  • memory/232-217-0x0000000005F20000-0x0000000005F3E000-memory.dmp
    Filesize

    120KB

  • memory/232-216-0x0000000005FC0000-0x0000000006036000-memory.dmp
    Filesize

    472KB

  • memory/232-215-0x0000000005E00000-0x0000000005E50000-memory.dmp
    Filesize

    320KB

  • memory/232-214-0x0000000005290000-0x00000000052F6000-memory.dmp
    Filesize

    408KB

  • memory/232-213-0x0000000005280000-0x0000000005290000-memory.dmp
    Filesize

    64KB

  • memory/232-212-0x0000000004F50000-0x0000000004F9B000-memory.dmp
    Filesize

    300KB

  • memory/232-211-0x0000000004F10000-0x0000000004F4E000-memory.dmp
    Filesize

    248KB

  • memory/232-210-0x0000000004FE0000-0x00000000050EA000-memory.dmp
    Filesize

    1.0MB

  • memory/232-209-0x0000000004EB0000-0x0000000004EC2000-memory.dmp
    Filesize

    72KB

  • memory/232-208-0x00000000054A0000-0x0000000005AA6000-memory.dmp
    Filesize

    6.0MB

  • memory/4520-140-0x0000000005550000-0x00000000055BF000-memory.dmp
    Filesize

    444KB

  • memory/4520-178-0x0000000005550000-0x00000000055BF000-memory.dmp
    Filesize

    444KB

  • memory/4520-144-0x0000000005550000-0x00000000055BF000-memory.dmp
    Filesize

    444KB

  • memory/4520-146-0x0000000005550000-0x00000000055BF000-memory.dmp
    Filesize

    444KB

  • memory/4520-148-0x0000000005550000-0x00000000055BF000-memory.dmp
    Filesize

    444KB

  • memory/4520-150-0x0000000005550000-0x00000000055BF000-memory.dmp
    Filesize

    444KB

  • memory/4520-152-0x0000000005550000-0x00000000055BF000-memory.dmp
    Filesize

    444KB

  • memory/4520-154-0x0000000005550000-0x00000000055BF000-memory.dmp
    Filesize

    444KB

  • memory/4520-156-0x0000000005550000-0x00000000055BF000-memory.dmp
    Filesize

    444KB

  • memory/4520-158-0x0000000005550000-0x00000000055BF000-memory.dmp
    Filesize

    444KB

  • memory/4520-160-0x0000000005550000-0x00000000055BF000-memory.dmp
    Filesize

    444KB

  • memory/4520-162-0x0000000005550000-0x00000000055BF000-memory.dmp
    Filesize

    444KB

  • memory/4520-164-0x0000000005550000-0x00000000055BF000-memory.dmp
    Filesize

    444KB

  • memory/4520-166-0x0000000005550000-0x00000000055BF000-memory.dmp
    Filesize

    444KB

  • memory/4520-168-0x0000000005550000-0x00000000055BF000-memory.dmp
    Filesize

    444KB

  • memory/4520-170-0x0000000005550000-0x00000000055BF000-memory.dmp
    Filesize

    444KB

  • memory/4520-172-0x0000000005550000-0x00000000055BF000-memory.dmp
    Filesize

    444KB

  • memory/4520-174-0x0000000005550000-0x00000000055BF000-memory.dmp
    Filesize

    444KB

  • memory/4520-176-0x0000000005550000-0x00000000055BF000-memory.dmp
    Filesize

    444KB

  • memory/4520-142-0x0000000005550000-0x00000000055BF000-memory.dmp
    Filesize

    444KB

  • memory/4520-180-0x0000000005550000-0x00000000055BF000-memory.dmp
    Filesize

    444KB

  • memory/4520-182-0x0000000005550000-0x00000000055BF000-memory.dmp
    Filesize

    444KB

  • memory/4520-201-0x0000000005BB0000-0x00000000060AE000-memory.dmp
    Filesize

    5.0MB

  • memory/4520-202-0x0000000005750000-0x00000000057E2000-memory.dmp
    Filesize

    584KB

  • memory/4520-203-0x00000000056A0000-0x00000000056B0000-memory.dmp
    Filesize

    64KB

  • memory/4520-204-0x00000000055F0000-0x00000000055F1000-memory.dmp
    Filesize

    4KB

  • memory/4520-117-0x0000000000A00000-0x0000000000DD4000-memory.dmp
    Filesize

    3.8MB

  • memory/4520-138-0x0000000005550000-0x00000000055BF000-memory.dmp
    Filesize

    444KB

  • memory/4520-136-0x0000000005550000-0x00000000055BF000-memory.dmp
    Filesize

    444KB

  • memory/4520-134-0x0000000005550000-0x00000000055BF000-memory.dmp
    Filesize

    444KB

  • memory/4520-132-0x0000000005550000-0x00000000055BF000-memory.dmp
    Filesize

    444KB

  • memory/4520-130-0x0000000005550000-0x00000000055BF000-memory.dmp
    Filesize

    444KB

  • memory/4520-128-0x0000000005550000-0x00000000055BF000-memory.dmp
    Filesize

    444KB

  • memory/4520-126-0x0000000005550000-0x00000000055BF000-memory.dmp
    Filesize

    444KB

  • memory/4520-124-0x0000000005550000-0x00000000055BF000-memory.dmp
    Filesize

    444KB

  • memory/4520-122-0x0000000005550000-0x00000000055BF000-memory.dmp
    Filesize

    444KB

  • memory/4520-120-0x0000000005550000-0x00000000055BF000-memory.dmp
    Filesize

    444KB

  • memory/4520-119-0x0000000005550000-0x00000000055BF000-memory.dmp
    Filesize

    444KB

  • memory/4520-118-0x0000000005550000-0x00000000055C4000-memory.dmp
    Filesize

    464KB