Analysis
-
max time kernel
184s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
14-11-2023 19:18
General
-
Target
41e1ac9c4acfe3fbb09f212ef7f3534baa74413cf4830ad934a0ef435ddf1034.exe
-
Size
3.7MB
-
MD5
9b2f1f65ce3f58b4ce229409f39a8d2b
-
SHA1
5699542019f22d4f44ee2f8a63b5980b819ce72d
-
SHA256
41e1ac9c4acfe3fbb09f212ef7f3534baa74413cf4830ad934a0ef435ddf1034
-
SHA512
028f195e504c8da9150834438a3abc76c8a3d2a42cdec4e8c17e7e48aa0fae73470575f8eb3bff97c47b951f612f1533f06fd627c282df258ff34e543a94e2fa
-
SSDEEP
98304:TkMZ2Vi5bIn6tDdz2JLOsWynvvPUiXYT1/mxGlof6:TkMAA586tDdzALOs5vnUiXYguF
Malware Config
Extracted
redline
95.181.152.8:46927
-
auth_value
cdf3919a262c0d6ba99116b375d7551c
Signatures
-
Gurcu, WhiteSnake
Gurcu is a malware stealer written in C#.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 37 IoCs
-
Suspicious use of AdjustPrivilegeToken 39 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\41e1ac9c4acfe3fbb09f212ef7f3534baa74413cf4830ad934a0ef435ddf1034.exe"C:\Users\Admin\AppData\Local\Temp\41e1ac9c4acfe3fbb09f212ef7f3534baa74413cf4830ad934a0ef435ddf1034.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\@zxckostyan4ik_crypted.exeC:\Users\Admin\AppData\Local\Temp\@zxckostyan4ik_crypted.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe#cmd3⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\Smithianism.exeC:\Users\Admin\AppData\Local\Temp\Smithianism.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
506KB
MD552cbba6d520f8f9c3f5425824fb23f78
SHA1d4fa4290fe4729ee0a924712ad0f1a3cd4f11506
SHA2569dd44e1f1893d46a4fa68bd19a2ad6b49b87bd0f47432dd2497f2a1f0d32d560
SHA5120fce8f90ed02b3cf15e09878d220f946e8900b409f4d7d894df11fe37db39d89769d55194738f0ba85b9c6de2e664f2bc0913b5b1426df1945cbdb8ac8611222
-
Filesize
506KB
MD552cbba6d520f8f9c3f5425824fb23f78
SHA1d4fa4290fe4729ee0a924712ad0f1a3cd4f11506
SHA2569dd44e1f1893d46a4fa68bd19a2ad6b49b87bd0f47432dd2497f2a1f0d32d560
SHA5120fce8f90ed02b3cf15e09878d220f946e8900b409f4d7d894df11fe37db39d89769d55194738f0ba85b9c6de2e664f2bc0913b5b1426df1945cbdb8ac8611222
-
Filesize
3.6MB
MD5355a3913d57c678eaae265f11b9e4262
SHA196b85ab1767ad661f6f94e647899179c3e74c5a5
SHA2567f4827e9d612ba8ab56b4122dc1ee018e8bb84e8a6918e8953d2eb101d824d3c
SHA512e04e331774013ce12ab5cf184d371304272a236846d4c82835595c9572244115adca1dad2348e6780c07c73948b043db2f61504766f8aec578383719c280d363
-
Filesize
3.6MB
MD5355a3913d57c678eaae265f11b9e4262
SHA196b85ab1767ad661f6f94e647899179c3e74c5a5
SHA2567f4827e9d612ba8ab56b4122dc1ee018e8bb84e8a6918e8953d2eb101d824d3c
SHA512e04e331774013ce12ab5cf184d371304272a236846d4c82835595c9572244115adca1dad2348e6780c07c73948b043db2f61504766f8aec578383719c280d363
-
Filesize
72KB
-
Filesize
2.0MB
-
Filesize
3.6MB
-
Filesize
688KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
104KB
-
Filesize
240KB
-
Filesize
72KB
-
Filesize
688KB
-
Filesize
64KB
-
Filesize
688KB
-
Filesize
2.8MB
-
Filesize
760KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
4.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
3.1MB
-
Filesize
64KB
-
Filesize
3.1MB
-
Filesize
2.3MB
-
Filesize
128KB
-
Filesize
408KB
-
Filesize
72KB
-
Filesize
7.7MB
-
Filesize
6.1MB
-
Filesize
7.7MB
-
Filesize
1.0MB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
10.8MB
-
Filesize
120KB
-
Filesize
472KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
520KB