Analysis
-
max time kernel
120s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
14-12-2023 19:06
Static task
static1
Behavioral task
behavioral1
Sample
2CDE23B16BD96A257BB37E37DF2C48D6.exe
Resource
win7-20231129-en
General
-
Target
2CDE23B16BD96A257BB37E37DF2C48D6.exe
-
Size
655KB
-
MD5
2cde23b16bd96a257bb37e37df2c48d6
-
SHA1
1abb9a627d97d8dce69e3cb1f839a190de909887
-
SHA256
7d7aa96711d95594ef9c4d53d4698ec8d845c501e4a18ccd09fdc1dca58a4235
-
SHA512
28440d2947d5dc4aa3981dca38e9baf5acb24d6b8792d69ce3424779ed5ec0837d0cc809b13b312f92357a7b2cb0c2a388737cbb8935cb15ceeb37d3b40bcd32
-
SSDEEP
12288:Rb27ADkIB4y8HJYqj+BZjHkTy7E75dJHMvJHHqn9GW2Ju:Rb27YZcj3DldJHMvlqn9GV
Malware Config
Extracted
redline
5
janaremrau.com:80
Signatures
-
Detect ZGRat V1 35 IoCs
Processes:
resource yara_rule behavioral1/memory/2868-2-0x0000000000BE0000-0x0000000000C88000-memory.dmp family_zgrat_v1 behavioral1/memory/2868-3-0x0000000000B60000-0x0000000000BA0000-memory.dmp family_zgrat_v1 behavioral1/memory/2868-11-0x0000000000BE0000-0x0000000000C83000-memory.dmp family_zgrat_v1 behavioral1/memory/2868-21-0x0000000000BE0000-0x0000000000C83000-memory.dmp family_zgrat_v1 behavioral1/memory/2868-25-0x0000000000BE0000-0x0000000000C83000-memory.dmp family_zgrat_v1 behavioral1/memory/2868-27-0x0000000000BE0000-0x0000000000C83000-memory.dmp family_zgrat_v1 behavioral1/memory/2868-31-0x0000000000BE0000-0x0000000000C83000-memory.dmp family_zgrat_v1 behavioral1/memory/2868-41-0x0000000000BE0000-0x0000000000C83000-memory.dmp family_zgrat_v1 behavioral1/memory/2868-53-0x0000000000BE0000-0x0000000000C83000-memory.dmp family_zgrat_v1 behavioral1/memory/2868-57-0x0000000000BE0000-0x0000000000C83000-memory.dmp family_zgrat_v1 behavioral1/memory/2868-65-0x0000000000BE0000-0x0000000000C83000-memory.dmp family_zgrat_v1 behavioral1/memory/2868-67-0x0000000000BE0000-0x0000000000C83000-memory.dmp family_zgrat_v1 behavioral1/memory/2868-63-0x0000000000BE0000-0x0000000000C83000-memory.dmp family_zgrat_v1 behavioral1/memory/2868-61-0x0000000000BE0000-0x0000000000C83000-memory.dmp family_zgrat_v1 behavioral1/memory/2868-59-0x0000000000BE0000-0x0000000000C83000-memory.dmp family_zgrat_v1 behavioral1/memory/2868-55-0x0000000000BE0000-0x0000000000C83000-memory.dmp family_zgrat_v1 behavioral1/memory/2868-51-0x0000000000BE0000-0x0000000000C83000-memory.dmp family_zgrat_v1 behavioral1/memory/2868-49-0x0000000000BE0000-0x0000000000C83000-memory.dmp family_zgrat_v1 behavioral1/memory/2868-47-0x0000000000BE0000-0x0000000000C83000-memory.dmp family_zgrat_v1 behavioral1/memory/2868-45-0x0000000000BE0000-0x0000000000C83000-memory.dmp family_zgrat_v1 behavioral1/memory/2868-43-0x0000000000BE0000-0x0000000000C83000-memory.dmp family_zgrat_v1 behavioral1/memory/2868-39-0x0000000000BE0000-0x0000000000C83000-memory.dmp family_zgrat_v1 behavioral1/memory/2868-37-0x0000000000BE0000-0x0000000000C83000-memory.dmp family_zgrat_v1 behavioral1/memory/2868-35-0x0000000000BE0000-0x0000000000C83000-memory.dmp family_zgrat_v1 behavioral1/memory/2868-33-0x0000000000BE0000-0x0000000000C83000-memory.dmp family_zgrat_v1 behavioral1/memory/2868-29-0x0000000000BE0000-0x0000000000C83000-memory.dmp family_zgrat_v1 behavioral1/memory/2868-23-0x0000000000BE0000-0x0000000000C83000-memory.dmp family_zgrat_v1 behavioral1/memory/2868-19-0x0000000000BE0000-0x0000000000C83000-memory.dmp family_zgrat_v1 behavioral1/memory/2868-17-0x0000000000BE0000-0x0000000000C83000-memory.dmp family_zgrat_v1 behavioral1/memory/2868-15-0x0000000000BE0000-0x0000000000C83000-memory.dmp family_zgrat_v1 behavioral1/memory/2868-13-0x0000000000BE0000-0x0000000000C83000-memory.dmp family_zgrat_v1 behavioral1/memory/2868-9-0x0000000000BE0000-0x0000000000C83000-memory.dmp family_zgrat_v1 behavioral1/memory/2868-7-0x0000000000BE0000-0x0000000000C83000-memory.dmp family_zgrat_v1 behavioral1/memory/2868-5-0x0000000000BE0000-0x0000000000C83000-memory.dmp family_zgrat_v1 behavioral1/memory/2868-4-0x0000000000BE0000-0x0000000000C83000-memory.dmp family_zgrat_v1 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2288-945-0x0000000000400000-0x000000000043C000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
2CDE23B16BD96A257BB37E37DF2C48D6.exedescription pid process target process PID 2868 set thread context of 2288 2868 2CDE23B16BD96A257BB37E37DF2C48D6.exe RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
RegAsm.exepid process 2288 RegAsm.exe 2288 RegAsm.exe 2288 RegAsm.exe 2288 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2CDE23B16BD96A257BB37E37DF2C48D6.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 2868 2CDE23B16BD96A257BB37E37DF2C48D6.exe Token: SeDebugPrivilege 2288 RegAsm.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
2CDE23B16BD96A257BB37E37DF2C48D6.exedescription pid process target process PID 2868 wrote to memory of 2288 2868 2CDE23B16BD96A257BB37E37DF2C48D6.exe RegAsm.exe PID 2868 wrote to memory of 2288 2868 2CDE23B16BD96A257BB37E37DF2C48D6.exe RegAsm.exe PID 2868 wrote to memory of 2288 2868 2CDE23B16BD96A257BB37E37DF2C48D6.exe RegAsm.exe PID 2868 wrote to memory of 2288 2868 2CDE23B16BD96A257BB37E37DF2C48D6.exe RegAsm.exe PID 2868 wrote to memory of 2288 2868 2CDE23B16BD96A257BB37E37DF2C48D6.exe RegAsm.exe PID 2868 wrote to memory of 2288 2868 2CDE23B16BD96A257BB37E37DF2C48D6.exe RegAsm.exe PID 2868 wrote to memory of 2288 2868 2CDE23B16BD96A257BB37E37DF2C48D6.exe RegAsm.exe PID 2868 wrote to memory of 2288 2868 2CDE23B16BD96A257BB37E37DF2C48D6.exe RegAsm.exe PID 2868 wrote to memory of 2288 2868 2CDE23B16BD96A257BB37E37DF2C48D6.exe RegAsm.exe PID 2868 wrote to memory of 2288 2868 2CDE23B16BD96A257BB37E37DF2C48D6.exe RegAsm.exe PID 2868 wrote to memory of 2288 2868 2CDE23B16BD96A257BB37E37DF2C48D6.exe RegAsm.exe PID 2868 wrote to memory of 2288 2868 2CDE23B16BD96A257BB37E37DF2C48D6.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2CDE23B16BD96A257BB37E37DF2C48D6.exe"C:\Users\Admin\AppData\Local\Temp\2CDE23B16BD96A257BB37E37DF2C48D6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Tar433D.tmpFilesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
memory/2288-945-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2868-43-0x0000000000BE0000-0x0000000000C83000-memory.dmpFilesize
652KB
-
memory/2868-53-0x0000000000BE0000-0x0000000000C83000-memory.dmpFilesize
652KB
-
memory/2868-21-0x0000000000BE0000-0x0000000000C83000-memory.dmpFilesize
652KB
-
memory/2868-39-0x0000000000BE0000-0x0000000000C83000-memory.dmpFilesize
652KB
-
memory/2868-27-0x0000000000BE0000-0x0000000000C83000-memory.dmpFilesize
652KB
-
memory/2868-35-0x0000000000BE0000-0x0000000000C83000-memory.dmpFilesize
652KB
-
memory/2868-41-0x0000000000BE0000-0x0000000000C83000-memory.dmpFilesize
652KB
-
memory/2868-37-0x0000000000BE0000-0x0000000000C83000-memory.dmpFilesize
652KB
-
memory/2868-57-0x0000000000BE0000-0x0000000000C83000-memory.dmpFilesize
652KB
-
memory/2868-65-0x0000000000BE0000-0x0000000000C83000-memory.dmpFilesize
652KB
-
memory/2868-67-0x0000000000BE0000-0x0000000000C83000-memory.dmpFilesize
652KB
-
memory/2868-63-0x0000000000BE0000-0x0000000000C83000-memory.dmpFilesize
652KB
-
memory/2868-61-0x0000000000BE0000-0x0000000000C83000-memory.dmpFilesize
652KB
-
memory/2868-59-0x0000000000BE0000-0x0000000000C83000-memory.dmpFilesize
652KB
-
memory/2868-55-0x0000000000BE0000-0x0000000000C83000-memory.dmpFilesize
652KB
-
memory/2868-51-0x0000000000BE0000-0x0000000000C83000-memory.dmpFilesize
652KB
-
memory/2868-49-0x0000000000BE0000-0x0000000000C83000-memory.dmpFilesize
652KB
-
memory/2868-47-0x0000000000BE0000-0x0000000000C83000-memory.dmpFilesize
652KB
-
memory/2868-45-0x0000000000BE0000-0x0000000000C83000-memory.dmpFilesize
652KB
-
memory/2868-0-0x0000000000E50000-0x0000000000EFA000-memory.dmpFilesize
680KB
-
memory/2868-25-0x0000000000BE0000-0x0000000000C83000-memory.dmpFilesize
652KB
-
memory/2868-11-0x0000000000BE0000-0x0000000000C83000-memory.dmpFilesize
652KB
-
memory/2868-31-0x0000000000BE0000-0x0000000000C83000-memory.dmpFilesize
652KB
-
memory/2868-33-0x0000000000BE0000-0x0000000000C83000-memory.dmpFilesize
652KB
-
memory/2868-29-0x0000000000BE0000-0x0000000000C83000-memory.dmpFilesize
652KB
-
memory/2868-23-0x0000000000BE0000-0x0000000000C83000-memory.dmpFilesize
652KB
-
memory/2868-19-0x0000000000BE0000-0x0000000000C83000-memory.dmpFilesize
652KB
-
memory/2868-17-0x0000000000BE0000-0x0000000000C83000-memory.dmpFilesize
652KB
-
memory/2868-15-0x0000000000BE0000-0x0000000000C83000-memory.dmpFilesize
652KB
-
memory/2868-13-0x0000000000BE0000-0x0000000000C83000-memory.dmpFilesize
652KB
-
memory/2868-9-0x0000000000BE0000-0x0000000000C83000-memory.dmpFilesize
652KB
-
memory/2868-7-0x0000000000BE0000-0x0000000000C83000-memory.dmpFilesize
652KB
-
memory/2868-5-0x0000000000BE0000-0x0000000000C83000-memory.dmpFilesize
652KB
-
memory/2868-4-0x0000000000BE0000-0x0000000000C83000-memory.dmpFilesize
652KB
-
memory/2868-926-0x00000000007C0000-0x00000000007C1000-memory.dmpFilesize
4KB
-
memory/2868-928-0x0000000004340000-0x000000000438C000-memory.dmpFilesize
304KB
-
memory/2868-927-0x0000000004300000-0x0000000004342000-memory.dmpFilesize
264KB
-
memory/2868-941-0x0000000073F30000-0x000000007461E000-memory.dmpFilesize
6.9MB
-
memory/2868-3-0x0000000000B60000-0x0000000000BA0000-memory.dmpFilesize
256KB
-
memory/2868-2-0x0000000000BE0000-0x0000000000C88000-memory.dmpFilesize
672KB
-
memory/2868-1-0x0000000073F30000-0x000000007461E000-memory.dmpFilesize
6.9MB